@gusnips/server 0.1.0 → 0.2.0

package/README.md

@@ -42,6 +42,18 @@ paginated(rows, { total: 128, limit: 20, offset: 100 });
 `hasMore` is computed from the rows you actually returned, not from `limit`, so a page cut short
 by a filter still answers honestly.
 
+**What comes back is an answer, not a body.** A framework wants the `body`:
+
+```ts
+return c.json(ok(data), 200); // WRONG: {"status":200,"body":{"data":…}}
+return c.json(ok(data).body, 200); // the envelope
+```
+
+Nothing catches the first line. `c.json` takes any JSON value, so the types hold; the status is
+still 200, so a health probe and a deploy gate both pass; and a test that calls `ok` never sees
+the body its caller sends. That shipped, and a client found it fifty minutes later. On Hono,
+import the four adapters from `@gusnips/server/hono` and the question does not arise.
+
 ## Refusing a request
 
 Declare your own codes and what status each one answers with. The `satisfies` is the line that
@@ -181,7 +193,9 @@ contract, and a "too big" without it costs somebody a bisect to rediscover a num
 already state.
 
 Validation is recognized by shape, not by an import, so your validator does not become this
-package's dependency. Measured against zod 3.25, 4.4 and 4.5.
+package's dependency. Measured against zod 3.25, 4.4 and 4.5. A tool or queue consumer can use
+`validationIssues(error)` from the root package to apply the same allow-list without building an
+HTTP answer.
 
 **A 5xx keeps its message unless its code is masked.** By default only `INTERNAL_ERROR` is,
 because that is the code you raise when something unexpected broke, so its message may carry
@@ -254,6 +268,19 @@ app.onError(errorHandler({ errorResponse, logger }));
 app.notFound(notFoundHandler(errorResponse(errors.notFound("Route"))));
 ```
 
+```ts
+import { created, noContent, ok, paginated } from "@gusnips/server/hono";
+
+app.get("/users/:id", (c) => ok(c, user)); // { data: user }, 200
+app.post("/users", (c) => created(c, user)); // 201
+app.get("/users", (c) => paginated(c, rows, { total, limit, offset }));
+app.delete("/users/:id", (c) => noContent(c)); // 204, no body, no content-type
+```
+
+Three adopters wrote those four functions by hand before they were here, and one of the three
+got the unwrap wrong in production. `ok` takes an explicit status for the cases that are not
+200 — `ok(c, job, 202)` where the route accepted rather than answered.
+
 **`errorBoundary` is not optional.** Hono hands `onError` only what is `instanceof Error`.
 Anything else is rethrown past every layer and escapes as an unhandled rejection: no answer, a
 dropped connection, and a browser that reports it as a CORS failure — which sends whoever reads
@@ -264,6 +291,14 @@ hypothetical. The boundary wraps one in an `Error` and keeps the original as `ca
 document number in a log and in whatever reads that log afterwards. `/health` is skipped with
 everything under it, because every deploy polls it in a loop; a throw is logged anyway.
 
+Add safe product metadata with `requestLogger<AppEnv>({ logger, fields: (c) => ({ … }) })`.
+`fields` runs after the response exists, so it can read values a handler set and `c.res`; return only
+bounded, sanitized values, never a raw path, query, header set, body or authentication object. Your
+fields are written first, so they cannot replace the canonical request id, method, route, status,
+duration or error code. A hook that throws is caught: the line is written with
+`requestFieldsFailed: true` instead of your fields. A value whose own `toJSON` throws is not — that
+one loses the whole line, request id included — so return plain data, not live objects.
+
 The request id goes back on `X-Request-ID`, on every answer including `onError`'s and
 `notFound`'s. A caller's own id is echoed only if it is 64 characters of `A-Z a-z 0-9 . _ -`,
 so the id in a line is always either the caller's or ours. Cross-origin, list that header in your

package/dist/hono/index.d.ts

@@ -6,6 +6,11 @@
  *     app.onError(errorHandler({ errorResponse, logger }));
  *     app.notFound(notFoundHandler(errorResponse(errors.notFound("Route"))));
  *
+ * `ok`, `created`, `paginated` and `noContent` are the success half: they take the `Context` and
+ * put the envelope on the wire, so no route has to unwrap the `{ status, body }` answer that the
+ * framework-free builders return. Three adopters wrote them by hand and one got that unwrap wrong
+ * in production — see `responses.ts` beside this file.
+ *
  * and, in a test of the real app, `assertEveryRouteGuarded(app, { isPublic })`, with the rule the
  * app itself uses for what anyone may call.
  */
@@ -13,6 +18,7 @@ export { errorBoundary, errorHandler, notFoundHandler } from "./errors.ts";
 export type { ErrorHandlerOptions } from "./errors.ts";
 export { assertEveryRouteGuarded, guard, underAny } from "./guards.ts";
 export type { GuardCheckOptions } from "./guards.ts";
+export { created, noContent, ok, paginated } from "./responses.ts";
 export { requestLogger } from "./request-logger.ts";
 export type { RequestLoggerOptions, RequestVariables } from "./request-logger.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/hono/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvE,YAAY,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/hono/index.js

@@ -6,10 +6,16 @@
  *     app.onError(errorHandler({ errorResponse, logger }));
  *     app.notFound(notFoundHandler(errorResponse(errors.notFound("Route"))));
  *
+ * `ok`, `created`, `paginated` and `noContent` are the success half: they take the `Context` and
+ * put the envelope on the wire, so no route has to unwrap the `{ status, body }` answer that the
+ * framework-free builders return. Three adopters wrote them by hand and one got that unwrap wrong
+ * in production — see `responses.ts` beside this file.
+ *
  * and, in a test of the real app, `assertEveryRouteGuarded(app, { isPublic })`, with the rule the
  * app itself uses for what anyone may call.
  */
 export { errorBoundary, errorHandler, notFoundHandler } from "./errors.js";
 export { assertEveryRouteGuarded, guard, underAny } from "./guards.js";
+export { created, noContent, ok, paginated } from "./responses.js";
 export { requestLogger } from "./request-logger.js";
 //# sourceMappingURL=index.js.map

package/dist/hono/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/hono/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/hono/request-logger.d.ts

@@ -1,4 +1,4 @@
-import type { MiddlewareHandler } from "hono";
+import type { Context, MiddlewareHandler } from "hono";
 import type { Logger } from "../logger/index.ts";
 /** The two variables this adapter writes. Put them in your app's `Variables`. */
 export interface RequestVariables<Code extends string = string> {
@@ -6,8 +6,21 @@ export interface RequestVariables<Code extends string = string> {
     /** The code of the refusal this request got, for the request line. `null` until one happens. */
     errorCode: Code | null;
 }
-export interface RequestLoggerOptions {
+type RequestLoggerEnv = {
+    Variables: RequestVariables;
+};
+export interface RequestLoggerOptions<E extends RequestLoggerEnv = RequestLoggerEnv> {
     logger: Logger;
+    /**
+     * Sanitized product fields to add to the request line. Runs after the response exists, so it can
+     * read downstream variables and `c.res`. Keep caller-controlled values bounded; never return a
+     * raw path, query, header set, body or authentication object.
+     *
+     * Return plain data, not live objects: a throw from this hook is caught, but a value whose own
+     * `toJSON` throws is caught by the logger instead, which costs the whole line rather than the
+     * field.
+     */
+    fields?: (c: Context<E>) => Record<string, unknown>;
     /**
      * Paths answered but never logged, each with everything under it: `/health` covers
      * `/health/db` and not `/healthz`. Defaults to `["/health"]`. A throw is logged anyway.
@@ -25,7 +38,6 @@ export interface RequestLoggerOptions {
  * answer including `onError`'s and `notFound`'s. Cross-origin, list that header in your CORS
  * `exposeHeaders` or the browser hides it from the page.
  */
-export declare function requestLogger({ logger, skipPaths, }: RequestLoggerOptions): MiddlewareHandler<{
-    Variables: RequestVariables;
-}>;
+export declare function requestLogger<E extends RequestLoggerEnv = RequestLoggerEnv>({ logger, fields, skipPaths, }: RequestLoggerOptions<E>): MiddlewareHandler<E>;
+export {};
 //# sourceMappingURL=request-logger.d.ts.map

package/dist/hono/request-logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-logger.d.ts","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAE9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,EAC5B,MAAM,EACN,SAAuB,GACxB,EAAE,oBAAoB,GAAG,iBAAiB,CAAC;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAmC3E"}
+{"version":3,"file":"request-logger.d.ts","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,iFAAiF;AACjF,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;CACxB;AAED,KAAK,gBAAgB,GAAG;IAAE,SAAS,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAExD,MAAM,WAAW,oBAAoB,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB;IACjF,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,MAAM,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD;;;OAGG;IACH,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B;AAuBD;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,gBAAgB,GAAG,gBAAgB,EAAE,EAC3E,MAAM,EACN,MAAM,EACN,SAAuB,GACxB,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAoChD"}

package/dist/hono/request-logger.js

@@ -5,6 +5,18 @@ import { routePath } from "hono/route";
  * trimmed, so the id in the log is always either the caller's or ours.
  */
 const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
+function collectFields(fields, c) {
+    if (fields === undefined)
+        return {};
+    try {
+        // Materialize here too: a throwing getter is just as capable of losing the request line as a
+        // throwing callback. Logging metadata must never change the response it describes.
+        return { ...fields(c) };
+    }
+    catch {
+        return { requestFieldsFailed: true };
+    }
+}
 /**
  * One line per request, and the request id.
  *
@@ -16,7 +28,7 @@ const REQUEST_ID = /^[A-Za-z0-9._-]{1,64}$/;
  * answer including `onError`'s and `notFound`'s. Cross-origin, list that header in your CORS
  * `exposeHeaders` or the browser hides it from the page.
  */
-export function requestLogger({ logger, skipPaths = ["/health"], }) {
+export function requestLogger({ logger, fields, skipPaths = ["/health"], }) {
     return async (c, next) => {
         const supplied = c.req.header("X-Request-ID");
         const requestId = supplied && REQUEST_ID.test(supplied) ? supplied : crypto.randomUUID();
@@ -51,7 +63,7 @@ export function requestLogger({ logger, skipPaths = ["/health"], }) {
         c.header("X-Request-ID", requestId);
         const skipped = skipPaths.some((skip) => path === skip || path.startsWith(`${skip}/`));
         if (method !== "OPTIONS" && !skipped)
-            logger.info("request", line(c.res.status));
+            logger.info("request", { ...collectFields(fields, c), ...line(c.res.status) });
     };
 }
 //# sourceMappingURL=request-logger.js.map

package/dist/hono/request-logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-logger.js","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAmBvC;;;;GAIG;AACH,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,EAC5B,MAAM,EACN,SAAS,GAAG,CAAC,SAAS,CAAC,GACF;IACrB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACzF,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,+FAA+F;QAC/F,0FAA0F;QAC1F,4FAA4F;QAC5F,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS;YACT,MAAM;YACN,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,MAAM;YACN,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,0FAA0F;YAC1F,oFAAoF;YACpF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8FAA8F;QAC9F,sCAAsC;QACtC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-logger.js","sourceRoot":"","sources":["../../src/hono/request-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AA+BvC;;;;GAIG;AACH,MAAM,UAAU,GAAG,wBAAwB,CAAC;AAE5C,SAAS,aAAa,CACpB,MAAyC,EACzC,CAAa;IAEb,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,6FAA6F;QAC7F,mFAAmF;QACnF,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAgD,EAC3E,MAAM,EACN,MAAM,EACN,SAAS,GAAG,CAAC,SAAS,CAAC,GACC;IACxB,OAAO,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACzF,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QAC9B,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACzB,+FAA+F;QAC/F,0FAA0F;QAC1F,4FAA4F;QAC5F,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAAC,CAAC;YAChC,SAAS;YACT,MAAM;YACN,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACvB,MAAM;YACN,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YACtB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,SAAS;SAC3C,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4FAA4F;YAC5F,0FAA0F;YAC1F,oFAAoF;YACpF,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YACtD,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,8FAA8F;QAC9F,sCAAsC;QACtC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC;QACvF,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,OAAO;YAClC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC"}

package/dist/hono/responses.d.ts

@@ -0,0 +1,43 @@
+/**
+ * The success half of the Hono edge: four adapters that put the envelope on the wire.
+ *
+ * They exist because the builders in `../responses.ts` return an ANSWER — `{ status, body }` —
+ * and every Hono adopter therefore has to unwrap one before `c.json` sees it. Three of three
+ * wrote these same four functions by hand, and one of the three wrote `c.json(ok(data))` instead
+ * of `c.json(ok(data).body)`: every 200 from a live API answered
+ * `{"status":200,"body":{"data":…}}` for fifty minutes. Nothing caught it. `c.json` takes any
+ * JSON value, so the types were satisfied; the status was still 200, so every probe and every
+ * deploy gate was satisfied; and a test that calls the module never sees the body its caller
+ * sends. A client found it, because a client is the only reader that parses the envelope.
+ *
+ * A doc comment would have been read by whoever was already careful. These make the wrong line
+ * unreachable, which is the only fix available to a package that owns both sides of the seam.
