Files
ontime/apps/server/package.json
T
Claude 972a246bb6 feat(server): introduce Zod request validation, starting with MCP tools
Adds Zod as the validation library for apps/server (in place of
express-validator), scoped here to a low-risk slice rather than a
full migration:

- MCP tool-call arguments (apps/server/src/api-mcp) are now validated
  end to end. Every tool's inputSchema is generated from its Zod
  schema via z.toJSONSchema() instead of hand-maintained JSON Schema
  literals, and every handler now parses its arguments before use —
  previously every handler did an unchecked `args as SomeType` cast
  with no runtime validation at all.
- A new validate.ts middleware (validateBody/validateParams) replaces
  the express-validator chokepoint for two reference routers, session
  and url-presets, demonstrating the pattern the remaining ~11 routers
  will follow in later PRs.
- An oxlint no-restricted-imports guardrail keeps zod importable only
  from apps/server, so it can never leak into the apps/client bundle.

The bulk of the REST router migration (automation, rundown, and the
rest of api-data) is intentionally left for follow-up PRs to keep this
change reviewable.
2026-07-18 13:34:07 +00:00

58 lines
1.9 KiB
JSON

{
"name": "ontime-server",
"type": "module",
"main": "src/index.ts",
"version": "4.10.0",
"exports": "./src/index.js",
"dependencies": {
"@googleapis/sheets": "^5.0.5",
"@modelcontextprotocol/sdk": "^1.15.0",
"cookie": "1.0.2",
"cookie-parser": "1.4.7",
"cors": "2.8.6",
"dotenv": "^16.0.1",
"express": "5.2.1",
"express-static-gzip": "3.0.1",
"express-validator": "7.3.2",
"fast-equals": "^6.0.0",
"google-auth-library": "^9.4.2",
"lowdb": "^7.0.1",
"multer": "2.2.0",
"ontime-utils": "workspace:*",
"osc-min": "2.1.2",
"sanitize-filename": "^1.6.3",
"ws": "^8.18.0",
"xlsx": "^0.18.5",
"zod": "catalog:"
},
"devDependencies": {
"@types/cookie-parser": "1.4.10",
"@types/cors": "2.8.19",
"@types/express": "5.0.6",
"@types/multer": "2.1.0",
"@types/node": "catalog:",
"@types/ws": "^8.5.10",
"esbuild": "^0.24.0",
"ontime-types": "workspace:*",
"server-timing": "^3.3.3",
"ts-essentials": "catalog:",
"tsx": "^4.19.2",
"typescript": "catalog:",
"vitest": "catalog:"
},
"scripts": {
"addversion": "node -p \"'export const ONTIME_VERSION = ' + JSON.stringify(require('../../package.json').version) + ';'\" > src/ONTIME_VERSION.js",
"postinstall": "pnpm addversion",
"dev": "cross-env NODE_ENV=development tsx watch --tsconfig tsconfig.app.json ./src/index.ts",
"dev:electron": "pnpm dev",
"dev:inspect": "cross-env NODE_ENV=development tsx watch --tsconfig tsconfig.app.json --inspect ./src/index.ts",
"lint": "oxlint --quiet --type-aware",
"typecheck": "tsc -p tsconfig.app.json --noEmit",
"prebuild": "tsx --tsconfig tsconfig.app.json ./scripts/bundleDefaults.ts",
"build": "node esbuild.js",
"test": "cross-env IS_TEST=true vitest",
"test:inspect": "cross-env IS_TEST=true vitest --inspect --no-file-parallelism",
"test:pipeline": "cross-env IS_TEST=true vitest run"
}
}