@voyant-travel/hono 0.117.0 → 0.117.2

package/dist/app.d.ts

@@ -1,10 +1,22 @@
 import type { Hono } from "hono";
+import { type LazyRoutesLoader } from "./lazy-routes.js";
 import type { VoyantAppConfig, VoyantBindings, VoyantVariables } from "./types.js";
 /** The composed app's Hono env (bindings + framework request variables). */
 type MountEnv<TBindings extends VoyantBindings> = {
     Bindings: TBindings;
     Variables: VoyantVariables;
 };
+/**
+ * A lazy route family recorded at mount time so a build-time OpenAPI generator
+ * can eager-load it and merge its `.openapi()` operations (voyant#2114). Mirrors
+ * `LazyMount` in `./openapi.ts` (kept structurally identical, but declared here
+ * to avoid pulling the build-time-only openapi module into the runtime path).
+ */
+export interface LazyMount {
+    /** Absolute surface mount prefix, or `"/"` for absolute `lazyRoutes`. */
+    prefix: string;
+    load: LazyRoutesLoader;
+}
 /**
  * App handle returned alongside the Hono instance. Carries `ready()` for
  * headless / sibling-process deployments that need to fire the lazy
@@ -40,6 +52,13 @@ export interface VoyantAppExtensions<TBindings = unknown> {
      *     await withDbFromEnv(env, (db) => drainOutbox(db, app.eventBus))
      */
     eventBus: import("@voyant-travel/core").EventBus;
+    /**
+     * Lazy route families recorded at mount time (the wildcard dispatch stubs in
+     * `lazy-routes.ts` don't reach the composed `OpenAPIHono` registry). A
+     * build-time OpenAPI generator reads this to eager-load + merge their
+     * `.openapi()` operations via `mergeLazyOpenApiPaths`. Never read at runtime.
+     */
+    lazyMounts: LazyMount[];
 }
 /**
  * Low-level app factory: given an already-resolved `modules`/`extensions` set

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAkChC,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;CACjD;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAue5D"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA8BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CA2f5D"}

package/dist/app.js

@@ -12,7 +12,7 @@ import { tryGetExecutionCtx } from "./lib/execution-ctx.js";
 import { matchesPublicPath, normalizePathname } from "./lib/public-paths.js";
 import { requestScopedEventBus } from "./lib/request-event-bus.js";
 import { requireAuth } from "./middleware/auth.js";
-import { DEFAULT_REQUEST_BODY_LIMIT_BYTES, requestBodyLimit } from "./middleware/body-size.js";
+import { DEFAULT_REQUEST_BODY_LIMIT_BYTES, MAX_GLOBAL_REQUEST_BODY_BYTES, requestBodyLimit, } from "./middleware/body-size.js";
 import { cors } from "./middleware/cors.js";
 import { db } from "./middleware/db.js";
 import { handleApiError, requestId } from "./middleware/error-boundary.js";
@@ -225,7 +225,12 @@ export function mountApp(config) {
     }
     if (config.requestBodyLimit !== false) {
         app.use("*", requestBodyLimit({
-            maxBytes: config.requestBodyLimit?.maxBytes ?? DEFAULT_REQUEST_BODY_LIMIT_BYTES,
+            // Outer ceiling sized to the largest legitimate body (uploads); the
+            // upload route enforces its own 25 MiB cap. See MAX_GLOBAL_REQUEST_BODY_BYTES.
+            maxBytes: config.requestBodyLimit?.maxBytes ?? MAX_GLOBAL_REQUEST_BODY_BYTES,
+            // JSON bodies keep the tighter 10 MiB cap (matching parseJsonBody) so
+            // migrated `.openapi()` routes aren't loosened to the upload ceiling.
+            jsonMaxBytes: config.requestBodyLimit?.jsonMaxBytes ?? DEFAULT_REQUEST_BODY_LIMIT_BYTES,
         }));
     }
     if (config.rateLimit !== false) {
@@ -416,6 +421,13 @@ export function mountApp(config) {
             scopes: c.get("scopes"),
         }));
     }
+    // Lazy route families recorded for build-time OpenAPI merging. The wildcard
+    // dispatch stubs registered by `mountLazyRoutesAt`/`mountLazyRoutePaths` never
+    // reach the composed OpenAPIHono registry, so the spec generator replays these
+    // loaders (see `mergeLazyOpenApiPaths`). Recorded in the same loop that mounts
+    // them so the prefix logic is single-sourced here. Cheap array pushes — no
+    // eager `import()` and no runtime read.
+    const lazyMounts = [];
     // Mount module routes
     for (const mod of allModules) {
         const adminPrefix = `/v1/admin/${mod.module.name}`;
@@ -428,12 +440,15 @@ export function mountApp(config) {
         }
         if (mod.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, mod.lazyAdminRoutes);
+            lazyMounts.push({ prefix: adminPrefix, load: mod.lazyAdminRoutes });
         }
         if (mod.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, mod.lazyPublicRoutes);
+            lazyMounts.push({ prefix: publicPrefix, load: mod.lazyPublicRoutes });
         }
         if (mod.lazyRoutes) {
             mountLazyRoutePaths(app, mod.lazyRoutes.paths, mod.lazyRoutes.load);
+            lazyMounts.push({ prefix: "/", load: mod.lazyRoutes.load });
         }
         if (mod.routes) {
             app.route(`/v1/${mod.module.name}`, mod.routes);
@@ -451,12 +466,15 @@ export function mountApp(config) {
         }
         if (ext.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, ext.lazyAdminRoutes);
+            lazyMounts.push({ prefix: adminPrefix, load: ext.lazyAdminRoutes });
         }
         if (ext.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, ext.lazyPublicRoutes);
+            lazyMounts.push({ prefix: publicPrefix, load: ext.lazyPublicRoutes });
         }
         if (ext.lazyRoutes) {
             mountLazyRoutePaths(app, ext.lazyRoutes.paths, ext.lazyRoutes.load);
+            lazyMounts.push({ prefix: "/", load: ext.lazyRoutes.load });
         }
         if (ext.routes) {
             app.route(`/v1/${ext.extension.module}`, ext.routes);
@@ -476,6 +494,7 @@ export function mountApp(config) {
     // the real `env`.
     const augmented = app;
     augmented.eventBus = eventBus;
+    augmented.lazyMounts = lazyMounts;
     augmented.ready = (bindings) => ensureRuntimeBootstrapped(bindings ?? {});
     return augmented;
 }

