permittable 0.13.0 → 0.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7dc4908fbfa3e6b5e58441e97f3a1f73415a779447b06fd0d42b4a6fdc4154e4
-  data.tar.gz: 776776cac3cfd9288af6f591c96288acabb82707002017964a1ecee6b18dd9aa
+  metadata.gz: bbb9461a44e4918ca7a982fc42ad55e7c2c6a36b231ea9560eb298c85fea259c
+  data.tar.gz: 324137849cfc36dde9a3ff2764aeef2ba02beec9e6487bd70b4990b0ee3b95e9
 SHA512:
-  metadata.gz: 7f045ce704da2e70e4a1a85a4b7b8cdd2f5099733619779655885fc820b1fa03b6f4d99a7461e492d01147c15cc545fa268e46b11f13bfbd640cb334d3b98ff8
-  data.tar.gz: c82a67ca14285e04c35b218cd363f8280f2876e09faec983ded0d4aa81e30626d60e3fd67211ee0588e7f2b25a82da368ac97aac1f1ab505000256c1f5873e25
+  metadata.gz: f612dc7e5b04cf543c34b4b9ff4810e0620f80a8dfcc6cbed92d2969eab40a4396b3472d9ac2f8b4a37bc1b1a8d92ddc166312edba7de78508de2c4435dcba31
+  data.tar.gz: 7dd8145f4968a76cd10332a17f74a30531a4c4d549becd967b80c5f2a7f4ad41b54751209abf94b9386aa6a0aaa939d3be8f1eb1a3dd1b309f05bd39c5d212d6

