rpc-express-toolkit 4.0.0 → 4.1.0

package/src/clients/rpc-client.min.js

@@ -1 +1 @@
-let fetchFn;if("undefined"==typeof BigInt||BigInt.prototype.toJSON||(BigInt.prototype.toJSON=function(){return this.toString()}),"undefined"!=typeof fetch)fetchFn=fetch;else try{fetchFn=require("node-fetch")}catch(e){if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("fetch is not available. Please install node-fetch or use Node.js 18+");fetchFn=globalThis.fetch}class RpcClient{#e;#t;#i;#n;#s;constructor(e,t={},i={}){this.#e=e,this.#t={"Content-Type":"application/json",...t},this.#i=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#s={safeEnabled:!0===i.safeEnabled,warnOnUnsafe:!1!==i.warnOnUnsafe,...i},this.#n={}}#r(){return++this.#i}async call(e,t,i=void 0,n={}){const s={jsonrpc:"2.0",method:e,id:void 0===i?this.#r():i};null!=t&&(s.params=this.serializeBigIntsAndDates(t));try{const e=await fetchFn(this.#e,{method:"POST",headers:{...this.#t,"X-RPC-Safe-Enabled":this.#s.safeEnabled?"true":"false",...n},body:JSON.stringify(s),...this.#n});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const t=await e.json();if(t.error)throw t.error;const i=e.headers.get("X-RPC-Safe-Enabled");if(this.#s.safeEnabled&&null===i)throw new Error("RPC Compatibility Error: Client has safe serialization enabled but server did not respond with compatibility header (X-RPC-Safe-Enabled). This may indicate a version mismatch or non-toolkit server. Solutions: (1) Update server to rpc-express-toolkit v4+, (2) Disable client safeEnabled option, or (3) Use a compatible JSON-RPC server.");!this.#s.safeEnabled&&"true"===i&&this.#s.warnOnUnsafe&&console.warn("⚠️  RPC Compatibility Notice: Server supports safe serialization but client has safeEnabled=false. Consider enabling safeEnabled option for better BigInt/Date handling and forward compatibility.");const r={safeEnabled:"true"===i};return this.deserializeBigIntsAndDates(t.result,r)}catch(e){throw console.error("RPC call failed:",e),e}}async notify(e,t={},i={}){await this.call(e,t,null,i)}async batch(e,t={}){const i=e.map(e=>{const t={jsonrpc:"2.0",method:e.method,id:void 0!==e.id?e.id:this.#r()};return void 0!==e.params&&null!==e.params&&(t.params=this.serializeBigIntsAndDates(e.params)),t});try{const e=await fetchFn(this.#e,{method:"POST",headers:{...this.#t,"X-RPC-Safe-Enabled":this.#s.safeEnabled?"true":"false",...t},body:JSON.stringify(i),...this.#n});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const n=await e.json(),s=e.headers.get("X-RPC-Safe-Enabled");if(this.#s.safeEnabled&&null===s)throw new Error("RPC Compatibility Error: Client has safe serialization enabled but server did not respond with compatibility header (X-RPC-Safe-Enabled). This may indicate a version mismatch or non-toolkit server. Solutions: (1) Update server to rpc-express-toolkit v4+, (2) Disable client safeEnabled option, or (3) Use a compatible JSON-RPC server.");!this.#s.safeEnabled&&"true"===s&&this.