package/dist/middleware/body-size.d.ts

@@ -1,7 +1,25 @@
 import type { MiddlewareHandler } from "hono";
 export interface RequestBodyLimitOptions {
+    /** Outer ceiling applied to non-JSON bodies (e.g. multipart uploads). */
     maxBytes: number;
+    /**
+     * Tighter cap applied when the request `Content-Type` is `application/json`.
+     * When omitted, the outer `maxBytes` ceiling applies to JSON bodies too.
+     */
+    jsonMaxBytes?: number;
 }
 export declare const DEFAULT_REQUEST_BODY_LIMIT_BYTES: number;
+/**
+ * App-wide OUTER ceiling for the global `requestBodyLimit` mount. It must be at
+ * least the largest body any legitimate route accepts so the global stream cap
+ * never rejects valid traffic — the media upload route allows a 25 MiB file in a
+ * multipart envelope (`MAX_MULTIPART_UPLOAD_BYTES` = 25 MiB + 1 MiB in
+ * `@voyant-travel/storage`). Finer limits stay per-route: `parseJsonBody`/
+ * `readBoundedRequestText` keep the tighter `DEFAULT_REQUEST_BODY_LIMIT_BYTES`
+ * (10 MiB) for JSON, and the upload route enforces its own 25 MiB cap. Raising
+ * the global guard to a header-only check would reopen the no-Content-Length
+ * hole; lowering it below this would reject valid uploads (voyant#2114).
+ */
+export declare const MAX_GLOBAL_REQUEST_BODY_BYTES: number;
 export declare function requestBodyLimit(options: RequestBodyLimitOptions): MiddlewareHandler;
 //# sourceMappingURL=body-size.d.ts.map

package/dist/middleware/body-size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-size.d.ts","sourceRoot":"","sources":["../../src/middleware/body-size.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAE7C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,eAAO,MAAM,gCAAgC,QAAmB,CAAA;AAEhE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAuBpF"}
+{"version":3,"file":"body-size.d.ts","sourceRoot":"","sources":["../../src/middleware/body-size.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAOD,eAAO,MAAM,gCAAgC,QAAmB,CAAA;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAA;AAE7D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAsCpF"}

package/dist/middleware/body-size.js

@@ -1,20 +1,59 @@
+import { bodyLimit } from "hono/body-limit";
+// Mirrors Hono's own `jsonRegex` (hono/dist/validator/validator.js) and the
+// openApiValidationHook content-type guard EXACTLY — case-sensitive, strict
+// params — so "this matches" ⟺ "Hono parses the body as JSON". Keep in sync.
+const JSON_CONTENT_TYPE = /^application\/([a-z-.]+\+)?json(;\s*[a-zA-Z0-9-]+=([^;]+))*$/;
 export const DEFAULT_REQUEST_BODY_LIMIT_BYTES = 10 * 1024 * 1024;
+/**
+ * App-wide OUTER ceiling for the global `requestBodyLimit` mount. It must be at
+ * least the largest body any legitimate route accepts so the global stream cap
+ * never rejects valid traffic — the media upload route allows a 25 MiB file in a
+ * multipart envelope (`MAX_MULTIPART_UPLOAD_BYTES` = 25 MiB + 1 MiB in
+ * `@voyant-travel/storage`). Finer limits stay per-route: `parseJsonBody`/
+ * `readBoundedRequestText` keep the tighter `DEFAULT_REQUEST_BODY_LIMIT_BYTES`
+ * (10 MiB) for JSON, and the upload route enforces its own 25 MiB cap. Raising
+ * the global guard to a header-only check would reopen the no-Content-Length
+ * hole; lowering it below this would reject valid uploads (voyant#2114).
+ */
+export const MAX_GLOBAL_REQUEST_BODY_BYTES = 26 * 1024 * 1024;
 export function requestBodyLimit(options) {
+    // Hono's bodyLimit checks the Content-Length header AND wraps the request body
+    // stream so it throws once the actual read exceeds maxSize. That stream cap is
+    // what bounds chunked / HTTP/2 requests with no Content-Length header — the
+    // case the previous header-only check could not catch (e.g. `.openapi()` json
+    // routes that read via c.req.json() and never went through parseJsonBody).
+    const enforceDefault = bodyLimit({
+        maxSize: options.maxBytes,
+        onError: (c) => tooLargeResponse(c, options.maxBytes),
+    });
+    // JSON bodies keep the tighter cap that `parseJsonBody` historically enforced
+    // (10 MiB) so migrated `.openapi()` routes aren't loosened to the upload
+    // ceiling. Non-JSON bodies (uploads) get the outer `maxBytes`. (voyant#2114)
+    // Clamp to `maxBytes` so the JSON cap is never LOOSER than the outer ceiling —
+    // a deployment that tightens `maxBytes` below the JSON default (e.g. a 1 MiB
+    // global override) must also tighten JSON, not silently leave it at 10 MiB.
+    const jsonMaxBytes = options.jsonMaxBytes != null ? Math.min(options.jsonMaxBytes, options.maxBytes) : null;
+    const enforceJson = jsonMaxBytes != null
+        ? bodyLimit({
+            maxSize: jsonMaxBytes,
+            onError: (c) => tooLargeResponse(c, jsonMaxBytes),
+        })
+        : null;
     return async (c, next) => {
         if (c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS") {
             return next();
         }
-        const contentLength = c.req.header("content-length");
-        if (contentLength) {
-            const size = Number(contentLength);
-            if (Number.isFinite(size) && size > options.maxBytes) {
-                return c.json({
-                    error: "Request body too large",
-                    code: "request_body_too_large",
-                    maxBytes: options.maxBytes,
-                }, 413);
-            }
+        const contentType = c.req.header("content-type");
+        if (enforceJson && contentType && JSON_CONTENT_TYPE.test(contentType)) {
+            return enforceJson(c, next);
         }
-        return next();
+        return enforceDefault(c, next);
     };
 }
+function tooLargeResponse(c, maxBytes) {
+    return c.json({
+        error: "Request body too large",
+        code: "request_body_too_large",
+        maxBytes,
+    }, 413);
+}

package/dist/openapi-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-validation.d.ts","sourceRoot":"","sources":["../src/openapi-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG7C;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAI9D,CAAA"}
+{"version":3,"file":"openapi-validation.d.ts","sourceRoot":"","sources":["../src/openapi-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG7C;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAoB9D,CAAA"}

