@aztec/foundation 0.0.1-commit.f504929 → 0.0.1-commit.f5a9928

package/src/json-rpc/server/safe_json_rpc_server.ts

@@ -10,7 +10,14 @@ import { ZodError } from 'zod';
 
 import { type Logger, createLogger } from '../../log/index.js';
 import { promiseWithResolvers } from '../../promise/utils.js';
-import { type ApiSchema, type ApiSchemaFor, parseWithOptionals, schemaHasMethod } from '../../schemas/index.js';
+import {
+  type ApiSchema,
+  type ApiSchemaFor,
+  getSchemaParameters,
+  parseWithOptionals,
+  schemaHasMethod,
+} from '../../schemas/index.js';
+import { Timer } from '../../timer/index.js';
 import { jsonStringify } from '../convert.js';
 import { assert } from '../js_utils.js';
 
@@ -19,6 +26,8 @@ export type DiagnosticsData = {
   method: string;
   params: any[];
   headers: http.IncomingHttpHeaders;
+  requestValidationDurationMs?: number;
+  requestValidationSucceeded?: boolean;
 };
 
 export type DiagnosticsMiddleware = (ctx: DiagnosticsData, next: () => Promise<void>) => Promise<void>;
@@ -30,14 +39,41 @@ export type SafeJsonRpcServerConfig = {
   http200OnError: boolean;
   /** The maximum body size the server will accept */
   maxBodySizeBytes: string;
+  /** Origins allowed to make credentialed cross-origin requests. An empty list preserves wildcard CORS. */
+  corsAllowedOrigins?: string[];
+  /** Headers allowed in cross-origin requests. An empty list reflects the requested headers. */
+  corsAllowedHeaders?: string[];
 };
 
-const defaultServerConfig: SafeJsonRpcServerConfig = {
+type ResolvedSafeJsonRpcServerConfig = Omit<SafeJsonRpcServerConfig, 'corsAllowedOrigins' | 'corsAllowedHeaders'> & {
+  corsAllowedOrigins: string[];
+  corsAllowedHeaders: string[];
+};
+
+const defaultServerConfig: ResolvedSafeJsonRpcServerConfig = {
   http200OnError: false,
   maxBatchSize: 100,
   maxBodySizeBytes: '1mb',
+  corsAllowedOrigins: [],
+  corsAllowedHeaders: [],
 };
 
+function normalizeCorsOrigin(origin: string): string {
+  if (origin === '*') {
+    return origin;
+  }
+  const url = new URL(origin);
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw new Error(`Invalid CORS origin protocol: ${origin}`);
+  }
+  if (url.username || url.password || (url.pathname !== '' && url.pathname !== '/') || url.search || url.hash) {
+    throw new Error(
+      `CORS allowed origin must not include credentials, a path, query parameters, or a fragment: ${origin}`,
+    );
+  }
+  return url.origin;
+}
+
 export class SafeJsonRpcServer {
   /**
    * The HTTP server accepting remote requests.
@@ -45,7 +81,7 @@ export class SafeJsonRpcServer {
    */
   private httpServer?: http.Server;
 
-  private config: SafeJsonRpcServerConfig;
+  private config: ResolvedSafeJsonRpcServerConfig;
 
   constructor(
     /** The proxy object to delegate requests to */
@@ -53,12 +89,15 @@ export class SafeJsonRpcServer {
     config: Partial<SafeJsonRpcServerConfig> = {},
     /** Health check function */
     private readonly healthCheck: StatusCheckFn = () => true,
-    /** Additional middlewares */
+    /** Additional Koa middlewares */
     private extraMiddlewares: Application.Middleware[] = [],
+    /** Additional per-request diagnostics middlewares */
+    private diagnosticsMiddleware?: DiagnosticsMiddleware,
     /** Logger */
     private log = createLogger('json-rpc:server'),
   ) {
     this.config = { ...defaultServerConfig, ...config };
+    this.config.corsAllowedOrigins = this.config.corsAllowedOrigins.map(normalizeCorsOrigin);
 
     // handle empty string
     if (!this.config.maxBodySizeBytes) {
@@ -66,8 +105,16 @@ export class SafeJsonRpcServer {
     }
   }
 
