Skip to content

fix: strict type safety with Zod validation and comprehensive negative tests#9

Merged
caballeto merged 1 commit into
mainfrom
fix/type-safety-validation-audit
Apr 19, 2026
Merged

fix: strict type safety with Zod validation and comprehensive negative tests#9
caballeto merged 1 commit into
mainfrom
fix/type-safety-validation-audit

Conversation

@caballeto
Copy link
Copy Markdown
Member

Summary

  • Regenerate all types from corrected OpenAPI spec (nullable/default annotation fixes from API)
  • Add Zod schema generation pipeline (scripts/generate-zod.mjssrc/lib/api-zod.generated.ts)
  • Update YAML validator and transform modules to use generated Zod schemas for channel configs
  • Fix all YAML test fixtures to use frequencySeconds (not frequency) and config.channelType (not top-level type)
  • Add ~130 new negative YAML validation tests covering invalid structures, wrong types, bad enums, invalid patterns, and bad references
  • Add generated file to eslint ignores, export ChannelConfigSchema union

Test plan

  • npm run typecheck — 0 errors
  • npm run lint — 0 errors
  • npm test — all tests passed
  • Surface tests (monorepo) — 342 passed (imperative + BDD + negative), 0 failed

Made with Cursor

…hensive negative tests

- Regenerate types from corrected OpenAPI spec (nullable/default fixes)
- Add Zod schema generation pipeline (scripts/generate-zod.mjs -> src/lib/api-zod.generated.ts)
- Update YAML validator and transform to use generated Zod schemas
- Fix YAML fixtures (frequencySeconds, channelType in config) to match current schema
- Add ~130 negative YAML validation tests (test/yaml/negative-validation.test.ts)
- Add generated file to eslint ignores
- Export ChannelConfigSchema union from zod-schemas.ts

Made-with: Cursor
@caballeto caballeto merged commit 911297c into main Apr 19, 2026
3 checks passed
@caballeto caballeto deleted the fix/type-safety-validation-audit branch April 19, 2026 08:58
caballeto added a commit that referenced this pull request May 5, 2026
…confirm (#27)

The single-record table renderer used by `monitors create` (and every
other CRUD `create` / `get` command) JSON-stringified nested objects in
full, so a `MonitorDto.incidentPolicy` blob blew the value column out to
~1500 characters and pushed the freshly-minted monitor id off-screen.
Truncate object previews to 80 chars with a `(use --output json for
full)` hint so the id and the rest of the record stay readable; JSON /
YAML output is untouched.

`monitors delete <id>` (and every other CRUD `delete`) now prompts for
confirmation showing the resource's name + id (best-effort GET — typo'd
ids surface a 404 before the prompt). `--yes` / `-y` skips the prompt
for scripted use. In a non-TTY context (CI, piped stdin) we refuse with
an EXIT_CODES.VALIDATION error rather than hanging on a prompt that
nobody can answer.

Round-2 DevEx friction P1 #8 + P1 #9.

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant