Asynchronous validation

The public HTTP schema custom callback returns boolean | string, not a promise. Do not pass an async function: a promise can be mistaken for a successful result rather than awaited.

Perform asynchronous business checks in an awaited service/controller step after structural validation. For example, validate an email's shape, then query your service to check eligibility. Enforce uniqueness with database constraints as well; a preflight availability check alone races concurrent writes.

Apply timeouts and rate limits to remote checks. Treat unavailable dependencies as errors according to your application policy; do not silently authorize on failure. Avoid returning existence information about private accounts.

The internal AI validation parser and DTO decorators are not public APIs. See schemas, cross-field checks and error responses.