@zudojs/api 1.1.0 → 1.2.0

package/dist/api/bindings/shared/apiBinding.helper.js

@@ -0,0 +1,66 @@
+import { findUnsafeKey } from "@zudojs/security";
+import { APIExecutor } from "../../executor/executor.core.js";
+import { normalizeAPIError } from "../../executor/executor.core.js";
+import { APIOperationRegistry } from "../../registry/operationRegistry.core.js";
+import { assertValidOperationShape } from "../../operation/operation.type.js";
+import { apiFailure } from "../../result/apiResult.type.js";
+import { APIValidationError } from "../../errors/index.js";
+import { createAPIContext, isValidRequestId, normalizeRequestId, } from "../../context/context.type.js";
+import { CorrelationIdContextKey, TransportContextKey, } from "../../context/contextKey.type.js";
+/**
+ * Lists the operations of a source, validating a plain list the way the
+ * registry validates on `register`.
+ *
+ * @throws {TypeError | RangeError} for a malformed operation or a
+ * duplicated name in a list.
+ */
+export function listOperations(source) {
+    if (source instanceof APIOperationRegistry) {
+        return source.getAll();
+    }
+    const seen = new Set();
+    for (const operation of source) {
+        assertValidOperationShape(operation);
+        if (seen.has(operation.name)) {
+            throw new RangeError(`Operation "${operation.name}" is listed more than once.`);
+        }
+        seen.add(operation.name);
+    }
+    return source;
+}
+/**
+ * Creates the function every binding runs calls through, so the context,
+ * interceptors, error normalization and internal-error reporting are
+ * identical over HTTP, RPC, queues and the CLI. Input carrying a
+ * `__proto__`, `constructor` or `prototype` key anywhere is refused with
+ * an `APIValidationError` after `state` runs and before the operation
+ * does. `run` never throws.
+ */
+export function createOperationRunner(options) {
+    const executor = options.executor ?? new APIExecutor();
+    return async (call) => {
+        const requestId = normalizeRequestId(call.requestId);
+        let result;
+        try {
+            const state = options.state === undefined ? {} : await options.state(call.source, call.operation);
+            const context = createAPIContext(requestId, state, call.signal);
+            context.set(TransportContextKey, call.transport);
+            if (isValidRequestId(call.correlationId)) {
+                context.set(CorrelationIdContextKey, call.correlationId);
+            }
+            const unsafe = findUnsafeKey(call.input);
+            result =
+                unsafe === undefined
+                    ? await executor.execute(call.operation, call.input, context)
+                    : apiFailure(new APIValidationError(`Input contains the forbidden key "${unsafe}".`));
+        }
+        catch (error) {
+            result = apiFailure(normalizeAPIError(error, call.operation.name));
+        }
+        if (!result.ok && !result.error.expose) {
+            options.onInternalError?.(result.error, requestId);
+        }
+        return { result, requestId };
+    };
+}
+//# sourceMappingURL=apiBinding.helper.js.map

package/dist/api/bindings/shared/apiBinding.type.d.ts

@@ -0,0 +1,37 @@
+import type { APIExecutor } from "../../executor/executor.core.js";
+import type { APIOperationRegistry } from "../../registry/operationRegistry.core.js";
+import type { AnyAPIOperation, APIOperation } from "../../operation/operation.type.js";
+import type { APIError } from "../../errors/index.js";
+/**
+ * The operations a binding exposes: a registry (freeze it first so the
+ * set cannot change underneath a live binding) or a plain list.
+ */
+export type APIOperationSource = APIOperationRegistry | readonly AnyAPIOperation[];
+/**
+ * Options every binding accepts.
+ *
+ * `TSource` is what the transport hands the binding for one call: the
+ * `Request` for HTTP, the `RPCContext` for RPC, the `Job` for a queue, the
+ * parsed invocation for the CLI.
+ */
+export interface APIBindingOptions<TSource> {
+    /**
+     * Executor that runs every operation. Configure interceptors on it; they
+     * apply identically over every binding. Defaults to `new APIExecutor()`.
+     */
+    readonly executor?: APIExecutor;
+    /**
+     * Builds `context.state` for one call — typically the authenticated
+     * principal derived from the transport. Throw an `APIError` (for example
+     * `APIAuthenticationError`) to refuse the call with that error; any
+     * other thrown value becomes an internal error. Defaults to `{}`.
+     */
+    readonly state?: (source: TSource, operation: APIOperation) => unknown;
+    /**
+     * Receives every failure that was not exposed to the caller (the error
+     * still carries its `cause`), with the call's request id — the place to
+     * log what the caller was only told was "an internal error".
+     */
+    readonly onInternalError?: (error: APIError, requestId: string) => void;
+}
+//# sourceMappingURL=apiBinding.type.d.ts.map

