@zintrust/core 0.4.18 → 0.4.20

package/src/middleware/ErrorHandlerMiddleware.js

@@ -3,6 +3,7 @@ import { Logger } from '../config/logger.js';
 import ErrorRouting from '../routes/error.js';
 import { ErrorResponse } from '../http/ErrorResponse.js';
 import { RequestContext } from '../http/RequestContext.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 const isWritableEnded = (res) => {
     if (typeof res.getRaw !== 'function')
         return false;
@@ -22,7 +23,7 @@ const shouldHideStackFromResponse = (error) => {
         candidate.statusCode === 404);
 };
 export const ErrorHandlerMiddleware = Object.freeze({
-    create() {
+    create(options = {}) {
         return async (req, res, next) => {
             try {
                 await next();
@@ -40,7 +41,16 @@ export const ErrorHandlerMiddleware = Object.freeze({
                         await handleInternalServerErrorWithWrappers(req, res, error, requestId);
                     }
                     else {
-                        res.json(ErrorResponse.internalServerError('Internal server error', requestId, includeStack ? error?.stack : undefined));
+                        const body = ErrorResponse.internalServerError('Internal server error', requestId, includeStack ? error?.stack : undefined);
+                        await respondWithMiddlewareFailure(req, res, options.onFailure, {
+                            middleware: 'error',
+                            reason: 'unhandled_exception',
+                            statusCode: 500,
+                            message: 'Internal server error',
+                            body,
+                            error,
+                            requestId,
+                        });
                     }
                 }
             }

package/src/middleware/JwtAuthMiddleware.d.ts

@@ -1,8 +1,10 @@
+import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
 import type { Middleware } from './MiddlewareStack';
 import type { JwtAlgorithm } from '../security/JwtManager';
 export interface JwtAuthOptions {
     algorithm?: JwtAlgorithm;
     secret?: string;
+    onUnauthorized?: MiddlewareFailureResponder;
 }
 export declare const JwtAuthMiddleware: Readonly<{
     create(options?: JwtAuthOptions): Middleware;

package/src/middleware/JwtAuthMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"JwtAuthMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/JwtAuthMiddleware.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAe,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAItE,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AA4BD,eAAO,MAAM,iBAAiB;qBACZ,cAAc,GAAQ,UAAU;EAoEhD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}
+{"version":3,"file":"JwtAuthMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/JwtAuthMiddleware.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAe,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAItE,MAAM,WAAW,cAAc;IAC7B,SAAS,CAAC,EAAE,YAAY,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,0BAA0B,CAAC;CAC7C;AAuCD,eAAO,MAAM,iBAAiB;qBACZ,cAAc,GAAQ,UAAU;EA6FhD,CAAC;AAEH,eAAe,iBAAiB,CAAC"}

