@ultimat3/schema 29.4.0 → 30.1.0

package/CLAUDE.md

@@ -16,8 +16,22 @@ Tier 0. **Imports no `@ultimat3/*` package — not even `@ultimat3/core`.**
 
 Module order (no cycles):
 `char-count → describe-value → node → builder → money-value → json-value → array-schema →
-validators → discriminated-union → provider → t` (`node-fits` and `json-schema` read `json-value`
-too).
+validators → record-schema → discriminated-union → provider → t` (`node-fits` and `json-schema` read
+`json-value` too). `record-schema.ts` (`t.record`) split from `validators.ts` at the ceiling.
+`schema-rules.ts` is a leaf (`SCHEMA_RULES`, `issueRuleFacts`), imported by `standard.ts`,
+`errors.ts` (type only) and `builder.ts`. `sensitive.ts` reads `provider.ts` and is not in `t`'s graph.
+
+- **A builtin refusal names its rule**: `rejected(path, message, rule, params?)` (`builder.ts`,
+  internal) has `rule` REQUIRED; `mistyped(path, message, value, type)` answers `required` for
+  `undefined` and `type { type }` otherwise. The exported `fail` keeps `rule?` optional for
+  providers. `schema-rules.test.ts` fails if a builtin file calls `fail(`, and pins `SCHEMA_RULES`
+  (add, never rename). `params` are declared facts only, never the rejected value.
+- **`.sensitive()` is a node fact, never a key table**: `maskSensitive` memoises "holds a flag" per
+  node in a WeakMap, so an unflagged schema costs one map read and returns the same reference. A
+  union masks every branch's flagged keys (fails closed). `assertNoSensitiveOutput` lives here
+  because `query` cannot import `action`.
+- Bytes: the `t`-only browser chunk is 19,788 B minified (+1,321 B, gzip +404, for a rule and params
+  at every refusal site), `Bun.build --minify`, 2026-11-03.
 `char-count.ts` is imported by BOTH `validators.ts` (which rejects on length) and
 `describe-value.ts` (which renders the length in the same message), because they disagreed: the
 rule counted code points and the message counted UTF-16 units, so `t.string.min(3)` refused `'👍a'`
@@ -50,7 +64,7 @@ overlay already holds the raw body. `describe-value.test.ts` is the enforcement.
 
 `t.array(items, { min, max })` (`array-schema.ts`) carries its bounds as `minItems`/`maxItems` ON
 the node — JSON Schema's names — and `json-schema.ts` and `wire-schema.ts` publish both;
-`@ultimat3/action`'s `sampleFor` samples `minItems` items. A bound no count meets is
+`sample.ts`'s walker samples `minItems` items. A bound no count meets is
 `X_SCHEMA_BOUNDS_INVALID` where it is declared, the same rule as the discriminant below.
 
 `X_SCHEMA_DISCRIMINANT_INVALID` is thrown where a `discriminatedUnion` is BUILT, not where a value
@@ -190,7 +204,7 @@ Gotchas:
   is `describeValue`d in the `cause` and whole in `meta`, never echoed.
 - **Prefer a new `SchemaNode` FIELD to a new `SchemaKind`.** Every consumer that switches on `kind`
   has a `default:` that degrades quietly — `json-schema.ts` emits `{}`, `coerce.ts` passes the raw
-  value through, `@ultimat3/action`'s `sample-input.ts` answers `null` — and they live in packages
+  value through, `sample.ts` answers `null` — and they live in packages
   a schema change is not allowed to edit. `refinements` and `discriminant` are both fields for that
   reason: a refined string still reads as a string, and a discriminated union still reads as a
   union, everywhere. `lazy` and `tuple` cannot be — which is why neither has shipped.
@@ -207,3 +221,10 @@ Gotchas:
 - `@ultimat3/action`'s `sampleInput` does not read `refinements`, so a contract test over a refined
   schema reports `X_CONTRACT_DRIFT` exactly as it already does for a bare `pattern`. Documented
   there; fixing it is that package's change, not this one's.
+
+## The `./sample` subpath
+
+- `sample.ts`, `sample-draw.ts` and `sample-seeded.ts` are the `./sample` subpath, never re-exported
+  from `src/index.ts` (axiom 6: `t` is in every bundle graph).
+- Module order: `sample-draw → sample-seeded → sample`, reading `node` and `provider`.
+- `seededDraw` is mulberry32 over the seed it is handed. It never uses `Math.random` or the clock.

package/README.md

@@ -3,6 +3,8 @@
 Tier 0. The validation seam. One schema declaration projects to a runtime validator, a TypeScript
 type, a JSON Schema, an OpenAPI body, an MCP tool `inputSchema` and HTTP query coercion.
 
