@gusnips/server 0.1.0 → 0.1.1

package/README.md

@@ -181,7 +181,9 @@ contract, and a "too big" without it costs somebody a bisect to rediscover a num
 already state.
 
 Validation is recognized by shape, not by an import, so your validator does not become this
-package's dependency. Measured against zod 3.25, 4.4 and 4.5.
+package's dependency. Measured against zod 3.25, 4.4 and 4.5. A tool or queue consumer can use
+`validationIssues(error)` from the root package to apply the same allow-list without building an
+HTTP answer.
 
 **A 5xx keeps its message unless its code is masked.** By default only `INTERNAL_ERROR` is,
 because that is the code you raise when something unexpected broke, so its message may carry
@@ -264,6 +266,14 @@ hypothetical. The boundary wraps one in an `Error` and keeps the original as `ca
 document number in a log and in whatever reads that log afterwards. `/health` is skipped with
 everything under it, because every deploy polls it in a loop; a throw is logged anyway.
 
+Add safe product metadata with `requestLogger<AppEnv>({ logger, fields: (c) => ({ … }) })`.
+`fields` runs after the response exists, so it can read values a handler set and `c.res`; return only
+bounded, sanitized values, never a raw path, query, header set, body or authentication object. Your
+fields are written first, so they cannot replace the canonical request id, method, route, status,
+duration or error code. A hook that throws is caught: the line is written with
+`requestFieldsFailed: true` instead of your fields. A value whose own `toJSON` throws is not — that
+one loses the whole line, request id included — so return plain data, not live objects.
+
 The request id goes back on `X-Request-ID`, on every answer including `onError`'s and
 `notFound`'s. A caller's own id is echoed only if it is 64 characters of `A-Z a-z 0-9 . _ -`,
 so the id in a line is always either the caller's or ours. Cross-origin, list that header in your

package/dist/hono/request-logger.d.ts

@@ -1,4 +1,4 @@
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 import type { Logger } from "../logger/index.ts";
 /** The two variables this adapter writes. Put them in your app's `Variables`. */
 export interface RequestVariables<Code extends string = string> {
@@ -6,8 +6,21 @@ export interface RequestVariables<Code extends string = string> {
     /** The code of the refusal this request got, for the request line. `null` until one happens. */
     errorCode: Code | null;
 }
-export interface RequestLoggerOptions {
+type RequestLoggerEnv = {
+    Variables: RequestVariables;
+};
+export interface RequestLoggerOptions<E extends RequestLoggerEnv = RequestLoggerEnv> {
     logger: Logger;
+    /**
+     * Sanitized product fields to add to the request line. Runs after the response exists, so it can
+     * read downstream variables and `c.res`. Keep caller-controlled values bounded; never return a
+     * raw path, query, header set, body or authentication object.
+     *
+     * Return plain data, not live objects: a throw from this hook is caught, but a value whose own
+     * `toJSON` throws is caught by the logger instead, which costs the whole line rather than the
+     * field.
+     */
+    fields?: (c: Context<E>) => Record<string, unknown>;
     /**
      * Paths answered but never logged, each with everything under it: `/health` covers
      * `/health/db` and not `/healthz`. Defaults to `["/health"]`. A throw is logged anyway.
@@ -25,7 +38,6 @@ export interface RequestLoggerOptions {
  * answer including `onError`'s and `notFound`'s. Cross-origin, list that header in your CORS
  * `exposeHeaders` or the browser hides it from the page.
  */
-export declare function requestLogger({ logger, skipPaths, }: RequestLoggerOptions): MiddlewareHandler<{
-    Variables: RequestVariables;
-}>;
+export declare function requestLogger<E extends RequestLoggerEnv = RequestLoggerEnv>({ logger, fields, skipPaths, }: RequestLoggerOptions<E>): MiddlewareHandler<E>;
+export {};
 //# sourceMappingURL=request-logger.d.ts.map

package/dist/hono/request-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-logger.d.ts","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,MAAM,EACN,SAAuB,GACxB,EAAE,oBAAoB,GAAG,iBAAiB,CAAC;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmC3E"}
+{"version":3,"file":"request-logger.d.ts","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,KAAK,gBAAgB,GAAG;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,EAAE,EAC3E,MAAM,EACN,MAAM,EACN,SAAuB,GACxB,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAoChD"}

package/dist/hono/request-logger.js

@@ -5,6 +5,18 @@ import { routePath } from "hono/route";
  * trimmed, so the id in the log is always either the caller's or ours.
  */
 const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
+function collectFields(fields, c) {
+    if (fields === undefined)
+        return {};
+    try {
+        // Materialize here too: a throwing getter is just as capable of losing the request line as a
+        // throwing callback. Logging metadata must never change the response it describes.
+        return { ...fields(c) };
+    }
+    catch {
+        return { requestFieldsFailed: true };
+    }
+}
 /**
  * One line per request, and the request id.
  *
@@ -16,7 +28,7 @@ const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
  * answer including `onError`'s and `notFound`'s. Cross-origin, list that header in your CORS
  * `exposeHeaders` or the browser hides it from the page.
  */
-export function requestLogger({ logger, skipPaths = ["/health"], }) {
+export function requestLogger({ logger, fields, skipPaths = ["/health"], }) {
     return async (c, next) => {
         const supplied = c.req.header("X-Request-ID");
         const requestId = supplied && REQUEST_ID.test(supplied) ? supplied : crypto.randomUUID();
@@ -51,7 +63,7 @@ export function requestLogger({ logger, skipPaths = ["/health"], }) {
         c.header("X-Request-ID", requestId);
         const skipped = skipPaths.some((skip) => path === skip || path.startsWith(`${skip}/`));
         if (method !== "OPTIONS" && !skipped)
-            logger.info("request", line(c.res.status));
+            logger.info("request", { ...collectFields(fields, c), ...line(c.res.status) });
     };
 }
 //# sourceMappingURL=request-logger.js.map

