@voyant-travel/hono 0.118.3 → 0.119.0

package/dist/app.d.ts

@@ -17,6 +17,20 @@ export interface LazyMount {
     prefix: string;
     load: LazyRoutesLoader;
 }
+/**
+ * A single module route mount recorded at mount time so a build-time generator
+ * can produce one self-contained OpenAPI document per module (voyant#2733).
+ * Mirrors `ModuleMount` in `./openapi.ts` (structurally identical, declared here
+ * to keep the build-time-only openapi module out of the runtime path). `load`
+ * returns the sub-app without serving it — eager mounts wrap the already-built
+ * routes as `() => routes`; lazy mounts pass their loader.
+ */
+export interface ModuleMount {
+    moduleName: string;
+    /** Absolute surface mount prefix, or `"/"` for absolute `lazyRoutes`. */
+    prefix: string;
+    load: () => Hono<any, any, any> | Promise<Hono<any, any, any>>;
+}
 /**
  * App handle returned alongside the Hono instance. Carries `ready()` for
  * headless / sibling-process deployments that need to fire the lazy
@@ -59,6 +73,14 @@ export interface VoyantAppExtensions<TBindings = unknown> {
      * `.openapi()` operations via `mergeLazyOpenApiPaths`. Never read at runtime.
      */
     lazyMounts: LazyMount[];
+    /**
+     * Every module route mount (admin + public, eager + lazy), tagged with its
+     * owning module name (voyant#2733). A build-time generator reads this to
+     * produce one self-contained OpenAPI document per module via
+     * `generateModuleOpenApiDocuments`, keeping the module boundary authoritative
+     * rather than guessed from path prefixes. Never read at runtime.
+     */
+    moduleMounts: ModuleMount[];
 }
 /**
  * Low-level app factory: given an already-resolved `modules`/`extensions` set

package/dist/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA+BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAue5D"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAQhC,OAAO,EAAE,KAAK,gBAAgB,EAA0C,MAAM,kBAAkB,CAAA;AA+BhG,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAY,eAAe,EAAE,MAAM,YAAY,CAAA;AAI5F,4EAA4E;AAC5E,KAAK,QAAQ,CAAC,SAAS,SAAS,cAAc,IAAI;IAChD,QAAQ,EAAE,SAAS,CAAA;IACnB,SAAS,EAAE,eAAe,CAAA;CAC3B,CAAA;AAuBD;;;;;GAKG;AACH,MAAM,WAAW,SAAS;IACxB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAA;IAEd,IAAI,EAAE,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;CAC/D;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,mBAAmB,CAAC,SAAS,GAAG,OAAO;IACtD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1C;;;;;;;;OAQG;IACH,QAAQ,EAAE,OAAO,qBAAqB,EAAE,QAAQ,CAAA;IAChD;;;;;OAKG;IACH,UAAU,EAAE,SAAS,EAAE,CAAA;IACvB;;;;;;OAMG;IACH,YAAY,EAAE,WAAW,EAAE,CAAA;CAC5B;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,SAAS,SAAS,cAAc,EACvD,MAAM,EAAE,eAAe,CAAC,SAAS,CAAC,GACjC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,GAAG,mBAAmB,CAAC,SAAS,CAAC,CA+f5D"}

