refactor: migrate validation to compiled zod 4 (#256)

Author: kasperrt

.agents/skills/vibes-frontend/SKILL.md

@@ -30,7 +30,7 @@ Apply these repository-specific rules together with `AGENTS.md`.
 - `apps/mobile`: native-only Expo Router app for iOS and Android phones/tablets.
 - `apps/tv`: one TV product with a shared session layer, delivered through an Expo Android TV renderer and a Samsung TV DOM renderer.
 - `packages/api`: the transport package and the only package that owns `wiretyped`, backend REST calls, typed request capabilities, SSE plumbing, and narrowly scoped reusable SSE hooks.
-- `packages/models`: shared Yup schemas and derived domain types.
+- `packages/models`: shared compiled Zod 4 schemas and derived domain types.
 - `packages/shared`: platform-neutral utilities, hooks, stores, constants, and safe wrappers.
 - `packages/ui/web`: DOM components and provider players.
 - `packages/ui/native`: React Native primitives and official native provider-player wrappers shared by mobile and Android TV.

AGENTS.md

@@ -49,7 +49,7 @@ apps/cast/src/
 
 packages/
 ├── api/                   # API client
-├── models/                # Shared types and Yup schemas
+├── models/                # Shared types and compiled Zod 4 schemas
 ├── shared/                # Utilities, hooks, stores
 │   ├── src/utils/wrap.ts  # safeWrap utilities
 │   ├── src/stores/        # Shared Zustand stores (playbackStore)

apps/mobile/app.json

@@ -2,7 +2,7 @@
   "expo": {
     "name": "Zoff",
     "slug": "vibes-mobile",
-    "version": "0.2.18",
+    "version": "0.2.19",
     "orientation": "default",
     "icon": "./assets/images/icon.png",
     "scheme": "zoff",

apps/tv/app.json

@@ -2,7 +2,7 @@
   "expo": {
     "name": "Zoff TV",
     "slug": "vibes-tv",
-    "version": "0.1.11",
+    "version": "0.1.12",
     "orientation": "landscape",
     "icon": "./assets/icon.png",
     "scheme": "zoff-tv",

packages/api/package.json

@@ -15,8 +15,7 @@
   "dependencies": {
     "@vibes/models": "workspace:*",
     "@vibes/shared": "workspace:*",
-    "wiretyped": "0.3.4",
-    "yup": "1.7.1"
+    "wiretyped": "0.3.4"
   },
   "peerDependencies": {
     "react": "^19.2.7"

packages/api/src/client.ts

@@ -71,8 +71,6 @@ import {
   youTubeVideoSchema,
 } from '@vibes/models';
 
-export * as yup from 'yup';
-
 import {
   getHttpError,
   RequestClient,

packages/api/src/rateLimit.ts

@@ -65,7 +65,7 @@ export async function getAPIErrorMessage(error: Error) {
   }
 
   const [validationError, parsedBody] = safeWrap(() =>
-    errorCodeResponseSchema.validateSync(body),
+    errorCodeResponseSchema.parse(body),
   );
   if (validationError || !parsedBody?.propagate) {
     return null;

packages/models/package.json

@@ -13,7 +13,7 @@
     "lint": "biome check src"
   },
   "dependencies": {
-    "yup": "1.7.1"
+    "zod": "4.5.4"
   },
   "devDependencies": {
     "typescript": "5.9.3"

packages/models/src/schemas/admin.ts

@@ -1,115 +1,122 @@
-import * as yup from 'yup';
+import { z } from 'zod';
 
-export const adminRoomSummarySchema = yup.object({
-  id: yup.string().required(),
-  name: yup.string().required(),
-  userCount: yup.number().required(),
-  songCount: yup.number().required(),
-  activeSources: yup.array(yup.string().required()).required(),
-  hasAdminPassword: yup.boolean().required(),
-});
-export type AdminRoomSummary = yup.InferType<typeof adminRoomSummarySchema>;
+export const adminRoomSummarySchema = z.compile(
+  z.object({
+    id: z.string(),
+    name: z.string(),
+    userCount: z.number(),
+    songCount: z.number(),
+    activeSources: z.array(z.string()),
+    hasAdminPassword: z.boolean(),
+  }),
+);
+export type AdminRoomSummary = z.infer<typeof adminRoomSummarySchema>;
 
