@spfn/core 0.2.0-beta.66 → 0.2.0-beta.68

package/dist/middleware/index.js

@@ -1,11 +1,25 @@
+import { randomBytes, createHmac, createHash, timingSafeEqual } from 'crypto';
 import { SerializableError } from '@spfn/core/errors';
 import { logger } from '@spfn/core/logger';
 import { env } from '@spfn/core/config';
-import { randomBytes, createHmac, createHash, timingSafeEqual } from 'crypto';
 import { format } from 'util';
 
 // src/middleware/error-handler.ts
 var errorLogger = logger.child("@spfn/core:error-handler");
+function withEnvelope(body, c) {
+  return {
+    ...body,
+    error: {
+      code: body.__type,
+      message: body.message,
+      requestId: resolveRequestId(c)
+    }
+  };
+}
+function resolveRequestId(c) {
+  const existing = c.get("requestId");
+  return existing ?? randomBytes(16).toString("hex");
+}
 function extractCauseMessage(err) {
   const cause = err.cause;
   if (!cause) {
@@ -86,8 +100,15 @@ function ErrorHandler(options = {}) {
   const {
     includeStack = env.NODE_ENV !== "production",
     enableLogging = true,
+    errorEnvelope = true,
     onError
   } = options;
+  const respond = (c, body, statusCode) => {
+    return c.json(
+      errorEnvelope ? withEnvelope(body, c) : body,
+      statusCode
+    );
+  };
   return (err, c) => {
     const path = c.req.path;
     const method = c.req.method;
@@ -109,7 +130,8 @@ function ErrorHandler(options = {}) {
         Promise.resolve(onError(err, ctx)).catch((e) => errorLogger.warn("onError callback failed", e));
       }
       if (err.internal === true && !includeStack) {
-        return c.json(
+        return respond(
+          c,
           { __type: err.constructor.name, message: "Internal server error" },
           statusCode2
         );
@@ -118,7 +140,7 @@ function ErrorHandler(options = {}) {
       if (includeStack && err.stack) {
         serialized.stack = err.stack;
       }
-      return c.json(serialized, statusCode2);
+      return respond(c, serialized, statusCode2);
     }
     const errorWithCode = err;
     const statusCode = errorWithCode.statusCode || 500;
@@ -146,7 +168,7 @@ function ErrorHandler(options = {}) {
     if (includeStack && err.stack) {
       response.stack = err.stack;
     }
-    return c.json(response, statusCode);
+    return respond(c, response, statusCode);
   };
 }
 var PROXY_SIGNATURE_HEADER = "x-spfn-proxy-signature";
@@ -368,7 +390,8 @@ var ErrorRegistry = class _ErrorRegistry {
     if (!ErrorClass) {
       throw new Error(`Unknown error type: ${data.__type}`);
     }
-    return new ErrorClass(data);
+    const { __type: _type, error: _envelope, ...fields } = data;
+    return new ErrorClass(fields);
   }
   /**
    * Try to deserialize error, return null if type unknown
@@ -394,705 +417,801 @@ var ErrorRegistry = class _ErrorRegistry {
   }
 };
 
-// src/errors/serializable-error.ts
-var SerializableError2 = class extends Error {
-  /**
-   * Serialize error to JSON-compatible object
-   *
-   * Automatically includes:
-   * - __type: Constructor name for deserialization
-   * - message: Error message
-   * - All public instance properties (except name, stack)
-   */
-  toJSON() {
-    const json = {
-      __type: this.constructor.name,
-      message: this.message
-    };
-    for (const key of Object.keys(this)) {
-      if (key !== "name" && key !== "message" && key !== "stack" && key !== "statusCode") {
-        json[key] = this[key];
-      }
-    }
-    return json;
-  }
+// src/logger/types.ts
+var LOG_LEVEL_PRIORITY = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3,
+  fatal: 4
 };
 
-// src/errors/http-errors.ts
-var HttpError = class extends SerializableError2 {
-  statusCode;
-  details;
-  constructor(data) {
-    super(data.message);
-    this.name = "HttpError";
-    this.statusCode = data.statusCode;
-    if (data.details) {
-      this.details = data.details;
-    }
-    Error.captureStackTrace(this, this.constructor);
-  }
-};
-var BadRequestError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Bad request",
-      statusCode: 400,
-      details: data.details
-    });
-    this.name = "BadRequestError";
+// src/logger/formatters.ts
+var SENSITIVE_KEYS = [
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "token",
+  "apikey",
+  "api_key",
+  "accesstoken",
+  "access_token",
+  "refreshtoken",
+  "refresh_token",
+  "authorization",
+  "auth",
+  "cookie",
+  "session",
+  "sessionid",
+  "session_id",
+  "privatekey",
+  "private_key",
+  "creditcard",
+  "credit_card",
+  "cardnumber",
+  "card_number",
+  "cvv",
+  "ssn",
+  "pin"
+];
+var MASKED_VALUE = "***MASKED***";
+function isSensitiveKey(key) {
+  const lowerKey = key.toLowerCase();
+  return SENSITIVE_KEYS.some((sensitive) => lowerKey.includes(sensitive));
+}
+function maskSensitiveData(data, seen = /* @__PURE__ */ new WeakSet()) {
+  if (data === null || data === void 0) {
+    return data;
   }
-};
-var ValidationError = class extends HttpError {
-  fields;
-  constructor(data) {
-    super({
-      message: data.message,
-      statusCode: 400,
-      details: data.details
-    });
-    this.name = "ValidationError";
-    if (data.fields) {
-      this.fields = data.fields;
-    }
+  if (typeof data !== "object") {
+    return data;
   }
-};
-var UnauthorizedError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Authentication required",
-      statusCode: 401,
-      details: data.details
-    });
-    this.name = "UnauthorizedError";
+  if (seen.has(data)) {
+    return "[Circular]";
   }
-};
-var ForbiddenError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Access forbidden",
-      statusCode: 403,
-      details: data.details
-    });
-    this.name = "ForbiddenError";
+  seen.add(data);
+  if (Array.isArray(data)) {
+    return data.map((item) => maskSensitiveData(item, seen));
   }
-};
-var NotFoundError = class extends HttpError {
-  resource;
-  constructor(data = {}) {
-    super({
-      message: data.message || "Resource not found",
-      statusCode: 404,
-      details: data.details
-    });
-    this.name = "NotFoundError";
-    if (data.resource) {
-      this.resource = data.resource;
+  const masked = {};
+  for (const [key, value] of Object.entries(data)) {
+    if (isSensitiveKey(key)) {
+      masked[key] = MASKED_VALUE;
+    } else if (typeof value === "object" && value !== null) {
+      masked[key] = maskSensitiveData(value, seen);
+    } else {
+      masked[key] = value;
     }
   }
+  return masked;
+}
+var COLORS = {
+  reset: "\x1B[0m",
+  bright: "\x1B[1m",
+  dim: "\x1B[2m",
+  // 로그 레벨 컬러
+  debug: "\x1B[36m",
+  // cyan
+  info: "\x1B[32m",
+  // green
+  warn: "\x1B[33m",
+  // yellow
+  error: "\x1B[31m",
+  // red
+  fatal: "\x1B[35m",
+  // magenta
+  // 추가 컬러
+  gray: "\x1B[90m"
 };
-var ConflictError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Resource conflict",
-      statusCode: 409,
-      details: data.details
-    });
-    this.name = "ConflictError";
+function formatTimestampHuman(date) {
+  const year = date.getFullYear();
+  const month = String(date.getMonth() + 1).padStart(2, "0");
+  const day = String(date.getDate()).padStart(2, "0");
+  const hours = String(date.getHours()).padStart(2, "0");
+  const minutes = String(date.getMinutes()).padStart(2, "0");
+  const seconds = String(date.getSeconds()).padStart(2, "0");
+  const ms = String(date.getMilliseconds()).padStart(3, "0");
+  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}.${ms}`;
+}
+function formatError(error) {
+  const lines = [];
+  lines.push(`${error.name}: ${error.message}`);
+  if (error.stack) {
+    const stackLines = error.stack.split("\n").slice(1);
+    lines.push(...stackLines);
   }
-};
-var GoneError = class extends HttpError {
-  resource;
-  constructor(data = {}) {
-    super({
-      message: data.message || "Resource permanently deleted",
-      statusCode: 410,
-      details: data.details
-    });
-    this.name = "GoneError";
-    if (data.resource) {
-      this.resource = data.resource;
-    }
+  if (error.cause instanceof Error) {
+    lines.push(`Caused by: ${formatError(error.cause)}`);
+  } else if (error.cause !== void 0) {
+    lines.push(`Caused by: ${String(error.cause)}`);
   }
-};
-var TooManyRequestsError = class extends HttpError {
-  retryAfter;
-  constructor(data = {}) {
-    super({
-      message: data.message || "Too many requests",
-      statusCode: 429,
-      details: data.details
-    });
-    this.name = "TooManyRequestsError";
-    if (data.retryAfter) {
-      this.retryAfter = data.retryAfter;
-    }
+  return lines.join("\n");
+}
+function formatConsole(metadata, colorize = true) {
+  const parts = [];
+  const timestamp = formatTimestampHuman(metadata.timestamp);
+  if (colorize) {
+    parts.push(`${COLORS.gray}[${timestamp}]${COLORS.reset}`);
+  } else {
+    parts.push(`[${timestamp}]`);
   }
-};
-var InternalServerError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Internal server error",
-      statusCode: 500,
-      details: data.details
-    });
-    this.name = "InternalServerError";
+  const pid = process.pid;
+  if (colorize) {
+    parts.push(`${COLORS.dim}[pid=${pid}]${COLORS.reset}`);
+  } else {
+    parts.push(`[pid=${pid}]`);
   }
-};
-var UnsupportedMediaTypeError = class extends HttpError {
-  mediaType;
-  supportedTypes;
-  constructor(data = {}) {
-    super({
-      message: data.message || "Unsupported media type",
-      statusCode: 415,
-      details: data.details
-    });
-    this.name = "UnsupportedMediaTypeError";
-    if (data.mediaType) {
-      this.mediaType = data.mediaType;
-    }
-    if (data.supportedTypes) {
-      this.supportedTypes = data.supportedTypes;
+  if (metadata.module) {
+    if (colorize) {
+      parts.push(`${COLORS.dim}[module=${metadata.module}]${COLORS.reset}`);
+    } else {
+      parts.push(`[module=${metadata.module}]`);
     }
   }
-};
-var UnprocessableEntityError = class extends HttpError {
-  constructor(data = {}) {
-    super({
-      message: data.message || "Unprocessable entity",
-      statusCode: 422,
-      details: data.details
+  if (metadata.context && Object.keys(metadata.context).length > 0) {
+    Object.entries(metadata.context).forEach(([key, value]) => {
+      let valueStr;
+      if (typeof value === "string") {
+        valueStr = value;
+      } else if (typeof value === "object" && value !== null) {
+        try {
+          valueStr = JSON.stringify(value);
+        } catch (error) {
+          valueStr = "[circular]";
+        }
+      } else {
+        valueStr = String(value);
+      }
+      if (colorize) {
+        parts.push(`${COLORS.dim}[${key}=${valueStr}]${COLORS.reset}`);
+      } else {
+        parts.push(`[${key}=${valueStr}]`);
+      }
     });
-    this.name = "UnprocessableEntityError";
   }
-};
-var ServiceUnavailableError = class extends HttpError {
-  retryAfter;
-  constructor(data = {}) {
-    super({
-      message: data.message || "Service unavailable",
-      statusCode: 503,
-      details: data.details
-    });
-    this.name = "ServiceUnavailableError";
-    if (data.retryAfter) {
-      this.retryAfter = data.retryAfter;
-    }
+  const levelStr = metadata.level.toUpperCase();
+  if (colorize) {
+    const color = COLORS[metadata.level];
+    parts.push(`${color}(${levelStr})${COLORS.reset}:`);
+  } else {
+    parts.push(`(${levelStr}):`);
   }
-};
+  if (colorize) {
+    parts.push(`${COLORS.bright}${metadata.message}${COLORS.reset}`);
+  } else {
+    parts.push(metadata.message);
+  }
+  let output = parts.join(" ");
+  if (metadata.error) {
+    output += "\n" + formatError(metadata.error);
+  }
+  return output;
+}
 
-// src/errors/database-errors.ts
-var DatabaseError = class extends SerializableError2 {
-  statusCode;
-  details;
-  constructor(data) {
-    super(data.message);
-    this.name = "DatabaseError";
-    this.statusCode = data.statusCode ?? 500;
-    this.details = data.details;
-    Error.captureStackTrace(this, this.constructor);
+// src/logger/logger.ts
+var FORMAT_PATTERN = /%[sdifjoOc%]/;
+var Logger = class _Logger {
+  config;
+  module;
+  constructor(config) {
+    this.config = config;
+    this.module = config.module;
   }
   /**
-   * Whether this error's message/details are derived from the raw database
-   * driver (SQL text, table/column/constraint names, parameter values) and
-   * therefore must NOT be exposed to clients in production. Defined as a
-   * prototype getter so it is never serialized into the response by toJSON().
-   * Subclasses with a safe, constructed message override this to `false`.
+   * Convert unknown error to Error object
    */
-  get internal() {
+  toError(error) {
+    if (error instanceof Error) return error;
+    if (typeof error === "string") return new Error(error);
+    if (typeof error === "object" && error !== null) {
+      return new Error(JSON.stringify(error));
+    }
+    return new Error(String(error));
+  }
+  /**
+   * Check if value is a context object (not an error)
+   */
+  isContext(value) {
+    if (typeof value !== "object" || value === null) return false;
+    if (value instanceof Error) return false;
+    const hasStack = "stack" in value && typeof value.stack === "string";
+    if (hasStack) {
+      return false;
+    }
     return true;
   }
-};
-var ConnectionError = class extends DatabaseError {
-  constructor(data) {
-    super({ message: data.message, statusCode: 503, details: data.details });
-    this.name = "ConnectionError";
+  /**
+   * Get current log level
+   */
+  get level() {
+    return this.config.level;
   }
-};
-var QueryError = class extends DatabaseError {
-  constructor(data) {
-    super({
-      message: data.message,
-      statusCode: data.statusCode ?? 500,
-      details: data.details
+  /**
+   * Create child logger (per module)
+   */
+  child(module) {
+    return new _Logger({
+      ...this.config,
+      module
     });
-    this.name = "QueryError";
   }
-};
-var EntityNotFoundError = class extends QueryError {
-  resource;
-  id;
-  constructor(data) {
-    super({
-      message: `${data.resource} with id ${data.id} not found`,
-      statusCode: 404,
-      details: { resource: data.resource, id: data.id }
-    });
-    this.name = "EntityNotFoundError";
-    this.resource = data.resource;
-    this.id = data.id;
+  /**
+   * Common log method with error/context detection
+   */
+  logWithLevel(level, message, errorOrContext, context) {
+    if (errorOrContext !== void 0 && FORMAT_PATTERN.test(message)) {
+      this.log(level, format(message, errorOrContext), void 0, context);
+      return;
+    }
+    if (errorOrContext instanceof Error) {
+      this.log(level, message, errorOrContext, context);
+    } else if (errorOrContext !== void 0 && typeof errorOrContext === "object" && !this.isContext(errorOrContext)) {
+      this.log(level, message, this.toError(errorOrContext), context);
+    } else if (typeof errorOrContext === "string" || typeof errorOrContext === "number" || typeof errorOrContext === "boolean") {
+      this.log(level, message, this.toError(errorOrContext), context);
+    } else {
+      this.log(level, message, void 0, errorOrContext);
+    }
   }
-  // Message/details are constructed from the resource + id, not driver text
-  get internal() {
-    return false;
+  debug(message, errorOrContext, context) {
+    this.logWithLevel("debug", message, errorOrContext, context);
   }
-};
-var ConstraintViolationError = class extends QueryError {
-  constructor(data) {
-    super({ message: data.message, statusCode: 400, details: data.details });
-    this.name = "ConstraintViolationError";
+  info(message, errorOrContext, context) {
+    this.logWithLevel("info", message, errorOrContext, context);
   }
-};
-var TransactionError = class extends DatabaseError {
-  constructor(data) {
-    super({
-      message: data.message,
-      statusCode: data.statusCode ?? 500,
-      details: data.details
-    });
-    this.name = "TransactionError";
+  warn(message, errorOrContext, context) {
+    this.logWithLevel("warn", message, errorOrContext, context);
   }
-};
-var DeadlockError = class extends TransactionError {
-  constructor(data) {
-    super({ message: data.message, statusCode: 409, details: data.details });
-    this.name = "DeadlockError";
+  error(message, errorOrContext, context) {
+    this.logWithLevel("error", message, errorOrContext, context);
   }
-};
-var DuplicateEntryError = class extends QueryError {
-  field;
-  value;
-  constructor(data) {
-    super({
-      message: `${data.field} already exists`,
-      statusCode: 409,
-      details: { field: data.field }
+  fatal(message, errorOrContext, context) {
+    this.logWithLevel("fatal", message, errorOrContext, context);
+  }
+  /**
+   * Log processing (internal)
+   */
+  log(level, message, error, context) {
+    if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[this.config.level]) {
+      return;
+    }
+    const metadata = {
+      timestamp: /* @__PURE__ */ new Date(),
+      level,
+      message,
+      module: this.module,
+      error,
+      // Mask sensitive information in context to prevent credential leaks
+      context: context ? maskSensitiveData(context) : void 0
+    };
+    this.processTransports(metadata);
+  }
+  /**
+   * Process Transports
+   */
+  processTransports(metadata) {
+    const promises = this.config.transports.filter((transport) => transport.enabled).map((transport) => this.safeTransportLog(transport, metadata));
+    Promise.all(promises).catch((error) => {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[Logger] Transport error: ${errorMessage}
+`);
     });
-    this.name = "DuplicateEntryError";
-    this.field = data.field;
-    this.value = data.value;
   }
-  // Field-only message/details — safe to surface to the client (not internal)
-  get internal() {
-    return false;
+  /**
+   * Transport log (error-safe)
+   */
+  async safeTransportLog(transport, metadata) {
+    try {
+      await transport.log(metadata);
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      process.stderr.write(`[Logger] Transport "${transport.name}" failed: ${errorMessage}
+`);
+    }
+  }
+  /**
+   * Close all Transports
+   */
+  async close() {
+    const closePromises = this.config.transports.filter((transport) => transport.close).map((transport) => transport.close());
+    await Promise.all(closePromises);
   }
 };
 
-// src/errors/index.ts
-var errorRegistry = new ErrorRegistry();
-errorRegistry.append([
-  HttpError,
-  BadRequestError,
-  ValidationError,
-  UnauthorizedError,
-  ForbiddenError,
-  NotFoundError,
-  ConflictError,
-  GoneError,
-  TooManyRequestsError,
-  UnsupportedMediaTypeError,
-  UnprocessableEntityError,
-  InternalServerError,
-  ServiceUnavailableError
-]);
-errorRegistry.append([
-  DatabaseError,
-  ConnectionError,
-  QueryError,
-  EntityNotFoundError,
-  ConstraintViolationError,
-  TransactionError,
-  DeadlockError,
-  DuplicateEntryError
-]);
-
-// src/logger/types.ts
-var LOG_LEVEL_PRIORITY = {
-  debug: 0,
-  info: 1,
-  warn: 2,
-  error: 3,
-  fatal: 4
-};
-
-// src/logger/formatters.ts
-var SENSITIVE_KEYS = [
-  "password",
-  "passwd",
-  "pwd",
-  "secret",
-  "token",
-  "apikey",
-  "api_key",
-  "accesstoken",
-  "access_token",
-  "refreshtoken",
-  "refresh_token",
-  "authorization",
-  "auth",
-  "cookie",
-  "session",
-  "sessionid",
-  "session_id",
-  "privatekey",
-  "private_key",
-  "creditcard",
-  "credit_card",
-  "cardnumber",
-  "card_number",
-  "cvv",
-  "ssn",
-  "pin"
-];
-var MASKED_VALUE = "***MASKED***";
-function isSensitiveKey(key) {
-  const lowerKey = key.toLowerCase();
-  return SENSITIVE_KEYS.some((sensitive) => lowerKey.includes(sensitive));
-}
-function maskSensitiveData(data, seen = /* @__PURE__ */ new WeakSet()) {
-  if (data === null || data === void 0) {
-    return data;
-  }
-  if (typeof data !== "object") {
-    return data;
-  }
-  if (seen.has(data)) {
-    return "[Circular]";
-  }
-  seen.add(data);
-  if (Array.isArray(data)) {
-    return data.map((item) => maskSensitiveData(item, seen));
+// src/logger/transports/console.ts
+var ConsoleTransport = class {
+  name = "console";
+  level;
+  enabled;
+  colorize;
+  constructor(config) {
+    this.level = config.level;
+    this.enabled = config.enabled;
+    this.colorize = config.colorize ?? true;
   }
-  const masked = {};
-  for (const [key, value] of Object.entries(data)) {
-    if (isSensitiveKey(key)) {
-      masked[key] = MASKED_VALUE;
-    } else if (typeof value === "object" && value !== null) {
-      masked[key] = maskSensitiveData(value, seen);
+  async log(metadata) {
+    if (!this.enabled) {
+      return;
+    }
+    if (LOG_LEVEL_PRIORITY[metadata.level] < LOG_LEVEL_PRIORITY[this.level]) {
+      return;
+    }
+    const message = formatConsole(metadata, this.colorize);
+    if (metadata.level === "warn" || metadata.level === "error" || metadata.level === "fatal") {
+      console.error(message);
     } else {
-      masked[key] = value;
+      console.log(message);
     }
   }
-  return masked;
-}
-var COLORS = {
-  reset: "\x1B[0m",
-  bright: "\x1B[1m",
-  dim: "\x1B[2m",
-  // 로그 레벨 컬러
-  debug: "\x1B[36m",
-  // cyan
-  info: "\x1B[32m",
-  // green
-  warn: "\x1B[33m",
-  // yellow
-  error: "\x1B[31m",
-  // red
-  fatal: "\x1B[35m",
-  // magenta
-  // 추가 컬러
-  gray: "\x1B[90m"
 };
-function formatTimestampHuman(date) {
-  const year = date.getFullYear();
-  const month = String(date.getMonth() + 1).padStart(2, "0");
-  const day = String(date.getDate()).padStart(2, "0");
-  const hours = String(date.getHours()).padStart(2, "0");
-  const minutes = String(date.getMinutes()).padStart(2, "0");
-  const seconds = String(date.getSeconds()).padStart(2, "0");
-  const ms = String(date.getMilliseconds()).padStart(3, "0");
-  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}.${ms}`;
+
+// src/logger/config.ts
+function getConsoleConfig() {
+  const isProduction = process.env.NODE_ENV === "production";
+  return {
+    level: "debug",
+    enabled: true,
+    colorize: !isProduction
+    // Dev: colored output, Production: plain text
+  };
 }
-function formatError(error) {
-  const lines = [];
-  lines.push(`${error.name}: ${error.message}`);
-  if (error.stack) {
-    const stackLines = error.stack.split("\n").slice(1);
-    lines.push(...stackLines);
-  }
-  if (error.cause instanceof Error) {
-    lines.push(`Caused by: ${formatError(error.cause)}`);
-  } else if (error.cause !== void 0) {
-    lines.push(`Caused by: ${String(error.cause)}`);
+function validateEnvironment() {
+  const nodeEnv = process.env.NODE_ENV;
+  if (!nodeEnv) {
+    process.stderr.write(
+      "[Logger] Warning: NODE_ENV is not set. Defaulting to test environment.\n"
+    );
   }
-  return lines.join("\n");
 }
-function formatConsole(metadata, colorize = true) {
-  const parts = [];
-  const timestamp = formatTimestampHuman(metadata.timestamp);
-  if (colorize) {
-    parts.push(`${COLORS.gray}[${timestamp}]${COLORS.reset}`);
-  } else {
-    parts.push(`[${timestamp}]`);
+function validateConfig() {
+  validateEnvironment();
+}
+
+// src/logger/factory.ts
+function initializeTransports() {
+  const transports = [];
+  const consoleConfig = getConsoleConfig();
+  transports.push(new ConsoleTransport(consoleConfig));
+  return transports;
+}
+function getLogLevel() {
+  const envLevel = process.env.SPFN_LOG_LEVEL || process.env.NEXT_PUBLIC_SPFN_LOG_LEVEL || "info";
+  if (envLevel in LOG_LEVEL_PRIORITY) {
+    return envLevel;
   }
-  const pid = process.pid;
-  if (colorize) {
-    parts.push(`${COLORS.dim}[pid=${pid}]${COLORS.reset}`);
-  } else {
-    parts.push(`[pid=${pid}]`);
+  process.stderr.write(
+    `[Logger] Invalid log level "${envLevel}", defaulting to "info"
+`
+  );
+  return "info";
+}
+function initializeLogger() {
+  validateConfig();
+  return new Logger({
+    level: getLogLevel(),
+    transports: initializeTransports()
+  });
+}
+var logger4 = initializeLogger();
+
+// src/errors/serializable-error.ts
+var RESERVED_RESPONSE_KEYS = /* @__PURE__ */ new Set(["__type", "message", "error"]);
+var AUTHORING_ENVIRONMENTS = /* @__PURE__ */ new Set(["local", "development", "test"]);
+function refuseReservedKey(className, key) {
+  const detail = `${className} declares the reserved field "${key}". Reserved response keys: ${[...RESERVED_RESPONSE_KEYS].join(", ")}. Rename the field.`;
+  if (AUTHORING_ENVIRONMENTS.has(process.env.NODE_ENV ?? "local")) {
+    throw new Error(detail);
+  }
+  logger4.error(`[SerializableError] ${detail} The field is omitted from the response.`);
+}
+var SerializableError2 = class extends Error {
+  /**
+   * Serialize error to JSON-compatible object
+   *
+   * Automatically includes:
+   * - __type: Constructor name for deserialization
+   * - message: Error message
+   * - All public instance properties (except name, stack)
+   */
+  toJSON() {
+    const json = {
+      __type: this.constructor.name,
+      message: this.message
+    };
+    for (const key of Object.keys(this)) {
+      if (key === "name" || key === "stack" || key === "statusCode") {
+        continue;
+      }
+      if (RESERVED_RESPONSE_KEYS.has(key)) {
+        refuseReservedKey(this.constructor.name, key);
+        continue;
+      }
+      json[key] = this[key];
+    }
+    return json;
   }
-  if (metadata.module) {
-    if (colorize) {
-      parts.push(`${COLORS.dim}[module=${metadata.module}]${COLORS.reset}`);
-    } else {
-      parts.push(`[module=${metadata.module}]`);
+};
+
+// src/errors/http-errors.ts
+var HttpError = class extends SerializableError2 {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "HttpError";
+    this.statusCode = data.statusCode;
+    if (data.details) {
+      this.details = data.details;
     }
+    Error.captureStackTrace(this, this.constructor);
   }
-  if (metadata.context && Object.keys(metadata.context).length > 0) {
-    Object.entries(metadata.context).forEach(([key, value]) => {
-      let valueStr;
-      if (typeof value === "string") {
-        valueStr = value;
-      } else if (typeof value === "object" && value !== null) {
-        try {
-          valueStr = JSON.stringify(value);
-        } catch (error) {
-          valueStr = "[circular]";
-        }
-      } else {
-        valueStr = String(value);
-      }
-      if (colorize) {
-        parts.push(`${COLORS.dim}[${key}=${valueStr}]${COLORS.reset}`);
-      } else {
-        parts.push(`[${key}=${valueStr}]`);
-      }
+};
+var BadRequestError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Bad request",
+      statusCode: 400,
+      details: data.details
     });
+    this.name = "BadRequestError";
   }
-  const levelStr = metadata.level.toUpperCase();
-  if (colorize) {
-    const color = COLORS[metadata.level];
-    parts.push(`${color}(${levelStr})${COLORS.reset}:`);
-  } else {
-    parts.push(`(${levelStr}):`);
-  }
-  if (colorize) {
-    parts.push(`${COLORS.bright}${metadata.message}${COLORS.reset}`);
-  } else {
-    parts.push(metadata.message);
+};
+var ValidationError = class extends HttpError {
+  fields;
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: 400,
+      details: data.details
+    });
+    this.name = "ValidationError";
+    if (data.fields) {
+      this.fields = data.fields;
+    }
   }
-  let output = parts.join(" ");
-  if (metadata.error) {
-    output += "\n" + formatError(metadata.error);
+};
+var UnauthorizedError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Authentication required",
+      statusCode: 401,
+      details: data.details
+    });
+    this.name = "UnauthorizedError";
   }
-  return output;
-}
-
-// src/logger/logger.ts
-var FORMAT_PATTERN = /%[sdifjoOc%]/;
-var Logger = class _Logger {
-  config;
-  module;
-  constructor(config) {
-    this.config = config;
-    this.module = config.module;
+};
+var ForbiddenError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Access forbidden",
+      statusCode: 403,
+      details: data.details
+    });
+    this.name = "ForbiddenError";
   }
-  /**
-   * Convert unknown error to Error object
-   */
-  toError(error) {
-    if (error instanceof Error) return error;
-    if (typeof error === "string") return new Error(error);
-    if (typeof error === "object" && error !== null) {
-      return new Error(JSON.stringify(error));
+};
+var NotFoundError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource not found",
+      statusCode: 404,
+      details: data.details
+    });
+    this.name = "NotFoundError";
+    if (data.resource) {
+      this.resource = data.resource;
     }
-    return new Error(String(error));
   }
-  /**
-   * Check if value is a context object (not an error)
-   */
-  isContext(value) {
-    if (typeof value !== "object" || value === null) return false;
-    if (value instanceof Error) return false;
-    const hasStack = "stack" in value && typeof value.stack === "string";
-    if (hasStack) {
-      return false;
+};
+var ConflictError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource conflict",
+      statusCode: 409,
+      details: data.details
+    });
+    this.name = "ConflictError";
+  }
+};
+var GoneError = class extends HttpError {
+  resource;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Resource permanently deleted",
+      statusCode: 410,
+      details: data.details
+    });
+    this.name = "GoneError";
+    if (data.resource) {
+      this.resource = data.resource;
     }
-    return true;
   }
-  /**
-   * Get current log level
-   */
-  get level() {
-    return this.config.level;
+};
+var TooManyRequestsError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Too many requests",
+      statusCode: 429,
+      details: data.details
+    });
+    this.name = "TooManyRequestsError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
   }
-  /**
-   * Create child logger (per module)
-   */
-  child(module) {
-    return new _Logger({
-      ...this.config,
-      module
+};
+var InternalServerError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Internal server error",
+      statusCode: 500,
+      details: data.details
     });
+    this.name = "InternalServerError";
   }
-  /**
-   * Common log method with error/context detection
-   */
-  logWithLevel(level, message, errorOrContext, context) {
-    if (errorOrContext !== void 0 && FORMAT_PATTERN.test(message)) {
-      this.log(level, format(message, errorOrContext), void 0, context);
-      return;
+};
+var UnsupportedMediaTypeError = class extends HttpError {
+  mediaType;
+  supportedTypes;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unsupported media type",
+      statusCode: 415,
+      details: data.details
+    });
+    this.name = "UnsupportedMediaTypeError";
+    if (data.mediaType) {
+      this.mediaType = data.mediaType;
     }
-    if (errorOrContext instanceof Error) {
-      this.log(level, message, errorOrContext, context);
-    } else if (errorOrContext !== void 0 && typeof errorOrContext === "object" && !this.isContext(errorOrContext)) {
-      this.log(level, message, this.toError(errorOrContext), context);
-    } else if (typeof errorOrContext === "string" || typeof errorOrContext === "number" || typeof errorOrContext === "boolean") {
-      this.log(level, message, this.toError(errorOrContext), context);
-    } else {
-      this.log(level, message, void 0, errorOrContext);
+    if (data.supportedTypes) {
+      this.supportedTypes = data.supportedTypes;
     }
   }
-  debug(message, errorOrContext, context) {
-    this.logWithLevel("debug", message, errorOrContext, context);
+};
+var UnprocessableEntityError = class extends HttpError {
+  constructor(data = {}) {
+    super({
+      message: data.message || "Unprocessable entity",
+      statusCode: 422,
+      details: data.details
+    });
+    this.name = "UnprocessableEntityError";
+  }
+};
+var ServiceUnavailableError = class extends HttpError {
+  retryAfter;
+  constructor(data = {}) {
+    super({
+      message: data.message || "Service unavailable",
+      statusCode: 503,
+      details: data.details
+    });
+    this.name = "ServiceUnavailableError";
+    if (data.retryAfter) {
+      this.retryAfter = data.retryAfter;
+    }
+  }
+};
+
+// src/errors/database-errors.ts
+var DatabaseError = class extends SerializableError2 {
+  statusCode;
+  details;
+  constructor(data) {
+    super(data.message);
+    this.name = "DatabaseError";
+    this.statusCode = data.statusCode ?? 500;
+    this.details = data.details;
+    Error.captureStackTrace(this, this.constructor);
+  }
+  /**
+   * Whether this error's message/details are derived from the raw database
+   * driver (SQL text, table/column/constraint names, parameter values) and
+   * therefore must NOT be exposed to clients in production. Defined as a
+   * prototype getter so it is never serialized into the response by toJSON().
+   * Subclasses with a safe, constructed message override this to `false`.
+   */
+  get internal() {
+    return true;
   }
-  info(message, errorOrContext, context) {
-    this.logWithLevel("info", message, errorOrContext, context);
+};
+var ConnectionError = class extends DatabaseError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 503, details: data.details });
+    this.name = "ConnectionError";
   }
-  warn(message, errorOrContext, context) {
-    this.logWithLevel("warn", message, errorOrContext, context);
+};
+var QueryError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
+    });
+    this.name = "QueryError";
   }
-  error(message, errorOrContext, context) {
-    this.logWithLevel("error", message, errorOrContext, context);
+};
+var EntityNotFoundError = class extends QueryError {
+  resource;
+  id;
+  constructor(data) {
+    super({
+      message: `${data.resource} with id ${data.id} not found`,
+      statusCode: 404,
+      details: { resource: data.resource, id: data.id }
+    });
+    this.name = "EntityNotFoundError";
+    this.resource = data.resource;
+    this.id = data.id;
   }
-  fatal(message, errorOrContext, context) {
-    this.logWithLevel("fatal", message, errorOrContext, context);
+  // Message/details are constructed from the resource + id, not driver text
+  get internal() {
+    return false;
   }
-  /**
-   * Log processing (internal)
-   */
-  log(level, message, error, context) {
-    if (LOG_LEVEL_PRIORITY[level] < LOG_LEVEL_PRIORITY[this.config.level]) {
-      return;
-    }
-    const metadata = {
-      timestamp: /* @__PURE__ */ new Date(),
-      level,
-      message,
-      module: this.module,
-      error,
-      // Mask sensitive information in context to prevent credential leaks
-      context: context ? maskSensitiveData(context) : void 0
-    };
-    this.processTransports(metadata);
+};
+var ConstraintViolationError = class extends QueryError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 400, details: data.details });
+    this.name = "ConstraintViolationError";
   }
-  /**
-   * Process Transports
-   */
-  processTransports(metadata) {
-    const promises = this.config.transports.filter((transport) => transport.enabled).map((transport) => this.safeTransportLog(transport, metadata));
-    Promise.all(promises).catch((error) => {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      process.stderr.write(`[Logger] Transport error: ${errorMessage}
-`);
+};
+var TransactionError = class extends DatabaseError {
+  constructor(data) {
+    super({
+      message: data.message,
+      statusCode: data.statusCode ?? 500,
+      details: data.details
     });
+    this.name = "TransactionError";
   }
-  /**
-   * Transport log (error-safe)
-   */
-  async safeTransportLog(transport, metadata) {
-    try {
-      await transport.log(metadata);
-    } catch (error) {
-      const errorMessage = error instanceof Error ? error.message : String(error);
-      process.stderr.write(`[Logger] Transport "${transport.name}" failed: ${errorMessage}
-`);
-    }
+};
+var DeadlockError = class extends TransactionError {
+  constructor(data) {
+    super({ message: data.message, statusCode: 409, details: data.details });
+    this.name = "DeadlockError";
   }
-  /**
-   * Close all Transports
-   */
-  async close() {
-    const closePromises = this.config.transports.filter((transport) => transport.close).map((transport) => transport.close());
-    await Promise.all(closePromises);
+};
+var DuplicateEntryError = class extends QueryError {
+  field;
+  value;
+  constructor(data) {
+    super({
+      message: `${data.field} already exists`,
+      statusCode: 409,
+      details: { field: data.field }
+    });
+    this.name = "DuplicateEntryError";
+    this.field = data.field;
+    this.value = data.value;
+  }
+  // Field-only message/details — safe to surface to the client (not internal)
+  get internal() {
+    return false;
   }
 };
 
-// src/logger/transports/console.ts
-var ConsoleTransport = class {
-  name = "console";
-  level;
-  enabled;
-  colorize;
-  constructor(config) {
-    this.level = config.level;
-    this.enabled = config.enabled;
-    this.colorize = config.colorize ?? true;
+// src/errors/index.ts
+var errorRegistry = new ErrorRegistry();
+errorRegistry.append([
+  HttpError,
+  BadRequestError,
+  ValidationError,
+  UnauthorizedError,
+  ForbiddenError,
+  NotFoundError,
+  ConflictError,
+  GoneError,
+  TooManyRequestsError,
+  UnsupportedMediaTypeError,
+  UnprocessableEntityError,
+  InternalServerError,
+  ServiceUnavailableError
+]);
+errorRegistry.append([
+  DatabaseError,
+  ConnectionError,
+  QueryError,
+  EntityNotFoundError,
+  ConstraintViolationError,
+  TransactionError,
+  DeadlockError,
+  DuplicateEntryError
+]);
+
+// src/middleware/rate-limit-store.ts
+var FIXED_WINDOW_LUA = `
+local count = redis.call('INCR', KEYS[1])
+if count == 1 then
+    redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return { count, redis.call('PTTL', KEYS[1]) }
+`;
+var CacheRateLimitStore = class {
+  constructor(cache) {
+    this.cache = cache;
+  }
+  async hit(key, windowMs) {
+    const [count, pttl] = await this.cache.eval(
+      FIXED_WINDOW_LUA,
+      1,
+      key,
+      String(windowMs)
+    );
+    return { count, pttl };
   }
-  async log(metadata) {
-    if (!this.enabled) {
-      return;
+};
+var MemoryRateLimitStore = class {
+  constructor(maxKeys = 1e4) {
+    this.maxKeys = maxKeys;
+  }
+  windows = /* @__PURE__ */ new Map();
+  /** How many live windows were dropped to stay under `maxKeys`. */
+  evicted = 0;
+  async hit(key, windowMs) {
+    const now = Date.now();
+    const existing = this.windows.get(key);
+    if (existing !== void 0 && existing.expiresAt > now) {
+      existing.count += 1;
+      return { count: existing.count, pttl: existing.expiresAt - now };
     }
-    if (LOG_LEVEL_PRIORITY[metadata.level] < LOG_LEVEL_PRIORITY[this.level]) {
+    if (this.windows.size >= this.maxKeys) {
+      this.makeRoom(now);
+    }
+    this.windows.set(key, { count: 1, expiresAt: now + windowMs });
+    return { count: 1, pttl: windowMs };
+  }
+  /** Drops every window that has already reset. */
+  prune(nowMillis) {
+    for (const [key, window] of this.windows) {
+      if (window.expiresAt <= nowMillis) {
+        this.windows.delete(key);
+      }
+    }
+  }
+  /**
+   * Frees a slot for a new key.
+   *
+   * Expired windows go first. If every window is still live the oldest one is
+   * dropped, because a hard bound is the only thing standing between a
+   * per-IP limiter and unbounded memory. A dropped window loses its count,
+   * so a caller who can mint `maxKeys` distinct identities can push another
+   * one out — which is why `evictionCount` is worth watching: it says this
+   * process is past what an in-memory limiter should be asked to hold, and
+   * the deployment wants a real cache.
+   */
+  makeRoom(nowMillis) {
+    this.prune(nowMillis);
+    if (this.windows.size < this.maxKeys) {
       return;
     }
-    const message = formatConsole(metadata, this.colorize);
-    if (metadata.level === "warn" || metadata.level === "error" || metadata.level === "fatal") {
-      console.error(message);
-    } else {
-      console.log(message);
+    const oldest = this.windows.keys().next();
+    if (!oldest.done) {
+      this.windows.delete(oldest.value);
+      this.evicted += 1;
     }
   }
-};
-
-// src/logger/config.ts
-function getConsoleConfig() {
-  const isProduction = process.env.NODE_ENV === "production";
-  return {
-    level: "debug",
-    enabled: true,
-    colorize: !isProduction
-    // Dev: colored output, Production: plain text
-  };
-}
-function validateEnvironment() {
-  const nodeEnv = process.env.NODE_ENV;
-  if (!nodeEnv) {
-    process.stderr.write(
-      "[Logger] Warning: NODE_ENV is not set. Defaulting to test environment.\n"
-    );
+  get size() {
+    return this.windows.size;
   }
-}
-function validateConfig() {
-  validateEnvironment();
-}
-
-// src/logger/factory.ts
-function initializeTransports() {
-  const transports = [];
-  const consoleConfig = getConsoleConfig();
-  transports.push(new ConsoleTransport(consoleConfig));
-  return transports;
-}
-function getLogLevel() {
-  const envLevel = process.env.SPFN_LOG_LEVEL || process.env.NEXT_PUBLIC_SPFN_LOG_LEVEL || "info";
-  if (envLevel in LOG_LEVEL_PRIORITY) {
-    return envLevel;
+  /** Live windows dropped for capacity — nonzero means the bound is binding. */
+  get evictionCount() {
+    return this.evicted;
   }
-  process.stderr.write(
-    `[Logger] Invalid log level "${envLevel}", defaulting to "info"
-`
-  );
-  return "info";
-}
-function initializeLogger() {
-  validateConfig();
-  return new Logger({
-    level: getLogLevel(),
-    transports: initializeTransports()
-  });
-}
-var logger4 = initializeLogger();
+  clear() {
+    this.windows.clear();
+    this.evicted = 0;
+  }
+};
 
 // src/middleware/rate-limit.ts
 var rateLimitLogger = logger4.child("@spfn/core:rate-limit");
-var FIXED_WINDOW_LUA = `
-local count = redis.call('INCR', KEYS[1])
-if count == 1 then
-    redis.call('PEXPIRE', KEYS[1], ARGV[1])
-end
-return { count, redis.call('PTTL', KEYS[1]) }
-`;
+var memoryStore = new MemoryRateLimitStore();
+function resetMemoryRateLimitStore() {
+  memoryStore.clear();
+}
 function getClientIp(c) {
   const clientType = c.get("clientType");
   if (clientType && clientType !== "untrusted") {
@@ -1109,21 +1228,37 @@ function socketRemoteAddress(c) {
   const bindings = env4?.server ?? env4;
   return bindings?.incoming?.socket?.remoteAddress;
 }
+function selectStore(failClosed, message, path) {
+  const cache = getCache();
+  if (cache && !isCacheDisabled()) {
+    return new CacheRateLimitStore(cache);
+  }
+  if (failClosed) {
+    throw new TooManyRequestsError({ message: message || "Rate limiter unavailable" });
+  }
+  rateLimitLogger.debug("No cache \u2014 counting rate limits in this process", { path });
+  return memoryStore;
+}
+async function hitWithFallback(store, key, windowMs, failClosed, message, path) {
+  try {
+    return await store.hit(key, windowMs);
+  } catch (error) {
+    if (failClosed) {
+      throw new TooManyRequestsError({ message: message || "Rate limiter unavailable" });
+    }
+    rateLimitLogger.warn("Cache failed \u2014 counting this rate limit in the process instead", {
+      path,
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return memoryStore.hit(key, windowMs);
+  }
+}
 var rateLimit = defineMiddlewareFactory(
   "rateLimit",
   (options) => {
     const { limit, windowMs, scope, by, failClosed = false, message } = options;
     return async (c, next) => {
-      const cache = getCache();
-      if (!cache || isCacheDisabled()) {
-        if (failClosed) {
-          throw new TooManyRequestsError({ message: message || "Rate limiter unavailable" });
-        }
-        rateLimitLogger.warn("Cache unavailable \u2014 rate limit not enforced (fail-open)", {
-          path: c.req.path
-        });
-        return next();
-      }
+      const store = selectStore(failClosed, message, c.req.path);
       const dimensions = (by ? await by(c) : [getClientIp(c)]).filter((d) => Boolean(d));
       const ns = scope || `${c.req.method} ${c.req.routePath || c.req.path}`;
       for (const dimension of dimensions) {
@@ -1132,11 +1267,13 @@ var rateLimit = defineMiddlewareFactory(
           continue;
         }
         const dimLimit = typeof dimension === "string" ? limit : dimension.limit ?? limit;
-        const [count, pttl] = await cache.eval(
-          FIXED_WINDOW_LUA,
-          1,
+        const { count, pttl } = await hitWithFallback(
+          store,
           `ratelimit:${ns}:${key}`,
-          String(windowMs)
+          windowMs,
+          failClosed,
+          message,
+          c.req.path
         );
         if (count > dimLimit) {
           const retryAfter = Math.max(1, Math.ceil((pttl > 0 ? pttl : windowMs) / 1e3));
@@ -1464,6 +1601,6 @@ function reject(c, mode, next, reason) {
   return next();
 }
 
-export { ErrorHandler, RequestLogger, createCacheNonceStore, createInMemoryNonceStore, createProxyGuard, getClientIp, getRateLimitPolicy, maskSensitiveData2 as maskSensitiveData, rateLimit, rateLimitPolicy, setRateLimitFailClosedDefault, setRateLimitPolicies };
+export { CacheRateLimitStore, ErrorHandler, MemoryRateLimitStore, RequestLogger, createCacheNonceStore, createInMemoryNonceStore, createProxyGuard, getClientIp, getRateLimitPolicy, maskSensitiveData2 as maskSensitiveData, rateLimit, rateLimitPolicy, resetMemoryRateLimitStore, setRateLimitFailClosedDefault, setRateLimitPolicies };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map