package/dist/app.js

@@ -410,56 +410,79 @@ export function mountApp(config) {
     // them so the prefix logic is single-sourced here. Cheap array pushes — no
     // eager `import()` and no runtime read.
     const lazyMounts = [];
+    // Per-module OpenAPI generation manifest (voyant#2733). Recorded alongside the
+    // mount so the module name + real prefix are single-sourced here; `publicPath`
+    // overrides are captured with their actual mount, not re-derived. Eager routes
+    // are wrapped as `() => routes` so the generator's loader-based path is
+    // uniform across eager + lazy. Webhook routes are intentionally excluded — the
+    // per-module docs cover the admin/storefront surfaces only.
+    const moduleMounts = [];
     // Mount module routes
     for (const mod of allModules) {
-        const adminPrefix = `/v1/admin/${mod.module.name}`;
-        const publicPrefix = resolveSurfaceMountPath("/v1/public", mod.publicPath, mod.module.name);
+        const moduleName = mod.module.name;
+        const adminPrefix = `/v1/admin/${moduleName}`;
+        const publicPrefix = resolveSurfaceMountPath("/v1/public", mod.publicPath, moduleName);
         if (mod.adminRoutes) {
-            app.route(adminPrefix, mod.adminRoutes);
+            const adminRoutes = mod.adminRoutes;
+            app.route(adminPrefix, adminRoutes);
+            moduleMounts.push({ moduleName, prefix: adminPrefix, load: () => adminRoutes });
         }
         if (mod.publicRoutes) {
-            app.route(publicPrefix, mod.publicRoutes);
+            const publicRoutes = mod.publicRoutes;
+            app.route(publicPrefix, publicRoutes);
+            moduleMounts.push({ moduleName, prefix: publicPrefix, load: () => publicRoutes });
         }
         if (mod.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, mod.lazyAdminRoutes);
             lazyMounts.push({ prefix: adminPrefix, load: mod.lazyAdminRoutes });
+            moduleMounts.push({ moduleName, prefix: adminPrefix, load: mod.lazyAdminRoutes });
         }
         if (mod.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, mod.lazyPublicRoutes);
             lazyMounts.push({ prefix: publicPrefix, load: mod.lazyPublicRoutes });
+            moduleMounts.push({ moduleName, prefix: publicPrefix, load: mod.lazyPublicRoutes });
         }
         if (mod.lazyRoutes) {
             mountLazyRoutePaths(app, mod.lazyRoutes.paths, mod.lazyRoutes.load);
             lazyMounts.push({ prefix: "/", load: mod.lazyRoutes.load });
+            moduleMounts.push({ moduleName, prefix: "/", load: mod.lazyRoutes.load });
         }
         if (mod.webhookRoutes) {
-            app.route(`/v1/${mod.module.name}`, mod.webhookRoutes);
+            app.route(`/v1/${moduleName}`, mod.webhookRoutes);
         }
     }
     // Mount extension routes
     for (const ext of allExtensions) {
-        const adminPrefix = `/v1/admin/${ext.extension.module}`;
-        const publicPrefix = resolveSurfaceMountPath("/v1/public", ext.publicPath, ext.extension.module);
+        const moduleName = ext.extension.module;
+        const adminPrefix = `/v1/admin/${moduleName}`;
+        const publicPrefix = resolveSurfaceMountPath("/v1/public", ext.publicPath, moduleName);
         if (ext.adminRoutes) {
-            app.route(adminPrefix, ext.adminRoutes);
+            const adminRoutes = ext.adminRoutes;
+            app.route(adminPrefix, adminRoutes);
+            moduleMounts.push({ moduleName, prefix: adminPrefix, load: () => adminRoutes });
         }
         if (ext.publicRoutes) {
-            app.route(publicPrefix, ext.publicRoutes);
+            const publicRoutes = ext.publicRoutes;
+            app.route(publicPrefix, publicRoutes);
+            moduleMounts.push({ moduleName, prefix: publicPrefix, load: () => publicRoutes });
         }
         if (ext.lazyAdminRoutes) {
             mountLazyRoutesAt(app, adminPrefix, ext.lazyAdminRoutes);
             lazyMounts.push({ prefix: adminPrefix, load: ext.lazyAdminRoutes });
+            moduleMounts.push({ moduleName, prefix: adminPrefix, load: ext.lazyAdminRoutes });
         }
         if (ext.lazyPublicRoutes) {
             mountLazyRoutesAt(app, publicPrefix, ext.lazyPublicRoutes);
             lazyMounts.push({ prefix: publicPrefix, load: ext.lazyPublicRoutes });
+            moduleMounts.push({ moduleName, prefix: publicPrefix, load: ext.lazyPublicRoutes });
         }
         if (ext.lazyRoutes) {
             mountLazyRoutePaths(app, ext.lazyRoutes.paths, ext.lazyRoutes.load);
             lazyMounts.push({ prefix: "/", load: ext.lazyRoutes.load });
+            moduleMounts.push({ moduleName, prefix: "/", load: ext.lazyRoutes.load });
         }
         if (ext.webhookRoutes) {
-            app.route(`/v1/${ext.extension.module}`, ext.webhookRoutes);
+            app.route(`/v1/${moduleName}`, ext.webhookRoutes);
         }
     }
     // Additional routes
@@ -477,6 +500,7 @@ export function mountApp(config) {
     const augmented = app;
     augmented.eventBus = eventBus;
     augmented.lazyMounts = lazyMounts;
+    augmented.moduleMounts = moduleMounts;
     augmented.ready = (bindings) => ensureRuntimeBootstrapped(bindings ?? {});
     return augmented;
 }

