feat(api): enforce request and response schema validation

README.md

@@ -196,6 +196,14 @@ Check the standard `RateLimit-*` headers for quota and reset time.
 
 ---
 
+## API Boundary Validation
+
+LiquiFact backend leverages [Zod](https://zod.dev/) to protect API boundaries against malformed data and data leaks constraint regressions:
+- **Inbound Validation**: Ensures clients provide expected payloads (e.g., `amount`, `customer`). Malformed requests receive a `400 Bad Request` containing specific constraint validation issues.
+- **Outbound Escrowing**: Employs a response interceptor to rigidly validate outbound domain responses. This prevents internal schema drift or accidental leakage of sensitive DB fields to the public network, forcing a `500 Internal Server Error` instead of breaching contracts.
+
+---
+
 ## Configuration
 
 ### CORS Allowlist

bodySize_fail_utf8.txt

@@ -0,0 +1,180 @@
+  console.log
+    [dotenv@17.3.1] injecting env (0) from .env -- tip: ⚙️  suppress all logs with { quiet: true }
+
+      at _log (node_modules/dotenv/lib/main.js:139:11)
+
+  console.log
+    [dotenv@17.3.1] injecting env (0) from .env -- tip: 🛡️ auth for agents: https://vestauth.com
+
+      at _log (node_modules/dotenv/lib/main.js:139:11)
+
+  console.log
+    [dotenv@17.3.1] injecting env (0) from .env -- tip: 🔐 encrypt with Dotenvx: https://dotenvx.com
+
+      at _log (node_modules/dotenv/lib/main.js:139:11)
+
+node.exe : FAIL src/__tests__
+/bodySizeLimits.test.js
+At C:\Users\pc\AppData\Roamin
+g\npm\npx.ps1:24 char:5
++     & "node$exe"  "$basedir
+/node_modules/npm/bin/npx-cli
+.js" $args
++     ~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~
+    + CategoryInfo           
+   : NotSpecified: (FAIL sr  
+  c/__test...eLimits.test.   
+ js:String) [], RemoteExc    
+eption
+    + FullyQualifiedErrorId  
+   : NativeCommandError
+
+  parseSize()
+    valid inputs
+      √ parses bytes (no 
+suffix) (4 ms)
+      √ parses "b" suffix 
+(lowercase) (1 ms)
+      √ parses "B" suffix 
+(uppercase) (1 ms)
+      √ parses "kb" suffix 
+(1 ms)
+      √ parses "KB" suffix 
+(1 ms)
+      √ parses "mb" suffix
+      √ parses "MB" suffix
+      √ parses "gb" suffix 
+(1 ms)
+      √ handles decimal 
+values (1 ms)
+      √ handles 
+surrounding whitespace (1 ms)
+      √ returns 0 for "0b" 
+(1 ms)
+    TypeError
+      √ throws for empty 
+string (12 ms)
+      √ throws for 
+whitespace-only (1 ms)
+      √ throws for number 
+input (1 ms)
+      √ throws for null (1 
+ms)
+      √ throws for 
+undefined (1 ms)
+      √ throws for object 
+(2 ms)
+    RangeError
+      √ throws for unknown 
+unit "tb" (2 ms)
+      √ throws for 
+non-numeric value (2 ms)
+      √ throws for 
+negative value (2 ms)
+  DEFAULT_LIMITS
+    √ json is a parseable 
+string (1 ms)
+    √ urlencoded is a 
+parseable string (1 ms)
+    √ raw is a parseable 
+string (1 ms)
+    √ invoice is a 
+parseable string (1 ms)
+  jsonBodyLimit()
+    √ returns a 
+two-element handler array (1 
+ms)
+    √ accepts a body 
+within the limit (42 ms)
+    √ rejects a body 
+exceeding the limit with 413 
+(8 ms)
+    √ 413 response has 
+correct shape (8 ms)
+  isCorsOriginRejectedError()
+    √ returns true for 
+flagged error
+    √ returns false for 
+plain error
+  createCorsOptions()
+    √ allows request with 
+no Origin header (1 ms)
+    √ rejects an unlisted 
+origin
+  computeBackoff()
+    √ returns a number >= 0
+    √ is capped at 
+maxDelay (1 ms)
+  isRetryable()
+    √ returns true for 
+ECONNRESET
+    √ returns true for 
+status 429
+    √ returns true for 
+status 502
+    √ returns true for 
+status 503 (1 ms)
+    √ returns true for 
+status 504
+  createApp() integration
+    × GET /health → 200 
+with status ok (19 ms)
+    √ POST /api/invoices 
+oversized body → 413 (17 
+ms)
+
+  ΓùÅ createApp() 
+integration › GET /health 
+→ 200 with status ok
+
+    expect(received).toBe(exp
+ected) // Object.is equality
+
+    Expected: "ok"
+    Received: undefined
+
+      198 |    
+ const res 
+= await r
+equest(app).ge
+t('/health')[
+33m;
+      199 |     exp
+ect(res.status)[33
+m.toBe(200)[3
+3m;
+
+> 
+200 |     expect(res[33
+m.body.status)
+.toBe('ok'[39
+m);
+          |        
+
+^
+      201 |   
+});
+      202 |
+      203 |   
+it('POST /api/invoices 
+oversized body → 
+413', 
+async () 
+=> {
+
+      at Object.toBe (src/__t
+ests__/bodySizeLimits.test.js
+:200:29)
+
+Test Suites: 1 failed, 1 
+total
+Tests:       1 failed, 40 
+passed, 41 total
+Snapshots:   0 total
+Time:        1.154 s, 
+estimated 4 s
+Ran all test suites matching 
+src/__tests__/bodySizeLimits.
+test.js.