@stone-js/validation 0.8.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright © 2026 Stone Foundation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,44 @@
+# Stone.js · Validation
+
+[![npm](https://img.shields.io/npm/v/@stone-js/validation)](https://www.npmjs.com/package/@stone-js/validation)
+[![CI](https://github.com/stone-foundation/stone-js-framework/actions/workflows/ci.yml/badge.svg)](https://github.com/stone-foundation/stone-js-framework/actions/workflows/ci.yml)
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=stone-foundation_stone-js-framework&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=stone-foundation_stone-js-framework)
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![Conventional Commits](https://img.shields.io/badge/Conventional%20Commits-1.0.0-yellow.svg)](https://conventionalcommits.org)
+
+> Framework-agnostic input validation for Stone.js. Define a schema once (Zod, Valibot, ArkType — anything Standard Schema) and validate it identically on the backend and the frontend.
+
+Part of **[Stone.js](https://stonejs.dev)**, the reference implementation of the
+[Continuum Architecture](https://evens-stone.github.io/continuum-manifesto/manifesto): write your
+domain once, and the context (runtime, protocol, caller) applies to it at run time.
+
+## Install
+
+```bash
+npm i @stone-js/validation
+```
+
+## Usage
+
+```ts
+import { z } from 'zod'
+import { validate } from '@stone-js/validation'
+import { EventHandler, Post } from '@stone-js/router'
+
+export const NewTask = z.object({ title: z.string().min(1).max(120) })
+
+@EventHandler('/tasks')
+export class TaskController {
+  // Rejects a malformed body with 422 before the handler runs. Same schema validates the form.
+  @Post('/', { middleware: [validate({ body: NewTask })] })
+  create (event) { return event.get('body') }
+}
+```
+
+## Documentation
+
+Full documentation: **[stonejs.dev/docs/extensions/validation](https://stonejs.dev/docs/extensions/validation)**.
+
+## License
+
+[MIT](https://opensource.org/licenses/MIT) © Evens Pierre ("Mr. Stone") and the Stone.js contributors.

package/dist/ValidationServiceProvider.d.ts

@@ -0,0 +1,16 @@
+import { IContainer, IServiceProvider, Promiseable } from '@stone-js/core';
+/**
+ * Registers the {@link Validator} service (singleton) in the container, aliased as
+ * `validator`/`Validator`, so middleware, handlers and services can resolve it.
+ */
+export declare class ValidationServiceProvider implements IServiceProvider {
+    private readonly container;
+    /**
+     * @param container - The service container.
+     */
+    constructor(container: IContainer);
+    /**
+     * Register the validation service.
+     */
+    register(): Promiseable<void>;
+}

package/dist/Validator.d.ts

@@ -0,0 +1,43 @@
+import { IValidator, SchemaInput, ValidationResult } from './declarations';
+/**
+ * The validation service.
+ *
+ * Platform-agnostic: it validates any value against any supported schema (Zod, Valibot, ArkType
+ * via Standard Schema, or a native Stone.js schema) and knows nothing about HTTP/CLI/browser.
+ * Register it in the container (see `ValidationServiceProvider`) and resolve it as `validator`,
+ * or use the same schema directly on the frontend — one schema, both sides.
+ */
+export declare class Validator implements IValidator {
+    /**
+     * Factory.
+     *
+     * @returns A new Validator instance.
+     */
+    static create(): Validator;
+    /**
+     * Validate `data` against `schema`, returning a normalised result (never throws for validation
+     * failures — inspect `success`).
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns The validation result.
+     */
+    validate<T>(schema: SchemaInput<T>, data: unknown): ValidationResult<T>;
+    /**
+     * Validate `data` and return the parsed value, or throw a {@link ValidationError} on failure.
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns The parsed value.
+     * @throws {ValidationError} When validation fails.
+     */
+    assert<T>(schema: SchemaInput<T>, data: unknown): T;
+    /**
+     * Whether `data` satisfies `schema`.
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns True when valid.
+     */
+    isValid<T>(schema: SchemaInput<T>, data: unknown): boolean;
+}

package/dist/adapters/standardSchema.d.ts

@@ -0,0 +1,17 @@
+import { ValidationSchema, StandardSchemaV1 } from '../declarations';
+/**
+ * Adapts a [Standard Schema](https://standardschema.dev) (Zod 3.24+, Valibot, ArkType, …) to the
+ * Stone.js {@link ValidationSchema} contract. Only the synchronous path is supported here; an
+ * async schema throws a clear {@link ValidationError} so the misuse is obvious.
+ *
+ * @param schema - The Standard Schema.
+ * @returns A Stone.js validation schema.
+ */
+export declare function fromStandard<T>(schema: StandardSchemaV1<T>): ValidationSchema<T>;
+/**
+ * Whether a value implements the Standard Schema v1 contract.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `~standard` v1 entry.
+ */
+export declare function isStandardSchema(value: unknown): value is StandardSchemaV1;

package/dist/adapters/zod.d.ts

@@ -0,0 +1,17 @@
+import { ValidationSchema, ZodLikeSchema } from '../declarations';
+/**
+ * Adapts a Zod-style schema (anything exposing a synchronous `safeParse`) to the Stone.js
+ * {@link ValidationSchema} contract. Structural — never imports Zod, so it works with any
+ * compatible engine and keeps the module dependency-free.
+ *
+ * @param schema - The Zod-like schema.
+ * @returns A Stone.js validation schema.
+ */
+export declare function fromZod<T>(schema: ZodLikeSchema<T>): ValidationSchema<T>;
+/**
+ * Whether a value looks like a Zod-style schema.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `safeParse` function.
+ */
+export declare function isZodLike(value: unknown): value is ZodLikeSchema;

package/dist/declarations.d.ts

@@ -0,0 +1,100 @@
+/**
+ * A single validation problem, normalised across engines.
+ */
+export interface ValidationIssue {
+    /** Property path to the offending value (e.g. `['user', 'email']`). */
+    path: Array<string | number>;
+    /** Human-readable message. */
+    message: string;
+    /** Optional engine/rule code (e.g. `too_small`). */
+    code?: string;
+}
+/**
+ * The outcome of validating a value against a schema. Never throws — inspect `success`.
+ */
+export type ValidationResult<T> = {
+    success: true;
+    value: T;
+    issues?: undefined;
+} | {
+    success: false;
+    value?: undefined;
+    issues: ValidationIssue[];
+};
+/**
+ * The engine-agnostic schema contract every validator speaks.
+ *
+ * Any object exposing a `validate(data)` method that returns a {@link ValidationResult} is a
+ * valid Stone.js schema. Zod, Valibot and ArkType schemas are adapted to this shape (they all
+ * implement the Standard Schema spec, or expose `safeParse`), so you write the schema once and
+ * use it identically on the backend and the frontend.
+ */
+export interface ValidationSchema<T = unknown> {
+    /** Validate a value, returning a normalised result. */
+    validate: (data: unknown) => ValidationResult<T>;
+}
+/**
+ * Minimal shape of the [Standard Schema](https://standardschema.dev) v1 contract — implemented
+ * by Zod 3.24+, Valibot, ArkType and others. Only the synchronous path is consumed here.
+ */
+export interface StandardSchemaV1<Output = unknown> {
+    readonly '~standard': {
+        readonly version: 1;
+        readonly vendor: string;
+        readonly validate: (value: unknown) => StandardResult<Output> | Promise<StandardResult<Output>>;
+    };
+}
+/** A Standard Schema validation result. */
+export interface StandardResult<Output> {
+    readonly value?: Output;
+    readonly issues?: ReadonlyArray<{
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | {
+            readonly key: PropertyKey;
+        }>;
+    }>;
+}
+/**
+ * Minimal shape of a Zod-style schema (a `safeParse` method). Kept structural so `@stone-js/validation`
+ * never has to depend on Zod at runtime.
+ */
+export interface ZodLikeSchema<T = unknown> {
+    safeParse: (data: unknown) => ZodSafeParseResult<T>;
+}
+/** A Zod-style `safeParse` result. */
+export type ZodSafeParseResult<T> = {
+    success: true;
+    data: T;
+} | {
+    success: false;
+    error: {
+        issues: ReadonlyArray<{
+            message: string;
+            path: readonly PropertyKey[];
+            code?: string;
+        }>;
+    };
+};
+/**
+ * Anything that can be resolved into a {@link ValidationSchema}: a native Stone.js schema, a
+ * Standard Schema, or a Zod-like schema.
+ */
+export type SchemaInput<T = unknown> = ValidationSchema<T> | StandardSchemaV1<T> | ZodLikeSchema<T>;
+/**
+ * The telemetry-free validation service contract.
+ */
+export interface IValidator {
+    /** Validate `data` against `schema`, returning a normalised result (never throws). */
+    validate: <T>(schema: SchemaInput<T>, data: unknown) => ValidationResult<T>;
+    /** Validate `data` and return the parsed value, or throw a `ValidationError` on failure. */
+    assert: <T>(schema: SchemaInput<T>, data: unknown) => T;
+    /** Whether `data` satisfies `schema`. */
+    isValid: <T>(schema: SchemaInput<T>, data: unknown) => boolean;
+}
+/**
+ * Validation configuration (`stone.validation.*`).
+ */
+export interface ValidationOptions {
+    /** Whether to strip unknown keys is left to the schema; reserved for future options. */
+    reserved?: never;
+}

package/dist/errors/ValidationError.d.ts

@@ -0,0 +1,32 @@
+import { ValidationIssue } from '../declarations';
+import { IntegrationError } from '@stone-js/core';
+import type { ErrorOptions } from '@stone-js/core';
+/**
+ * Options for a {@link ValidationError}.
+ */
+export interface ValidationErrorOptions extends ErrorOptions {
+    /** The normalised validation issues. */
+    issues: ValidationIssue[];
+}
+/**
+ * Thrown when a value fails validation.
+ *
+ * It carries the normalised {@link ValidationIssue}s so any layer can render them (an HTTP error
+ * handler into `422` + problem+json, a CLI into a table, a form into field errors). The error
+ * itself stays platform-agnostic — it knows nothing about HTTP.
+ */
+export declare class ValidationError extends IntegrationError {
+    /** The normalised validation issues. */
+    readonly issues: ValidationIssue[];
+    /**
+     * @param message - The error message.
+     * @param options - The error options, including the issues.
+     */
+    constructor(message: string, options: ValidationErrorOptions);
+    /**
+     * A plain, serialisable representation (suitable as a problem+json `errors` payload).
+     *
+     * @returns The issues keyed by dotted path.
+     */
+    toIssuesRecord(): Record<string, string[]>;
+}

package/dist/index.d.ts

@@ -0,0 +1,10 @@
+export * from './ValidationServiceProvider';
+export * from './Validator';
+export * from './adapters/standardSchema';
+export * from './adapters/zod';
+export * from './declarations';
+export * from './errors/ValidationError';
+export * from './middleware/validate';
+export * from './options/ValidationBlueprint';
+export * from './schema';
+export * from './validateEvent';

package/dist/index.js

@@ -0,0 +1,286 @@
+import { IntegrationError } from '@stone-js/core';
+
+/**
+ * Adapts a Zod-style schema (anything exposing a synchronous `safeParse`) to the Stone.js
+ * {@link ValidationSchema} contract. Structural — never imports Zod, so it works with any
+ * compatible engine and keeps the module dependency-free.
+ *
+ * @param schema - The Zod-like schema.
+ * @returns A Stone.js validation schema.
+ */
+function fromZod(schema) {
+    return {
+        validate: (data) => {
+            const result = schema.safeParse(data);
+            if (result.success) {
+                return { success: true, value: result.data };
+            }
+            const issues = result.error.issues.map((issue) => ({
+                path: issue.path.map((segment) => typeof segment === 'symbol' ? String(segment) : segment),
+                message: issue.message,
+                code: issue.code
+            }));
+            return { success: false, issues };
+        }
+    };
+}
+/**
+ * Whether a value looks like a Zod-style schema.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `safeParse` function.
+ */
+function isZodLike(value) {
+    return typeof value?.safeParse === 'function';
+}
+
+/**
+ * Thrown when a value fails validation.
+ *
+ * It carries the normalised {@link ValidationIssue}s so any layer can render them (an HTTP error
+ * handler into `422` + problem+json, a CLI into a table, a form into field errors). The error
+ * itself stays platform-agnostic — it knows nothing about HTTP.
+ */
+class ValidationError extends IntegrationError {
+    /** The normalised validation issues. */
+    issues;
+    /**
+     * @param message - The error message.
+     * @param options - The error options, including the issues.
+     */
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'ValidationError';
+        this.issues = options.issues;
+    }
+    /**
+     * A plain, serialisable representation (suitable as a problem+json `errors` payload).
+     *
+     * @returns The issues keyed by dotted path.
+     */
+    toIssuesRecord() {
+        return this.issues.reduce((acc, issue) => {
+            const key = issue.path.length > 0 ? issue.path.join('.') : '_';
+            acc[key] = acc[key] ?? [];
+            acc[key].push(issue.message);
+            return acc;
+        }, {});
+    }
+}
+
+/**
+ * Adapts a [Standard Schema](https://standardschema.dev) (Zod 3.24+, Valibot, ArkType, …) to the
+ * Stone.js {@link ValidationSchema} contract. Only the synchronous path is supported here; an
+ * async schema throws a clear {@link ValidationError} so the misuse is obvious.
+ *
+ * @param schema - The Standard Schema.
+ * @returns A Stone.js validation schema.
+ */
+function fromStandard(schema) {
+    return {
+        validate: (data) => {
+            const result = schema['~standard'].validate(data);
+            if (result instanceof Promise) {
+                throw new ValidationError('Asynchronous Standard Schemas are not supported by the synchronous validator.', { issues: [] });
+            }
+            if (result.issues === undefined) {
+                return { success: true, value: result.value };
+            }
+            const issues = result.issues.map((issue) => ({
+                path: (issue.path ?? []).map((segment) => {
+                    const key = typeof segment === 'object' ? segment.key : segment;
+                    return typeof key === 'symbol' ? String(key) : key;
+                }),
+                message: issue.message
+            }));
+            return { success: false, issues };
+        }
+    };
+}
+/**
+ * Whether a value implements the Standard Schema v1 contract.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `~standard` v1 entry.
+ */
+function isStandardSchema(value) {
+    const std = value?.['~standard'];
+    return std !== undefined && std.version === 1 && typeof std.validate === 'function';
+}
+
+/**
+ * Normalises any supported schema input into a Stone.js {@link ValidationSchema}.
+ *
+ * Resolution order: a Standard Schema (`~standard`) is preferred (canonical, covers Zod 3.24+,
+ * Valibot, ArkType), then a Zod-like `safeParse`, then a native Stone.js schema (`validate`).
+ *
+ * @param input - The schema to resolve.
+ * @returns A Stone.js validation schema.
+ * @throws {ValidationError} When the input is not a recognisable schema.
+ */
+function resolveSchema(input) {
+    if (isStandardSchema(input)) {
+        return fromStandard(input);
+    }
+    if (isZodLike(input)) {
+        return fromZod(input);
+    }
+    if (isNativeSchema(input)) {
+        return input;
+    }
+    throw new ValidationError('Unrecognised validation schema: expected a Standard Schema, a Zod-like schema, or a Stone.js schema.', { issues: [] });
+}
+/**
+ * Whether a value is already a native Stone.js {@link ValidationSchema}.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `validate` function.
+ */
+function isNativeSchema(value) {
+    return typeof value?.validate === 'function';
+}
+
+/**
+ * The validation service.
+ *
+ * Platform-agnostic: it validates any value against any supported schema (Zod, Valibot, ArkType
+ * via Standard Schema, or a native Stone.js schema) and knows nothing about HTTP/CLI/browser.
+ * Register it in the container (see `ValidationServiceProvider`) and resolve it as `validator`,
+ * or use the same schema directly on the frontend — one schema, both sides.
+ */
+class Validator {
+    /**
+     * Factory.
+     *
+     * @returns A new Validator instance.
+     */
+    static create() {
+        return new this();
+    }
+    /**
+     * Validate `data` against `schema`, returning a normalised result (never throws for validation
+     * failures — inspect `success`).
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns The validation result.
+     */
+    validate(schema, data) {
+        return resolveSchema(schema).validate(data);
+    }
+    /**
+     * Validate `data` and return the parsed value, or throw a {@link ValidationError} on failure.
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns The parsed value.
+     * @throws {ValidationError} When validation fails.
+     */
+    assert(schema, data) {
+        const result = this.validate(schema, data);
+        if (!result.success) {
+            throw new ValidationError('The given data failed validation.', { issues: result.issues });
+        }
+        return result.value;
+    }
+    /**
+     * Whether `data` satisfies `schema`.
+     *
+     * @param schema - The schema.
+     * @param data - The value to validate.
+     * @returns True when valid.
+     */
+    isValid(schema, data) {
+        return this.validate(schema, data).success;
+    }
+}
+
+/**
+ * Registers the {@link Validator} service (singleton) in the container, aliased as
+ * `validator`/`Validator`, so middleware, handlers and services can resolve it.
+ */
+class ValidationServiceProvider {
+    container;
+    /**
+     * @param container - The service container.
+     */
+    constructor(container) {
+        this.container = container;
+    }
+    /**
+     * Register the validation service.
+     */
+    register() {
+        this.container
+            .singletonIf(Validator, () => Validator.create())
+            .alias(Validator, ['validator', 'Validator']);
+    }
+}
+
+/**
+ * Validates several event inputs at once against their schemas.
+ *
+ * For each `[key, schema]` it validates `event.get(key)` and collects every issue (each issue's
+ * path is prefixed with its key). If any input fails, it throws a single {@link ValidationError}
+ * carrying all the issues — so the caller sees the full picture, not just the first failure.
+ *
+ * Platform-agnostic: the event only needs a `get(key)` method, so it works for HTTP, CLI, browser
+ * or any other context.
+ *
+ * @param event - The incoming event (anything with `get`).
+ * @param rules - The validation rules.
+ * @param validator - The validator to use (defaults to a fresh stateless one).
+ * @throws {ValidationError} When any input fails validation.
+ */
+function validateEvent(event, rules, validator = Validator.create()) {
+    const issues = [];
+    for (const [key, schema] of Object.entries(rules)) {
+        const result = validator.validate(schema, event.get(key));
+        if (!result.success) {
+            for (const issue of result.issues) {
+                issues.push({ ...issue, path: [key, ...issue.path] });
+            }
+        }
+    }
+    if (issues.length > 0) {
+        throw new ValidationError('The given data failed validation.', { issues });
+    }
+}
+
+/**
+ * Builds a route middleware that validates the event's inputs before the handler runs.
+ *
+ * Attach it to any route's `middleware` — declarative
+ * (`@Post('/users', { middleware: [validate({ name: NameSchema })] })`) or imperative
+ * (route definition `middleware: [validate({ ... })]`). On failure it throws a
+ * `ValidationError` (map it to `422` + problem+json in your HTTP error handler); on success the
+ * handler runs untouched. The same schema works on the frontend via the `Validator` service —
+ * one schema, both sides.
+ *
+ * @param rules - The validation rules (event key → schema).
+ * @returns A functional middleware.
+ */
+function validate(rules) {
+    const validator = Validator.create();
+    return async (event, next) => {
+        validateEvent(event, rules, validator);
+        return await next(event);
+    };
+}
+
+/**
+ * Opt-in blueprint: import and register it to enable validation.
+ *
+ * It contributes the validation service provider. `stone.providers` is an array, so this merges
+ * with the rest of the app rather than replacing anything.
+ */
+const validationBlueprint = {
+    stone: {
+        validation: {},
+        providers: [
+            ValidationServiceProvider
+        ]
+    }
+};
+
+export { ValidationError, ValidationServiceProvider, Validator, fromStandard, fromZod, isNativeSchema, isStandardSchema, isZodLike, resolveSchema, validate, validateEvent, validationBlueprint };

package/dist/middleware/validate.d.ts

@@ -0,0 +1,16 @@
+import { ValidationRules } from '../validateEvent';
+import { IncomingEvent, OutgoingResponse, FunctionalMiddleware } from '@stone-js/core';
+/**
+ * Builds a route middleware that validates the event's inputs before the handler runs.
+ *
+ * Attach it to any route's `middleware` — declarative
+ * (`@Post('/users', { middleware: [validate({ name: NameSchema })] })`) or imperative
+ * (route definition `middleware: [validate({ ... })]`). On failure it throws a
+ * `ValidationError` (map it to `422` + problem+json in your HTTP error handler); on success the
+ * handler runs untouched. The same schema works on the frontend via the `Validator` service —
+ * one schema, both sides.
+ *
+ * @param rules - The validation rules (event key → schema).
+ * @returns A functional middleware.
+ */
+export declare function validate(rules: ValidationRules): FunctionalMiddleware<IncomingEvent, OutgoingResponse>;

package/dist/options/ValidationBlueprint.d.ts

@@ -0,0 +1,26 @@
+import { ValidationOptions } from '../declarations';
+import { AppConfig, StoneBlueprint } from '@stone-js/core';
+/**
+ * Validation configuration bucket (`stone.validation`).
+ */
+export interface ValidationConfig extends ValidationOptions {
+}
+/**
+ * Application config augmented with the validation bucket.
+ */
+export interface ValidationAppConfig extends Partial<AppConfig> {
+    validation: ValidationConfig;
+}
+/**
+ * Blueprint for the validation module.
+ */
+export interface ValidationBlueprint extends StoneBlueprint {
+    stone: ValidationAppConfig;
+}
+/**
+ * Opt-in blueprint: import and register it to enable validation.
+ *
+ * It contributes the validation service provider. `stone.providers` is an array, so this merges
+ * with the rest of the app rather than replacing anything.
+ */
+export declare const validationBlueprint: ValidationBlueprint;

package/dist/schema.d.ts

@@ -0,0 +1,19 @@
+import { SchemaInput, ValidationSchema } from './declarations';
+/**
+ * Normalises any supported schema input into a Stone.js {@link ValidationSchema}.
+ *
+ * Resolution order: a Standard Schema (`~standard`) is preferred (canonical, covers Zod 3.24+,
+ * Valibot, ArkType), then a Zod-like `safeParse`, then a native Stone.js schema (`validate`).
+ *
+ * @param input - The schema to resolve.
+ * @returns A Stone.js validation schema.
+ * @throws {ValidationError} When the input is not a recognisable schema.
+ */
+export declare function resolveSchema<T>(input: SchemaInput<T>): ValidationSchema<T>;
+/**
+ * Whether a value is already a native Stone.js {@link ValidationSchema}.
+ *
+ * @param value - The value to test.
+ * @returns True when it exposes a `validate` function.
+ */
+export declare function isNativeSchema<T>(value: unknown): value is ValidationSchema<T>;

package/dist/validateEvent.d.ts

@@ -0,0 +1,30 @@
+import { IValidator, SchemaInput } from './declarations';
+/**
+ * A map of event keys to the schema that validates each one.
+ *
+ * @example
+ * ```ts
+ * { email: EmailSchema, age: AgeSchema }
+ * ```
+ */
+export type ValidationRules = Record<string, SchemaInput>;
+/** The minimal event shape the validator reads from — platform-agnostic. */
+export interface ReadableEvent {
+    get: <T>(key: string) => T | undefined;
+}
+/**
+ * Validates several event inputs at once against their schemas.
+ *
+ * For each `[key, schema]` it validates `event.get(key)` and collects every issue (each issue's
+ * path is prefixed with its key). If any input fails, it throws a single {@link ValidationError}
+ * carrying all the issues — so the caller sees the full picture, not just the first failure.
+ *
+ * Platform-agnostic: the event only needs a `get(key)` method, so it works for HTTP, CLI, browser
+ * or any other context.
+ *
+ * @param event - The incoming event (anything with `get`).
+ * @param rules - The validation rules.
+ * @param validator - The validator to use (defaults to a fresh stateless one).
+ * @throws {ValidationError} When any input fails validation.
+ */
+export declare function validateEvent(event: ReadableEvent, rules: ValidationRules, validator?: IValidator): void;

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "@stone-js/validation",
+  "version": "0.8.0",
+  "description": "Framework-agnostic input validation for Stone.js. Define a schema once (Zod, Valibot, ArkType — anything Standard Schema) and validate it identically on the backend and the frontend.",
+  "author": "Mr. Stone <evensstone@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/stone-foundation/stone-js-framework.git",
+    "directory": "stone-js-validation"
+  },
+  "homepage": "https://stonejs.dev",
+  "bugs": {
+    "url": "https://github.com/stone-foundation/stone-js-framework/issues"
+  },
+  "keywords": [
+    "StoneJS",
+    "validation",
+    "schema",
+    "zod",
+    "valibot",
+    "arktype",
+    "standard-schema",
+    "isomorphic",
+    "agnostic"
+  ],
+  "files": [
+    "/dist"
+  ],
+  "type": "module",
+  "sideEffects": false,
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "engines": {
+    "node": ">=18.17.0"
+  },
+  "peerDependencies": {
+    "@stone-js/core": "0.8.0"
+  },
+  "devDependencies": {
+    "@commitlint/cli": "^19.8.1",
+    "@commitlint/config-conventional": "^19.8.1",
+    "@rollup/plugin-commonjs": "^28.0.6",
+    "@rollup/plugin-multi-entry": "^6.0.1",
+    "@rollup/plugin-node-resolve": "^16.0.1",
+    "@rollup/plugin-typescript": "^12.1.4",
+    "@types/node": "^24.0.7",
+    "@vitest/coverage-v8": "^3.2.4",
+    "husky": "^9.1.7",
+    "rimraf": "^6.0.1",
+    "rollup": "^4.44.1",
+    "rollup-plugin-node-externals": "^8.0.1",
+    "ts-standard": "^12.0.2",
+    "tslib": "^2.8.1",
+    "typedoc": "^0.28.6",
+    "typedoc-plugin-markdown": "^4.7.0",
+    "typescript": "^5.6.3",
+    "vitest": "^3.2.4",
+    "zod": "^3.24.1",
+    "@stone-js/core": "0.8.0"
+  },
+  "ts-standard": {
+    "globals": [
+      "it",
+      "test",
+      "vi",
+      "expect",
+      "describe",
+      "beforeEach"
+    ]
+  },
+  "scripts": {
+    "lint": "ts-standard src",
+    "lint:fix": "ts-standard --fix src tests",
+    "predoc": "rimraf docs",
+    "doc": "typedoc",
+    "clean": "rimraf dist",
+    "build": "rollup -c",
+    "test": "vitest run",
+    "test:cvg": "npm run test -- --coverage",
+    "test:text": "npm run test:cvg -- --coverage.reporter=text",
+    "test:html": "npm run test:cvg -- --coverage.reporter=html",
+    "test:clover": "npm run test:cvg -- --coverage.reporter=clover"
+  }
+}