#s.warnOnUnsafe&&console.warn("⚠️  RPC Compatibility Notice: Server supports safe serialization but client has safeEnabled=false. Consider enabling safeEnabled option for better BigInt/Date handling and forward compatibility.");const r={safeEnabled:"true"===s};if(Array.isArray(n))return n.map(e=>{if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result,r)});if(n.error)throw n.error;return[this.deserializeBigIntsAndDates(n.result,r)]}catch(e){throw console.error("Batch RPC call failed:",e),e}}serializeBigIntsAndDates(e){if("bigint"==typeof e)return e.toString()+"n";if(e instanceof Date){const t=e.toISOString();return this.#s.safeEnabled?`D:${t}`:(this.#s.warnOnUnsafe&&console.warn("⚠️  Date serialization: Using plain ISO string format for JSON-RPC 2.0 compliance. Date objects will be deserialized as strings on the receiving end. Consider enabling safeEnabled or using string timestamps for better type safety."),t)}if("string"==typeof e)return this.#s.safeEnabled?"S:"+e:(this.#s.warnOnUnsafe&&/^-?\d+n?$/.test(e)&&console.warn(`⚠️  String serialization: String "${e}" could be confused with BigInt. Consider enabling safeEnabled for disambiguation or use explicit typing.`),e);if(Array.isArray(e))return e.map(e=>this.serializeBigIntsAndDates(e));if(e&&"object"==typeof e){const t={};for(const[i,n]of Object.entries(e))t[i]=this.serializeBigIntsAndDates(n);return t}return e}deserializeBigIntsAndDates(e,t=null){const i=t?t.safeEnabled:this.#s.safeEnabled,n=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof e){if(i&&e.startsWith("S:"))return e.substring(2);if(i&&e.startsWith("D:")){const t=e.substring(2),i=new Date(t);if(!isNaN(i.getTime()))return i}if(/^-?\d+n$/.test(e))return BigInt(e.slice(0,-1));if(!i&&n.test(e)){const t=new Date(e);if(!isNaN(t.getTime()))return t}}return Array.isArray(e)?e.map(e=>this.deserializeBigIntsAndDates(e,t)):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).map(([e,i])=>[e,this.deserializeBigIntsAndDates(i,t)])):e}}module.exports=RpcClient;
+let fetchFn;if("undefined"==typeof globalThis||!globalThis.fetch)throw new Error("globalThis.fetch is not available. Node.js 18+ is required.");fetchFn=globalThis.fetch.bind(globalThis);class RpcClient{#e;#t;#i;#s;#n;constructor(e,t={},i={}){this.#e=e,this.#t={"Content-Type":"application/json",...t},this.#i=1e3*Date.now()+Math.floor(1e3*Math.random()),this.#n={safeEnabled:!0===i.safeEnabled,warnOnUnsafe:!1!==i.warnOnUnsafe,...i},this.#s={}}#a(){return++this.#i}async call(e,t,i=void 0,s={}){const n={jsonrpc:"2.0",method:e,id:void 0===i?this.#a():i};null!=t&&(n.params=this.serializeBigIntsAndDates(t));try{const e=await fetchFn(this.#e,{method:"POST",headers:{...this.#t,"X-RPC-Safe-Enabled":this.#n.safeEnabled?"true":"false",...s},body:JSON.stringify(n),...this.#s});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const t=await e.json();if(t.error)throw t.error;const i=e.headers.get("X-RPC-Safe-Enabled");if(this.#n.safeEnabled&&null===i)throw new Error("RPC Compatibility Error: Client has safe serialization enabled but server did not respond with compatibility header (X-RPC-Safe-Enabled). This may indicate a version mismatch or non-toolkit server. Solutions: (1) Update server to rpc-express-toolkit v4+, (2) Disable client safeEnabled option, or (3) Use a compatible JSON-RPC server.");!this.#n.safeEnabled&&"true"===i&&this.