@zintrust/core 0.4.18 → 0.4.19

package/src/middleware/RateLimiter.d.ts

@@ -4,6 +4,7 @@
  * Zero-dependency implementation
  */
 import type { IRequest } from '../http/Request';
+import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
 import type { Middleware } from './MiddlewareStack';
 export interface RateLimitOptions {
     windowMs: number;
@@ -20,6 +21,7 @@ export interface RateLimitOptions {
      * - 'db' uses Cache.store('mongodb')
      */
     store?: RateLimitStoreName;
+    onFailure?: MiddlewareFailureResponder;
 }
 export type RateLimitStoreName = 'memory' | 'redis' | 'kv' | 'db';
 export declare const RateLimiter: Readonly<{

package/src/middleware/RateLimiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC;IAEzC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAqKlE,eAAO,MAAM,WAAW;IACtB;;;OAGG;uBACgB;QAAE,KAAK,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI;IAKxD;;;;OAIG;iBACgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;OAEG;yBACwB,MAAM,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE;;;OAGG;cACa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxC;;OAEG;eACc,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;qBACa,gBAAgB,GAAqB,UAAU;EAgF/D,CAAC"}
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC;IAEzC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACxC;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAqKlE,eAAO,MAAM,WAAW;IACtB;;;OAGG;uBACgB;QAAE,KAAK,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI;IAKxD;;;;OAIG;iBACgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;OAEG;yBACwB,MAAM,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE;;;OAGG;cACa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxC;;OAEG;eACc,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;qBACa,gBAAgB,GAAqB,UAAU;EAqF/D,CAAC"}

package/src/middleware/RateLimiter.js

@@ -6,6 +6,7 @@
 import { Cache } from '../cache/Cache.js';
 import { Env } from '../config/env.js';
 import { Logger } from '../config/logger.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 const createMemoryStore = () => {
     const entries = new Map();
     let nextCleanupAt = Date.now() + 60_000;
@@ -257,10 +258,15 @@ export const RateLimiter = Object.freeze({
             // Check limit
             if (count > config.max) {
                 Logger.warn(`Rate limit exceeded for IP: ${key}`);
-                res.setStatus(config.statusCode ?? 429);
-                res.json({
-                    error: 'Too Many Requests',
-                    message: config.message,
+                await respondWithMiddlewareFailure(req, res, config.onFailure, {
+                    middleware: 'rateLimit',
+                    reason: 'rate_limit_exceeded',
+                    statusCode: config.statusCode ?? 429,
+                    message: config.message ?? 'Too many requests',
+                    body: {
+                        error: 'Too Many Requests',
+                        message: config.message,
+                    },
                 });
                 return;
             }

package/src/middleware/ValidationMiddleware.d.ts

@@ -1,12 +1,17 @@
+import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
 import type { Middleware } from './MiddlewareStack';
 import type { ISchema, TypedSchema } from '../validation/Validator';
+type ValidationMiddlewareOptions = Readonly<{
+    onFailure?: MiddlewareFailureResponder;
+    middlewareKey?: string;
+}>;
 type FieldSanitizers = Readonly<Record<string, (value: unknown) => unknown>>;
 export declare const ValidationMiddleware: Readonly<{
-    create(schema: ISchema): Middleware;
-    createBody<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
-    createBodyWithSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers): Middleware;
-    createQuery<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
-    createParams<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
+    create(schema: ISchema, options?: ValidationMiddlewareOptions): Middleware;
+    createBody<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
+    createBodyWithSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers, options?: ValidationMiddlewareOptions): Middleware;
+    createQuery<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
+    createParams<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
     /**
      * Create body validation middleware with bulletproof sanitization error handling.
      * Automatically converts SanitizerError to 422 validation response.
@@ -19,7 +24,7 @@ export declare const ValidationMiddleware: Readonly<{
      * @param sanitizers - Optional field sanitizers to apply before validation
      * @returns Middleware with bulletproof error handling
      */
-    createBodyWithBulletproofSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers): Middleware;
+    createBodyWithBulletproofSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers, options?: ValidationMiddlewareOptions): Middleware;
 }>;
 export {};
 //# sourceMappingURL=ValidationMiddleware.d.ts.map

