refactor(ai): remove zod from the dependency graph - #1038
Open
AlemTuzlak wants to merge 1 commit into
Open
Conversation
Bump `@ag-ui/core` to `0.1.1-canary.beta.0`, the only published version that
declares zod as an optional peer rather than a runtime dependency. Every prior
version (including `0.0.57`) hard-depends on zod, so it was installed
transitively for every `@tanstack/ai` consumer.
`chatParamsFromRequest` / `chatParamsFromRequestBody` were the sole zod
consumers here — they validated request bodies with AG-UI's
`RunAgentInputSchema`, which the canary moved to the `@ag-ui/core/schemas`
subpath. Since this module is re-exported from the package root, importing that
subpath (statically or lazily) would keep zod on the critical path for anyone
calling `import { chat } from '@tanstack/ai'`. Instead both helpers now validate
the same `RunAgentInput` contract structurally, transcribed from the upstream
schema definitions: `tools`/`context` stay required arrays, `parentRunId` /
`state` / `forwardedProps` / `resume` optional, and messages discriminate on
`role` per variant.
`@tanstack/ai` now ships with no schema-validation runtime at all and neither
requires nor suggests zod. zod remains fully supported for defining tools.
No API change: both helpers keep their signatures, still reject non-conforming
bodies with `AGUIError` (`chatParamsFromRequest` still throws a 400 `Response`),
and still carry TanStack's canonical `parts` through on messages. Validation
failures now name the offending field (`messages[1].content must be a string`)
instead of dumping zod issues.
Two deliberate behavior notes:
- `forwardedProps` is now validated as an object. Upstream typed it `z.any()`,
so a non-object previously passed through and violated the declared
`Record<string, unknown>` return type.
- Unknown fields on individual messages now pass through instead of being
stripped by `z.object`, which is more forward-compatible with newer AG-UI
message fields. Unknown top-level fields are still dropped by construction,
so the `cursor` behavior is unchanged.
Also fixes a middleware snippet in the Vercel AI SDK comparison doc. The canary
replaced zod-inferred event types with hand-written interfaces, so
`'delta' in chunk` no longer filters the `AGUIEvent` union — every member is
retained and intersected with `Record<'delta', unknown>`, typing `delta` as
`unknown`. The snippet now discriminates on `type`, the real discriminant, which
narrows `delta` to `string` with no non-null assertion.
Contributor
📝 WalkthroughWalkthrough
ChangesAG-UI request validation
Middleware redaction documentation
Estimated code review effort: 4 (Complex) | ~45 minutes Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant RequestBody
participant chatParamsFromRequestBody
participant AGUIValidators
participant AGUIError
RequestBody->>chatParamsFromRequestBody: provide unknown request body
chatParamsFromRequestBody->>AGUIValidators: validate fields and nested entries
AGUIValidators-->>chatParamsFromRequestBody: return validated values
AGUIValidators-->>AGUIError: report invalid field
chatParamsFromRequestBody-->>RequestBody: return reconstructed chat parameters
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
🚀 Changeset Version Preview19 package(s) bumped directly, 32 bumped as dependents. 🟥 Major bumps
🟨 Minor bumps
🟩 Patch bumps
|
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
|
View your CI Pipeline Execution ↗ for commit 9887698
☁️ Nx Cloud last updated this comment at |
@tanstack/ai
@tanstack/ai-acp
@tanstack/ai-angular
@tanstack/ai-anthropic
@tanstack/ai-bedrock
@tanstack/ai-claude-code
@tanstack/ai-client
@tanstack/ai-code-mode
@tanstack/ai-code-mode-skills
@tanstack/ai-codex
@tanstack/ai-devtools-core
@tanstack/ai-durable-stream
@tanstack/ai-elevenlabs
@tanstack/ai-event-client
@tanstack/ai-fal
@tanstack/ai-gemini
@tanstack/ai-grok
@tanstack/ai-grok-build
@tanstack/ai-groq
@tanstack/ai-isolate-cloudflare
@tanstack/ai-isolate-node
@tanstack/ai-isolate-quickjs
@tanstack/ai-mcp
@tanstack/ai-memory
@tanstack/ai-mistral
@tanstack/ai-ollama
@tanstack/ai-openai
@tanstack/ai-opencode
@tanstack/ai-openrouter
@tanstack/ai-persistence
@tanstack/ai-preact
@tanstack/ai-react
@tanstack/ai-react-ui
@tanstack/ai-sandbox
@tanstack/ai-sandbox-cloudflare
@tanstack/ai-sandbox-daytona
@tanstack/ai-sandbox-docker
@tanstack/ai-sandbox-local-process
@tanstack/ai-sandbox-sprites
@tanstack/ai-sandbox-vercel
@tanstack/ai-solid
@tanstack/ai-solid-ui
@tanstack/ai-svelte
@tanstack/ai-utils
@tanstack/ai-vue
@tanstack/ai-vue-ui
@tanstack/openai-base
@tanstack/preact-ai-devtools
@tanstack/react-ai-devtools
@tanstack/solid-ai-devtools
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (2)
docs/migration/ag-ui-compliance.md (1)
383-385: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd a language to the fenced block.
