@voyant-travel/hono 0.117.0 → 0.117.1

package/dist/app.d.ts

@@ -1,10 +1,22 @@
 import type { Hono } from "hono";
+import { type LazyRoutesLoader } from "./lazy-routes.js";
 import type { VoyantAppConfig, VoyantBindings, VoyantVariables } from "./types.js";
 /** The composed app's Hono env (bindings + framework request variables). */
 type MountEnv<TBindings extends VoyantBindings> = {
     Bindings: TBindings;
     Variables: VoyantVariables;
 };
+/**
+ * A lazy route family recorded at mount time so a build-time OpenAPI generator
+ * can eager-load it and merge its `.openapi()` operations (voyant#2114). Mirrors
+ * `LazyMount` in `./openapi.ts` (kept structurally identical, but declared here
+ * to avoid pulling the build-time-only openapi module into the runtime path).
+ */
+export interface LazyMount {
+    /** Absolute surface mount prefix, or `"/"` for absolute `lazyRoutes`. */
+    prefix: string;
+    load: LazyRoutesLoader;
+}
 /**
  * App handle returned alongside the Hono instance. Carries `ready()` for
  * headless / sibling-process deployments that need to fire the lazy
@@ -40,6 +52,13 @@ export interface VoyantAppExtensions<TBindings = unknown> {
      *     await withDbFromEnv(env, (db) => drainOutbox(db, app.eventBus))
      */
     eventBus: import("@voyant-travel/core").EventBus;
+    /**
+     * Lazy route families recorded at mount time (the wildcard dispatch stubs in
+     * `lazy-routes.ts` don't reach the composed `OpenAPIHono` registry). A
+     * build-time OpenAPI generator reads this to eager-load + merge their
+     * `.openapi()` operations via `mergeLazyOpenApiPaths`. Never read at runtime.
+     */
+    lazyMounts: LazyMount[];
 }
 /**
  * Low-level app factory: given an already-resolved `modules`/`extensions` set

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAkChC,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;CACjD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAue5D"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA0BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAsf5D"}

package/dist/app.js

@@ -416,6 +416,13 @@ export function mountApp(config) {
             scopes: c.get("scopes"),
         }));
     }
+    // Lazy route families recorded for build-time OpenAPI merging. The wildcard
+    // dispatch stubs registered by `mountLazyRoutesAt`/`mountLazyRoutePaths` never
+    // reach the composed OpenAPIHono registry, so the spec generator replays these
+    // loaders (see `mergeLazyOpenApiPaths`). Recorded in the same loop that mounts
+    // them so the prefix logic is single-sourced here. Cheap array pushes — no
+    // eager `import()` and no runtime read.
+    const lazyMounts = [];
     // Mount module routes
     for (const mod of allModules) {
         const adminPrefix = `/v1/admin/${mod.module.name}`;
@@ -428,12 +435,15 @@ export function mountApp(config) {
         }
         if (mod.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, mod.lazyAdminRoutes);
+            lazyMounts.push({ prefix: adminPrefix, load: mod.lazyAdminRoutes });
         }
         if (mod.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, mod.lazyPublicRoutes);
+            lazyMounts.push({ prefix: publicPrefix, load: mod.lazyPublicRoutes });
         }
         if (mod.lazyRoutes) {
             mountLazyRoutePaths(app, mod.lazyRoutes.paths, mod.lazyRoutes.load);
+            lazyMounts.push({ prefix: "/", load: mod.lazyRoutes.load });
         }
         if (mod.routes) {
             app.route(`/v1/${mod.module.name}`, mod.routes);
@@ -451,12 +461,15 @@ export function mountApp(config) {
         }
         if (ext.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, ext.lazyAdminRoutes);
+            lazyMounts.push({ prefix: adminPrefix, load: ext.lazyAdminRoutes });
         }
         if (ext.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, ext.lazyPublicRoutes);
+            lazyMounts.push({ prefix: publicPrefix, load: ext.lazyPublicRoutes });
         }
         if (ext.lazyRoutes) {
             mountLazyRoutePaths(app, ext.lazyRoutes.paths, ext.lazyRoutes.load);
+            lazyMounts.push({ prefix: "/", load: ext.lazyRoutes.load });
         }
         if (ext.routes) {
             app.route(`/v1/${ext.extension.module}`, ext.routes);
@@ -476,6 +489,7 @@ export function mountApp(config) {
     // the real `env`.
     const augmented = app;
     augmented.eventBus = eventBus;
+    augmented.lazyMounts = lazyMounts;
     augmented.ready = (bindings) => ensureRuntimeBootstrapped(bindings ?? {});
     return augmented;
 }

