@voyant-travel/hono 0.117.1 → 0.118.0

package/dist/anonymous-paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anonymous-paths.d.ts","sourceRoot":"","sources":["../src/anonymous-paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAG5D;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,MAAM,EAAE,CAuBV"}
+{"version":3,"file":"anonymous-paths.d.ts","sourceRoot":"","sources":["../src/anonymous-paths.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAG5D;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,UAAU,EAAE,EAC9B,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,QAAQ,GAAE,SAAS,MAAM,EAAO,GAC/B,MAAM,EAAE,CA0CV"}

package/dist/anonymous-paths.js

@@ -25,11 +25,31 @@ export function assembleAnonymousPaths(modules, extensions, explicit = []) {
             paths.add(trimmed ? `${mount}/${trimmed}` : mount);
         }
     };
+    // Inbound webhook routes are unauthenticated by construction (the handler
+    // verifies the provider signature), so their concrete absolute paths are
+    // auto-added to the allow-list — no per-deployment `publicPaths` entry. Mounted
+    // at `/v1/{name}`, matching the mount in `app.ts`. Parameterized/wildcard paths
+    // are skipped (the literal `matchesPublicPath` matcher can't match them) and
+    // must be declared via `anonymous` if ever needed.
+    // biome-ignore lint/suspicious/noExplicitAny: Hono sub-apps have varied env generics -- owner: hono; mirrors the HonoModule.webhookRoutes suppression.
+    const addWebhooks = (name, routes) => {
+        if (!routes)
+            return;
+        for (const route of routes.routes) {
+            const path = route.path;
+            if (path.includes(":") || path.includes("*"))
+                continue;
+            const trimmed = path.replace(/\/+$/g, "");
+            paths.add(`/v1/${name}${trimmed === "/" ? "" : trimmed}`);
+        }
+    };
     for (const m of modules) {
         add(resolveSurfaceMountPath("/v1/public", m.publicPath, m.module.name), m.anonymous);
+        addWebhooks(m.module.name, m.webhookRoutes);
     }
     for (const e of extensions) {
         add(resolveSurfaceMountPath("/v1/public", e.publicPath, e.extension.module), e.anonymous);
+        addWebhooks(e.extension.module, e.webhookRoutes);
     }
     return [...paths].sort();
 }

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA0BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAsf5D"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA8BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CA2e5D"}