markdownlint reports MD040 for this block. Use
textso the docs lint gate passes.📝 Proposed fix
-``` +```text Request body is not a valid AG-UI RunAgentInput. ... Validation errors: messages[1].content must be a string</details> Based on the static analysis hint MD040 (fenced-code-language) at line 383. <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.In
@docs/migration/ag-ui-compliance.mdaround lines 383 - 385, Update the fenced
code block in the AG-UI compliance documentation to specify the text language,
changing the opening fence to use text while preserving its existing contents.</details> <!-- cr-comment:v1:c69ec57803d9a17ea7ecda25 --> _Source: Linters/SAST tools_ </blockquote></details> <details> <summary>packages/ai/tests/chat-params.test.ts (1)</summary><blockquote> `218-230`: _📐 Maintainability & Code Quality_ | _🔵 Trivial_ | _⚡ Quick win_ **Add the complementary cases for `parts`, role lookup, and `toolCalls`.** This test proves that unrecognized `parts` are dropped. Three boundaries stay uncovered: - A message with recognized `parts` keeps them. - `role: 'toString'` is rejected. It is currently accepted, because `isAGUIRole` uses `in`. See the comment on `packages/ai/src/utilities/chat-params.ts` lines 41-53. - `toolCalls: [{}]` on an assistant message is rejected. See the comment on `packages/ai/src/utilities/chat-params.ts` lines 100-116. Add these three cases so the accept/reject boundary is pinned after the fixes land. <details> <summary>🤖 Prompt for AI Agents</summary>Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.In
@packages/ai/tests/chat-params.test.tsaround lines 218 - 230, Add three
complementary test cases in the chatParamsFromRequestBody suite: verify
recognized parts are preserved, verify a message with role "toString" is
rejected, and verify an assistant message with toolCalls containing an empty
object is rejected. Keep the assertions aligned with the existing invalid-parts
test and use withMessages for request construction.</details> <!-- cr-comment:v1:2824d44c490e24adf724073d --> </blockquote></details> </blockquote></details> <details> <summary>🤖 Prompt for all review comments with AI agents</summary>Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.Inline comments:
In@docs/migration/ag-ui-compliance.md:
- Around line 375-381: Update the earlier Tier 2 documentation statements that
reference Zod or AG-UI’s RunAgentInputSchema, replacing them with structural
validation against the RunAgentInput contract; keep the surrounding behavior and
terminology consistent with the later chatParamsFromRequest and
chatParamsFromRequestBody description.In
@packages/ai/src/utilities/chat-params.ts:
- Around line 100-116: Update the assistant branch in the role validation switch
to validate every element of value.toolCalls after requireArray, checking each
expected tool-call property, including id and function.name/function.arguments,
before modelMessageToUIMessage() can process it; malformed entries must produce
the existing validation error rather than throwing during conversion.- Around line 41-53: Update isAGUIRole to use an own-property membership check
with Object.hasOwn against AGUI_ROLES instead of the in operator, so inherited
names such as toString, valueOf, and constructor are rejected.
