exisjs 0.8.0 → 0.9.0

package/dist/docs/content/errors.mdx

@@ -139,15 +139,13 @@ Every error response has the same core shape, whatever caused it:
 | `statusCode` | Same as the HTTP status |
 | `error.code` | Stable machine-readable code: `NOT_FOUND`, `UNAUTHORIZED`, `VALIDATION_ERROR`, `INTERNAL_ERROR`... |
 | `error.message` | Human-readable message. For unexpected errors in production it is a generic message; internals are never exposed |
-| `error.details` | Optional extra data (validation issues, or the `details` passed to an `HttpError`) |
+| `error.details` | Optional extra data (validation issues, or the `details` passed to an `HttpError`). Never copied to the top level |
 
-Clients can rely on `error.code` and `error.message` for every failed request.
+Clients can rely on `error.code` and `error.message` for every failed request: thrown errors, validation, `@Roles` / `@Permissions` / guard rejections, `404` and `405` all use this shape. Codes the framework itself sends include `VALIDATION_ERROR`, `INVALID_JSON`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `METHOD_NOT_ALLOWED` (with an `Allow` header), `RATE_LIMIT_EXCEEDED`, `IDEMPOTENCY_KEY_REUSED`, `IDEMPOTENCY_IN_PROGRESS` and `INTERNAL_ERROR`. A handler that rejects with `null` or `undefined` is a `500`, never a `404`.
 
 ### Validation Error Responses
 
-When schema validation fails (via `tex`, Zod, or Yup), ExisJS intercepts the validation failure and generates a structured `400 Bad Request` payload containing field-level error mappings:
-
-The top-level `message`, `validationErrors`, `errors` and `details` fields are kept for existing clients; new code should read `error.details`. Values of credential fields (`password`, `token`, `secret`...) are replaced with `[Redacted]` in responses and logs.
+When schema validation fails (via `tex`, Zod, Yup or a DTO's `validate()`), the response is a `400` with **one entry per failing field** in `error.details` (up to 100):
 
 ```json filename="HTTP 400 Validation Error Response"
 {
@@ -155,37 +153,40 @@ The top-level `message`, `validationErrors`, `errors` and `details` fields are k
   "statusCode": 400,
   "error": {
     "code": "VALIDATION_ERROR",
-    "message": "Validation Error: email: Invalid email format, age: Minimum age is 18",
-    "details": [ /* same entries as "details" below */ ]
-  },
-  "message": "Validation Error: email: Invalid email format, age: Minimum age is 18",
-  "validationErrors": {
-    "email": "Invalid email format",
-    "age": "Minimum age is 18"
-  },
-  "errors": {
-    "email": "Invalid email format",
-    "age": "Minimum age is 18"
-  },
-  "details": [
-    {
-      "field": "email",
-      "message": "Invalid email format",
-      "expected": "Valid email address",
-      "received": "invalid-email",
-      "code": "INVALID_EMAIL",
-      "httpPart": "body"
-    },
-    {
-      "field": "age",
-      "message": "Minimum age is 18",
-      "expected": ">= 18",
-      "received": "16",
-      "code": "MIN_VALUE",
-      "httpPart": "body"
-    }
-  ],
-  "timestamp": "2026-10-02T12:45:00.000Z"
+    "message": "Validation Error",
+    "details": [
+      {
+        "field": "email",
+        "message": "Must be a valid email address",
+        "expected": "valid email address",
+        "received": "\"invalid-email\"",
+        "code": "INVALID_EMAIL",
+        "httpPart": "body"
+      },
+      {
+        "field": "age",
+        "message": "Must be at least 18",
+        "expected": "must be at least 18",
+        "received": "16",
+        "code": "VALUE_TOO_SMALL",
+        "httpPart": "body"
+      }
+    ]
+  }
+}
+```
+
+`received` never shows secrets: credential fields (`password`, `token`, `secret`, `apiKey`...) and connection settings (`DATABASE_URL`, `REDIS_URI`, `SENTRY_DSN`, `*_CONNECTION`...) are `[Redacted]`, and the password of any `scheme://user:password@host` value is masked as `***`, in responses, logs and `tex.env` startup errors.
+
+**Status codes.** Malformed input that cannot be parsed at all is `400` (`INVALID_JSON` for a broken JSON body); input that parses but breaks the schema is `400` `VALIDATION_ERROR`. Use `HttpError.unprocessable()` (`422`) for business rules that the schema cannot express, such as "this email is already registered".
+
+#### Pre-0.9 duplicate fields
+
+Before 0.9, error bodies also carried `message`, `validationErrors`, `errors`, `details` and `timestamp` at the top level. They are gone by default. Clients that still read them can get them back while they migrate:
+
+```typescript filename="exis.config.ts"
+export default {
+  errors: { legacyFields: true }, // deprecated, removed in 1.0
 }
 ```
 

package/dist/docs/content/installation.mdx

@@ -205,9 +205,8 @@ const config: ExisConfig = {
   helmet: { enabled: true },
   compression: true,
 
-  // Swagger UI at /docs; set enabled to
-  // process.env.NODE_ENV !== 'production' to hide it in production
-  docs: { enabled: true },
+  // Swagger UI at /docs, development only
+  docs: { enabled: process.env.NODE_ENV !== 'production' },
 }
 
 export default config
@@ -283,7 +282,7 @@ npm run dev
 Output:
 
 ```text filename="Terminal"
-[exis] starting development server (v0.8.0)...
+[exis] starting development server (v0.9.0)...
 EXIS ready in 125 ms
 
 → Local:   http://localhost:4000/

package/dist/docs/content/introduction.mdx

@@ -50,7 +50,7 @@ ExisJS combines convention-based file routing, built-in standard modules, and a
 The file-system routing engine scans the `src/http` directory and compiles route paths into a radix tree at startup. Purely static paths resolve through an exact-match table; parameterized paths walk the tree with no per-request parsing of the route definitions.
 
 ### 2. Dual-Paradigm Parity
-ExisJS provides feature parity across both functional and object-oriented paradigms. Both compile down to the same runtime execution pipeline:
+ExisJS supports a functional and a class-based (OOP) paradigm. Both share the router, validation, boundaries, error handling, response handling and route authorization; a project uses **one** of them throughout (`exisjs dev` and `exisjs build` stop with the file names if they are mixed). Class-based controllers add decorator and dependency-injection work per request, so functional routes are somewhat faster.
 - **Functional**: `controller()`, `route.get()`, `route.post()`, `defineBoundary()`, `inject()`.
 - **Class-Based (OOP)**: `@Controller()`, `@Get()`, `@Post()`, `@Boundary()`, `@Injectable()`.
 

package/dist/docs/content/providers.mdx

@@ -199,6 +199,8 @@ export class RequestContextService {
 ```
 
 > [!WARNING]
+> **Scopes propagate**: a controller or service that depends on a request-scoped provider is itself created per request, so it can never keep one request's instance for the next. `transient` providers get a new instance for every injection.
+
 > **Request Scope Lifecycle**: Request-scoped providers can only be resolved within an active HTTP request context. Attempting to resolve a request-scoped provider during boot scripts, background cron tasks, or standalone worker processes will throw a container error.
 
 ---

package/dist/docs/content/requests.mdx

@@ -33,9 +33,9 @@ ExisJS wraps the standard Node.js `IncomingMessage` in an `ExisRequest` instance
 | `req.signal` | `AbortSignal` | Standard `AbortSignal` triggered when client cancels connection |
 | `req.fresh` | `boolean` | `true` if client cache matches current `ETag` or `Last-Modified` |
 | `req.stale` | `boolean` | Inverse of `req.fresh` |
-| `req.user` | `ExisUser` | Authenticated user identity attached by auth guards |
+| `req.user` | `ExisUser` | Authenticated user set by your auth middleware or guard. Type it once with `declare module 'exisjs' { interface ExisUser { id: string; roles: string[]; permissions: string[] } }` |
 | `req.session` | `Record<string, any>` | Session data store when session middleware is enabled |
-| `req.log` | `Logger` | Request-scoped Pino logger with trace metadata |
+| `req.log` | `Logger` | Request-scoped Pino logger; every line carries `requestId` |
 | `req.requestId` | `string` | Unique request identifier header |
 | `req.raw` | `IncomingMessage` | Underlying Node.js `IncomingMessage` stream |
 

package/dist/docs/content/responses.mdx

@@ -51,6 +51,24 @@ export default class UsersController {
 }
 ```
 
+### What a Return Value Becomes
+
+Both paradigms answer the same way:
+
+| Handler returns | Response |
+| :--- | :--- |
+| Object, array, number, boolean, `null` | JSON (`null` is the JSON value `null`) |
+| String | `text/plain` |
+| `Buffer` / `Uint8Array` | `application/octet-stream` (set `Content-Type` first to change it) |
+| Stream or async iterable | Streamed |
+| `download(data, name)` | Attachment |
+| `res`, or the result of `res.json()` / `res.send()` | Nothing more: the response was already sent |
+| `undefined`, nothing sent | `204 No Content` (or the status set with `@HttpCode` / `res.status()`, with an empty body) |
+
+Prefer returning a value. Call `res.json()` / `res.send()` yourself only when you need to, and do not do both. A handler that receives the response object (`@Res()`, or `(req, res)` with no decorators) may also answer later, for example from a callback; it is then responsible for sending exactly one response.
+
+`HEAD` is answered by the matching `GET` route without a body. A path that exists under other methods answers `405 METHOD_NOT_ALLOWED` with an `Allow` header instead of `404`.
+
 ---
 
 ## Response Envelope Builders (`exisjs/response`)

package/dist/docs/content/security.mdx

@@ -32,6 +32,8 @@ The following security middlewares are exported from `exisjs/middleware` and can
 
 ## 1. Security Headers (`helmet`)
 
+Helmet is on by default (`helmet: { enabled: true }` in `exis.config.ts`), including a same-origin `Content-Security-Policy`; see [Security Baseline](#11-security-baseline). Use the middleware directly to apply different settings to part of the app.
+
 The `helmet` middleware sets secure response headers to harden the application against cross-site scripting (XSS), clickjacking, and content sniffing:
 
 ```typescript filename="src/http/server.ts"
@@ -69,7 +71,7 @@ export default exis({
   async onStart(app) {
     app.use(
       csrf({
-        secret: process.env.CSRNF_SECRET!, // Must be at least 32 characters
+        secret: process.env.CSRF_SECRET!, // Must be at least 32 characters
         cookieName: 'csrf-token',
         headerName: 'x-csrf-token',
         cookieOptions: {
@@ -104,6 +106,30 @@ export const config = defineBoundary({
 })
 ```
 
+The default store counts per process: with two instances each allows `max`, and on serverless the count resets constantly. Pass a shared `store` to enforce one limit everywhere:
+
+```typescript filename="src/http/auth/boundary.ts"
+import { rateLimit, type RateLimitStore } from 'exisjs/middleware'
+import { redis } from '../../lib/redis'
+
+const redisStore: RateLimitStore = {
+  async increment(key, windowMs) {
+    const k = `rl:${key}`
+    const [[, count], [, ttl]] = (await redis
+      .multi()
+      .incr(k)
+      .pexpire(k, windowMs, 'NX')
+      .pttl(k)
+      .exec()) as [unknown, number][]
+    return { count, resetTime: Date.now() + Math.max(ttl, 0) }
+  },
+}
+
+export const loginLimiter = rateLimit({ max: 10, windowMs: 15 * 60_000, store: redisStore })
+```
+
+If the store fails, requests are let through and a warning is logged, so a cache outage does not take the API down.
+
 ### Rate Limit Response Headers
 
 `rateLimit` attaches standard IETF and legacy rate-limiting headers to every response:
@@ -136,7 +162,6 @@ export const adminIpGuard = ipFilter({
     '10.0.0.99', // Block specific compromised host
   ],
   message: 'Access Denied: IP address not authorized',
-  trustProxy: true,
 })
 
 export const config = defineBoundary({
@@ -150,6 +175,11 @@ export const config = defineBoundary({
 
 Prevent duplicate mutations (e.g. double-charging a credit card or duplicate database inserts) by caching responses associated with an `Idempotency-Key` header:
 
+- A repeat with the same key, user, method, path and body gets the first response again (header `Idempotent-Replayed: true`); the handler does not run twice.
+- Keys belong to `req.user.id` (or `sub`), so one client can never receive another client's response. Change this with `scope: (req) => req.tenantId`.
+- The same key with a **different body** is refused with `422 IDEMPOTENCY_KEY_REUSED`; a repeat that arrives while the first is still running gets `409 IDEMPOTENCY_IN_PROGRESS`.
+- Only `2xx`/`3xx` responses are stored, so a failed request can be retried. Pass `store` to share responses between instances.
+
 ```typescript filename="src/http/checkout/route.ts"
 import { controller, route } from 'exisjs/router'
 import { idempotent } from 'exisjs/middleware'
@@ -274,9 +304,9 @@ export function apiKeyGuard(req: any) {
 
 ---
 
-## 10. Role-Based Access Control (RBAC) Decorators
+## 10. Route Authorization (`@Roles`, `@Permissions`, `@Public`)
 
