npm - alepha - Versions diffs - 0.20.3 → 0.20.5 - Mend

alepha 0.20.3 → 0.20.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (218) hide show

package/dist/api/audits/index.d.ts.map +1 -1
package/dist/api/files/index.d.ts.map +1 -1
package/dist/api/jobs/index.d.ts +14 -14
package/dist/api/jobs/index.d.ts.map +1 -1
package/dist/api/organizations/index.d.ts.map +1 -1
package/dist/api/parameters/index.d.ts +6 -1
package/dist/api/parameters/index.d.ts.map +1 -1
package/dist/api/parameters/index.js +20 -4
package/dist/api/parameters/index.js.map +1 -1
package/dist/api/payments/index.d.ts.map +1 -1
package/dist/api/users/index.browser.js +6 -0
package/dist/api/users/index.browser.js.map +1 -1
package/dist/api/users/index.d.ts +5032 -134
package/dist/api/users/index.d.ts.map +1 -1
package/dist/api/users/index.js +58 -10
package/dist/api/users/index.js.map +1 -1
package/dist/bin/index.js +0 -0
package/dist/bucket/index.d.ts +77 -107
package/dist/bucket/index.d.ts.map +1 -1
package/dist/bucket/index.js +148 -4
package/dist/bucket/index.js.map +1 -1
package/dist/bucket/index.workerd.js +7 -1
package/dist/bucket/index.workerd.js.map +1 -1
package/dist/cache/core/index.d.ts +26 -0
package/dist/cache/core/index.d.ts.map +1 -1
package/dist/cache/core/index.js +11 -1
package/dist/cache/core/index.js.map +1 -1
package/dist/cache/core/index.workerd.js +11 -1
package/dist/cache/core/index.workerd.js.map +1 -1
package/dist/cli/config/index.d.ts +7 -5
package/dist/cli/config/index.d.ts.map +1 -1
package/dist/cli/config/index.js +2 -3
package/dist/cli/config/index.js.map +1 -1
package/dist/cli/core/index.d.ts +419 -12
package/dist/cli/core/index.d.ts.map +1 -1
package/dist/cli/core/index.js +22 -511
package/dist/cli/core/index.js.map +1 -1
package/dist/cli/devtools/index.d.ts +4 -8
package/dist/cli/devtools/index.d.ts.map +1 -1
package/dist/cli/devtools/index.js +13 -15
package/dist/cli/devtools/index.js.map +1 -1
package/dist/cli/platform/index.d.ts +10 -13
package/dist/cli/platform/index.d.ts.map +1 -1
package/dist/cli/platform/index.js +18 -15
package/dist/cli/platform/index.js.map +1 -1
package/dist/cli/vendor/index.d.ts +10 -13
package/dist/cli/vendor/index.d.ts.map +1 -1
package/dist/cli/vendor/index.js +16 -13
package/dist/cli/vendor/index.js.map +1 -1
package/dist/command/index.d.ts +1 -1
package/dist/core/index.browser.js +27 -3
package/dist/core/index.browser.js.map +1 -1
package/dist/core/index.d.ts +6 -3
package/dist/core/index.d.ts.map +1 -1
package/dist/core/index.js +27 -3
package/dist/core/index.js.map +1 -1
package/dist/core/index.native.js +27 -3
package/dist/core/index.native.js.map +1 -1
package/dist/core/index.workerd.js +27 -3
package/dist/core/index.workerd.js.map +1 -1
package/dist/datetime/index.d.ts +69 -10
package/dist/datetime/index.d.ts.map +1 -1
package/dist/datetime/index.js +135 -13
package/dist/datetime/index.js.map +1 -1
package/dist/email/smtp/index.js +10636 -2
package/dist/email/smtp/index.js.map +1 -1
package/dist/fake/index.d.ts +8085 -4
package/dist/fake/index.d.ts.map +1 -1
package/dist/fake/index.js +33554 -3
package/dist/fake/index.js.map +1 -1
package/dist/lock/core/index.d.ts +30 -2
package/dist/lock/core/index.d.ts.map +1 -1
package/dist/lock/core/index.js +35 -12
package/dist/lock/core/index.js.map +1 -1
package/dist/mcp/index.d.ts +238 -31
package/dist/mcp/index.d.ts.map +1 -1
package/dist/mcp/index.js +198 -71