Nitpick comments:
In@docs/migration/ag-ui-compliance.md:
- Around line 383-385: Update the fenced code block in the AG-UI compliance
documentation to specify the text language, changing the opening fence to use
text while preserving its existing contents.In
@packages/ai/tests/chat-params.test.ts:
- Around line 218-230: Add three complementary test cases in the
chatParamsFromRequestBody suite: verify recognized parts are preserved, verify a
message with role "toString" is rejected, and verify an assistant message with
toolCalls containing an empty object is rejected. Keep the assertions aligned
with the existing invalid-parts test and use withMessages for request
construction.</details> <details> <summary>🪄 Autofix (Beta)</summary> Fix all unresolved CodeRabbit comments on this PR: - [ ] <!-- {"checkboxId": "4b0d0e0a-96d7-4f10-b296-3a18ea78f0b9"} --> Push a commit to this branch (recommended) - [ ] <!-- {"checkboxId": "ff5b1114-7d8c-49e6-8ac1-43f82af23a33"} --> Create a new PR with the fixes </details> --- <details> <summary>ℹ️ Review info</summary> <details> <summary>⚙️ Run configuration</summary> **Configuration used**: defaults **Review profile**: CHILL **Plan**: Pro Plus **Run ID**: `5ef51077-f12e-4023-97f7-b47d10d6253d` </details> <details> <summary>📥 Commits</summary> Reviewing files that changed from the base of the PR and between 826cfed738ec19e8f416bc5373ad50de0c1824cc and 988769877e42c4d35a697686807875030ab5b088. </details> <details> <summary>⛔ Files ignored due to path filters (1)</summary> * `pnpm-lock.yaml` is excluded by `!**/pnpm-lock.yaml` </details> <details> <summary>📒 Files selected for processing (7)</summary> * `.changeset/ag-ui-core-zod-free.md` * `docs/comparison/vercel-ai-sdk.md` * `docs/config.json` * `docs/migration/ag-ui-compliance.md` * `packages/ai/package.json` * `packages/ai/src/utilities/chat-params.ts` * `packages/ai/tests/chat-params.test.ts` </details> </details> <!-- This is an auto-generated comment by CodeRabbit for review status -->
Comment on lines
+375
to
+381
| `chatParamsFromRequest` / `chatParamsFromRequestBody` were the only zod | ||
| consumers: they validated the request body with AG-UI's `RunAgentInputSchema`. | ||
| They now validate the same `RunAgentInput` contract structurally. Their | ||
| signatures, their thrown types (`AGUIError`, and a 400 `Response` from | ||
| `chatParamsFromRequest`), and the `parts` passthrough on messages are all | ||
| unchanged. The one visible difference is friendlier failures — the error names | ||
| the offending field, e.g.: |
Contributor
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Update the earlier Tier 2 text, which still credits zod.
This section states that zod is no longer used. Lines 133 and 157 of the same document still describe "Zod validation against RunAgentInputSchema" and validation "against AG-UI RunAgentInputSchema". Readers see two different mechanisms in one page. Reword those two lines to describe structural validation of the RunAgentInput contract.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/migration/ag-ui-compliance.md` around lines 375 - 381, Update the
earlier Tier 2 documentation statements that reference Zod or AG-UI’s
RunAgentInputSchema, replacing them with structural validation against the
RunAgentInput contract; keep the surrounding behavior and terminology consistent
with the later chatParamsFromRequest and chatParamsFromRequestBody description.
Comment on lines
+41
to
+53
| const AGUI_ROLES: Record<AGUIRole, true> = { | ||
| developer: true, | ||
| system: true, | ||
| assistant: true, | ||
| user: true, | ||
| tool: true, | ||
| activity: true, | ||
| reasoning: true, | ||
| } | ||
|
|
||
| function isAGUIRole(value: unknown): value is AGUIRole { | ||
| return typeof value === 'string' && value in AGUI_ROLES | ||
| } |
Contributor
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Show the AG-UI Role union and Message variants for the pinned canary.
set -euo pipefail
fd -t f -g '*.d.ts' . node_modules/@ag-ui/core 2>/dev/null | head -20 || true
rg -n -C3 'type Role|ToolCall|toolCalls' --glob '**/@ag-ui/core/**/*.d.ts' . 2>/dev/null | head -60 || \
echo 'Package not installed in sandbox; inspect the published types instead.'Repository: TanStack/ai
Length of output: 513
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== Locate chat-params and relevant package files =="
fd -t f -g 'chat-params.ts' .