-ExisJS provides declarative security decorators in `exisjs/decorators` for class-based controllers:
+Declare who may call a route; ExisJS checks it against `req.user` before guards, pipes and the handler run. Your authentication middleware (in a boundary or `@Use`) verifies the token and sets `req.user`.
 
 ```typescript filename="src/http/users/controller.ts"
 import { Controller, Get, Post, Roles, Permissions, Public } from 'exisjs/decorators'
@@ -291,9 +321,67 @@ export class UsersController {
   }
 
   @Post('/login')
-  @Public() // Bypasses authentication guards
+  @Public()
   async login() {
     return { token: 'jwt' }
   }
 }
 ```
+
+Functional routes declare the same with `roles`, `permissions` and `public` on the route (or on the whole `controller({...})`):
+
+```typescript filename="src/http/reports/route.ts"
+export default controller({
+  export: route.get('/export', {
+    permissions: ['report:read', 'report:export'],
+    handle: () => buildReport(),
+  }),
+})
+```
+
+| Rule | Behaviour |
+| :--- | :--- |
+| No `req.user` | `401 UNAUTHORIZED` |
+| `@Roles('a', 'b')` | The user needs **one** of the roles, from `user.roles` (array) or `user.role` |
+| `@Permissions('x', 'y')` | The user needs **all** listed permissions in `user.permissions`. A role name never counts as a permission |
+| Rule not met | `403 FORBIDDEN`, standard error envelope |
+| `@Public()` | Wins over `@Roles` / `@Permissions` on the same route; a warning is logged at startup |
+
+There is no built-in "super admin" field. To let some users through every rule, say so explicitly:
+
+```typescript filename="exis.config.ts"
+export default {
+  authorization: { superUser: (user) => user.role === 'owner' },
+}
+```
+
+### Deny by Default
+
+By default a controller route without `@Roles`, `@Permissions` or `@Public` is open, so a forgotten decorator exposes the route. Turn that around and require a signed-in user everywhere except routes marked `@Public()`:
+
+```typescript filename="exis.config.ts"
+export default {
+  authorization: { defaultPolicy: 'authenticated' },
+}
+```
+
+It applies to class and functional controllers; plain `app.get()` routes such as health checks are not affected.
+
+`exisjs routes` prints the rule of every route in its ACCESS column, which is the quickest way to review what is public.
+
+---
+
+## 11. Security Baseline
+
+What a new app sends and hides without extra code:
+
+| Area | Default |
+| :--- | :--- |
+| Headers (`helmet: { enabled: true }`) | `Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; form-action 'self'`, `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`, `X-XSS-Protection: 0`; no `X-Powered-By`. Set `contentSecurityPolicy` to a string to change the policy or to `false` to send none. A policy set earlier by your own middleware is kept |
+| `/docs` | Sends its own policy allowing the Swagger UI assets from jsDelivr. The project template enables `/docs` outside production only |
+| Errors | Unexpected errors answer `INTERNAL_ERROR` without message or stack outside development |
+| Logs and validation errors | Credentials and connection strings are redacted (see [Errors](/docs/errors)) |
+| Request bodies | Malformed JSON is `400 INVALID_JSON`; `__proto__` / `constructor` keys are stripped |
+
+`tex.string({ preventSql: true, escapeHtml: true })` is input hygiene, not an injection defence: always use parameterised queries, and encode output for the context it is written to (HTML, SQL, shell).
+

