Batch C · Priority P2 · pkg openapi-server
Beyond unvalidated path/query/header params (tracked separately), the server generator is missing:
- Problem-details / error contract — no try/catch around service calls (README admits this); the only structured error is an ad-hoc
{ error, issues } 422 (router.ts:320), not RFC 7807 application/problem+json, and unrelated to the spec's declared error responses. A thrown service error becomes a generic 500.
- Response validation — handlers return
c.json(await service.method(...)) with no outbound safeParse; no symmetry with the client (which validates responses). Contract drift on responses is undetectable.
- Service ergonomics —
buildMethodSignature (service.ts:315-342) emits method(pathParam: string, body, params?): no header params, no auth/security context, no typed framework context, no DI seam, no base-path/mount config, no CORS or security-scheme enforcement stubs, no OpenAPI doc serving. Multi-content-type bodies collapse to application/json only.
- Coercion — query/path coercion is naive and inconsistent across frameworks (
Number(...) with no NaN guard; booleans uncoerced in Hono; arrays/dates never coerced).
Effort: M (errors + response validation) → L (context/auth seam, multi-content-type).
Source: Opus product review, findings SRV-3, SRV-4, SRV-5, SRV-6, SRV-7.
Batch C · Priority P2 · pkg openapi-server
Beyond unvalidated path/query/header params (tracked separately), the server generator is missing:
{ error, issues }422 (router.ts:320), not RFC 7807application/problem+json, and unrelated to the spec's declared error responses. A thrown service error becomes a generic 500.c.json(await service.method(...))with no outboundsafeParse; no symmetry with the client (which validates responses). Contract drift on responses is undetectable.buildMethodSignature(service.ts:315-342) emitsmethod(pathParam: string, body, params?): no header params, no auth/security context, no typed framework context, no DI seam, no base-path/mount config, no CORS or security-scheme enforcement stubs, no OpenAPI doc serving. Multi-content-type bodies collapse toapplication/jsononly.Number(...)with no NaN guard; booleans uncoerced in Hono; arrays/dates never coerced).Effort: M (errors + response validation) → L (context/auth seam, multi-content-type).
Source: Opus product review, findings SRV-3, SRV-4, SRV-5, SRV-6, SRV-7.