/** * Inside a `catch` block in a handler or route, do NOT propagate the provider's * `error.message` (or `err.message`, `e.message`, etc.) into the message * argument of an `HttpErrors.*` throw. The provider's error string crosses the * HTTP boundary into Unito's response, where it can carry tokens, customer * PII, or internal field names back to upstream callers and logs. * * Bad: * } catch (error) { * throw new HttpErrors.BadRequestError(error.message); * throw new HttpErrors.X(`upload failed: ${err.message}`); * throw new HttpErrors.Y(error instanceof Error ? error.message : String(error)); * } * * Good — strip provider message, surface a stable summary instead: * } catch (error) { * context.logger.warn('upload failed', { error: error.message }); * throw new HttpErrors.UnprocessableEntityError('Upload failed'); * } * * Scope: * Fires only in `**\/src/handlers/**` and `**\/src/routes/**`. Rate-limiter * files under those paths are excluded (intentional internal-lib message * rethrow on rate-limit responses). */ import type { Rule } from 'eslint'; declare const rule: Rule.RuleModule; export default rule;