+ */
+import type { PaginationMeta } from "@gusnips/http";
+import type { Context } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+/** `return ok(c, user)` — or `ok(c, job, 202)` where the route accepted rather than answered. */
+export declare function ok<T>(c: Context, data: T, status?: ContentfulStatusCode): Response & import("hono").TypedResponse<PaginationMeta | T | undefined extends bigint | readonly bigint[] ? never : { [K in keyof {
+    data: T;
+    meta?: PaginationMeta | undefined;
+} as (import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] extends infer T_1 ? T_1 extends import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] ? T_1 extends import("hono/utils/types").InvalidJSONValue ? true : false : never : never) extends true ? never : K]: boolean extends (import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] extends infer T_2 ? T_2 extends import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] ? T_2 extends import("hono/utils/types").InvalidJSONValue ? true : false : never : never) ? import("hono/utils/types").JSONParsed<import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K], bigint | readonly bigint[]> | undefined : import("hono/utils/types").JSONParsed<import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K], bigint | readonly bigint[]>; }, 429 | 500 | 200 | 201 | 400 | 401 | 100 | 102 | 103 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 431 | 451 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 | -1, "json">;
+export declare function created<T>(c: Context, data: T): Response & import("hono").TypedResponse<PaginationMeta | T | undefined extends bigint | readonly bigint[] ? never : { [K in keyof {
+    data: T;
+    meta?: PaginationMeta | undefined;
+} as (import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] extends infer T_1 ? T_1 extends import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] ? T_1 extends import("hono/utils/types").InvalidJSONValue ? true : false : never : never) extends true ? never : K]: boolean extends (import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] extends infer T_2 ? T_2 extends import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K] ? T_2 extends import("hono/utils/types").InvalidJSONValue ? true : false : never : never) ? import("hono/utils/types").JSONParsed<import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K], bigint | readonly bigint[]> | undefined : import("hono/utils/types").JSONParsed<import("@gusnips/http").ApiSuccess<T, PaginationMeta>[K], bigint | readonly bigint[]>; }, 429 | 500 | 200 | 201 | 400 | 401 | 100 | 102 | 103 | 202 | 203 | 206 | 207 | 208 | 226 | 300 | 301 | 302 | 303 | 305 | 306 | 307 | 308 | 402 | 403 | 404 | 405 | 406 | 407 | 408 | 409 | 410 | 411 | 412 | 413 | 414 | 415 | 416 | 417 | 418 | 421 | 422 | 423 | 424 | 425 | 426 | 428 | 431 | 451 | 501 | 502 | 503 | 504 | 505 | 506 | 507 | 508 | 510 | 511 | -1, "json">;
+/** `hasMore` is computed from the rows actually returned — see `paginated` in `../responses.ts`. */
+export declare function paginated<T>(c: Context, rows: T[], meta: Omit<PaginationMeta, "hasMore">): Response & import("hono").TypedResponse<{
+    data: import("hono/utils/types").JSONParsed<T extends import("hono/utils/types").InvalidJSONValue ? null : T, bigint | readonly bigint[]>[];
+    meta?: {
+        total: number;
+        limit: number;
+        offset: number;
+        hasMore: boolean;
+    } | undefined;
+}, 200, "json">;
+/**
+ * `c.body(null, 204)`, not `c.json`: a 204 carries no body, and `c.json(null, 204)` writes the
+ * four bytes `null` and a `content-type` header under a status that promises neither.
+ */
+export declare function noContent(c: Context): Response & import("hono").TypedResponse<null, 204, "body">;
+//# sourceMappingURL=responses.d.ts.map

package/dist/hono/responses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../../src/hono/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,iGAAiG;AACjG,wBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,GAAE,oBAA0B;;;ooCAE5E;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;;ooCAE7C;AAED,oGAAoG;AACpG,wBAAgB,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;;;;;;;;gBAExF;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,8DAEnC"}

package/dist/hono/responses.js

@@ -0,0 +1,20 @@
+import { ok as okBody, paginated as paginatedBody } from "../responses.js";
+/** `return ok(c, user)` — or `ok(c, job, 202)` where the route accepted rather than answered. */
+export function ok(c, data, status = 200) {
+    return c.json(okBody(data).body, status);
+}
+export function created(c, data) {
+    return ok(c, data, 201);
+}
+/** `hasMore` is computed from the rows actually returned — see `paginated` in `../responses.ts`. */
+export function paginated(c, rows, meta) {
+    return c.json(paginatedBody(rows, meta).body, 200);
+}
+/**
+ * `c.body(null, 204)`, not `c.json`: a 204 carries no body, and `c.json(null, 204)` writes the
+ * four bytes `null` and a `content-type` header under a status that promises neither.
+ */
+export function noContent(c) {
+    return c.body(null, 204);
+}
+//# sourceMappingURL=responses.js.map

package/dist/hono/responses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"responses.js","sourceRoot":"","sources":["../../src/hono/responses.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,EAAE,IAAI,MAAM,EAAE,SAAS,IAAI,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAE3E,iGAAiG;AACjG,MAAM,UAAU,EAAE,CAAI,CAAU,EAAE,IAAO,EAAE,SAA+B,GAAG;IAC3E,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,OAAO,CAAI,CAAU,EAAE,IAAO;IAC5C,OAAO,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,SAAS,CAAI,CAAU,EAAE,IAAS,EAAE,IAAqC;IACvF,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACrD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,CAAU;IAClC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 export { AppError, createAppError, toMessage } from "./errors.ts";
 export type { AppErrorOptions } from "./errors.ts";
-export { created, createErrorResponse, noContent, ok, paginated } from "./responses.ts";
-export type { CannedError, ErrorAnswer, ErrorResponseOptions } from "./responses.ts";
+export { created, createErrorResponse, noContent, ok, paginated, validationIssues, } from "./responses.ts";
+export type { CannedError, ErrorAnswer, ErrorResponseOptions, ValidationIssue, } from "./responses.ts";
 export { createLogger, errorReplacer, keptErrorFields } from "./logger/index.ts";
 export type { Logger, LoggerOptions, LogLevel, LogThreshold } from "./logger/index.ts";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACxF,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACrF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,SAAS,EACT,EAAE,EACF,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -1,4 +1,4 @@
 export { AppError, createAppError, toMessage } from "./errors.js";
-export { created, createErrorResponse, noContent, ok, paginated } from "./responses.js";
+export { created, createErrorResponse, noContent, ok, paginated, validationIssues, } from "./responses.js";
 export { createLogger, errorReplacer, keptErrorFields } from "./logger/index.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAExF,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElE,OAAO,EACL,OAAO,EACP,mBAAmB,EACnB,SAAS,EACT,EAAE,EACF,SAAS,EACT,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AAOxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/logger/serialize.d.ts

@@ -17,9 +17,18 @@
  * a PostgREST client rejects with plain objects. So in a Hono app the cause slot is precisely where
  * a vendor's rejection object ends up, and a leak there reads as if the list had run.
  *
- * `cause` means "the error this one came from", so whatever sits in it is in the error slot and
- * gets the same treatment. `name` and `message` come along because a rejection object usually
- * carries them and a line with neither says nothing at all.
+ * A plain object passed directly as `meta.error` is the other door. Hono wraps it, but a worker,
+ * a fire-and-forget catch or a database client outside Hono does not. `error` is the raw-error slot
+ * the logger documents, so it gets the same treatment as `cause`; an ordinary metadata object under
+ * any other key stays untouched. `name`, `message` and `stack` come along because a rejection
+ * object usually carries them and a line with none of them says nothing at all.
+ *
+ * `stack` is here because an adopter's queue found it missing. A job that dies is stored by its
+ * queue through a serializer, so the error reaching the dead-letter handler is a plain object with
+ * its stack in a string — and that stack is the whole of the "why" in a line whose job is to say
+ * which job died and why. The Error branch below has always written `stack` unfiltered; leaving it
+ * out here was an asymmetry, not a decision. It is a conventional field name, not one an SDK hangs
+ * its own inputs off, which is what the allow-list exists to stop.
  *
  * Deliberate state it does NOT keep: context an app attaches on purpose. That belongs in the
  * logger's `meta`, which is untouched — `cause` is not the place for it, and one incident of a
@@ -33,6 +42,9 @@ export declare function narrowErrorLike(value: object): Record<string, unknown>;
  *   `JSON.stringify(err)` is `{}` — which is how a logger ends up printing nothing about the
  *   failure it was called to report. They are added explicitly, and the allow-listed extras ride
  *   along beside them.
+ * - A plain object in the root `error` slot is narrowed through the same allow-list. Hono's
+ *   boundary turns one into an Error cause, but workers and swallowed catches log it directly.
+ *   Other metadata objects stay untouched.
  * - A nested `cause` is followed, and so is an `AggregateError`'s `errors`. Both are
  *   non-enumerable, so both are invisible to the loop above; without this line "all attempts
  *   failed" is the whole log entry. Each one goes back through this replacer, so the allow-list

package/dist/logger/serialize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEtE;AA+BD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,aAAa,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CA4BvF;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC"}
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA2EH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEtE;AAiCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,aAAa,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAiCvF;AAED,qGAAqG;AACrG,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,CAAqB,CAAC"}

package/dist/logger/serialize.js

@@ -87,9 +87,18 @@ function keptValue(key, value) {
  * a PostgREST client rejects with plain objects. So in a Hono app the cause slot is precisely where
  * a vendor's rejection object ends up, and a leak there reads as if the list had run.
  *
- * `cause` means "the error this one came from", so whatever sits in it is in the error slot and
- * gets the same treatment. `name` and `message` come along because a rejection object usually
- * carries them and a line with neither says nothing at all.
+ * A plain object passed directly as `meta.error` is the other door. Hono wraps it, but a worker,
+ * a fire-and-forget catch or a database client outside Hono does not. `error` is the raw-error slot
+ * the logger documents, so it gets the same treatment as `cause`; an ordinary metadata object under
+ * any other key stays untouched. `name`, `message` and `stack` come along because a rejection
+ * object usually carries them and a line with none of them says nothing at all.
+ *
+ * `stack` is here because an adopter's queue found it missing. A job that dies is stored by its
+ * queue through a serializer, so the error reaching the dead-letter handler is a plain object with
+ * its stack in a string — and that stack is the whole of the "why" in a line whose job is to say
+ * which job died and why. The Error branch below has always written `stack` unfiltered; leaving it
+ * out here was an asymmetry, not a decision. It is a conventional field name, not one an SDK hangs
+ * its own inputs off, which is what the allow-list exists to stop.
  *
  * Deliberate state it does NOT keep: context an app attaches on purpose. That belongs in the
  * logger's `meta`, which is untouched — `cause` is not the place for it, and one incident of a
@@ -101,11 +110,13 @@ export function narrowErrorLike(value) {
 function narrow(value, seen) {
     seen.add(value);
     const out = {};
-    const { name, message, cause } = value;
+    const { name, message, stack, cause } = value;
     if (typeof name === "string")
         out.name = name;
     if (typeof message === "string")
         out.message = message;
+    if (typeof stack === "string")
+        out.stack = stack;
     for (const [k, v] of Object.entries(value)) {
         if (KEPT_ERROR_FIELDS.has(k))
             out[k] = keptValue(k, v);
@@ -133,6 +144,9 @@ function narrowCause(cause, seen) {
  *   `JSON.stringify(err)` is `{}` — which is how a logger ends up printing nothing about the
  *   failure it was called to report. They are added explicitly, and the allow-listed extras ride
  *   along beside them.
+ * - A plain object in the root `error` slot is narrowed through the same allow-list. Hono's
+ *   boundary turns one into an Error cause, but workers and swallowed catches log it directly.
+ *   Other metadata objects stay untouched.
  * - A nested `cause` is followed, and so is an `AggregateError`'s `errors`. Both are
  *   non-enumerable, so both are invisible to the loop above; without this line "all attempts
  *   failed" is the whole log entry. Each one goes back through this replacer, so the allow-list
@@ -164,12 +178,18 @@ function narrowCause(cause, seen) {
  */
 export function errorReplacer() {
     const seen = new WeakSet();
+    let root;
     return function (key, value) {
         const held = typeof this === "object" && this !== null
             ? this[key]
             : undefined;
+        if (key === "" && typeof held === "object" && held !== null)
+            root = held;
         if (held instanceof Error)
             value = held;
+        else if (this === root && key === "error" && typeof held === "object" && held !== null) {
+            return seen.has(held) ? "[Circular]" : narrow(held, seen);
+        }
         if (typeof value === "bigint")
             return value.toString();
         if (value instanceof Error) {

package/dist/logger/serialize.js.map

@@ -1 +1 @@
-{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,sFAAsF;IACtF,yFAAyF;IACzF,4FAA4F;IAC5F,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,UAAU;IACV,wEAAwE;IACxE,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,8FAA8F;IAC9F,+FAA+F;IAC/F,iEAAiE;IACjE,YAAY;IACZ,MAAM;IACN,WAAW;IACX,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAqB;IAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,KAIhC,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACvD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAqB;IACxD,IAAI,KAAK,YAAY,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,oBAAoB;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,OAAO,UAAU,GAAG,EAAE,KAAK;QACzB,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,IAAI,YAAY,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;QACxC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,YAAY,cAAc;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/D,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAwB,iBAAiB,CAAC"}
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../../src/logger/serialize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC;IACrD,sFAAsF;IACtF,yFAAyF;IACzF,4FAA4F;IAC5F,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,YAAY;IACZ,UAAU;IACV,wEAAwE;IACxE,YAAY;IACZ,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,gBAAgB;IAChB,8FAA8F;IAC9F,+FAA+F;IAC/F,iEAAiE;IACjE,YAAY;IACZ,MAAM;IACN,WAAW;IACX,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM;CACP,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,cAAc,GAAG,wBAAwB,CAAC;AAChD,MAAM,WAAW,GAAG,wEAAwE,CAAC;AAE7F,SAAS,SAAS,CAAC,GAAW,EAAE,KAAc;IAC5C,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACzE,OAAO,KAAK,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,MAAM,CAAC,KAAK,EAAE,IAAI,OAAO,EAAU,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,IAAqB;IAClD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAKvC,CAAC;IACF,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9C,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;IACvD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IACjD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,IAAqB;IACxD,IAAI,KAAK,YAAY,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACxF,gGAAgG;IAChG,iGAAiG;IACjG,oBAAoB;IACpB,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,IAAI,IAAwB,CAAC;IAC7B,OAAO,UAAU,GAAG,EAAE,KAAK;QACzB,MAAM,IAAI,GACR,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YACvC,CAAC,CAAE,IAAgC,CAAC,GAAG,CAAC;YACxC,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,GAAG,KAAK,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,CAAC;QACzE,IAAI,IAAI,YAAY,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;aACnC,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,KAAK,OAAO,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACvF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAChB,MAAM,GAAG,GAA4B,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;oBAAE,GAAG,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;YACxB,IAAI,KAAK,KAAK,SAAS;gBAAE,GAAG,CAAC,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9D,IAAI,KAAK,YAAY,cAAc;gBAAE,GAAG,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YAC/D,IAAI,KAAK,CAAC,KAAK;gBAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YACzC,OAAO,GAAG,CAAC;QACb,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,OAAO,YAAY,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAwB,iBAAiB,CAAC"}

package/dist/responses.d.ts

@@ -11,7 +11,20 @@
  * callers. The framework adapter is eight lines and lives in `/hono`.
  */
 import type { ApiError, ApiSuccess, PaginationMeta } from "@gusnips/http";
-/** Every 2xx body is `{ data }`, or `{ data, meta }` where a route has counts to report. */
+/**
+ * The `body` is `{ data }`, or `{ data, meta }` where a route has counts to report.
+ *
+ * What comes back is an ANSWER — `{ status, body }` — not a body, because this layer is
+ * framework-free and has to hand its caller a status too. An adapter takes `.body`:
+ *
+ *     return c.json(ok(data), status);        // WRONG: {"status":200,"body":{"data":…}}
+ *     return c.json(ok(data).body, status);   // the envelope
+ *
+ * Nothing catches the first line — `c.json` takes any JSON value, the status is still whatever
+ * you passed, and a test that calls this module never sees the body its caller sends. It shipped,
+ * and a client found it. On Hono, import `ok` from `@gusnips/server/hono` instead: the four
+ * adapters there take the `Context`, and the question does not arise.
+ */
 export declare function ok<T, M = PaginationMeta>(data: T, meta?: M): {
     status: 200;
     body: ApiSuccess<T, M>;
@@ -88,6 +101,49 @@ export interface ErrorResponseOptions<Code extends string, Key extends string> {
      */
     maskDetails?: boolean;
 }
+/**
+ * What an issue MIGHT carry — every field optional, because the gate below proves only that
+ * `issues` is an array and nothing at all about an element. Typing the element as certain is
+ * what turned this projection into a throw: `path.map` on an issue that arrived without one.
+ */
+interface RawIssue {
+    readonly path?: unknown;
+    readonly code?: unknown;
+    readonly maximum?: unknown;
+    readonly minimum?: unknown;
+}
+/** One rejected field: enough to fix the call, and nothing about the schema. */
+export interface ValidationIssue {
+    /** The field that failed, as the caller spelled it. */
+    path: (string | number)[];
+    /** The rule that rejected it, such as `too_big`. */
+    code: string;
+    /** The numeric bound, when the rule has one. */
+    maximum?: number;
+    minimum?: number;
+}
+/**
+ * The field path, the rule it failed, and — for a range — the BOUND it failed against.
+ *
+ * Never the rejected value, and never the schema's internals. All six donors carry a version of
+ * that comment; what none of them carries is the proof, so here it is: handing the validator's
+ * issues straight to the client ships back the caller's own key names (`keys`), the enum's
+ * allowed values (`values`), the validator's English sentence and the expected type
+ * (`origin`) — four disclosures from one convenience, and two repos in the fleet do it today.
+ * An audit note written against an older validator looks for `received`, which the current one
+ * no longer emits; the projection is an allow-list precisely so a rename cannot reopen this.
+ *
+ * The bound is the exception, and it belongs to the caller: it is the published contract, and
+ * a `too_big` without it costs somebody a bisect to rediscover a number our own docs state.
+ *
+ * Total on purpose: this runs inside the function that turns a thrown thing into an answer, and
+ * it is advertised to the queue and tool doors, where an issue list has crossed a serialization
+ * hop. An allow-list that throws on a malformed issue sends its caller back to shipping the
+ * validator's issues raw, which is the disclosure it exists to prevent.
+ */
+export declare function validationIssues(error: {
+    readonly issues: readonly RawIssue[];
+}): ValidationIssue[];
 /**
  * Binds the mask policy and the two canned bodies, and returns the function that answers.
  *
@@ -104,4 +160,5 @@ export interface ErrorResponseOptions<Code extends string, Key extends string> {
  * ```
  */
 export declare function createErrorResponse<Code extends string = string, Key extends string = string>(opts: ErrorResponseOptions<Code, Key>): (err: unknown) => ErrorAnswer<Code>;
+export {};
 //# sourceMappingURL=responses.d.ts.map

package/dist/responses.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E,4FAA4F;AAC5F,wBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;;;EAG1D;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;;;EAGjC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;;;EAM5E;AAED,wBAAgB,SAAS;;;EAExB;AAED,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAClE,IAAI,EAAE,IAAI,CAAC;IACX,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAC3E,sDAAsD;IACtD,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,oCAAoC;IACpC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AA+GD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3F,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,IAIP,KAAK,OAAO,KAAG,WAAW,CAAC,IAAI,CAAC,CA8C/D"}
+{"version":3,"file":"responses.d.ts","sourceRoot":"","sources":["../src/responses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1E;;;;;;;;;;;;;GAaG;AACH,wBAAgB,EAAE,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;;;EAG1D;AAED,wBAAgB,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;;;EAGjC;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,CAAC;;;EAM5E;AAED,wBAAgB,SAAS;;;EAExB;AAED,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACrB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC;;;;;OAKG;IACH,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,YAAY,CAAC;CAC1C;AAED,0FAA0F;AAC1F,MAAM,WAAW,WAAW,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAClE,IAAI,EAAE,IAAI,CAAC;IACX,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,GAAG,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,MAAM,EAAE,GAAG,SAAS,MAAM;IAC3E,sDAAsD;IACtD,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,oCAAoC;IACpC,UAAU,EAAE,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnC;;;;;;;;;;;OAWG;IACH,WAAW,CAAC,EAAE,SAAS,IAAI,EAAE,CAAC;IAC9B,6FAA6F;IAC7F,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;;;;;;;OAYG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAuDD;;;;GAIG;AACH,UAAU,QAAQ;IAChB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,uDAAuD;IACvD,IAAI,EAAE,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;IAC1B,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,gDAAgD;IAChD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA6BD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACtC,QAAQ,CAAC,MAAM,EAAE,SAAS,QAAQ,EAAE,CAAC;CACtC,GAAG,eAAe,EAAE,CAUpB;AAaD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,MAAM,GAAG,MAAM,EAC3F,IAAI,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,IAIP,KAAK,OAAO,KAAG,WAAW,CAAC,IAAI,CAAC,CA8C/D"}

package/dist/responses.js

@@ -1,5 +1,18 @@
 import { AppError } from "./errors.js";
-/** Every 2xx body is `{ data }`, or `{ data, meta }` where a route has counts to report. */
+/**
+ * The `body` is `{ data }`, or `{ data, meta }` where a route has counts to report.
+ *
+ * What comes back is an ANSWER — `{ status, body }` — not a body, because this layer is
+ * framework-free and has to hand its caller a status too. An adapter takes `.body`:
+ *
+ *     return c.json(ok(data), status);        // WRONG: {"status":200,"body":{"data":…}}
+ *     return c.json(ok(data).body, status);   // the envelope
+ *
+ * Nothing catches the first line — `c.json` takes any JSON value, the status is still whatever
+ * you passed, and a test that calls this module never sees the body its caller sends. It shipped,
+ * and a client found it. On Hono, import `ok` from `@gusnips/server/hono` instead: the four
+ * adapters there take the `Context`, and the question does not arise.
+ */
 export function ok(data, meta) {
     const body = meta === undefined ? { data } : { data, meta };
     return { status: 200, body };
@@ -87,6 +100,18 @@ function zodIssues(err) {
         return null;
     return issues;
 }
+/**
+ * One path segment, as something that survives `JSON.stringify`.
+ *
+ * A symbol keyed a field the caller cannot name back at us, so its description is the only
+ * useful thing in it — and an unnamed symbol has none, which is an empty segment rather than
+ * the `null` that `JSON.stringify` would otherwise write.
+ */
+function pathSegment(segment) {
+    if (typeof segment === "symbol")
+        return segment.description ?? "";
+    return typeof segment === "number" ? segment : String(segment);
+}
 /**
  * The field path, the rule it failed, and — for a range — the BOUND it failed against.
  *
@@ -100,14 +125,22 @@ function zodIssues(err) {
  *
  * The bound is the exception, and it belongs to the caller: it is the published contract, and
  * a `too_big` without it costs somebody a bisect to rediscover a number our own docs state.
+ *
+ * Total on purpose: this runs inside the function that turns a thrown thing into an answer, and
+ * it is advertised to the queue and tool doors, where an issue list has crossed a serialization
+ * hop. An allow-list that throws on a malformed issue sends its caller back to shipping the
+ * validator's issues raw, which is the disclosure it exists to prevent.
  */
-function safeIssues(issues) {
-    return issues.map((issue) => ({
-        path: issue.path,
-        code: issue.code,
-        ...(typeof issue.maximum === "number" && { maximum: issue.maximum }),
-        ...(typeof issue.minimum === "number" && { minimum: issue.minimum }),
-    }));
+export function validationIssues(error) {
+    return error.issues.map((issue) => {
+        const { path, code, maximum, minimum } = issue ?? {};
+        return {
+            path: Array.isArray(path) ? path.map(pathSegment) : [],
+            code: typeof code === "string" ? code : "",
+            ...(typeof maximum === "number" && { maximum }),
+            ...(typeof minimum === "number" && { minimum }),
+        };
+    });
 }
 /**
  * `AppError` is generic over the product's own code union, and no runtime check can verify
@@ -140,7 +173,7 @@ export function createErrorResponse(opts) {
         if (issues !== null) {
             return {
                 status: 400,
-                body: envelope(opts.validation, safeIssues(issues)),
+                body: envelope(opts.validation, validationIssues({ issues })),
                 headers: {},
                 kind: "client",
             };