package/dist/hono/request-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-logger.js","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmBvC;;;;GAIG;AACH,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,SAAS,GAAG,CAAC,SAAS,CAAC,GACF;IACrB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACzF,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,+FAA+F;QAC/F,0FAA0F;QAC1F,4FAA4F;QAC5F,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS;YACT,MAAM;YACN,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,MAAM;YACN,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,0FAA0F;YAC1F,oFAAoF;YACpF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8FAA8F;QAC9F,sCAAsC;QACtC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-logger.js","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA+BvC;;;;GAIG;AACH,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,SAAS,aAAa,CACpB,MAAyC,EACzC,CAAa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,6FAA6F;QAC7F,mFAAmF;QACnF,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAgD,EAC3E,MAAM,EACN,MAAM,EACN,SAAS,GAAG,CAAC,SAAS,CAAC,GACC;IACxB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACzF,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,+FAA+F;QAC/F,0FAA0F;QAC1F,4FAA4F;QAC5F,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS;YACT,MAAM;YACN,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,MAAM;YACN,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,0FAA0F;YAC1F,oFAAoF;YACpF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8FAA8F;QAC9F,sCAAsC;QACtC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { AppError, createAppError, toMessage } from "./errors.ts";
 export type { AppErrorOptions } from "./errors.ts";
-export { created, createErrorResponse, noContent, ok, paginated } from "./responses.ts";
-export type { CannedError, ErrorAnswer, ErrorResponseOptions } from "./responses.ts";
+export { created, createErrorResponse, noContent, ok, paginated, validationIssues, } from "./responses.ts";
+export type { CannedError, ErrorAnswer, ErrorResponseOptions, ValidationIssue, } from "./responses.ts";
 export { createLogger, errorReplacer, keptErrorFields } from "./logger/index.ts";
 export type { Logger, LoggerOptions, LogLevel, LogThreshold } from "./logger/index.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,SAAS,EACT,EAAE,EACF,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { AppError, createAppError, toMessage } from "./errors.js";
-export { created, createErrorResponse, noContent, ok, paginated } from "./responses.js";
+export { created, createErrorResponse, noContent, ok, paginated, validationIssues, } from "./responses.js";
 export { createLogger, errorReplacer, keptErrorFields } from "./logger/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,SAAS,EACT,EAAE,EACF,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/logger/serialize.d.ts

@@ -17,8 +17,10 @@
  * a PostgREST client rejects with plain objects. So in a Hono app the cause slot is precisely where
  * a vendor's rejection object ends up, and a leak there reads as if the list had run.
  *
- * `cause` means "the error this one came from", so whatever sits in it is in the error slot and
- * gets the same treatment. `name` and `message` come along because a rejection object usually
+ * A plain object passed directly as `meta.error` is the other door. Hono wraps it, but a worker,
+ * a fire-and-forget catch or a database client outside Hono does not. `error` is the raw-error slot
+ * the logger documents, so it gets the same treatment as `cause`; an ordinary metadata object under
+ * any other key stays untouched. `name` and `message` come along because a rejection object usually
  * carries them and a line with neither says nothing at all.
  *
  * Deliberate state it does NOT keep: context an app attaches on purpose. That belongs in the
@@ -33,6 +35,9 @@ export declare function narrowErrorLike(value: object): Record<string, unknown>;
  *   `JSON.stringify(err)` is `{}` — which is how a logger ends up printing nothing about the
  *   failure it was called to report. They are added explicitly, and the allow-listed extras ride
  *   along beside them.
+ * - A plain object in the root `error` slot is narrowed through the same allow-list. Hono's
+ *   boundary turns one into an Error cause, but workers and swallowed catches log it directly.
+ *   Other metadata objects stay untouched.
  * - A nested `cause` is followed, and so is an `AggregateError`'s `errors`. Both are
  *   non-enumerable, so both are invisible to the loop above; without this line "all attempts
  *   failed" is the whole log entry. Each one goes back through this replacer, so the allow-list

package/dist/logger/serialize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEtE;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,aAAa,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CA4BvF;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC"}
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEtE;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,aAAa,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAiCvF;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC"}

