Files
triggerdotdev--trigger.dev/packages/schema-to-json
github-actions[bot] 325b906319
🚀 Publish Trigger.dev Docker / units (push) Failing after 0s
🚀 Publish Trigger.dev Docker / typecheck (push) Failing after 20s
🚀 Publish Trigger.dev Docker / scan-webapp (push) Has been skipped
🚀 Publish Trigger.dev Docker / scan-supervisor (push) Has been skipped
🚀 Publish Trigger.dev Docker / publish-webapp (push) Has been skipped
🚀 Publish Trigger.dev Docker / publish-worker-v4 (push) Has been skipped
🧭 Helm Chart Release / release (push) Has been cancelled
🧭 Helm Chart Release / lint-and-test (push) Has been cancelled
🚀 Publish Trigger.dev Docker / 📣 Dispatch main image (push) Has been cancelled
chore: release v4.5.6 (#4317)
## Summary
5 improvements, 9 bug fixes.

## Breaking changes
- Self-hosted deployments no longer ship shared default credentials;
fresh installs generate their own. If yours still uses a previously
published default, set a unique value before upgrading, or set
`ALLOW_INSECURE_DEFAULT_SECRETS=true` to keep booting while you migrate.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))

## Improvements
- Require explicit browser approval for CLI and MCP login, with
resilient polling while approval is pending.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Deployed task telemetry now reports the deployment identifier (e.g.
`deployment_abc123`) in the `worker.id` attribute, instead of an opaque
internal value. Upgrade to get the readable identifier in your own
OpenTelemetry exporters.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Prevent prototype pollution when applying run metadata operations or
reconstructing nested telemetry attributes, while preserving legitimate
`constructor` and `prototype` fields.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Add helpers to mint and verify the deployment-scoped token used to
authenticate run controllers to the platform.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))

## Server changes

These changes affect the self-hosted Docker image and Trigger.dev Cloud:

- Added optional request rate limiting for telemetry ingestion
endpoints.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Background-worker deployment lookups are now scoped to the
authenticated environment.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Updating a GitHub App installation from the callback flow is now
scoped to your own organization, so an installation ID belonging to
another organization can no longer be used to refresh that
organization's installation record. The GitHub App installation session
is also now single-use, so completing an installation callback
invalidates its state and it can no longer be replayed.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Scope schedule and environment-variable writes to the caller's project
and environment
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Reject compute snapshot callbacks that do not match the snapshot
request that created them.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Require secret-key authentication to initialize the session out
(agent→client) stream, matching the append route.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Live run and trace subscriptions now validate their identifiers more
strictly and only return data from your own organization.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Window-function names in the query compiler are now validated against
the allowlist, matching how other function calls are handled.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Authenticate run controllers to the platform with a signed,
deployment-scoped token.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Verify that worker actions (starting, completing, and continuing a
run, and reading its snapshots) target a run belonging to the caller's
environment.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))

<details>
<summary>Raw changeset output</summary>

# Releases
## @trigger.dev/build@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
## trigger.dev@4.5.6

### Patch Changes

- Require explicit browser approval for CLI and MCP login, with
resilient polling while approval is pending.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Deployed task telemetry now reports the deployment identifier (e.g.
`deployment_abc123`) in the `worker.id` attribute, instead of an opaque
internal value. Upgrade to get the readable identifier in your own
OpenTelemetry exporters.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
  - `@trigger.dev/build@4.5.6`
  - `@trigger.dev/schema-to-json@4.5.6`
## @trigger.dev/core@4.5.6

### Patch Changes

- Prevent prototype pollution when applying run metadata operations or
reconstructing nested telemetry attributes, while preserving legitimate
`constructor` and `prototype` fields.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Require explicit browser approval for CLI and MCP login, with
resilient polling while approval is pending.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
- Add helpers to mint and verify the deployment-scoped token used to
authenticate run controllers to the platform.
([#4316](https://github.com/triggerdotdev/trigger.dev/pull/4316))
## @trigger.dev/python@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
  - `@trigger.dev/build@4.5.6`
  - `@trigger.dev/sdk@4.5.6`
## @trigger.dev/react-hooks@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
## @trigger.dev/redis-worker@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
## @trigger.dev/rsc@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
## @trigger.dev/schema-to-json@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`
## @trigger.dev/sdk@4.5.6

### Patch Changes

- Updated dependencies:
  - `@trigger.dev/core@4.5.6`

</details>

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
2026-07-21 12:07:52 +01:00
..
2026-07-21 12:07:52 +01:00
2026-07-21 12:07:52 +01:00

@trigger.dev/schema-to-json

Convert various schema validation libraries to JSON Schema format.