package/dist/api/bindings/shared/apiBinding.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=apiBinding.type.js.map

package/dist/api/bindings/shared/apiWireResult.helper.d.ts

@@ -0,0 +1,47 @@
+import type { APIResult } from "../../result/apiResult.type.js";
+import type { APIError } from "../../errors/index.js";
+/**
+ * Message sent in place of any error that was not built to be exposed.
+ */
+export declare const API_INTERNAL_ERROR_MESSAGE = "An internal error occurred.";
+/**
+ * The client-safe form of an `APIError`, identical across bindings: the
+ * HTTP body, the CLI's stderr, and what a queue records all carry it.
+ *
+ * `message` is the error's own message only when the error is
+ * `expose: true`; otherwise it is {@link API_INTERNAL_ERROR_MESSAGE}.
+ * `issues` appears only on validation failures and holds the executor's
+ * already-redacted `"<path>: invalid"` entries. Stack traces, causes and
+ * metadata are never included.
+ */
+export interface APIWireError {
+    readonly code: string;
+    readonly message: string;
+    readonly statusCode: number;
+    readonly requestId: string;
+    readonly issues?: readonly string[];
+}
+/**
+ * The client-safe form of an `APIResult`.
+ */
+export type APIWireResult<T = unknown> = {
+    readonly ok: true;
+    readonly data: T;
+} | {
+    readonly ok: false;
+    readonly error: APIWireError;
+};
+/**
+ * The HTTP-style status of an error: its `statusCode` when that is an
+ * integer in 400–599, otherwise 500.
+ */
+export declare function apiErrorStatus(error: APIError): number;
+/**
+ * Converts an `APIError` into its client-safe {@link APIWireError}.
+ */
+export declare function toApiWireError(error: APIError, requestId: string): APIWireError;
+/**
+ * Converts an executor result into its client-safe {@link APIWireResult}.
+ */
+export declare function toApiWireResult<T>(result: APIResult<T>, requestId: string): APIWireResult<T>;
+//# sourceMappingURL=apiWireResult.helper.d.ts.map

package/dist/api/bindings/shared/apiWireResult.helper.js

@@ -0,0 +1,38 @@
+import { APIValidationError } from "../../errors/index.js";
+/**
+ * Message sent in place of any error that was not built to be exposed.
+ */
+export const API_INTERNAL_ERROR_MESSAGE = "An internal error occurred.";
+/**
+ * The HTTP-style status of an error: its `statusCode` when that is an
+ * integer in 400–599, otherwise 500.
+ */
+export function apiErrorStatus(error) {
+    const status = error.statusCode;
+    return Number.isInteger(status) && status >= 400 && status <= 599 ? status : 500;
+}
+/**
+ * Converts an `APIError` into its client-safe {@link APIWireError}.
+ */
+export function toApiWireError(error, requestId) {
+    const exposed = error.expose === true;
+    const issues = exposed && error instanceof APIValidationError && error.issues.length > 0
+        ? error.issues
+        : undefined;
+    return Object.freeze({
+        code: String(error.code),
+        message: exposed ? error.message : API_INTERNAL_ERROR_MESSAGE,
+        statusCode: apiErrorStatus(error),
+        requestId,
+        ...(issues !== undefined ? { issues } : {}),
+    });
+}
+/**
+ * Converts an executor result into its client-safe {@link APIWireResult}.
+ */
+export function toApiWireResult(result, requestId) {
+    return result.ok
+        ? Object.freeze({ ok: true, data: result.data })
+        : Object.freeze({ ok: false, error: toApiWireError(result.error, requestId) });
+}
+//# sourceMappingURL=apiWireResult.helper.js.map