package/dist/logger/serialize.js

@@ -87,8 +87,10 @@ function keptValue(key, value) {
  * a PostgREST client rejects with plain objects. So in a Hono app the cause slot is precisely where
  * a vendor's rejection object ends up, and a leak there reads as if the list had run.
  *
- * `cause` means "the error this one came from", so whatever sits in it is in the error slot and
- * gets the same treatment. `name` and `message` come along because a rejection object usually
+ * A plain object passed directly as `meta.error` is the other door. Hono wraps it, but a worker,
+ * a fire-and-forget catch or a database client outside Hono does not. `error` is the raw-error slot
+ * the logger documents, so it gets the same treatment as `cause`; an ordinary metadata object under
+ * any other key stays untouched. `name` and `message` come along because a rejection object usually
  * carries them and a line with neither says nothing at all.
  *
  * Deliberate state it does NOT keep: context an app attaches on purpose. That belongs in the
@@ -133,6 +135,9 @@ function narrowCause(cause, seen) {
  *   `JSON.stringify(err)` is `{}` — which is how a logger ends up printing nothing about the
  *   failure it was called to report. They are added explicitly, and the allow-listed extras ride
  *   along beside them.
+ * - A plain object in the root `error` slot is narrowed through the same allow-list. Hono's
+ *   boundary turns one into an Error cause, but workers and swallowed catches log it directly.
+ *   Other metadata objects stay untouched.
  * - A nested `cause` is followed, and so is an `AggregateError`'s `errors`. Both are
  *   non-enumerable, so both are invisible to the loop above; without this line "all attempts
  *   failed" is the whole log entry. Each one goes back through this replacer, so the allow-list
@@ -164,12 +169,18 @@ function narrowCause(cause, seen) {
  */
 export function errorReplacer() {
     const seen = new WeakSet();
+    let root;
     return function (key, value) {
         const held = typeof this === "object" && this !== null
             ? this[key]
             : undefined;
+        if (key === "" && typeof held === "object" && held !== null)
+            root = held;
         if (held instanceof Error)
             value = held;
+        else if (this === root && key === "error" && typeof held === "object" && held !== null) {
+            return seen.has(held) ? "[Circular]" : narrow(held, seen);
+        }
         if (typeof value === "bigint")
             return value.toString();
         if (value instanceof Error) {

package/dist/logger/serialize.js.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,sFAAsF;IACtF,yFAAyF;IACzF,4FAA4F;IAC5F,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,UAAU;IACV,wEAAwE;IACxE,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,8FAA8F;IAC9F,+FAA+F;IAC/F,iEAAiE;IACjE,YAAY;IACZ,MAAM;IACN,WAAW;IACX,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAqB;IAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAIhC,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAqB;IACxD,IAAI,KAAK,YAAY,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,oBAAoB;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,UAAU,GAAG,EAAE,KAAK;QACzB,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,YAAY,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,YAAY,cAAc;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/D,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAwB,iBAAiB,CAAC"}
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,sFAAsF;IACtF,yFAAyF;IACzF,4FAA4F;IAC5F,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,UAAU;IACV,wEAAwE;IACxE,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,8FAA8F;IAC9F,+FAA+F;IAC/F,iEAAiE;IACjE,YAAY;IACZ,MAAM;IACN,WAAW;IACX,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAqB;IAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAIhC,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAqB;IACxD,IAAI,KAAK,YAAY,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,oBAAoB;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,IAAI,IAAwB,CAAC;IAC7B,OAAO,UAAU,GAAG,EAAE,KAAK;QACzB,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,CAAC;QACzE,IAAI,IAAI,YAAY,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;aACnC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACvF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,YAAY,cAAc;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/D,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAwB,iBAAiB,CAAC"}

