Add consistent API request logging and a themed 404 page, bump to 0.4.0

Every app/api route handler now goes through withRouteLogging, which logs
a correlated reqId/method/path/status/duration for each request and turns
any uncaught error into a logged stack trace plus a clean JSON 500 instead
of Next's default opaque failure. proxy.ts logs rejected auth attempts, and
instrumentation.ts's onRequestError catches anything that still escapes a
route handler. Also adds a minimal not-found page matching the app's card
styling.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/api/play-sessions/[id]/events/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { insertEvents } from "@/lib/db/queries/session-events";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
 
 const eventSchema = z.object({
   sessionDeviceId: z.number().int().positive(),
@@ -13,12 +14,15 @@ const eventSchema = z.object({
 
 const bodySchema = z.object({ events: z.array(eventSchema).max(2000) });
 
-export async function POST(req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
-  if (!parsed.success) {
-    return NextResponse.json({ error: parsed.error.message }, { status: 400 });
-  }
-  await insertEvents(Number(id), parsed.data.events);
-  return NextResponse.json({ inserted: parsed.data.events.length });
-}
+export const POST = withRouteLogging(
+  "play-sessions.events.append",
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const parsed = bodySchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json({ error: parsed.error.message }, { status: 400 });
+    }
+    await insertEvents(Number(id), parsed.data.events);
+    return NextResponse.json({ inserted: parsed.data.events.length });
+  },
+);

app/api/play-sessions/[id]/route.ts

@@ -2,42 +2,55 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { deletePlaySession, endPlaySession, getPlaySessionDetail } from "@/lib/db/queries/play-sessions";
 import { getRecordingsForSession } from "@/lib/db/queries/recordings";
+import { withRouteLogging } from "@/lib/api/with-route-logging";
+import { createLogger } from "@/lib/logger";
 
+const log = createLogger("play-sessions");
 const patchSchema = z.object({ status: z.enum(["completed", "aborted"]) });
 
-export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const detail = await getPlaySessionDetail(Number(id));
-  if (!detail) return NextResponse.json({ error: "not found" }, { status: 404 });
-  return NextResponse.json(detail);
-}
+export const GET = withRouteLogging(
+  "play-sessions.get",
+  async (_req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const detail = await getPlaySessionDetail(Number(id));
+    if (!detail) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json(detail);
+  },
+);
 
-export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const parsed = patchSchema.safeParse(await req.json().catch(() => null));
-  if (!parsed.success) {
-    return NextResponse.json({ error: "status must be completed or aborted" }, { status: 400 });
-  }
-  const updated = await endPlaySession(Number(id), parsed.data);
-  if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
-  return NextResponse.json({ playSession: updated });
-}
-
-export async function DELETE(req: Request, { params }: { params: Promise<{ id: string }> }) {
-  const { id } = await params;
-  const cascade = new URL(req.url).searchParams.get("cascade") === "true";
-  try {
-    await deletePlaySession(Number(id), { cascade });
-    return NextResponse.json({ ok: true });
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    if (message.includes("FOREIGN KEY") || message.includes("SQLITE_CONSTRAINT")) {
-      const blockingRecordings = await getRecordingsForSession(Number(id));
-      return NextResponse.json(
-        { error: "cannot delete a session that a saved recording still references", recordings: blockingRecordings },
-        { status: 409 },
-      );
+export const PATCH = withRouteLogging(
+  "play-sessions.end",
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const parsed = patchSchema.safeParse(await req.json().catch(() => null));
+    if (!parsed.success) {
+      return NextResponse.json({ error: "status must be completed or aborted" }, { status: 400 });
     }
-    throw err;
-  }
-}
+    const updated = await endPlaySession(Number(id), parsed.data);
+    if (!updated) return NextResponse.json({ error: "not found" }, { status: 404 });
+    return NextResponse.json({ playSession: updated });
+  },
+);
+
+export const DELETE = withRouteLogging(
+  "play-sessions.delete",
+  async (req: Request, { params }: { params: Promise<{ id: string }> }) => {
+    const { id } = await params;
+    const cascade = new URL(req.url).searchParams.get("cascade") === "true";
+    try {
+      await deletePlaySession(Number(id), { cascade });
+      return NextResponse.json({ ok: true });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (message.includes("FOREIGN KEY") || message.includes("SQLITE_CONSTRAINT")) {
+        log.warn("blocked session delete due to referencing recording", { sessionId: id, cascade });
+        const blockingRecordings = await getRecordingsForSession(Number(id));
+        return NextResponse.json(
+          { error: "cannot delete a session that a saved recording still references", recordings: blockingRecordings },
+          { status: 409 },
+        );
+      }
+      throw err;
+    }
+  },
+);