@zudojs/errors 1.3.1 → 1.3.2

package/README.md

@@ -48,6 +48,7 @@ try {
 - `ErrorCode`, `ErrorCategory` and `ErrorSeverity` enums with guards (`isErrorCode`, ...)
 - Domain, infrastructure and system error families (access, state, HTTP, database, network, container, adapter, crypto, ...) with factories and type guards
 - Base classes for other packages' error families, so their `instanceof` checks match: `TransactionError` (+ 10 subclasses), `MiddlewareLimitExceededError` / `MiddlewareDepthExceededError` / `MiddlewareRateLimitError` / `MiddlewareAbortedError`, `TraversalLimitError`, `HttpMiddlewareError` / `HttpMiddlewarePipelineError` / `HttpRequestGuardError`, `OpenAPIError`, `AuthError`, `OAuthError` (with `ErrorCode.OAUTH_*`), `CqrsError` (+ `CommandFailedError` / `QueryFailedError`, thrown when a failed command or query result is unwrapped), `EventBusStoppedError` / `EventBusDisposedError` (re-exported by `@zudojs/events`), `ObservabilityError`, `InvalidConstantError` / `ConstantContextError`, and the `zudojs-cli` errors `CLIValidationError` / `CLIGenerationError` / `CLINotInProjectError` / `CLITemplateError`
+- Serialization limit errors take `{ statusCode?, expose? }` as a third argument, so a guard can tell a client that sent too much from a server that built too much. `SerializationPayloadTooLargeError(size, maxSize)` defaults to an exposed 413 (its message names only the two sizes, so `serializePublicError` returns it instead of "An unexpected error occurred."); pass `{ statusCode: 500, expose: false }` for a payload the server built itself, as `serialize` in `@zudojs/serialization` does. `SerializationDepthError(depth, maxDepth)` defaults to an unexposed 500; guards over untrusted input pass `{ statusCode: 400, expose: true }`
 - `withMetadata()` copies any error (including subclasses with custom constructors) with extra metadata
 - Serialization: `toJSON()`/`toLogObject()` for trusted logs (cycle-safe cause chains truncated with `"[MaxDepth]"` after 8 levels across the whole chain; metadata under sensitive keys, sensitive keys in object causes and submitted issue values are redacted, so `JSON.stringify(error)` is safe to log), `serializePublicError` / `ErrorSerializer` / `ErrorHandler.toPublicResult` for untrusted clients (recursive redaction, metadata allow-list)
 - Metadata utilities: `createErrorMetadata`, `mergeErrorMetadata`, `sanitizeErrorMetadata` (drops unsupported values) and `redactErrorMetadata` (removes secrets)

package/dist/domain/serialization/serialization.error.d.ts

@@ -3,5 +3,6 @@
  */
 export { SerializationError, createSerializationError, isSerializationError, toSerializationError, } from "./serializationError.base.js";
 export type { SerializationErrorOptions } from "./serializationError.base.js";
-export { SerializeError, DeserializeError, UnsupportedSerializationFormatError, SerializerNotFoundError, CircularReferenceError, SerializationDepthError, SerializationPayloadTooLargeError, InvalidSerializedDataError, TransformerError, TransformerNotFoundError, } from "./serializationError.types.js";
+export { SerializeError, DeserializeError, UnsupportedSerializationFormatError, SerializerNotFoundError, CircularReferenceError, InvalidSerializedDataError, TransformerError, TransformerNotFoundError, } from "./serializationError.types.js";
+export { SerializationDepthError, SerializationPayloadTooLargeError, } from "./serializationError.limits.js";
 //# sourceMappingURL=serialization.error.d.ts.map

package/dist/domain/serialization/serialization.error.js

@@ -2,5 +2,6 @@
  * Serialization error classes — re-exports from focused files.
  */
 export { SerializationError, createSerializationError, isSerializationError, toSerializationError, } from "./serializationError.base.js";
-export { SerializeError, DeserializeError, UnsupportedSerializationFormatError, SerializerNotFoundError, CircularReferenceError, SerializationDepthError, SerializationPayloadTooLargeError, InvalidSerializedDataError, TransformerError, TransformerNotFoundError, } from "./serializationError.types.js";
+export { SerializeError, DeserializeError, UnsupportedSerializationFormatError, SerializerNotFoundError, CircularReferenceError, InvalidSerializedDataError, TransformerError, TransformerNotFoundError, } from "./serializationError.types.js";
+export { SerializationDepthError, SerializationPayloadTooLargeError, } from "./serializationError.limits.js";
 //# sourceMappingURL=serialization.error.js.map