-export const adminRoomsSchema = yup.array(adminRoomSummarySchema).required();
-export type AdminRooms = yup.InferType<typeof adminRoomsSchema>;
+export const adminRoomsSchema = z.compile(z.array(adminRoomSummarySchema));
+export type AdminRooms = z.infer<typeof adminRoomsSchema>;
 
-export const adminRoomResultSchema = yup.object({
-  rooms: adminRoomsSchema,
-  from: yup.number().required(),
-  to: yup.number().required(),
-  total: yup.number().required(),
-  count: yup.number().required(),
-});
-export type AdminRoomResult = yup.InferType<typeof adminRoomResultSchema>;
+export const adminRoomResultSchema = z.compile(
+  z.object({
+    rooms: adminRoomsSchema,
+    from: z.number(),
+    to: z.number(),
+    total: z.number(),
+    count: z.number(),
+  }),
+);
+export type AdminRoomResult = z.infer<typeof adminRoomResultSchema>;
 
-export const adminRoomSearchSchema = yup.object({
-  q: yup.string().optional(),
-  sortBy: yup.string().oneOf(['listeners', 'songs']).optional(),
-  order: yup.string().oneOf(['asc', 'desc']).optional(),
-  from: yup.number().integer().min(0).optional(),
-  to: yup.number().integer().min(0).optional(),
-});
+export const adminRoomSearchSchema = z.compile(
+  z.object({
+    q: z.string().optional(),
+    sortBy: z.enum(['listeners', 'songs']).optional(),
+    order: z.enum(['asc', 'desc']).optional(),
+    from: z.int().min(0).optional(),
+    to: z.int().min(0).optional(),
+  }),
+);
 
-export const adminLoginRequestSchema = yup.object({
-  username: yup.string().required(),
-  password: yup.string().required(),
-});
-export type AdminLoginRequest = yup.InferType<typeof adminLoginRequestSchema>;
+export const adminLoginRequestSchema = z.compile(
+  z.object({ username: z.string(), password: z.string() }),
+);
+export type AdminLoginRequest = z.infer<typeof adminLoginRequestSchema>;
 
-export const adminUserSchema = yup.object({
-  id: yup.string().required(),
-  username: yup.string().required(),
-  createdAt: yup.string().required(),
-  updatedAt: yup.string().required(),
-});
-export type AdminUser = yup.InferType<typeof adminUserSchema>;
+export const adminUserSchema = z.compile(
+  z.object({
+    id: z.string(),
+    username: z.string(),
+    createdAt: z.string(),
+    updatedAt: z.string(),
+  }),
+);
+export type AdminUser = z.infer<typeof adminUserSchema>;
 
-export const adminUsersSchema = yup.array(adminUserSchema).required();
-export type AdminUsers = yup.InferType<typeof adminUsersSchema>;
+export const adminUsersSchema = z.compile(z.array(adminUserSchema));
+export type AdminUsers = z.infer<typeof adminUsersSchema>;
 
-export const adminCreateUserRequestSchema = yup.object({
-  username: yup.string().required(),
-  password: yup.string().required(),
-});
-export type AdminCreateUserRequest = yup.InferType<
+export const adminCreateUserRequestSchema = z.compile(
+  z.object({ username: z.string(), password: z.string() }),
+);
+export type AdminCreateUserRequest = z.infer<
   typeof adminCreateUserRequestSchema
 >;
 
-export const adminUpdateUserRequestSchema = yup.object({
-  password: yup.string().required(),
-});
-export type AdminUpdateUserRequest = yup.InferType<
+export const adminUpdateUserRequestSchema = z.compile(
+  z.object({ password: z.string() }),
+);
+export type AdminUpdateUserRequest = z.infer<
   typeof adminUpdateUserRequestSchema
 >;
 
-export const adminUpdateRoomRequestSchema = yup.object({
-  name: yup.string().optional(),
-  clearAdminPassword: yup.boolean().optional(),
-});
-export type AdminUpdateRoomRequest = yup.InferType<
+export const adminUpdateRoomRequestSchema = z.compile(
+  z.object({
+    name: z.string().optional(),
+    clearAdminPassword: z.boolean().optional(),
+  }),
+);
+export type AdminUpdateRoomRequest = z.infer<
   typeof adminUpdateRoomRequestSchema
 >;
 