package/dist/mcp/index.js.map +1 -1
package/dist/orm/core/index.browser.js +1 -1
package/dist/orm/core/index.browser.js.map +1 -1
package/dist/orm/core/index.bun.js +4 -3
package/dist/orm/core/index.bun.js.map +1 -1
package/dist/orm/core/index.d.ts +4877 -9
package/dist/orm/core/index.d.ts.map +1 -1
package/dist/orm/core/index.js +4 -3
package/dist/orm/core/index.js.map +1 -1
package/dist/orm/postgres/index.d.ts +608 -1
package/dist/orm/postgres/index.d.ts.map +1 -1
package/dist/react/core/index.d.ts +102 -1
package/dist/react/core/index.d.ts.map +1 -1
package/dist/react/core/index.js +65 -1
package/dist/react/core/index.js.map +1 -1
package/dist/react/form/index.d.ts +6 -0
package/dist/react/form/index.d.ts.map +1 -1
package/dist/react/form/index.js +7 -7
package/dist/react/form/index.js.map +1 -1
package/dist/react/i18n/index.d.ts +7 -1
package/dist/react/i18n/index.d.ts.map +1 -1
package/dist/react/i18n/index.js +6 -0
package/dist/react/i18n/index.js.map +1 -1
package/dist/react/router/index.browser.js +20 -2
package/dist/react/router/index.browser.js.map +1 -1
package/dist/react/router/index.d.ts +36 -4
package/dist/react/router/index.d.ts.map +1 -1
package/dist/react/router/index.js +20 -2
package/dist/react/router/index.js.map +1 -1
package/dist/react/testing/chunk-6Ep1yQYe.js +16 -0
package/dist/react/testing/index.d.ts +411 -1
package/dist/react/testing/index.d.ts.map +1 -1
package/dist/react/testing/index.js +12293 -13
package/dist/react/testing/index.js.map +1 -1
package/dist/react/ui/index.d.ts +195 -1
package/dist/react/ui/index.d.ts.map +1 -1
package/dist/react/ui/index.js +61 -1
package/dist/react/ui/index.js.map +1 -1
package/dist/scheduler/index.d.ts +84 -3
package/dist/scheduler/index.d.ts.map +1 -1
package/dist/scheduler/index.js +390 -1
package/dist/scheduler/index.js.map +1 -1
package/dist/scheduler/index.workerd.js +390 -1
package/dist/scheduler/index.workerd.js.map +1 -1
package/dist/security/index.d.ts +325 -2
package/dist/security/index.d.ts.map +1 -1
package/dist/security/index.js +1361 -2
package/dist/security/index.js.map +1 -1
package/dist/server/auth/index.d.ts +1054 -1
package/dist/server/auth/index.d.ts.map +1 -1
package/dist/server/auth/index.js +1223 -1
package/dist/server/auth/index.js.map +1 -1
package/dist/server/core/index.browser.js +10 -3
package/dist/server/core/index.browser.js.map +1 -1
package/dist/server/core/index.d.ts.map +1 -1
package/dist/server/core/index.js +28 -5
package/dist/server/core/index.js.map +1 -1
package/dist/server/metrics/index.d.ts +514 -1
package/dist/server/metrics/index.d.ts.map +1 -1
package/dist/server/metrics/index.js +4374 -4
package/dist/server/metrics/index.js.map +1 -1
package/dist/server/swagger/index.d.ts.map +1 -1
package/dist/server/swagger/index.js +3 -4
package/dist/server/swagger/index.js.map +1 -1
package/dist/websocket/index.browser.js +11 -5
package/dist/websocket/index.browser.js.map +1 -1
package/dist/websocket/index.d.ts +3 -1
package/dist/websocket/index.d.ts.map +1 -1
package/dist/websocket/index.js +21 -6
package/dist/websocket/index.js.map +1 -1
package/package.json +416 -8
package/src/api/parameters/services/ParameterProvider.ts +21 -4
package/src/api/users/__tests__/SessionService.spec.ts +99 -0
package/src/api/users/__tests__/UserJobs.spec.ts +67 -0
package/src/api/users/atoms/realmAuthSettingsAtom.ts +15 -0
package/src/api/users/entities/sessions.ts +6 -0