+  /** Returns the status of this server, including per-component health when the health check reports it. */
+  public getStatus(): Promise<ServerStatus> {
+    return Promise.resolve(this.healthCheck()).then(result => {
+      const { healthy, details } = normalizeStatusCheckResult(result);
+      return { ok: healthy, ...details };
+    });
+  }
+
   public isHealthy(): boolean | Promise<boolean> {
-    return this.healthCheck();
+    return this.getStatus().then(status => status.ok);
   }
 
   /**
@@ -92,7 +139,7 @@ export class SafeJsonRpcServer {
           ctx.body = { jsonrpc: '2.0', id: null, error: { code: -32700, message: `Parse error: ${err.message}` } };
         } else {
           ctx.status = 500;
-          ctx.body = { jsonrpc: '2.0', id: null, error: { code: -32600, message: err.message ?? 'Internal error' } };
+          ctx.body = { jsonrpc: '2.0', id: null, error: { code: -32603, message: err.message ?? 'Internal error' } };
         }
       }
     };
@@ -116,6 +163,36 @@ export class SafeJsonRpcServer {
 
     app.use(compress({ br: false }));
     app.use(jsonResponse);
+    const corsAllowedHeaders =
+      this.config.corsAllowedHeaders.length > 0 ? { allowHeaders: this.config.corsAllowedHeaders } : {};
+    if (this.config.corsAllowedOrigins.length === 0) {
+      app.use(cors(corsAllowedHeaders));
+    } else {
+      const allowedOrigins = new Set(this.config.corsAllowedOrigins);
+      const allowAnyOrigin = allowedOrigins.has('*');
+      app.use(
+        cors({
+          origin: ctx => {
+            const origin = ctx.get('Origin');
+            if (!origin) {
+              return '';
+            }
+
+            if (allowAnyOrigin) {
+              return origin;
+            }
+
+            if (allowedOrigins.has(origin)) {
+              return origin;
+            }
+
+            return '';
+          },
+          credentials: true,
+          ...corsAllowedHeaders,
+        }),
+      );
+    }
     for (const middleware of this.extraMiddlewares) {
       app.use(middleware);
     }
@@ -126,7 +203,6 @@ export class SafeJsonRpcServer {
         enableTypes: ['json'],
       }),
     );
-    app.use(cors());
     app.use(router.routes());
     app.use(router.allowedMethods());
 
@@ -155,7 +231,7 @@ export class SafeJsonRpcServer {
           };
           return;
         }
-        const resp = await this.processBatch(ctx.request.body);
+        const resp = await this.processBatch(ctx.request.body, ctx.request.headers);
         if (Array.isArray(resp)) {
           ctx.status = 200;
           ctx.body = resp;
@@ -164,7 +240,7 @@ export class SafeJsonRpcServer {
           ctx.body = resp;
         }
       } else {
-        const resp = await this.processRequest(ctx.request.body);
+        const resp = await this.processRequest(ctx.request.body, ctx.request.headers);
         if ('error' in resp) {
           ctx.status = this.config.http200OnError ? 200 : 400;
         }
@@ -176,22 +252,22 @@ export class SafeJsonRpcServer {
     return router;
   }
 
-  private async processBatch(requests: any[]) {
+  private async processBatch(requests: any[], headers: http.IncomingHttpHeaders = {}) {
     if (requests.length === 0) {
       return { jsonrpc: '2.0', error: { code: -32600, message: 'Invalid Request' }, id: null };
     }
-    const results = await Promise.allSettled(requests.map(req => this.processRequest(req)));
+    const results = await Promise.allSettled(requests.map(req => this.processRequest(req, headers)));
     return results.map(res => {
       if (res.status === 'fulfilled') {
         return res.value;
       }
 
       this.log.warn(`Uncaught error executing request in batch: ${res.reason}.`);
-      return { jsonrpc: '2.0', error: { code: -32600, message: 'Invalid Request' }, id: null };
+      return { jsonrpc: '2.0', error: { code: -32603, message: 'Internal error' }, id: null };
     });
   }
 