package/dist/openapi.d.ts

@@ -1,5 +1,6 @@
-import type { OpenAPIHono } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Hono } from "hono";
+import type { LazyRoutesLoader } from "./lazy-routes.js";
 /**
  * OpenAPI document generation for composed Voyant apps (voyant#2114).
  *
@@ -54,5 +55,36 @@ export type ApiSurface = "admin" | "storefront";
  * over-include shared component schemas, which is harmless).
  */
 export declare function selectSurface(doc: OpenApiDocument, surface: ApiSurface): OpenApiDocument;
+/**
+ * A lazy-mounted route family recorded by `mountApp` for build-time spec
+ * merging. `prefix` is the absolute surface mount (`/v1/admin/<name>`,
+ * `/v1/public/...`) for relative-route loaders, or `"/"` for absolute
+ * `lazyRoutes` loaders. `load` is the same loader the runtime dispatcher caches
+ * — it constructs (but does not serve) the sub-app via `import(...)`.
+ */
+export interface LazyMount {
+    prefix: string;
+    load: LazyRoutesLoader;
+}
+/**
+ * Eager-merge lazy route families into a generated base document (voyant#2114).
+ *
+ * Lazy families mount at runtime as wildcard dispatch stubs (see
+ * `lazy-routes.ts`), so their `.openapi()` operations never reach the composed
+ * `OpenAPIHono` registry and are invisible to `generateOpenApiDocument`. This
+ * runs each loader at build time, and for any that return an `OpenAPIHono`,
+ * re-mounts it into a throwaway `OpenAPIHono` at its real prefix — reusing the
+ * exact prefix-merge semantics `OpenAPIHono.route(...)` applies to eager mounts
+ * — then shallow-merges the resulting `paths` + `components.*` into `base`.
+ *
+ * Plain `Hono` sub-apps (no `.openapi()` routes) carry no registry and are
+ * skipped without error. A loader that throws is skipped with a warning so one
+ * bad family can't break generation. `base` wins on path/component collisions
+ * (which shouldn't happen given distinct prefixes), with a dev-time warning.
+ *
+ * Build-time only — same module-level constraint as the rest of this file
+ * (`@asteasolutions/zod-to-openapi` stays out of the Worker bundle).
+ */
+export declare function mergeLazyOpenApiPaths(base: OpenApiDocument, mounts: readonly LazyMount[], options: GenerateOpenApiOptions): Promise<OpenApiDocument>;
 export {};
 //# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA8D1B"}