package/dist/domain/serialization/serializationError.limits.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Serialization limit errors: a payload nested too deep or too large.
+ *
+ * Both take `{ statusCode?, expose? }` so a guard can tell a client that
+ * sent too much (an exposed 4xx) from a server that built too much (an
+ * unexposed 500). Their messages hold only the observed value and the
+ * limit, never the payload.
+ */
+import { SerializationError } from "./serializationError.base.js";
+/** Status and exposure overrides accepted by the limit errors. */
+export interface SerializationLimitErrorOptions {
+    readonly statusCode?: number;
+    readonly expose?: boolean;
+}
+/**
+ * Error thrown when maximum serialization depth is exceeded.
+ *
+ * By default over-deep data is a server-side data bug, so this is an
+ * internal (500) error. Code that checks UNTRUSTED input (for example
+ * `assertDepthWithinLimit` in `@zudojs/validation`) passes
+ * `{ statusCode: 400, expose: true }`: too-deep client input is a client
+ * error. The message holds only the two numbers, so it is safe to expose.
+ */
+export declare class SerializationDepthError extends SerializationError {
+    readonly depth: number;
+    readonly maxDepth: number;
+    /** @deprecated Use `maxDepth`. */
+    readonly maxDepthValue: number;
+    constructor(depth: number, maxDepth: number, options?: SerializationLimitErrorOptions);
+}
+/**
+ * Error thrown when a serialized payload exceeds the size limit.
+ *
+ * By default this is an exposed 413: the size guards that throw it
+ * (`deserialize` in `@zudojs/serialization`, `assertSizeWithinLimit` in
+ * `@zudojs/validation`) check UNTRUSTED input, and too much client input is
+ * a client error. It used to be an unexposed 413, which
+ * `serializePublicError` answered with "An unexpected error occurred.".
+ * The message holds only the two sizes, never the payload, so it is safe to
+ * expose. Code that checks a payload the server built itself passes
+ * `{ statusCode: 500, expose: false }`, as `serialize` does.
+ */
+export declare class SerializationPayloadTooLargeError extends SerializationError {
+    readonly size: number;
+    readonly maxSize: number;
+    /** @deprecated Use `size`. */
+    readonly payloadSize: number;
+    /** @deprecated Use `maxSize`. */
+    readonly maxSizeValue: number;
+    constructor(size: number, maxSize: number, options?: SerializationLimitErrorOptions);
+}
+//# sourceMappingURL=serializationError.limits.d.ts.map

package/dist/domain/serialization/serializationError.limits.js

@@ -0,0 +1,71 @@
+/**
+ * Serialization limit errors: a payload nested too deep or too large.
+ *
+ * Both take `{ statusCode?, expose? }` so a guard can tell a client that
+ * sent too much (an exposed 4xx) from a server that built too much (an
+ * unexposed 500). Their messages hold only the observed value and the
+ * limit, never the payload.
+ */
+import { ErrorCode } from "../../base/types/errorCode.type.js";
+import { SerializationError } from "./serializationError.base.js";
+/**
+ * Error thrown when maximum serialization depth is exceeded.
+ *
+ * By default over-deep data is a server-side data bug, so this is an
+ * internal (500) error. Code that checks UNTRUSTED input (for example
+ * `assertDepthWithinLimit` in `@zudojs/validation`) passes
+ * `{ statusCode: 400, expose: true }`: too-deep client input is a client
+ * error. The message holds only the two numbers, so it is safe to expose.
+ */
+export class SerializationDepthError extends SerializationError {
+    depth;
+    maxDepth;
+    /** @deprecated Use `maxDepth`. */
+    maxDepthValue;
+    constructor(depth, maxDepth, options = {}) {
+        super(`Maximum serialization depth exceeded: ${depth} > ${maxDepth}`, {
+            code: ErrorCode.MAX_DEPTH_EXCEEDED,
+            depth,
+            maxDepth,
+            statusCode: options.statusCode ?? 500,
+            expose: options.expose ?? false,
+        });
+        this.depth = depth;
+        this.maxDepth = maxDepth;
+        this.maxDepthValue = maxDepth;
+    }
+}
+/**
+ * Error thrown when a serialized payload exceeds the size limit.
+ *
+ * By default this is an exposed 413: the size guards that throw it
+ * (`deserialize` in `@zudojs/serialization`, `assertSizeWithinLimit` in
+ * `@zudojs/validation`) check UNTRUSTED input, and too much client input is
+ * a client error. It used to be an unexposed 413, which
+ * `serializePublicError` answered with "An unexpected error occurred.".
+ * The message holds only the two sizes, never the payload, so it is safe to
+ * expose. Code that checks a payload the server built itself passes
+ * `{ statusCode: 500, expose: false }`, as `serialize` does.
+ */
+export class SerializationPayloadTooLargeError extends SerializationError {
+    size;
+    maxSize;
+    /** @deprecated Use `size`. */
+    payloadSize;
+    /** @deprecated Use `maxSize`. */
+    maxSizeValue;
+    constructor(size, maxSize, options = {}) {
+        super(`Serialized payload too large: ${size} bytes (max: ${maxSize})`, {
+            code: ErrorCode.PAYLOAD_TOO_LARGE,
+            size,
+            maxSize,
+            statusCode: options.statusCode ?? 413,
+            expose: options.expose ?? true,
+        });
+        this.size = size;
+        this.maxSize = maxSize;
+        this.payloadSize = size;
+        this.maxSizeValue = maxSize;
+    }
+}
+//# sourceMappingURL=serializationError.limits.js.map