-  private async processRequest(request: any) {
+  private async processRequest(request: any, headers: http.IncomingHttpHeaders = {}) {
     if (!request || typeof request !== 'object') {
       return { jsonrpc: '2.0', error: { code: -32600, message: 'Invalid Request' }, id: null };
     }
@@ -206,8 +282,25 @@ export class SafeJsonRpcServer {
       return { jsonrpc, id, error: { code: -32601, message: `Method not found: ${method}` } };
     } else {
       try {
-        const result = await this.proxy.call(method, params);
-        return { jsonrpc, id, result };
+        let result: any;
+
+        if (this.diagnosticsMiddleware) {
+          const diagnosticsData: DiagnosticsData = { id: id ?? null, method, params, headers };
+          await this.diagnosticsMiddleware(diagnosticsData, async () => {
+            result = await this.proxy.call(method, params, (durationMs, succeeded) => {
+              diagnosticsData.requestValidationDurationMs = durationMs;
+              diagnosticsData.requestValidationSucceeded = succeeded;
+            });
+          });
+        } else {
+          result = await this.proxy.call(method, params);
+        }
+
+        // Coerce an undefined return value to null so the response always carries a `result` key.
+        // JSON.stringify drops undefined-valued keys, which would otherwise produce a JSON-RPC
+        // response with neither `result` nor `error` — a spec violation that leaves callers unable
+        // to distinguish "not found" from a malformed response.
+        return { jsonrpc, id, result: result ?? null };
       } catch (err: any) {
         if (err && err instanceof ZodError) {
           const message = err.issues.map(e => `${e.message} (${e.path.join('.')})`).join('. ') || 'Validation error';
@@ -274,11 +367,42 @@ export class SafeJsonRpcServer {
   }
 }
 
-export type StatusCheckFn = () => boolean | Promise<boolean>;
+/** Health of a single component, along with any details worth surfacing to whoever queries the status endpoint. */
+export type StatusCheckResult = {
+  /** Whether the component is healthy. */
+  healthy: boolean;
+  /** Component-specific information, reported next to the healthy flag. */
+  details?: object;
+};
+
+/** Health check for a component. Returning a plain boolean is shorthand for `{ healthy: <boolean> }`. */
+export type StatusCheckFn = () => boolean | StatusCheckResult | Promise<boolean | StatusCheckResult>;
+
+/** Health of a component as reported on the status endpoint: its healthy flag flattened with its details. */
+export type ComponentStatus = { healthy: boolean } & Record<string, unknown>;
+
+/** Status of a server as reported on the status endpoint. */
+export type ServerStatus = {
+  /** Whether every checked component reported healthy. */
+  ok: boolean;
+  /** Health of each component keyed by namespace, when the server has component-level health checks. */
+  components?: Record<string, ComponentStatus>;
+};
+
+/** Returns the status of a server. */
+export type ServerStatusFn = () => ServerStatus | Promise<ServerStatus>;
+
+function normalizeStatusCheckResult(result: boolean | StatusCheckResult): StatusCheckResult {
+  return typeof result === 'boolean' ? { healthy: result } : result;
+}
 
 interface Proxy {
   hasMethod(methodName: string): boolean;
-  call(methodName: string, jsonParams?: any[]): Promise<any>;
+  call(
+    methodName: string,
+    jsonParams?: any[],
+    onRequestValidated?: (durationMs: number, succeeded: boolean) => void,
+  ): Promise<any>;
 }
 
 /**
@@ -302,14 +426,26 @@ export class SafeJsonProxy<T extends object = any> implements Proxy {
    * @param jsonParams - The RPC parameters.
    * @returns The remote result.
    */
-  public async call(methodName: string, jsonParams: any[] = []) {
+  public async call(
+    methodName: string,
+    jsonParams: any[] = [],
+    onRequestValidated?: (durationMs: number, succeeded: boolean) => void,
+  ) {
     this.log.debug(format(`request`, methodName, jsonParams));
 
