feat: add response body validation via validateResponse option

[G4brym]

Summary

Closes #159

Adds a validateResponse router option that, when enabled, parses response bodies through their Zod response schema. This provides two key benefits:

1. Strips unknown fields — prevents accidentally leaking sensitive data (e.g., password hashes, internal IDs) that aren't in the response schema
2. Validates required fields — catches mismatches between declared response schema and actual return values at runtime

Usage

// Enable globally for all routes
const router = fromIttyRouter(AutoRouter(), { validateResponse: true });
// or
const router = fromHono(app, { validateResponse: true });

How it works

• After handle() returns, the response is parsed through the Zod schema for the matching status code
• Plain objects: parsed directly, unknown fields stripped
• Response objects: JSON body is read, parsed, and the Response is reconstructed with the same status/headers
• Non-JSON responses (HTML, text, etc.): passed through unchanged
• No response schema defined: passed through unchanged (backward compatible)
• Missing required fields: throws a ZodError (formatted as 400 by itty-router, raised as HTTPException by Hono)

Changes

• src/types.ts: Added validateResponse?: boolean to RouterOptions and RouteOptions
• src/openapi.ts: Forward the option to route instances
• src/route.ts: Added getResponseSchema() and validateResponse() methods, called in execute() when the option is enabled
• 7 integration tests covering: field stripping (plain objects and Response objects), passthrough when no schema, validation errors, default behavior unchanged, Hono integration

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	94.56%	731 / 773
🔵	Statements	94.47%	753 / 797
🔵	Functions	91.61%	153 / 167
🔵	Branches	87.15%	441 / 506

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Changed Files
src/exceptions.ts	100%	100%	100%	100%
src/openapi.ts	89.53%	85%	80.95%	89.41%	61, 249, 254-270, 350-368
src/route.ts	96.69%	91.02%	100%	98.19%	239, 245, 300, 350

Generated in workflow #666 for commit 4aa1d44 by the Vitest Coverage Report Action

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/chanfana@317

commit: 4aa1d44