data/CHANGELOG.md

@@ -1,5 +1,27 @@
 <!-- CHANGELOG.md -->
 
+## 0.13.1 (2026-11-04)
+<!-- title: contracts that cannot be exported are refused at class load, a Metal catch-all and a date-parts example export correctly, and a pre-1582 date reads as the day it names -->
+
+Six fixes, one documentation change and a development dependency bump, no new API. A `:datetime` `default:` or `example:` finer than a nanosecond and a `:json` `default:` or `example:` holding NaN or Infinity are now refused at class load, instead of loading and then breaking the export. The OpenAPI export of a catch-all contract on an `ActionController::Metal` controller no longer documents the framework's own methods as operations, and an array `example:` written with date parts is exported as the date it spells. A midnight-UTC `Time` or `DateTime` sent to a `:date` before 1582 is read as the day it names. A missing-column error for an ignored column no longer suggests a migration, and the README now says that a catch-all `rescue_from` declared after the include wins.
+
+Patch rather than minor: nothing that works today stops working. Every entry is a crash or a wrong value on input that was already mishandled, an export correction that makes the document agree with what the server does, a clearer error message, documentation, or development tooling. Four things are visible from outside and worth knowing before you upgrade. A contract now fails at class load, naming the field, in three cases: its `:datetime` `default:` or `example:` is finer than a nanosecond (#159), which the export published as a different instant; its `:json` `default:` or `example:` holds NaN or Infinity (#163), which made the export raise; or its `:date` `in:` member is a `Time` on one of the days 1582-10-05 to 1582-10-14 (#164), which was read silently as 1582-09-30. The OpenAPI export of a Metal catch-all loses its bogus framework operations (#161). An array `example:` written with date parts is now exported correctly (#162).
+
+### Fixed
+- **An ignored column that is in the table was reported as missing, with a migration hint that would add it twice.** `ColumnGuard` checked a field against `column_names`, which leaves out `ignored_columns`, so `optional :legacy, :integer` on a model with `self.ignored_columns = %w[legacy]` raised "does not exist in the database" and suggested `bin/rails generate migration`. The guard still refuses the field, since assigning an ignored column raises `ActiveModel::UnknownAttributeError`, but the message now says the model ignores the column and suggests removing it from `ignored_columns` or declaring the field `virtual: true`. When the column was dropped and its name was left in `ignored_columns`, the message says the table has no such column and gives no migration. (#157)
+- **A `:datetime` `default:` or `example:` finer than a nanosecond loaded, and the export published a different instant.** 0.12.0 refused such an `in:` member (#106), but `Time.at(Rational(1, 3)).utc` as a `default:` was exported as `.333333333Z`, so a client that sent the published default sent a different instant. A `default:` or `example:` finer than a nanosecond now raises `ArgumentError` at class load, naming the field, at any depth: a scalar, an `of: :datetime` array, an array of hashes and a sub-field. A String with ten or more fractional digits is refused too, unlike an `in:` String member, which is published as written. A nanosecond-exact value is still accepted. (#159)
+- **The OpenAPI export documented about 36 framework methods of a Metal controller as operations.** A catch-all `permit_params` on an `ActionController::Metal` controller expanded from `action_methods`, which for a Metal subclass counts every public method of an included module, so `render`, `head`, `_prefixes`, `view_paths` and the rest were exported with operationIds such as `pings_render`. The catch-all now lists only the controller's own actions, as it does on an `ActionController::Base` controller. (#161)
+- **An array `example:` written with date parts was exported as `[{}]`.** `array :items, example: [{ "on(1i)" => "2026", "on(2i)" => "10", "on(3i)" => "17" }]` was published as `[[{}]]`, though a request with the same parts reads as `2026-10-17`, and the server would fill in the sub-field's default for the published payload. The example is now judged on the hash with the date parts assembled, and is exported as `[{"on" => "2026-10-17"}]`. This covers `:date` and `:datetime` parts, in arrays and in a nested block inside an array. Requests are unchanged. (#162)
+- **A `:json` `default:` or `example:` holding NaN or Infinity loaded, and the export raised.** `optional :meta, :json, default: { "score" => Float::NAN }` loaded, and `JSON.generate(json_schema)` then raised `JSON::GeneratorError`. No JSON request can carry NaN, so the value is one no client can send. A non-finite Float at any depth of a `:json` default or example, including a `:json` sub-field and a `:json` value inside an array, now raises `ArgumentError` at class load, naming the field and the path, such as `x[1].y`. Requests are unchanged. (#163)
+- **A midnight-UTC `Time` sent to a `:date` before 1582 was read as the wrong day.** `Time.utc(1500, 1, 1)` became 1499-12-23, because `Time#to_date` labels days before the reform in the Julian calendar, while the String `"1500-01-01"` is proleptic Gregorian. The same applied to a `DateTime` and a `TimeWithZone`, and to `in:` members and `default:` values, which never matched or were exported as a different day. The day is now built from the instant's own year, month and day, so a Time, a DateTime and the String `"1500-01-01T00:00:00Z"` all give 1500-01-01. (#164)
+- **A pre-1582 `DateTime` was read wrongly without ActiveSupport.** With a plain `require "permittable"`, `DateTime.new(1500, 1, 1)` sent to a `:date` landed on 1500-01-10. It now reads the DateTime's own calendar labels and gives 1500-01-01, with or without ActiveSupport. The days 1582-10-05 to 1582-10-14 do not exist in the calendar a `:date` reads, so a Time or DateTime on one of them is `invalid_type`, and an `in:` member on one raises the normal class-load error naming the field. A `:datetime` still accepts those days. (#164)
+
+### Documentation
+- **The README now says that a catch-all `rescue_from` declared after `include Permittable` wins.** `include Permittable` registers `rescue_from Permittable::InvalidParameters`, and Rails searches handlers from the last declared, so a `rescue_from StandardError` placed after the include answers an invalid request with its own response, often a 500, and the gem's 422 never runs. The README gives the two fixes: declare the catch-all before the include, or declare `rescue_from Permittable::InvalidParameters, with: :render_invalid_parameters` after it. (#158)
+
+### Development
+- **Bump `sqlite3` 2.10.0 to 2.10.1 and `rubocop` (bundler-minor-patch group).** Development dependencies only. (#167)
+
 ## 0.13.0 (2026-10-24)
 <!-- title: the audit and the OpenAPI export follow mounted engines and Metal controllers, and a path variable is documented as one -->
 

data/README.md

@@ -716,7 +716,7 @@ What you give up is the shape. What you keep:
 | `max_depth:` | Caps **container nesting**, counting arrays as a level: `{"a": 1}` is 1, `{"a": {"b": 1}}` and `{"a": [1, 2]}` are 2, `{"a": [{"b": 1}]}` is 3. Violation code `depth` |
 | `validate:` / `transform:` | See the whole hash, so any check you can write in Ruby still applies |
 | `model:` | The field maps onto a column like a scalar does, so the [drift guard](#the-schema-drift-guard) still catches a dropped `metadata` column |
-| `sensitive:` / `nullable:` / `message:` / `desc:` / `default:` / `example:` | Behave as on any other field (`default:`/`example:` must be a hash, and are checked against the field's own bounds at class load) |
+| `sensitive:` / `nullable:` / `message:` / `desc:` / `default:` / `example:` | Behave as on any other field (`default:`/`example:` must be a hash holding no NaN or Infinity, and are checked against the field's own bounds at class load) |
 
 Bounding it matters more than it looks: an unbounded `jsonb` column is where clients put megabytes and 200-level-deep objects. `max_depth:` and `length:` are how a contract says "opaque, but not unlimited" — which is strictly more than `permit(metadata: {})` can say.
 
@@ -773,6 +773,12 @@ Exported [OpenAPI](#exporting-openapi-docs-that-cannot-drift) tells the truth ab
 
 Every failure raises `Permittable::InvalidParameters`, carrying `details` (an array of `{ param:, code: }`, plus a `message:` when the field [declares one](#custom-error-messages-message)) and a `status`. On a real controller it is auto-rescued into the error envelope shown at the [top of this README](#permittable).
 
+Rails searches `rescue_from` handlers from the last declared to the first, so a catch-all such as `rescue_from StandardError` declared *after* `include Permittable` answers an invalid request first, and the client gets that handler's response instead of the 422 or 400. Either declare the catch-all before the include, or re-declare the gem's handler after it:
+
+```ruby
+rescue_from Permittable::InvalidParameters, with: :render_invalid_parameters
+```
+
 | Code | Raised when |
 |---|---|
 | `missing` | A required field is absent, or the `root:` key is absent (that one is a **400**) |
@@ -1015,6 +1021,8 @@ If this parameter is not backed by a column, declare it with virtual: true.
 
 The error carries a ready-to-paste migration command, typed from your own field declaration.
 
+A field naming a column the model lists in `ignored_columns` raises too, but says so (remove it from `ignored_columns`, or declare it `virtual: true`) rather than suggesting a migration.
+
 #### Checking types too (opt-in)
 
 A dropped column fails the deploy; a **retyped** one doesn't, unless you ask:
@@ -1592,7 +1600,7 @@ A bad contract is a programmer error, so it fails when the class loads — never
 - `length:` that isn't a non-negative `Integer` or a `Range`, or a `Range` with a negative or fractional end (`..-1`, `-2..3`, `1.5..3.5`; a whole-number Float such as `1..10.0` is fine; leave an end off, or use `Float::INFINITY`, for no bound); an `in:` that is a `String` (`String#include?` would match any substring — `in: "free pro"` accepted `"e"`), or that is neither a `Range` nor answers `include?`
 - An `in:` member the field's own type can't cast (`in: %w[1 two]` on an `:integer`, `nil` on a field that isn't `nullable:`, or a `Time` on a `:date` field that isn't exactly midnight UTC), or an `in:` `Range` whose endpoints a value of the field's type can't be compared with (`in: "1".."5"` on an `:integer`) — either would reject every request as `inclusion`
 - A bound **no value could satisfy**: a reversed or empty `Range` (`in: 65..18`, `length: 5..2`, `length: 3...3`), an empty `in:` set, or a `length:` of 0 on a `required` field (where `""` already violates as `missing`)
-- A `Time` `in:` member on a `:datetime` field finer than a nanosecond (`Time.at(1.1)`, a third of a second): a request's fraction is a finite decimal and the export prints nine digits, so no request could equal it
+- A `Time` `in:` member, `default:` or `example:` on a `:datetime` field finer than a nanosecond (`Time.at(1.1)`, a third of a second): a request's fraction is a finite decimal and the export prints nine digits, so no request could equal the member, and a published default or example would be a different instant
 - `validate:` or `transform:` that isn't callable
 - A `default:` or `example:` that violates its own field's contract, or an array `default:`/`example:` whose elements violate `of:` — or, for an array declared with a **block**, an element that isn't a hash the block would accept
 - A `default: nil` or `example: nil` on a field that isn't `nullable:`