package/dist/api/bindings/shared/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Runtime shared by every binding: the operation source and options
+ * types, the runner that builds the context and executes a call, and the
+ * client-safe wire form of results and errors.
+ */
+export type { APIBindingOptions, APIOperationSource } from "./apiBinding.type.js";
+export type { APIBoundCall, APIBoundOutcome } from "./apiBinding.helper.js";
+export { createOperationRunner, listOperations } from "./apiBinding.helper.js";
+export type { APIWireError, APIWireResult } from "./apiWireResult.helper.js";
+export { API_INTERNAL_ERROR_MESSAGE, apiErrorStatus, toApiWireError, toApiWireResult, } from "./apiWireResult.helper.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/api/bindings/shared/index.js

@@ -0,0 +1,8 @@
+/**
+ * Runtime shared by every binding: the operation source and options
+ * types, the runner that builds the context and executes a call, and the
+ * client-safe wire form of results and errors.
+ */
+export { createOperationRunner, listOperations } from "./apiBinding.helper.js";
+export { API_INTERNAL_ERROR_MESSAGE, apiErrorStatus, toApiWireError, toApiWireResult, } from "./apiWireResult.helper.js";
+//# sourceMappingURL=index.js.map

package/dist/api/context/context.type.d.ts

@@ -1,5 +1,5 @@
-import type { APIContextKey } from "./contextKey.type.js";
-import { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, createContextKey } from "./contextKey.type.js";
+import type { APIContextKey, APITransportKind } from "./contextKey.type.js";
+import { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, TransportContextKey, createContextKey } from "./contextKey.type.js";
 /**
  * Generic API context that flows through the execution pipeline.
  *
@@ -55,6 +55,6 @@ export declare function normalizeRequestId(value: unknown): string;
  * {@link normalizeRequestId} for client-supplied values.
  */
 export declare function createAPIContext<TState = unknown>(requestId: string, state: TState, signal?: AbortSignal): APIContext<TState>;
-export type { APIContextKey };
-export { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, createContextKey, };
+export type { APIContextKey, APITransportKind };
+export { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, TransportContextKey, createContextKey, };
 //# sourceMappingURL=context.type.d.ts.map

package/dist/api/context/context.type.js

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { MAX_REQUEST_ID_LENGTH } from "../constants.js";
-import { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, createContextKey, } from "./contextKey.type.js";
+import { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, TransportContextKey, createContextKey, } from "./contextKey.type.js";
 const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]+$/;
 /**
  * Determines whether a value is usable as a request id.
@@ -102,5 +102,5 @@ function createReadonlyMapView(source) {
     };
     return Object.freeze(view);
 }
-export { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, createContextKey, };
+export { RequestIdContextKey, CorrelationIdContextKey, TenantIdContextKey, UserIdContextKey, StartTimeContextKey, TransportContextKey, createContextKey, };
 //# sourceMappingURL=context.type.js.map

package/dist/api/context/contextKey.type.d.ts

@@ -38,4 +38,12 @@ export declare const CorrelationIdContextKey: APIContextKey<string>;
 export declare const TenantIdContextKey: APIContextKey<string>;
 export declare const UserIdContextKey: APIContextKey<string>;
 export declare const StartTimeContextKey: APIContextKey<number>;
+/**
+ * The binding an operation was invoked through. Set by every built-in
+ * binding (`createApiFetchHandler`, the RPC, queue and CLI bindings) under
+ * {@link TransportContextKey}, so an interceptor can vary its behaviour by
+ * entry point without the handler knowing.
+ */
+export type APITransportKind = "http" | "rpc" | "queue" | "cli";
+export declare const TransportContextKey: APIContextKey<APITransportKind>;
 //# sourceMappingURL=contextKey.type.d.ts.map

package/dist/api/context/contextKey.type.js

@@ -34,4 +34,6 @@ export const UserIdContextKey =
 /* #__PURE__ */ createContextKey("userId");
 export const StartTimeContextKey = 
 /* #__PURE__ */ createContextKey("startTime");
+export const TransportContextKey = 
+/* #__PURE__ */ createContextKey("transport");
 //# sourceMappingURL=contextKey.type.js.map

