[ctvo]

> Stop assuming data is of the type you’re expecting. You know it is, period.

> Know when you break compatability with the frontend, before even running it: TypeScript has your back.

Do you? Your front-end and back-end, regardless if they use the same source for their interface contract, aren't deployed as a unit. At least not always, and not in the single page application use cases you're targeting.

How do you handle versioning and protocol compatibility? Across all these frameworks, it feels like a footgun your users will discover on their own.

[kamilafsar]

Good point!

We use Phero extensively in mobile apps projects, so we know the pain of maintaining API versions and backward compatibility hell.

Phero generates a declaration file with all functions you expose, and bundles dependent domain models (interfaces, type aliases, enums, etc) with it. Currently there's only one version. Our plan is to let users pin versions of this declaration file (we call it the manifest file).

Then we build cli commands to compare them and actually tell if they are compatible. This way you know if it's safe to deploy a new version of your API without breaking existing clients. These are all future plans of course, but in the scope of the project.

[jitl]

It seems like you could use Microsoft’s API Extractor to validate schema changes between HEAD’s phero-schema.d.ts and $(git merge-base HEAD main). I haven’t run Phero yet but it would be cool to leverage existing investment here.

[Wissmueller]

> Across all these frameworks, it feels like a footgun your users will discover on their own

Exactly. tRPC and other projects alike don’t provide you an actual API that you can later consume, but an RPC “glue”

[alexdotjs]

We have an RPC spec in tRPC :)

One big difference in philosophy here is that tRPC is not designed to be used for cases where you have third party consumers. It's built for situations where you control both ends. (That said, you can use trpc-openapi for the endpoints that are public)

On versioning: it's 2023 & in most cases, you can solve versioning in other ways than maintaining old API versions indefinitely. For RN there's OTA, for web you just need to reload the page or "downgrade" your SPA-links to a classic link to get a new bundle (did an example here https://twitter.com/alexdotjs/status/1627739926782480409)

Also, we'll release tooling to help keeping track of changes in cases where you can't update the clients as easily.

GraphQL is amazing but it isn't a silver bullet either, it has its own complexity that you have to accept as well.

[ctvo]

> On versioning: it's 2023 & in most cases, you can solve versioning in other ways than maintaining old API versions indefinitely. For RN there's OTA, for web you just need reload the page or "downgrade" your SPA-links to a classic link to get a new bundle (did an example here https://twitter.com/alexdotjs/status/1627739926782480409)

I would suggest you think more deeply about this problem.

In all the examples you listed there is a population on the new version and the old version, even in the happy case. Distributed systems are not instant, and changes take time to propagate. Publishing a new version of your website / RN bundle to a CDN does not mean all edge locations are serving it. Long lived single page applications (Gmail for example) are not typically refreshed often. For small applications, this may not be an issue -- when your scale is millions of users, the population that now receives a 500 due to a bad request is significant, even if it's seconds or minutes where clients access both versions, but the backend only supports the latest version.

> Also, we'll release tooling to help keeping track of changes in cases where you can't update the clients as easily.

The ease of updating the clients doesn't solve this issue, and avoiding leaking it into your framework because it's messy or introduces constraints won't make it go away.

[alexdotjs]

Thanks for the input! We have thought about it a lot.

The biggest challenge with trpc right now is that the API is transient so it's not obvious when you might be braking clients in flight and that you often can't guarantee perfect sync of deployments as you're rightly pointing out.

Once we have some more tooling around it, you'll be able to get the benefits of a traditional API where you consciously choose when to break the spec, but with the productivity benefits of not having to manually define it. I think that will scale pretty well.

[vosper]

> One big difference in philosophy here is that tRPC is not designed to be used for cases where you have third party consumers. It's built for situations where you control both ends. (That said, you can use trpc-openapi for the endpoints that are public)

I'm a happy tRPC user, and this is my use case. Our web application has no client other than our web frontend. I can't see a situation when it would (and I would bet this is true for most web applications), so I am very happy with how tRPC has worked out.

I did recently create a more limited data API, and for that I used express-zod-api [0] which I like very much.