PR #465 introduced shared branded zod helpers in packages/demo/backend/src/helpers/schemas.ts:
AddressSchema — validates 0x[a-fA-F0-9]{40} and lowercases the value before branding as Address.
Bytes32Schema — validates and lowercases bytes32.
ChainIdSchema / ChainIdStringSchema — accepts number or numeric string, brands as SupportedChainId.
BorrowAmountRawSchema — bigint-as-decimal-string capped at .max(78) to bound DoS surface.
These live in helpers/schemas.ts so lend/swap/wallet can share them. Today only borrow consumes them; the rest still use raw regex or ad-hoc transforms:
controllers/wallet.ts:32 (/wallet/eth/...) — raw regex on address, no lowercase normalization.
controllers/lend.ts — request shapes use bespoke validators.
controllers/swap.ts — request shapes use bespoke validators.
Acceptance
PR #465 introduced shared branded zod helpers in
packages/demo/backend/src/helpers/schemas.ts:AddressSchema— validates0x[a-fA-F0-9]{40}and lowercases the value before branding asAddress.Bytes32Schema— validates and lowercases bytes32.ChainIdSchema/ChainIdStringSchema— accepts number or numeric string, brands asSupportedChainId.BorrowAmountRawSchema— bigint-as-decimal-string capped at.max(78)to bound DoS surface.These live in
helpers/schemas.tsso lend/swap/wallet can share them. Today only borrow consumes them; the rest still use raw regex or ad-hoc transforms:controllers/wallet.ts:32(/wallet/eth/...) — raw regex on address, no lowercase normalization.controllers/lend.ts— request shapes use bespoke validators.controllers/swap.ts— request shapes use bespoke validators.Acceptance
controllers/wallet.ts,controllers/lend.ts,controllers/swap.tswithAddressSchemafromhelpers/schemas.ts.ChainIdSchema/ChainIdStringSchemawhere appropriate.BorrowAmountRawSchema(or a renamedAmountRawSchema) to lend/swap amount fields if currently uncapped strings.