package/src/middleware/ValidationMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ValidationMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/ValidationMiddleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAe,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAW/E,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AAqG7E,eAAO,MAAM,oBAAoB;mBAChB,OAAO,GAAG,UAAU;eAwBxB,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;+BA0BlD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrD,OAAO,eACF,eAAe,GAC3B,UAAU;gBA6BD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;iBAejE,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;IAe/E;;;;;;;;;;;OAWG;0CACmC,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAChE,OAAO,eACF,eAAe,GAC3B,UAAU;EAqCb,CAAC"}
+{"version":3,"file":"ValidationMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/ValidationMiddleware.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAe,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAI/E,KAAK,2BAA2B,GAAG,QAAQ,CAAC;IAC1C,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAQH,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AA+H7E,eAAO,MAAM,oBAAoB;mBAChB,OAAO,YAAW,2BAA2B,GAAQ,UAAU;eAwBnE,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrC,OAAO,YACN,2BAA2B,GACnC,UAAU;+BA0Bc,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrD,OAAO,eACF,eAAe,YACnB,2BAA2B,GACnC,UAAU;gBA6BD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACtC,OAAO,YACN,2BAA2B,GACnC,UAAU;iBAeA,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACvC,OAAO,YACN,2BAA2B,GACnC,UAAU;IAeb;;;;;;;;;;;OAWG;0CACmC,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAChE,OAAO,eACF,eAAe,YACnB,2BAA2B,GACnC,UAAU;EA4Cb,CAAC"}

package/src/middleware/ValidationMiddleware.js

@@ -1,5 +1,6 @@
 import { Env } from '../config/env.js';
 import { Logger } from '../config/logger.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 import { Xss } from '../security/Xss.js';
 import { Validator } from '../validation/Validator.js';
 const toRecord = (value) => {
@@ -73,7 +74,7 @@ const getBodyForValidation = (req) => {
     const raw = safeCall(() => req.getBody?.());
     return toBodyRecord(raw);
 };
-const handleValidationError = (res, error) => {
+const handleValidationError = async (req, res, error, options) => {
     // Temporary: log validation error details to help debugging failing requests.
     // Remove this detailed debug logging once the issue is investigated.
     Logger.warn('Validation failed');
@@ -88,21 +89,42 @@ const handleValidationError = (res, error) => {
                 // best-effort: fall back to direct log
                 Logger.debug('[Validation] errors (toObject threw):', err);
             }
-            res.setStatus(422).json({ errors: err.toObject() });
+            await respondWithMiddlewareFailure(req, res, options.onFailure, {
+                middleware: options.middlewareKey ?? 'validation',
+                reason: 'validation_error',
+                statusCode: 422,
+                message: 'Validation failed',
+                body: { errors: err.toObject() },
+                error,
+            });
             return;
         }
         // Fallback: log raw error
         Logger.debug('[Validation] error:', err);
-        res.setStatus(400).json({ error: 'Invalid request body' });
+        await respondWithMiddlewareFailure(req, res, options.onFailure, {
+            middleware: options.middlewareKey ?? 'validation',
+            reason: 'invalid_request_body',
+            statusCode: 400,
+            message: 'Invalid request body',
+            body: { error: 'Invalid request body' },
+            error,
+        });
     }
     catch (error_) {
         // Ensure we don't throw while handling validation errors
         Logger.debug('[Validation] failed to log error details:', error_);
-        res.setStatus(400).json({ error: 'Invalid request body' });
+        await respondWithMiddlewareFailure(req, res, options.onFailure, {
+            middleware: options.middlewareKey ?? 'validation',
+            reason: 'invalid_request_body',
+            statusCode: 400,
+            message: 'Invalid request body',
+            body: { error: 'Invalid request body' },
+            error,
+        });
     }
 };
 export const ValidationMiddleware = Object.freeze({
-    create(schema) {
+    create(schema, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -120,11 +142,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createBody(schema) {
+    createBody(schema, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -142,11 +164,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createBodyWithSanitization(schema, sanitizers) {
+    createBodyWithSanitization(schema, sanitizers, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -165,11 +187,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createQuery(schema) {
+    createQuery(schema, options = {}) {
         return async (req, res, next) => {
             try {
                 const query = toRecord(req.getQuery());
@@ -178,11 +200,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createParams(schema) {
+    createParams(schema, options = {}) {
         return async (req, res, next) => {
             try {
                 const params = toRecord(req.getParams());
@@ -191,7 +213,7 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
@@ -207,7 +229,7 @@ export const ValidationMiddleware = Object.freeze({
      * @param sanitizers - Optional field sanitizers to apply before validation
      * @returns Middleware with bulletproof error handling
      */
-    createBodyWithBulletproofSanitization(schema, sanitizers) {
+    createBodyWithBulletproofSanitization(schema, sanitizers, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -228,14 +250,21 @@ export const ValidationMiddleware = Object.freeze({
             catch (error) {
                 // Handle SanitizerError by converting to validation error format
                 if (isSanitizerError(error)) {
-                    res.setStatus(422).json({
-                        errors: {
-                            sanitization: [error.message],
+                    await respondWithMiddlewareFailure(req, res, options.onFailure, {
+                        middleware: options.middlewareKey ?? 'validation',
+                        reason: 'sanitization_error',
+                        statusCode: 422,
+                        message: error.message,
+                        body: {
+                            errors: {
+                                sanitization: [error.message],
+                            },
                         },
+                        error,
                     });
                     return;
                 }
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },

package/src/middleware/index.d.ts

@@ -5,6 +5,7 @@
 export * from './CsrfMiddleware';
 export * from './ErrorHandlerMiddleware';
 export * from './LoggingMiddleware';
+export * from './MiddlewareFailureResponder';
 export * from './MiddlewareStack';
 export * from './RateLimiter';
 export * from './SecurityMiddleware';

package/src/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC"}

package/src/middleware/index.js

@@ -5,6 +5,7 @@
 export * from './CsrfMiddleware.js';
 export * from './ErrorHandlerMiddleware.js';
 export * from './LoggingMiddleware.js';
+export * from './MiddlewareFailureResponder.js';
 export * from './MiddlewareStack.js';
 export * from './RateLimiter.js';
 export * from './SecurityMiddleware.js';

package/src/runtime/WorkersModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkersModule.d.ts","sourceRoot":"","sources":["../../../src/runtime/WorkersModule.ts"],"names":[],"mappings":"AAOA,KAAK,aAAa,GAAG,cAAc,mBAAmB,CAAC,CAAC;AACxD,KAAK,kBAAkB,GAAG,cAAc,yBAAyB,CAAC,CAAC;AA4WnE,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,aAAa,CAwB/D,CAAC;AA4CF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,kBAAkB,CAkBzE,CAAC"}
+{"version":3,"file":"WorkersModule.d.ts","sourceRoot":"","sources":["../../../src/runtime/WorkersModule.ts"],"names":[],"mappings":"AAOA,KAAK,aAAa,GAAG,cAAc,mBAAmB,CAAC,CAAC;AACxD,KAAK,kBAAkB,GAAG,cAAc,yBAAyB,CAAC,CAAC;AA8WnE,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,aAAa,CAwB/D,CAAC;AA4CF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,kBAAkB,CAkBzE,CAAC"}

package/src/runtime/WorkersModule.js

@@ -268,6 +268,7 @@ const isMissingOptionalWorkersModuleError = (error) => {
     });
 };
 const handleImportFailure = async (error) => {
+    let finalError = error;
     if (shouldRetryAfterFailure(error)) {
         patchAfterFailureAttempted = true;
         const { replacements, filesChanged } = patchWorkersDist();
@@ -281,7 +282,7 @@ const handleImportFailure = async (error) => {
                 return await workersModulePromise;
             }
             catch (retryError) {
-                error = retryError;
+                finalError = retryError;
             }
         }
     }
@@ -290,12 +291,12 @@ const handleImportFailure = async (error) => {
         workersModulePromise = Promise.resolve(localFallback);
         return localFallback;
     }
-    if (isMissingOptionalWorkersModuleError(error)) {
+    if (isMissingOptionalWorkersModuleError(finalError)) {
         Logger.info('Optional @zintrust/workers package is unavailable; worker routes are disabled.');
         workersModulePromise = Promise.resolve(createDisabledWorkersModule());
         return workersModulePromise;
     }
-    throw error;
+    throw finalError;
 };
 const tryLocalFallback = async () => {
     const localFallback = await importLocalWorkersModule();