fd -t f -g 'package.json' packages/ai packages 2>/dev/null | head -40
echo "== chat-params outline =="
ast-grep outline packages/ai/src/utilities/chat-params.ts || true
echo "== chat-params relevant content =="
nl -ba packages/ai/src/utilities/chat-params.ts | sed -n '1,140p'
echo "== usage of assertAGUIMessage / AGUI roles =="
rg -n "assertAGUIMessage|AGUIRole|isAGUIRole|AGUI_ROLES|`@ag-ui/core`" packages/ai/src packages -g '*.{ts,tsx}' | head -100Repository: TanStack/ai
Length of output: 2860
🌐 Web query:
@ag-ui/core 0.1.1-canary.beta.0 type Role AGUI Role
💡 Result:
In the @ag-ui/core library, the Role type defines the possible participants in the Agent User Interaction (AG-UI) Protocol [1][2]. It is implemented as a union of string literals in TypeScript [1] and a Literal type in Python [2]. The Role type includes the following values: - developer [1][2] - system [1][2] - assistant [1][2] - user [1][2] - tool [1][2] - activity [1][2] - reasoning [1][2] These roles act as a discriminator for message types within the protocol, determining the structure and permitted fields of a message [3][4]. For example, a message with the role "tool" requires a toolCallId field [3], while a "user" role may support multimodal content parts [5]. Regarding the version specified, @ag-ui/core 0.1.1-canary.beta.0 does not appear in the official npm registry version history as of July 31, 2026; the package has active development under the 0.0.x branch [6][7][8]. Users are advised to rely on the latest stable or canary releases documented in the official AG-UI protocol documentation [9][10].
Citations:
- 1: https://docs.ag-ui.com/sdk/js/core/types
- 2: https://docs.ag-ui.com/sdk/python/core/types
- 3: https://github.com/lurus92/askvio-genui/blob/main/.cursor/skills/copilotkit-agui/references/protocol-spec.md
- 4: https://docs.ag-ui.com/sdk/dotnet/abstractions/types
- 5: https://docs.ag-ui.com/sdk/js/core/multimodal-inputs
- 6: https://registry.npmjs.org/%40ag-ui%2Fcore
- 7: https://npmx.dev/package/@ag-ui/core/v/0.0.56-canary.clone-oom-fix.0
- 8: https://npmx.dev/package-timeline/@ag-ui/core/v/0.0.57
- 9: https://docs.ag-ui.com/sdk/js/core/overview
- 10: https://github.com/ag-ui-protocol/ag-ui?tab=readme-ov-file
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== chat-params.ts relevant content =="
awk '{printf "%5d\t%s\n", NR, $0}' packages/ai/src/utilities/chat-params.ts | sed -n '1,160p'
echo "== usage of assertAGUIMessage / AGUI roles / package version =="
rg -n "assertAGUIMessage|AGUIRole|isAGUIRole|AGUI_ROLES|`@ag-ui/core`" packages/ai/src packages -g '*.{ts,tsx}' | head -120
awk '{printf "%5d\t%s\n", NR, $0}' packages/ai/package.json | sed -n '1,220p'
echo "== JavaScript prototype membership behavior =="
node - <<'JS'
const AGUI_ROLES = {
developer: true,
system: true,
assistant: true,
user: true,
tool: true,
activity: true,
reasoning: true,
}
for (const value of ['toString', 'valueOf', 'constructor', 'activity', 'unknown']) {
console.log(JSON.stringify(value), {
typeof: typeof value,
in_member: value in AGUI_ROLES,
hasOwn_member: Object.hasOwn(AGUI_ROLES, value),
ownKeys: Object.keys(AGUI_ROLES),
})
}
JSRepository: TanStack/ai
Length of output: 19770
Use Object.hasOwn for the role membership check.
in checks the prototype chain, so messages with role: 'toString', role: 'valueOf', or role: 'constructor' pass isAGUIRole(). Those values then fall through the switch without any role-specific validation.
🔒 Proposed fix
function isAGUIRole(value: unknown): value is AGUIRole {
- return typeof value === 'string' && value in AGUI_ROLES
+ return typeof value === 'string' && Object.hasOwn(AGUI_ROLES, value)
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| const AGUI_ROLES: Record<AGUIRole, true> = { | |
| developer: true, | |
| system: true, | |
| assistant: true, | |
| user: true, | |
| tool: true, | |
| activity: true, | |
| reasoning: true, | |
| } | |
| function isAGUIRole(value: unknown): value is AGUIRole { | |
| return typeof value === 'string' && value in AGUI_ROLES | |
| } | |
| const AGUI_ROLES: Record<AGUIRole, true> = { | |
| developer: true, | |
| system: true, | |
| assistant: true, | |
| user: true, | |
| tool: true, | |
| activity: true, | |
| reasoning: true, | |
| } | |
| function isAGUIRole(value: unknown): value is AGUIRole { | |
| return typeof value === 'string' && Object.hasOwn(AGUI_ROLES, value) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/ai/src/utilities/chat-params.ts` around lines 41 - 53, Update
isAGUIRole to use an own-property membership check with Object.hasOwn against
AGUI_ROLES instead of the in operator, so inherited names such as toString,
valueOf, and constructor are rejected.
