APIs & Data Architecture API Architecture & RPC

17. Schema Validation & Type-Safe RPC

Enforce runtime boundaries with Standard Schema, auto-generate OpenAPI documentation, and implement end-to-end type-safe RPC contracts.

schema-rpc.ts

typescript

import { z } from 'zod';
import { Hono } from 'hono';
import { zValidator } from '@hono/zod-validator';
// 1. Runtime Schema Contract
export const createAccountSchema = z.object({
  email: z.string().email(),
  organization: z.string().min(2),
  plan: z.enum(['starter', 'pro', 'enterprise'])
});
// 2. Type-Safe Hono RPC Backend
export const app = new Hono()
  .post('/api/v1/accounts', zValidator('json', createAccountSchema), (c) => {
    const payload = c.req.valid('json'); // 100% Type-Safe validated input
    return c.json({ success: true, id: 'acc_' + crypto.randomUUID(), data: payload });
  });
export type AppType = typeof app;

Schema Validation (Standard Schema) & Hono RPC

Standard Schema and Hono RPC eliminate boilerplate by providing end-to-end type safety between backend handlers and frontend clients without code-generation steps.

Runtime Boundary Safety: TypeScript types evaporate at build time. Standard Schema (Zod / Valibot) validates untrusted JSON at the network perimeter.
End-to-End Type-Safe RPCs: Exporting route definitions directly enables auto-completion and compile-time contract enforcement.
OpenAPI 3.1 & Scalar: Generates standardised JSON specs automatically for external consumers and automated SDK generation.
Unified Web & Mobile (Android) Backend: OpenAPI specs allow tools like openapi-generator to generate type-safe Kotlin models (Retrofit/Ktor) for native Android apps alongside TypeScript web clients from a single backend.

Runtime Schema & RPC Validator Schema: VALID

Typed RPC Server Response:

// Inferred payload will appear here after RPC dispatch...

←

Previous Module 16. Security: Strict CSP, Nonces & View Transitions

Next Module 18. Real-Time Streaming & Webhook Signatures

→