Fastify 5 + Zod 4 type provider for typed routes: working versions (tested 2026-10-15)

{
  "name": "fastify-zod-type-provider",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "fastify": "5.12.7",
    "zod": "4.6.7",
    "fastify-type-provider-zod": "7.0.0"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2"
  }
}

import Fastify from "fastify";
import { serializerCompiler, validatorCompiler, type ZodTypeProvider } from "fastify-type-provider-zod";
import { z } from "zod";

export function buildApp() {
  const app = Fastify();
  app.setValidatorCompiler(validatorCompiler);
  app.setSerializerCompiler(serializerCompiler);
  const typed = app.withTypeProvider<ZodTypeProvider>();

  typed.post("/users", {
    schema: {
      body: z.object({ email: z.email(), age: z.number().int().min(13) }),
      response: { 201: z.object({ id: z.number(), email: z.string() }) }, // extra fields are stripped
    },
  }, async (req, reply) => {
    const { email } = req.body; // typed from the schema
    return reply.code(201).send({ id: 1, email, passwordHash: "never-leaks" } as any);
  });

  typed.get("/search", { schema: { querystring: z.object({ q: z.string().min(1), page: z.coerce.number().int().default(1) }) } },
    async (req) => ({ q: req.query.q, page: req.query.page }));
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import { buildApp } from "../src/app.ts";

test("valid body and response schema strips extra fields", async () => {
  const app = buildApp();
  const r = await app.inject({ method: "POST", url: "/users", payload: { email: "a@example.com", age: 30 } });
  assert.equal(r.statusCode, 201);
  assert.deepEqual(r.json(), { id: 1, email: "a@example.com" });
  await app.close();
});

test("invalid body is 400", async () => {
  const app = buildApp();
  const r = await app.inject({ method: "POST", url: "/users", payload: { email: "nope", age: 5 } });
  assert.equal(r.statusCode, 400);
  await app.close();
});

test("querystring coercion and defaults", async () => {
  const app = buildApp();
  assert.deepEqual((await app.inject({ url: "/search?q=pin" })).json(), { q: "pin", page: 1 });
  assert.deepEqual((await app.inject({ url: "/search?q=pin&page=3" })).json(), { q: "pin", page: 3 });
  assert.equal((await app.inject({ url: "/search" })).statusCode, 400);
  await app.close();
});