package/dist/lib/request-event-bus.d.ts

@@ -10,9 +10,10 @@ import type { EventBus, OutboxEventStore } from "@voyant-travel/core";
  * With a `store` (transactional outbox), emits are also DURABLE: the
  * envelope is persisted before any handler runs, and failed deliveries
  * are retried by the drain. If the durable capture itself fails (DB
- * unreachable), the emit falls back to direct (non-durable) delivery —
- * losing durability for that one event is strictly better than losing
- * the event, and an order of magnitude better than failing the request.
+ * unreachable), the emit falls back to direct (non-durable) delivery.
+ * Once capture has succeeded, the wrapper must not redeliver directly:
+ * the stored row owns completion/retry, and direct fallback would make
+ * subscriber side effects ambiguous.
  *
  * Buses that predate the {@link EmitOptions} parameter simply ignore it
  * and keep awaiting all handlers — a safe degradation.

package/dist/lib/request-event-bus.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-event-bus.d.ts","sourceRoot":"","sources":["../../src/lib/request-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEjG;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,QAAQ,EACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,gBAAgB,GACvB,QAAQ,CA+BV"}
+{"version":3,"file":"request-event-bus.d.ts","sourceRoot":"","sources":["../../src/lib/request-event-bus.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,QAAQ,EAAiB,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEjG;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,QAAQ,EACb,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,GAAG,SAAS,EAC3D,KAAK,CAAC,EAAE,gBAAgB,GACvB,QAAQ,CAiDV"}

package/dist/lib/request-event-bus.js

@@ -9,9 +9,10 @@
  * With a `store` (transactional outbox), emits are also DURABLE: the
  * envelope is persisted before any handler runs, and failed deliveries
  * are retried by the drain. If the durable capture itself fails (DB
- * unreachable), the emit falls back to direct (non-durable) delivery —
- * losing durability for that one event is strictly better than losing
- * the event, and an order of magnitude better than failing the request.
+ * unreachable), the emit falls back to direct (non-durable) delivery.
+ * Once capture has succeeded, the wrapper must not redeliver directly:
+ * the stored row owns completion/retry, and direct fallback would make
+ * subscriber side effects ambiguous.
  *
  * Buses that predate the {@link EmitOptions} parameter simply ignore it
  * and keep awaiting all handlers — a safe degradation.
@@ -26,12 +27,28 @@ export function requestScopedEventBus(bus, schedule, store) {
             if (!store) {
                 return bus.emit(event, data, metadata, { ...base, ...options });
             }
+            let captureFailed = false;
+            const guardedStore = {
+                async insert(envelope) {
+                    try {
+                        return await store.insert(envelope);
+                    }
+                    catch (err) {
+                        captureFailed = true;
+                        throw err;
+                    }
+                },
+                complete: (id) => store.complete(id),
+                fail: (id, error) => store.fail(id, error),
+            };
             try {
-                return await bus.emit(event, data, metadata, { ...base, store, ...options });
+                return await bus.emit(event, data, metadata, { ...base, store: guardedStore, ...options });
             }
             catch (err) {
-                // Only the outbox insert can reject (handler errors are
-                // collected, bookkeeping failures are swallowed inside the bus).
+                if (!captureFailed) {
+                    console.error(`[events] durable delivery failed for "${event}" after outbox capture:`, err);
+                    return;
+                }
                 console.error(`[events] outbox capture failed for "${event}" — falling back to direct delivery:`, err);
                 return bus.emit(event, data, metadata, { ...base, ...options });
             }