-    assert(Array.isArray(jsonParams), `Params to ${methodName} is not an array: ${jsonParams}`);
     assert(schemaHasMethod(this.schema, methodName), `Method ${methodName} not found in schema`);
     const method = this.handler[methodName as keyof T];
     assert(typeof method === 'function', `Method ${methodName} is not a function`);
-    const args = await parseWithOptionals(jsonParams, this.schema[methodName].parameters());
+    const validationTimer = new Timer();
+    let args: any[];
+    try {
+      assert(Array.isArray(jsonParams), `Params to ${methodName} is not an array: ${jsonParams}`);
+      args = await parseWithOptionals(jsonParams, getSchemaParameters(this.schema[methodName]));
+      onRequestValidated?.(validationTimer.ms(), true);
+    } catch (error) {
+      onRequestValidated?.(validationTimer.ms(), false);
+      throw error;
+    }
     const ret = await method.apply(this.handler, args);
     this.log.debug(format('response', methodName, ret));
     return ret;
@@ -329,12 +465,16 @@ class NamespacedSafeJsonProxy implements Proxy {
     }
   }
 
-  public call(namespacedMethodName: string, jsonParams: any[] = []) {
+  public call(
+    namespacedMethodName: string,
+    jsonParams: any[] = [],
+    onRequestValidated?: (durationMs: number, succeeded: boolean) => void,
+  ) {
     const [namespace, methodName] = namespacedMethodName.split('_', 2);
     assert(namespace && methodName, `Invalid namespaced method name: ${namespacedMethodName}`);
     const handler = this.proxies[namespace];
     assert(handler, `Namespace not found: ${namespace}`);
-    return handler.call(methodName, jsonParams);
+    return handler.call(methodName, jsonParams, onRequestValidated);
   }
 
   public hasMethod(namespacedMethodName: string): boolean {
@@ -353,23 +493,23 @@ export function makeHandler<T extends object>(handler: T, schema: ApiSchemaFor<T
 }
 
 function makeAggregateHealthcheck(namedHandlers: NamespacedApiHandlers, log?: Logger): StatusCheckFn {
-  return async () => {
+  return async (): Promise<StatusCheckResult> => {
     try {
-      const results = await Promise.all(
-        Object.entries(namedHandlers).map(async ([name, [, , healthCheck]]) => [
-          name,
-          healthCheck ? await healthCheck() : true,
-        ]),
+      const entries = await Promise.all(
+        Object.entries(namedHandlers).map(async ([name, [, , healthCheck]]): Promise<[string, ComponentStatus]> => {
+          const { healthy, details } = normalizeStatusCheckResult(healthCheck ? await healthCheck() : true);
+          return [name, { healthy, ...details }];
+        }),
       );
-      const failed = results.filter(([_, result]) => !result);
+      const components = Object.fromEntries(entries);
+      const failed = entries.filter(([, status]) => !status.healthy).map(([name]) => name);
       if (failed.length > 0) {
-        log?.warn(`Health check failed for ${failed.map(([name]) => name).join(', ')}`);
-        return false;
+        log?.warn(`Health check failed for ${failed.join(', ')}`, { components });
       }
-      return true;
+      return { healthy: failed.length === 0, details: { components } };
     } catch (err) {
       log?.error(`Error during health check`, err);
-      return false;
+      return { healthy: false };
     }
   };
 }
@@ -377,6 +517,7 @@ function makeAggregateHealthcheck(namedHandlers: NamespacedApiHandlers, log?: Lo
 export type SafeJsonRpcServerOptions = Partial<
   SafeJsonRpcServerConfig & {
     healthCheck: StatusCheckFn;
+    diagnostic: DiagnosticsMiddleware;
     log: Logger;
     middlewares: Application.Middleware[];
   }
@@ -391,10 +532,10 @@ export function createNamespacedSafeJsonRpcServer(
   handlers: NamespacedApiHandlers,
   options: Omit<SafeJsonRpcServerOptions, 'healthcheck'> = {},
 ): SafeJsonRpcServer {
-  const { middlewares, log } = options;
+  const { diagnostic, middlewares, log } = options;
   const proxy = new NamespacedSafeJsonProxy(handlers);
   const healthCheck = makeAggregateHealthcheck(handlers, log);
-  return new SafeJsonRpcServer(proxy, options, healthCheck, middlewares, log);
+  return new SafeJsonRpcServer(proxy, options, healthCheck, middlewares, diagnostic, log);
 }
 
 export function createSafeJsonRpcServer<T extends object = any>(
@@ -402,51 +543,61 @@ export function createSafeJsonRpcServer<T extends object = any>(
   schema: ApiSchemaFor<T>,
   options: SafeJsonRpcServerOptions = {},
 ) {
-  const { log, healthCheck, middlewares: extraMiddlewares } = options;
+  const { diagnostic, log, healthCheck, middlewares: extraMiddlewares } = options;
   const proxy = new SafeJsonProxy(handler, schema);
-  return new SafeJsonRpcServer(proxy, options, healthCheck, extraMiddlewares, log);
+  return new SafeJsonRpcServer(proxy, options, healthCheck, extraMiddlewares, diagnostic, log);
 }
 
 /**
- * Creates a router for handling a plain status request that will return 200 status when running.
- * @param getCurrentStatus - List of health check functions to run.
+ * Creates a router for handling a status request that returns a 200 status code when healthy and a 500 otherwise,
+ * along with the reported status as a JSON body.
+ * @param getCurrentStatus - Function returning the current status of the server.
  * @param apiPrefix - The prefix to use for all api requests
  * @returns - The router for handling status requests.
  */
-export function createStatusRouter(getCurrentStatus: StatusCheckFn, apiPrefix = '') {
+export function createStatusRouter(getCurrentStatus: ServerStatusFn, apiPrefix = '') {
   const router = new Router({ prefix: `${apiPrefix}` });
   router.get('/status', async (ctx: Koa.Context) => {
-    let ok: boolean;
+    let status: ServerStatus;
     try {
-      ok = (await getCurrentStatus()) === true;
+      status = await getCurrentStatus();
     } catch {
-      ok = false;
+      status = { ok: false };
     }
 
-    ctx.status = ok ? 200 : 500;
+    ctx.status = status.ok === true ? 200 : 500;
+    ctx.type = 'application/json';
+    ctx.body = status;
   });
   return router;
 }
 
 /**
  * Wraps a JsonRpcServer in a nodejs http server and starts it.
- * Installs a status router that calls to the isHealthy method to the server.
+ * Installs a status router that reports the status of the server, using its getStatus method when available so that
+ * per-component health is included, and falling back to isHealthy otherwise.
  * Returns once starts listening unless noWait is set.
  * @returns A running http server.
  */
 export async function startHttpRpcServer(
-  rpcServer: Pick<SafeJsonRpcServer, 'getApp' | 'isHealthy'>,
+  rpcServer: Pick<SafeJsonRpcServer, 'getApp' | 'isHealthy'> & Partial<Pick<SafeJsonRpcServer, 'getStatus'>>,
   options: {
     host?: string;
     port?: number | string;
     apiPrefix?: string;
     timeoutMs?: number;
+    keepAliveTimeoutMs?: number;
+    headersTimeoutMs?: number;
     noWait?: boolean;
   } = {},
 ): Promise<http.Server & { port: number }> {
   const app = rpcServer.getApp(options.apiPrefix);
 
-  const statusRouter = createStatusRouter(rpcServer.isHealthy.bind(rpcServer), options.apiPrefix);
+  const getStatus: ServerStatusFn = rpcServer.getStatus
+    ? rpcServer.getStatus.bind(rpcServer)
+    : async () => ({ ok: (await rpcServer.isHealthy()) === true });
+
+  const statusRouter = createStatusRouter(getStatus, options.apiPrefix);
   app.use(statusRouter.routes()).use(statusRouter.allowedMethods());
 
   // eslint-disable-next-line @typescript-eslint/no-misused-promises
@@ -454,6 +605,12 @@ export async function startHttpRpcServer(
   if (options.timeoutMs) {
     httpServer.timeout = options.timeoutMs;
   }
+  if (options.keepAliveTimeoutMs !== undefined) {
+    httpServer.keepAliveTimeout = options.keepAliveTimeoutMs;
+  }
+  if (options.headersTimeoutMs !== undefined) {
+    httpServer.headersTimeout = options.headersTimeoutMs;
+  }
 
   const { promise, resolve } = promiseWithResolvers<void>();
   const listenPort = options.port ? (typeof options.port === 'string' ? parseInt(options.port) : options.port) : 0;