#n.warnOnUnsafe&&console.warn("⚠️  RPC Compatibility Notice: Server supports safe serialization but client has safeEnabled=false. Consider enabling safeEnabled option for better BigInt/Date handling and forward compatibility.");const a={safeEnabled:"true"===i};return this.deserializeBigIntsAndDates(t.result,a)}catch(e){throw console.error("RPC call failed:",e),e}}async notify(e,t={},i={}){await this.call(e,t,null,i)}async batch(e,t={}){const i=e.map(e=>{const t={jsonrpc:"2.0",method:e.method,id:void 0!==e.id?e.id:this.#a()};return void 0!==e.params&&null!==e.params&&(t.params=this.serializeBigIntsAndDates(e.params)),t});try{const e=await fetchFn(this.#e,{method:"POST",headers:{...this.#t,"X-RPC-Safe-Enabled":this.#n.safeEnabled?"true":"false",...t},body:JSON.stringify(i),...this.#s});if(!e.ok)throw new Error(`HTTP Error: ${e.status} ${e.statusText}`);const s=await e.json(),n=e.headers.get("X-RPC-Safe-Enabled");if(this.#n.safeEnabled&&null===n)throw new Error("RPC Compatibility Error: Client has safe serialization enabled but server did not respond with compatibility header (X-RPC-Safe-Enabled). This may indicate a version mismatch or non-toolkit server. Solutions: (1) Update server to rpc-express-toolkit v4+, (2) Disable client safeEnabled option, or (3) Use a compatible JSON-RPC server.");!this.#n.safeEnabled&&"true"===n&&this.#n.warnOnUnsafe&&console.warn("⚠️  RPC Compatibility Notice: Server supports safe serialization but client has safeEnabled=false. Consider enabling safeEnabled option for better BigInt/Date handling and forward compatibility.");const a={safeEnabled:"true"===n};if(Array.isArray(s))return s.map(e=>{if(e.error)throw e.error;return this.deserializeBigIntsAndDates(e.result,a)});if(s.error)throw s.error;return[this.deserializeBigIntsAndDates(s.result,a)]}catch(e){throw console.error("Batch RPC call failed:",e),e}}serializeBigIntsAndDates(e){if("bigint"==typeof e)return`${e.toString()}n`;if(e instanceof Date){const t=e.toISOString();return this.#n.safeEnabled?`D:${t}`:(this.#n.warnOnUnsafe&&console.warn("⚠️  Date serialization: Using plain ISO string format for JSON-RPC 2.0 compliance. Date objects will be deserialized as strings on the receiving end. Consider enabling safeEnabled or using string timestamps for better type safety."),t)}if("string"==typeof e)return this.#n.safeEnabled?`S:${e}`:(this.#n.warnOnUnsafe&&/^-?\d+n?$/.test(e)&&console.warn(`⚠️  String serialization: String "${e}" could be confused with BigInt. Consider enabling safeEnabled for disambiguation or use explicit typing.`),e);if(Array.isArray(e))return e.map(e=>this.serializeBigIntsAndDates(e));if(e&&"object"==typeof e){const t={};for(const[i,s]of Object.entries(e))t[i]=this.serializeBigIntsAndDates(s);return t}return e}deserializeBigIntsAndDates(e,t=null){const i=t?t.safeEnabled:this.#n.safeEnabled,s=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/;if("string"==typeof e){if(i&&e.startsWith("S:"))return e.substring(2);if(i&&e.startsWith("D:")){const t=e.substring(2),i=new Date(t);if(!Number.isNaN(i.getTime()))return i}if(/^-?\d+n$/.test(e))return BigInt(e.slice(0,-1));if(!i&&s.test(e)){const t=new Date(e);if(!Number.isNaN(t.getTime()))return t}}return Array.isArray(e)?e.map(e=>this.deserializeBigIntsAndDates(e,t)):e&&"object"==typeof e?Object.fromEntries(Object.entries(e).map(([e,i])=>[e,this.deserializeBigIntsAndDates(i,t)])):e}}module.exports=RpcClient;

package/src/index.d.ts

@@ -96,7 +96,7 @@ interface RpcEndpointOptions {
   prefix?: string;
   maxBodySize?: string;
   timeout?: number;
-  cors?: boolean | CorsOptions;
+  cors?: boolean | CorsConfig;
   auth?: AuthConfig;
   validation?: ValidationConfig;
   safeEnabled?: boolean;
@@ -113,6 +113,11 @@ interface RpcEndpointOptions {
     type?: string | string[] | ((req: any) => boolean);
     verify?: (req: any, res: any, buf: Buffer, encoding: string) => void;
   };
+  // Additional options supported by implementation
+  methodWhitelist?: string[];
+  timing?: boolean;
+  metrics?: boolean;
+  healthCheck?: boolean;
 }
 
 /**

package/src/index.js

@@ -1,11 +1,13 @@
 const path = require('path');
 const express = require('express');
+const expressPkg = require('express/package.json');
+const NestedError = require('nested-error-stacks');
+const pkg = require('../package.json');
 
 /** @typedef {import("express").Router} Router */
 /** @typedef {import("express").Request} Request */
 /** @typedef {import("express").Response} Response */
 
-const NestedError = require('nested-error-stacks');
 const Logger = require('./logger');
 const { MiddlewareManager, builtInMiddlewares } = require('./middleware');
 const {
@@ -190,41 +192,47 @@ class RpcEndpoint {
     try {
       // Check if express.json is available (Express 4.16.0+)
       if (typeof express.json !== 'function') {
-        throw new Error('express.json() is not available. Please ensure you are using Express 4.16.0 or later, or install body-parser separately.');
+        throw new Error(
+          'express.json() is not available. Please ensure you are using Express 4.16.0 or later, or install body-parser separately.'
+        );
       }
-      
+
       // Test JSON middleware creation with default options
       const jsonMiddleware = express.json({ limit: '10mb' });
-      
+
       if (typeof jsonMiddleware !== 'function') {
-        throw new Error('express.json() did not return a valid middleware function');
+        throw new Error(
+          'express.json() did not return a valid middleware function'
+        );
       }
-      
+
       // Verify middleware has correct signature (req, res, next)
       if (jsonMiddleware.length !== 3) {
-        throw new Error('JSON middleware has invalid signature - expected (req, res, next)');
+        throw new Error(
+          'JSON middleware has invalid signature - expected (req, res, next)'
+        );
       }
-      
+
       this.#logger.debug('JSON middleware validation passed', {
         expressJsonAvailable: true,
         middlewareValid: true,
-        endpoint: this.#endpoint
+        endpoint: this.#endpoint,
       });
-      
     } catch (error) {
-      const errorMsg = `JSON middleware validation failed: ${error.message}\n` +
+      const errorMsg =
+        `JSON middleware validation failed: ${error.message}\n` +
         `This router cannot handle JSON-RPC requests properly.\n\n` +
         `Possible solutions:\n` +
         `- Update Express: npm install express@latest (requires >=4.16.0)\n` +
         `- Add JSON parsing middleware manually: router.use(express.json())\n` +
         `- Install body-parser: npm install body-parser`;
-      
+
       this.#logger.error('JSON middleware validation failed', {
         error: error.message,
-        expressVersion: require('express/package.json')?.version || 'unknown',
-        endpoint: this.#endpoint
+        expressVersion: expressPkg?.version || 'unknown',
+        endpoint: this.#endpoint,
       });
-      
+
       throw new Error(errorMsg);
     }
   }
@@ -241,7 +249,7 @@ class RpcEndpoint {
         res.json({
           status: 'ok',
           timestamp: new Date().toISOString(),
-          version: require('../package.json').version,
+          version: pkg.version,
         });
       });
     }
@@ -274,6 +282,11 @@ class RpcEndpoint {
 
           // Only send response if there are results (non-notification requests)
           if (results.length > 0) {
+            // Align batch responses with single-call header negotiation
+            res.setHeader(
+              'X-RPC-Safe-Enabled',
+              this.#options.safeEnabled ? 'true' : 'false'
+            );
             res.json(results);
           } else {
             res.status(204).end(); // No content for all-notification batch
@@ -361,30 +374,38 @@ class RpcEndpoint {
       const clientSafeHeader = req.headers['x-rpc-safe-enabled'];
 
       // Strict mode: se server ha safe enabled ma client non invia header → JSON-RPC ERROR
-      if (this.#options.strictMode && this.#options.safeEnabled && !clientSafeHeader) {
+      if (
+        this.#options.strictMode &&
+        this.#options.safeEnabled &&
+        !clientSafeHeader
+      ) {
         return this.reply(res, {
           id,
           error: {
             code: -32600, // Invalid Request
-            message: 'RPC Compatibility Error: Server requires safe serialization header but client did not provide it.',
+            message:
+              'RPC Compatibility Error: Server requires safe serialization header but client did not provide it.',
             data: {
               serverSafeEnabled: this.#options.safeEnabled,
               requiredHeader: 'X-RPC-Safe-Enabled',
               strictMode: true,
-              solution: 'Update client to rpc-express-toolkit v4+ or disable server strict mode'
-            }
-          }
+              solution:
+                'Update client to rpc-express-toolkit v4+ or disable server strict mode',
+            },
+          },
         });
       }
 
       // Use client's safe options for parameter deserialization
       const clientSafeEnabled = clientSafeHeader === 'true';
       const deserializationOptions = {
-        safeEnabled: clientSafeEnabled
+        safeEnabled: clientSafeEnabled,
       };
 
       // Deserialize parameters using client's safe options
-      const deserializedParams = params ? this.deserializeBigIntsAndDates(params, deserializationOptions) : params;
+      const deserializedParams = params
+        ? this.deserializeBigIntsAndDates(params, deserializationOptions)
+        : params;
 
       // Prepare middleware context
       let middlewareContext = {
@@ -483,6 +504,8 @@ class RpcEndpoint {
         },
       });
     }
+    // Ensure explicit return for consistent-return rule
+    return null;
   }
 
   /**
@@ -618,7 +641,10 @@ class RpcEndpoint {
 
     // Add safe options headers so client knows how to deserialize
     // Send safe options headers to client
-    res.setHeader('X-RPC-Safe-Enabled', this.#options.safeEnabled ? 'true' : 'false');
+    res.setHeader(
+      'X-RPC-Safe-Enabled',
+      this.#options.safeEnabled ? 'true' : 'false'
+    );
 
     res.json(response);
   }
@@ -642,30 +668,46 @@ class RpcEndpoint {
   #serializeValue(value, hasBigInt = false, hasDate = false) {
     if (typeof value === 'bigint') {
       // Warn if safeEnabled is disabled and we have BigInt
-      if (!this.#options.safeEnabled && !hasBigInt && this.#options.warnOnUnsafe) {
-        this.#logger.warn('BigInt detected in serialization. Consider enabling safeEnabled option to avoid potential string/BigInt confusion.');
+      if (
+        !this.#options.safeEnabled &&
+        !hasBigInt &&
+        this.#options.warnOnUnsafe
+      ) {
+        this.#logger.warn(
+          'BigInt detected in serialization. Consider enabling safeEnabled option to avoid potential string/BigInt confusion.'
+        );
       }
       // Convert BigInt to string with 'n' suffix for proper deserialization
-      return value.toString() + 'n';
-    } else if (value instanceof Date) {
+      return `${value.toString()}n`;
+    }
+    if (value instanceof Date) {
       // Warn if safeEnabled is disabled and we have Date
-      if (!this.#options.safeEnabled && !hasDate && this.#options.warnOnUnsafe) {
-        this.#logger.warn('Date detected in serialization. Consider enabling safeEnabled option to avoid potential string/Date confusion.');
+      if (
+        !this.#options.safeEnabled &&
+        !hasDate &&
+        this.#options.warnOnUnsafe
+      ) {
+        this.#logger.warn(
+          'Date detected in serialization. Consider enabling safeEnabled option to avoid potential string/Date confusion.'
+        );
       }
       // Convert Date to ISO string with D: prefix if safeEnabled
       const isoString = value.toISOString();
       return this.#options.safeEnabled ? `D:${isoString}` : isoString;
-    } else if (typeof value === 'string') {
+    }
+    if (typeof value === 'string') {
       // Add S: prefix if safeEnabled is true
       if (this.#options.safeEnabled) {
-        return 'S:' + value;
+        return `S:${value}`;
       }
       return value;
-    } else if (Array.isArray(value)) {
+    }
+    if (Array.isArray(value)) {
       // Recurse into arrays - don't pass hasBigInt/hasDate to children
       // Each element should be checked independently for warnings
       return value.map((v) => this.#serializeValue(v, false, false));
-    } else if (value && typeof value === 'object') {
+    }
+    if (value && typeof value === 'object') {
       // Recurse into plain objects - don't pass hasBigInt/hasDate to children
       // Each property should be checked independently for warnings
       const result = {};
@@ -685,9 +727,10 @@ class RpcEndpoint {
    */
   #hasDeepBigInt(obj) {
     if (typeof obj === 'bigint') return true;
-    if (Array.isArray(obj)) return obj.some(item => this.#hasDeepBigInt(item));
+    if (Array.isArray(obj))
+      return obj.some((item) => this.#hasDeepBigInt(item));
     if (obj && typeof obj === 'object') {
-      return Object.values(obj).some(val => this.#hasDeepBigInt(val));
+      return Object.values(obj).some((val) => this.#hasDeepBigInt(val));
     }
     return false;
   }
@@ -698,9 +741,9 @@ class RpcEndpoint {
    */
   #hasDeepDate(obj) {
     if (obj instanceof Date) return true;
-    if (Array.isArray(obj)) return obj.some(item => this.#hasDeepDate(item));
+    if (Array.isArray(obj)) return obj.some((item) => this.#hasDeepDate(item));
     if (obj && typeof obj === 'object') {
-      return Object.values(obj).some(val => this.#hasDeepDate(val));
+      return Object.values(obj).some((val) => this.#hasDeepDate(val));
     }
     return false;
   }
@@ -720,7 +763,9 @@ class RpcEndpoint {
    */
   deserializeBigIntsAndDates(value, options = null) {
     // Use provided options or fall back to server options
-    const safeEnabled = options ? options.safeEnabled : this.#options.safeEnabled;
+    const safeEnabled = options
+      ? options.safeEnabled
+      : this.#options.safeEnabled;
 
     // More comprehensive ISO date regex that handles:
     // - UTC: 2023-01-01T12:00:00.000Z
@@ -741,7 +786,7 @@ class RpcEndpoint {
         const isoString = value.substring(2); // Remove 'D:' prefix
         const date = new Date(isoString);
         // Double-check that we got a valid date
-        if (!isNaN(date.getTime())) {
+        if (!Number.isNaN(date.getTime())) {
           return date;
         }
       }
@@ -755,7 +800,7 @@ class RpcEndpoint {
       if (!safeEnabled && ISO_DATE_REGEX.test(value)) {
         const date = new Date(value);
         // Double-check that we got a valid date
-        if (!isNaN(date.getTime())) {
+        if (!Number.isNaN(date.getTime())) {
           return date;
         }
       }

package/src/logger.js

@@ -47,6 +47,24 @@ class Logger {
     };
   }
 
+  /**
+   * Safely stringify objects that may contain BigInt/Date
+   * @param {any} obj
+   * @returns {string}
+   */
+  safeStringify(obj) {
+    try {
+      return JSON.stringify(obj, (key, value) => {
+        if (typeof value === 'bigint') return `${value.toString()}n`;
+        if (value instanceof Date) return value.toISOString();
+        return value;
+      });
+    } catch (e) {
+      // Fallback: best-effort toString
+      return String(obj);
+    }
+  }
+
   /**
    * Generic log method
    * @param {string} level
@@ -63,7 +81,7 @@ class Logger {
     } else {
       const logMessage = `${this.prefix} ${logData.timestamp} [${logData.level}] ${message}`;
       const metaStr =
-        Object.keys(meta).length > 0 ? ` | ${JSON.stringify(meta)}` : '';
+        Object.keys(meta).length > 0 ? ` | ${this.safeStringify(meta)}` : '';
       console[level === 'debug' || level === 'trace' ? 'log' : level](
         `${logMessage}${metaStr}`
       );
@@ -120,7 +138,7 @@ class Logger {
       id,
       duration: `${duration}ms`,
       resultType: typeof result,
-      resultSize: result ? JSON.stringify(result).length : 0,
+      resultSize: result ? this.safeStringify(result).length : 0,
     });
   }
 
@@ -160,21 +178,23 @@ class Logger {
     ];
     const sanitized = Array.isArray(params) ? [...params] : { ...params };
 
-    const sanitizeObj = (obj) => {
-      if (typeof obj !== 'object' || obj === null) return obj;
-
-      for (const [key, value] of Object.entries(obj)) {
-        if (
-          sensitiveKeys.some((sensitive) =>
-            key.toLowerCase().includes(sensitive)
-          )
-        ) {
-          obj[key] = '[REDACTED]';
-        } else if (typeof value === 'object') {
-          sanitizeObj(value);
+    const sanitizeObj = (input) => {
+      if (typeof input !== 'object' || input === null) return input;
+
+      const output = Array.isArray(input) ? [] : {};
+      for (const [key, value] of Object.entries(input)) {
+        const isSensitive = sensitiveKeys.some((sensitive) =>
+          key.toLowerCase().includes(sensitive)
+        );
+        if (isSensitive) {
+          output[key] = '[REDACTED]';
+        } else if (typeof value === 'object' && value !== null) {
+          output[key] = sanitizeObj(value);
+        } else {
+          output[key] = value;
         }
       }
-      return obj;
+      return output;
     };
 
     return sanitizeObj(sanitized);