package/dist/docs/content/testing.mdx

@@ -117,6 +117,11 @@ const res = await api
   .execute()
 ```
 
+Two more builder methods:
+
+- `.query({ page: 2, tags: ['a', 'b'] })` appends a query string.
+- `.timeout(ms)` fails the request after `ms` milliseconds (default 5000, or `EXIS_TEST_TIMEOUT`; `0` waits forever). A handler that never answers fails its own test with the route in the message instead of hanging the whole run.
+
 ### Response Object Properties
 
 The returned `TestResponse` contains:
@@ -132,6 +137,39 @@ export interface TestResponse {
 
 ---
 
+## Testing Over Real Sockets (`startTestServer`)
+
+In-memory requests cover most tests. For what only a real connection shows (CORS and security headers as a browser sees them, keep-alive, malformed HTTP), start the app on a free port:
+
+```typescript filename="tests/headers.test.ts"
+import { describe, it, expect, startTestServer } from 'exisjs/testing'
+import app from '../src/http/server'
+
+describe('headers', () => {
+  it('sends a Content-Security-Policy', async () => {
+    const server = await startTestServer(app)
+    try {
+      const res = await server.request('/health')
+      expect(res.headers.get('content-security-policy')).toBeDefined()
+    } finally {
+      await server.close()
+    }
+  })
+})
+```
+
+`exisjs test` runs your source files. To test the production build itself, run `exisjs build`, then start it with `exisjs start` (which always sets `NODE_ENV=production`) and send requests to it.
+
+## Cron Jobs in Tests
+
+Under `NODE_ENV=test` (what `exisjs test` sets) cron jobs and timeout tasks are registered but **never started**, so a test run cannot fire a real job. Run one on demand, or opt in for a test file:
+
+```typescript
+await app.cron.trigger('daily-cleanup') // runs it once, now
+
+const api = createTestContext(app, { cron: true }) // schedules jobs as in production
+```
+
 ## Unit Testing Controllers & Middlewares
 
 For fast unit tests that do not require booting a full HTTP server pipeline, use `createMockRequest` and `createMockResponse`:

package/dist/docs/content/validation.mdx

@@ -78,7 +78,7 @@ All primitive builders accept modifier options directly in their configuration a
 | **Optional** | `{ optional: true }` | `.optional()` | Allows `undefined`. |
 | **Nullable** | `{ nullable: true }` | `.nullable()` | Allows `null`. |
 | **Nullish** | `{ nullish: true }` | `.nullish()` | Allows both `null` and `undefined`. |
-| **Default** | `{ default: value \| () => value }` | N/A | Evaluates static value or dynamic factory function when field is missing. Automatically marks the field optional in schemas. |
+| **Default** | `{ default: value \| () => value }` | N/A | Used when the field is missing. A client may omit the field, and after parsing it always has a value. |
 
