feat: Add Zod-based typing for API responses across frontend and backend

[knudtty]

Summary

Define API response Zod schemas in common-utils for alerts, webhooks, team, installation, and me endpoints. Apply Response typing on backend route handlers with explicit Mongoose-to-JSON serialization (ObjectId, Date, Map). Replace all any types and as Promise<T> casts in frontend TanStack Query hooks with proper generics.

How to test locally or on Vercel

1. yarn dev
2. Interact with app, ensuring nothing is broken

References

• Linear Issue: HDX-3464

[changeset-bot]

🦋 Changeset detected

Latest commit: f056c32

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 4 packages

Name	Type
@hyperdx/common-utils	Patch
@hyperdx/api	Patch
@hyperdx/app	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ready	Preview, Comment	Mar 13, 2026 1:54pm

[github-actions]

E2E Test Results

✅ All tests passed • 86 passed • 3 skipped • 992s

Status	Count
✅ Passed	86
❌ Failed	0
⚠️ Flaky	3
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →

[github-actions]

PR Review

• ⚠️ MeApiResponseSchema.shape.team.parse(team.toJSON()) uses Zod's throwing .parse() (me.ts:200) → If team data doesn't match the schema exactly, this throws a ZodError (caught by try/catch → 500). No other route does runtime Zod validation. Either use .safeParse() with a fallback, or just rely on TypeScript types and manual field selection like the other routes.

• ⚠️ Multiple (alert as any).createdAt?.toISOString?.() ?? '' casts (alerts.ts:62,64,103,118,122) → The ?? '' fallback silently replaces missing timestamps with empty strings, which could break any downstream code comparing/sorting by these dates. The proper fix is to update the IAlert (and related) Mongoose model interfaces to include createdAt/updatedAt timestamps, eliminating the need for any casts entirely.

• ⚠️ pick(team, Object.keys(req.body)) without null guard (team.ts:315) → updateTeamClickhouseSettings could return null; lodash.pick(null, keys) returns {} which silently returns an empty response body instead of an error. The old code used team?.[cur[0]] which at least preserved the same null-tolerance behavior; add an explicit null check to fail loudly.