data/lib/permittable/authored_values.rb

@@ -103,6 +103,16 @@ module Permittable
       found
     end
 
+    # An authored :datetime Time must survive the export's nine digits, at
+    # any depth, as a scalar `default:` or `example:` must (see Coercion).
+    def permittable_check_scalar(field, value)
+      Coercion.refuse_finer_than_nanosecond(field[:type], super)
+    end
+
+    def permittable_cast_element(field, element)
+      Coercion.refuse_finer_than_nanosecond(field[:of], super)
+    end
+
     # Nor does it run an array-level validate:, which expects the transformed
     # sub-fields a request hands it. The validating read has already run it
     # on exactly those, so the stored read, which would hand it the
@@ -114,11 +124,13 @@ module Permittable
     # What a client sends has no defaults filled in: an omitted sub-field
     # stays omitted, at any depth, so the published example does not show a
     # value (`cents: 0`) that no client sends. The walker fills them in; drop
-    # exactly what it filled, by the walker's own absence rule.
+    # exactly what it filled, by the walker's own absence rule, judged on the
+    # hash the walker walked: one with the date parts read into their field.
     def permittable_check_hash(fields, hash, **)
       result = super
       return result unless @as_sent
 
+      hash = permittable_read_date_parts(fields, hash)
       fields.each do |field|
         key = field[:name].to_s
         next unless field.key?(:default)
@@ -130,6 +142,30 @@ module Permittable
       result
     end
 
+    # An authored hash is exported as a schema `default`/`example`, and JSON
+    # has no NaN or Infinity: JSON.generate raises on them when the document
+    # is written, long after the class loaded. A request cannot carry one
+    # (JSON has none; a form sends Strings), so only the authored value is
+    # held to it, here, and not permittable_check_json for every request.
+    def permittable_check_json(field, value)
+      status, read = super
+      return [status, read] unless status == :ok
+
+      at = non_finite_path(value, "")
+      return [:error, "holds NaN or Infinity at #{at}, which JSON cannot carry"] if at
+
+      [status, read]
+    end
+
+    # Where the first NaN or infinite Float sits, as `a.b[1].c`, or nil.
+    def non_finite_path(value, path)
+      case value
+      when Float then path unless value.finite?
+      when Hash then value.each_pair.lazy.filter_map { |k, v| non_finite_path(v, path.empty? ? k.to_s : "#{path}.#{k}") }.first
+      when Array then value.each_with_index.lazy.filter_map { |v, i| non_finite_path(v, "#{path}[#{i}]") }.first
+      end
+    end
+
     def permittable_violation(_field, param, code)
       { param: param, code: code.to_s }
     end

data/lib/permittable/column_guard.rb

@@ -49,6 +49,8 @@ module Permittable
 
       fields.flatten.compact.each do |field|
         unless klass.column_names.include?(field.to_s)
+          raise ArgumentError, ignored_column_message(label, klass, field) if ignored_column?(klass, field)
+
           raise ArgumentError,
                 "#{label}: '#{field}' does not exist in the database (table: #{klass.table_name})." \
                 "#{column_migration_hint(klass, field, types)}"
@@ -204,6 +206,37 @@ module Permittable
       klass.name || "Model"
     end
 