package/src/middleware/JwtAuthMiddleware.js

@@ -1,8 +1,18 @@
 import { Logger } from '../config/logger.js';
 import { securityConfig } from '../config/security.js';
 import { RequestContext } from '../http/RequestContext.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 import { JwtManager } from '../security/JwtManager.js';
 import { JwtSessions } from '../security/JwtSessions.js';
+const getJwtFailureReason = (error) => {
+    if (typeof error !== 'object' || error === null)
+        return 'invalid_token';
+    const candidate = error;
+    if (candidate.name === 'TokenExpiredError' || candidate.code === 'TOKEN_EXPIRED') {
+        return 'expired_token';
+    }
+    return 'invalid_token';
+};
 const getHeaderValue = (value) => {
     if (Array.isArray(value))
         return typeof value[0] === 'string' ? value[0] : '';
@@ -44,19 +54,37 @@ export const JwtAuthMiddleware = Object.freeze({
             }
             const authorizationHeader = getHeaderValue(req.getHeader('authorization'));
             if (authorizationHeader === '') {
-                res.setStatus(401).json({ error: 'Missing authorization header' });
+                await respondWithMiddlewareFailure(req, res, options.onUnauthorized, {
+                    middleware: 'jwt',
+                    reason: 'missing_authorization_header',
+                    statusCode: 401,
+                    message: 'Missing authorization header',
+                    body: { error: 'Missing authorization header' },
+                });
                 return;
             }
             const token = getBearerToken(authorizationHeader);
             if (token === null) {
-                res.setStatus(401).json({ error: 'Invalid authorization header format' });
+                await respondWithMiddlewareFailure(req, res, options.onUnauthorized, {
+                    middleware: 'jwt',
+                    reason: 'invalid_authorization_header_format',
+                    statusCode: 401,
+                    message: 'Invalid authorization header format',
+                    body: { error: 'Invalid authorization header format' },
+                });
                 return;
             }
             try {
                 const payload = jwt.verify(token, algorithm);
                 // Session allowlist: token must exist in the session store to be accepted.
                 if (!(await JwtSessions.isActive(token))) {
-                    res.setStatus(401).json({ error: 'Invalid or expired token' });
+                    await respondWithMiddlewareFailure(req, res, options.onUnauthorized, {
+                        middleware: 'jwt',
+                        reason: 'inactive_session',
+                        statusCode: 401,
+                        message: 'Invalid or expired token',
+                        body: { error: 'Invalid or expired token' },
+                    });
                     return;
                 }
                 req.user = payload;
@@ -77,7 +105,14 @@ export const JwtAuthMiddleware = Object.freeze({
                     algorithm,
                     error: error instanceof Error ? error.message : String(error),
                 });
-                res.setStatus(401).json({ error: 'Invalid or expired token' });
+                await respondWithMiddlewareFailure(req, res, options.onUnauthorized, {
+                    middleware: 'jwt',
+                    reason: getJwtFailureReason(error),
+                    statusCode: 401,
+                    message: 'Invalid or expired token',
+                    body: { error: 'Invalid or expired token' },
+                    error,
+                });
             }
         };
     },

package/src/middleware/MiddlewareFailureResponder.d.ts

@@ -0,0 +1,15 @@
+import type { IRequest } from '../http/Request';
+import type { IResponse } from '../http/Response';
+export type MiddlewareFailureContext = Readonly<{
+    middleware: string;
+    reason: string;
+    statusCode: number;
+    message: string;
+    body: unknown;
+    error?: unknown;
+    requestId?: string;
+}>;
+export type MiddlewareFailureResponder = (req: IRequest, res: IResponse, context: MiddlewareFailureContext) => void | Promise<void>;
+export declare const defaultMiddlewareFailureResponder: MiddlewareFailureResponder;
+export declare const respondWithMiddlewareFailure: (req: IRequest, res: IResponse, responder: MiddlewareFailureResponder | undefined, context: MiddlewareFailureContext) => Promise<void>;
+//# sourceMappingURL=MiddlewareFailureResponder.d.ts.map

package/src/middleware/MiddlewareFailureResponder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MiddlewareFailureResponder.d.ts","sourceRoot":"","sources":["../../../src/middleware/MiddlewareFailureResponder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC,CAAC;AAEH,MAAM,MAAM,0BAA0B,GAAG,CACvC,GAAG,EAAE,QAAQ,EACb,GAAG,EAAE,SAAS,EACd,OAAO,EAAE,wBAAwB,KAC9B,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AAE1B,eAAO,MAAM,iCAAiC,EAAE,0BAgB/C,CAAC;AAEF,eAAO,MAAM,4BAA4B,GACvC,KAAK,QAAQ,EACb,KAAK,SAAS,EACd,WAAW,0BAA0B,GAAG,SAAS,EACjD,SAAS,wBAAwB,KAChC,OAAO,CAAC,IAAI,CAEd,CAAC"}

package/src/middleware/MiddlewareFailureResponder.js

@@ -0,0 +1,15 @@
+import { isObject } from '../helper/index.js';
+export const defaultMiddlewareFailureResponder = (_req, res, context) => {
+    const statusTarget = res.setStatus(context.statusCode);
+    const responseTarget = isObject(statusTarget) ? statusTarget : res;
+    if (typeof responseTarget.json === 'function') {
+        responseTarget.json(context.body);
+        return;
+    }
+    if (typeof responseTarget.send === 'function') {
+        responseTarget.send(JSON.stringify(context.body));
+    }
+};
+export const respondWithMiddlewareFailure = async (req, res, responder, context) => {
+    await (responder ?? defaultMiddlewareFailureResponder)(req, res, context);
+};

package/src/middleware/RateLimiter.d.ts

@@ -4,6 +4,7 @@
  * Zero-dependency implementation
  */
 import type { IRequest } from '../http/Request';
+import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
 import type { Middleware } from './MiddlewareStack';
 export interface RateLimitOptions {
     windowMs: number;
@@ -20,6 +21,7 @@ export interface RateLimitOptions {
      * - 'db' uses Cache.store('mongodb')
      */
     store?: RateLimitStoreName;
+    onFailure?: MiddlewareFailureResponder;
 }
 export type RateLimitStoreName = 'memory' | 'redis' | 'kv' | 'db';
 export declare const RateLimiter: Readonly<{

package/src/middleware/RateLimiter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC;IAEzC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;CAC5B;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAqKlE,eAAO,MAAM,WAAW;IACtB;;;OAGG;uBACgB;QAAE,KAAK,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI;IAKxD;;;;OAIG;iBACgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;OAEG;yBACwB,MAAM,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE;;;OAGG;cACa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxC;;OAEG;eACc,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;qBACa,gBAAgB,GAAqB,UAAU;EAgF/D,CAAC"}
+{"version":3,"file":"RateLimiter.d.ts","sourceRoot":"","sources":["../../../src/middleware/RateLimiter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAE9C,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,KAAK,MAAM,CAAC;IAEzC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,SAAS,CAAC,EAAE,0BAA0B,CAAC;CACxC;AAED,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,CAAC;AAqKlE,eAAO,MAAM,WAAW;IACtB;;;OAGG;uBACgB;QAAE,KAAK,CAAC,EAAE,kBAAkB,CAAA;KAAE,GAAG,IAAI;IAKxD;;;;OAIG;iBACgB,MAAM,eAAe,MAAM,gBAAgB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAYvF;;OAEG;yBACwB,MAAM,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzE;;;OAGG;cACa,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQxC;;OAEG;eACc,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC;;OAEG;qBACa,gBAAgB,GAAqB,UAAU;EAqF/D,CAAC"}

package/src/middleware/RateLimiter.js

@@ -6,6 +6,7 @@
 import { Cache } from '../cache/Cache.js';
 import { Env } from '../config/env.js';
 import { Logger } from '../config/logger.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 const createMemoryStore = () => {
     const entries = new Map();
     let nextCleanupAt = Date.now() + 60_000;
@@ -257,10 +258,15 @@ export const RateLimiter = Object.freeze({
             // Check limit
             if (count > config.max) {
                 Logger.warn(`Rate limit exceeded for IP: ${key}`);
-                res.setStatus(config.statusCode ?? 429);
-                res.json({
-                    error: 'Too Many Requests',
-                    message: config.message,
+                await respondWithMiddlewareFailure(req, res, config.onFailure, {
+                    middleware: 'rateLimit',
+                    reason: 'rate_limit_exceeded',
+                    statusCode: config.statusCode ?? 429,
+                    message: config.message ?? 'Too many requests',
+                    body: {
+                        error: 'Too Many Requests',
+                        message: config.message,
+                    },
                 });
                 return;
             }

package/src/middleware/SecurityMiddleware.d.ts

@@ -14,7 +14,7 @@ export interface SecurityOptions {
         action?: 'DENY' | 'SAMEORIGIN';
     };
     cors?: {
-        origin?: string;
+        origin?: string | string[];
         methods?: string[];
         allowedHeaders?: string[];
         credentials?: boolean;

package/src/middleware/SecurityMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AA+FD,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}
+{"version":3,"file":"SecurityMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/SecurityMiddleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,iBAAiB,CAAC,EAAE,OAAO,CAAC;QAC5B,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,CAAC;IACF,UAAU,CAAC,EAAE;QACX,MAAM,CAAC,EAAE,MAAM,GAAG,YAAY,CAAC;KAChC,CAAC;IACF,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,WAAW,CAAC,EAAE,OAAO,CAAC;QACtB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,CAAC,EAAE;QACJ,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KACvC,CAAC;CACH;AAiID,eAAO,MAAM,kBAAkB;IAC7B;;OAEG;qBACa,eAAe,GAAQ,UAAU;EAgBjD,CAAC"}

package/src/middleware/SecurityMiddleware.js

@@ -3,6 +3,17 @@
  * Implements standard security headers and CORS protection
  * Zero-dependency implementation replacing helmet/cors
  */
+import { securityConfig } from '../config/security.js';
+const normalizeCorsList = (values, fallback) => {
+    const normalized = (values ?? [])
+        .map((value) => (typeof value === 'string' ? value.trim() : ''))
+        .filter((value) => value !== '');
+    return normalized.length > 0 ? normalized : fallback;
+};
+const resolveCorsOrigin = () => {
+    const origins = normalizeCorsList(securityConfig.cors.origins, ['*']);
+    return origins.includes('*') ? '*' : origins;
+};
 const DEFAULT_OPTIONS = {
     hsts: {
         maxAge: 15552000, // 180 days
@@ -13,13 +24,33 @@ const DEFAULT_OPTIONS = {
         action: 'SAMEORIGIN',
     },
     cors: {
-        origin: '*',
-        methods: ['GET', 'HEAD', 'PUT', 'PATCH', 'POST', 'DELETE'],
-        allowedHeaders: ['Content-Type', 'Authorization', 'X-Requested-With', 'X-CSRF-Token'],
-        credentials: true,
-        maxAge: 86400,
+        origin: resolveCorsOrigin(),
+        methods: normalizeCorsList(securityConfig.cors.methods, [
+            'GET',
+            'HEAD',
+            'PUT',
+            'PATCH',
+            'POST',
+            'DELETE',
+        ]),
+        allowedHeaders: normalizeCorsList(securityConfig.cors.allowedHeaders, [
+            'Content-Type',
+            'Authorization',
+            'X-Requested-With',
+            'X-CSRF-Token',
+        ]),
+        credentials: securityConfig.cors.credentials,
+        maxAge: securityConfig.cors.maxAge,
     },
 };
+const mergeSecurityOptions = (options) => {
+    return {
+        hsts: { ...DEFAULT_OPTIONS.hsts, ...options.hsts },
+        frameguard: { ...DEFAULT_OPTIONS.frameguard, ...options.frameguard },
+        cors: { ...DEFAULT_OPTIONS.cors, ...options.cors },
+        csp: options.csp ?? DEFAULT_OPTIONS.csp,
+    };
+};
 function applyHsts(res, hsts) {
     if (!hsts)
         return;
@@ -73,7 +104,7 @@ function applyCors(req, res, cors) {
         res.setHeader('Access-Control-Allow-Headers', cors.allowedHeaders.join(', '));
     }
     if (cors.credentials !== undefined) {
-        res.setHeader('Access-Control-Allow-Credentials', 'true');
+        res.setHeader('Access-Control-Allow-Credentials', cors.credentials ? 'true' : 'false');
     }
     if (cors.maxAge !== undefined) {
         res.setHeader('Access-Control-Max-Age', cors.maxAge.toString());
@@ -90,7 +121,7 @@ export const SecurityMiddleware = Object.freeze({
      * Create security middleware with options
      */
     create(options = {}) {
-        const config = { ...DEFAULT_OPTIONS, ...options };
+        const config = mergeSecurityOptions(options);
         return async (req, res, next) => {
             applyHsts(res, config.hsts);
             applyFrameguard(res, config.frameguard);

package/src/middleware/ValidationMiddleware.d.ts

@@ -1,12 +1,17 @@
+import { type MiddlewareFailureResponder } from './MiddlewareFailureResponder';
 import type { Middleware } from './MiddlewareStack';
 import type { ISchema, TypedSchema } from '../validation/Validator';
+type ValidationMiddlewareOptions = Readonly<{
+    onFailure?: MiddlewareFailureResponder;
+    middlewareKey?: string;
+}>;
 type FieldSanitizers = Readonly<Record<string, (value: unknown) => unknown>>;
 export declare const ValidationMiddleware: Readonly<{
-    create(schema: ISchema): Middleware;
-    createBody<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
-    createBodyWithSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers): Middleware;
-    createQuery<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
-    createParams<TSchema extends TypedSchema<unknown>>(schema: TSchema): Middleware;
+    create(schema: ISchema, options?: ValidationMiddlewareOptions): Middleware;
+    createBody<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
+    createBodyWithSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers, options?: ValidationMiddlewareOptions): Middleware;
+    createQuery<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
+    createParams<TSchema extends TypedSchema<unknown>>(schema: TSchema, options?: ValidationMiddlewareOptions): Middleware;
     /**
      * Create body validation middleware with bulletproof sanitization error handling.
      * Automatically converts SanitizerError to 422 validation response.
@@ -19,7 +24,7 @@ export declare const ValidationMiddleware: Readonly<{
      * @param sanitizers - Optional field sanitizers to apply before validation
      * @returns Middleware with bulletproof error handling
      */
-    createBodyWithBulletproofSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers): Middleware;
+    createBodyWithBulletproofSanitization<TSchema extends TypedSchema<unknown>>(schema: TSchema, sanitizers?: FieldSanitizers, options?: ValidationMiddlewareOptions): Middleware;
 }>;
 export {};
 //# sourceMappingURL=ValidationMiddleware.d.ts.map

package/src/middleware/ValidationMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ValidationMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/ValidationMiddleware.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAe,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAW/E,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AAqG7E,eAAO,MAAM,oBAAoB;mBAChB,OAAO,GAAG,UAAU;eAwBxB,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;+BA0BlD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrD,OAAO,eACF,eAAe,GAC3B,UAAU;gBA6BD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;iBAejE,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAAU,OAAO,GAAG,UAAU;IAe/E;;;;;;;;;;;OAWG;0CACmC,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAChE,OAAO,eACF,eAAe,GAC3B,UAAU;EAqCb,CAAC"}
+{"version":3,"file":"ValidationMiddleware.d.ts","sourceRoot":"","sources":["../../../src/middleware/ValidationMiddleware.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAChD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAE9D,OAAO,KAAK,EAAe,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAI/E,KAAK,2BAA2B,GAAG,QAAQ,CAAC;IAC1C,SAAS,CAAC,EAAE,0BAA0B,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC,CAAC;AAQH,KAAK,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC;AA+H7E,eAAO,MAAM,oBAAoB;mBAChB,OAAO,YAAW,2BAA2B,GAAQ,UAAU;eAwBnE,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrC,OAAO,YACN,2BAA2B,GACnC,UAAU;+BA0Bc,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACrD,OAAO,eACF,eAAe,YACnB,2BAA2B,GACnC,UAAU;gBA6BD,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACtC,OAAO,YACN,2BAA2B,GACnC,UAAU;iBAeA,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UACvC,OAAO,YACN,2BAA2B,GACnC,UAAU;IAeb;;;;;;;;;;;OAWG;0CACmC,OAAO,SAAS,WAAW,CAAC,OAAO,CAAC,UAChE,OAAO,eACF,eAAe,YACnB,2BAA2B,GACnC,UAAU;EA4Cb,CAAC"}

package/src/middleware/ValidationMiddleware.js

@@ -1,5 +1,6 @@
 import { Env } from '../config/env.js';
 import { Logger } from '../config/logger.js';
+import { respondWithMiddlewareFailure, } from './MiddlewareFailureResponder.js';
 import { Xss } from '../security/Xss.js';
 import { Validator } from '../validation/Validator.js';
 const toRecord = (value) => {
@@ -73,7 +74,7 @@ const getBodyForValidation = (req) => {
     const raw = safeCall(() => req.getBody?.());
     return toBodyRecord(raw);
 };
-const handleValidationError = (res, error) => {
+const handleValidationError = async (req, res, error, options) => {
     // Temporary: log validation error details to help debugging failing requests.
     // Remove this detailed debug logging once the issue is investigated.
     Logger.warn('Validation failed');
@@ -88,21 +89,42 @@ const handleValidationError = (res, error) => {
                 // best-effort: fall back to direct log
                 Logger.debug('[Validation] errors (toObject threw):', err);
             }
-            res.setStatus(422).json({ errors: err.toObject() });
+            await respondWithMiddlewareFailure(req, res, options.onFailure, {
+                middleware: options.middlewareKey ?? 'validation',
+                reason: 'validation_error',
+                statusCode: 422,
+                message: 'Validation failed',
+                body: { errors: err.toObject() },
+                error,
+            });
             return;
         }
         // Fallback: log raw error
         Logger.debug('[Validation] error:', err);
-        res.setStatus(400).json({ error: 'Invalid request body' });
+        await respondWithMiddlewareFailure(req, res, options.onFailure, {
+            middleware: options.middlewareKey ?? 'validation',
+            reason: 'invalid_request_body',
+            statusCode: 400,
+            message: 'Invalid request body',
+            body: { error: 'Invalid request body' },
+            error,
+        });
     }
     catch (error_) {
         // Ensure we don't throw while handling validation errors
         Logger.debug('[Validation] failed to log error details:', error_);
-        res.setStatus(400).json({ error: 'Invalid request body' });
+        await respondWithMiddlewareFailure(req, res, options.onFailure, {
+            middleware: options.middlewareKey ?? 'validation',
+            reason: 'invalid_request_body',
+            statusCode: 400,
+            message: 'Invalid request body',
+            body: { error: 'Invalid request body' },
+            error,
+        });
     }
 };
 export const ValidationMiddleware = Object.freeze({
-    create(schema) {
+    create(schema, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -120,11 +142,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createBody(schema) {
+    createBody(schema, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -142,11 +164,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createBodyWithSanitization(schema, sanitizers) {
+    createBodyWithSanitization(schema, sanitizers, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -165,11 +187,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createQuery(schema) {
+    createQuery(schema, options = {}) {
         return async (req, res, next) => {
             try {
                 const query = toRecord(req.getQuery());
@@ -178,11 +200,11 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
-    createParams(schema) {
+    createParams(schema, options = {}) {
         return async (req, res, next) => {
             try {
                 const params = toRecord(req.getParams());
@@ -191,7 +213,7 @@ export const ValidationMiddleware = Object.freeze({
                 await next();
             }
             catch (error) {
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },
@@ -207,7 +229,7 @@ export const ValidationMiddleware = Object.freeze({
      * @param sanitizers - Optional field sanitizers to apply before validation
      * @returns Middleware with bulletproof error handling
      */
-    createBodyWithBulletproofSanitization(schema, sanitizers) {
+    createBodyWithBulletproofSanitization(schema, sanitizers, options = {}) {
         return async (req, res, next) => {
             const method = req.getMethod();
             if (method === 'GET' || method === 'DELETE') {
@@ -228,14 +250,21 @@ export const ValidationMiddleware = Object.freeze({
             catch (error) {
                 // Handle SanitizerError by converting to validation error format
                 if (isSanitizerError(error)) {
-                    res.setStatus(422).json({
-                        errors: {
-                            sanitization: [error.message],
+                    await respondWithMiddlewareFailure(req, res, options.onFailure, {
+                        middleware: options.middlewareKey ?? 'validation',
+                        reason: 'sanitization_error',
+                        statusCode: 422,
+                        message: error.message,
+                        body: {
+                            errors: {
+                                sanitization: [error.message],
+                            },
                         },
+                        error,
                     });
                     return;
                 }
-                handleValidationError(res, error);
+                await handleValidationError(req, res, error, options);
             }
         };
     },

package/src/middleware/index.d.ts

@@ -5,6 +5,7 @@
 export * from './CsrfMiddleware';
 export * from './ErrorHandlerMiddleware';
 export * from './LoggingMiddleware';
+export * from './MiddlewareFailureResponder';
 export * from './MiddlewareStack';
 export * from './RateLimiter';
 export * from './SecurityMiddleware';

package/src/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,cAAc,4BAA4B,CAAC;AAC3C,cAAc,oCAAoC,CAAC;AACnD,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wCAAwC,CAAC;AACvD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,gCAAgC,CAAC"}

package/src/middleware/index.js

@@ -5,6 +5,7 @@
 export * from './CsrfMiddleware.js';
 export * from './ErrorHandlerMiddleware.js';
 export * from './LoggingMiddleware.js';
+export * from './MiddlewareFailureResponder.js';
 export * from './MiddlewareStack.js';
 export * from './RateLimiter.js';
 export * from './SecurityMiddleware.js';

package/src/runtime/RuntimeAdapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RuntimeAdapter.d.ts","sourceRoot":"","sources":["../../../src/runtime/RuntimeAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAO7E,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC;IAElE;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAErE;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAAC;IAE9C;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAEpD;;OAEG;IACH,SAAS,IAAI;QACX,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACvC,CAAC;IAEF;;OAEG;IACH,6BAA6B,IAAI,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI;QAChB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,KAAK,KACR,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACvC,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,KAAK,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;IAChE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IACtE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACxD,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IACtC,UAAU,IAAI,gBAAgB,CAAC;CAChC;AAED,eAAO,MAAM,YAAY;cACb,aAAa;EA0EvB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;uBACL,MAAM,WAAW,MAAM,YAAY,OAAO,GAAG,aAAa;EAW7E,CAAC;AAgGH,KAAK,OAAO,GAAG;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAwGF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG;IAC/D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;CACvB,CAMA"}
+{"version":3,"file":"RuntimeAdapter.d.ts","sourceRoot":"","sources":["../../../src/runtime/RuntimeAdapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAO7E,KAAK,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;AAEjE;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,KAAK,CAAC;IACb,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,QAAQ,EAAE,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,YAAY,GAAG,MAAM,CAAC;IAElE;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAErE;;OAEG;IACH,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,eAAe,CAAC;IAE9C;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAEpD;;OAEG;IACH,SAAS,IAAI;QACX,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACvC,CAAC;IAEF;;OAEG;IACH,6BAA6B,IAAI,OAAO,CAAC;IAEzC;;OAEG;IACH,cAAc,IAAI;QAChB,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACxB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,CAC5B,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,cAAc,EACnB,IAAI,EAAE,KAAK,KACR,OAAO,CAAC,IAAI,CAAC,CAAC;AAEnB;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACzC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;QACxC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;KACvC,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,KAAK,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAAC;IACvC,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,aAAa,CAAC;IAChE,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,GAAG,aAAa,CAAC;IACtE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,OAAO,GAAG,aAAa,CAAC;IACxD,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,CAAC;IACtC,UAAU,IAAI,gBAAgB,CAAC;CAChC;AAED,eAAO,MAAM,YAAY;cACb,aAAa;EA0EvB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,aAAa;uBACL,MAAM,WAAW,MAAM,YAAY,OAAO,GAAG,aAAa;EAW7E,CAAC;AAgGH,KAAK,OAAO,GAAG;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,IAAI,EAAE,KAAK,CAAC;CACb,CAAC;AAkHF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG;IAC/D,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,CAAC;CACvB,CAMA"}

