@critical-path/core 0.23.0 → 0.24.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @critical-path/core
 
+## 0.24.0
+
+### Minor Changes
+
+- b54e22c: Validate request bodies with shared zod schemas and publish an OpenAPI document.
+  
+  **@critical-path/core**
+  - New `@critical-path/core/schemas` subpath with create/update schemas for every resource and `parsePayload(schema, data)`. Kept off the package root so browser bundles do not include zod. `zod` is now a dependency of core.
+  - `ValidationError` carries an optional `issues: { path, message }[]`.
+  
+  **@critical-path/server**
+  - All request bodies are validated. Invalid bodies return `400` with `issues`. Server-assigned fields (`id`, `createdAt`, `updatedAt`, task `key`, owning `projectId` on updates) and unknown keys are stripped, so a `PATCH` can no longer move a task to another project.
+  - Comments, reactions and attachments require an author unless `getContext` resolves the caller. Attachment `mimeType` and `sizeBytes` default to `application/octet-stream` and `0` for linked files.
+  - New `GET /openapi.json` and `buildOpenApiDocument()` (OpenAPI 3.1, request bodies generated from the validation schemas).
+  
+  **@critical-path/mcp**
+  - Tool `inputSchema`s are generated from their zod schemas via the new `defineTool`, removing the hand-written JSON copies.
+  
+  **@critical-path/svelte**
+  - Rebuilt with the bundled `@critical-path/mcp` changes.
+
 ## 0.23.0
 
 ### Minor Changes

package/README.md

@@ -122,6 +122,17 @@ try {
 
 Cycle detection follows the full upstream chain, so indirect cycles (A → B → C → D → A) are rejected as well as direct ones.
 
+#### Request Payload Schemas (`@critical-path/core/schemas`)
+
+```ts
+import { CreateTaskSchema, UpdateTaskSchema, parsePayload } from '@critical-path/core/schemas';
+
+const input = parsePayload(CreateTaskSchema, await request.json()); // throws ValidationError with `issues`
+await engine.createTask(input);
+```
+
+Create and update schemas exist for workflows, projects, tasks, dependencies, deliverables, teams, containers, iterations, comments, reactions, attachments and time entries. They strip server-assigned fields and unknown keys. The schemas live on a subpath so importing `@critical-path/core` in a browser bundle does not pull in zod. A compile-time test fails the build if a domain type gains a field its schema lacks.
+
 #### Attributing Mutations to a User (`withActor`)
 
 ```ts

package/dist/domain/errors.d.ts

@@ -1,8 +1,14 @@
 /**
  * Thrown when input fails a domain rule. Route handlers map it to HTTP 400.
  */
+export interface ValidationIssue {
+    /** Dot-separated path to the invalid field, e.g. `todos.0.title`. Empty for the whole payload. */
+    path: string;
+    message: string;
+}
 export declare class ValidationError extends Error {
-    constructor(message: string);
+    readonly issues?: ValidationIssue[];
+    constructor(message: string, issues?: ValidationIssue[]);
 }
 /**
  * Thrown when a referenced entity does not exist. Route handlers map it to HTTP 404.

package/dist/domain/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,OAAO,EAAE,MAAM;CAI5B;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,SAAgB,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;gBAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,eAAe,EAAE;CAKxD;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;gBAC1B,OAAO,EAAE,MAAM;CAI5B"}

package/dist/domain/errors.js

@@ -1,10 +1,9 @@
-/**
- * Thrown when input fails a domain rule. Route handlers map it to HTTP 400.
- */
 export class ValidationError extends Error {
-    constructor(message) {
+    issues;
+    constructor(message, issues) {
         super(message);
         this.name = 'ValidationError';
+        this.issues = issues;
     }
 }
 /**

package/dist/domain/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAChC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/domain/errors.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,eAAgB,SAAQ,KAAK;IACxB,MAAM,CAAqB;IAE3C,YAAY,OAAe,EAAE,MAA0B;QACrD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,KAAK;IACtC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF"}