package/src/middleware.js

@@ -42,32 +42,47 @@ class MiddlewareManager {
    */
   async execute(hook, context) {
     const middlewares = this.middlewares[hook] || [];
-    let result = context;
-
-    for (const middleware of middlewares) {
-      try {
-        const middlewareResult = await middleware(result);
-
-        // If middleware returns an object, merge it with context
-        if (middlewareResult && typeof middlewareResult === 'object') {
-          result = { ...result, ...middlewareResult };
-        }
-
-        // If middleware explicitly returns false, stop execution
-        if (middlewareResult === false) {
-          throw new Error('Middleware execution stopped');
-        }
-      } catch (error) {
-        // For error hooks, continue even if middleware fails
-        if (hook === 'onError') {
-          console.error('Error middleware failed:', error);
-          continue;
-        }
-        throw error;
-      }
+    const isErrorHook = hook === 'onError';
+
+    const finalResult = await middlewares.reduce(
+      (promise, middleware) =>
+        promise.then(async (acc) => {
+          // If a previous middleware requested stop, propagate without executing others
+          if (acc && acc.__middlewareStopped) {
+            return acc;
+          }
+          try {
+            const middlewareResult = await middleware(acc);
+
+            if (middlewareResult === false) {
+              // Mark chain as stopped
+              return { ...acc, __middlewareStopped: true };
+            }
+
+            // If middleware returns an object, merge it with context
+            if (middlewareResult && typeof middlewareResult === 'object') {
+              return { ...acc, ...middlewareResult };
+            }
+
+            return acc;
+          } catch (error) {
+            if (isErrorHook) {
+              console.error('Error middleware failed:', error);
+              return acc;
+            }
+            throw error;
+          }
+        }),
+      Promise.resolve(context)
+    );
+
+    // Do not expose internal marker
+    if (finalResult && finalResult.__middlewareStopped) {
+      const rest = { ...finalResult };
+      delete rest.__middlewareStopped;
+      return rest;
     }
-
-    return result;
+    return finalResult;
   }
 
   /**

package/src/safe.d.ts

@@ -0,0 +1,30 @@
+import type { Router } from 'express';
+import type { RpcEndpoint, RpcClient, RpcEndpointOptions, RpcClientOptions } from './index';
+
+/**
+ * Factory: create a RpcEndpoint with safe defaults (safeEnabled=true, strictMode=true).
+ */
+export function createSafeEndpoint<C = any>(
+  router: Router,
+  context: C,
+  endpoint?: string,
+  options?: RpcEndpointOptions
+): RpcEndpoint<C>;
+
+export function createSafeEndpoint<C = any>(
+  router: Router,
+  context: C,
+  options?: RpcEndpointOptions
+): RpcEndpoint<C>;
+
+/**
+ * Factory: create a RpcClient with safe defaults (safeEnabled=true).
+ */
+export function createSafeClient(
+  endpoint: string,
+  defaultHeaders?: Record<string, string>,
+  options?: RpcClientOptions
+): RpcClient;
+
+export * from './index';
+

package/src/safe.js

@@ -0,0 +1,54 @@
+const Main = require('./index');
+
+// Default safe options applied unless explicitly overridden
+const defaultSafeOptions = {
+  safeEnabled: true,
+  strictMode: true,
+};
+
+/**
+ * Create a RpcEndpoint with safe defaults (safeEnabled=true, strictMode=true).
+ * Preserves both constructor signatures supported by RpcEndpoint.
+ *
+ * @param {import('express').Router} router
+ * @param {any} context
+ * @param {string|object} [endpointOrOptions='/api']
+ * @param {object} [options]
+ */
+function createSafeEndpoint(
+  router,
+  context,
+  endpointOrOptions = '/api',
+  options = {}
+) {
+  if (typeof endpointOrOptions === 'string') {
+    const finalOptions = { ...defaultSafeOptions, ...options };
+    return new Main.RpcEndpoint(
+      router,
+      context,
+      endpointOrOptions,
+      finalOptions
+    );
+  }
+  // options object form
+  const final = { ...defaultSafeOptions, ...endpointOrOptions };
+  return new Main.RpcEndpoint(router, context, final);
+}
+
+/**
+ * Create a RpcClient with safe defaults (safeEnabled=true).
+ * @param {string} endpoint
+ * @param {Record<string,string>} [defaultHeaders]
+ * @param {object} [options]
+ */
+function createSafeClient(endpoint, defaultHeaders = {}, options = {}) {
+  const finalOptions = { safeEnabled: true, ...options };
+  return new Main.RpcClient(endpoint, defaultHeaders, finalOptions);
+}
+
+module.exports = {
+  // Re-export everything for convenience
+  ...Main,
+  createSafeEndpoint,
+  createSafeClient,
+};

package/src/validation.js

@@ -1,3 +1,4 @@
+/* eslint max-classes-per-file: off */
 const Ajv = require('ajv');
 const addFormats = require('ajv-formats');