+    # `klass.column_names` leaves out `self.ignored_columns`, so an ignored
+    # column that IS in the database reads as missing. Raising stays right
+    # (`Model.new(field: ...)` raises UnknownAttributeError), but the
+    # migration the missing-column message teaches would duplicate it.
+    def ignored_column?(klass, field)
+      klass.respond_to?(:ignored_columns) && klass.ignored_columns.map(&:to_s).include?(field.to_s)
+    end
+
+    # The column may have been dropped since it was ignored, with its name
+    # left in ignored_columns; the table itself says which. That case needs
+    # different advice: removing the name would only lead to a migration
+    # that re-adds a column the app no longer wants.
+    def ignored_column_message(label, klass, field)
+      subject = "#{label}: '#{field}' is in #{model_expr(klass)}'s ignored_columns"
+      if column_in_table?(klass, field)
+        "#{subject} (table: #{klass.table_name}), so the model ignores that column " \
+          "and assigning it raises ActiveModel::UnknownAttributeError. " \
+          "Remove it from ignored_columns, or declare the field virtual: true if the app handles it itself."
+      else
+        "#{subject} but the table has no such column (table: #{klass.table_name}). " \
+          "Remove it from ignored_columns and the field from the contract, " \
+          "or declare the field virtual: true if the app handles it itself."
+      end
+    end
+
+    # Unlike `column_names`, the connection's own column list includes the
+    # columns the model ignores.
+    def column_in_table?(klass, field)
+      klass.connection_pool.with_connection { |connection| connection.column_exists?(klass.table_name, field) }
+    end
+
     def column_migration_hint(klass, field, types)
       type = types.is_a?(Hash) ? types[field.to_sym] : types
       column = [field, type].compact.join(":")

data/lib/permittable/open_api.rb

@@ -91,6 +91,54 @@ module Permittable
       @concern_methods ||= Permittable.public_instance_methods(false).map(&:to_s).freeze
     end
 
+    # Gems whose public methods are the framework's own: the ones a controller
+    # gets from the modules Rails mixes in (Rendering, Head, Callbacks, ViewPaths,
+    # Rescuable, ...) and from the class attributes those define on it.
+    FRAMEWORK_GEMS = %w[actionpack actionview activesupport activemodel railties].freeze
+
+    # Rails reads a controller's internal methods off its nearest abstract
+    # class: ActionController::Base includes all of those modules, so they are
+    # internal on a Base or API controller, but ActionController::Metal includes
+    # none, so on one built directly on it every public method of an included
+    # module is an action_methods entry. A method is the framework's when it
+    # is defined in one of its gems, by whichever module or class_attribute
+    # put it on the controller; a method the app defines, in the class or in a
+    # concern of its own, stays an action. So does one a superclass declares in
+    # its own file, even a framework controller's (Rails::HealthController#show):
+    # a method defined elsewhere in a gem, such as the class_attribute readers
+    # an app's parent class gets from the modules it includes, is not one.
+    def framework_method?(controller, action)
+      return false unless controller.respond_to?(:instance_method)
+
+      method = controller.instance_method(action)
+      file = method.source_location&.first
+      return false if file.nil? || framework_roots.none? { |root| file.start_with?(root) }
+
+      !declared_by_superclass?(method, controller, file)
+    rescue NameError
+      false
+    end
+
+    # Whether `method` is written in the file that defines its owner, a class
+    # other than the controller itself. An anonymous owner has no such file.
+    def declared_by_superclass?(method, controller, file)
+      owner = method.owner
+      owner.is_a?(Class) && owner != controller && !owner.name.nil? &&
+        Object.const_source_location(owner.name)&.first == file
+    end
+
+    # Resolved lazily, like concern_methods: the gems load after this file.
+    # Real paths, which is what source_location reports: a gem's own path is
+    # only expanded, so one reached through a symlink would never match.
+    def framework_roots
+      @framework_roots ||= FRAMEWORK_GEMS.filter_map do |name|
+        path = Gem.loaded_specs[name]&.full_gem_path or next
+        File.join(File.realpath(path), "")
+      rescue SystemCallError
+        File.join(path, "")
+      end.freeze
+    end
+
     # Shared `components` for any document referencing Permittable responses.
     #
     # Unlike a rule's monitor mode — which the exporter reads only from the
@@ -176,7 +224,8 @@ module Permittable
       return explicit unless contracts.any? { |rule| rule[:actions].empty? }
       return explicit + ["*"] unless controller.respond_to?(:action_methods)
 