package/dist/app.js

@@ -12,7 +12,7 @@ import { tryGetExecutionCtx } from "./lib/execution-ctx.js";
 import { matchesPublicPath, normalizePathname } from "./lib/public-paths.js";
 import { requestScopedEventBus } from "./lib/request-event-bus.js";
 import { requireAuth } from "./middleware/auth.js";
-import { DEFAULT_REQUEST_BODY_LIMIT_BYTES, requestBodyLimit } from "./middleware/body-size.js";
+import { DEFAULT_REQUEST_BODY_LIMIT_BYTES, MAX_GLOBAL_REQUEST_BODY_BYTES, requestBodyLimit, } from "./middleware/body-size.js";
 import { cors } from "./middleware/cors.js";
 import { db } from "./middleware/db.js";
 import { handleApiError, requestId } from "./middleware/error-boundary.js";
@@ -225,7 +225,12 @@ export function mountApp(config) {
     }
     if (config.requestBodyLimit !== false) {
         app.use("*", requestBodyLimit({
-            maxBytes: config.requestBodyLimit?.maxBytes ?? DEFAULT_REQUEST_BODY_LIMIT_BYTES,
+            // Outer ceiling sized to the largest legitimate body (uploads); the
+            // upload route enforces its own 25 MiB cap. See MAX_GLOBAL_REQUEST_BODY_BYTES.
+            maxBytes: config.requestBodyLimit?.maxBytes ?? MAX_GLOBAL_REQUEST_BODY_BYTES,
+            // JSON bodies keep the tighter 10 MiB cap (matching parseJsonBody) so
+            // migrated `.openapi()` routes aren't loosened to the upload ceiling.
+            jsonMaxBytes: config.requestBodyLimit?.jsonMaxBytes ?? DEFAULT_REQUEST_BODY_LIMIT_BYTES,
         }));
     }
     if (config.rateLimit !== false) {
@@ -384,22 +389,6 @@ export function mountApp(config) {
     const actorOptions = { basePath: config.basePath };
     app.use("/v1/admin/*", requireActor(actorOptions, "staff"));
     app.use("/v1/public/*", requireActor(actorOptions, "customer", "partner", "supplier"));
-    const requireLegacyActor = requireActor(actorOptions, "staff");
-    app.use("/v1/*", (c, next) => {
-        const pathname = normalizePathname(new URL(c.req.url).pathname, { basePath: config.basePath });
-        if (pathname.startsWith("/v1/admin/") || pathname.startsWith("/v1/public/")) {
-            return next();
-        }
-        // Anonymous legacy/webhook routes (ADR-0008) — e.g. a bundle-declared
-        // payment-processor callback at `/v1/finance/...`. `requireAuth` already
-        // skipped credential resolution for these, but it only stamps an actor on
-        // `/v1/public/*`, so without this skip the fail-closed staff guard would 401
-        // a route that is meant to be reachable without a session.
-        if (matchesPublicPath(pathname, anonymousPaths)) {
-            return next();
-        }
-        return requireLegacyActor(c, next);
-    });
     // Admin capability discovery — GET /v1/admin/_meta/capabilities. A built-in
     // framework route (like /health), mounted only when the deployment supplies
     // the operation catalogue via `config.adminMeta` (from
@@ -445,8 +434,8 @@ export function mountApp(config) {
             mountLazyRoutePaths(app, mod.lazyRoutes.paths, mod.lazyRoutes.load);
             lazyMounts.push({ prefix: "/", load: mod.lazyRoutes.load });
         }
-        if (mod.routes) {
-            app.route(`/v1/${mod.module.name}`, mod.routes);
+        if (mod.webhookRoutes) {
+            app.route(`/v1/${mod.module.name}`, mod.webhookRoutes);
         }
     }
     // Mount extension routes
@@ -471,8 +460,8 @@ export function mountApp(config) {
             mountLazyRoutePaths(app, ext.lazyRoutes.paths, ext.lazyRoutes.load);
             lazyMounts.push({ prefix: "/", load: ext.lazyRoutes.load });
         }
-        if (ext.routes) {
-            app.route(`/v1/${ext.extension.module}`, ext.routes);
+        if (ext.webhookRoutes) {
+            app.route(`/v1/${ext.extension.module}`, ext.webhookRoutes);
         }
     }
     // Additional routes

package/dist/lazy-routes.d.ts

@@ -8,7 +8,7 @@
  * route families don't inflate the main bundle or the Worker cold start.
  *
  * For deployment-local families that span MULTIPLE absolute path prefixes (e.g.
- * an operator bundle exposing `/v1/uploads`, `/v1/admin/uploads`, `/v1/media/*`),
+ * an operator bundle exposing `/v1/admin/uploads` and `/v1/admin/media/*`),
  * the single-surface loaders don't fit. Such families declare `lazyRoutes`:
  * `{ paths, load }` where `load` returns a sub-app whose routes are ABSOLUTE and
  * `paths` are the explicit matchers the framework installs up front. This is the

package/dist/middleware/body-size.d.ts

@@ -1,7 +1,25 @@
 import type { MiddlewareHandler } from "hono";
 export interface RequestBodyLimitOptions {
+    /** Outer ceiling applied to non-JSON bodies (e.g. multipart uploads). */
     maxBytes: number;
+    /**
+     * Tighter cap applied when the request `Content-Type` is `application/json`.
+     * When omitted, the outer `maxBytes` ceiling applies to JSON bodies too.
+     */
+    jsonMaxBytes?: number;
 }
 export declare const DEFAULT_REQUEST_BODY_LIMIT_BYTES: number;
+/**
+ * App-wide OUTER ceiling for the global `requestBodyLimit` mount. It must be at
+ * least the largest body any legitimate route accepts so the global stream cap
+ * never rejects valid traffic — the media upload route allows a 25 MiB file in a
+ * multipart envelope (`MAX_MULTIPART_UPLOAD_BYTES` = 25 MiB + 1 MiB in
+ * `@voyant-travel/storage`). Finer limits stay per-route: `parseJsonBody`/
+ * `readBoundedRequestText` keep the tighter `DEFAULT_REQUEST_BODY_LIMIT_BYTES`
+ * (10 MiB) for JSON, and the upload route enforces its own 25 MiB cap. Raising
+ * the global guard to a header-only check would reopen the no-Content-Length
+ * hole; lowering it below this would reject valid uploads (voyant#2114).
+ */
+export declare const MAX_GLOBAL_REQUEST_BODY_BYTES: number;
 export declare function requestBodyLimit(options: RequestBodyLimitOptions): MiddlewareHandler;
 //# sourceMappingURL=body-size.d.ts.map