package/src/security/Xss.d.ts

@@ -2,8 +2,8 @@
  * XSS Sanitizer
  * Recursive, zero-dependency input sanitization utility.
  *
- * This is intentionally conservative:
- * - Strings: strip tags, then escape HTML entities.
+ * This is intentionally conservative for request-body handling:
+ * - Strings: strip markup tags but preserve plain text characters.
  * - Arrays/Objects: sanitize recursively.
  */
 export interface IXss {

package/src/security/Xss.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Xss.d.ts","sourceRoot":"","sources":["../../../src/security/Xss.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwDH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,GAAG,EAAE,IAIhB,CAAC;AAEH,eAAe,GAAG,CAAC"}
+{"version":3,"file":"Xss.d.ts","sourceRoot":"","sources":["../../../src/security/Xss.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsDH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,GAAG,EAAE,IAIhB,CAAC;AAEH,eAAe,GAAG,CAAC"}

package/src/security/Xss.js

@@ -2,11 +2,10 @@
  * XSS Sanitizer
  * Recursive, zero-dependency input sanitization utility.
  *
- * This is intentionally conservative:
- * - Strings: strip tags, then escape HTML entities.
+ * This is intentionally conservative for request-body handling:
+ * - Strings: strip markup tags but preserve plain text characters.
  * - Arrays/Objects: sanitize recursively.
  */
-import { XssProtection } from './XssProtection.js';
 const stripTags = (value) => {
     // Remove all HTML tags in linear time (no regex backtracking / ReDoS risk).
     let out = '';
@@ -28,7 +27,7 @@ const stripTags = (value) => {
 };
 const sanitizeRecursive = (input, seen) => {
     if (typeof input === 'string') {
-        return XssProtection.escape(stripTags(input));
+        return stripTags(input);
     }
     if (Array.isArray(input)) {
         if (seen.has(input))

package/src/templates/project/basic/app/Middleware/AuthFailureResponder.ts.tpl

@@ -0,0 +1,10 @@
+import type { MiddlewareFailureResponder } from '@zintrust/core';
+
+export const authFailureResponder: MiddlewareFailureResponder = async (_req, res, context) => {
+  res.setStatus(context.statusCode).json({
+    error: {
+      code: context.reason,
+      message: context.message,
+    },
+  });
+};

package/src/templates/project/basic/config/middleware.ts.tpl

@@ -9,6 +9,12 @@ import type { MiddlewaresType } from '@zintrust/core';
  * 2. Import it below.
  * 3. Register route middleware under `route` or append global middleware under `global`.
  * 4. Use the route key in `routes/*.ts`.
+ * 5. Use `responders` when you only want to reshape built-in failure payloads.
+ *
+ * Built-in middleware keys are overrideable by reusing the same key under `route`.
+ * For example, `route.jwt = MyJwtMiddleware` replaces the framework `jwt` middleware
+ * anywhere that key is used, including shared global slots such as `log`, `error`,
+ * `security`, `rateLimit`, `csrf`, and `sanitizeBody`.
  *
  * For custom route keys, extend the framework type locally in your route file:
  * `type AppMiddlewareKey = MiddlewareKey | 'yourMiddleware';`
@@ -16,6 +22,8 @@ import type { MiddlewaresType } from '@zintrust/core';
 
 // Example custom middleware import:
 // import { AuthMiddleware } from '@app/Middleware/AuthMiddleware';
+// import { authFailureResponder } from '@app/Middleware/AuthFailureResponder';
+// import { JwtAuthOverrideMiddleware } from '@app/Middleware/JwtAuthOverrideMiddleware';
 
 export default {
   skipPaths: Env.get('CSRF_SKIP_PATHS', '')
@@ -37,10 +45,20 @@ export default {
     max: 20,
     message: 'Too many user mutation requests, please try again later.',
   },
+  responders: {
+    // auth: authFailureResponder,
+    // jwt: authFailureResponder,
+    // bulletproof: authFailureResponder,
+    // csrf: authFailureResponder,
+    // rateLimit: authFailureResponder,
+    // error: authFailureResponder,
+  },
   global: [
     // AuthMiddleware,
   ],
   route: {
     // authMiddleware: AuthMiddleware,
+    // Plug-and-play built-in override example:
+    // jwt: JwtAuthOverrideMiddleware,
   },
 } as MiddlewaresType;