exisjs 0.7.13 → 0.8.0

package/dist/docs/content/decorators.mdx

@@ -481,7 +481,7 @@ export class OrderService implements OnInit, OnDestroy {
 | `OnDestroy` (`onDestroy()`) | Class Interface | Invoked once during graceful shutdown. |
 | `OnModuleInit` / `OnModuleDestroy` | Class Interface | Invoked during parent module initialization and destruction. |
 | `OnApplicationBootstrap` | Class Interface | Invoked when all modules are initialized and server starts listening. |
-| `OnApplicationShutdown` | Class Interface | Invoked on `SIGTERM` or `SIGINT` signals. |
+| `OnApplicationShutdown` | Class Interface | `onApplicationShutdown(signal?)` runs during graceful shutdown; `signal` is `'SIGTERM'` or `'SIGINT'` when a signal triggered it. |
 
 ---
 
@@ -601,7 +601,7 @@ import { UserService } from './service'
 @Controller('/users')
 export default class UsersController {
   constructor(
-    private userService: UserService,
+    @Inject(UserService) private userService: UserService,
     @Inject('DATABASE_URL') private dbUrl: string,
     @Optional() @Inject('ANALYTICS_SERVICE') private analytics?: any
   ) {}

package/dist/docs/content/errors.mdx

@@ -120,28 +120,44 @@ export default class UsersController {
 
 ## Standard Error Response Format
 
-When an `HttpError` is thrown, ExisJS returns a standardized JSON payload:
+Every error response has the same core shape, whatever caused it:
 
 ```json filename="HTTP 404 Response"
 {
   "success": false,
   "statusCode": 404,
-  "error": "Not Found",
-  "message": "User not found",
-  "validationErrors": null,
-  "timestamp": "2026-10-02T12:45:00.000Z"
+  "error": {
+    "code": "NOT_FOUND",
+    "message": "User not found"
+  }
 }
 ```
 
+| Field | Description |
+| :--- | :--- |
+| `success` | Always `false` for errors |
+| `statusCode` | Same as the HTTP status |
+| `error.code` | Stable machine-readable code: `NOT_FOUND`, `UNAUTHORIZED`, `VALIDATION_ERROR`, `INTERNAL_ERROR`... |
+| `error.message` | Human-readable message. For unexpected errors in production it is a generic message; internals are never exposed |
+| `error.details` | Optional extra data (validation issues, or the `details` passed to an `HttpError`) |
+
+Clients can rely on `error.code` and `error.message` for every failed request.
+
 ### Validation Error Responses
 
 When schema validation fails (via `tex`, Zod, or Yup), ExisJS intercepts the validation failure and generates a structured `400 Bad Request` payload containing field-level error mappings:
 
+The top-level `message`, `validationErrors`, `errors` and `details` fields are kept for existing clients; new code should read `error.details`. Values of credential fields (`password`, `token`, `secret`...) are replaced with `[Redacted]` in responses and logs.
+
 ```json filename="HTTP 400 Validation Error Response"
 {
   "success": false,
   "statusCode": 400,
-  "error": "Bad Request",
+  "error": {
+    "code": "VALIDATION_ERROR",
+    "message": "Validation Error: email: Invalid email format, age: Minimum age is 18",
+    "details": [ /* same entries as "details" below */ ]
+  },
   "message": "Validation Error: email: Invalid email format, age: Minimum age is 18",
   "validationErrors": {
     "email": "Invalid email format",

package/dist/docs/content/installation.mdx

@@ -119,7 +119,7 @@ my-api/
 │       ├── route.ts             # Root route handler (/)
 │       └── server.ts            # Application lifecycle (onStart / onClose)
 ├── tests/
-│   └── users.e2e-spec.ts        # End-to-end test suite
+│   └── users.test.ts        # End-to-end test suite
 ├── .env                         # Environment variables
 ├── .gitignore
 ├── .prettierrc
@@ -178,7 +178,7 @@ Create or update `tsconfig.json` to configure module resolution and metadata ref
 ```
 
 > [!NOTE]
-> `experimentalDecorators` and `emitDecoratorMetadata` are required when using the class-based (OOP) paradigm (`@Controller()`, `@Injectable()`).
+> `experimentalDecorators` is required when using the class-based (OOP) paradigm; `emitDecoratorMetadata` is harmless but not used by the ExisJS toolchain, so inject constructor dependencies with `@Inject(Token)`. This applies to the class-based (OOP) paradigm (`@Controller()`, `@Injectable()`).
 