package/dist/middleware/body-size.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"body-size.d.ts","sourceRoot":"","sources":["../../src/middleware/body-size.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAE7C,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,eAAO,MAAM,gCAAgC,QAAmB,CAAA;AAEhE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAuBpF"}
+{"version":3,"file":"body-size.d.ts","sourceRoot":"","sources":["../../src/middleware/body-size.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAGtD,MAAM,WAAW,uBAAuB;IACtC,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAOD,eAAO,MAAM,gCAAgC,QAAmB,CAAA;AAEhE;;;;;;;;;;GAUG;AACH,eAAO,MAAM,6BAA6B,QAAmB,CAAA;AAE7D,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAsCpF"}

package/dist/middleware/body-size.js

@@ -1,20 +1,59 @@
+import { bodyLimit } from "hono/body-limit";
+// Mirrors Hono's own `jsonRegex` (hono/dist/validator/validator.js) and the
+// openApiValidationHook content-type guard EXACTLY — case-sensitive, strict
+// params — so "this matches" ⟺ "Hono parses the body as JSON". Keep in sync.
+const JSON_CONTENT_TYPE = /^application\/([a-z-.]+\+)?json(;\s*[a-zA-Z0-9-]+=([^;]+))*$/;
 export const DEFAULT_REQUEST_BODY_LIMIT_BYTES = 10 * 1024 * 1024;
+/**
+ * App-wide OUTER ceiling for the global `requestBodyLimit` mount. It must be at
+ * least the largest body any legitimate route accepts so the global stream cap
+ * never rejects valid traffic — the media upload route allows a 25 MiB file in a
+ * multipart envelope (`MAX_MULTIPART_UPLOAD_BYTES` = 25 MiB + 1 MiB in
+ * `@voyant-travel/storage`). Finer limits stay per-route: `parseJsonBody`/
+ * `readBoundedRequestText` keep the tighter `DEFAULT_REQUEST_BODY_LIMIT_BYTES`
+ * (10 MiB) for JSON, and the upload route enforces its own 25 MiB cap. Raising
+ * the global guard to a header-only check would reopen the no-Content-Length
+ * hole; lowering it below this would reject valid uploads (voyant#2114).
+ */
+export const MAX_GLOBAL_REQUEST_BODY_BYTES = 26 * 1024 * 1024;
 export function requestBodyLimit(options) {
+    // Hono's bodyLimit checks the Content-Length header AND wraps the request body
+    // stream so it throws once the actual read exceeds maxSize. That stream cap is
+    // what bounds chunked / HTTP/2 requests with no Content-Length header — the
+    // case the previous header-only check could not catch (e.g. `.openapi()` json
+    // routes that read via c.req.json() and never went through parseJsonBody).
+    const enforceDefault = bodyLimit({
+        maxSize: options.maxBytes,
+        onError: (c) => tooLargeResponse(c, options.maxBytes),
+    });
+    // JSON bodies keep the tighter cap that `parseJsonBody` historically enforced
+    // (10 MiB) so migrated `.openapi()` routes aren't loosened to the upload
+    // ceiling. Non-JSON bodies (uploads) get the outer `maxBytes`. (voyant#2114)
+    // Clamp to `maxBytes` so the JSON cap is never LOOSER than the outer ceiling —
+    // a deployment that tightens `maxBytes` below the JSON default (e.g. a 1 MiB
+    // global override) must also tighten JSON, not silently leave it at 10 MiB.
+    const jsonMaxBytes = options.jsonMaxBytes != null ? Math.min(options.jsonMaxBytes, options.maxBytes) : null;
+    const enforceJson = jsonMaxBytes != null
+        ? bodyLimit({
+            maxSize: jsonMaxBytes,
+            onError: (c) => tooLargeResponse(c, jsonMaxBytes),
+        })
+        : null;
     return async (c, next) => {
         if (c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS") {
             return next();
         }
-        const contentLength = c.req.header("content-length");
-        if (contentLength) {
-            const size = Number(contentLength);
-            if (Number.isFinite(size) && size > options.maxBytes) {
-                return c.json({
-                    error: "Request body too large",
-                    code: "request_body_too_large",
-                    maxBytes: options.maxBytes,
-                }, 413);
-            }
+        const contentType = c.req.header("content-type");
+        if (enforceJson && contentType && JSON_CONTENT_TYPE.test(contentType)) {
+            return enforceJson(c, next);
         }
-        return next();
+        return enforceDefault(c, next);
     };
 }
+function tooLargeResponse(c, maxBytes) {
+    return c.json({
+        error: "Request body too large",
+        code: "request_body_too_large",
+        maxBytes,
+    }, 413);
+}

package/dist/module.d.ts

@@ -3,18 +3,23 @@ import type { Hono } from "hono";
 import type { LazyHonoRoutes, LazyRoutesLoader } from "./lazy-routes.js";
 export interface HonoModule {
     module: Module;
-    /**
-     * Legacy routes — mounted at `/v1/{module.name}`. Gated by the caller's
-     * `requireAuth` configuration. Use `adminRoutes` / `publicRoutes` for new
-     * modules that participate in the admin/public API split.
-     *
-     * @deprecated Prefer `adminRoutes` or `publicRoutes`.
-     */
-    routes?: Hono<any>;
     /** Staff-facing routes — mounted at `/v1/admin/{module.name}`. */
     adminRoutes?: Hono<any>;
     /** Customer/partner/supplier-facing routes — mounted at `/v1/public/{module.name}`. */
     publicRoutes?: Hono<any>;
+    /**
+     * Inbound webhook routes — e.g. a payment-processor callback POSTed by an
+     * external system with no session. Mounted at `/v1/{module.name}` (so existing
+     * processor-registered callback URLs are preserved), and their concrete paths
+     * are AUTOMATICALLY added to the anonymous allow-list (ADR-0008) — no
+     * `anonymous` declaration or `publicPaths` entry needed. The handler is
+     * responsible for verifying the provider signature. Distinct from `routes`
+     * (deprecated catch-all) and from `publicRoutes` (session-bearing customer
+     * surface): a webhook is unauthenticated by construction and verified in-band.
+     * Only concrete paths are auto-allow-listed; parameterized/wildcard webhook
+     * paths must additionally be declared via `anonymous`.
+     */
+    webhookRoutes?: Hono<any>;
     /**
      * Lazy variant of `adminRoutes` — the route bundle is dynamically imported on
      * first request and cached per isolate. Mounted at `/v1/admin/{module.name}`
@@ -66,12 +71,15 @@ export interface HonoModule {
 }
 export interface HonoExtension {
     extension: Extension;
-    /** @deprecated Prefer `adminRoutes` or `publicRoutes`. */
-    routes?: Hono<any>;
     /** Staff-facing routes — mounted at `/v1/admin/{extension.module}`. */
     adminRoutes?: Hono<any>;
     /** Customer/partner/supplier-facing routes — mounted at `/v1/public/{extension.module}`. */
     publicRoutes?: Hono<any>;
+    /**
+     * Inbound webhook routes — mounted at `/v1/{extension.module}`, concrete paths
+     * auto-added to the anonymous allow-list (ADR-0008). See `HonoModule.webhookRoutes`.
+     */
+    webhookRoutes?: Hono<any>;
     /** Lazy variant of `adminRoutes` — mounted at `/v1/admin/{extension.module}` (see HonoModule). */
     lazyAdminRoutes?: LazyRoutesLoader;
     /** Lazy variant of `publicRoutes` — mounted at `/v1/public/{publicPath ?? extension.module}`. */