package/dist/openapi.js

@@ -1,3 +1,4 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
 /**
  * Generate a single OpenAPI 3.1 document covering every `.openapi()` route
  * mounted on the composed app, with module base paths already merged in
@@ -28,3 +29,86 @@ export function selectSurface(doc, surface) {
     const paths = Object.fromEntries(Object.entries(doc.paths ?? {}).filter(([path]) => path.startsWith(prefix)));
     return { ...doc, paths };
 }
+/** Detect an `OpenAPIHono` sub-app (carries the `.openapi()` route registry). */
+function isOpenApiHono(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.getOpenAPI31Document === "function" &&
+        "openAPIRegistry" in value);
+}
+/**
+ * Eager-merge lazy route families into a generated base document (voyant#2114).
+ *
+ * Lazy families mount at runtime as wildcard dispatch stubs (see
+ * `lazy-routes.ts`), so their `.openapi()` operations never reach the composed
+ * `OpenAPIHono` registry and are invisible to `generateOpenApiDocument`. This
+ * runs each loader at build time, and for any that return an `OpenAPIHono`,
+ * re-mounts it into a throwaway `OpenAPIHono` at its real prefix — reusing the
+ * exact prefix-merge semantics `OpenAPIHono.route(...)` applies to eager mounts
+ * — then shallow-merges the resulting `paths` + `components.*` into `base`.
+ *
+ * Plain `Hono` sub-apps (no `.openapi()` routes) carry no registry and are
+ * skipped without error. A loader that throws is skipped with a warning so one
+ * bad family can't break generation. `base` wins on path/component collisions
+ * (which shouldn't happen given distinct prefixes), with a dev-time warning.
+ *
+ * Build-time only — same module-level constraint as the rest of this file
+ * (`@asteasolutions/zod-to-openapi` stays out of the Worker bundle).
+ */
+export async function mergeLazyOpenApiPaths(base, mounts, options) {
+    const throwaway = new OpenAPIHono();
+    let mergedAny = false;
+    for (const { prefix, load } of mounts) {
+        let subApp;
+        try {
+            subApp = await load();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(`[voyant] openapi: lazy loader for "${prefix}" failed, skipping: ${message}`);
+            continue;
+        }
+        if (!isOpenApiHono(subApp)) {
+            // Plain Hono (or anything without the registry) contributes no docs.
+            continue;
+        }
+        // `route("/", subApp)` reproduces what an absolute-path (`lazyRoutes`)
+        // family does at runtime; a relative-surface loader merges at its prefix.
+        throwaway.route(prefix === "/" ? "/" : prefix, subApp);
+        mergedAny = true;
+    }
+    if (!mergedAny)
+        return base;
+    const lazyDoc = throwaway.getOpenAPI31Document({
+        openapi: "3.1.0",
+        info: options.info,
+        ...(options.servers ? { servers: options.servers } : {}),
+    });
+    const paths = { ...(base.paths ?? {}) };
+    for (const [path, item] of Object.entries(lazyDoc.paths ?? {})) {
+        if (path in paths) {
+            console.warn(`[voyant] openapi: lazy path "${path}" collides with an eager route; keeping eager.`);
+            continue;
+        }
+        paths[path] = item;
+    }
+    const merged = { ...base, paths };
+    const lazyComponents = lazyDoc.components;
+    if (lazyComponents) {
+        const baseComponents = (base.components ?? {});
+        const mergedComponents = {};
+        const groups = new Set([...Object.keys(baseComponents), ...Object.keys(lazyComponents)]);
+        for (const group of groups) {
+            const baseGroup = (baseComponents[group] ?? {});
+            const lazyGroup = lazyComponents[group] ?? {};
+            const combined = { ...lazyGroup };
+            for (const [key, value] of Object.entries(baseGroup)) {
+                combined[key] = value; // base wins
+            }
+            mergedComponents[group] = combined;
+        }
+        ;
+        merged.components = mergedComponents;
+    }
+    return merged;
+}

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,KAAK,CAAA;AAI5C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAClC;CAQJ;AAED,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ/D;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAiB;CAOrC;AAED,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAAc;CAOlC;AAqBD,wBAAsB,aAAa,CAAC,CAAC,EACnC,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,CAAC,CAAC,CAcZ;AAkBD,wBAAgB,UAAU,CAAC,CAAC,EAC1B,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,CAAC,CAMH;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAUjF"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,KAAK,CAAA;AAI5C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAClC;CAQJ;AAED,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ/D;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAiB;CAOrC;AAED,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAAc;CAOlC;AAqBD,wBAAsB,aAAa,CAAC,CAAC,EACnC,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,CAAC,CAAC,CAcZ;AAkBD,wBAAgB,UAAU,CAAC,CAAC,EAC1B,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,CAAC,CAMH;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBjF"}

package/dist/validation.js

@@ -1,3 +1,4 @@
+import { HTTPException } from "hono/http-exception";
 import { ZodError } from "zod";
 import { DEFAULT_REQUEST_BODY_LIMIT_BYTES } from "./middleware/body-size.js";
 export class ApiHttpError extends Error {
@@ -102,5 +103,16 @@ export function normalizeValidationError(error) {
     if (error instanceof ZodError) {
         return toValidationError(error);
     }
+    if (error instanceof HTTPException) {
+        // Hono's request validators throw HTTPException before our validation hook
+        // runs — most notably HTTPException(400, "Malformed JSON in request body")
+        // from the JSON body parser on `.openapi()` routes. Map it onto the
+        // framework error contract so bad client input is a structured 4xx, not a
+        // 500 (voyant#2114).
+        return new ApiHttpError(error.message, {
+            status: error.status,
+            code: error.status === 400 ? "invalid_request" : undefined,
+        });
+    }
     return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.117.0",
+  "version": "0.117.1",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -146,8 +146,8 @@
     "@cloudflare/workers-types": "^4.20260426.1",
     "typescript": "^6.0.2",
     "vitest": "^4.1.2",
-    "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.111.9"
+    "@voyant-travel/workflows-orchestrator": "^0.111.9",
+    "@voyant-travel/voyant-typescript-config": "^0.1.0"
   },
   "files": [
     "dist"