package/src/log/aws-logger-config.ts

@@ -0,0 +1,32 @@
+import type { pino } from 'pino';
+
+function getSeverity(label: string): { severityText: string; severityNumber: number } {
+  switch (label) {
+    case 'trace':
+      return { severityText: 'TRACE', severityNumber: 1 };
+    case 'debug':
+      return { severityText: 'DEBUG', severityNumber: 5 };
+    case 'verbose':
+      return { severityText: 'VERBOSE', severityNumber: 7 };
+    case 'info':
+      return { severityText: 'INFO', severityNumber: 9 };
+    case 'warn':
+      return { severityText: 'WARN', severityNumber: 13 };
+    case 'error':
+      return { severityText: 'ERROR', severityNumber: 17 };
+    case 'fatal':
+      return { severityText: 'FATAL', severityNumber: 21 };
+    default:
+      return { severityText: 'UNSPECIFIED', severityNumber: 0 };
+  }
+}
+
+/** Pino configuration that adds OpenTelemetry severity fields understood by CloudWatch Logs. */
+export const AWSCloudLoggerConfig = {
+  messageKey: 'msg',
+  formatters: {
+    level(label: string, level: number): object {
+      return { level, ...getSeverity(label) };
+    },
+  },
+} satisfies pino.LoggerOptions;

package/src/log/pino-logger.ts

@@ -7,6 +7,7 @@ import { inspect } from 'util';
 import { compactArray } from '../collection/array.js';
 import type { EnvVar } from '../config/index.js';
 import { parseBooleanEnv } from '../config/parse-env.js';
+import { AWSCloudLoggerConfig } from './aws-logger-config.js';
 import { convertBigintsToStrings } from './bigint-utils.js';
 import { GoogleCloudLoggerConfig } from './gcloud-logger-config.js';
 import { getLogLevelFromFilters, parseLogLevelEnvVar } from './log-filters.js';
@@ -21,6 +22,8 @@ export type LoggerBindings = {
   instanceId?: string;
 };
 
+const MAX_MODULE_NAME_LENGTH = 256;
+
 // Allow global hooks for providing default bindings.
 // Used by withLoggerBindings in pino-logger-server to propagate bindings via AsyncLocalStorage.
 type LogBindingsHandler = () => LoggerBindings | undefined;
@@ -48,7 +51,7 @@ function getBindingsFromHandlers(): LoggerBindings | undefined {
 }
 
 export function createLogger(module: string, bindings?: LoggerBindings): Logger {
-  module = module.replace(/^aztec:/, '');
+  module = module.slice(0, MAX_MODULE_NAME_LENGTH).replace(/^aztec:/, '');
 
   const resolvedBindings = { ...getBindingsFromHandlers(), ...bindings };
   const actor = resolvedBindings?.actor;
@@ -132,8 +135,17 @@ export const [logLevel, logFilters] = parseLogLevelEnvVar(process.env.LOG_LEVEL,
 // Define custom logging levels for pino.
 const customLevels = { verbose: 25 };
 
-// Global pino options, tweaked for google cloud if running there.
+// Global pino options, tweaked for the active cloud logging backend.
 const useGcloudLogging = parseBooleanEnv(process.env['USE_GCLOUD_LOGGING' satisfies EnvVar]);
+const useAwsLogging = parseBooleanEnv(process.env['USE_AWS_LOGGING' satisfies EnvVar]);
+const loggingConfig = useGcloudLogging
+  ? GoogleCloudLoggerConfig
+  : useAwsLogging
+    ? AWSCloudLoggerConfig
+    : {
+        formatters: {},
+        messageKey: 'msg',
+      };
 
 const redactedPaths = [
   'validatorPrivateKeys',
@@ -154,7 +166,7 @@ const redactedPaths = [
 
 const pinoOpts: pino.LoggerOptions<keyof typeof customLevels> = {
   customLevels,
-  messageKey: 'msg',
+  messageKey: loggingConfig.messageKey,
   useOnlyCustomLevels: false,
   level: logLevel,
   redact: {
@@ -168,8 +180,8 @@ const pinoOpts: pino.LoggerOptions<keyof typeof customLevels> = {
   },
   formatters: {
     log: obj => convertBigintsToStrings(obj) as Record<string, unknown>,
+    ...loggingConfig.formatters,
   },
-  ...(useGcloudLogging ? GoogleCloudLoggerConfig : {}),
 };
 