package/dist/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd;;;;;;OAMG;IAEH,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,kEAAkE;IAElE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,uFAAuF;IAEvF,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAA;IACvC;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAA;IACpB,0DAA0D;IAE1D,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,uEAAuE;IAEvE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,4FAA4F;IAE5F,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB,kGAAkG;IAClG,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,gFAAgF;IAChF,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAA;IACvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExE,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,kEAAkE;IAElE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,uFAAuF;IAEvF,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB;;;;;;;;;;;OAWG;IAEH,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,4FAA4F;IAC5F,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAA;IACvC;;;;;;;;;;OAUG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,SAAS,CAAA;IACpB,uEAAuE;IAEvE,WAAW,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACvB,4FAA4F;IAE5F,YAAY,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACxB;;;OAGG;IAEH,aAAa,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IACzB,kGAAkG;IAClG,eAAe,CAAC,EAAE,gBAAgB,CAAA;IAClC,iGAAiG;IACjG,gBAAgB,CAAC,EAAE,gBAAgB,CAAA;IACnC,gFAAgF;IAChF,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAAA;IACvC;;;OAGG;IACH,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACvC"}

package/dist/openapi-validation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-validation.d.ts","sourceRoot":"","sources":["../src/openapi-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG7C;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAI9D,CAAA"}
+{"version":3,"file":"openapi-validation.d.ts","sourceRoot":"","sources":["../src/openapi-validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAA;AAG7C;;;;;;;;;;;;;;;;GAgBG;AAIH,eAAO,MAAM,qBAAqB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAoB9D,CAAA"}

package/dist/openapi-validation.js

@@ -19,7 +19,23 @@ import { normalizeValidationError, RequestValidationError } from "./validation.j
 // Typed as the library's own `defaultHook` shape (`Hook<any, E, any, any>`) so
 // it stays assignable for every module's specific `OpenAPIHono<Env>`.
 // biome-ignore lint/suspicious/noExplicitAny: matches @hono/zod-openapi's defaultHook signature
-export const openApiValidationHook = (result) => {
+export const openApiValidationHook = (result, c) => {
+    // Hono's json validator yields `{}` (not a parse) when the request's
+    // content-type isn't one its parser accepts; partial PATCH schemas then
+    // validate `{}` and silently no-op. Enforce the content-type the route's
+    // contract declares so a missing/unaccepted header is a clean invalid_request
+    // 400 (voyant#2114, §16). The pattern MIRRORS Hono's own `jsonRegex`
+    // (hono/dist/validator/validator.js) EXACTLY — case-sensitive, strict params —
+    // so "this guard accepts" ⟺ "Hono parses the body". A laxer check (e.g. a
+    // case-insensitive match or a bare trailing `;`) would admit content-types
+    // Hono leaves unparsed, reintroducing the silent no-op. Keep in sync with Hono.
+    if (result.target === "json") {
+        const contentType = c.req.header("content-type");
+        const jsonContentType = /^application\/([a-z-.]+\+)?json(;\s*[a-zA-Z0-9-]+=([^;]+))*$/;
+        if (!contentType || !jsonContentType.test(contentType)) {
+            throw new RequestValidationError("Expected request Content-Type: application/json");
+        }
+    }
     if (!result.success) {
         throw normalizeValidationError(result.error) ?? new RequestValidationError("Invalid request");
     }