package/dist/domain/serialization/serializationError.types.d.ts

@@ -39,35 +39,6 @@ export declare class CircularReferenceError extends SerializationError {
     readonly circularPath: string;
     constructor(path?: string);
 }
-/**
- * Error thrown when maximum serialization depth is exceeded.
- *
- * By default over-deep data is a server-side data bug, so this is an
- * internal (500) error. Code that checks UNTRUSTED input (for example
- * `assertDepthWithinLimit` in `@zudojs/validation`) passes
- * `{ statusCode: 400, expose: true }`: too-deep client input is a client
- * error. The message holds only the two numbers, so it is safe to expose.
- */
-export declare class SerializationDepthError extends SerializationError {
-    readonly depth: number;
-    readonly maxDepth: number;
-    /** @deprecated Use `maxDepth`. */
-    readonly maxDepthValue: number;
-    constructor(depth: number, maxDepth: number, options?: {
-        readonly statusCode?: number;
-        readonly expose?: boolean;
-    });
-}
-/** Error thrown when a serialized payload exceeds the size limit. */
-export declare class SerializationPayloadTooLargeError extends SerializationError {
-    readonly size: number;
-    readonly maxSize: number;
-    /** @deprecated Use `size`. */
-    readonly payloadSize: number;
-    /** @deprecated Use `maxSize`. */
-    readonly maxSizeValue: number;
-    constructor(size: number, maxSize: number);
-}
 /** Error thrown when serialized data is invalid or malformed. */
 export declare class InvalidSerializedDataError extends SerializationError {
     constructor(message: string, options?: {

package/dist/domain/serialization/serializationError.types.js

@@ -71,55 +71,6 @@ export class CircularReferenceError extends SerializationError {
         this.circularPath = path;
     }
 }
-/**
- * Error thrown when maximum serialization depth is exceeded.
- *
- * By default over-deep data is a server-side data bug, so this is an
- * internal (500) error. Code that checks UNTRUSTED input (for example
- * `assertDepthWithinLimit` in `@zudojs/validation`) passes
- * `{ statusCode: 400, expose: true }`: too-deep client input is a client
- * error. The message holds only the two numbers, so it is safe to expose.
- */
-export class SerializationDepthError extends SerializationError {
-    depth;
-    maxDepth;
-    /** @deprecated Use `maxDepth`. */
-    maxDepthValue;
-    constructor(depth, maxDepth, options = {}) {
-        super(`Maximum serialization depth exceeded: ${depth} > ${maxDepth}`, {
-            code: ErrorCode.MAX_DEPTH_EXCEEDED,
-            depth,
-            maxDepth,
-            statusCode: options.statusCode ?? 500,
-            expose: options.expose ?? false,
-        });
-        this.depth = depth;
-        this.maxDepth = maxDepth;
-        this.maxDepthValue = maxDepth;
-    }
-}
-/** Error thrown when a serialized payload exceeds the size limit. */
-export class SerializationPayloadTooLargeError extends SerializationError {
-    size;
-    maxSize;
-    /** @deprecated Use `size`. */
-    payloadSize;
-    /** @deprecated Use `maxSize`. */
-    maxSizeValue;
-    constructor(size, maxSize) {
-        super(`Serialized payload too large: ${size} bytes (max: ${maxSize})`, {
-            code: ErrorCode.PAYLOAD_TOO_LARGE,
-            size,
-            maxSize,
-            statusCode: 413,
-            expose: false,
-        });
-        this.size = size;
-        this.maxSize = maxSize;
-        this.payloadSize = size;
-        this.maxSizeValue = maxSize;
-    }
-}
 /** Error thrown when serialized data is invalid or malformed. */
 export class InvalidSerializedDataError extends SerializationError {
     constructor(message, options = {}) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/errors",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Shared error base class, error codes, and error handling utilities for the Zudojs framework.",
   "type": "module",
   "main": "./dist/index.js",