typespec-http-zod 0.12.0 → 0.13.0

package/dist/src/api.js

@@ -1360,7 +1360,28 @@ function responseArmsOf(route, response, alternate) {
      * declares. Each arm resolves its own body now, so an arm with no schema is a response the document
      * says carries no body, and saying `undefined` is the truthful answer rather than a guess.
      */
+    /**
+     * **An error arm whose status the primary arm already answers is dropped, primary winning.**
+     *
+     * `errorArmsOf` excludes 2xx from the failure arms, so widening the primary to include 3xx made a
+     * redirect BOTH: `[{ status: 302, schema: undefined, headers: [...] }, { status: 302, schema:
+     * undefined }]`, two arms for one status where the second shadows the first's headers for anything
+     * scanning past the first match.
+     *
+     * Widening `isSuccessKey` to match would be wrong in the other direction: an operation declaring a
+     * 200 AND a 302 has 200 as its primary, so the 302 must stay a failure arm to be emitted at all.
+     * Deduplicating here keeps both cases, because it asks what was actually emitted rather than what
+     * might have been.
+     */
+    const emitted = new Set();
+    for (const arm of arms) {
+        const status = /status: ([^,}]+)/.exec(arm)?.[1]?.trim();
+        if (status !== undefined)
+            emitted.add(status);
+    }
     for (const arm of route.errorArms) {
+        if (emitted.has(String(arm.status)) || emitted.has(JSON.stringify(arm.status)))
+            continue;
         arms.push(`{ status: ${JSON.stringify(arm.status)}, schema: ${arm.schema ?? "undefined"} }`);
     }
     return `[${arms.join(", ")}]`;

package/dist/src/zod.js

@@ -337,18 +337,34 @@ const SCALARS = {
     decimal128: "z.number()",
     numeric: "z.number()",
     /**
-     * Dates cross the wire as strings and are validated as strings.
+     * **A declared TYPE is a claim about the value, and these check it.**
      *
-     * Not `z.iso.datetime()`: response schemas are permissive on purpose, and a
-     * stricter format check here would turn a producer emitting a legal-but-unexpected instant into a
-     * failed response for a caller who could have parsed it perfectly well.
+     * These are not strings with a hint attached: they are scalars the document publishes as
+     * `format: date-time`, `format: uri` and so on. Emitting `z.string()` for them discarded a
+     * declared type, so a service promising a timestamp accepted `banana` - and a consumer who wanted
+     * the check had to rewrite the spec as `string` with a `@pattern`, losing `format: date-time` from
+     * the document AND getting a weaker check, since a hand-written pattern accepts `2026-02-31`. A
+     * rule that pushes consumers into writing worse specs is the wrong rule.
+     *
+     * **`@format("...")` on a plain string is a different case and stays unenforced.** Under JSON
+     * Schema 2020-12, which OpenAPI 3.1 uses, `format` is an annotation rather than an assertion, so
+     * enforcing an author's hint would add a rule the contract does not state, and
+     * `@format("account-number")` proves no general rule exists. A type is a claim; an annotation is a
+     * hint.
+     *
+     * **`{ offset: true }` is measured, not decorative.** The previous comment here warned that a
+     * stricter check would fail "a legal-but-unexpected instant", and it was right about the risk: a
+     * bare `z.iso.datetime()` REJECTS `2026-08-14T12:00:00+01:00`, which is valid RFC 3339 and valid
+     * `format: date-time`. With the offset permitted, every legal instant is accepted and only
+     * `2026-02-31` and `banana` are refused. `local: true` would go too far, admitting a value with no
+     * timezone at all, which RFC 3339 does not allow.
      */
-    utcDateTime: "z.string()",
-    offsetDateTime: "z.string()",
-    plainDate: "z.string()",
-    plainTime: "z.string()",
-    duration: "z.string()",
-    url: "z.string()",
+    utcDateTime: "z.iso.datetime({ offset: true })",
+    offsetDateTime: "z.iso.datetime({ offset: true })",
+    plainDate: "z.iso.date()",
+    plainTime: "z.iso.time()",
+    duration: "z.iso.duration()",
+    url: "z.url()",
 };
 function scalarToZod(program, scalar) {
     // `scalar unixTimestamp32 is utcDateTime;` with `@encode(int32)` on the SCALAR, not on each use.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "typespec-http-zod",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "description": "TypeSpec emitter and library: turn an HTTP service definition into Zod validators and framework-free contract types that agree, keyword for keyword, with the OpenAPI document @typespec/openapi3 publishes from the same source.",
   "keywords": [
     "codegen",