 ### Step 3: Create `exis.config.ts`
 
@@ -191,18 +191,23 @@ const config: ExisConfig = {
   port: Number(process.env.PORT) || 4000,
   host: '0.0.0.0',
 
-  cors: {
-    origin: process.env.CORS_ORIGIN || '*',
-    credentials: true,
-  },
+  // Credentialed requests need explicit origins (comma-separated CORS_ORIGIN).
+  // Without it, any origin may call the API, but without cookies.
+  cors: process.env.CORS_ORIGIN
+    ? { origin: process.env.CORS_ORIGIN.split(','), credentials: true }
+    : { origin: '*' },
 
   logger: {
-    level: 'debug',
+    level: process.env.NODE_ENV === 'production' ? 'info' : 'debug',
     pretty: process.env.NODE_ENV !== 'production',
   },
 
   helmet: { enabled: true },
   compression: true,
+
+  // Swagger UI at /docs; set enabled to
+  // process.env.NODE_ENV !== 'production' to hide it in production
+  docs: { enabled: true },
 }
 
 export default config
@@ -278,7 +283,7 @@ npm run dev
 Output:
 
 ```text filename="Terminal"
-[exis] starting development server (v0.7.12)...
+[exis] starting development server (v0.8.0)...
 EXIS ready in 125 ms
 
 → Local:   http://localhost:4000/

package/dist/docs/content/introduction.mdx

@@ -9,7 +9,7 @@ nextTitle: 'Installation'
 
 **ExisJS** is an opinionated web framework for building TypeScript backends on Node.js. It brings convention-over-configuration and automatic file-system routing to backend API development.
 
-Rather than manually assembling, wiring, and maintaining separate third-party libraries for routing, input validation, dependency injection, OpenAPI documentation, rate limiting, and background task scheduling, ExisJS provides a standard library integrated with a native Rust acceleration engine (`@exisjs/rs`).
+Rather than manually assembling, wiring, and maintaining separate third-party libraries for routing, input validation, dependency injection, OpenAPI documentation, rate limiting, and background task scheduling, ExisJS provides an integrated standard library in a lightweight, pure TypeScript core with no native add-ons.
 
 ---
 
@@ -20,7 +20,7 @@ TypeScript backend development often faces two approaches:
 1. **Micro-frameworks (Express, Fastify)**: Require developers to manually select, wire, and maintain middleware packages for validation, OpenAPI schemas, dependency injection, and security headers. Over time, projects diverge in structure and maintenance overhead increases.
 2. **Heavy enterprise frameworks**: Introduce deep class hierarchies, verbose configuration modules, and steep learning curves.
 
-ExisJS combines convention-based file routing, built-in standard modules, and native Rust primitives with support for both functional and object-oriented paradigms.
+ExisJS combines convention-based file routing, built-in standard modules, and a lean runtime with support for both functional and object-oriented paradigms.
 
 ---
 
@@ -38,16 +38,16 @@ ExisJS combines convention-based file routing, built-in standard modules, and na
 │  Request Context (ExisRequest/Response) · Hierarchical Boundaries · Swagger │
 │        Rate Limiting · Helmet Headers · CSRF · Idempotency · Telemetry      │
 └──────────────────────────────────────┬──────────────────────────────────────┘
-                                       │ (N-API Direct Bindings with Fallback)
+                                       │
 ┌──────────────────────────────────────▼──────────────────────────────────────┐
-│                       Native Rust Engine (@exisjs/rs)                       │
-│    NativeRadixTree Routing  │  LRU Memory Cache  │  Fast CIDR IP Filtering  │
-│    TexValidator Accelerator │  Safe Sanitization Body Parser                │
+│                               Runtime Core                                  │
+│      Radix-Tree Router   │   Compiled tex Validators   │   CIDR IP Filter   │
+│      Secure Body Parser  │   Bounded In-Memory Caches                       │
 └─────────────────────────────────────────────────────────────────────────────┘
 ```
 
-### 1. File-System Native Routing
-The file-system routing engine scans the `src/http` directory and compiles route paths into a native Rust radix tree (`NativeRadixTree`). Path parameter extraction and endpoint dispatching execute through native N-API bindings.
+### 1. File-System Routing
+The file-system routing engine scans the `src/http` directory and compiles route paths into a radix tree at startup. Purely static paths resolve through an exact-match table; parameterized paths walk the tree with no per-request parsing of the route definitions.
 
 ### 2. Dual-Paradigm Parity
 ExisJS provides feature parity across both functional and object-oriented paradigms. Both compile down to the same runtime execution pipeline:
@@ -60,8 +60,8 @@ The built-in `tex` schema builder provides runtime type validation, parameter co
 ### 4. Hierarchical Security & Error Boundaries
 Directory-based `boundary.ts` files allow you to declare scoped authentication guards, rate limits, CORS configurations, and error handlers that cascade down folder trees without manual middleware repetition.
 
-### 5. Resilient Native Fallbacks
-All native Rust bindings (`@exisjs/rs`) include pure TypeScript fallback implementations. If native binaries cannot load on an unsupported architecture, ExisJS automatically runs its pure TypeScript fallback implementations.
+### 5. No Native Dependencies
+The core is pure TypeScript. There are no platform binaries to download or compile, so ExisJS installs the same way on every OS and CPU architecture that Node.js supports.
 
 ---
 
@@ -70,7 +70,7 @@ All native Rust bindings (`@exisjs/rs`) include pure TypeScript fallback impleme
 | Feature Area | ExisJS Built-In Capability | Benefit |
 | :--- | :--- | :--- |
 | **Routing** | File-system route discovery (`src/http/**/route.ts`) | No manual router mounting or path strings |
-| **Validation** | `tex` Schema Validator (Rust accelerated) | Fast parsing, zero-crash sanitization, automatic OpenAPI types |
+| **Validation** | `tex` Schema Validator (compiled once per schema) | Fast parsing, zero-crash sanitization, automatic OpenAPI types |
 | **Documentation** | Automatic Swagger / OpenAPI 3.1 at `/docs` | Self-updating interactive documentation with zero manual sync |
 | **Traffic Control** | Native Token Bucket Rate Limiting & CIDR Filtering | Fast DoS prevention and client throttling |
 | **Security** | Security headers (`helmet`), CSRF, HPP, Body Sanitization | Secure defaults without installing separate packages |
@@ -178,7 +178,7 @@ Every HTTP request dispatched through ExisJS follows a predictable, high-perform
 Incoming Request
       │
       ▼
-1. Native Radix Path Match (@exisjs/rs)
+1. Radix Path Match
       │
       ▼
 2. CIDR IP Filter & Rate Limit Check

package/dist/docs/content/middleware.mdx

@@ -24,7 +24,7 @@ All standard middlewares can be imported directly from `exisjs/middleware`. Cust
 | `requestLogger` | `requestLogger(options?)` | Request logger powered by Pino, injecting `req.log` with automatic timing and child loggers. |
 | `requestId` | `requestId()` | Attaches a unique `X-Request-Id` to requests and responses with distributed tracing headers. |
 | `compress` | `compress()` | Stream-based HTTP response compression supporting Gzip, Brotli, and Deflate. |
-| `rateLimit` | `rateLimit(options?)` | Off-heap / in-memory rate limiter returning `429 Too Many Requests` with standard headers. |
+| `rateLimit` | `rateLimit(options?)` | In-memory rate limiter returning `429 Too Many Requests` with standard headers. |
 | `idempotent` | `idempotent(options?)` | Duplicate mutation caching keyed by `Idempotency-Key` headers. |
 | `dedupe` | `dedupe(options)` | Merges simultaneous identical in-flight `GET` requests into a single operation. |
 | `backpressure` | `backpressure(options?)` | Queues requests during high load and sheds excess traffic with `503 Service Unavailable`. |

package/dist/docs/content/providers.mdx

@@ -70,7 +70,7 @@ export default controller({
 
 ### OOP Constructor and Property Injection
 
-In class-based controllers and services, dependencies declared in the constructor are automatically resolved using TypeScript's emitted metadata (`design:paramtypes`):
+In class-based controllers and services, constructor dependencies are injected by token. Mark each parameter with `@Inject(Token)`; a class is its own token. ExisJS does not rely on TypeScript's emitted type metadata (the `tsx`/esbuild toolchain does not produce it), so an undecorated parameter on a controller or `@Injectable()` class fails with a clear error instead of receiving `undefined`:
 
 ```typescript filename="src/http/users/route.ts"
 import { Controller, Get, Post, Body } from 'exisjs/decorators'
@@ -85,8 +85,8 @@ export default class UsersController {
   @Optional()
   private metrics?: MetricsService
 
-  // Automatic constructor injection
-  constructor(private usersService: UsersService) {}
+  // Constructor injection: the class is the token
+  constructor(@Inject(UsersService) private usersService: UsersService) {}
 
   @Get('/')
   async list() {
@@ -287,7 +287,7 @@ import { DatabaseService } from './database.service'
 
 @Injectable()
 export class RolesService {
-  constructor(private db: DatabaseService) {}
+  constructor(@Inject(DatabaseService) private db: DatabaseService) {}
 
   // Caches method results using an LRU cache
   @Cacheable({ ttl: 300, key: (id: string) => `role:${id}` })

package/dist/docs/content/requests.mdx

@@ -155,12 +155,23 @@ When running behind reverse proxies, load balancers, or CDNs (such as AWS ALB, C
 import type { ExisConfig } from 'exisjs/config'
 
 const config: ExisConfig = {
-  trustProxy: true, // Evaluates CF-Connecting-IP, X-Real-IP, and X-Forwarded-For
+  // Exactly one proxy (e.g. NGINX or a load balancer) in front of the app:
+  trustProxy: 1,
 }
 
 export default config
 ```
 