package/dist/responses.d.ts

@@ -88,6 +88,49 @@ export interface ErrorResponseOptions<Code extends string, Key extends string> {
      */
     maskDetails?: boolean;
 }
+/**
+ * What an issue MIGHT carry — every field optional, because the gate below proves only that
+ * `issues` is an array and nothing at all about an element. Typing the element as certain is
+ * what turned this projection into a throw: `path.map` on an issue that arrived without one.
+ */
+interface RawIssue {
+    readonly path?: unknown;
+    readonly code?: unknown;
+    readonly maximum?: unknown;
+    readonly minimum?: unknown;
+}
+/** One rejected field: enough to fix the call, and nothing about the schema. */
+export interface ValidationIssue {
+    /** The field that failed, as the caller spelled it. */
+    path: (string | number)[];
+    /** The rule that rejected it, such as `too_big`. */
+    code: string;
+    /** The numeric bound, when the rule has one. */
+    maximum?: number;
+    minimum?: number;
+}
+/**
+ * The field path, the rule it failed, and — for a range — the BOUND it failed against.
+ *
+ * Never the rejected value, and never the schema's internals. All six donors carry a version of
+ * that comment; what none of them carries is the proof, so here it is: handing the validator's
+ * issues straight to the client ships back the caller's own key names (`keys`), the enum's
+ * allowed values (`values`), the validator's English sentence and the expected type
+ * (`origin`) — four disclosures from one convenience, and two repos in the fleet do it today.
+ * An audit note written against an older validator looks for `received`, which the current one
+ * no longer emits; the projection is an allow-list precisely so a rename cannot reopen this.
+ *
+ * The bound is the exception, and it belongs to the caller: it is the published contract, and
+ * a `too_big` without it costs somebody a bisect to rediscover a number our own docs state.
+ *
+ * Total on purpose: this runs inside the function that turns a thrown thing into an answer, and
+ * it is advertised to the queue and tool doors, where an issue list has crossed a serialization
+ * hop. An allow-list that throws on a malformed issue sends its caller back to shipping the
+ * validator's issues raw, which is the disclosure it exists to prevent.
+ */
+export declare function validationIssues(error: {
+    readonly issues: readonly RawIssue[];
+}): ValidationIssue[];
 /**
  * Binds the mask policy and the two canned bodies, and returns the function that answers.
  *
@@ -104,4 +147,5 @@ export interface ErrorResponseOptions<Code extends string, Key extends string> {
  * ```
  */
 export declare function createErrorResponse<Code extends string = string, Key extends string = string>(opts: ErrorResponseOptions<Code, Key>): (err: unknown) => ErrorAnswer<Code>;
+export {};
 //# sourceMappingURL=responses.d.ts.map

package/dist/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E,4FAA4F;AAC5F,wBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;;;EAG1D;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;;;EAGjC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;;;EAM5E;AAED,wBAAgB,SAAS;;;EAExB;AAED,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAClE,IAAI,EAAE,IAAI,CAAC;IACX,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAC3E,sDAAsD;IACtD,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,oCAAoC;IACpC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA+GD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3F,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,IAIP,KAAK,OAAO,KAAG,WAAW,CAAC,IAAI,CAAC,CA8C/D"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E,4FAA4F;AAC5F,wBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;;;EAG1D;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;;;EAGjC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;;;EAM5E;AAED,wBAAgB,SAAS;;;EAExB;AAED,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAClE,IAAI,EAAE,IAAI,CAAC;IACX,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAC3E,sDAAsD;IACtD,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,oCAAoC;IACpC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAuDD;;;;GAIG;AACH,UAAU,QAAQ;IAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC,GAAG,eAAe,EAAE,CAUpB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3F,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,IAIP,KAAK,OAAO,KAAG,WAAW,CAAC,IAAI,CAAC,CA8C/D"}

package/dist/responses.js

@@ -87,6 +87,18 @@ function zodIssues(err) {
         return null;
     return issues;
 }
+/**
+ * One path segment, as something that survives `JSON.stringify`.
+ *
+ * A symbol keyed a field the caller cannot name back at us, so its description is the only
+ * useful thing in it — and an unnamed symbol has none, which is an empty segment rather than
+ * the `null` that `JSON.stringify` would otherwise write.
+ */
+function pathSegment(segment) {
+    if (typeof segment === "symbol")
+        return segment.description ?? "";
+    return typeof segment === "number" ? segment : String(segment);
+}
 /**
  * The field path, the rule it failed, and — for a range — the BOUND it failed against.
  *
@@ -100,14 +112,22 @@ function zodIssues(err) {
  *
  * The bound is the exception, and it belongs to the caller: it is the published contract, and
  * a `too_big` without it costs somebody a bisect to rediscover a number our own docs state.
+ *
+ * Total on purpose: this runs inside the function that turns a thrown thing into an answer, and
+ * it is advertised to the queue and tool doors, where an issue list has crossed a serialization
+ * hop. An allow-list that throws on a malformed issue sends its caller back to shipping the
+ * validator's issues raw, which is the disclosure it exists to prevent.
  */
-function safeIssues(issues) {
-    return issues.map((issue) => ({
-        path: issue.path,
-        code: issue.code,
-        ...(typeof issue.maximum === "number" && { maximum: issue.maximum }),
-        ...(typeof issue.minimum === "number" && { minimum: issue.minimum }),
-    }));
+export function validationIssues(error) {
+    return error.issues.map((issue) => {
+        const { path, code, maximum, minimum } = issue ?? {};
+        return {
+            path: Array.isArray(path) ? path.map(pathSegment) : [],
+            code: typeof code === "string" ? code : "",
+            ...(typeof maximum === "number" && { maximum }),
+            ...(typeof minimum === "number" && { minimum }),
+        };
+    });
 }
 /**
  * `AppError` is generic over the product's own code union, and no runtime check can verify
@@ -140,7 +160,7 @@ export function createErrorResponse(opts) {
         if (issues !== null) {
             return {
                 status: 400,
-                body: envelope(opts.validation, safeIssues(issues)),
+                body: envelope(opts.validation, validationIssues({ issues })),
                 headers: {},
                 kind: "client",
             };

package/dist/responses.js.map

@@ -1 +1 @@
-{"version":3,"file":"responses.js","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,4FAA4F;AAC5F,MAAM,UAAU,EAAE,CAAwB,IAAO,EAAE,IAAQ;IACzD,MAAM,IAAI,GAAqB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO,CAAI,IAAO;IAChC,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,IAAS,EAAE,IAAqC;IAC3E,MAAM,IAAI,GAAoB;QAC5B,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE;KACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AA4DD;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAa;IACrC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACzD,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAsB,GAAmB;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACvD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,MAA8B,EAC9B,OAAiB;IAEjB,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AASD;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAA2C,CAAC;IACrE,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CAAC,MAAkB;IACpC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACpE,GAAG,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;KACrE,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAsB,GAAY;IACnD,OAAO,GAAG,YAAY,QAAQ,CAAC;AACjC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqC;IAErC,MAAM,WAAW,GAAsB,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC;IAE1E,OAAO,SAAS,aAAa,CAAC,GAAY;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;gBACnD,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,QAAQ;aACf,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAO,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,uFAAuF;YACvF,uFAAuF;YACvF,iFAAiF;YACjF,wEAAwE;YACxE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtD,CAAC;YACD,0FAA0F;YAC1F,0EAA0E;YAC1E,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;YAEnE,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBACtB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAEtF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtF,IAAI,IAAI,EAAE,CAAC;gBACT,oFAAoF;gBACpF,sFAAsF;gBACtF,kFAAkF;gBAClF,mFAAmF;gBACnF,iBAAiB;gBACjB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnE,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,+DAA+D;QAC/D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACzF,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,4FAA4F;AAC5F,MAAM,UAAU,EAAE,CAAwB,IAAO,EAAE,IAAQ;IACzD,MAAM,IAAI,GAAqB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9E,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,OAAO,CAAI,IAAO;IAChC,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAI,IAAS,EAAE,IAAqC;IAC3E,MAAM,IAAI,GAAoB;QAC5B,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE;KACnE,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,EAAE,MAAM,EAAE,GAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAC9C,CAAC;AA4DD;;;;;;;;;GASG;AACH,SAAS,gBAAgB,CAAC,GAAa;IACrC,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACzD,MAAM,OAAO,GACX,GAAG,CAAC,OAAO,KAAK,SAAS;QACzB,CAAC,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,OAAO;QAAE,OAAO,GAAG,CAAC,OAAO,CAAC;IACjC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAsB,GAAmB;IAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;YACnE,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YACvD,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,MAA8B,EAC9B,OAAiB;IAEjB,OAAO;QACL,KAAK,EAAE;YACL,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;YACzE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC;SAC1C;KACF,CAAC;AACJ,CAAC;AAyBD;;;;;;;GAOG;AACH,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,GAA2C,CAAC;IACrE,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/D,OAAO,MAAoB,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAAgB;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAClE,OAAO,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAEhC;IACC,OAAO,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAmB,EAAE;QACjD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE;YACtD,IAAI,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC1C,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/C,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,CAAC;SAChD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAsB,GAAY;IACnD,OAAO,GAAG,YAAY,QAAQ,CAAC;AACjC,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAqC;IAErC,MAAM,WAAW,GAAsB,IAAI,CAAC,WAAW,IAAI,cAAc,CAAC;IAE1E,OAAO,SAAS,aAAa,CAAC,GAAY;QACxC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;gBAC7D,OAAO,EAAE,EAAE;gBACX,IAAI,EAAE,QAAQ;aACf,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,CAAO,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,uFAAuF;YACvF,uFAAuF;YACvF,iFAAiF;YACjF,wEAAwE;YACxE,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,EAAE,CAAC;gBAC3C,OAAO,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACtD,CAAC;YACD,0FAA0F;YAC1F,0EAA0E;YAC1E,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG;gBAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,QAAQ,CAAC;YAEnE,IAAI,GAAG,CAAC,UAAU,GAAG,GAAG;gBACtB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,YAAY,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAEtF,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACtF,IAAI,IAAI,EAAE,CAAC;gBACT,oFAAoF;gBACpF,sFAAsF;gBACtF,kFAAkF;gBAClF,mFAAmF;gBACnF,iBAAiB;gBACjB,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACnE,CAAC;QAED,yFAAyF;QACzF,0FAA0F;QAC1F,+DAA+D;QAC/D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IACzF,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gusnips/server",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "The layer under a TypeScript backend: one error shape, one response envelope, one retry rule, one logger.",
   "type": "module",
   "license": "MIT",

package/src/hono/request-logger.test.ts

@@ -7,20 +7,92 @@ import {
   type RequestVariables,
 } from "./request-logger.ts";
 
-function setup(options: Omit<RequestLoggerOptions, "logger"> = {}) {
+function setup<E extends { Variables: RequestVariables } = { Variables: RequestVariables }>(
+  options: Omit<RequestLoggerOptions<E>, "logger"> = {},
+) {
   const lines: Array<Record<string, unknown>> = [];
   const logger = createLogger({
     level: "debug",
     write: (line) => lines.push(JSON.parse(line) as Record<string, unknown>),
   });
-  const app = new Hono<{ Variables: RequestVariables }>();
-  app.use(requestLogger({ logger, ...options }));
+  const app = new Hono<E>();
+  app.use(requestLogger<E>({ logger, ...options }));
   return { app, lines };
 }
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 
+type AppEnv = {
+  Variables: RequestVariables<"DENIED"> & { actorId: string };
+};
+
 describe("the request line", () => {
+  it("adds typed adopter fields after the response exists", async () => {
+    const { app, lines } = setup<AppEnv>({
+      fields: (c) => ({ actorId: c.get("actorId"), responseStatus: c.res.status }),
+    });
+    app.post("/items", (c) => {
+      c.set("actorId", "user_1");
+      return c.text("created", 201);
+    });
+
+    await app.request("/items", { method: "POST" });
+
+    expect(lines[0]).toMatchObject({ actorId: "user_1", responseStatus: 201 });
+  });
+
+  it("keeps every canonical request field when adopter fields use the same names", async () => {
+    const { app, lines } = setup<AppEnv>({
+      fields: () => ({
+        actorId: "user_1",
+        requestId: "wrong",
+        method: "DELETE",
+        route: "/wrong",
+        status: 599,
+        ms: -1,
+        errorCode: "WRONG",
+      }),
+    });
+    app.post("/items/:id", (c) => {
+      c.set("errorCode", "DENIED");
+      return c.text("no", 403);
+    });
+
+    await app.request("/items/secret", {
+      method: "POST",
+      headers: { "X-Request-ID": "trace_1" },
+    });
+
+    expect(lines[0]).toMatchObject({
+      actorId: "user_1",
+      requestId: "trace_1",
+      method: "POST",
+      route: "/items/:id",
+      status: 403,
+      errorCode: "DENIED",
+    });
+    expect(lines[0]!.ms).not.toBe(-1);
+  });
+
+  it("does not let a broken adopter field hook lose the response or its request line", async () => {
+    const { app, lines } = setup<AppEnv>({
+      fields: () => {
+        throw new Error("field hook broke");
+      },
+    });
+    app.get("/items", (c) => c.text("ok"));
+
+    const response = await app.request("/items");
+
+    expect(response.status).toBe(200);
+    expect(lines[0]).toMatchObject({
+      requestFieldsFailed: true,
+      method: "GET",
+      route: "/items",
+      status: 200,
+    });
+  });
+
   it("names the route template, never the path", async () => {
     // A path carries whatever the caller put in it. In one backend that was a customer's national
     // id number, and the request line carried it into the log and on into an analytics event.

package/src/hono/request-logger.ts

@@ -1,4 +1,4 @@
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 import { routePath } from "hono/route";
 import type { Logger } from "../logger/index.ts";
 
@@ -9,8 +9,20 @@ export interface RequestVariables<Code extends string = string> {
   errorCode: Code | null;
 }
 
-export interface RequestLoggerOptions {
+type RequestLoggerEnv = { Variables: RequestVariables };
+
+export interface RequestLoggerOptions<E extends RequestLoggerEnv = RequestLoggerEnv> {
   logger: Logger;
+  /**
+   * Sanitized product fields to add to the request line. Runs after the response exists, so it can
+   * read downstream variables and `c.res`. Keep caller-controlled values bounded; never return a
+   * raw path, query, header set, body or authentication object.
+   *
+   * Return plain data, not live objects: a throw from this hook is caught, but a value whose own
+   * `toJSON` throws is caught by the logger instead, which costs the whole line rather than the
+   * field.
+   */
+  fields?: (c: Context<E>) => Record<string, unknown>;
   /**
    * Paths answered but never logged, each with everything under it: `/health` covers
    * `/health/db` and not `/healthz`. Defaults to `["/health"]`. A throw is logged anyway.
@@ -25,6 +37,20 @@ export interface RequestLoggerOptions {
  */
 const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
 
+function collectFields<E extends RequestLoggerEnv>(
+  fields: RequestLoggerOptions<E>["fields"],
+  c: Context<E>,
+): Record<string, unknown> {
+  if (fields === undefined) return {};
+  try {
+    // Materialize here too: a throwing getter is just as capable of losing the request line as a
+    // throwing callback. Logging metadata must never change the response it describes.
+    return { ...fields(c) };
+  } catch {
+    return { requestFieldsFailed: true };
+  }
+}
+
 /**
  * One line per request, and the request id.
  *
@@ -36,10 +62,11 @@ const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
  * answer including `onError`'s and `notFound`'s. Cross-origin, list that header in your CORS
  * `exposeHeaders` or the browser hides it from the page.
  */
-export function requestLogger({
+export function requestLogger<E extends RequestLoggerEnv = RequestLoggerEnv>({
   logger,
+  fields,
   skipPaths = ["/health"],
-}: RequestLoggerOptions): MiddlewareHandler<{ Variables: RequestVariables }> {
+}: RequestLoggerOptions<E>): MiddlewareHandler<E> {
   return async (c, next) => {
     const supplied = c.req.header("X-Request-ID");
     const requestId = supplied && REQUEST_ID.test(supplied) ? supplied : crypto.randomUUID();
@@ -72,6 +99,7 @@ export function requestLogger({
     // returns a Response it built itself.
     c.header("X-Request-ID", requestId);
     const skipped = skipPaths.some((skip) => path === skip || path.startsWith(`${skip}/`));
-    if (method !== "OPTIONS" && !skipped) logger.info("request", line(c.res.status));
+    if (method !== "OPTIONS" && !skipped)
+      logger.info("request", { ...collectFields(fields, c), ...line(c.res.status) });
   };
 }

package/src/index.ts

@@ -1,6 +1,18 @@
 export { AppError, createAppError, toMessage } from "./errors.ts";
 export type { AppErrorOptions } from "./errors.ts";
-export { created, createErrorResponse, noContent, ok, paginated } from "./responses.ts";
-export type { CannedError, ErrorAnswer, ErrorResponseOptions } from "./responses.ts";
+export {
+  created,
+  createErrorResponse,
+  noContent,
+  ok,
+  paginated,
+  validationIssues,
+} from "./responses.ts";
+export type {
+  CannedError,
+  ErrorAnswer,
+  ErrorResponseOptions,
+  ValidationIssue,
+} from "./responses.ts";
 export { createLogger, errorReplacer, keptErrorFields } from "./logger/index.ts";
 export type { Logger, LoggerOptions, LogLevel, LogThreshold } from "./logger/index.ts";

package/src/logger/serialize.test.ts

@@ -221,6 +221,28 @@ describe("what an Error contributes to a log line", () => {
     expect(JSON.stringify(line)).not.toContain("4242");
   });
 
+  it("allow-lists a thrown plain object passed directly as the error", () => {
+    // Hono wraps a non-Error throw as a cause, but workers, fire-and-forget catches and a database
+    // client's `{ code, message, details }` rejection reach the logger directly. `error` is the
+    // raw-error slot the logger documents; an ordinary metadata object under another key stays
+    // ordinary metadata.
+    const rejection = {
+      message: "insert failed",
+      code: "23514",
+      detail: "Failing row contains (someone@example.com, 4242424242424242).",
+      payload: '{"customer_email":"someone@example.com"}',
+    };
+
+    const line = serialized(rejection);
+
+    expect(line).toEqual({
+      message: "insert failed",
+      code: "23514",
+      detail: "[row omitted: Postgres DETAIL for this error is the whole failing row]",
+    });
+    expect(entryFor({ context: rejection }).context).toEqual(rejection);
+  });
+
   it("survives a chain of plain-object causes that holds itself", () => {
     // The Error branch has had this guard since it was written; the narrowing builds a new object
     // and so needs its own, or a self-referencing rejection recurses until the stack ends — inside

package/src/logger/serialize.ts

@@ -91,8 +91,10 @@ function keptValue(key: string, value: unknown): unknown {
  * a PostgREST client rejects with plain objects. So in a Hono app the cause slot is precisely where
  * a vendor's rejection object ends up, and a leak there reads as if the list had run.
  *
- * `cause` means "the error this one came from", so whatever sits in it is in the error slot and
- * gets the same treatment. `name` and `message` come along because a rejection object usually
+ * A plain object passed directly as `meta.error` is the other door. Hono wraps it, but a worker,
+ * a fire-and-forget catch or a database client outside Hono does not. `error` is the raw-error slot
+ * the logger documents, so it gets the same treatment as `cause`; an ordinary metadata object under
+ * any other key stays untouched. `name` and `message` come along because a rejection object usually
  * carries them and a line with neither says nothing at all.
  *
  * Deliberate state it does NOT keep: context an app attaches on purpose. That belongs in the
@@ -139,6 +141,9 @@ function narrowCause(cause: unknown, seen: WeakSet<object>): unknown {
  *   `JSON.stringify(err)` is `{}` — which is how a logger ends up printing nothing about the
  *   failure it was called to report. They are added explicitly, and the allow-listed extras ride
  *   along beside them.
+ * - A plain object in the root `error` slot is narrowed through the same allow-list. Hono's
+ *   boundary turns one into an Error cause, but workers and swallowed catches log it directly.
+ *   Other metadata objects stay untouched.
  * - A nested `cause` is followed, and so is an `AggregateError`'s `errors`. Both are
  *   non-enumerable, so both are invisible to the loop above; without this line "all attempts
  *   failed" is the whole log entry. Each one goes back through this replacer, so the allow-list
@@ -170,12 +175,17 @@ function narrowCause(cause: unknown, seen: WeakSet<object>): unknown {
  */
 export function errorReplacer(): (this: unknown, key: string, value: unknown) => unknown {
   const seen = new WeakSet<object>();
+  let root: object | undefined;
   return function (key, value) {
     const held =
       typeof this === "object" && this !== null
         ? (this as Record<string, unknown>)[key]
         : undefined;
+    if (key === "" && typeof held === "object" && held !== null) root = held;
     if (held instanceof Error) value = held;
+    else if (this === root && key === "error" && typeof held === "object" && held !== null) {
+      return seen.has(held) ? "[Circular]" : narrow(held, seen);
+    }
     if (typeof value === "bigint") return value.toString();
     if (value instanceof Error) {
       if (seen.has(value)) return "[Circular]";

package/src/responses.test.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { z } from "zod";
+import { type ValidationIssue, validationIssues } from "./index.ts";
 import { AppError, createAppError } from "./errors.ts";
 import { created, createErrorResponse, noContent, ok, paginated } from "./responses.ts";
 
@@ -110,6 +111,43 @@ describe("a validation failure is a 400 that reflects nothing back", () => {
     .object({ days: z.enum(["7", "30"]), timeoutMs: z.number().max(30_000) })
     .strict();
 
+  it("exports the safe issue projection for every door that validates input", () => {
+    const validationError = {
+      issues: [
+        {
+          path: ["items", 0, Symbol("field"), Symbol()],
+          code: "too_big",
+          maximum: 10,
+          minimum: 1,
+          received: "secret",
+          values: ["private", "schema"],
+          message: "Expected a private schema value",
+        },
+        { path: ["amount"], code: "too_big", maximum: 10n, minimum: "1" },
+      ],
+    } as const;
+    const projected: ValidationIssue[] = validationIssues(validationError);
+
+    expect(projected).toEqual([
+      { path: ["items", 0, "field", ""], code: "too_big", maximum: 10, minimum: 1 },
+      { path: ["amount"], code: "too_big" },
+    ]);
+    expect(() => JSON.stringify(projected)).not.toThrow();
+    expect(JSON.stringify(projected)).not.toContain("secret");
+    expect(JSON.stringify(projected)).not.toContain("private");
+  });
+
+  it("answers rather than throws when an issue arrives without a usable path", () => {
+    // The gate admits anything named ZodError with an array of issues, so an element that lost a
+    // field crossing a queue or a tool boundary reaches the projection. Throwing here throws
+    // inside the function whose whole job is to turn a thrown thing into an answer.
+    for (const issue of [{ code: "custom" }, null, { path: "amount", code: "too_big" }]) {
+      const answer = errorResponse({ name: "ZodError", issues: [issue] });
+      expect(answer.status).toBe(400);
+      expect(answer.body.error.details).toEqual([{ path: [], code: issue?.code ?? "" }]);
+    }
+  });
+
   it("answers 400 with the path and the rule", () => {
     const parsed = schema.safeParse({ days: "90", timeoutMs: 1 });
     const answer = errorResponse(parsed.error);

package/src/responses.ts

@@ -152,11 +152,27 @@ function envelope<Code extends string, Key extends string>(
   };
 }
 
+/**
+ * What an issue MIGHT carry — every field optional, because the gate below proves only that
+ * `issues` is an array and nothing at all about an element. Typing the element as certain is
+ * what turned this projection into a throw: `path.map` on an issue that arrived without one.
+ */
 interface RawIssue {
-  path?: unknown;
-  code?: unknown;
-  maximum?: unknown;
-  minimum?: unknown;
+  readonly path?: unknown;
+  readonly code?: unknown;
+  readonly maximum?: unknown;
+  readonly minimum?: unknown;
+}
+
+/** One rejected field: enough to fix the call, and nothing about the schema. */
+export interface ValidationIssue {
+  /** The field that failed, as the caller spelled it. */
+  path: (string | number)[];
+  /** The rule that rejected it, such as `too_big`. */
+  code: string;
+  /** The numeric bound, when the rule has one. */
+  maximum?: number;
+  minimum?: number;
 }
 
 /**
@@ -174,6 +190,18 @@ function zodIssues(err: unknown): RawIssue[] | null {
   return issues as RawIssue[];
 }
 
+/**
+ * One path segment, as something that survives `JSON.stringify`.
+ *
+ * A symbol keyed a field the caller cannot name back at us, so its description is the only
+ * useful thing in it — and an unnamed symbol has none, which is an empty segment rather than
+ * the `null` that `JSON.stringify` would otherwise write.
+ */
+function pathSegment(segment: unknown): string | number {
+  if (typeof segment === "symbol") return segment.description ?? "";
+  return typeof segment === "number" ? segment : String(segment);
+}
+
 /**
  * The field path, the rule it failed, and — for a range — the BOUND it failed against.
  *
@@ -187,14 +215,24 @@ function zodIssues(err: unknown): RawIssue[] | null {
  *
  * The bound is the exception, and it belongs to the caller: it is the published contract, and
  * a `too_big` without it costs somebody a bisect to rediscover a number our own docs state.
+ *
+ * Total on purpose: this runs inside the function that turns a thrown thing into an answer, and
+ * it is advertised to the queue and tool doors, where an issue list has crossed a serialization
+ * hop. An allow-list that throws on a malformed issue sends its caller back to shipping the
+ * validator's issues raw, which is the disclosure it exists to prevent.
  */
-function safeIssues(issues: RawIssue[]): unknown[] {
-  return issues.map((issue) => ({
-    path: issue.path,
-    code: issue.code,
-    ...(typeof issue.maximum === "number" && { maximum: issue.maximum }),
-    ...(typeof issue.minimum === "number" && { minimum: issue.minimum }),
-  }));
+export function validationIssues(error: {
+  readonly issues: readonly RawIssue[];
+}): ValidationIssue[] {
+  return error.issues.map((issue): ValidationIssue => {
+    const { path, code, maximum, minimum } = issue ?? {};
+    return {
+      path: Array.isArray(path) ? path.map(pathSegment) : [],
+      code: typeof code === "string" ? code : "",
+      ...(typeof maximum === "number" && { maximum }),
+      ...(typeof minimum === "number" && { minimum }),
+    };
+  });
 }
 
 /**
@@ -233,7 +271,7 @@ export function createErrorResponse<Code extends string = string, Key extends st
     if (issues !== null) {
       return {
         status: 400,
-        body: envelope(opts.validation, safeIssues(issues)),
+        body: envelope(opts.validation, validationIssues({ issues })),
         headers: {},
         kind: "client",
       };