package/dist/api/executor/executor.core.d.ts

@@ -2,53 +2,10 @@ import type { APIContext } from "../context/context.type.js";
 import type { APIResult } from "../result/apiResult.type.js";
 import type { APIOperation } from "../operation/operation.type.js";
 import type { APIInterceptor } from "../interceptors/interceptor.type.js";
-import { APIError } from "../errors/index.js";
+import type { APIExecutorOptions } from "./executor.type.js";
+export { normalizeAPIError } from "./executor.normalize.js";
+export type { APIExecutorOptions } from "./executor.type.js";
 export type { APIExecutionContext } from "../interceptors/interceptor.type.js";
-/**
- * Error normalizer for converting unknown errors into APIError instances.
- *
- * APIErrors pass through untouched. Everything else is wrapped in an
- * `APIInternalError` (`expose: false`) carrying a generic message; the
- * original error is preserved on `cause` for logging.
- *
- * The wrapper's own message is deliberately *not* a copy of the original.
- * `BaseError.toJSON()` in `@zudojs/errors` 0.1.0 emits `message`, `stack`
- * and the serialized `cause` regardless of `expose`, so a transport doing
- * `res.json(result.error)` would otherwise ship the raw driver message
- * (connection strings, constraint names, file paths, tokens) to a client.
- */
-export declare function normalizeAPIError(error: unknown, operationName?: string): APIError;
-/**
- * Options for {@link APIExecutor}.
- */
-export interface APIExecutorOptions {
-    /** Interceptor pipeline, outermost first. */
-    readonly interceptors?: readonly APIInterceptor[];
-    /**
-     * Whether raw schema issue messages are copied into the client-facing
-     * `APIValidationError` (which is `expose: true`).
-     *
-     * Default `false`. Schema messages routinely interpolate the received
-     * value — Zod's built-in messages do for several checks, and most
-     * hand-written `message:` strings do — which would put submitted
-     * secrets straight into a 422 body. With the default, clients receive
-     * one entry per failing path (`"user.email: invalid"`) naming *where*
-     * validation failed but never echoing *what* was submitted.
-     *
-     * Set to `true` only when every schema in the process is known to
-     * produce value-free messages.
-     */
-    readonly exposeValidationMessages?: boolean;
-    /**
-     * Maximum number of validation issues carried on a single
-     * `APIValidationError`. Defaults to {@link MAX_VALIDATION_ISSUES}.
-     *
-     * A schema over a large array emits one issue per failing element, so
-     * an uncapped list is an amplification vector: the executor is the
-     * layer on the untrusted-input boundary and caps it here.
-     */
-    readonly maxValidationIssues?: number;
-}
 /**
  * Executes an API operation through its interceptor pipeline.
  *
@@ -57,6 +14,9 @@ export interface APIExecutorOptions {
  * schema (a Standard Schema or a `safeParse` schema such as
  * `@zudojs/schema`). A declared schema of any other kind fails closed
  * with an `APIInternalError`; it is never skipped.
+ *
+ * Interceptors wrap everything, input validation included: validation
+ * runs innermost, on the input the interceptors pass to the handler.
  */
 export declare class APIExecutor {
     private readonly interceptors;
@@ -65,28 +25,25 @@ export declare class APIExecutor {
     constructor(optionsOrInterceptors?: readonly APIInterceptor[] | APIExecutorOptions);
     /**
      * Executes an operation with the given input and context.
+     *
+     * Order: the interceptors run first, outermost first; input validation
+     * runs innermost, immediately before the handler, on the input the
+     * interceptors finally pass. So an authentication interceptor refuses an
+     * anonymous call before its input is inspected (a 401, not a 422 that
+     * describes the schema), logging, metrics and rate-limit interceptors see
+     * invalid calls too, and an interceptor that replaces `context.input`
+     * cannot bypass the schema.
      */
     execute<TInput = unknown, TOutput = unknown>(operation: APIOperation<TInput, TOutput>, input: TInput, context: APIContext): Promise<APIResult<TOutput>>;
     /**
-     * Invokes the operation handler under its timeout and abort signal, and
-     * validates the handler's output against `operation.output`.
-     */
-    private invokeHandler;
-    /**
-     * Validates handler output against `operation.output`.
+     * Validates the input, then invokes the operation handler under its
+     * timeout and abort signal, and validates the handler's output against
+     * `operation.output`.
      *
-     * A response that does not match its declared schema is a server bug,
-     * not a client mistake, so failures surface as an `APIInternalError`
-     * (500, `expose: false`) naming only the failing paths — never the
-     * offending values, which are exactly the fields (password hashes,
-     * internal audit columns) that should not reach a client.
+     * The handler receives a context whose `signal` aborts when the deadline
+     * elapses or the caller's signal aborts, so it can stop its work.
      */
-    private validateOutput;
-    /**
-     * Converts schema issues into the capped, redacted list carried on the
-     * client-facing `APIValidationError`.
-     */
-    private clientIssues;
+    private invokeHandler;
     /**
      * Runs the interceptor pipeline (Koa-style dispatch).
      *