-export const adminSessionResponseSchema = yup.object({
-  authorized: yup.boolean().required(),
-  user: adminUserSchema.optional(),
-});
-export type AdminSessionResponse = yup.InferType<
-  typeof adminSessionResponseSchema
->;
+export const adminSessionResponseSchema = z.compile(
+  z.object({ authorized: z.boolean(), user: adminUserSchema.optional() }),
+);
+export type AdminSessionResponse = z.infer<typeof adminSessionResponseSchema>;
 
-export const adminSearchUsagePointSchema = yup.object({
-  window: yup.string().oneOf(['hour', 'day']).required(),
-  timestamp: yup.string().required(),
-  provider: yup.string().required(),
-  total: yup.number().required(),
-  unique: yup.number().required(),
-  cached: yup.number().required(),
-  live: yup.number().required(),
-});
-export type AdminSearchUsagePoint = yup.InferType<
-  typeof adminSearchUsagePointSchema
->;
+export const adminSearchUsagePointSchema = z.compile(
+  z.object({
+    window: z.enum(['hour', 'day']),
+    timestamp: z.string(),
+    provider: z.string(),
+    total: z.number(),
+    unique: z.number(),
+    cached: z.number(),
+    live: z.number(),
+  }),
+);
+export type AdminSearchUsagePoint = z.infer<typeof adminSearchUsagePointSchema>;
 
-export const adminSearchUsageSchema = yup
-  .object({
-    points: yup.array(adminSearchUsagePointSchema).required(),
-    generatedAt: yup.string().required(),
-  })
-  .required();
-export type AdminSearchUsage = yup.InferType<typeof adminSearchUsageSchema>;
+export const adminSearchUsageSchema = z.compile(
+  z.object({
+    points: z.array(adminSearchUsagePointSchema),
+    generatedAt: z.string(),
+  }),
+);
+export type AdminSearchUsage = z.infer<typeof adminSearchUsageSchema>;
 
-export const listenerUsagePointSchema = yup.object({
-  window: yup.string().oneOf(['hour', 'day', 'week', 'month']).required(),
-  timestamp: yup.string().required(),
-  listeners: yup.number().required(),
-});
-export type ListenerUsagePoint = yup.InferType<typeof listenerUsagePointSchema>;
+export const listenerUsagePointSchema = z.compile(
+  z.object({
+    window: z.enum(['hour', 'day', 'week', 'month']),
+    timestamp: z.string(),
+    listeners: z.number(),
+  }),
+);
+export type ListenerUsagePoint = z.infer<typeof listenerUsagePointSchema>;
 
-export const adminListenerUsageSchema = yup
-  .object({
-    points: yup.array(listenerUsagePointSchema).required(),
-    generatedAt: yup.string().required(),
-  })
-  .required();
-export type AdminListenerUsage = yup.InferType<typeof adminListenerUsageSchema>;
+export const adminListenerUsageSchema = z.compile(
+  z.object({
+    points: z.array(listenerUsagePointSchema),
+    generatedAt: z.string(),
+  }),
+);
+export type AdminListenerUsage = z.infer<typeof adminListenerUsageSchema>;

packages/models/src/schemas/authorization.ts

@@ -1,12 +1,9 @@
-import * as yup from 'yup';
+import { z } from 'zod';
 
-export const authorizationsListSchema = yup
-  .array(yup.string().required())
-  .required();
-export type AuthorizationsList = yup.InferType<typeof authorizationsListSchema>;
+export const authorizationsListSchema = z.compile(z.array(z.string()));
+export type AuthorizationsList = z.infer<typeof authorizationsListSchema>;
 
-export const providerTokenSchema = yup.object({
-  accessToken: yup.string().required(),
-  expiresAt: yup.string().required(),
-});
-export type ProviderToken = yup.InferType<typeof providerTokenSchema>;
+export const providerTokenSchema = z.compile(
+  z.object({ accessToken: z.string(), expiresAt: z.string() }),
+);
+export type ProviderToken = z.infer<typeof providerTokenSchema>;