 export const levels = {
@@ -239,7 +251,7 @@ const pinoPrettyBaseOpts = {
   destination: 2,
   sync: true,
   colorize: useColor,
-  ignore: 'module,actor,instanceId,pid,hostname,trace_id,span_id,trace_flags,severity',
+  ignore: 'module,actor,instanceId,pid,hostname,trace_id,span_id,trace_flags,severity,severityText,severityNumber',
   customLevels: 'fatal:60,error:50,warn:40,info:30,verbose:25,debug:20,trace:10',
   customColors: 'fatal:bgRed,error:red,warn:yellow,info:green,verbose:magenta,debug:blue,trace:gray',
   minimumLevel: 'trace' as const,
@@ -375,5 +387,20 @@ export type Logger = { [K in LogLevel]: LogFn } & { /** Error log function */ er
  * @returns A string with both the log message and the error message.
  */
 function formatErr(msg: string, err?: unknown): string {
-  return err ? `${msg}: ${inspect(err)}` : msg;
+  if (!err) {
+    return msg;
+  }
+
+  try {
+    return `${msg}: ${inspect(err)}`;
+  } catch {
+    // inspect can crash on error objects with broken property descriptors
+    try {
+      // eslint-disable-next-line @typescript-eslint/no-base-to-string
+      return `${msg}: ${err instanceof Error ? `${err.name}: ${err.message}` : String(err)}`;
+    } catch {
+      // if even String(err) fails, return the original message with a note about the error
+      return `${msg}: [unserializable error]`;
+    }
+  }
 }

package/src/noir/noir_package_config.ts

@@ -10,26 +10,6 @@ const noirLocalDependencySchema = z.object({
   path: z.string(),
 });
 
-const noirPackageConfigSchema = z.object({
-  package: z.object({
-    name: z.string().default(''),
-    type: z.enum(['lib', 'contract', 'bin']).default('bin'),
-    entry: z.string().optional(),
-    description: z.string().optional(),
-    authors: z.array(z.string()).optional(),
-    // eslint-disable-next-line camelcase
-    compiler_version: z.string().optional(),
-    backend: z.string().optional(),
-    license: z.string().optional(),
-  }),
-  dependencies: z.record(z.union([noirGitDependencySchema, noirLocalDependencySchema])).default({}),
-});
-
-/**
- * Noir package configuration.
- */
-export type NoirPackageConfig = z.infer<typeof noirPackageConfigSchema>;
-
 /**
  * A remote package dependency.
  */
@@ -45,6 +25,38 @@ export type NoirLocalDependencyConfig = z.infer<typeof noirLocalDependencySchema
  */
 export type NoirDependencyConfig = NoirGitDependencyConfig | NoirLocalDependencyConfig;
 
+/**
+ * Noir package configuration.
+ */
+export type NoirPackageConfig = {
+  package: {
+    name: string;
+    type: 'lib' | 'contract' | 'bin';
+    entry?: string | undefined;
+    description?: string | undefined;
+    authors?: string[] | undefined;
+    compiler_version?: string | undefined;
+    backend?: string | undefined;
+    license?: string | undefined;
+  };
+  dependencies: Record<string, NoirDependencyConfig>;
+};
+
+const noirPackageConfigSchema: z.ZodType<NoirPackageConfig> = z.object({
+  package: z.object({
+    name: z.string().default(''),
+    type: z.enum(['lib', 'contract', 'bin']).default('bin'),
+    entry: z.string().optional(),
+    description: z.string().optional(),
+    authors: z.array(z.string()).optional(),
+    // eslint-disable-next-line camelcase
+    compiler_version: z.string().optional(),
+    backend: z.string().optional(),
+    license: z.string().optional(),
+  }),
+  dependencies: z.record(z.string(), z.union([noirGitDependencySchema, noirLocalDependencySchema])).default({}),
+});
+
 /**
  * Checks that an object is a package configuration.
  * @param config - Config to check