Interface ErrorHandlerOptions

The error body format: 'default', 'rfc9457', the deprecated 'rfc7807', or a custom formatter function. Defaults to 'default'.

When true, the error stack trace is included in the response body. Never enable this in production — pass a config-derived boolean (e.g. config.get('NODE_ENV') === 'development'), never read process.env directly (AI_GUIDELINES §4.1). Defaults to false.

Note the stack is the secondary disclosure: the primary one is the error message, which for a failed query carries the SQL and its bound parameter values. Masking that is maskInternalErrors' job.

The two compose safely, and masking wins: an error masked by ErrorHandlerOptions.maskInternalErrors carries no stack in the body even when this option is true, because a stack begins with the very message that was masked. Set maskInternalErrors: false to see the stack of an internal error.

When true (the default), logs once at warn below 500 and error otherwise. Without a logger, only 5xx reaches runtime.reportError.

When true (the default), a caught value that was not an HttpError and resolves to a status >= 500 is masked in the response: its detail/message becomes the status title ('Internal Server Error') and the raw message — which for a failed query carries the SQL and its bound parameter values — is dropped from the body. The log is unaffected: logErrors still records the unmasked error and its cause chain, so an operator loses nothing unless logErrors is also false, the configuration that already logs nothing.

A deliberately thrown HttpError is never masked — instanceof HttpError is the line between "the developer wrote this for a caller" and "this escaped from a driver". false restores the previous behaviour verbatim.

Lets the application write its own response for a caught error. The hook receives the normalized error after status hints, internal-error masking, and status resolution, so error.statusCode is safe to serve. Return a HandlerResult produced by ctx.response to use that response; it may resolve that result asynchronously. Return or resolve to undefined to fall through to the configured formatter unchanged.

The hook owns its returned response's status, headers, and body. It is called only for errors caught by this middleware, not responder-based terminals such as an unmatched-path 404.