package/dist/openapi.d.ts

@@ -66,6 +66,23 @@ export interface LazyMount {
     prefix: string;
     load: LazyRoutesLoader;
 }
+/**
+ * A single module route mount recorded by `mountApp` for build-time per-module
+ * spec generation (voyant#2733). One module contributes several mounts (admin +
+ * public, eager + lazy), all tagged with the same `moduleName` — so the module
+ * boundary is the authoritative one from the registration, not a path-prefix
+ * guess. `prefix` is the real absolute mount (base path included), so the
+ * generated per-module doc carries correct absolute paths — including
+ * `publicPath` overrides whose prefix isn't the module name (e.g. a module that
+ * mounts its storefront routes under `/v1/public/booking-engine`). `load`
+ * returns the sub-app without serving it (eager mounts wrap the already-built
+ * app as `() => routes`; lazy mounts pass their loader).
+ */
+export interface ModuleMount {
+    moduleName: string;
+    prefix: string;
+    load: () => AnyApp | Promise<AnyApp>;
+}
 /**
  * Eager-merge lazy route families into a generated base document (voyant#2114).
  *
@@ -86,5 +103,51 @@ export interface LazyMount {
  * (`@asteasolutions/zod-to-openapi` stays out of the Worker bundle).
  */
 export declare function mergeLazyOpenApiPaths(base: OpenApiDocument, mounts: readonly LazyMount[], options: GenerateOpenApiOptions): Promise<OpenApiDocument>;
+/**
+ * Generate one self-contained OpenAPI document per module from its recorded
+ * mounts (voyant#2733).
+ *
+ * Instead of building one giant composed document and splitting it by path
+ * prefix, this generates each module's spec directly from the routes the module
+ * registered — the authoritative module boundary. Each module's admin + public
+ * (+ lazy) sub-apps are re-mounted into a throwaway `OpenAPIHono` at their real
+ * absolute prefix (reusing the exact prefix-merge `OpenAPIHono.route(...)`
+ * applies), then its `getOpenAPI31Document()` is read. The returned docs are
+ * self-contained (each carries its own referenced components), so they render
+ * and diff cleanly on their own — unlike a 7 MB aggregate.
+ *
+ * A mount whose loader throws, or that returns a plain `Hono` with no
+ * `.openapi()` registry, is skipped without failing the module. Modules that
+ * contribute no documented operation are omitted from the result entirely.
+ *
+ * Build-time only — same constraint as the rest of this module
+ * (`@asteasolutions/zod-to-openapi` must stay out of the Worker bundle).
+ */
+export declare function generateModuleOpenApiDocuments(mounts: readonly ModuleMount[], options: GenerateOpenApiOptions): Promise<Map<string, OpenApiDocument>>;
+/**
+ * Partition a composed document into one document per module, covering EVERY
+ * admin/storefront path (voyant#2733).
+ *
+ * `generateModuleOpenApiDocuments` alone only sees routes recorded in the module
+ * mount manifest — it misses `additionalRoutes` and any route mounted directly
+ * on the composed app (e.g. the operator's workflow-runs admin surface, the
+ * `_meta/capabilities` route). Those were present in the old committed aggregate
+ * and must not silently vanish from the committed per-module specs.
+ *
+ * This uses the manifest as the *authoritative* owner for the routes it knows
+ * about — which is what makes `publicPath` overrides (whose prefix isn't the
+ * module name, e.g. `/v1/public/booking-engine`) land under the right module —
+ * and falls back to the path's own second segment for anything the manifest
+ * doesn't claim. The result therefore partitions the full surface exactly: every
+ * `/v1/admin/*` and `/v1/public/*` path lands in exactly one module document.
+ * Non-surface routes (`/v1/<name>` webhooks, legacy `/v1/*`) live only in the
+ * aggregate, as before.
+ *
+ * Each per-module document carries the aggregate's shared `components` verbatim
+ * (there is ~one), so it stays a valid, self-contained OpenAPI document.
+ *
+ * Build-time only.
+ */
+export declare function splitDocumentByModule(full: OpenApiDocument, mounts: readonly ModuleMount[], options: GenerateOpenApiOptions): Promise<Map<string, OpenApiDocument>>;
 export {};
 //# sourceMappingURL=openapi.d.ts.map

