0.8.1 — Documentation: feature-list README, namespace imports, fingerprint design record

Documentation only. No runtime change; the emitted declarations differ in
their comments alone.

• README: opens with a description of the utility and a feature list; adds a
  "Why not just…" section, an "On the agent's side" section, and a Limits
  table; shows both reports of one failure side by side from a real run.
• Every snippet and example uses import * as AppEx from 'application-exception';
  AGENTS.md rule 0 records the convention. Named imports are unchanged.
• New docs/design/public-fingerprint.md holds the public-fingerprint threat
  model; README, recipes, and AGENTS.md link to it instead of repeating it.
• API card: four new task rows (retry, escalate, thrown primitive, untrusted
  value), an output line on every example, and a description of what each
  PublicReportCorjOptions key does.
• errors.md: a code-to-fix table at the top; APPEX_INVALID_TRUST_REALM now
  names isTrustedException, the function that takes a realm.
• AGENTS.md rule 10 split into one fact per rule; recipe prose trimmed to each
  task; decoder limits and foreign-ID adoption notes deduplicated.
• Repository: process documents removed; docs:check type-checks
  examples/*.ts; dev dependencies moved to Jest 30.

npm: https://www.npmjs.com/package/application-exception/v/0.8.1

0.8.0 — Public report boundary hardening

Addresses the remaining findings from #50.

Compatibility. This pre-1.0 minor release tightens decoder input acceptance
and automatic foreign-ID adoption. Some inputs accepted by 0.7.0 now reject or
receive replacement IDs; producer limits, exported signatures, report versions,
and published schemas remain unchanged. For cross-version or standalone-corj
correlation, pass the same explicit trusted occurrenceId to each reporter.

• Harden decodePublicReport traversal: reject sparse arrays, avoid repeated
  top-level field and array-element reads, and measure field text in Unicode
  code points, matching JSON Schema. Rejection paths use bounded JSON-quoted
  key segments and remain untrusted data.
• Add a receiver limit of 16,384 UTF-8 bytes of compact JSON for as_json,
  including keys and escaping, alongside depth 32 and 10,000 values. Oversized
  input is rejected. Producer limits and published report schemas are unchanged.
• Read foreign public policy fields once into a validated snapshot before use.
• Reject arrays supplied as diagnostic corj.metadata with
  APPEX_INVALID_OPTIONS rather than treating them as metadata options objects.
• Narrow automatic foreign branded occurrence-ID adoption to
  /^[A-Za-z0-9_.:-]{1,128}$/; other foreign IDs get a memoized generated
  replacement shared by this copy's paired and standalone reports. Local and
  explicit IDs keep the printable-ASCII rule. Older copies or standalone corj
  may retain IDs this release replaces; pass the same explicit trusted
  occurrenceId override when cross-version correlation is required.
• Clarify chosen-call comparisons against public fingerprints containing
  sensitive recipe inputs, receiver resource policies, and intentionally open
  diagnostic schema roots. Optional-field typos remain accepted for extension
  compatibility; public roots remain closed.

Install with npm install application-exception@0.8.0.

Verified with 405 tests at 100% coverage, type checks, build, packed-package smoke, Node ESM, Bun, browser, and documentation checks. Implemented by Sol medium workers and reviewed by Astra high. Published from the tested package artifact; this manual release does not claim GitHub Actions provenance.

Release PR #59 · Passing Node 18/20/24, Bun, and browser CI.

0.7.0 — Corj namespace integration

Application-exception now integrates CORJ 13 and re-exports its exact frozen Corj utility object. The standalone restoreExpectedValues export is removed without an alias. The package's typed-failure and reporting APIs retain their current names.

Migrating from 0.6.x

Before:

import { makeDiagnosticReport, restoreExpectedValues } from 'application-exception';
const report = makeDiagnosticReport(caught);
const full = restoreExpectedValues(report);

After:

import { Corj, makeDiagnosticReport } from 'application-exception';
const report = makeDiagnosticReport(caught);
const full = Corj.restoreExpectedValues(report);

With import * as appex from 'application-exception', change appex.restoreExpectedValues(report) to appex.Corj.restoreExpectedValues(report).

Migration checklist:

• Replace the restoreExpectedValues import with Corj and qualify restoration calls.
• If you import CORJ utilities directly, use the named Corj export and follow the CORJ 13 migration notes.
• Update mocks and runtime export assertions for Corj replacing standalone restoration.
• Keep existing defineException, makeDiagnosticReport, makePublicReport, makeReportPair, redaction, trust, and decoding calls.

Redaction resolution now uses Corj.resolveRedactPolicy internally. Dependency range is caught-object-report-json ^13.0.0. Report formats, byte limits, diagnostic schema v6, public v3/v4 decoding, fingerprint semantics and cross-copy trust are unchanged.

For upgrades from 0.5.x or earlier, apply the 0.6.0 migration changes as well.

Validation: 340 tests pass with 100% coverage, plus strict types, build, packed package checks, Node ESM, Bun, Chromium and 45 documentation snippets. GitHub CI passed on Node 18, 20 and 24, Bun and browser; an independent installation of the release tarball verified namespace identity and reporting integration.

0.6.0: Descriptive APIs and report byte limits

This release adopts descriptive APIs and corj 12, with breaking changes and no compatibility aliases.

Previous API	New API
toDiagnosticReport	makeDiagnosticReport
toPublicReport	makePublicReport
toReports	makeReportPair
createRedactionPolicy	makeRedactionPolicy
createTrustRealm	makeTrustRealm
CapturedReports	ReportPair
ToReportsOptions	ReportPairOptions
PublicOverride	PublicPolicyOverride
CorjReportChild	CorjReportNode
AppexCorjOptions	DiagnosticReportCorjOptions / PublicReportCorjOptions
Policy details callback	detailsSelector
Single-report public override	policyOverride
Nested corj.maxReportSize	Top-level maxReportBytes

Instance details, kind definition public, and the pair's public audience bag retain their meanings.

maxReportBytes measures complete compact JSON in UTF-8. Diagnostic reports retain the existing default cap and accept limits of at least 512 bytes. Public limits are opt-in and at least 2,048 bytes; an over-budget public report drops as_json whole, then shortens message without splitting Unicode pairs. null disables the total cap; independent component caps still apply.

Caller option bags remain mutable, and later changes affect later reports. Unknown policy keys and obsolete option spellings are rejected. Public CORJ options are limited to inspection, maxDepth, maxChildren, childrenSources, fingerprintParts, and onReportingError; diagnostic CORJ options exclude redact, maxReportSize, and reportSizeUnit.

Diagnostic reports use corj/v0.15, with the new schemas/diagnostic-report-v6.json. Historical schemas remain available. Public reports stay v4, the decoder still accepts v3/v4, and realm-v1 interoperability is preserved.

Validation: 339 tests with 100% coverage; types, build, packed consumers on Node ESM, Bun and Chromium; 44 documentation snippets; independent Sol medium review. GitHub CI covers Node 18/20/24, Bun, and browser.

Published from the exact verified tarball; this manual release does not claim GitHub Actions provenance.

v0.5.0

Reports rebuilt on caught-object-report-json 11: one corj options slot, one public option, public report v4 with a stack-backed fingerprint, new schemas. Breaking; see the Upgrading from 0.4 table in CHANGELOG.md.

🤖 Generated with Claude Code

v0.4.0

Six opt-in controls over what a failure discloses, and one breaking change: the diagnostic report format. A caller that uses none of the new options sees no other difference from 0.3.0.

Breaking

• The diagnostic report's v is now corj/v0.13, and its schema ships as schemas/diagnostic-report-v4.json. schemas/diagnostic-report-v3.json stays published, unchanged, for readers of 0.3.0 reports. The public report is still appex/public/v3.
• The runtime dependency is caught-object-report-json ^10.0.0.
• TypeScript unions widen with the format: ReportingError['stage'] gains 'redact'; corj's children_omitted gains 'not_inspected' and 'redacted'; as_string_format gains 'derived'.
• The re-exported restoreExpectedValues (now corj 10) no longer relabels a stored corj/v0.12 report as -full.

New

• toReports(caught, { occurrenceId, diagnostic, public }) resolves one occurrence and returns both reports from it, so occurrence_id matches for every caught value, thrown primitives included. Options are validated before either report is built; a half pair is never returned. (#45)
• maxFinalReportSize bounds the whole diagnostic report in UTF-8 bytes of compact JSON. It drops context, then reporting_errors — both named in the new report_omitted field — then shrinks corj's own budget, and throws APPEX_REPORT_BUDGET_TOO_SMALL rather than emit an over-budget or invalid report. (#44)
• createRedactionPolicy({ keys, paths, patterns, replacement, transform }), accepted as redact by all three report functions. Skip rules (keys, paths) name properties that are never read, so an excluded getter never runs. Scrub rules (patterns, transform) rewrite strings and property names in both reports. To remove a secret's text, use patterns: skipping message still leaves it in stack. On a public report the policy is given only what the kind's details selector returned. A policy that throws fails closed, and its own message is withheld because it can quote what the policy was protecting. (#43)
• defineException({ snapshotDetails: true }) captures a deep frozen copy of the details at construction, so later mutation of the caller's objects cannot change what the message and the reports describe. It never freezes the caller's objects, and rejects what it cannot capture faithfully — cycles, functions, accessors, class instances — as APPEX_INVALID_DETAILS naming the path. (#47)
• createTrustRealm() and isTrustedException(caught, realm): an explicit, capability-based trust boundary between separately loaded copies of the package. Trust is keyed by object identity only, so a forged _tag or brand and a wire-deserialized value acquire nothing. Without a realm every copy keeps its isolation, and isTypedException keeps its one-argument shape. (#46)
• Runtime support, measured: Node >= 18 (CommonJS), Node ESM, Bun, and browsers through a bundler, each exercised against the packed artifact — including a Vite build run in headless Chromium with no Node shims. (#48)
• A diagnostic report now always carries v, even at the smallest size a budget can force.
• New error codes: APPEX_REPORT_BUDGET_TOO_SMALL, APPEX_INVALID_TRUST_REALM, APPEX_INVALID_REDACTION_POLICY.

Read more

Recipes · API card · Redaction design · Cross-copy trust design · Runtime support · Changelog

Install: npm install application-exception@0.4.0

npm package

v0.2.2

Documentation patch: a shorter, self-contained README explaining typed failures, bounded operator diagnostics, and deliberately selected public reports for agent tools and LLM harnesses. Detailed guidance keeps recovery and disclosure responsibilities explicit.

No runtime or public API changes; distributed JavaScript and TypeScript declarations are unchanged from 0.2.1.

Install: npm install application-exception@0.2.2

npm package