-      explicit + (controller.action_methods.map(&:to_s).sort - explicit - concern_methods)
+      actions = controller.action_methods.map(&:to_s).sort - explicit - concern_methods
+      explicit + actions.reject { |action| framework_method?(controller, action) }
     end
 
     def operation_for(controller, action)

data/lib/permittable/version.rb

@@ -1,3 +1,3 @@
 module Permittable
-  VERSION = "0.13.0".freeze
+  VERSION = "0.13.1".freeze
 end

data/lib/permittable.rb

@@ -1046,9 +1046,31 @@ module Permittable
     # with a time of day always got. Shared by cast_date and
     # instant_as_date, so a value and an in: member cannot be read
     # differently; and always a plain Date, never the DateTime it came as.
+    #
+    # Built from the UTC components, as a String is (cast_date), not with
+    # Time#to_date: that keeps the instant's day NUMBER and labels it in the
+    # Julian calendar before the 1582 reform, so Time.utc(1500, 1, 1) came
+    # out as 1499-12-23 while "1500-01-01" was 1500-01-01.
+    #
+    # A day the 1582 reform skipped (1582-10-05..14) is no Date, as the String
+    # "1582-10-10" is none, so it is nil here and every caller gives its usual
+    # error. :datetime is proleptic Gregorian and does accept those days; the
+    # two differ there by design, :date being the String path's calendar.
+    #
+    # A DateTime is read by its own civil day, not through #to_time: stdlib's
+    # converts by day number, so outside Rails (ActiveSupport converts by
+    # component) a DateTime before 1582 landed 9 days late.
     def date_of_instant(instant)
-      utc = instant.to_time.getutc
-      utc.to_date if utc == utc.beginning_of_day
+      if instant.is_a?(DateTime)
+        utc = instant.new_offset(0)
+        return unless utc.hour.zero? && utc.minute.zero? && utc.second.zero? && utc.sec_fraction.zero?
+      else
+        utc = instant.to_time.getutc
+        return unless utc == utc.beginning_of_day
+      end
+      return unless Date.valid_date?(utc.year, utc.month, utc.day)
+
+      Date.new(utc.year, utc.month, utc.day)
     end
 
     # A zoneless String parses as UTC regardless of the host timezone
@@ -1241,11 +1263,34 @@ module Permittable
       return instant_as_date(member) if type == :date && (member.is_a?(Time) || member.is_a?(DateTime))
 
       status, value = cast(type, member)
-      return [status, value] unless status == :ok && type == :datetime && !member.is_a?(String) && !whole_nanoseconds?(value)
+      return [status, value] unless status == :ok && finer_than_nanosecond?(type, member, value)
 
       [:error, "finer than a nanosecond, so it never equals a request; round it, e.g. with .round(9)"]
     end
 
