improvement(repo): centralized zod contracts

[icecrasher321]

Summary

• Client-Server boundary must respect Zod contracts.
• Migration to zod v4
• CI check to enforce boundary violations
• Update skills
• Split up selectors code to match repo structure
• Cleanup route local schemas and client component arbitrary types

Type of Change

• Other: Code Structure Improvement

Testing

IN PROGRESS -- to be tested in dev environment

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Apr 29, 2026 4:45pm

[cursor]

PR Summary

Medium Risk
Touches many API routes’ request parsing/validation paths and upgrades Zod semantics (issues/formatting), so subtle behavior changes in 400s and schema parsing are possible despite being largely mechanical.

Overview
Enforces a contract-first HTTP boundary policy: routes under apps/sim/app/api/** are updated to stop defining route-local Zod schemas and instead validate params/query/body via shared schemas/contracts in apps/sim/lib/api/contracts/** using canonical helpers like parseRequest, validateSchema, and validateJsonBody (with improved, consistent 400 error messaging).

Adds enforcement and guidance: CI now runs bun run check:api-validation:strict and developer docs/agent skills/cursor rules are expanded to codify the boundary rules (including limited, reason-required annotations for legitimate raw fetch/double-cast exceptions).

Zod v4 migration follow-ups and small correctness fixes: realtime bumps zod to 4.3.6 and updates error formatting/access (treeifyError, issues), numerous API routes switch from error.errors to error.issues, the academy certificate page replaces a double-cast with schema-validated metadata, landing forms use a shared flattenFieldErrors helper and remove a Combobox double-cast, and a realtime variable update bug is fixed (workflowId source).

^{Reviewed by Cursor Bugbot for commit 25d4d0b. Configure here.}

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[icecrasher321]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 25d4d0b. Configure here.}