package/dist/api/executor/executor.core.js

@@ -1,51 +1,11 @@
-import { apiFailure, apiSuccess } from "../result/apiResult.type.js";
+import { apiFailure } from "../result/apiResult.type.js";
 import { resolveOperationTimeout } from "../operation/operation.type.js";
-import { APIError, APIInternalError, APITimeoutError, APIValidationError, createAPIError, ErrorCode, isAPIError, } from "../errors/index.js";
-import { validateWithSchema } from "../schema/index.js";
-import { MAX_INTERCEPTORS, MAX_VALIDATION_ISSUES, MAX_VALIDATION_ISSUE_LENGTH, } from "../constants.js";
-/**
- * Error normalizer for converting unknown errors into APIError instances.
- *
- * APIErrors pass through untouched. Everything else is wrapped in an
- * `APIInternalError` (`expose: false`) carrying a generic message; the
- * original error is preserved on `cause` for logging.
- *
- * The wrapper's own message is deliberately *not* a copy of the original.
- * `BaseError.toJSON()` in `@zudojs/errors` 0.1.0 emits `message`, `stack`
- * and the serialized `cause` regardless of `expose`, so a transport doing
- * `res.json(result.error)` would otherwise ship the raw driver message
- * (connection strings, constraint names, file paths, tokens) to a client.
- */
-export function normalizeAPIError(error, operationName) {
-    if (isAPIError(error)) {
-        return error;
-    }
-    const where = operationName !== undefined && operationName !== ""
-        ? `operation "${operationName}"`
-        : "an API operation";
-    const wrapped = error instanceof Error
-        ? new APIInternalError(`An unexpected internal error occurred in ${where}.`)
-        : new APIInternalError(`A non-error value (${describeValueType(error)}) was thrown in ${where}.`);
-    // `APIInternalError`'s subclass constructor forwards only
-    // `{ endpoint, method }`, so `cause` cannot be passed through it.
-    // `APIError` / `createAPIError` *do* accept `cause`, but constructing
-    // through them would lose the `APIInternalError` class identity that
-    // consumers match on. `cause` is a declared writable class field on
-    // `BaseError`, so assigning it after construction is equivalent for
-    // `toJSON()` and for `error.cause` reads; only the native `[[cause]]`
-    // slot differs.
-    wrapped.cause = error;
-    return wrapped;
-}
-function describeValueType(value) {
-    if (value === null) {
-        return "null";
-    }
-    if (Array.isArray(value)) {
-        return "array";
-    }
-    return typeof value;
-}
+import { APIInternalError } from "../errors/index.js";
+import { MAX_INTERCEPTORS, MAX_VALIDATION_ISSUES } from "../constants.js";
+import { abortedError, withContextSignal, withDeadline, } from "./executor.deadline.js";
+import { normalizeAPIError } from "./executor.normalize.js";
+import { validateOperationInput, validateOperationOutput, } from "./executor.validation.js";
+export { normalizeAPIError } from "./executor.normalize.js";
 /**
  * Executes an API operation through its interceptor pipeline.
  *
@@ -54,6 +14,9 @@ function describeValueType(value) {
  * schema (a Standard Schema or a `safeParse` schema such as
  * `@zudojs/schema`). A declared schema of any other kind fails closed
  * with an `APIInternalError`; it is never skipped.
+ *
+ * Interceptors wrap everything, input validation included: validation
+ * runs innermost, on the input the interceptors pass to the handler.
  */
 export class APIExecutor {
     interceptors;
@@ -79,32 +42,27 @@ export class APIExecutor {
     }
     /**
      * Executes an operation with the given input and context.
+     *
+     * Order: the interceptors run first, outermost first; input validation
+     * runs innermost, immediately before the handler, on the input the
+     * interceptors finally pass. So an authentication interceptor refuses an
+     * anonymous call before its input is inspected (a 401, not a 422 that
+     * describes the schema), logging, metrics and rate-limit interceptors see
+     * invalid calls too, and an interceptor that replaces `context.input`
+     * cannot bypass the schema.
      */
     async execute(operation, input, context) {