Installation

npm install @trigger.dev/schema-to-json

Important: Bundle Safety

This package is designed to be bundle-safe. It does NOT bundle any schema libraries (zod, yup, etc.) as dependencies. Instead:

  1. Built-in conversions work immediately (ArkType, Zod 4, TypeBox)
  2. External conversions (Zod 3, Yup, Effect) require the conversion libraries to be available at runtime

This design ensures that:

  • Your bundle size stays small
  • You only include the schema libraries you actually use
  • Tree-shaking works properly
  • No unnecessary dependencies are installed

Supported Schema Libraries

  • Zod - Full support
    • Zod 4: Native support via built-in toJsonSchema method (no external deps needed)
    • Zod 3: Requires zod-to-json-schema to be installed
  • Yup - Requires @sodaru/yup-to-json-schema to be installed
  • ArkType - Native support (built-in toJsonSchema method)
  • Effect/Schema - Requires effect or @effect/schema to be installed
  • TypeBox - Native support (already JSON Schema compliant)
  • Valibot - Coming soon
  • Superstruct - Coming soon
  • Runtypes - Coming soon

Usage

Basic Usage (Built-in conversions only)

import { schemaToJsonSchema } from '@trigger.dev/schema-to-json';
import { type } from 'arktype';

// Works immediately for schemas with built-in conversion
const arkSchema = type({
  name: 'string',
  age: 'number',
});

const result = schemaToJsonSchema(arkSchema);
console.log(result);
// { jsonSchema: {...}, schemaType: 'arktype' }

Full Usage (With external conversion libraries)

import { schemaToJsonSchema, initializeSchemaConverters } from '@trigger.dev/schema-to-json';
import { z } from 'zod';

// Initialize converters once in your app (loads conversion libraries if available)
await initializeSchemaConverters();

// Now you can convert Zod 3, Yup, and Effect schemas
const zodSchema = z.object({
  name: z.string(),
  age: z.number(),
  email: z.string().email(),
});

const result = schemaToJsonSchema(zodSchema);
console.log(result);
// {
//   jsonSchema: {
//     type: 'object',
//     properties: {
//       name: { type: 'string' },
//       age: { type: 'number' },
//       email: { type: 'string', format: 'email' }
//     },
//     required: ['name', 'age', 'email']
//   },
//   schemaType: 'zod'
// }

API

schemaToJsonSchema(schema, options?)

Convert a schema to JSON Schema format.

Parameters:

  • schema - The schema to convert
  • options (optional)
    • name - Name to use for the schema (supported by some converters)
    • additionalProperties - Additional properties to merge into the result

Returns:

  • { jsonSchema, schemaType } - The converted JSON Schema and detected type
  • undefined - If the schema cannot be converted

initializeSchemaConverters()

Initialize the external conversion libraries. Call this once in your application if you need to convert schemas that don't have built-in JSON Schema support (Zod 3, Yup, Effect).

Returns: Promise<void>

canConvertSchema(schema)

Check if a schema can be converted to JSON Schema.

Returns: boolean

detectSchemaType(schema)

Detect the type of schema.

Returns: 'zod' | 'yup' | 'arktype' | 'effect' | 'valibot' | 'superstruct' | 'runtypes' | 'typebox' | 'unknown'

areConvertersInitialized()

Check which conversion libraries are available.

Returns: { zod: boolean, yup: boolean, effect: boolean }

Peer Dependencies

Each schema library is an optional peer dependency. Install only the ones you need:

# For Zod
npm install zod

# For Yup
npm install yup

# For ArkType
npm install arktype

# For Effect
npm install effect @effect/schema

# For TypeBox
npm install @sinclair/typebox

License

MIT