Comment on lines
+100
to
+116
| switch (role) { | ||
| case 'assistant': | ||
| // Both optional: a tool-calling turn carries no text content. | ||
| if (value.content !== undefined) { | ||
| requireString(value.content, `${at}.content`) | ||
| } | ||
| if (value.toolCalls !== undefined) { | ||
| requireArray(value.toolCalls, `${at}.toolCalls`) | ||
| } | ||
| break | ||
| case 'user': | ||
| if (typeof value.content !== 'string' && !Array.isArray(value.content)) { | ||
| invalidBody( | ||
| `${at}.content must be a string or an array of content parts`, | ||
| ) | ||
| } | ||
| break |
Contributor
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Description: Find downstream reads of AG-UI toolCalls entries that assume a validated shape.
set -euo pipefail
rg -nP --type=ts -C3 'toolCalls\s*(\?\.|\[)|\.function\.(name|arguments)' packages/ai/src | head -80Repository: TanStack/ai
Length of output: 6902
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== file size/outline =="
wc -l packages/ai/src/utilities/chat-params.ts packages/ai/src/activities/chat/messages.ts
ast-grep outline packages/ai/src/utilities/chat-params.ts packages/ai/src/activities/chat/messages.ts --view compact 2>/dev/null | sed -n '1,180p'
echo "== chat-params relevant slice =="
cat -n packages/ai/src/utilities/chat-params.ts | sed -n '1,180p'
echo "== messages relevant slice =="
cat -n packages/ai/src/activities/chat/messages.ts | sed -n '380,475p'
echo "== search requireArray/isRecord definitions =="
rg -n --type=ts -C2 'function requireArray|const requireArray|requireArray\s*=|function isRecord|const isRecord|export function invalidBody|export function requireString' packages/ai/srcRepository: TanStack/ai
Length of output: 282
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== chat-params relevant slice =="
cat -n packages/ai/src/utilities/chat-params.ts | sed -n '1,180p'
echo "== messages relevant slice =="
cat -n packages/ai/src/activities/chat/messages.ts | sed -n '380,475p'
echo "== search requireArray/isRecord definitions =="
rg -n --type=ts -C2 'function requireArray|const requireArray|requireArray\s*=|function isRecord|const isRecord|export function invalidBody|export function requireString' packages/ai/src || true
echo "== behavioral probe for current validation shape access =="
node - <<'JS'
function requireArray(value, at) {
if (!Array.isArray(value)) throw new TypeError(`${at} must be an array`)
return value
}
function requireString(value, at) {}
function assertAGUIMessage(value) {}
for (const v of [null, {}, [{id: 1}], [{function: {}}], [{function: {name: 'x'}}]]) {
const role = 'assistant'
try {
if (value.content !== undefined) requireString(value.content, `${role}.content`)
if (v.toolCalls !== undefined) requireArray(v.toolCalls, `${role}.toolCalls`)
} catch (error) {
console.log('validation rejects', JSON.stringify(v), 'error:', error.message)
continue
}
// Downstream shape access modeled from packages/ai/src/activities/chat/messages.ts lines 452/459/460
try {
const toolCalls = v.toolCalls
for (const toolCall of toolCalls) {
JSON.parse(toolCall.function.arguments)
toolCall.function.name
toolCall.function.arguments
}
console.log('shape access succeeds', JSON.stringify(v))
} catch (error) {
console.log('shape access throws', JSON.stringify(v), 'name:', error.name, 'message:', error.message)
}
}
JSRepository: TanStack/ai
Length of output: 12025
Validate each toolCalls object before downstream conversion.
requireArray only checks the parent array, so toolCalls: [{}] or toolCalls: [{function: {}}] passes validation into modelMessageToUIMessage(). That code then reads toolCall.function.arguments, id, and function.name, which throws on malformed entries instead of returning the intended validation error. Add per-element checks for each expected property.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/ai/src/utilities/chat-params.ts` around lines 100 - 116, Update the
assistant branch in the role validation switch to validate every element of
value.toolCalls after requireArray, checking each expected tool-call property,
including id and function.name/function.arguments, before
modelMessageToUIMessage() can process it; malformed entries must produce the
existing validation error rather than throwing during conversion.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🎯 Changes
@tanstack/aino longer pulls zod into consumers' dependency graphs.Why it was there.