package/dist/public-document-delivery.d.ts

@@ -71,25 +71,25 @@ export declare function createDrizzlePublicDocumentDeliveryGrantStore(db: Postgr
 export declare function createPublicDocumentDeliveryGrant(store: PublicDocumentDeliveryGrantStore, input: CreatePublicDocumentDeliveryInput): Promise<PublicDocumentDeliveryEnvelope>;
 export declare function resolvePublicDocumentDeliveryGrant(store: PublicDocumentDeliveryGrantStore, token: string, now?: Date): Promise<PublicDocumentDeliveryResolution>;
 export declare function revokePublicDocumentDeliveryGrant(store: PublicDocumentDeliveryGrantStore, input: RevokePublicDocumentDeliveryGrantInput): Promise<{
-    metadata: unknown;
     id: string;
     createdAt: Date;
     expiresAt: Date;
-    revokedAt: Date | null;
-    tokenHash: string;
-    createdBy: string | null;
+    metadata: unknown;
     filename: string | null;
+    tokenHash: string;
     storageKey: string;
     storageProvider: string | null;
     contentType: string;
     sourceModule: string | null;
     sourceEntity: string | null;
     sourceId: string | null;
+    createdBy: string | null;
     createdByType: string | null;
     accessCount: number;
     lastAccessedAt: Date | null;
     lastAccessedIp: string | null;
     lastAccessedUserAgent: string | null;
+    revokedAt: Date | null;
     revokedBy: string | null;
 } | null>;
 export declare function createPublicDocumentDeliveryRoutes<TBindings extends object = Record<string, unknown>>(options?: PublicDocumentDeliveryRouteOptions<TBindings>): import("hono/hono-base").HonoBase<Env<TBindings>, {

package/dist/types.d.ts

@@ -242,12 +242,14 @@ export interface VoyantAppConfig<TBindings extends VoyantBindings = VoyantBindin
      */
     metrics?: boolean;
     /**
-     * Default request body limit enforced by `Content-Length` before route
-     * handlers parse JSON/form data. Enabled by default at 10 MiB. Set
-     * `false` to disable or pass `{ maxBytes }` to override.
+     * Default request body limit enforced before route handlers parse
+     * JSON/form data. Content-type-aware: JSON bodies are capped at 10 MiB
+     * (`jsonMaxBytes`), non-JSON bodies (uploads) at the 26 MiB outer ceiling
+     * (`maxBytes`). Set `false` to disable, or override either cap.
      */
     requestBodyLimit?: false | {
-        maxBytes: number;
+        maxBytes?: number;
+        jsonMaxBytes?: number;
     };
     /**
      * Default app-wide security headers. Enabled by default. Set `false`