+`bun add @ultimat3/schema` · guide: [The Eight Primitives](https://github.com/developerz-ai/ultimate/wiki/The-Eight-Primitives)
+
 | Owns | Module |
 |---|---|
 | Standard Schema v1 types + `validate()` / `parse()` for **any** conforming library | `standard.ts` |
@@ -17,6 +19,9 @@ type, a JSON Schema, an OpenAPI body, an MCP tool `inputSchema` and HTTP query c
 | schema → JSON Schema (OpenAPI + MCP) | `json-schema.ts` |
 | HTTP-boundary coercion, kept out of validation | `coerce.ts` |
 | `X_VALIDATION_FAILED` with path-annotated issues | `errors.ts` |
+| `SCHEMA_RULES` — the closed vocabulary an issue's `rule` names — and `issueRuleFacts` | `schema-rules.ts` |
+| `.sensitive()`'s two readers: `maskSensitive`, `assertNoSensitiveOutput` | `sensitive.ts` |
+| `@ultimat3/schema/sample`, off the barrel: `sampleInput` (the minimal value), `arbitrary(schema, { seed, run })` (the contract step's generated inputs), one walker over a `Draw` (`minimalDraw`, `seededDraw`), `sampleGaps` | `sample.ts`, `sample-draw.ts`, `sample-seeded.ts` |
 
 ## `t`
 
@@ -39,7 +44,7 @@ type PublishPost = Infer<typeof publishPost>;
 
 | Value schemas | Factories | Methods |
 |---|---|---|
-| `string` `number` `boolean` `date` `uuid` `email` `url` | `object` `array` `enum` `literal` `union` `discriminatedUnion` `record` `optional` `nullable` `refine` | `.default(v)` `.optional()` `.nullable()` `.describe(s)` `.refine(r)` |
+| `string` `number` `boolean` `date` `uuid` `email` `url` | `object` `array` `enum` `literal` `union` `discriminatedUnion` `record` `optional` `nullable` `refine` | `.default(v)` `.optional()` `.nullable()` `.describe(s)` `.sensitive()` `.refine(r)` |
 | `money` `timezone` `locale` `slug` `cursor` `json()` | `object(...).extend/.pick/.omit` | `string.min/.max/.pattern`, `number.min/.max/.int` |
 
 `nullable` is a value the row holds; `optional` is the caller omitting the key. Both ship as a
@@ -47,6 +52,43 @@ namespace member (`t.nullable`) and a free function (`nullableSchema`) — symme
 
 Unknown object keys are **dropped**, never forwarded — an action cannot be mass-assigned.
 
+### `.sensitive()` — sent in, never written down, never sent back
+
+`cardPan: t.string.sensitive()` is JSON Schema's `writeOnly`, published as such. Last in a chain:
+it answers a plain `Schema`. Read by the walkers that hold the schema, never by a key table, so
+flagging `note` on one action changes nothing another action records:
+
+| Reader | What it does |
+|---|---|
+| `maskSensitive(schema, value, '[redacted]')` | a copy with every flagged field replaced — through objects, arrays, records and EVERY union branch (fail closed, no branch resolution). The same reference when nothing is flagged |
+| `assertNoSensitiveOutput(owner, schema)` | `X_SCHEMA_SENSITIVE_OUTPUT` naming the path — an action's `output` and a query's `rows` are checked at registration |
+
+Reach, exactly: the `audit: true` record of an action or a query, and `x jobs show` (a job whose
+declaration is gone shows its input `[redacted]` whole). **Not** an app's own log line — a
+`logger.info('x', input)` holds no schema; that stays `redactKeys` or a `Secret`. PII read back
+and only hidden in logs is `redactKeys(['ssn'])`, not this flag.
+
+### An issue names its `rule`
+
+Every builtin refusal carries `rule` from `SCHEMA_RULES` and the declared `params` a translator
+interpolates — ``t(`form.${issue.rule}`, issue.params)``, never a match on the English `message`:
+
+| `rule` | `params` |
+|---|---|
+| `required` (nothing sent) · `type` | — · `{ type }` (`string`, `number`, `object`, `money`, …) |
+| `string.min` `string.max` | `{ min }` `{ max }` (characters) |
+| `string.pattern` · `string.format` | `{ pattern }` · `{ format }` (`uuid`, `email`, `uri`, `timezone`, `locale`, `date-time`) |
+| `number.min` `number.max` `number.integer` | `{ min }` `{ max }` — |
+| `enum` · `literal` · `union` | `{ values }` (`a \| b`) · `{ value }` · — (a discriminated union: `{ values }`) |
+| `array.min` `array.max` | `{ min }` `{ max }` (items) |
+| `record.key` `json` `money` | — |
+| `refine` | `{ name }` |
+
+The values are contract like an `X_*` code: added, never renamed (`schema-rules.test.ts` pins the
+list). `rule` is optional on the issue type — a third-party provider names none — and the exported
+`fail(path, message, rule?, params?)` takes both optionally for a provider. Inside this package a
+builtin refuses through `rejected`, whose `rule` is required.
+
 Refused at the boundary rather than guessed at (`As of 2026-10`):
 
