@polygonlabs/zod-to-openapi-heyapi@3.0.0

Major Changes

• #86 34f408d Thanks @MaximusHaximus! - Generated clients' TransportError and ResponseValidationError now extend @polygonlabs/verror's VError instead of the bare Error global, so consumers get VError.info(), serializeError(), and cause-chain helpers for free on wrapper-emitted errors.

  Breaking change

  Install the new required runtime peer dependency, then regenerate your client:

  pnpm add @polygonlabs/verror

  Behaviour changes

  • .message now includes the accumulated cause message. The as-constructed message alone is available as .shortMessage.
  • ResponseValidationError.body is now a getter backed by VError's info bag — error.body still reads the same way, and VError.info(error).body / serializeError(error) now see it too.
  • isTransportError, isResponseValidationError, isWrapperError, and their marker symbols are unchanged — existing narrowing code keeps working.

@polygonlabs/zod-to-openapi-heyapi@2.1.0

Minor Changes

• #83 340bdb2 Thanks @MaximusHaximus! - schemasFrom now resolves from the consumer's perspective — '#schemas' aliases work

  The codegen-time audit used to dynamic-import schemasFrom with the plugin's own install location as the resolution referrer, so a consumer's package.json#imports alias ('#schemas') could never resolve — the documented same-package recipe failed for every real installation, while bare package names worked only via the package manager's store layout. The audit now anchors resolution at the codegen output directory — the exact location the generated client's emitted import { Name } from '<schemasFrom>' statements resolve from — so audit-time and consumer-runtime resolution are identical by construction, including imports aliases with their conditions, exports maps, and the running process's --conditions flags.

  • '#schemas' is the canonical schemasFrom for schemas living in the same package as the codegen: declare the alias under imports and point it at the schema barrel. No package name, exports entry, or self-dependency is needed.
  • If you adopted the "<name>": "link:." self-dependency workaround from the 2.0.4 docs: remove the self-link (and the exports entry, if nothing else consumes it) and switch schemasFrom to a # alias.
  • Package specifiers (@org/pkg, @org/pkg/zod) for separate schemas packages are unchanged.
  • Relative paths are now rejected with guidance instead of being undefined behavior: the emitted import must resolve identically from anywhere in the consumer package, which only aliases and package names do.
  • registryPlugin (the advanced API) gains an optional outputDir option; defineRegistryClientConfig wires it automatically from output.

@polygonlabs/zod-to-openapi-heyapi@2.0.4

Patch Changes

• #81 c514a10 Thanks @MaximusHaximus! - Report 2xx bodies that fail response validation as ResponseValidationError instead of TransportError

  Fixed

  • A success (2xx) response body that failed parseAsync against the registered response schema surfaced as a TransportError — the response transformer's ZodError was intercepted by the SDK wrapper's generic instanceof Error transport branch, so the single most important thing the codec client detects (a producer's contract drift on a success body) was reported as a network failure. It now surfaces as a ResponseValidationError carrying the parse issues (cause) and the offending post-JSON.parse body (body), in both throwOnError modes and for every wrapper flavour — full error-decoding wrappers, input-only wrappers, and pass-through ops.

  Docs

  • schemasFrom: '#schemas' (a package.json#imports alias) was documented but has never worked: Node resolves # aliases against the package containing the importing module, and the plugin dynamic-imports schemasFrom from its own install location, where the consumer's alias is not defined. The README, option JSDoc, and the codegen-time error hint now describe the working pattern for schemas living inside the codegen package — give the package a name + exports entry, self-link it ("<name>": "link:." in devDependencies), and pass the package's own name.

@polygonlabs/zod-codecs@1.2.0

Minor Changes

• #81 d46e7d4 Thanks @MaximusHaximus! - Add SafeIntegerCodec — wire integer string ↔ runtime number

  For string-transported integers that fit a plain JS number — query and path parameters (chain ids, page numbers, limits, counts) always arrive as strings, and the runtime wants a number. Decoding rejects values outside the safe-integer range, so an oversized digit string fails loudly instead of silently rounding.

  This is the sanctioned replacement for z.coerce.number() in registry contracts: in zod v4 a coercing schema's input type is unknown, so the generated OpenAPI documents the parameter as optional and nullable regardless of intent. The codec declares both the wire and runtime sides honestly. For range-constrained parameters, roll a local codec with a constrained output schema (example in the codec's JSDoc).

@polygonlabs/openapi-registry@3.0.0

Major Changes

• #81 9edc162 Thanks @MaximusHaximus! - registerPath now rejects coercing schemas (z.coerce.*) in parameter positions

  Breaking change

  TypedRegistry.registerPath throws at generate time when request.params, request.query, or request.headers contains a coercing schema (z.coerce.number(), z.coerce.date(), …), including when wrapped in .optional() / .default() / .nullable().