package/dist/openapi-validation.js

@@ -19,7 +19,23 @@ import { normalizeValidationError, RequestValidationError } from "./validation.j
 // Typed as the library's own `defaultHook` shape (`Hook<any, E, any, any>`) so
 // it stays assignable for every module's specific `OpenAPIHono<Env>`.
 // biome-ignore lint/suspicious/noExplicitAny: matches @hono/zod-openapi's defaultHook signature
-export const openApiValidationHook = (result) => {
+export const openApiValidationHook = (result, c) => {
+    // Hono's json validator yields `{}` (not a parse) when the request's
+    // content-type isn't one its parser accepts; partial PATCH schemas then
+    // validate `{}` and silently no-op. Enforce the content-type the route's
+    // contract declares so a missing/unaccepted header is a clean invalid_request
+    // 400 (voyant#2114, §16). The pattern MIRRORS Hono's own `jsonRegex`
+    // (hono/dist/validator/validator.js) EXACTLY — case-sensitive, strict params —
+    // so "this guard accepts" ⟺ "Hono parses the body". A laxer check (e.g. a
+    // case-insensitive match or a bare trailing `;`) would admit content-types
+    // Hono leaves unparsed, reintroducing the silent no-op. Keep in sync with Hono.
+    if (result.target === "json") {
+        const contentType = c.req.header("content-type");
+        const jsonContentType = /^application\/([a-z-.]+\+)?json(;\s*[a-zA-Z0-9-]+=([^;]+))*$/;
+        if (!contentType || !jsonContentType.test(contentType)) {
+            throw new RequestValidationError("Expected request Content-Type: application/json");
+        }
+    }
     if (!result.success) {
         throw normalizeValidationError(result.error) ?? new RequestValidationError("Invalid request");
     }

package/dist/openapi.d.ts

@@ -1,5 +1,6 @@
-import type { OpenAPIHono } from "@hono/zod-openapi";
+import { OpenAPIHono } from "@hono/zod-openapi";
 import type { Hono } from "hono";
+import type { LazyRoutesLoader } from "./lazy-routes.js";
 /**
  * OpenAPI document generation for composed Voyant apps (voyant#2114).
  *
@@ -54,5 +55,36 @@ export type ApiSurface = "admin" | "storefront";
  * over-include shared component schemas, which is harmless).
  */
 export declare function selectSurface(doc: OpenApiDocument, surface: ApiSurface): OpenApiDocument;
+/**
+ * A lazy-mounted route family recorded by `mountApp` for build-time spec
+ * merging. `prefix` is the absolute surface mount (`/v1/admin/<name>`,
+ * `/v1/public/...`) for relative-route loaders, or `"/"` for absolute
+ * `lazyRoutes` loaders. `load` is the same loader the runtime dispatcher caches
+ * — it constructs (but does not serve) the sub-app via `import(...)`.
+ */
+export interface LazyMount {
+    prefix: string;
+    load: LazyRoutesLoader;
+}
+/**
+ * Eager-merge lazy route families into a generated base document (voyant#2114).
+ *
+ * Lazy families mount at runtime as wildcard dispatch stubs (see
+ * `lazy-routes.ts`), so their `.openapi()` operations never reach the composed
+ * `OpenAPIHono` registry and are invisible to `generateOpenApiDocument`. This
+ * runs each loader at build time, and for any that return an `OpenAPIHono`,
+ * re-mounts it into a throwaway `OpenAPIHono` at its real prefix — reusing the
+ * exact prefix-merge semantics `OpenAPIHono.route(...)` applies to eager mounts
+ * — then shallow-merges the resulting `paths` + `components.*` into `base`.
+ *
+ * Plain `Hono` sub-apps (no `.openapi()` routes) carry no registry and are
+ * skipped without error. A loader that throws is skipped with a warning so one
+ * bad family can't break generation. `base` wins on path/component collisions
+ * (which shouldn't happen given distinct prefixes), with a dev-time warning.
+ *
+ * Build-time only — same module-level constraint as the rest of this file
+ * (`@asteasolutions/zod-to-openapi` stays out of the Worker bundle).
+ */
+export declare function mergeLazyOpenApiPaths(base: OpenApiDocument, mounts: readonly LazyMount[], options: GenerateOpenApiOptions): Promise<OpenApiDocument>;
 export {};
 //# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA8D1B"}

package/dist/openapi.js

@@ -1,3 +1,4 @@
+import { OpenAPIHono } from "@hono/zod-openapi";
 /**
  * Generate a single OpenAPI 3.1 document covering every `.openapi()` route
  * mounted on the composed app, with module base paths already merged in
@@ -28,3 +29,86 @@ export function selectSurface(doc, surface) {
     const paths = Object.fromEntries(Object.entries(doc.paths ?? {}).filter(([path]) => path.startsWith(prefix)));
     return { ...doc, paths };
 }
+/** Detect an `OpenAPIHono` sub-app (carries the `.openapi()` route registry). */
+function isOpenApiHono(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        typeof value.getOpenAPI31Document === "function" &&
+        "openAPIRegistry" in value);
+}
+/**
+ * Eager-merge lazy route families into a generated base document (voyant#2114).
+ *
+ * Lazy families mount at runtime as wildcard dispatch stubs (see
+ * `lazy-routes.ts`), so their `.openapi()` operations never reach the composed
+ * `OpenAPIHono` registry and are invisible to `generateOpenApiDocument`. This
+ * runs each loader at build time, and for any that return an `OpenAPIHono`,
+ * re-mounts it into a throwaway `OpenAPIHono` at its real prefix — reusing the
+ * exact prefix-merge semantics `OpenAPIHono.route(...)` applies to eager mounts
+ * — then shallow-merges the resulting `paths` + `components.*` into `base`.
+ *
+ * Plain `Hono` sub-apps (no `.openapi()` routes) carry no registry and are
+ * skipped without error. A loader that throws is skipped with a warning so one
+ * bad family can't break generation. `base` wins on path/component collisions
+ * (which shouldn't happen given distinct prefixes), with a dev-time warning.
+ *
+ * Build-time only — same module-level constraint as the rest of this file
+ * (`@asteasolutions/zod-to-openapi` stays out of the Worker bundle).
+ */
+export async function mergeLazyOpenApiPaths(base, mounts, options) {
+    const throwaway = new OpenAPIHono();
+    let mergedAny = false;
+    for (const { prefix, load } of mounts) {
+        let subApp;
+        try {
+            subApp = await load();
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            console.warn(`[voyant] openapi: lazy loader for "${prefix}" failed, skipping: ${message}`);
+            continue;
+        }
+        if (!isOpenApiHono(subApp)) {
+            // Plain Hono (or anything without the registry) contributes no docs.
+            continue;
+        }
+        // `route("/", subApp)` reproduces what an absolute-path (`lazyRoutes`)
+        // family does at runtime; a relative-surface loader merges at its prefix.
+        throwaway.route(prefix === "/" ? "/" : prefix, subApp);
+        mergedAny = true;
+    }
+    if (!mergedAny)
+        return base;
+    const lazyDoc = throwaway.getOpenAPI31Document({
+        openapi: "3.1.0",
+        info: options.info,
+        ...(options.servers ? { servers: options.servers } : {}),
+    });
+    const paths = { ...(base.paths ?? {}) };
+    for (const [path, item] of Object.entries(lazyDoc.paths ?? {})) {
+        if (path in paths) {
+            console.warn(`[voyant] openapi: lazy path "${path}" collides with an eager route; keeping eager.`);
+            continue;
+        }
+        paths[path] = item;
+    }
+    const merged = { ...base, paths };
+    const lazyComponents = lazyDoc.components;
+    if (lazyComponents) {
+        const baseComponents = (base.components ?? {});
+        const mergedComponents = {};
+        const groups = new Set([...Object.keys(baseComponents), ...Object.keys(lazyComponents)]);
+        for (const group of groups) {
+            const baseGroup = (baseComponents[group] ?? {});
+            const lazyGroup = lazyComponents[group] ?? {};
+            const combined = { ...lazyGroup };
+            for (const [key, value] of Object.entries(baseGroup)) {
+                combined[key] = value; // base wins
+            }
+            mergedComponents[group] = combined;
+        }
+        ;
+        merged.components = mergedComponents;
+    }
+    return merged;
+}

package/dist/types.d.ts

@@ -242,12 +242,14 @@ export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindin
      */
     metrics?: boolean;
     /**
-     * Default request body limit enforced by `Content-Length` before route
-     * handlers parse JSON/form data. Enabled by default at 10 MiB. Set
-     * `false` to disable or pass `{ maxBytes }` to override.
+     * Default request body limit enforced before route handlers parse
+     * JSON/form data. Content-type-aware: JSON bodies are capped at 10 MiB
+     * (`jsonMaxBytes`), non-JSON bodies (uploads) at the 26 MiB outer ceiling
+     * (`maxBytes`). Set `false` to disable, or override either cap.
      */
     requestBodyLimit?: false | {
-        maxBytes: number;
+        maxBytes?: number;
+        jsonMaxBytes?: number;
     };
     /**
      * Default app-wide security headers. Enabled by default. Set `false`

