@cratestack/validator-zod 0.5.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stephane Segning
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,30 @@
+# @cratestack/validator-zod
+
+An [`RpcLink`](https://github.com/cratestack/cratestack/tree/main/packages/cratestack-ts-types)
+([issue #182](https://github.com/cratestack/cratestack/issues/182)) for CrateStack's generated
+TypeScript RPC client (`transport rpc` schemas) that validates `request.input` against a per-op
+[zod](https://zod.dev/) schema before the call reaches the network — client-side validation with
+the exact same schema shape your server-side procedure/model input already has, instead of hoping
+the generated types alone catch a bad call at compile time.
+
+## Usage
+
+```ts
+import { createZodValidatorLink } from "@cratestack/validator-zod";
+import { CratestackRpcRuntime } from "./generated/runtime"; // your project's generated client
+import { z } from "zod";
+
+const runtime = new CratestackRpcRuntime("https://api.example.com", {
+  links: [
+    createZodValidatorLink({
+      "model.Order.create": z.object({ total: z.number().positive() }),
+    }),
+  ],
+});
+```
+
+Ops with no configured schema pass through unvalidated — this is opt-in per op, not a blanket
+gate. On success, the schema's *parsed* output (defaults, `z.coerce`, transforms) becomes the
+actual request `input`, not just a type-level assertion. On failure, the chain short-circuits —
+the real network call never happens — and the call rejects the same way a server-side validation
+failure would, with an `RpcErrorBody` carrying `code: "invalid_argument"`.

package/dist/index.d.ts

@@ -0,0 +1,21 @@
+import type { RpcLink } from "@cratestack/ts-types";
+import type { ZodTypeAny } from "zod";
+/** Maps a `request.opId` to the schema its `input` must satisfy. Ops
+ *  with no entry pass through unvalidated — this link is opt-in per op,
+ *  not a blanket gate. */
+export type ZodValidatorSchemas = Record<string, ZodTypeAny>;
+/** Validates `request.input` against a per-op `zod` schema before
+ *  calling `next()`, shipped as an
+ *  [`RpcLink`](https://github.com/cratestack/cratestack/tree/main/packages/cratestack-ts-types)
+ *  ([issue #182](https://github.com/cratestack/cratestack/issues/182)) so it composes with
+ *  `@cratestack/link-batch`/`@cratestack/link-logger` instead of requiring its own call site.
+ *
+ *  On success, `next()` receives the schema's *parsed* output as
+ *  `input` — so `z.coerce.number()`/defaults/transforms actually take
+ *  effect on the wire, not just at the type level. On failure, the
+ *  chain short-circuits: `next()` is never called and the link resolves
+ *  its own `Response` carrying an `RpcErrorBody` with
+ *  `code: "invalid_argument"`, mirroring what the server itself would
+ *  return for a rejected input (see `docs/design/rpc-transport.md`). */
+export declare function createZodValidatorLink(schemas: ZodValidatorSchemas): RpcLink;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAgB,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAEtC;;0BAE0B;AAC1B,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAE7D;;;;;;;;;;;;wEAYwE;AACxE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAmB5E"}

package/dist/index.js

@@ -0,0 +1,32 @@
+/** Validates `request.input` against a per-op `zod` schema before
+ *  calling `next()`, shipped as an
+ *  [`RpcLink`](https://github.com/cratestack/cratestack/tree/main/packages/cratestack-ts-types)
+ *  ([issue #182](https://github.com/cratestack/cratestack/issues/182)) so it composes with
+ *  `@cratestack/link-batch`/`@cratestack/link-logger` instead of requiring its own call site.
+ *
+ *  On success, `next()` receives the schema's *parsed* output as
+ *  `input` — so `z.coerce.number()`/defaults/transforms actually take
+ *  effect on the wire, not just at the type level. On failure, the
+ *  chain short-circuits: `next()` is never called and the link resolves
+ *  its own `Response` carrying an `RpcErrorBody` with
+ *  `code: "invalid_argument"`, mirroring what the server itself would
+ *  return for a rejected input (see `docs/design/rpc-transport.md`). */
+export function createZodValidatorLink(schemas) {
+    return async (request, next) => {
+        const schema = schemas[request.opId];
+        if (!schema) {
+            return next(request);
+        }
+        const result = schema.safeParse(request.input);
+        if (result.success) {
+            return next({ ...request, input: result.data });
+        }
+        const body = {
+            code: "invalid_argument",
+            message: `input for "${request.opId}" failed validation`,
+            details: result.error.flatten(),
+        };
+        return { response: new Response(request.codec.encode(body), { status: 400 }) };
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA;;;;;;;;;;;;wEAYwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,OAA4B;IACjE,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,IAAI,GAAiB;YACzB,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,cAAc,OAAO,CAAC,IAAI,qBAAqB;YACxD,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;SAChC,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;IACjF,CAAC,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@cratestack/validator-zod",
+  "version": "0.5.2",
+  "description": "An RpcLink for CrateStack's generated TypeScript RPC client that validates request input against per-op zod schemas.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/cratestack/cratestack.git",
+    "directory": "packages/cratestack-validator-zod"
+  },
+  "homepage": "https://cratestack.dev",
+  "bugs": "https://github.com/cratestack/cratestack/issues",
+  "keywords": ["cratestack", "cstack", "rpc", "zod", "validation", "trpc-links"],
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": ["dist", "README.md", "LICENSE"],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "vitest run",
+    "lint": "biome check ."
+  },
+  "dependencies": {
+    "@cratestack/ts-types": "0.5.2"
+  },
+  "peerDependencies": {
+    "zod": "^3.23.0 || ^4.0.0"
+  },
+  "peerDependenciesMeta": {
+    "zod": { "optional": true }
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "vitest": "^3.0.0",
+    "zod": "^4.0.0"
+  },
+  "engines": {
+    "node": ">=18"
+  }
+}