package/src/api/users/jobs/UserJobs.ts +44 -17
package/src/api/users/providers/RealmProvider.ts +4 -0
package/src/api/users/services/SessionService.ts +27 -0
package/src/bucket/__tests__/NodeS3BucketProvider.spec.ts +74 -0
package/src/bucket/index.ts +19 -2
package/src/bucket/primitives/$bucket.ts +9 -1
package/src/bucket/providers/CloudflareR2Provider.ts +2 -137
package/src/bucket/providers/NodeS3BucketProvider.ts +218 -0
package/src/cache/core/index.ts +29 -0
package/src/cache/core/primitives/$cache.ts +14 -1
package/src/cli/config/defineConfig.ts +13 -15
package/src/cli/core/__tests__/init.spec.ts +6 -7
package/src/cli/core/services/ProjectScaffolder.ts +18 -14
package/src/cli/core/tasks/BuildCloudflareTask.ts +5 -0
package/src/cli/core/templates/agentMd.ts +2 -10
package/src/cli/core/templates/saasAdminLayoutTsx.ts +3 -3
package/src/cli/devtools/index.ts +12 -26
package/src/cli/platform/index.ts +15 -24
package/src/cli/vendor/atoms/vendorOptions.ts +1 -1
package/src/cli/vendor/index.ts +14 -23
package/src/core/Alepha.ts +11 -1
package/src/core/helpers/ref.ts +18 -0
package/src/core/index.shared.ts +1 -0
package/src/core/providers/SchemaValidator.ts +9 -1
package/src/core/providers/TypeProvider.ts +1 -2
package/src/datetime/REFACTORING.md +118 -0
package/src/datetime/providers/DateTimeProvider.ts +203 -24
package/src/lock/core/index.ts +31 -0
package/src/lock/core/primitives/$lock.ts +14 -1
package/src/mcp/__tests__/jsonrpc.spec.ts +1 -1
package/src/mcp/helpers/jsonrpc.ts +26 -1
package/src/mcp/index.ts +10 -5
package/src/mcp/interfaces/McpTypes.ts +83 -6
package/src/mcp/primitives/$prompt.ts +18 -1
package/src/mcp/primitives/$resource.ts +18 -1
package/src/mcp/primitives/$tool.ts +83 -7
package/src/mcp/providers/McpServerProvider.ts +74 -16
package/src/mcp/transports/StreamableHttpMcpTransport.ts +226 -0
package/src/orm/REFACTORING.md +330 -0
package/src/orm/core/primitives/$transactional.ts +11 -0
package/src/orm/core/schemas/updateSchema.ts +1 -1
package/src/orm/core/services/PgRelationManager.ts +4 -2
package/src/react/core/__tests__/useQuery.browser.spec.tsx +86 -0
package/src/react/core/hooks/useQuery.ts +153 -0
package/src/react/core/index.ts +1 -0
package/src/react/form/services/FormModel.ts +15 -6
package/src/react/form/services/parseField.ts +8 -0
package/src/react/i18n/providers/I18nProvider.ts +8 -2
package/src/react/router/__tests__/$page.spec.tsx +0 -16
package/src/react/router/__tests__/ssr.spec.tsx +339 -0
package/src/react/router/primitives/$page.ts +28 -4
package/src/react/router/providers/ReactPageProvider.ts +27 -9
package/src/react/ui/atoms/uiThemeListAtom.ts +36 -0
package/src/react/ui/index.ts +6 -0
package/src/react/ui/services/SchemaControl.ts +209 -0
package/src/security/primitives/$issuer.ts +6 -3
package/src/server/core/__tests__/ServerRouterProvider-serializationError.spec.ts +75 -0
package/src/server/core/__tests__/ServerRouterProvider-validationError.spec.ts +306 -0
package/src/server/core/errors/ValidationError.ts +13 -1
package/src/server/core/primitives/$action.ts +16 -5
package/src/server/core/providers/ServerRouterProvider.ts +26 -4
package/src/server/swagger/providers/ServerSwaggerProvider.ts +5 -7
package/src/websocket/providers/NodeWebSocketServerProvider.ts +10 -4
package/src/websocket/services/WebSocketClient.ts +11 -5
package/src/mcp/transports/SseMcpTransport.ts +0 -182

