refactor(utils): replace 'data: any' on server functions with their validated shapes

[sukvvon]

CLAUDE.md says type safety is paramount and to fix at the source rather than cast. Fourteen server functions took { data: any }, which drops every guarantee at the boundary where it matters most — admin mutations reading data.userId, data.capabilities, and so on with no check that those fields exist or hold the right type.

File	Count
users.server.ts	8
intent-admin.server.ts	3
stats-admin.server.ts	2
stats.server.ts	1

Where the types came from

Not guessed. Each *.server.ts function has a sibling in *.functions.ts that validates the call against a valibot schema before delegating, so the schema is already the contract — these annotations just state it:

// users.functions.ts
export const getUser = createServerFn({ method: 'POST' })
  .validator(v.object({ userId: v.pipe(v.string(), v.uuid()) }))
  .handler(async ({ data }) => getUserServer({ data }))

For each function I pulled the fields it actually reads out of the body (rg -o "data\.\w+") and matched them against that schema. That caught retryIntentVersion, whose versionId is v.number() — annotating it string by eye would have compiled and been wrong.

listUsers reads ten fields, so it gets a named ListUsersInput. The rest are inline, matching requireCapability in the same file.

They are deliberately looser than the schemas in two places, both noted in a comment on ListUsersInput:

• The schemas' bounds (maxLength, minValue, uuid) have no type-level equivalent.
• useEffectiveCapabilities is v.optional(v.boolean(), true), so post-validation it is always a boolean — but the annotation keeps it optional, because listUsers guards it with ?? true and tightening the type would make that guard dead code.

Nothing is re-checked at runtime and no behaviour changes.

Note

fetchNpmDownloadChunk (stats.server.ts) is exported but has zero call sites anywhere in src/, scripts/, or tests/. It is typed here rather than deleted so this PR stays one thing; removing it is worth doing separately.

Testing

tsc clean and oxlint --type-aware reports 0 errors across 916 files. Types-only change — no runtime code was touched.

Summary by CodeRabbit

• Refactor
  • Improved input validation and consistency across administrative, statistics, and user-management operations.
  • Requests now require clearly defined values for identifiers, preferences, capabilities, packages, and reporting parameters.
  • Incomplete or incorrectly formatted requests can be detected earlier.
  • Existing authorization, database behavior, auditing, and responses remain unchanged.
  • No changes to user-facing functionality or workflows are expected.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	tanstack-com	71181d1	Commit Preview URL Branch Preview URL	Aug 05 2026, 04:51 AM

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

The PR replaces untyped server-function payloads with explicit TypeScript input contracts. Runtime behavior remains unchanged.

Typed server utility inputs

Layer / File(s)	Summary
Intent administration contracts src/utils/intent-admin.server.ts	retryIntentVersion requires a numeric versionId. seedIntentPackage and deleteIntentPackage require a string name.
Statistics function contracts src/utils/stats-admin.server.ts, src/utils/stats.server.ts	Statistics refresh functions and fetchNpmDownloadChunk now require structured string fields.
User function contracts src/utils/users.server.ts	User listing, retrieval, preference, framework, and capability functions now require explicit input shapes.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 85.71% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes replacing untyped server-function data with validated input shapes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/typed-server-fn-data

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.

[coderabbitai]

Note

GitHub couldn't provide a complete incremental comparison for this pull request, so CodeRabbit is performing a full review instead. This review may take a little longer.