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,eAAe,IAAI,mBAAmB,EACtC,QAAQ,EACR,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,4BAA4B,CAAA;IAChF;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,0BAA0B,CAAA;CACvE;AAED,MAAM,MAAM,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAC7E,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,QAAQ,CAAA;IACZ,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,mEAAmE;IACnE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,iCAAiC,EAAE,cAAc,CAAA;IACzE,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAA;CACvE,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,SAAS,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAAI,CACzE,GAAG,EAAE,SAAS,KACX,QAAQ,GAAG,YAAY,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACnF,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAClF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,MAAM,QAAQ,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAClE,SAAS,CAAC,SAAS,CAAC,GACpB,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAEhC,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,cAAc,EAClE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAExC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,SAAS,SAAS,cAAc,EAC9D,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,SAAS,CAAC,CAEtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG;IACtE,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B,CAOA;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,SAAS,CAAA;IACd,EAAE,EAAE,QAAQ,CAAA;IACZ,GAAG,CAAC,EAAE,sBAAsB,CAAA;CAC7B;AAED,MAAM,WAAW,wBAAwB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CACzF,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,wBAAwB,CAAA;CAC/B;AAED,MAAM,WAAW,8BAA8B,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CAC/F,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,YAAY,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK;QAC5B,KAAK,EAAE,CACL,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,sBAAsB,KACzB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAClC,CAAA;IACD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CACR,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,KACnC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAC/E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IACzF,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACjG;AAED,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAChF,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACtC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,iBAAiB,GAAG,kBAAkB,CAAA;IAC9C,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,8BAA8B,EAAE,kBAAkB,CAAA;IAC/E;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,OAAO,kCAAkC,EAAE,sBAAsB,CAAA;IAC3F;;;;OAIG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,OAAO,4BAA4B,EAAE,eAAe,CAAA;IACxE;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QACV,eAAe,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,aAAa,CAAC;YACxB,EAAE,EAAE,MAAM,CAAA;YACV,MAAM,EAAE,MAAM,CAAA;YACd,YAAY,EAAE,MAAM,CAAA;YACpB,cAAc,EAAE,MAAM,CAAA;YACtB,MAAM,EAAE,MAAM,EAAE,CAAA;YAChB,aAAa,CAAC,EAAE,MAAM,CAAA;SACvB,CAAC,CAAA;KACH,CAAA;IAED,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,qBAAqB,CAAC,SAAS,GAAG,OAAO;IACxD;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,aAAa,CAAA;IAC9C;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAA;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,eAAe,IAAI,mBAAmB,EACtC,QAAQ,EACR,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,4BAA4B,CAAA;IAChF;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,0BAA0B,CAAA;CACvE;AAED,MAAM,MAAM,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAC7E,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,QAAQ,CAAA;IACZ,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,mEAAmE;IACnE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,iCAAiC,EAAE,cAAc,CAAA;IACzE,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAA;CACvE,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,SAAS,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAAI,CACzE,GAAG,EAAE,SAAS,KACX,QAAQ,GAAG,YAAY,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACnF,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAClF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,MAAM,QAAQ,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAClE,SAAS,CAAC,SAAS,CAAC,GACpB,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAEhC,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,cAAc,EAClE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAExC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,SAAS,SAAS,cAAc,EAC9D,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,SAAS,CAAC,CAEtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG;IACtE,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B,CAOA;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,SAAS,CAAA;IACd,EAAE,EAAE,QAAQ,CAAA;IACZ,GAAG,CAAC,EAAE,sBAAsB,CAAA;CAC7B;AAED,MAAM,WAAW,wBAAwB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CACzF,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,wBAAwB,CAAA;CAC/B;AAED,MAAM,WAAW,8BAA8B,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CAC/F,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,YAAY,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK;QAC5B,KAAK,EAAE,CACL,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,sBAAsB,KACzB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAClC,CAAA;IACD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CACR,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,KACnC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAC/E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IACzF,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACjG;AAED,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAChF,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACtC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,iBAAiB,GAAG,kBAAkB,CAAA;IAC9C,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,8BAA8B,EAAE,kBAAkB,CAAA;IAC/E;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvE;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,OAAO,kCAAkC,EAAE,sBAAsB,CAAA;IAC3F;;;;OAIG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,OAAO,4BAA4B,EAAE,eAAe,CAAA;IACxE;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QACV,eAAe,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,aAAa,CAAC;YACxB,EAAE,EAAE,MAAM,CAAA;YACV,MAAM,EAAE,MAAM,CAAA;YACd,YAAY,EAAE,MAAM,CAAA;YACpB,cAAc,EAAE,MAAM,CAAA;YACtB,MAAM,EAAE,MAAM,EAAE,CAAA;YAChB,aAAa,CAAC,EAAE,MAAM,CAAA;SACvB,CAAC,CAAA;KACH,CAAA;IAED,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,qBAAqB,CAAC,SAAS,GAAG,OAAO;IACxD;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,aAAa,CAAA;IAC9C;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAA;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG"}

package/dist/validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,KAAK,CAAA;AAI5C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAClC;CAQJ;AAED,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ/D;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAiB;CAOrC;AAED,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAAc;CAOlC;AAqBD,wBAAsB,aAAa,CAAC,CAAC,EACnC,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,CAAC,CAAC,CAcZ;AAkBD,wBAAgB,UAAU,CAAC,CAAC,EAC1B,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,CAAC,CAMH;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAUjF"}
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../src/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,EAAY,KAAK,OAAO,EAAE,MAAM,KAAK,CAAA;AAI5C,qBAAa,YAAa,SAAQ,KAAK;IACrC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;gBAGxC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAClC;CAQJ;AAED,qBAAa,sBAAuB,SAAQ,YAAY;gBAC1C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQ/D;AAED,qBAAa,oBAAqB,SAAQ,YAAY;gBACxC,OAAO,SAAiB;CAOrC;AAED,qBAAa,iBAAkB,SAAQ,YAAY;gBACrC,OAAO,SAAc;CAOlC;AAqBD,wBAAsB,aAAa,CAAC,CAAC,EACnC,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACxF,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IACR,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB,GACA,OAAO,CAAC,CAAC,CAAC,CAcZ;AAkBD,wBAAgB,UAAU,CAAC,CAAC,EAC1B,CAAC,EAAE,OAAO,EACV,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAClB,OAAO,CAAC,EAAE;IAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAAE,GACzC,CAAC,CAMH;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,YAAY,GAAG,SAAS,CAsBjF"}

package/dist/validation.js

@@ -1,3 +1,4 @@
+import { HTTPException } from "hono/http-exception";
 import { ZodError } from "zod";
 import { DEFAULT_REQUEST_BODY_LIMIT_BYTES } from "./middleware/body-size.js";
 export class ApiHttpError extends Error {
@@ -102,5 +103,16 @@ export function normalizeValidationError(error) {
     if (error instanceof ZodError) {
         return toValidationError(error);
     }
+    if (error instanceof HTTPException) {
+        // Hono's request validators throw HTTPException before our validation hook
+        // runs — most notably HTTPException(400, "Malformed JSON in request body")
+        // from the JSON body parser on `.openapi()` routes. Map it onto the
+        // framework error contract so bad client input is a structured 4xx, not a
+        // 500 (voyant#2114).
+        return new ApiHttpError(error.message, {
+            status: error.status,
+            code: error.status === 400 ? "invalid_request" : undefined,
+        });
+    }
     return undefined;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.117.0",
+  "version": "0.117.2",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -139,8 +139,8 @@
     "@voyant-travel/db": "^0.109.4",
     "@voyant-travel/storage": "^0.105.0",
     "@voyant-travel/types": "^0.106.0",
-    "@voyant-travel/utils": "^0.105.4",
-    "@voyant-travel/workflows": "^0.111.9"
+    "@voyant-travel/workflows": "^0.111.9",
+    "@voyant-travel/utils": "^0.105.4"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260426.1",