package/src/react/router/providers/ReactPageProvider.ts CHANGED Viewed

@@ -470,6 +470,14 @@ export class ReactPageProvider {
       }
     }
+    // If the matched leaf opts out of SSR (own value or inherited from
+    // parents), wrap the root layer in ClientOnly so the server emits no
+    // HTML for the route chain. Loaders have already run above.
+    if (state.layers.length > 0 && !this.isSSR(route)) {
+      const rootLayer = state.layers[0];
+      rootLayer.element = createElement(ClientOnly, {}, rootLayer.element);
+    }
     return { state };
   }
@@ -598,14 +606,6 @@ export class ReactPageProvider {
   ): ReactNode {
     view ??= this.renderEmptyView();
-    const element = page.client
-      ? createElement(
-          ClientOnly,
-          typeof page.client === "object" ? page.client : {},
-          view,
-        )
-      : view;
     return createElement(
       RouterLayerContext.Provider,
       {
@@ -616,10 +616,28 @@ export class ReactPageProvider {
             this.getErrorHandler(page) ?? ((error) => this.renderError(error)),
         },
       },
-      element,
+      view,
     );
   }
+  /**
+   * Resolve the effective `ssr` value for a route by walking up the parent
+   * chain. Returns the nearest explicit `ssr` value, defaulting to `true`.
+   *
+   * The decision is made at the leaf: a parent's `ssr` only acts as a default
+   * for descendants that did not set their own value.
+   */
+  public isSSR(route: PageRoute): boolean {
+    let current: PageRoute | undefined = route;
+    while (current) {
+      if (typeof current.ssr === "boolean") {
+        return current.ssr;
+      }
+      current = current.parent;
+    }
+    return true;
+  }
   protected map(
     pages: Array<PagePrimitive>,
     target: PagePrimitive,

package/src/react/ui/atoms/uiThemeListAtom.ts ADDED Viewed

@@ -0,0 +1,36 @@
+import { $atom, type Static, t } from "alepha";
+/**
+ * Available themes the user can pick from. Apps populate this atom on boot
+ * (e.g. `alepha.store.set(uiThemeListAtom, MY_THEMES)`); UI consumers like
+ * `<ButtonTheme/>` read it to render a picker. The selected theme id is
+ * persisted separately in `uiAtom.theme`.
+ *
+ * Defaults to a single `"default"` entry so the registry stays usable when
+ * an app doesn't declare its own list.
+ */
+export const uiThemeListAtom = $atom({
+  name: "alepha.react.ui.themes",
+  schema: t.array(
+    t.object({
+      /** Stable id stored in `uiAtom.theme`. Mapped to a CSS class on `<html>`. */
+      id: t.string(),
+      /** Human-readable label shown in the picker. */
+      label: t.string(),
+      /**
+       * Optional 4-color preview swatch in 2×2 order (TL, TR, BL, BR). Any
+       * CSS-valid color string.
+       */
+      swatch: t.optional(t.array(t.string(), { minItems: 4, maxItems: 4 })),
+      /**
+       * Optional stylesheet URL (typically Google Fonts) loaded lazily when
+       * the theme is selected.
+       */
+      fontHref: t.optional(t.string()),
+    }),
+  ),
+  default: [{ id: "default", label: "Default" }],
+});
+export type UiThemeList = Static<typeof uiThemeListAtom.schema>;
+export type UiTheme = UiThemeList[number];

