Input Validation
How request bodies are validated.
Every state-changing route validates its request body with Zod schemas defined in src/lib/validation.ts. Unknown fields are rejected and values are constrained.
- Amounts must be positive decimals and are stored in base units
- Quantities must be positive integers
- Wallet addresses and transaction hashes are validated with viem
- Email addresses are validated and length-limited
- Line items and text fields have length caps
- Public IDs must match the expected format