         if (context.signal?.aborted) {
             return apiFailure(abortedError(operation.name));
         }
-        let effectiveInput = input;
-        if (operation.input !== undefined) {
-            try {
-                const validation = await validateWithSchema(operation.input, input);
-                if (!validation.ok) {
-                    return apiFailure(new APIValidationError(`Invalid input for operation "${operation.name}".`, this.clientIssues(validation.issues)));
-                }
-                effectiveInput = validation.value;
-            }
-            catch (error) {
-                return apiFailure(normalizeAPIError(error, operation.name));
-            }
-        }
         const executionContext = {
             operation,
-            input: effectiveInput,
+            input,
             context,
         };
         // Reads `executionContext.input` at call time, so an interceptor that
-        // replaces the input before calling `next()` actually changes what the
-        // handler receives.
+        // replaces the input before calling `next()` changes what is validated
+        // and what the handler receives.
         const executeHandler = () => this.invokeHandler(operation, executionContext.input, context);
         try {
             return await this.runPipeline(executionContext, executeHandler);
@@ -114,66 +72,33 @@ export class APIExecutor {
         }
     }
     /**
-     * Invokes the operation handler under its timeout and abort signal, and
-     * validates the handler's output against `operation.output`.
+     * Validates the input, then invokes the operation handler under its
+     * timeout and abort signal, and validates the handler's output against
+     * `operation.output`.
+     *
+     * The handler receives a context whose `signal` aborts when the deadline
+     * elapses or the caller's signal aborts, so it can stop its work.
      */
     async invokeHandler(operation, input, context) {
         if (context.signal?.aborted) {
             return apiFailure(abortedError(operation.name));
         }
+        const validated = await validateOperationInput(operation, input, {
+            maxIssues: this.maxValidationIssues,
+            exposeMessages: this.exposeValidationMessages,
+        });
+        if (!validated.ok) {
+            return apiFailure(validated.error);
+        }
         const timeoutMs = resolveOperationTimeout(operation);
         let output;
         try {
-            output = await withDeadline(operation.handler(input, context), timeoutMs, operation.name, context.signal);
-        }
-        catch (error) {
-            return apiFailure(normalizeAPIError(error, operation.name));
-        }
-        return this.validateOutput(operation, output);
-    }
-    /**
-     * Validates handler output against `operation.output`.
-     *
-     * A response that does not match its declared schema is a server bug,
-     * not a client mistake, so failures surface as an `APIInternalError`
-     * (500, `expose: false`) naming only the failing paths — never the
-     * offending values, which are exactly the fields (password hashes,
-     * internal audit columns) that should not reach a client.
-     */
-    async validateOutput(operation, output) {
-        if (operation.output === undefined) {
-            return apiSuccess(output);
-        }
-        let validation;
-        try {
-            validation = await validateWithSchema(operation.output, output);
+            output = await withDeadline((signal) => operation.handler(validated.data, withContextSignal(context, signal)), timeoutMs, operation.name, context.signal);
         }
         catch (error) {
             return apiFailure(normalizeAPIError(error, operation.name));
         }
-        if (!validation.ok) {
-            const paths = validation.issues
-                .slice(0, this.maxValidationIssues)
-                .map(formatIssuePath)
-                .join(", ");
-            return apiFailure(new APIInternalError(`Invalid output for operation "${operation.name}" at: ${paths}.`));
-        }