package/src/react/ui/index.ts CHANGED Viewed

@@ -1,14 +1,18 @@
 import { $module } from "alepha";
 import type { UiState } from "./atoms/uiAtom.ts";
+import type { UiThemeList } from "./atoms/uiThemeListAtom.ts";
+import { uiThemeListAtom } from "./atoms/uiThemeListAtom.ts";
 import { UiPersistence } from "./services/UiPersistence.ts";
 // ---------------------------------------------------------------------------------------------------------------------
 export * from "./atoms/uiAtom.ts";
+export * from "./atoms/uiThemeListAtom.ts";
 export * from "./components/ColorScheme.tsx";
 export * from "./hooks/useColorMode.ts";
 export * from "./hooks/useSidebarState.ts";
 export * from "./hooks/useTheme.ts";
+export * from "./services/SchemaControl.ts";
 export * from "./services/UiPersistence.ts";
 // ---------------------------------------------------------------------------------------------------------------------
@@ -16,6 +20,7 @@ export * from "./services/UiPersistence.ts";
 declare module "alepha" {
   export interface State {
     "alepha.react.ui": UiState;
+    "alepha.react.ui.themes": UiThemeList;
   }
 }
@@ -31,5 +36,6 @@ declare module "alepha" {
  */
 export const AlephaReactUi = $module({
   name: "alepha.react.ui",
+  atoms: [uiThemeListAtom],
   services: [UiPersistence],
 });

package/src/react/ui/services/SchemaControl.ts ADDED Viewed

@@ -0,0 +1,209 @@
+import type { FormModel } from "alepha/react/form";
+/**
+ * Schema-bound metadata read by `<Control>` (in `@alepha/ui-registry`) to
+ * configure how a field renders. Place under `$control` on any TypeBox
+ * schema option.
+ *
+ * Two forms:
+ *
+ * 1. **Object** — static configuration baked into the schema:
+ *    ```ts
+ *    t.string({ $control: { password: true, icon: "key" } })
+ *    ```
+ *
+ * 2. **Function** — dynamic, computed from current form state:
+ *    ```ts
+ *    t.string({
+ *      $control: ({ form, value }) => {
+ *        if (form.currentValues.kind !== "advanced") return false; // hide
+ *        return { items: () => fetchOptions(form.currentValues.kind) };
+ *      },
+ *    })
+ *    ```
+ *
+ * The function may return:
+ * - a partial `SchemaControl` to merge with explicit `<Control>` props
+ * - `false` to hide the control entirely
+ * - `undefined` to leave the field as-is
+ */
+export interface SchemaControl {
+  // ── Variant forcing ────────────────────────────────────────────────
+  text?: boolean;
+  area?: boolean;
+  password?: boolean;
+  switch?: boolean;
+  number?: boolean;
+  file?: boolean;
+  date?: boolean;
+  datetime?: boolean;
+  time?: boolean;
+  select?: boolean;
+  combobox?: boolean;
+  segmented?: boolean;
+  slider?: boolean;
+  object?: boolean;
+  array?: boolean;
+  // ── Labels / hints ────────────────────────────────────────────────
+  /**
+   * Icon name. The registry control maps this to its icon set
+   * (lucide-react). Pass `null` to suppress the schema-inferred icon.
+   */
+  icon?: string | null;
+  label?: string;
+  description?: string;
+  placeholder?: string;
+  /**
+   * HTML `autocomplete` attribute. Use standard tokens like
+   * `"username"`, `"email"`, `"new-password"`, `"current-password"`,
+   * `"street-address"`, `"address-line1"`, `"address-level2"` (city),
+   * `"postal-code"`, `"country"`, `"cc-number"`, `"cc-exp"`,
+   * `"cc-csc"`, `"cc-name"`, `"tel"`, etc.
+   */
+  autoComplete?: string;
+  // ── Data ──────────────────────────────────────────────────────────
+  /**
+   * Static or async option list for select / combobox / multi-select.
+   * Each item is either a bare string (used as both value & label) or a
+   * `{ value, label, description?, tag? }` object.
+   */
+  items?: Array<string | SchemaControlItem> | SchemaControlItemsFn;
+  /**
+   * Re-fetch `items` (when async) whenever any of these reference values
+   * change. Useful for cascading selects.
+   */
+  itemsWatch?: unknown[];
+  /**
+   * Allow the user to create a new option by typing into a select /
+   * multi-select. Pass `true` for `{ value: query, label: query }`, or a
+   * function returning a custom option built from the query.
+   */
+  createNewEntry?:
+    | boolean
+    | ((query: string) => { value: string; label: string });
+  // ── Layout ────────────────────────────────────────────────────────
+  /**
+   * Width slot inside an `<AutoForm>` group. Mapped to a grid column span.
+   * - `100` → full row
+   * - `75`  → 3/4 row
+   * - `66`  → 2/3 row
+   * - `50`  → half
+   * - `33`  → one third (default for plain primitives)
+   * - `25`  → one quarter
+   */
+  width?: 100 | 75 | 66 | 50 | 33 | 25;
+  // ── Behavior ─────────────────────────────────────────────────────
+  /**
+   * Render `null` (hide) when truthy. Equivalent to a function `$control`
+   * returning `false`, but available as a static value.
+   */
+  hidden?: boolean;
+  disabled?: boolean;
+  readOnly?: boolean;
+  // ── Slots ─────────────────────────────────────────────────────────
+  /**
+   * Render before/after the field. Both receive the resolved input.
+   * Typed loosely — UI layer narrows to `ReactNode`.
+   */
+  top?: unknown;
+  bottom?: unknown;
+  // ── File upload ───────────────────────────────────────────────────
+  /**
+   * Render a managed upload control (image preview, multi, drag-drop)
+   * that posts to the file API and stores the resulting file ID(s) in
+   * the form. Pass `true` for defaults or an options object:
+   *
+   * ```ts
+   * $control: { upload: { multi: true, accept: "image/*", maxSize: 5_000_000 } }
+   * ```
+   */
+  upload?:
+    | boolean
+    | {
+        multi?: boolean;
+        accept?: string;
+        maxSize?: number;
+        bucket?: string;
+      };
+  // ── Array specifics ───────────────────────────────────────────────
+  arrayProps?: {
+    confirmDelete?: boolean | { title?: string; message?: string };
+    /** Computed label for each tab when an array uses tabs mode. */
+    renderTabName?: (i: number, value: unknown) => string;
+    sortable?: boolean;
+    collapsible?: boolean;
+    /** Force grouped (CreateForm-style) tabs even for short arrays. */
+    forceTabs?: boolean;
+  };
+  // ── Open extension ────────────────────────────────────────────────
+  [key: string]: unknown;
+}
+export interface SchemaControlItem {
+  value: string | number | boolean;
+  label: string;
+  description?: string;
+  tag?: string;
+}
+export type SchemaControlItemsFn = (
+  query: string,
+) =>
+  | Array<string | SchemaControlItem>
+  | Promise<Array<string | SchemaControlItem>>;
+/**
+ * Function form of `$control`. Receives the live form model + the current
+ * field value, and returns a partial config (merged with explicit props),
+ * `false` to hide, or `undefined` to leave as-is.
+ */
+export type SchemaControlFn = (context: {
+  form: FormModel<any>;
+  value: unknown;
+}) => Partial<SchemaControl> | false | undefined;
+export type SchemaControlOption = SchemaControl | SchemaControlFn;
+/**
+ * Resolve a raw `$control` value (object or function) into a concrete
+ * partial config. Returns `null` when the field should be hidden.
+ */
+export const resolveSchemaControl = (
+  raw: unknown,
+  context: { form: FormModel<any>; value: unknown },
+): Partial<SchemaControl> | null => {
+  if (raw == null) return {};
+  if (typeof raw === "function") {
+    const result = (raw as SchemaControlFn)(context);
+    if (result === false) return null;
+    if (!result) return {};
+    if (result.hidden) return null;
+    return result;
+  }
+  if (typeof raw === "object") {
+    const obj = raw as SchemaControl;
+    if (obj.hidden) return null;
+    return obj;
+  }
+  return {};
+};
+declare module "typebox" {
+  interface TSchemaOptions {
+    /**
+     * UI metadata read by `<Control>` from `@alepha/ui-registry`. See
+     * {@link SchemaControl}.
+     */
+    $control?: SchemaControlOption;
+  }
+}

package/src/security/primitives/$issuer.ts CHANGED Viewed

@@ -75,9 +75,12 @@ export interface IssuerSettings {
      */
     expiration?: DurationLike;
-    // TODO: expirationIdle (max inactive time before the token is invalidated).
-    // Requires tracking lastUsedAt on session refresh and rejecting tokens
-    // that have been idle longer than the threshold.
+    /**
+     * Idle invalidation is enforced by session-backed realms via
+     * `realmAuthSettings.refreshToken.expirationIdle` (in `alepha/api/users`).
+     * Token-only refresh (no `onRefreshSession`) does not support idle
+     * invalidation — it has no stateful row to track `lastUsedAt`.
+     */
   };
   onCreateSession?: (

package/src/server/core/__tests__/ServerRouterProvider-serializationError.spec.ts ADDED Viewed

@@ -0,0 +1,75 @@
+import { Alepha, t } from "alepha";
+import { describe, it } from "vitest";
+import { $action, ServerProvider } from "../index.ts";
+class TestApp {
+  badResponse = $action({
+    schema: {
+      response: t.object({
+        name: t.text(),
+        age: t.integer(),
+      }),
+    },
+    handler: () =>
+      ({
+        // missing required `age` → response codec.encode will throw
+        name: "John",
+        secretToken: "leaked-token-xyz",
+      }) as any,
+  });
+}
+describe("ServerRouterProvider - response serialization error", () => {
+  describe("in production mode", () => {
+    it("should not leak validation details or response payload in 500 response", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create({
+        env: { NODE_ENV: "production", SERVER_PORT: 0 },
+      }).with(TestApp);
+      await alepha.start();
+      const hostname = alepha.inject(ServerProvider).hostname;
+      const response = await fetch(`${hostname}/api/badResponse`);
+      const json = await response.json();
+      expect(response.status).toBe(500);
+      expect(json.error).toBe("InternalServerError");
+      expect(json.message).toBe("Internal Server Error");
+      // payload from the handler must not leak through the error
+      const dump = JSON.stringify(json);
+      expect(dump).not.toContain("leaked-token-xyz");
+      expect(dump).not.toContain("secretToken");
+      await alepha.stop();
+    });
+  });
+  describe("in development mode", () => {
+    it("should include explicit validation details in 500 response", async ({
+      expect,
+    }) => {
+      const alepha = Alepha.create().with(TestApp);
+      await alepha.start();
+      const hostname = alepha.inject(ServerProvider).hostname;
+      const response = await fetch(`${hostname}/api/badResponse`);
+      const json = await response.json();
+      expect(response.status).toBe(500);
+      expect(json.error).toBe("InternalServerError");
+      // dev mode must surface enough context to debug the schema mismatch
+      expect(json.message).not.toBe("Internal Server Error");
+      expect(json.message.toLowerCase()).toMatch(/age|required|expected/);
+      // even in dev, the raw handler payload (potential secrets) must not be echoed
+      expect(json.message).not.toContain("leaked-token-xyz");
+      await alepha.stop();
+    });
+  });
+});