  Why: in zod v4 a coercing schema's input type is unknown, so the generated OpenAPI marks the parameter required: false, nullable: true regardless of the author's intent — a required parameter silently documents as optional-and-nullable, and every codegen consumer inherits the misdocumented contract. The audit turns that silent corruption into a loud error on the engineer's machine, in the same spirit as the sealed shared-registry conflict check.

  Migration

  • Parameter converted by the server binding: declare the logical type plainly — z.coerce.number().int() → z.number().int().
  • Wire string with a different runtime type: use a codec that declares both sides — e.g. Int64Codec / IsoDateCodec from @polygonlabs/zod-codecs. Codecs (z.codec(...)) are unaffected by the audit.
  • Request bodies are not audited — JSON bodies carry typed values on the wire.

  The check is also exported directly as assertNoCoercingParamSchemas for use outside TypedRegistry.

Minor Changes

• #81 0fcf6b3 Thanks @MaximusHaximus! - Make the auto-injected standard error responses configurable per registry

  new TypedRegistry({ standardErrorResponses }) now controls the framework-emitted error responses injected into every registerPath call:

  • false — inject nothing; every route documents exactly the responses it declares.
  • { serverError?, validationError?, notAuthenticated? } — override the schema for individual slots; omitted slots keep their defaults.
  • Omitted — unchanged default behaviour.

  The default shapes document @polygonlabs/express's error middleware, which is correct for services using it but wrong for any other producer: a spec authored with this registry for a non-Express backend would otherwise advertise 500/400/401 shapes its server never emits, and the injected ErrorResponse component name can collide with the service's own same-named schema of a different shape. The injection rules (when a 400/401/500 is added) are unchanged — only the shapes are configurable.

  The option is mirrored at the type level: the Ops accumulator reports the configured schema types (or omits the slots entirely under false), so OperationsOf consumers and codegen'd clients see the shapes the runtime registry actually holds. inferStandardErrorResponses accepts the same options as an optional second argument; existing single-argument calls are unaffected.

@polygonlabs/express@5.0.0

Patch Changes

• Updated dependencies [9edc162, 0fcf6b3]:
  • @polygonlabs/openapi-registry@3.0.0

@polygonlabs/sync-github-releases@1.0.5

Patch Changes

• #79 fbc9df6 Thanks @MaximusHaximus! - Fixed a silent no-op when a target repo pins a different pnpm version than the
  one running the tool. Package discovery shells out to pnpm m ls inside the
  clone; if that repo's packageManager field names a version other than the
  active pnpm, pnpm refuses to run at all. The failure was swallowed, so the run
  reported discovered 0 package(s), skip: no changelog match for every
  release, and errors=0 — indistinguishable from a repo that genuinely had
  nothing to sync.

  Enumeration now retries once with the package-manager version check waived. The
  retry is a fallback rather than the default path, because the flag that waives
  the check postdates pnpm 10 and passing it up front would break enumeration for
  anyone on an older pnpm.

  When enumeration still fails and the repo does have a root package.json, the
  run now says so explicitly instead of reporting a clean pass. Repos with no root
  package.json have nothing to enumerate and stay quiet as before.

@polygonlabs/zod-to-openapi-heyapi@2.0.3

Patch Changes

• #75 17845a2 Thanks @MaximusHaximus! - Raise the minimum supported @hey-api/openapi-ts to 0.97.3, which resolves a security advisory affecting earlier releases.

  The @hey-api/openapi-ts peer dependency floor is now >=0.97.3 (previously >=0.95.0). Update your @hey-api/openapi-ts dependency to 0.97.3 or later and regenerate your clients — the bundled runtime templates (client.gen.ts and friends) change between these versions.

@polygonlabs/zod-to-openapi-heyapi@2.0.2

Patch Changes

• #73 006cf08 Thanks @MaximusHaximus! - Ship the LICENSE file inside the published npm package

  The previous release added the Apache-2.0 license at the repo root and
  declared it in package.json, but npm only auto-includes a LICENSE file
  in the packed tarball when it lives in the same directory as the
  package's own package.json. The license metadata was correct but the
  actual license text was missing from the published package — this adds
  it.

@polygonlabs/zod-to-openapi-heyapi@2.0.1

Patch Changes

• #71 aa81b1a Thanks @MaximusHaximus! - Add Apache-2.0 license: the package now declares "license": "Apache-2.0" in its package.json, and the repository carries the full Apache License 2.0 text. Previously no license was declared.