 ```typescript filename="example.ts"
 import { tex } from 'exisjs/validator'
@@ -92,6 +92,26 @@ const Schema = tex.object({
 })
 ```
 
+### Input and Output Types
+
+A field with a `default` may be left out of a request but is always present after parsing, so the two sides have different types:
+
+```typescript filename="src/http/reports/schema.ts"
+import { tex, type ResolveInput, type ResolveOutput } from 'exisjs/validator'
+
+export const MODULES = ['ALL', 'EV', 'PV'] as const // readonly arrays work in tex.enum
+
+export const ReportQuery = tex.object({
+  module: tex.enum(MODULES, { default: 'ALL' }),
+  search: tex.string({ optional: true }),
+})
+
+type Query = ResolveOutput<typeof ReportQuery> // what the handler gets: module is 'ALL' | 'EV' | 'PV'
+type QueryInput = ResolveInput<typeof ReportQuery> // what a client sends: module may be omitted
+```
+
+`ResolveSchema` is the same as `ResolveOutput`. Validation reports every failing field, not only the first.
+
 > [!NOTE]
 > **Empty String Normalization**: When query parameters or form submissions supply empty strings `""` for fields marked `.optional()`, `.nullable()`, or `.nullish()`, ExisJS converts them to `undefined` or `null` before validation to avoid type conversion errors.
 

package/dist/docs/reference/decorators.mdx

@@ -25,8 +25,6 @@ import {
   Options,
   Head,
   All,
-  Ws,
-  Sse,
 
   // Parameter Injection
   Body,
@@ -152,8 +150,8 @@ Method decorators register class methods as HTTP route handlers and attach valid
 | `@Options(path?, schema?)` | `OPTIONS` | `(path?: string, schema?: MethodSchemaInput) => MethodDecorator` |
 | `@Head(path?, schema?)` | `HEAD` | `(path?: string, schema?: MethodSchemaInput) => MethodDecorator` |
 | `@All(path?, schema?)` | Any Method | `(path?: string, schema?: MethodSchemaInput) => MethodDecorator` |
-| `@Sse(path?, schema?)` | SSE Stream | `(path?: string, schema?: MethodSchemaInput) => MethodDecorator` |
-| `@Ws(path?, schema?)` | WebSocket | `(path?: string, schema?: MethodSchemaInput) => MethodDecorator` |
+
+> Server-Sent Events use a normal `@Get` route that calls `res.sse()`; see [Responses](/docs/responses). WebSocket routes are not part of the class decorators.
 
 ---
 

package/dist/docs/reference/middleware.mdx

@@ -217,6 +217,8 @@ function ipFilter(options: IpFilterOptions): Handler
 | `allow` | `string[]` | Array of permitted IP addresses or CIDR blocks (e.g. `['10.0.0.0/8', '192.168.1.5']`). |
 | `deny` | `string[]` | Array of blocked IP addresses or CIDR blocks. |
 
+The address checked is `req.ip`. Behind a proxy or load balancer, set `trustProxy` in `exis.config.ts` so `req.ip` is the real client; `ipFilter` never reads `X-Forwarded-For` itself, because a client can send any value in that header.
+
 ---
 
 ### `backpressure(options?)`

package/dist/docs/reference/router.mdx

@@ -232,8 +232,6 @@ import {
   Options,
   Head,
   All,
-  Ws,
-  Sse,
   Body,
   Param,
   Query,
@@ -311,8 +309,8 @@ Method decorators attach HTTP handler logic and validation schemas to controller
 - `@Options(path?, schema?)`
 - `@Head(path?, schema?)`
 - `@All(path?, schema?)`
-- `@Sse(path?, schema?)`
-- `@Ws(path?, schema?)`
+
+> Server-Sent Events use a normal `@Get` route that calls `res.sse()`; see [Responses](/docs/responses). WebSocket routes are not part of the class decorators.
 
 ---
 
@@ -361,9 +359,9 @@ getProfile(@CurrentUser() user: any, @CurrentUser('id') userId: string) {
 | Decorator | Target | Description |
 | :--- | :--- | :--- |
 | `@Use(...middlewares)` | Class / Method | Applies middleware functions to the controller or route. |
-| `@Guards(...guards)` | Class / Method | Attaches authorization guards. |
-| `@Filters(...filters)` | Class / Method | Attaches exception filters. |
-| `@Interceptors(...interceptors)` | Class / Method | Attaches response/request interceptors. |
+| `@UseGuards(...guards)` | Class / Method | Attaches authorization guards. |
+| `@UseFilters(...filters)` | Class / Method | Attaches exception filters. |
+| `@UseInterceptors(...interceptors)` | Class / Method | Wraps the handler: each interceptor receives `next.handle()` and its return value becomes the response. |
 | `@HttpCode(status)` | Method | Sets the default HTTP status code for successful responses. |
 | `@Header(name, value)` | Method | Sets static HTTP response headers. |
 | `@Redirect(url, status?)` | Method | Redirects responses to the target URL. |

package/dist/error/errors.d.ts

@@ -80,7 +80,15 @@ export declare function renderValidationTable(rows: {
     received: string;
     expected: string;
 }[]): string;
-export declare function createErrorHandler(isDev?: boolean): ErrorHandler;
+export interface ErrorHandlerOptions {
+    /**
+     * Also send the pre-0.9 duplicate fields (`message`, `validationErrors`,
+     * `errors`, `details`, `timestamp`) next to `error`. Deprecated; for
+     * clients that have not moved to `error.code` / `error.message` / `error.details` yet.
+     */
+    legacyFields?: boolean;
+}
+export declare function createErrorHandler(isDev?: boolean, options?: ErrorHandlerOptions): ErrorHandler;
 /**
  * Async handler wrapper — catches promise rejections.
  * Note: Exis automatically handles async promise rejections internally.

package/dist/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAerD,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,aAAa,EAAE,OAAO,CAAA;IACtC,SAAgB,OAAO,CAAC,EAAE,OAAO,CAAA;gBAG/B,OAAO,EAAE,MAAM,EACf,UAAU,SAAM,EAChB,IAAI,SAAmB,EACvB,OAAO,CAAC,EAAE,OAAO;IAenB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAIhE,MAAM,CAAC,YAAY,CAAC,OAAO,SAAiB,GAAG,SAAS;IAIxD,MAAM,CAAC,SAAS,CAAC,OAAO,SAAc,GAAG,SAAS;IAIlD,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAa,GAAG,SAAS;IAIjD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAI3C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAInE,MAAM,CAAC,eAAe,CACpB,OAAO,SAAsB,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,SAAS;IAIZ,MAAM,CAAC,eAAe,CAAC,OAAO,SAAsB,GAAG,SAAS;IAIhE,MAAM,CAAC,QAAQ,CAAC,OAAO,SAA0B,GAAG,SAAS;IAI7D,MAAM,CAAC,kBAAkB,CAAC,OAAO,SAAwB,GAAG,SAAS;IAIrE,MAAM,CAAC,cAAc,CAAC,OAAO,SAAoB,GAAG,SAAS;IAM7D,MAAM,IAAI,MAAM;CAYjB;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,SAAgB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIvD;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAiB;CAIrC;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAc;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,QAAQ,SAAa;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAAa;CAIjC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAyB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIhE;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,SAAsB,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAsB;CAI1C;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,SAAwB;CAI5C;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAAoB;CAIxC;AAGD,qBAAa,aAAc,SAAQ,SAAS;CAAG;AAC/C,qBAAa,mBAAoB,SAAQ,eAAe;CAAG;AAC3D,qBAAa,qBAAsB,SAAQ,iBAAiB;CAAG;AAC/D,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,wBAAyB,SAAQ,oBAAoB;CAAG;AACrE,qBAAa,sBAAuB,SAAQ,kBAAkB;CAAG;AACjE,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,2BAA4B,SAAQ,uBAAuB;CAAG;AAC3E,qBAAa,uBAAwB,SAAQ,mBAAmB;CAAG;AA6GnE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,GAC5D,MAAM,CA6BR;AAED,wBAAgB,kBAAkB,CAAC,KAAK,UAAQ,GAAG,YAAY,CA4T9D;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAIjD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/error/errors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,UAAU,CAAA;AAerD,qBAAa,SAAU,SAAQ,KAAK;IAClC,SAAgB,UAAU,EAAE,MAAM,CAAA;IAClC,SAAgB,IAAI,EAAE,MAAM,CAAA;IAC5B,SAAgB,aAAa,EAAE,OAAO,CAAA;IACtC,SAAgB,OAAO,CAAC,EAAE,OAAO,CAAA;gBAG/B,OAAO,EAAE,MAAM,EACf,UAAU,SAAM,EAChB,IAAI,SAAmB,EACvB,OAAO,CAAC,EAAE,OAAO;IAenB,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAIhE,MAAM,CAAC,YAAY,CAAC,OAAO,SAAiB,GAAG,SAAS;IAIxD,MAAM,CAAC,SAAS,CAAC,OAAO,SAAc,GAAG,SAAS;IAIlD,MAAM,CAAC,QAAQ,CAAC,QAAQ,SAAa,GAAG,SAAS;IAIjD,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS;IAI3C,MAAM,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS;IAInE,MAAM,CAAC,eAAe,CACpB,OAAO,SAAsB,EAC7B,OAAO,CAAC,EAAE,OAAO,GAChB,SAAS;IAIZ,MAAM,CAAC,eAAe,CAAC,OAAO,SAAsB,GAAG,SAAS;IAIhE,MAAM,CAAC,QAAQ,CAAC,OAAO,SAA0B,GAAG,SAAS;IAI7D,MAAM,CAAC,kBAAkB,CAAC,OAAO,SAAwB,GAAG,SAAS;IAIrE,MAAM,CAAC,cAAc,CAAC,OAAO,SAAoB,GAAG,SAAS;IAM7D,MAAM,IAAI,MAAM;CAWjB;AAED,qBAAa,eAAgB,SAAQ,SAAS;gBAChC,OAAO,SAAgB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIvD;AAED,qBAAa,iBAAkB,SAAQ,SAAS;gBAClC,OAAO,SAAiB;CAIrC;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAc;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,QAAQ,SAAa;CAIlC;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAAa;CAIjC;AAED,qBAAa,kBAAmB,SAAQ,SAAS;gBACnC,OAAO,SAAyB,EAAE,OAAO,CAAC,EAAE,OAAO;CAIhE;AAED,qBAAa,oBAAqB,SAAQ,SAAS;gBACrC,OAAO,SAAsB,EAAE,OAAO,CAAC,EAAE,OAAO;CAI7D;AAED,qBAAa,cAAe,SAAQ,SAAS;gBAC/B,OAAO,SAAsB;CAI1C;AAED,qBAAa,aAAc,SAAQ,SAAS;gBAC9B,OAAO,SAA0B;CAI9C;AAED,qBAAa,uBAAwB,SAAQ,SAAS;gBACxC,OAAO,SAAwB;CAI5C;AAED,qBAAa,mBAAoB,SAAQ,SAAS;gBACpC,OAAO,SAAoB;CAIxC;AAGD,qBAAa,aAAc,SAAQ,SAAS;CAAG;AAC/C,qBAAa,mBAAoB,SAAQ,eAAe;CAAG;AAC3D,qBAAa,qBAAsB,SAAQ,iBAAiB;CAAG;AAC/D,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,wBAAyB,SAAQ,oBAAoB;CAAG;AACrE,qBAAa,sBAAuB,SAAQ,kBAAkB;CAAG;AACjE,qBAAa,kBAAmB,SAAQ,cAAc;CAAG;AACzD,qBAAa,iBAAkB,SAAQ,aAAa;CAAG;AACvD,qBAAa,2BAA4B,SAAQ,uBAAuB;CAAG;AAC3E,qBAAa,uBAAwB,SAAQ,mBAAmB;CAAG;AAiHnE,wBAAgB,qBAAqB,CACnC,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,GAC5D,MAAM,CA6BR;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,wBAAgB,kBAAkB,CAChC,KAAK,UAAQ,EACb,OAAO,GAAE,mBAAwB,GAChC,YAAY,CAoUd;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,EAAE,EAAE,OAAO,GAAG,OAAO,CAIjD"}

package/dist/error/errors.js

@@ -75,7 +75,6 @@ class HttpError extends Error {
                 message: this.message,
                 ...(this.details !== undefined && { details: this.details }),
             },
-            ...(this.details && typeof this.details === 'object' ? this.details : {}),
         };
     }
 }
@@ -195,6 +194,8 @@ class GatewayTimeoutException extends GatewayTimeoutError {
 }
 exports.GatewayTimeoutException = GatewayTimeoutException;
 // ─── Global Error Handler ─────────────────────────────────────────────────────
+// The development error page is self-contained with inline styles
+const DEV_PAGE_CSP = "default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'";
 function escapeHtml(str) {
     if (typeof str !== 'string')
         return String(str);
@@ -307,7 +308,8 @@ function renderValidationTable(rows) {
     const bot = `└─${'─'.repeat(fieldWidth)}─┴─${'─'.repeat(receivedWidth)}─┴─${'─'.repeat(expectedWidth)}─┘`;
     return [top, headerRow, sep, ...dataRows, bot].join('\n');
 }
-function createErrorHandler(isDev = false) {
+function createErrorHandler(isDev = false, options = {}) {
+    const legacy = options.legacyFields === true;
     return (err, req, res, _next) => {
         if (res.headersSent)
             return;
@@ -316,6 +318,7 @@ function createErrorHandler(isDev = false) {
             if (isDev &&
                 req.headers.accept?.includes('text/html') &&
                 err.statusCode >= 500) {
+                res.setHeader('Content-Security-Policy', DEV_PAGE_CSP);
                 res.status(err.statusCode).html(renderErrorHtml(err, req));
                 return;
             }
@@ -480,7 +483,7 @@ function createErrorHandler(isDev = false) {
                 tableRows.push({
                     field,
                     // Never echo credentials into logs or error responses
-                    received: (0, error_1.isSensitiveField)(field) ? '[Redacted]' : formattedReceived,
+                    received: (0, error_1.redactReceived)(field, formattedReceived),
                     expected: itemDetail?.expected || expectedMsg,
                     code: itemDetail?.code,
                 });
@@ -527,12 +530,13 @@ function createErrorHandler(isDev = false) {
                     message: message || 'Validation Error',
                     details: responseDetails,
                 },
-                // Kept for existing clients: field -> message map and flat details
-                message: message || 'Validation Error',
-                validationErrors: errorsMap,
-                errors: errorsMap,
-                details: responseDetails,
-                timestamp: new Date().toISOString(),
+                ...(legacy && {
+                    message: message || 'Validation Error',
+                    validationErrors: errorsMap,
+                    errors: errorsMap,
+                    details: responseDetails,
+                    timestamp: new Date().toISOString(),
+                }),
             });
             return;
         }
@@ -545,9 +549,11 @@ function createErrorHandler(isDev = false) {
                     code: 'INVALID_JSON',
                     message: 'Invalid JSON in request body',
                 },
-                message: 'Invalid JSON in request body',
-                validationErrors: null,
-                timestamp: new Date().toISOString(),
+                ...(legacy && {
+                    message: 'Invalid JSON in request body',
+                    validationErrors: null,
+                    timestamp: new Date().toISOString(),
+                }),
             });
             return;
         }
@@ -561,6 +567,7 @@ function createErrorHandler(isDev = false) {
             logger_1.logger.error({ err }, 'unhandled server error');
         }
         if (isDev && req.headers.accept?.includes('text/html')) {
+            res.setHeader('Content-Security-Policy', DEV_PAGE_CSP);
             res
                 .status(500)
                 .html(renderErrorHtml(err instanceof Error ? err : new Error(String(err)), req));
@@ -575,9 +582,11 @@ function createErrorHandler(isDev = false) {
                 message: internalMessage,
                 ...(isDev && { stack: err.stack }),
             },
-            message: internalMessage,
-            validationErrors: null,
-            timestamp: new Date().toISOString(),
+            ...(legacy && {
+                message: internalMessage,
+                validationErrors: null,
+                timestamp: new Date().toISOString(),
+            }),
         });
     };
 }