gem-hunter
Language: TypeScript
Lightweight, type-safe request validation middleware for Express using Zod.
Lightweight, type-safe request and response validation middleware for Express using Zod.
Unlike other validation libraries, echt provides complete end-to-end type safety and built-in response validation while leveraging the full power of Zod's schema validation.
npm install echt # or yarn add echt # or pnpm add echt
Note: express and zod are peer dependencies and must be installed separately.
import express from 'express' import { validate } from 'echt' import { z } from 'zod' const app = express() app.use(express.json()) // Define your schema once, get full type safety const userSchema = { body: z.object({ name: z.string(), age: z.number() }), response: z.object({ id: z.string(), name: z.string(), age: z.number() }) } // Validation and type inference work automatically app.post('/users', validate(userSchema), (req, res) => { const { name, age } = req.body // ✅ Fully typed res.json({ id: '123', name, age }) // ✅ Response validated })
echt supports comprehensive validation for all parts of the request-response cycle:
const schema = { // Request body validation body: z.object({ username: z.string(), age: z.number() }), // URL parameters (e.g., /users/:id) params: z.object({ id: z.string().uuid() }), // Query string parameters (e.g., ?page=1&limit=10) query: z.object({ page: z.string().transform(Number), limit: z.string().transform(Number) }), // HTTP headers headers: z.object({ 'api-key': z.string(), 'content-type': z.string().optional() }), // Express locals (useful for middleware communication) locals: z.object({ userId: z.string(), permissions: z.array(z.string()) }) } app.get('/users/:id', validate(schema), (req, res) => { // All properties are fully typed const { id } = req.params const { page, limit } = req.query const { userId } = res.locals // ... })
There are two ways to validate responses in echt: using response and useResponse schemas.
The response schema provides basic response validation without status code differentiation:
const schema = { response: z.object({ success: z.boolean(), data: z.any() }) } app.get('/data', validate(schema), (req, res) => { res.json({ success: true, data: { /* ... */ } }) })
The useResponse schema provides granular control over response validation based on status codes. When using useResponse, you must use the .use() wrapper instead of passing the middleware directly:
const schema = { useResponse: { 200: z.object({ data: z.array(z.string()) }), 404: z.object({ error: z.string() }), 500: z.object({ message: z.string(), code: z.literal('INTERNAL_SERVER_ERROR'), requestId: z.string() }) } } // ❌ This will throw an error app.get('/data', validate(schema), (req, res) => {}) // ✅ This is the correct way app.get( '/data', validate(schema).use((req, res) => { if (!data) { return res.status(404).json({ error: 'Not found' }) } try { // your logic here res.json({ data: ['item1', 'item2'] }) } catch (error) { res.status(500).json({ message: 'Internal server error occurred', code: 'INTERNAL_SERVER_ERROR', requestId: generateRequestId() }) } }) )
The .use() wrapper is required with useResponse because it sets up the proper type inference and validation for different status codes. Without it, the middleware won't be able to properly validate responses against their corresponding status code schemas.
When using response validation, make sure to define schemas for all possible response status codes. The middleware will throw an error if you try to send a response with an undefined status code.
TypeScript Errors with Response Validation
If you're seeing TypeScript errors with response validation, ensure you're using the .use() wrapper with useResponse schemas.
Validation Not Working
Make sure you've added express.json() middleware before using echt.
Contributions are welcome! Please feel free to submit a Pull Request. For major changes, please open an issue first to discuss what you would like to change.
git checkout -b feature/AmazingFeature)git commit -m 'Add some AmazingFeature')git push origin feature/AmazingFeature)MIT License
Copyright (c) 2025 Armagan Amcalar
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.