docs(cross-link): connect pages to validation

NeaByteLab · NeaByteLab · commit 7988243cd4eb · 2026-06-16T23:37:23.000+07:00
- Add validation links from body limit and file upload pages
- Add validation links from json and request handling pages
- Add validation links from route patterns, teams, and xss pages
- Mirror every cross-link in Indonesian
diff --git a/docs/by-design/xss.md b/docs/by-design/xss.md
@@ -32,4 +32,4 @@ Some values are meant to be HTML, such as content from a trusted editor. Triple
 <p>{{{ trustedHtml }}}</p>
 ```
 
-The opt-out is deliberate and local, so the default stays safe and only the value that needs raw markup is marked as such. Sending JSON needs no escaping at all, since the data is never parsed as markup, covered in [JSON responses](/response/json). Checking the shape and type of incoming data is a separate task for the handler after [reading the body](/core-concepts/context-object#request-data-access), which is validation rather than escaping.
+The opt-out is deliberate and local, so the default stays safe and only the value that needs raw markup is marked as such. Sending JSON needs no escaping at all, since the data is never parsed as markup, covered in [JSON responses](/response/json). Checking the shape and type of incoming data is a separate task that runs before the handler through a [validation](/middleware/validation/overview) contract, which is validation rather than escaping.
diff --git a/docs/core-concepts/request-handling.md b/docs/core-concepts/request-handling.md
@@ -270,3 +270,7 @@ const sessionId = ctx.cookie('sessionId')
 // Get all cookies
 const cookies = ctx.cookie() // { sessionId: 'abc123', theme: 'dark' }
 ```
+
+## Validating Before The Handler
+
+Every reader above hands back the raw value as it arrived, so a handler still checks the shape itself. A schema moves those checks ahead of the handler, runs a contract against each source, and leaves only data that already passed. See [Validation Overview](/middleware/validation/overview) for how `ctx.json()`, `ctx.query()`, and the other readers feed a contract.
diff --git a/docs/core-concepts/route-patterns.md b/docs/core-concepts/route-patterns.md
@@ -106,3 +106,5 @@ export function GET(ctx: Context): Response {
   })
 }
 ```
+
+A handler that validates several params, or wants the failure to carry field-level reasons, runs a [validation](/middleware/validation/overview) contract with `Validator.check` instead of an inline regex. Params are checked inside the handler because they resolve after middleware runs, covered in [Reading Validated Data](/middleware/validation/reading-data#checking-params-in-a-handler).
diff --git a/docs/getting-started/built-for-teams.md b/docs/getting-started/built-for-teams.md
@@ -99,7 +99,7 @@ router.use(
 await router.serve(8000)
 ```
 
-Handlers stay focused on their own job, while shared behavior is applied once. The full set of building blocks is in [Global Middleware](/middleware/global), and errors flow to one place through [error handling](/error-handling/object-details).
+Handlers stay focused on their own job, while shared behavior is applied once. The full set of building blocks is in [Global Middleware](/middleware/global), and errors flow to one place through [error handling](/error-handling/object-details). Input rules belong here too, where a [validation](/middleware/validation/overview) contract checks a request before the handler so each route reads only data that already passed.
 
 ![Shared rules in one place: securityHeaders() registered with router.use(fn) reaches every route, while basicAuth() registered with router.use('/admin', fn) reaches only /admin/*, so one developer can own auth and another own logging without touching each other's route files](/diagrams/team-shared-rules.png)
 
diff --git a/docs/id/by-design/xss.md b/docs/id/by-design/xss.md
@@ -32,4 +32,4 @@ Beberapa nilai memang dimaksudkan jadi HTML, seperti konten dari editor tepercay
 <p>{{{ trustedHtml }}}</p>
 ```
 
-Opt-out ini sengaja dan lokal, jadi default tetap aman dan hanya nilai yang butuh markup mentah yang ditandai begitu. Mengirim JSON sama sekali tak butuh escaping, karena data tak pernah diurai sebagai markup, dibahas di [response JSON](/id/response/json). Memeriksa bentuk dan tipe data masuk adalah tugas terpisah untuk handler setelah [membaca body](/id/core-concepts/context-object#akses-data-request), yang merupakan validasi ketimbang escaping.
+Opt-out ini sengaja dan lokal, jadi default tetap aman dan hanya nilai yang butuh markup mentah yang ditandai begitu. Mengirim JSON sama sekali tak butuh escaping, karena data tak pernah diurai sebagai markup, dibahas di [response JSON](/id/response/json). Memeriksa bentuk dan tipe data masuk adalah tugas terpisah yang berjalan sebelum handler lewat kontrak [validasi](/id/middleware/validation/overview), yang merupakan validasi ketimbang escaping.
diff --git a/docs/id/core-concepts/request-handling.md b/docs/id/core-concepts/request-handling.md
@@ -270,3 +270,7 @@ const sessionId = ctx.cookie('sessionId')
 // Ambil semua cookie
 const cookies = ctx.cookie() // { sessionId: 'abc123', theme: 'dark' }
 ```
+
+## Memvalidasi Sebelum Handler
+
+Setiap pembaca di atas mengembalikan nilai mentah seperti saat tiba, jadi handler tetap memeriksa bentuknya sendiri. Sebuah schema memindahkan pemeriksaan itu ke depan handler, menjalankan kontrak terhadap tiap sumber, dan menyisakan hanya data yang sudah lolos. Lihat [Ringkasan Validasi](/id/middleware/validation/overview) untuk bagaimana `ctx.json()`, `ctx.query()`, dan pembaca lain mengisi sebuah kontrak.
diff --git a/docs/id/core-concepts/route-patterns.md b/docs/id/core-concepts/route-patterns.md
@@ -106,3 +106,5 @@ export function GET(ctx: Context): Response {
   })
 }
 ```
+
+Handler yang memvalidasi beberapa param, atau ingin kegagalannya membawa alasan tingkat field, menjalankan kontrak [validasi](/id/middleware/validation/overview) dengan `Validator.check` alih-alih regex inline. Param diperiksa di dalam handler karena baru tersedia setelah middleware berjalan, dibahas di [Membaca Data Tervalidasi](/id/middleware/validation/reading-data#memeriksa-params-di-handler).
diff --git a/docs/id/getting-started/built-for-teams.md b/docs/id/getting-started/built-for-teams.md
@@ -99,7 +99,7 @@ router.use(
 await router.serve(8000)
 ```
 
-Handler tetap fokus pada tugasnya sendiri, sementara perilaku bersama diterapkan sekali. Set lengkap blok penyusunnya ada di [Global Middleware](/id/middleware/global), dan error mengalir ke satu tempat lewat [penanganan error](/id/error-handling/object-details).
+Handler tetap fokus pada tugasnya sendiri, sementara perilaku bersama diterapkan sekali. Set lengkap blok penyusunnya ada di [Global Middleware](/id/middleware/global), dan error mengalir ke satu tempat lewat [penanganan error](/id/error-handling/object-details). Aturan input juga ada di sini, tempat kontrak [validasi](/id/middleware/validation/overview) memeriksa request sebelum handler sehingga tiap rute hanya membaca data yang sudah lolos.
 
 ![Aturan bersama di satu tempat: securityHeaders() yang didaftarkan dengan router.use(fn) menjangkau setiap rute, sedangkan basicAuth() yang didaftarkan dengan router.use('/admin', fn) hanya menjangkau /admin/*, jadi satu developer bisa memegang auth dan yang lain memegang logging tanpa menyentuh berkas rute satu sama lain](/diagrams/team-shared-rules.png)
 
diff --git a/docs/id/middleware/body-limit.md b/docs/id/middleware/body-limit.md
@@ -82,6 +82,8 @@ Ketika request bisa membawa body, middleware memeriksa ukuran yang dideklarasika
 - Ketika `Transfer-Encoding` dan `Content-Length` sama-sama ada, `Transfer-Encoding` didahulukan.
 - Body chunked atau panjang tak diketahui tetap dibatasi oleh stream yang dibungkus, dan hanya byte yang dibaca yang dihitung terhadap batas.
 
+Middleware ini membatasi berapa byte yang boleh dibawa sebuah body. Memeriksa bentuk byte itu adalah langkah terpisah yang dijalankan kontrak [validasi](/id/middleware/validation/overview) setelah body berada dalam batas.
+
 ## Contoh Lengkap
 
 ```typescript twoslash
diff --git a/docs/id/recipes/file-upload.md b/docs/id/recipes/file-upload.md
@@ -76,6 +76,8 @@ export async function POST(ctx: Context): Promise<Response> {
 
 Objek `File` memaparkan `name`, `type`, dan `size` miliknya sendiri, jadi melaporkan kembali sebuah upload tidak pernah perlu menyentuh disk.
 
+Handler yang memeriksa beberapa field bisa memindahkan pemeriksaan itu ke depan dirinya dengan kontrak [validasi](/id/middleware/validation/overview) pada sumber `body`, sehingga hanya request yang sudah membawa field yang benar mencapai handler.
+
 ## Menyimpan ke Disk
 
 Bytes tetap di dalam `File` sampai `arrayBuffer()` mengeluarkannya, dan membungkus buffer itu dalam `Uint8Array` memberi [`Deno.writeFile`](https://docs.deno.com/api/deno/~/Deno.writeFile) persis bentuk yang diharapkannya. Deserve tidak pernah menulis upload sendiri, jadi path tujuan tetap dalam kendali penuh:
diff --git a/docs/id/response/json.md b/docs/id/response/json.md
@@ -39,6 +39,8 @@ export async function POST(ctx: Context): Promise<Response> {
 
 Nilai `status` harus integer dalam rentang 200-599, atau salah satu kode tanpa body 101, 204, 205, dan 304 yang mengirim body kosong. Nilai lain melempar `Deno.errors.InvalidData`. Aturan ini berlaku untuk setiap helper `ctx.send`.
 
+Di sini `ctx.body()` mengembalikan apa pun yang dikirim client, jadi handler yang bergantung pada bentuknya menjalankan kontrak [validasi](/id/middleware/validation/overview) lebih dulu dan membaca data bertipe yang sudah lolos.
+
 ## Dengan Header Kustom
 
 ```typescript twoslash
@@ -97,3 +99,5 @@ export function GET(ctx: Context): Response {
   )
 }
 ```
+
+Sebuah handler bisa membentuk body error sekali pakai seperti ini, tetapi error yang dilempar mengalir lewat satu tempat alih-alih, dibahas di [Detail Objek Error](/id/error-handling/object-details).
diff --git a/docs/middleware/body-limit.md b/docs/middleware/body-limit.md
@@ -82,6 +82,8 @@ When a request can carry a body, the middleware checks the declared size first,
 - When both `Transfer-Encoding` and `Content-Length` are present, `Transfer-Encoding` takes precedence.
 - Chunked or unknown-length bodies are still limited by the wrapped stream, and only the bytes read count toward the limit.
 
+This middleware caps how many bytes a body may carry. Checking the shape of those bytes is a separate step that a [validation](/middleware/validation/overview) contract runs once the body is within the limit.
+
 ## Complete Example
 
 ```typescript twoslash
diff --git a/docs/recipes/file-upload.md b/docs/recipes/file-upload.md
@@ -76,6 +76,8 @@ export async function POST(ctx: Context): Promise<Response> {
 
 The `File` exposes its own `name`, `type`, and `size`, so reporting back on an upload never has to touch the disk.
 
+A handler that checks several fields can move those checks ahead of itself with a [validation](/middleware/validation/overview) contract on the `body` source, so only a request that already carries the right fields reaches the handler.
+
 ## Saving to Disk
 
 The bytes stay inside the `File` until `arrayBuffer()` pulls them out, and wrapping that buffer in a `Uint8Array` hands [`Deno.writeFile`](https://docs.deno.com/api/deno/~/Deno.writeFile) exactly the shape it expects. Deserve never writes uploads on its own, so the destination path stays under full control:
diff --git a/docs/response/json.md b/docs/response/json.md
@@ -39,6 +39,8 @@ export async function POST(ctx: Context): Promise<Response> {
 
 The `status` value must be an integer in the 200-599 range, or one of the body-less codes 101, 204, 205, and 304 which send an empty body. Any other value throws `Deno.errors.InvalidData`. This rule is shared by every `ctx.send` helper.
 
+Here `ctx.body()` returns whatever the client sent, so a handler that depends on its shape runs a [validation](/middleware/validation/overview) contract first and reads typed data that already passed.
+
 ## With Custom Headers
 
 ```typescript twoslash
@@ -97,3 +99,5 @@ export function GET(ctx: Context): Response {
   )
 }
 ```
+
+A handler can shape a one-off error body like this, but a thrown error routes through one place instead, covered in [Error Object Details](/error-handling/object-details).

Original file line number	Diff line number	Diff line change
`@@ -106,3 +106,5 @@ export function GET(ctx: Context): Response {`
`106`	`106`	`})`
`107`	`107`	`}`
`108`	`108`	```
	`109`	`+`
	`110`	+A handler that validates several params, or wants the failure to carry field-level reasons, runs a [validation](/middleware/validation/overview) contract with `Validator.check` instead of an inline regex. Params are checked inside the handler because they resolve after middleware runs, covered in [Reading Validated Data](/middleware/validation/reading-data#checking-params-in-a-handler).