@ag-ui/corelistedzodas a runtime dependency, so every@tanstack/aiinstall got zod transitively.0.1.1-canary.beta.0is the only published version of@ag-ui/corethat declares zod as an optional peer instead — all 59 others, including0.0.57(latest),0.0.58-canary.beta.0and0.0.59-canary.*, hard-depend on it.Why the bump alone isn't enough.
chatParamsFromRequest/chatParamsFromRequestBodywere the only zod consumers in this package — they validated request bodies with AG-UI'sRunAgentInputSchema, which the canary moved to the@ag-ui/core/schemassubpath. Because that module is re-exported from the package root, importing the subpath (statically or lazily) keeps zod on the critical path for anyone doingimport { chat } from '@tanstack/ai': a static import makes zod mandatory for every consumer, and an optional peer would let them install without it and crash at import time.So both helpers now validate the same
RunAgentInputcontract structurally, transcribed from the upstream schema definitions —tools/contextstay required arrays,parentRunId/state/forwardedProps/resumeoptional, messages discriminate onroleper variant (assistantcontent optional,usercontent string-or-array,toolrequirestoolCallId,activityrequiresactivityType+ object content). The role switch is exhaustive rather thandefault-cased, and the role list is keyedRecord<AGUIRole, true>so a role added upstream fails to compile until it's handled (verified: removing one yieldsTS2741).Result:
@tanstack/aiships with no schema-validation runtime at all. Verified by importing the built entry under a resolver hook that blockszodand@ag-ui/core/schemas— the root imports fine (98 exports) and request parsing still succeeds.No API change
Both helpers keep their signatures, still reject non-conforming bodies with
AGUIError(chatParamsFromRequeststill throws a 400Responsewith the original attached ascause), and still carry TanStack's canonicalpartsthrough on messages. Validation failures now name the offending field —messages[1].content must be a stringinstead of a zod issue dump.zod remains fully supported for defining tools; it's simply no longer installed on your behalf. Projects that used zod without declaring it, relying on the transitive copy, need to add it — called out in the changeset and the migration guide.
Two deliberate behavior notes
forwardedPropsis now validated as an object. Upstream typed itz.any(), so a non-object previously passed through and violated the declaredRecord<string, unknown>return type. Happy to relax this if the looser contract was intentional.z.object, which is more forward-compatible with newer AG-UI message fields. Unknown top-level fields are still dropped by construction, so thecursorbehavior is unchanged and its test still passes.Drive-by doc fix
The canary replaced zod-inferred event types with hand-written interfaces, which changes narrowing on the
AGUIEventunion (StreamChunk = AGUIEvent). A middleware snippet indocs/comparison/vercel-ai-sdk.mdused'delta' in chunk, which no longer filters the union — every member is retained and intersected withRecord<'delta', unknown>, typingdeltaasunknown(hence{}after!). It now discriminates ontype, the real discriminant, which narrowsdeltatostringwith no non-null assertion. Treated as a correction, so itsupdatedAtisn't bumped; the migration guide's is.Tests
25 new cases in
chat-params.test.tscovering the accept/reject boundary this PR now owns: role validation, per-variant required fields, malformed tool/context/resume entries,partsdropping,statepassthrough, optionalparentRunId.✅ Checklist
pnpm run test:pr.Ran the
test:prtarget set directly rather than through the Nx wrapper — in a git worktree on this machine Nx dies withEISDIR: illegal operation on a directory, lstat 'F:'and reports phantom successes (it printed "Successfully ran target build for 50 projects" while writing nodistat all). Results:test:lib— 1335 passed (71 files)test:types— clean forpackages/ai; 51 projects via Nxtest:kiira— 876/876 snippets, 133 files, 0 errorstest:oxlint— exit 0test:sherif— no issuestest:docs— no broken linkstest:build(publint) — all goodbuild— all packages, viapnpm -rtest:knipexits 1 on 13 pre-existing config hints (apackages/react-aiworkspace entry, staleignore/ignoreDependenciespaths);knip --no-config-hintsexits 0 and none of the hints relate to this change. Left alone as unrelated config drift.🚀 Release Impact
One caveat worth an explicit decision: this pins a canary (
0.1.1-canary.beta.0) as an exact version, since^on a prerelease doesn't range as you'd expect. It's the only release with zod as a peer, so going zod-free today means shipping against the canary. If you'd rather wait for a stable0.1.x, the structural-validation half of this PR stands on its own and can land against0.0.57.Summary by CodeRabbit