test(creators): assert no leaked internals and 404 shape parity for creator detail

src/modules/creators/creator-detail-not-found.integration.test.ts

@@ -31,4 +31,56 @@ describe('GET /api/v1/creators/:id — not found', () => {
       expect(res.body.error.code).toBe('NOT_FOUND');
       expect(res.body.error.message).toMatch(/creator.*not found/i);
    });
+
+   it('matches the standard 404 response shape used by other creator routes', async () => {
+      const { default: app } = await import('../../app');
+
+      const res = await supertest(app).get(
+         '/api/v1/creators/non-existent-creator-for-404-test'
+      );
+
+      // Same envelope as GET /:id/holders and other 404s in the API:
+      // exactly { success, error: { code, message } }, no extra fields.
+      expect(res.body).toEqual({
+         success: false,
+         error: {
+            code: 'NOT_FOUND',
+            message: 'Creator not found',
+         },
+      });
+   });
+
+   it('does not leak database errors, table/model names, or stack traces', async () => {
+      const { default: app } = await import('../../app');
+
+      const res = await supertest(app).get(
+         '/api/v1/creators/non-existent-creator-for-404-test'
+      );
+
+      const serializedBody = JSON.stringify(res.body).toLowerCase();
+
+      const forbiddenPatterns = [
+         'stack',
+         'trace',
+         'prisma',
+         'creatorprofile',
+         'creator_profile',
+         'select ',
+         'sql',
+         '.ts:',
+         '.js:',
+         'node_modules',
+         'at object',
+         'errno',
+         'econnrefused',
+      ];
+
+      for (const pattern of forbiddenPatterns) {
+         expect(serializedBody).not.toContain(pattern);
+      }
+
+      // Only the documented error keys should be present—nothing
+      // implementation-specific like a Prisma error `code`/`meta`/`clientVersion`.
+      expect(Object.keys(res.body.error).sort()).toEqual(['code', 'message']);
+   });
 });