package/dist/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA8D1B"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAC/C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAEhC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAExD;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,8EAA8E;IAC9E,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAAA;CACpC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,WAAW,CAAA;IACjB,OAAO,CAAC,EAAE,aAAa,EAAE,CAAA;CAC1B;AAGD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;AAEjC;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAA;AAE7E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,GAC9B,eAAe,CASjB;AAED;;;;GAIG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,YAAY,CAAA;AAO/C;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,eAAe,CAMxF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,gBAAgB,CAAA;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACrC;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,SAAS,EAAE,EAC5B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,eAAe,CAAC,CA8D1B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAsCvC;AAOD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,eAAe,EACrB,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CA4BvC"}

package/dist/openapi.js

@@ -112,3 +112,121 @@ export async function mergeLazyOpenApiPaths(base, mounts, options) {
     }
     return merged;
 }
+/**
+ * Generate one self-contained OpenAPI document per module from its recorded
+ * mounts (voyant#2733).
+ *
+ * Instead of building one giant composed document and splitting it by path
+ * prefix, this generates each module's spec directly from the routes the module
+ * registered — the authoritative module boundary. Each module's admin + public
+ * (+ lazy) sub-apps are re-mounted into a throwaway `OpenAPIHono` at their real
+ * absolute prefix (reusing the exact prefix-merge `OpenAPIHono.route(...)`
+ * applies), then its `getOpenAPI31Document()` is read. The returned docs are
+ * self-contained (each carries its own referenced components), so they render
+ * and diff cleanly on their own — unlike a 7 MB aggregate.
+ *
+ * A mount whose loader throws, or that returns a plain `Hono` with no
+ * `.openapi()` registry, is skipped without failing the module. Modules that
+ * contribute no documented operation are omitted from the result entirely.
+ *
+ * Build-time only — same constraint as the rest of this module
+ * (`@asteasolutions/zod-to-openapi` must stay out of the Worker bundle).
+ */
+export async function generateModuleOpenApiDocuments(mounts, options) {
+    const byModule = new Map();
+    for (const mount of mounts) {
+        const list = byModule.get(mount.moduleName);
+        if (list)
+            list.push(mount);
+        else
+            byModule.set(mount.moduleName, [mount]);
+    }
+    const result = new Map();
+    for (const [moduleName, moduleMounts] of byModule) {
+        const throwaway = new OpenAPIHono();
+        let mountedAny = false;
+        for (const { prefix, load } of moduleMounts) {
+            let subApp;
+            try {
+                subApp = await load();
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                console.warn(`[voyant] openapi: module "${moduleName}" mount at "${prefix}" failed to load, skipping: ${message}`);
+                continue;
+            }
+            if (!isOpenApiHono(subApp))
+                continue;
+            throwaway.route(prefix === "/" ? "/" : prefix, subApp);
+            mountedAny = true;
+        }
+        if (!mountedAny)
+            continue;
+        const doc = throwaway.getOpenAPI31Document({
+            openapi: "3.1.0",
