Response objects are typed

Handlers that return ad-hoc inline objects — { id: user.id, name: user.name, role: user.role } — with no shared type definition silently expose database columns that were never intended for the API surface. Without explicit response types, a refactor that renames a database column silently changes the API contract, and TypeScript's type system provides zero protection. iso-25010:2011 maintainability.modifiability and compatibility.interoperability both degrade: the API shape can change with any database migration and no tooling catches it.

Define explicit TypeScript interfaces for every API response shape and use a dedicated serialization function to enforce them:

interface UserResponse {
  id: string
  name: string
  email: string
  isActive: boolean
  createdAt: string
}

function toUserResponse(user: DbUser): UserResponse {
  return {
    id: user.id,
    name: user.name,
    email: user.email,
    isActive: user.is_active,
    createdAt: user.created_at.toISOString(),
  }
}

The serialization function is the explicit allowlist of what leaves the database layer. Any new field must be added deliberately, not by accident.