 | Schema | Refuses | Because |

package/package.json

@@ -1,7 +1,17 @@
 {
   "name": "@ultimat3/schema",
-  "version": "29.4.0",
+  "version": "30.1.0",
   "description": "Ultimate's validation seam: Standard Schema interface, the t namespace, JSON Schema output",
+  "keywords": [
+    "ultimate",
+    "bun",
+    "framework",
+    "validation",
+    "schema",
+    "standard-schema",
+    "json-schema"
+  ],
+  "homepage": "https://github.com/developerz-ai/ultimate/wiki/The-Eight-Primitives",
   "license": "MIT",
   "type": "module",
   "sideEffects": false,
@@ -15,7 +25,8 @@
     "provenance": true
   },
   "exports": {
-    ".": "./src/index.ts"
+    ".": "./src/index.ts",
+    "./sample": "./src/sample.ts"
   },
   "files": [
     "src",

package/src/array-schema.ts

@@ -2,7 +2,16 @@
 // bounds. Its own file because the bounds are a declaration-time refusal as well as a parse rule,
 // and `validators.ts` was at the line ceiling.
 
-import { type AnySchema, checkOf, fail, failWith, makeSchema, pass, type Schema } from './builder';
+import {
+  type AnySchema,
+  checkOf,
+  failWith,
+  makeSchema,
+  mistyped,
+  pass,
+  rejected,
+  type Schema,
+} from './builder';
 import { describeValue, expected } from './describe-value';
 import { BoundsInvalidError } from './errors';
 import type { SchemaNode } from './node';
@@ -57,14 +66,18 @@ export function arraySchema<S extends AnySchema>(
     ...(max === undefined ? {} : { maxItems: max }),
   };
   return makeSchema<readonly InferInput<S>[], InferOutput<S>[]>(node, (value, path) => {
-    if (!Array.isArray(value)) return fail(path, expected('an array', value));
+    if (!Array.isArray(value)) return mistyped(path, expected('an array', value), value, 'array');
     // The count before the items: an over-long array is refused without reading a member, so a
     // caller's 10,000-element body costs one comparison, not 10,000 item checks.
     if (min !== undefined && value.length < min) {
-      return fail(path, expected(`an array of at least ${items(min)}`, value));
+      return rejected(path, expected(`an array of at least ${items(min)}`, value), 'array.min', {
+        min,
+      });
     }
     if (max !== undefined && value.length > max) {
-      return fail(path, expected(`an array of at most ${items(max)}`, value));
+      return rejected(path, expected(`an array of at most ${items(max)}`, value), 'array.max', {
+        max,
+      });
     }
     const issues: StandardIssue[] = [];
     const out: unknown[] = [];

package/src/builder.ts

@@ -9,6 +9,7 @@ import {
   type ValidationIssue,
 } from './errors';
 import type { SchemaNode, SchemaRefinement } from './node';
+import { issueRuleFacts, type SchemaIssueParams, type SchemaRule } from './schema-rules';
 import {
   formatIssues,
   formatPath,
@@ -42,8 +43,46 @@ export function pass<Out>(value: Out): CheckOk<Out> {
   return { ok: true, value };
 }
 
