improvement(repo): zod based client-server boundary

[icecrasher321]

Summary

Zod v4 based client-server boundary. Linters to enforce best practices with baseline exceptions.

Type of Change

• Other: Code Refactor

Testing

Tested all core paths manually with @TheodoreSpeaks

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 30, 2026 7:16pm

[cursor]

PR Summary

Medium Risk
Touches many API route boundaries and validation/error-handling paths, plus adds a strict CI audit; regressions could surface as 400/401 behavior changes or unexpected validation failures. Upgrade to Zod v4 in apps/realtime also changes error shapes (issues vs errors) and env parsing output.

Overview
Enforces a contract-driven client/server boundary policy across apps/sim by documenting and standardizing that API routes must validate via shared contracts (no route-local Zod schemas) and clients must use requestJson(contract, ...) with contract-exported type aliases.

Updates multiple apps/sim/app/api/** routes (auth, billing, chat, audit logs, A2A) to replace request.json() + local Zod parsing with parseRequest(contract, ...), improving consistent validation responses and removing ad-hoc query/body handling.

Adds a strict API boundary audit to CI (bun run check:api-validation:strict) and expands internal docs/rules (AGENTS/Claude/Cursor skills) describing allowed exception annotations and enforcement.

Separately upgrades apps/realtime to Zod v4, adjusting env error formatting and validation error handling (error.issues), plus a small bugfix in variable operations using workflowId from outer scope.

^{Reviewed by Cursor Bugbot for commit 02ecefe. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 02ecefe. Configure here.}