+Choose the value that matches your deployment:
+
+| Value | Trusts | Use when |
+| :--- | :--- | :--- |
+| `false` (default) | Nothing; `req.ip` is the socket address | The app is reached directly |
+| `N` (number) | The `N` closest hops, counting the socket peer. With `X-Forwarded-For: a, b` and `trustProxy: 1`, `req.ip` is `b`, the address your proxy saw. Values a client prepends are ignored. | You run behind a known number of proxies |
+| `true` | Every hop, plus CDN headers (`CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, `X-Client-IP`) | Every request passes through a CDN or proxy that overwrites these headers |
+
+> **Warning:** with `trustProxy: true`, any client that can reach the app directly can set these headers and spoof `req.ip`, and with it rate limits and IP filters. Prefer a hop count unless the app is only reachable through your proxy.
+
 When enabled:
 - `req.ip` automatically resolves the client IP, normalizes IPv6 loopback (`::1` $\to$ `127.0.0.1`), and strips IPv4-mapped IPv6 prefixes (`::ffff:192.168.1.1` $\to$ `192.168.1.1`).
 - `req.ips` provides the complete upstream proxy chain.

package/dist/docs/content/responses.mdx

@@ -248,22 +248,63 @@ res.clearCookie('token', { path: '/' })
 
 ## File Downloads & Streaming
 
-### File Downloads with `res.download()`
+### File Downloads
 
-Reads a file from disk, sets `Content-Disposition: attachment`, and infers MIME type:
+Return `download()` from a handler to send generated content (a string, `Buffer` or stream) as an attachment. It sets `Content-Disposition` and infers `Content-Type` from the filename:
 
 ```typescript filename="src/http/reports/route.ts"
 import { controller, route } from 'exisjs/router'
+import { download } from 'exisjs/response'
 
 export default controller({
-  download: route.get('/annual', {
+  exportCsv: route.get('/export', {
+    async handle() {
+      const csv = await ReportService.buildCsv()
+      return download(csv, 'report.csv')
+    },
+  }),
+  exportXlsx: route.get('/export.xlsx', {
+    async handle() {
+      const stream = await ReportService.streamWorkbook()
+      return download(stream, 'report.xlsx', {
+        headers: { 'Cache-Control': 'no-store' },
+      })
+    },
+  }),
+})
+```
+
+Pass `{ contentType }` to override the inferred MIME type. A handler that returns a plain `Buffer` sends it as `application/octet-stream`.
+
+#### Files on disk: `res.download(path)`
+
+`res.download()` sends a file from disk. A string argument is **always a file path**, never content; a missing file answers `404`. It also accepts a `Buffer` or stream.
+
+```typescript filename="src/http/reports/route.ts"
+import { controller, route } from 'exisjs/router'
+
+export default controller({
+  annual: route.get('/annual', {
     handle: async ({ res }) => {
       res.download('./storage/annual-report.pdf', 'Annual-Report-2026.pdf')
     },
   }),
+  // The filename comes from the request, so confine it to one directory
+  byName: route.get('/files/:name', {
+    handle: async ({ params, res }) => {
+      res.download(params.name, undefined, { root: './storage/exports' })
+    },
+  }),
 })
 ```
 
+> **Security:** whenever any part of the path comes from the request (a param, query value or body field), pass `root`. Paths that resolve outside it, such as `../../.env` or an absolute path, answer `404` instead of leaking the file.
+
+| | String argument means | Use for |
+| :--- | :--- | :--- |
+| `return download(data, name)` | Content | Generated CSV, JSON, reports |
+| `res.download(path, name?, { root })` | File path | Files stored on disk |
+
 ---
 
 ### Stream Piping (`res.stream()` / `res.sendStream()`)

package/dist/docs/content/routing.mdx

@@ -362,6 +362,30 @@ export default controller({
 
 ---
 
+## Reusing Route Types in Services
+
+`InferRouteInput` and `InferRouteOutput` derive types from a route definition, so service methods do not need a second copy of the request shape:
+
+```typescript filename="src/http/users/route.ts"
+import { route, type InferRouteInput, type InferRouteOutput } from 'exisjs/router'
+import { CreateUserSchema } from './schema'
+import { UserService } from './service'
+
+export const createUser = route.post('/', {
+  body: CreateUserSchema,
+  async handle({ body, resolve }) {
+    return resolve(UserService).create(body)
+  },
+})
+
+// { body, query, params } as the handler receives them, after validation
+export type CreateUserInput = InferRouteInput<typeof createUser>['body']
+// What the handler resolves to
+export type CreateUserResult = InferRouteOutput<typeof createUser>
+```
+
+---
+
 ## Dependency Resolution in Functional Routes
 
 Functional routes can resolve dependencies directly from the IoC container using `ctx.resolve()`:

package/dist/docs/content/structure.mdx

@@ -110,11 +110,14 @@ export default controller({
 ```typescript filename="src/http/users/route.ts"
 import { Controller, Get, Param, ApiOperation } from 'exisjs/decorators'
 import { userParamsSchema } from './schema'
+import { Inject } from 'exisjs/di'
 import { UserService } from './service'
 
 @Controller()
 export default class UsersController {
-  constructor(private readonly userService: UserService) {}
+  constructor(
+    @Inject(UserService) private readonly userService: UserService
+  ) {}
 
   @Get('/:id', { params: userParamsSchema })
   @ApiOperation({ summary: 'Retrieve user by ID' })

package/dist/docs/content/testing.mdx

@@ -33,6 +33,8 @@ The `exisjs/testing` module re-exports test runner primitives, assertions, mocki
 
 `createTestContext` initializes your application definition, executes `onStart` hooks, establishes database connections (Mongoose, Prisma, or DatabaseManager), and tears down connections gracefully in `afterAll`.
 
+Tests always load routes from your source files, never from a previous `exisjs build`. `exisjs test` reads `.env.test` on top of `.env`, so point it at a separate database. A test file that crashes while loading is reported as failed, and a run that finds no test files fails (set `EXIS_PASS_WITH_NO_TESTS=1` to allow it).
+
 ### Functional Paradigm Application Test
 
 Given a functional application defined in `src/http/server.ts`:

package/dist/docs/content/validation.mdx

@@ -368,7 +368,7 @@ When validating, `tex.discriminatedUnion` matches the discriminator property aga
 ```json filename="Discriminator Error Example"
 {
   "statusCode": 400,
-  "error": "Bad Request",
+  "error": { "code": "VALIDATION_ERROR", "message": "Validation Error", "details": [] },
   "message": "Validation Error: type: Invalid discriminator value 'archive' for field 'type'",
   "details": [
     {
@@ -588,7 +588,7 @@ When incoming requests fail validation, ExisJS returns an HTTP `400 Bad Request`
 ```json filename="HTTP 400 Bad Request"
 {
   "statusCode": 400,
-  "error": "Bad Request",
+  "error": { "code": "VALIDATION_ERROR", "message": "Validation Error", "details": [] },
   "message": "Validation Error: username: Field must be at least 4 characters, email: Invalid email address",
   "errors": {
     "username": "Field must be at least 4 characters",
@@ -643,6 +643,20 @@ export default controller({
 })
 ```
 