package/src/runtime/RuntimeAdapter.js

@@ -159,8 +159,18 @@ const applyWriteHead = (responseData, statusCode, headers) => {
 };
 const resData = (responseData, request) => {
     return {
-        statusCode: 200,
-        headers: responseData.headers,
+        get statusCode() {
+            return responseData.statusCode;
+        },
+        set statusCode(value) {
+            responseData.statusCode = value;
+        },
+        get headers() {
+            return responseData.headers;
+        },
+        set headers(value) {
+            responseData.headers = value;
+        },
         writeHead: function (statusCode, headers) {
             this._writer = applyWriteHead(responseData, statusCode, headers);
             // Handle abortion if signal is present

package/src/runtime/WorkersModule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WorkersModule.d.ts","sourceRoot":"","sources":["../../../src/runtime/WorkersModule.ts"],"names":[],"mappings":"AAOA,KAAK,aAAa,GAAG,cAAc,mBAAmB,CAAC,CAAC;AACxD,KAAK,kBAAkB,GAAG,cAAc,yBAAyB,CAAC,CAAC;AA4WnE,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,aAAa,CAwB/D,CAAC;AA4CF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,kBAAkB,CAkBzE,CAAC"}
+{"version":3,"file":"WorkersModule.d.ts","sourceRoot":"","sources":["../../../src/runtime/WorkersModule.ts"],"names":[],"mappings":"AAOA,KAAK,aAAa,GAAG,cAAc,mBAAmB,CAAC,CAAC;AACxD,KAAK,kBAAkB,GAAG,cAAc,yBAAyB,CAAC,CAAC;AA8WnE,eAAO,MAAM,iBAAiB,QAAa,OAAO,CAAC,aAAa,CAwB/D,CAAC;AA4CF,eAAO,MAAM,sBAAsB,QAAa,OAAO,CAAC,kBAAkB,CAkBzE,CAAC"}

package/src/runtime/WorkersModule.js

@@ -268,6 +268,7 @@ const isMissingOptionalWorkersModuleError = (error) => {
     });
 };
 const handleImportFailure = async (error) => {
+    let finalError = error;
     if (shouldRetryAfterFailure(error)) {
         patchAfterFailureAttempted = true;
         const { replacements, filesChanged } = patchWorkersDist();
@@ -281,7 +282,7 @@ const handleImportFailure = async (error) => {
                 return await workersModulePromise;
             }
             catch (retryError) {
-                error = retryError;
+                finalError = retryError;
             }
         }
     }
@@ -290,12 +291,12 @@ const handleImportFailure = async (error) => {
         workersModulePromise = Promise.resolve(localFallback);
         return localFallback;
     }
-    if (isMissingOptionalWorkersModuleError(error)) {
+    if (isMissingOptionalWorkersModuleError(finalError)) {
         Logger.info('Optional @zintrust/workers package is unavailable; worker routes are disabled.');
         workersModulePromise = Promise.resolve(createDisabledWorkersModule());
         return workersModulePromise;
     }
-    throw error;
+    throw finalError;
 };
 const tryLocalFallback = async () => {
     const localFallback = await importLocalWorkersModule();

package/src/security/Xss.d.ts

@@ -2,8 +2,8 @@
  * XSS Sanitizer
  * Recursive, zero-dependency input sanitization utility.
  *
- * This is intentionally conservative:
- * - Strings: strip tags, then escape HTML entities.
+ * This is intentionally conservative for request-body handling:
+ * - Strings: strip markup tags but preserve plain text characters.
  * - Arrays/Objects: sanitize recursively.
  */
 export interface IXss {

package/src/security/Xss.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Xss.d.ts","sourceRoot":"","sources":["../../../src/security/Xss.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAwDH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,GAAG,EAAE,IAIhB,CAAC;AAEH,eAAe,GAAG,CAAC"}
+{"version":3,"file":"Xss.d.ts","sourceRoot":"","sources":["../../../src/security/Xss.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAsDH,MAAM,WAAW,IAAI;IACnB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC;CACnC;AAED,eAAO,MAAM,GAAG,EAAE,IAIhB,CAAC;AAEH,eAAe,GAAG,CAAC"}