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,eAAe,IAAI,mBAAmB,EACtC,QAAQ,EACR,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,4BAA4B,CAAA;IAChF;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,0BAA0B,CAAA;CACvE;AAED,MAAM,MAAM,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAC7E,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,QAAQ,CAAA;IACZ,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,mEAAmE;IACnE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,iCAAiC,EAAE,cAAc,CAAA;IACzE,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAA;CACvE,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,SAAS,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAAI,CACzE,GAAG,EAAE,SAAS,KACX,QAAQ,GAAG,YAAY,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACnF,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAClF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,MAAM,QAAQ,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAClE,SAAS,CAAC,SAAS,CAAC,GACpB,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAEhC,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,cAAc,EAClE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAExC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,SAAS,SAAS,cAAc,EAC9D,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,SAAS,CAAC,CAEtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG;IACtE,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B,CAOA;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,SAAS,CAAA;IACd,EAAE,EAAE,QAAQ,CAAA;IACZ,GAAG,CAAC,EAAE,sBAAsB,CAAA;CAC7B;AAED,MAAM,WAAW,wBAAwB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CACzF,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,wBAAwB,CAAA;CAC/B;AAED,MAAM,WAAW,8BAA8B,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CAC/F,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,YAAY,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK;QAC5B,KAAK,EAAE,CACL,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,sBAAsB,KACzB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAClC,CAAA;IACD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CACR,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,KACnC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAC/E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IACzF,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACjG;AAED,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAChF,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACtC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,iBAAiB,GAAG,kBAAkB,CAAA;IAC9C,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,8BAA8B,EAAE,kBAAkB,CAAA;IAC/E;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/C;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,OAAO,kCAAkC,EAAE,sBAAsB,CAAA;IAC3F;;;;OAIG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,OAAO,4BAA4B,EAAE,eAAe,CAAA;IACxE;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QACV,eAAe,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,aAAa,CAAC;YACxB,EAAE,EAAE,MAAM,CAAA;YACV,MAAM,EAAE,MAAM,CAAA;YACd,YAAY,EAAE,MAAM,CAAA;YACpB,cAAc,EAAE,MAAM,CAAA;YACtB,MAAM,EAAE,MAAM,EAAE,CAAA;YAChB,aAAa,CAAC,EAAE,MAAM,CAAA;SACvB,CAAC,CAAA;KACH,CAAA;IAED,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,qBAAqB,CAAC,SAAS,GAAG,OAAO;IACxD;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,aAAa,CAAA;IAC9C;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAA;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,eAAe,IAAI,mBAAmB,EACtC,QAAQ,EACR,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EACjB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEhE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,KAAK,EAAE,YAAY,IAAI,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AACjE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;IAC/C,sBAAsB,CAAC,EAAE,MAAM,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,uBAAuB,CAAC,EAAE,MAAM,CAAA;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,YAAY,CAAC,EAAE,OAAO,4BAA4B,EAAE,4BAA4B,CAAA;IAChF;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,yBAAyB,EAAE,0BAA0B,CAAA;CACvE;AAED,MAAM,MAAM,QAAQ,GAAG,kBAAkB,GAAG,gBAAgB,GAAG,cAAc,CAAA;AAC7E,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAA;AAE5C,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG;IAClD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,EAAE,EAAE,QAAQ,CAAA;IACZ,oEAAoE;IACpE,SAAS,EAAE,eAAe,CAAA;IAC1B,QAAQ,EAAE,QAAQ,CAAA;IAClB,mEAAmE;IACnE,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,oEAAoE;IACpE,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,iFAAiF;IACjF,cAAc,CAAC,EAAE,OAAO,iCAAiC,EAAE,cAAc,CAAA;IACzE,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,yBAAyB,EAAE,gBAAgB,CAAA;CACvE,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC7B;AAED,MAAM,MAAM,SAAS,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAAI,CACzE,GAAG,EAAE,SAAS,KACX,QAAQ,GAAG,YAAY,CAAA;AAE5B;;;GAGG;AACH,MAAM,WAAW,kBAAkB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACnF,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IAC7B;;;;;OAKG;IACH,uBAAuB,EAAE,OAAO,CAAA;CACjC;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,iBAAiB