+            info: options.info,
+            ...(options.servers ? { servers: options.servers } : {}),
+        });
+        if (!doc.paths || Object.keys(doc.paths).length === 0)
+            continue;
+        result.set(moduleName, doc);
+    }
+    return result;
+}
+/** Second path segment after the surface prefix — `/v1/admin/<seg>/...`. */
+function moduleSegment(path) {
+    return path.split("/")[3] ?? "misc";
+}
+/**
+ * Partition a composed document into one document per module, covering EVERY
+ * admin/storefront path (voyant#2733).
+ *
+ * `generateModuleOpenApiDocuments` alone only sees routes recorded in the module
+ * mount manifest — it misses `additionalRoutes` and any route mounted directly
+ * on the composed app (e.g. the operator's workflow-runs admin surface, the
+ * `_meta/capabilities` route). Those were present in the old committed aggregate
+ * and must not silently vanish from the committed per-module specs.
+ *
+ * This uses the manifest as the *authoritative* owner for the routes it knows
+ * about — which is what makes `publicPath` overrides (whose prefix isn't the
+ * module name, e.g. `/v1/public/booking-engine`) land under the right module —
+ * and falls back to the path's own second segment for anything the manifest
+ * doesn't claim. The result therefore partitions the full surface exactly: every
+ * `/v1/admin/*` and `/v1/public/*` path lands in exactly one module document.
+ * Non-surface routes (`/v1/<name>` webhooks, legacy `/v1/*`) live only in the
+ * aggregate, as before.
+ *
+ * Each per-module document carries the aggregate's shared `components` verbatim
+ * (there is ~one), so it stays a valid, self-contained OpenAPI document.
+ *
+ * Build-time only.
+ */
+export async function splitDocumentByModule(full, mounts, options) {
+    const moduleDocs = await generateModuleOpenApiDocuments(mounts, options);
+    const owner = new Map();
+    for (const [moduleName, doc] of moduleDocs) {
+        for (const path of Object.keys(doc.paths ?? {}))
+            owner.set(path, moduleName);
+    }
+    const buckets = new Map();
+    for (const [path, item] of Object.entries(full.paths ?? {})) {
+        if (!path.startsWith("/v1/admin/") && !path.startsWith("/v1/public/"))
+            continue;
+        const moduleName = owner.get(path) ?? moduleSegment(path);
+        let bucket = buckets.get(moduleName);
+        if (!bucket) {
+            bucket = {};
+            buckets.set(moduleName, bucket);
+        }
+        bucket[path] = item;
+    }
+    const result = new Map();
+    for (const [moduleName, paths] of buckets) {
+        result.set(moduleName, {
+            ...full,
+            paths,
+            ...(full.components ? { components: full.components } : {}),
+        });
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voyant-travel/hono",
-  "version": "0.118.3",
+  "version": "0.119.0",
   "license": "Apache-2.0",
   "type": "module",
   "exports": {
@@ -135,19 +135,19 @@
     "drizzle-orm": "^0.45.2",
     "hono": "^4.12.25",
     "zod": "^4.4.3",
-    "@voyant-travel/core": "^0.111.0",
+    "@voyant-travel/core": "^0.111.1",
     "@voyant-travel/db": "^0.109.4",
     "@voyant-travel/storage": "^0.106.0",
     "@voyant-travel/types": "^0.106.1",
     "@voyant-travel/utils": "^0.105.5",
-    "@voyant-travel/workflows": "^0.111.12"
+    "@voyant-travel/workflows": "^0.111.13"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260628.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.9",
     "@voyant-travel/voyant-typescript-config": "^0.1.0",
-    "@voyant-travel/workflows-orchestrator": "^0.111.12"
+    "@voyant-travel/workflows-orchestrator": "^0.111.13"
   },
   "files": [
     "dist"