-export function fail(path: Path, message: string): CheckErr {
-  return { ok: false, issues: [{ message, path: [...path] }] };
+/**
+ * The PROVIDER's refusal: `rule` and `params` optional, because a library backing `t` may have no
+ * name for its rule. A builtin validator never calls this — it calls `rejected`, whose `rule` is
+ * required, so a builtin refusal a translator cannot key on is a type error (`schema-rules.test.ts`
+ * pins that no builtin file reaches for `fail`).
+ */
+export function fail(
+  path: Path,
+  message: string,
+  rule?: string,
+  params?: SchemaIssueParams,
+): CheckErr {
+  return {
+    ok: false,
+    issues: [
+      {
+        message,
+        path: [...path],
+        ...(rule === undefined ? {} : { rule }),
+        ...(params === undefined ? {} : { params }),
+      },
+    ],
+  };
+}
+
+/** Package-internal: a builtin's refusal, naming its rule from the closed `SCHEMA_RULES`. */
+export function rejected(
+  path: Path,
+  message: string,
+  rule: SchemaRule,
+  params?: SchemaIssueParams,
+): CheckErr {
+  return fail(path, message, rule, params);
+}
+
+/** The wrong kind of value: `required` when nothing was sent, `type` naming what was wanted. */
+export function mistyped(path: Path, message: string, value: unknown, type: string): CheckErr {
+  return value === undefined
+    ? rejected(path, message, 'required')
+    : rejected(path, message, 'type', { type });
 }
 
 export function failWith(issues: readonly StandardIssue[]): CheckErr {
@@ -98,6 +137,12 @@ export interface Schema<In = unknown, Out = In> extends StandardSchemaV1<In, Out
   nullable(): Schema<In | null, Out | null>;
   default(value: Out): Schema<In | undefined, Out>;
   describe(description: string): Schema<In, Out>;
+  /**
+   * Sent in, never written down, never sent back. The audit record and `x jobs show` mask it, it
+   * publishes as `writeOnly`, and an output that reaches it is `X_SCHEMA_SENSITIVE_OUTPUT`. NOT the
+   * app's own log lines — a `logger.info('x', input)` holds no schema; that stays `redactKeys`.
+   */
+  sensitive(): Schema<In, Out>;
   /**
    * Attach a cross-field rule. Returns a plain `Schema` on purpose — `extend`/`pick`/`omit`
    * rebuild from the shape and would silently drop the refinement, so refining last is a type
@@ -191,6 +236,7 @@ function toIssues(result: CheckErr): readonly ValidationIssue[] {
     expected: issue.message,
     received: '',
     message: issue.message,
+    ...issueRuleFacts(issue),
   }));
 }
 
@@ -242,6 +288,9 @@ export function makeSchema<In, Out>(node: SchemaNode, check: Check<Out>): Schema
     describe(description: string): Schema<In, Out> {
       return makeSchema<In, Out>({ ...node, description }, check);
     },
+    sensitive(): Schema<In, Out> {
+      return makeSchema<In, Out>({ ...node, sensitive: true }, check);
+    },
     refine(refinement: Refinement<Out>): Schema<In, Out> {
       const declared: SchemaRefinement = {
         name: refinement.name,
@@ -257,7 +306,9 @@ export function makeSchema<In, Out>(node: SchemaNode, check: Check<Out>): Schema
           if (!result.ok) return result;
           return refinement.check(result.value)
             ? result
-            : fail([...path, ...(refinement.path ?? [])], refinement.message);
+            : rejected([...path, ...(refinement.path ?? [])], refinement.message, 'refine', {
+                name: refinement.name,
+              });
         },
       );
     },
@@ -270,6 +321,7 @@ export function checkOf<In, Out>(schema: Schema<In, Out>): Check<Out> {
   return (value, path) => {
     const result = schema['~standard'].validate(value);
     if (isThenable(result)) {
+      // A provider fault, not a rule a value broke: no `rule`, so a form falls back to the text.
       return fail(path, 'expected a synchronous schema, received an async one');
     }
     if (result.issues === undefined) return pass(result.value);
@@ -277,6 +329,8 @@ export function checkOf<In, Out>(schema: Schema<In, Out>): Check<Out> {
       result.issues.map((issue) => ({
         message: issue.message,
         path: [...path, ...(issue.path ?? [])],
+        // A composite re-roots a member's issues; the rule that refused rides along unchanged.
+        ...issueRuleFacts(issue),
       })),
     );
   };

package/src/discriminated-union.ts

@@ -6,9 +6,10 @@ import {
   type AnySchema,
   type Check,
   checkOf,
-  fail,
   isPlainObject,
   makeSchema,
+  mistyped,
+  rejected,
   type Schema,
 } from './builder';
 import { expected } from './describe-value';
@@ -101,13 +102,23 @@ export function discriminatedUnionSchema<S extends readonly [AnySchema, ...AnySc
 
   return makeSchema<InferInput<S[number]>, Out>(node, (value, path) => {
     if (!isPlainObject(value)) {
-      return fail(path, expected(`an object with a "${discriminant}" discriminant`, value));
+      return mistyped(
+        path,
+        expected(`an object with a "${discriminant}" discriminant`, value),
+        value,
+        'object',
+      );
     }
     const branch = branches.get(value[discriminant]);
     if (branch === undefined) {
-      return fail(
+      const listed = renderKnown(known);
+      return rejected(
         [...path, discriminant],
-        expected(`one of ${renderKnown(known)}`, value[discriminant]),
+        expected(`one of ${listed}`, value[discriminant]),
+        'union',
+        {
+          values: listed,
+        },
       );
     }
     // The named branch's issues, and only those: the caller already said which shape they meant,

package/src/error-codes.ts

@@ -28,4 +28,5 @@ export const SCHEMA_ERROR_CODES: Readonly<Record<string, SchemaErrorCodeDeclarat
     },
     X_SCHEMA_DEFAULT_INVALID: { title: 'a schema default fails its own schema' },
     X_SCHEMA_BOUNDS_INVALID: { title: 'an array bound no array can satisfy' },
+    X_SCHEMA_SENSITIVE_OUTPUT: { title: 'a sensitive field is reachable from an output' },
   });

package/src/errors.ts

@@ -5,6 +5,7 @@
 import { ULTIMATE_ERROR_BRAND } from './error-brand';
 import { SCHEMA_ERROR_CODES } from './error-codes';
 import { renderMetaRecord } from './render-meta';
+import type { SchemaIssueParams } from './schema-rules';
 import { formatIssues } from './standard';
 
 /**
@@ -158,6 +159,9 @@ export interface ValidationIssue {
   readonly expected: string;
   readonly received: string;
   readonly message: string;
+  /** Which rule refused (`SCHEMA_RULES`), when the schema said. A `string`: a newer server may name one this build does not know. */
+  readonly rule?: string;
+  readonly params?: SchemaIssueParams;
 }
 
 export class ValidationFailedError extends SchemaError {
@@ -223,6 +227,19 @@ export class BoundsInvalidError extends SchemaError {
   }
 }
 
+/**
+ * Thrown where an action or a query is REGISTERED: a `.sensitive()` field reachable from what the
+ * server sends back contradicts `writeOnly` for every response, so boot is the honest place.
+ */
+export class SensitiveOutputError extends SchemaError {
+  static readonly code = 'X_SCHEMA_SENSITIVE_OUTPUT';
+  override readonly name = 'SensitiveOutputError';
+
+  constructor(init: Omit<SchemaErrorInit, 'code'>) {
+    super({ ...init, code: SensitiveOutputError.code });
+  }
+}
+
 export class SchemaUnsupportedError extends SchemaError {
   static readonly code = 'X_SCHEMA_UNSUPPORTED';
   override readonly name = 'SchemaUnsupportedError';

package/src/index.ts

@@ -43,6 +43,7 @@ export {
   isSchemaError,
   SchemaError,
   SchemaUnsupportedError,
+  SensitiveOutputError,
   ValidationFailedError,
 } from './errors';
 // Exported for `@ultimat3/time`'s `fromIso`: one ISO-shape rule, whichever door a date comes in by.
@@ -75,6 +76,10 @@ export {
   schemaProvider,
   tryIntrospect,
 } from './provider';
+export { recordSchema } from './record-schema';
+export type { IssueRuleFacts, SchemaIssueParams, SchemaRule } from './schema-rules';
+export { issueRuleFacts, SCHEMA_RULES } from './schema-rules';
+export { assertNoSensitiveOutput, maskSensitive } from './sensitive';
 export type {
   FormattableIssue,
   InferInput,
@@ -114,7 +119,6 @@ export {
   nullableSchema,
   objectSchema,
   optionalSchema,
-  recordSchema,
   refineSchema,
   unionSchema,
 } from './validators';

package/src/json-schema.ts

@@ -59,6 +59,8 @@ export interface JsonSchema {
   readonly anyOf?: readonly JsonSchema[];
   readonly discriminator?: JsonSchemaDiscriminator;
   readonly title?: string;
+  /** `.sensitive()`: a value the caller sends and the server never returns. */
+  readonly writeOnly?: true;
   /**
    * The refinements a consumer can act on mechanically. The prose copy also lands in
    * `description`, because that is the only field an LLM reading an MCP tool schema is
@@ -97,7 +99,7 @@ const FORMAT_MAP: Readonly<Record<string, string>> = Object.freeze({
  * `Object.hasOwn`, never the read alone: `node.format` comes from a schema PROVIDER's IR, so
  * `FORMAT_MAP['constructor']` answered with the `Object` function and `?? node.format` could not
  * rescue it — `JSON.stringify` then dropped `format` from the published document in silence.
- * Same discriminator as `@ultimat3/action`'s `BY_FORMAT[node.format]`, one package up.
+ * Same discriminator as `sample-draw.ts`'s `BY_FORMAT[node.format]`.
  */
 const publishedFormat = (format: string): string =>
   Object.hasOwn(FORMAT_MAP, format) ? (FORMAT_MAP[format] ?? format) : format;
@@ -185,6 +187,7 @@ function convert(node: SchemaNode): JsonSchema {
   const annotations: JsonSchema = {
     ...(described === undefined ? {} : { description: described }),
     ...(node.hasDefault === true ? { default: node.default } : {}),
+    ...(node.sensitive === true ? { writeOnly: true as const } : {}),
     ...(refinements.length === 0 ? {} : { 'x-ultimate-refinements': refinements }),
   };
 

package/src/json-value.ts

@@ -4,11 +4,11 @@
 
 import {
   type Check,
-  fail,
   failWith,
   isPlainObject,
   makeSchema,
   pass,
+  rejected,
   type Schema,
 } from './builder';
 import { expected } from './describe-value';
@@ -69,7 +69,7 @@ const CYCLE = 'expected a JSON value, received a cycle (a reference back to an e
 const NOT_PLAIN = 'expected a JSON value, received an object that is not a plain object or array';
 
 function refuse(state: Walk, at: At | readonly PropertyKey[], message: string): null {
-  state.issues.push({ message, path: pathOf(at) });
+  state.issues.push({ message, path: pathOf(at), rule: 'json' });
   return null;
 }
 
@@ -180,7 +180,7 @@ const checkJson: Check<JsonValue> = (value, path) => {
   // Every refusal pushes its issue; the fallback only keeps a refusal from ever reading as success.
   return state.issues.length > 0
     ? failWith(state.issues)
-    : fail(path, expected('a JSON value', value));
+    : rejected(path, expected('a JSON value', value), 'json');
 };
 
 /**

package/src/money-value.ts

@@ -3,7 +3,7 @@
 // — `@ultimat3/money`'s `Money`, `@ultimat3/entity`'s `MoneyValue` — so it earns a file a reader
 // can open by name instead of scrolling to.
 
-import { fail, failWith, isPlainObject, makeSchema, pass, type Schema } from './builder';
+import { failWith, isPlainObject, makeSchema, mistyped, pass, type Schema } from './builder';
 import { expected } from './describe-value';
 import type { StandardIssue } from './standard';
 
@@ -101,7 +101,9 @@ export const moneySchema: Schema<MoneyValue, MoneyValue> = makeSchema<MoneyValue
     },
   },
   (value, path) => {
-    if (!isPlainObject(value)) return fail(path, expected('a Money object', value));
+    if (!isPlainObject(value)) {
+      return mistyped(path, expected('a Money object', value), value, 'money');
+    }
     const minor = value['minor'];
     const currency = value['currency'];
     const scale = value['scale'];
@@ -113,12 +115,14 @@ export const moneySchema: Schema<MoneyValue, MoneyValue> = makeSchema<MoneyValue
       issues.push({
         message: expected('a safe integer number of minor units', minor),
         path: [...path, 'minor'],
+        rule: 'money',
       });
     }
     if (!isCurrencyCode(currency)) {
       issues.push({
         message: expected('a 3-letter ISO 4217 code', currency),
         path: [...path, 'currency'],
+        rule: 'money',
       });
     }
     if (scale !== undefined && !isMoneyScale(scale)) {
@@ -128,6 +132,7 @@ export const moneySchema: Schema<MoneyValue, MoneyValue> = makeSchema<MoneyValue
           scale,
         ),
         path: [...path, 'scale'],
+        rule: 'money',
       });
     }
     if (issues.length > 0) return failWith(issues);

package/src/node.ts

@@ -54,6 +54,11 @@ export interface SchemaNode {
   readonly hasDefault?: boolean | undefined;
   readonly default?: unknown;
   readonly description?: string | undefined;
+  /**
+   * `.sensitive()`: sent in, never written down by the framework, never sent back — JSON Schema's
+   * `writeOnly`. Read by the walkers that hold this schema (`maskSensitive`), never a key table.
+   */
+  readonly sensitive?: boolean | undefined;
   readonly format?: SchemaFormat | undefined;
   readonly minLength?: number | undefined;
   readonly maxLength?: number | undefined;

package/src/record-schema.ts

@@ -0,0 +1,78 @@
+// Single responsibility: `t.record(values)` — a map of caller-chosen keys to one value schema.
+// Its own file because a record key is CALLER data, unlike every other path segment, and the rules
+// that follow from that (position paths, refused keys) are the whole of it.
+
+import {
+  type AnySchema,
+  checkOf,
+  failWith,
+  isPlainObject,
+  makeSchema,
+  mistyped,
+  pass,
+  type Schema,
+} from './builder';
+import { expected } from './describe-value';
+import type { SchemaNode } from './node';
+import { isPrototypeKey, PROTOTYPE_KEYS } from './prototype-keys';
+import type { InferInput, InferOutput, StandardIssue } from './standard';
+import { unstorable } from './unstorable-text';
+
+export function recordSchema<S extends AnySchema>(
+  values: S,
+): Schema<Readonly<Record<string, InferInput<S>>>, Record<string, InferOutput<S>>> {
+  const valueCheck = checkOf(values);
+  const node: SchemaNode = { kind: 'record', valueNode: values.node };
+  return makeSchema<Readonly<Record<string, InferInput<S>>>, Record<string, InferOutput<S>>>(
+    node,
+    (value, path) => {
+      if (!isPlainObject(value))
+        return mistyped(path, expected('an object', value), value, 'record');
+      const issues: StandardIssue[] = [];
+      const out: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
+      for (const [index, [key, entry]] of Object.entries(value).entries()) {
+        // The entry's POSITION, never its key. `describe-value.ts`'s absolute is stated about the
+        // rejected value, and a record's KEY is the caller's data just as much: the path travels
+        // `formatIssue` -> `bodyInvalid`'s `cause` -> the problem document AND the log line, and
+        // core's logger redacts by key, so a key baked into a string has no key left to redact.
+        // `@ultimat3/http`'s `bodyInvalid` states the contract this was breaking in its own doc
+        // block — *"`issues` … must name only facts the framework itself chose"*. A record keyed
+        // by an email address, a phone number or a pasted credential wrote every one of them into
+        // the central log index, in the same shape the password bug did.
+        //
+        // The index rather than nothing at all: the segment's whole job is to say WHICH entry
+        // failed, and dropping it makes three failing entries render three identical lines. It is
+        // the same segment `arraySchema` already uses, so `formatPath` renders `meta[3]` with no
+        // new spelling to learn. It is `Object.entries` order — integer-like keys sort ahead of
+        // string ones — so it names an entry that exists rather than a byte offset in the body.
+        const at = [...path, index];
+        // A record is stored as `jsonb` far more often than not, and jsonb refuses an unstorable
+        // KEY exactly as it does a value — so the key is refused here, by position, not quoted.
+        const unfitKey = unstorable(key);
+        if (unfitKey !== undefined) {
+          issues.push({
+            message: `expected a record key, received one ${unfitKey}`,
+            path: at,
+            rule: 'record.key',
+          });
+          continue;
+        }
+        if (isPrototypeKey(key)) {
+          issues.push({
+            // The refused NAMES are a closed set declared right here, so the message may state
+            // them: that is the one part of this line the caller did not choose.
+            message: expected(`a record key that is not ${PROTOTYPE_KEYS.join(' | ')}`, key),
+            path: at,
+            rule: 'record.key',
+          });
+          continue;
+        }
+        const result = valueCheck(entry, at);
+        if (result.ok) out[key] = result.value;
+        else issues.push(...result.issues);
+      }
+      if (issues.length > 0) return failWith(issues);
+      return pass(out as Record<string, InferOutput<S>>);
+    },
+  );
+}