-        return apiSuccess(validation.value);
-    }
-    /**
-     * Converts schema issues into the capped, redacted list carried on the
-     * client-facing `APIValidationError`.
-     */
-    clientIssues(issues) {
-        const limit = this.maxValidationIssues;
-        const shown = issues.slice(0, limit).map((issue) => this.exposeValidationMessages
-            ? truncate(issue.message, MAX_VALIDATION_ISSUE_LENGTH)
-            : `${formatIssuePath(issue)}: invalid`);
-        const omitted = issues.length - shown.length;
-        if (omitted > 0) {
-            shown.push(`… and ${omitted} more issue(s) omitted.`);
-        }
-        return shown;
+        return validateOperationOutput(operation, output, this.maxValidationIssues);
     }
     /**
      * Runs the interceptor pipeline (Koa-style dispatch).
@@ -208,84 +133,4 @@ export class APIExecutor {
         return dispatch(0);
     }
 }
-// ─── Internal helpers ─────────────────────────────────────────────────────
-function truncate(value, max) {
-    const text = typeof value === "string" ? value : String(value);
-    return text.length <= max ? text : `${text.slice(0, max - 1)}…`;
-}
-/**
- * Renders a Standard Schema issue path as a dotted string. Path segments
- * are field names, never submitted values, so they are safe to expose.
- */
-function formatIssuePath(issue) {
-    const path = issue.path;
-    if (path === undefined || path.length === 0) {
-        return "(root)";
-    }
-    return path
-        .map((segment) => {
-        const key = typeof segment === "object" && segment !== null && "key" in segment
-            ? segment.key
-            : segment;
-        return truncate(String(key), 64);
-    })
-        .join(".");
-}
-/**
- * Error for an execution cancelled by the caller's `AbortSignal`.
- *
- * Carries `ErrorCode.OPERATION_CANCELLED` — branch on that, not on the
- * status code. `statusCode` is 499, an nginx convention ("Client Closed
- * Request") rather than an IANA status; this package is
- * transport-agnostic, so each adapter should map the *code* onto whatever
- * its protocol calls "cancelled" (gRPC `CANCELLED`, a dropped queue
- * message, a non-zero CLI exit) rather than passing 499 to the wire.
- */
-function abortedError(operationName) {
-    return createAPIError(`Operation "${operationName}" was aborted.`, {
-        code: ErrorCode.OPERATION_CANCELLED,
-        statusCode: 499,
-        expose: true,
-    });
-}
-/**
- * Awaits a handler promise, rejecting when the timeout elapses or the
- * abort signal fires. The handler itself keeps running (promises are not
- * cancellable), but the caller stops waiting and resources are released.
- *
- * `timeoutMs` is always a positive integer here — `defineOperation`
- * rejects anything else and `resolveOperationTimeout` substitutes the
- * default for hand-rolled operations — so the deadline can never be
- * silently disabled.
- */
-function withDeadline(promise, timeoutMs, operationName, signal) {
-    return new Promise((resolve, reject) => {
-        let timer;
-        const cleanup = () => {
-            if (timer !== undefined)
-                clearTimeout(timer);
-            signal?.removeEventListener("abort", onAbort);
-        };
-        const onAbort = () => {
-            cleanup();
-            reject(abortedError(operationName));
-        };
-        timer = setTimeout(() => {
-            cleanup();
-            reject(new APITimeoutError(timeoutMs));
-        }, timeoutMs);
-        signal?.addEventListener("abort", onAbort, { once: true });
-        // `Promise.resolve` rather than `promise.then`: a hand-rolled operation
-        // whose handler returns synchronously is a legal JavaScript caller, and
-        // calling `.then` on its plain value failed with "promise.then is not a
-        // function" reported as an internal error of the operation.
-        Promise.resolve(promise).then((value) => {
-            cleanup();
-            resolve(value);
-        }, (error) => {
-            cleanup();
-            reject(error);
-        });
-    });
-}
 //# sourceMappingURL=executor.core.js.map