Validation

For npm consumers, use the public validationMiddleware and ValidationSchema for HTTP pipelines, route schemas on controller decorators through @tagna/udiot/server, and FormManager / validationRules for form UX.

The internal AI DTO/decorator system (AIDto, AIValidate, Field, AIValidationRuleParser, AISanitizer and its formatter/i18n helpers) is not exported by the RC. Do not use undocumented source or dist imports. Some legacy type-system names are exported only as TypeScript types; this does not make them runtime validators.

Public form example

import assert from 'node:assert/strict';
import { FormManager, validationRules } from '@tagna/udiot';

const form = new FormManager<{ email: string }>([{
  name: 'email',
  initialValue: '',
  required: true,
  validationRules: [validationRules.email],
}]);
form.setValue('email', 'not-an-email');
assert.ok(form.getState().errors.email);
form.setValue('email', 'reader@example.com');
assert.equal(form.getState().errors.email, '');

Client-side form validation is not a security boundary. Validate untrusted requests again on the server. Validation does not provide output escaping, parameterized SQL, authorization or safe file paths.

• HTTP schemas
• Runtime versus TypeScript types
• Async checks
• Cross-field checks
• Custom rules
• Validation ordering
• Error responses