+### Query and Param Coercion with Zod
+
+Query strings and path parameters always arrive as strings. For Zod object schemas used as `query` or `params`, ExisJS converts fields declared as `z.number()`, `z.boolean()` or `z.date()` before validating, so `z.coerce` and `.transform(Number)` are not needed (they keep working if present). This works with Zod 3 and Zod 4, including fields wrapped in `.optional()`, `.default()` or `.nullable()`.
+
+```typescript
+const ListQuery = z.object({
+  page: z.number().int().min(1).default(1), // ?page=2      -> 2
+  active: z.boolean().optional(),           // ?active=true -> true
+  from: z.date().optional(),                // ?from=2026-10-01 -> Date
+})
+```
+
+A value that cannot be converted (`?page=abc`) is left as a string, so the schema rejects it with a normal validation error. Request bodies are never coerced.
+
 ### Using Zod in OOP Controllers
 
 ```typescript filename="src/http/users/route.ts"

package/dist/docs/reference/README.md

@@ -20,7 +20,7 @@ This directory contains complete, information-dense API references, TypeScript i
 | `exisjs/middleware` | [`middleware.mdx`](file:///z:/projects/framework/exisjs/docs/reference/middleware.mdx) | Built-in middleware suite: Helmet, CORS, CSRF, rate limiting, IP filtering, and multipart uploads.     |
 | `exisjs/context`    | [`context.mdx`](file:///z:/projects/framework/exisjs/docs/reference/context.mdx)       | `AsyncLocalStorage` request context API (`getRequest`, `getResponse`, `getContext`, `after`).          |
 | `exisjs/cron`       | [`cron.mdx`](file:///z:/projects/framework/exisjs/docs/reference/cron.mdx)             | Task scheduler (`cron()`, `@Cron()`), interval timers, presets, and `CronManager` runtime controls.    |
-| `exisjs/sanitize`   | [`sanitize.mdx`](file:///z:/projects/framework/exisjs/docs/reference/sanitize.mdx)     | Rust-accelerated security cleaners (`escapeHtml`, `preventSql`) and data transform utilities.          |
+| `exisjs/sanitize`   | [`sanitize.mdx`](file:///z:/projects/framework/exisjs/docs/reference/sanitize.mdx)     | Security cleaners (`escapeHtml`, `preventSql`) and data transform utilities.          |
 | `exisjs/swagger`    | [`swagger.mdx`](file:///z:/projects/framework/exisjs/docs/reference/swagger.mdx)       | OpenAPI 3.1 specification generation, Swagger UI / Scalar interactive rendering, and decorators.       |
 | `exisjs/testing`    | [`testing.mdx`](file:///z:/projects/framework/exisjs/docs/reference/testing.mdx)       | Test runner (`node:test`), synthetic HTTP client (`createTestApp`), `expect` matchers, and `ex` mocks. |
 | `exisjs/plugin`     | [`plugin.mdx`](file:///z:/projects/framework/exisjs/docs/reference/plugin.mdx)         | Modular plugin development (`definePlugin`), lifecycle hooks, and dependency encapsulation.            |

package/dist/docs/reference/config.mdx

@@ -172,7 +172,7 @@ The root configuration schema accepted by `exis.config.ts`:
 | `host` | `string` | `'0.0.0.0'` | Network interface binding. |
 | `server` | `'auto' \| 'node' \| 'bun' \| 'uws'` | `'auto'` | HTTP server backend. Automatically selects Bun or Node when detected. |
 | `cluster` | `{ workers?: number \| 'auto' \| 'safe' \| 'max' }` | `{ workers: 1 }` | Multi-process worker clustering. `'safe'` uses available CPU cores minus 1; `'max'` uses all available cores. |
-| `trustProxy` | `boolean \| number` | `false` | Enables reverse-proxy IP headers (`X-Forwarded-For`, `CF-Connecting-IP`, `True-Client-IP`). |
+| `trustProxy` | `boolean \| number` | `false` | `true`: trust all proxy headers (`X-Forwarded-For`, `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`). `N`: trust only the N closest hops in `X-Forwarded-For`, counting the socket peer; CDN headers are ignored. |
 | `bodyLimit` | `number` | `10485760` (10MB) | Maximum payload size in bytes for JSON and URL-encoded request bodies. |
 | `compression` | `boolean` | `false` | Enables gzip and Brotli response compression. |
 | `etag` | `boolean` | `false` | Enables ETag computation for dynamic responses. |

package/dist/docs/reference/decorators.mdx

@@ -219,7 +219,7 @@ export const CurrentUser = createParamDecorator((data: string | undefined, ctx)
 | `@RateLimit(options)` | Class / Method | `RateLimitOptions` | Enforces rate limits on endpoints. |
 | `@Cors(options)` | Class / Method | `CorsConfig \| boolean` | Enforces CORS configuration. |
 | `@IpFilter(options)` | Class / Method | `IpFilterOptions` | Enforces CIDR IP allow/deny lists. |
-| `@Idempotent(options?)` | Class / Method | `IdempotencyOptions` | Enables off-heap request caching via `Idempotency-Key`. |
+| `@Idempotent(options?)` | Class / Method | `IdempotencyOptions` | Enables response caching via `Idempotency-Key`. |
 | `@Dedupe(options?)` | Class / Method | `DedupeOptions` | Deduplicates concurrent in-flight requests with identical keys. |
 | `@BlockProbes(options?)` | Class / Method | `BlockProbesOptions` | Blackholes malicious scanner probes (`.env`, `wp-admin`). |
 | `@Upload(field, options?)` | Method | `string, FileUploadOptions` | Configures multipart file upload streaming on the endpoint. |
@@ -266,7 +266,7 @@ export const CurrentUser = createParamDecorator((data: string | undefined, ctx)
 
 | Decorator | Target | Options | Description |
 | :--- | :--- | :--- | :--- |
-| `@Cacheable(options)` | Method | `{ ttl?: number, key?: string \| ((...args) => string) }` | Caches method return value in native off-heap LRU cache. |
+| `@Cacheable(options)` | Method | `{ ttl?: number, key?: string \| ((...args) => string) }` | Caches method return value in a bounded in-memory cache. |
 | `@CacheEvict(options)` | Method | `{ key: string \| ((...args) => string) }` | Evicts cached keys upon successful method execution. |
 | `@Transactional(options?)` | Method | `TransactionOptions` | Wraps database queries within an atomic transaction. |
 | `@Profile(options?)` | Method | `{ thresholdMs?: number, warnSlow?: boolean }` | Measures and logs method execution latency. |

package/dist/docs/reference/di.mdx

@@ -131,7 +131,7 @@ export default class UserController {
   private config!: Record<string, any>
 
   constructor(
-    private userService: UserService,
+    @Inject(UserService) private userService: UserService,
     @Inject('DATABASE_URL') private dbUrl: string
   ) {}
 }

package/dist/docs/reference/middleware.mdx

@@ -7,7 +7,7 @@ nextTitle: "Context Reference"
 
 # `exisjs/middleware`
 
-The `exisjs/middleware` module provides the built-in HTTP middleware pipeline for ExisJS. It includes native Rust-accelerated traffic controls, multipart upload handlers, security header suites, and request context enhancers.
+The `exisjs/middleware` module provides the built-in HTTP middleware pipeline for ExisJS. It includes traffic controls, multipart upload handlers, security header suites, and request context enhancers.
 
 ---
 
@@ -78,7 +78,7 @@ function helmet(options?: HelmetOptions): Handler
 | `xFrameOptions` | `'DENY' \| 'SAMEORIGIN'` | `'SAMEORIGIN'` | Protects against clickjacking. |
 | `hsts` | `boolean \| HstsOptions` | `true` (in prod) | Strict Transport Security configuration. |
 | `noSniff` | `boolean` | `true` | Sets `X-Content-Type-Options: nosniff`. |
-| `xssFilter` | `boolean` | `true` | Sets `X-XSS-Protection: 1; mode=block`. |
+| `xssFilter` | `boolean` | `true` | Sets `X-XSS-Protection: 0`, disabling the legacy browser XSS auditor (current OWASP guidance). |
 
 ---
 
@@ -145,7 +145,7 @@ function mongoSanitize(options?: MongoSanitizeOptions): Handler
 
 ### `rateLimit(options?)`
 
-In-memory off-heap rate limiter backed by native Rust acceleration (`NativeRateLimiter`).
+In-memory fixed-window rate limiter; expired windows are swept automatically.
 
 ```typescript
 function rateLimit(options?: RateLimitOptions): Handler
@@ -181,7 +181,7 @@ function routeTimeout(msOrOptions: number | TimeoutOptions): Handler
 
 ### `idempotent(options?)`
 
-Caches responses against the `Idempotency-Key` HTTP header in off-heap native memory to prevent duplicate mutations.
+Caches responses against the `Idempotency-Key` HTTP header in a bounded in-memory cache (10,000 entries) to prevent duplicate mutations.
 
 ```typescript
 function idempotent(options?: IdempotencyOptions): Handler
@@ -269,7 +269,9 @@ fileUpload.none(options?: FileUploadOptions): Handler
 | `dest` | `string` | Target directory on disk to stream uploaded files to. |
 | `maxBytes` | `number` | Maximum allowed individual file size in bytes. |
 | `mimeTypes` | `string[]` | Permitted MIME types (e.g. `['image/png', 'image/jpeg']`). |
-| `limits` | `FileUploadLimits` | Detailed limits (`fileSize`, `files`, `fieldSize`, `fields`). |
+| `limits` | `FileUploadLimits` | Detailed limits (`fileSize`, `files`, `fieldSize`, `fields`, `parts`). |
+
+**Default limits** (applied when a route does not set its own): `files: 10`, `fields: 100`, `parts: 200`, `fieldSize: 1 MB`, and `fileSize` equal to the app `bodyLimit` (10 MB by default). Exceeding a limit returns `413 Payload Too Large`. Files written to disk are named `<field>-<uuid><ext>`; field names and extensions are sanitized, so client input cannot choose the path.
 
 #### Example
 

package/dist/docs/reference/sanitize.mdx

@@ -1,13 +1,13 @@
 ---
 title: "exisjs/sanitize"
-description: "API Reference for ExisJS data sanitization engine: Rust-accelerated string cleaners, safeSanitize, and object transformers."
+description: "API Reference for ExisJS data sanitization engine: string cleaners, safeSanitize, and object transformers."
 nextUrl: "/docs/reference/swagger"
 nextTitle: "Swagger Reference"
 ---
 
 # `exisjs/sanitize`
 
-The `exisjs/sanitize` module provides pure data sanitization functions for cleaning and normalizing input strings, numbers, dates, arrays, and complex objects before business logic execution. High-throughput security transforms (XSS escaping, HTML stripping, SQL prevention, path traversal blocking) are backed by native Rust acceleration (`@exisjs/rs`).
+The `exisjs/sanitize` module provides pure data sanitization functions for cleaning and normalizing input strings, numbers, dates, arrays, and complex objects before business logic execution. It includes security transforms for XSS escaping, HTML stripping, and basic SQL injection and path traversal probe detection.
 
 ---
 
@@ -19,9 +19,9 @@ import { sanitize } from 'exisjs/sanitize'
 
 ---
 
-## 1. Rust-Accelerated Security Sanitizers
+## 1. Security Sanitizers
 
-These sanitizers interface with `@exisjs/rs` to ensure high-performance text cleansing.
+The SQL and path traversal checks reject common probe strings; they complement, and never replace, parameterized queries and resolved-path checks.
 
 | Function | Signature | Description |
 | :--- | :--- | :--- |

package/dist/docs/reference/validator.mdx

@@ -7,7 +7,7 @@ nextTitle: "Decorators Reference"
 
 # `exisjs/validator`
 
-The `exisjs/validator` module provides the `tex` schema builder, Rust-accelerated `TexEngine`, data transformation modifiers, and pagination helpers for request body, query, and parameter validation.
+The `exisjs/validator` module provides the `tex` schema builder, `TexEngine` (schemas compile once into plain JS checks), data transformation modifiers, and pagination helpers for request body, query, and parameter validation.
 
 ---
 

package/dist/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAKrD,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,aAAa,EAAE,OAAO,CAAA;IACtC,SAAgB,OAAO,CAAC,EAAE,OAAO,CAAA;gBAG/B,OAAO,EAAE,MAAM,EACf,UAAU,SAAM,EAChB,IAAI,SAAmB,EACvB,OAAO,CAAC,EAAE,OAAO;IAenB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAIhE,MAAM,CAAC,YAAY,CAAC,OAAO,SAAiB,GAAG,SAAS;IAIxD,MAAM,CAAC,SAAS,CAAC,OAAO,SAAc,GAAG,SAAS;IAIlD,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAa,GAAG,SAAS;IAIjD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAI3C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAInE,MAAM,CAAC,eAAe,CACpB,OAAO,SAAsB,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,SAAS;IAIZ,MAAM,CAAC,eAAe,CAAC,OAAO,SAAsB,GAAG,SAAS;IAIhE,MAAM,CAAC,QAAQ,CAAC,OAAO,SAA0B,GAAG,SAAS;IAI7D,MAAM,CAAC,kBAAkB,CAAC,OAAO,SAAwB,GAAG,SAAS;IAIrE,MAAM,CAAC,cAAc,CAAC,OAAO,SAAoB,GAAG,SAAS;IAI7D,MAAM,IAAI,MAAM;CAWjB;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,SAAgB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIvD;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAiB;CAIrC;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAc;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,QAAQ,SAAa;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAAa;CAIjC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAyB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIhE;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,SAAsB,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAsB;CAI1C;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,SAAwB;CAI5C;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAAoB;CAIxC;AAGD,qBAAa,aAAc,SAAQ,SAAS;CAAG;AAC/C,qBAAa,mBAAoB,SAAQ,eAAe;CAAG;AAC3D,qBAAa,qBAAsB,SAAQ,iBAAiB;CAAG;AAC/D,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,wBAAyB,SAAQ,oBAAoB;CAAG;AACrE,qBAAa,sBAAuB,SAAQ,kBAAkB;CAAG;AACjE,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,2BAA4B,SAAQ,uBAAuB;CAAG;AAC3E,qBAAa,uBAAwB,SAAQ,mBAAmB;CAAG;AA6GnE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,GAC5D,MAAM,CA6BR;AAED,wBAAgB,kBAAkB,CAAC,KAAK,UAAQ,GAAG,YAAY,CA+S9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAIjD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAerD,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,aAAa,EAAE,OAAO,CAAA;IACtC,SAAgB,OAAO,CAAC,EAAE,OAAO,CAAA;gBAG/B,OAAO,EAAE,MAAM,EACf,UAAU,SAAM,EAChB,IAAI,SAAmB,EACvB,OAAO,CAAC,EAAE,OAAO;IAenB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAIhE,MAAM,CAAC,YAAY,CAAC,OAAO,SAAiB,GAAG,SAAS;IAIxD,MAAM,CAAC,SAAS,CAAC,OAAO,SAAc,GAAG,SAAS;IAIlD,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAa,GAAG,SAAS;IAIjD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAI3C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAInE,MAAM,CAAC,eAAe,CACpB,OAAO,SAAsB,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,SAAS;IAIZ,MAAM,CAAC,eAAe,CAAC,OAAO,SAAsB,GAAG,SAAS;IAIhE,MAAM,CAAC,QAAQ,CAAC,OAAO,SAA0B,GAAG,SAAS;IAI7D,MAAM,CAAC,kBAAkB,CAAC,OAAO,SAAwB,GAAG,SAAS;IAIrE,MAAM,CAAC,cAAc,CAAC,OAAO,SAAoB,GAAG,SAAS;IAM7D,MAAM,IAAI,MAAM;CAYjB;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,SAAgB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIvD;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAiB;CAIrC;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAc;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,QAAQ,SAAa;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAAa;CAIjC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAyB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIhE;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,SAAsB,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAsB;CAI1C;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,SAAwB;CAI5C;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAAoB;CAIxC;AAGD,qBAAa,aAAc,SAAQ,SAAS;CAAG;AAC/C,qBAAa,mBAAoB,SAAQ,eAAe;CAAG;AAC3D,qBAAa,qBAAsB,SAAQ,iBAAiB;CAAG;AAC/D,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,wBAAyB,SAAQ,oBAAoB;CAAG;AACrE,qBAAa,sBAAuB,SAAQ,kBAAkB;CAAG;AACjE,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,2BAA4B,SAAQ,uBAAuB;CAAG;AAC3E,qBAAa,uBAAwB,SAAQ,mBAAmB;CAAG;AA6GnE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,GAC5D,MAAM,CA6BR;AAED,wBAAgB,kBAAkB,CAAC,KAAK,UAAQ,GAAG,YAAY,CA4T9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAIjD"}