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAClF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;CACpD;AAED,wEAAwE;AACxE,MAAM,MAAM,QAAQ,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,IAClE,SAAS,CAAC,SAAS,CAAC,GACpB,iBAAiB,CAAC,SAAS,CAAC,CAAA;AAEhC,wBAAgB,mBAAmB,CAAC,SAAS,SAAS,cAAc,EAClE,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC1B,MAAM,IAAI,iBAAiB,CAAC,SAAS,CAAC,CAExC;AAED,kEAAkE;AAClE,wBAAgB,eAAe,CAAC,SAAS,SAAS,cAAc,EAC9D,MAAM,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC3B,IAAI,EAAE,MAAM,GACX,SAAS,CAAC,SAAS,CAAC,CAEtB;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG,KAAK,IAAI,YAAY,CAKpF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,QAAQ,GAAG,YAAY,GAAG;IACtE,EAAE,EAAE,QAAQ,CAAA;IACZ,OAAO,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC9B,CAOA;AAED;;;;;GAKG;AACH,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,GAAG;IACxE,MAAM,EAAE,MAAM,CAAA;IACd,KAAK,EAAE,KAAK,CAAA;CACb,CAAA;AAED,MAAM,WAAW,QAAQ;IACvB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAAA;CAC3B;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,SAAS,CAAA;IACd,EAAE,EAAE,QAAQ,CAAA;IACZ,GAAG,CAAC,EAAE,sBAAsB,CAAA;CAC7B;AAED,MAAM,WAAW,wBAAwB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CACzF,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,UAAU,EAAE,gBAAgB,CAAA;IAC5B,IAAI,EAAE,wBAAwB,CAAA;CAC/B;AAED,MAAM,WAAW,8BAA8B,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc,CAC/F,SAAQ,qBAAqB,CAAC,SAAS,CAAC;IACxC,MAAM,EAAE,YAAY,CAAA;CACrB;AAED,MAAM,WAAW,qBAAqB,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IACtF,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,KAAK;QAC5B,KAAK,EAAE,CACL,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,SAAS,EACd,GAAG,CAAC,EAAE,sBAAsB,KACzB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;KAClC,CAAA;IACD;;;;;;;;OAQG;IACH,OAAO,CAAC,EAAE,CACR,IAAI,EAAE,qBAAqB,CAAC,SAAS,CAAC,KACnC,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,GAAG,wBAAwB,GAAG,IAAI,CAAA;IAC/E,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,wBAAwB,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IACzF,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,8BAA8B,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CACjG;AAED,MAAM,WAAW,eAAe,CAAC,SAAS,SAAS,cAAc,GAAG,cAAc;IAChF,EAAE,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACxB;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAA;IACtC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC/B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAC5B,OAAO,CAAC,EAAE,UAAU,EAAE,CAAA;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,IAAI,CAAC,EAAE,WAAW,CAAA;IAClB,KAAK,CAAC,EAAE,iBAAiB,GAAG,kBAAkB,CAAA;IAC9C,IAAI,CAAC,EAAE,qBAAqB,CAAC,SAAS,CAAC,CAAA;IACvC;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,cAAc,CAAA;IACvB;;;;;;;;;OASG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;;OAQG;IACH,WAAW,CAAC,EAAE,KAAK,GAAG,OAAO,8BAA8B,EAAE,kBAAkB,CAAA;IAC/E;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,KAAK,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACvE;;;OAGG;IACH,eAAe,CAAC,EAAE,KAAK,GAAG,OAAO,kCAAkC,EAAE,sBAAsB,CAAA;IAC3F;;;;OAIG;IACH,SAAS,CAAC,EAAE,KAAK,GAAG,OAAO,4BAA4B,EAAE,eAAe,CAAA;IACxE;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE;QACV,eAAe,EAAE,MAAM,CAAA;QACvB,iBAAiB,CAAC,EAAE,MAAM,CAAA;QAC1B,UAAU,EAAE,aAAa,CAAC;YACxB,EAAE,EAAE,MAAM,CAAA;YACV,MAAM,EAAE,MAAM,CAAA;YACd,YAAY,EAAE,MAAM,CAAA;YACpB,cAAc,EAAE,MAAM,CAAA;YACtB,MAAM,EAAE,MAAM,EAAE,CAAA;YAChB,aAAa,CAAC,EAAE,MAAM,CAAA;SACvB,CAAC,CAAA;KACH,CAAA;IAED,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,CAAA;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,WAAW,qBAAqB,CAAC,SAAS,GAAG,OAAO;IACxD;;;;OAIG;IACH,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,KAAK,aAAa,CAAA;IAC9C;;;;OAIG;IACH,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,CAAA;IACtD;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED;;;;GAIG"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.117.1",
+  "version": "0.118.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -137,17 +137,17 @@
     "zod": "^4.3.6",
     "@voyant-travel/core": "^0.111.0",
     "@voyant-travel/db": "^0.109.4",
-    "@voyant-travel/storage": "^0.105.0",
+    "@voyant-travel/storage": "^0.106.0",
     "@voyant-travel/types": "^0.106.0",
     "@voyant-travel/utils": "^0.105.4",
-    "@voyant-travel/workflows": "^0.111.9"
+    "@voyant-travel/workflows": "^0.111.10"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260426.1",
     "typescript": "^6.0.2",
     "vitest": "^4.1.2",
-    "@voyant-travel/workflows-orchestrator": "^0.111.9",
-    "@voyant-travel/voyant-typescript-config": "^0.1.0"
+    "@voyant-travel/voyant-typescript-config": "^0.1.0",
+    "@voyant-travel/workflows-orchestrator": "^0.111.10"
   },
   "files": [
     "dist"
@@ -161,10 +161,10 @@
     "directory": "packages/hono"
   },
   "scripts": {
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc -p tsconfig.typecheck.json",
     "lint": "biome check src/",
     "test": "vitest run",
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.build.json",
     "clean": "rm -rf dist tsconfig.tsbuildinfo"
   },
   "main": "./dist/index.js",