+    # Whether `raw`, authored as a Time-like `in:` member of a :datetime
+    # field and cast to `cast_value`, holds more than the nine digits the
+    # export prints. A String `in:` member is exempt: it is cast exactly as a
+    # request sending it is, and published as written (see
+    # published_in_member), so whatever precision it spells is reachable.
+    def finer_than_nanosecond?(type, raw, cast_value)
+      type == :datetime && !raw.is_a?(String) && !whole_nanoseconds?(cast_value)
+    end
+
+    # An authored `default:` or `example:` is held to the same rule as an
+    # `in:` member: the exported schema prints it to nine digits, so a value
+    # finer than that was published as a different instant than the action
+    # got for an omitted field, and a client sending the published default
+    # was not sending the default. Unlike an `in:` member, a String is NOT
+    # exempt here: a default or example is stored as the cast Time and
+    # exported from that, never as written, so "...00.1234567891Z" printed
+    # as .123456789Z. `outcome` is the cast's [status, value].
+    def refuse_finer_than_nanosecond(type, outcome)
+      return outcome unless outcome.first == :ok && type == :datetime && !whole_nanoseconds?(outcome.last)
+
+      [:error, "finer than a nanosecond, so the export publishes a different instant; round it, e.g. with .round(9)"]
+    end
+
     # A request's fraction of a second is a finite decimal, and the export
     # prints a member to at most nine digits, so a member that is not a whole
     # number of nanoseconds — Time.at(1.1) holds 1.10000000000000008881...,
@@ -1267,7 +1312,7 @@ module Permittable
     # class-load error a reason where a request gets `invalid_type`.
     def instant_as_date(member)
       date = date_of_instant(member)
-      date ? [:ok, date] : [:error, "not midnight UTC, so it never equals a date"]
+      date ? [:ok, date] : [:error, "not midnight UTC of an existing day, so it never equals a date"]
     end
 
     # What an exported enum lists for one member: the cast value, re-encoded
@@ -1885,7 +1930,9 @@ module Permittable
       # proc cannot rewrite the host's own literal.
       authored = field[opt].is_a?(String) ? field[opt].dup : field[opt]
       value = Coercion.apply_normalize(field[:normalize], authored)
-      status, result = Coercion.check_scalar(live_in?(field) ? field.except(:in) : field, value)
+      status, result = Coercion.refuse_finer_than_nanosecond(
+        field[:type], Coercion.check_scalar(live_in?(field) ? field.except(:in) : field, value)
+      )
       raise ArgumentError, "#{LABEL}: :#{opt} for field :#{field[:name]} violates its own contract (#{result})" unless status == :ok
 
       field[opt] = freeze_authored(opt == :default && field[:transform] ? field[opt] : result)
@@ -2758,7 +2805,7 @@ module Permittable
     case field[:kind]
     when :scalar
       # Already normalized by permittable_normalized, before the absence rule.
-      permittable_check_whole(field, Coercion.check_scalar(field, value), full, result, violations: violations)
+      permittable_check_whole(field, permittable_check_scalar(field, value), full, result, violations: violations)
     when :json
       permittable_check_whole(field, permittable_check_json(field, value), full, result, violations: violations)
     when :nested
@@ -2883,7 +2930,18 @@ module Permittable
     field[:transform] ? field[:transform].call(value) : value
   end
 
-  # A second seam, for the same reader: the array-level `validate:` to run.
+  # More seams, for the same reader: how a scalar field's value, and an
+  # array element, are cast. A request's are cast as they come; an authored
+  # default: or example: is also held to the nine digits the export prints.
+  def permittable_check_scalar(field, value)
+    Coercion.check_scalar(field, value)
+  end
+
+  def permittable_cast_element(field, element)
+    Coercion.cast(field[:of], element)
+  end
+
+  # A third seam, for the same reader: the array-level `validate:` to run.
   def permittable_array_validator(field)
     field[:validate]
   end
@@ -2898,7 +2956,7 @@ module Permittable
                                     path: path, unknown: unknown, top_level: false, violations: violations)
     end
 
-    status, out = Coercion.cast(field[:of], permittable_own(element))
+    status, out = permittable_cast_element(field, permittable_own(element))
     return out if status == :ok
 
     violations << permittable_violation(field, path, out)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: permittable
 version: !ruby/object:Gem::Version
-  version: 0.13.0
+  version: 0.13.1
 platform: ruby
 authors:
 - Ethan Nguyen
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-24 00:00:00.000000000 Z
+date: 2026-11-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport