@hypequery/serve 0.16.0 → 0.16.1

package/dist/pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../src/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAmB,MAAM,KAAK,CAAC;AAEzC,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EAKX,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EAGb,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOrD,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,WAAW,CAAC;AAiPvE,MAAM,WAAW,sBAAsB,CACrC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW;IAEzB,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,YAAY,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW,EAEzB,SAAS,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAC/C,OAAO,CAAC,aAAa,CA+UvB,CAAC;AAEF,UAAU,cAAc,CACtB,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW;IAEzB,MAAM,EAAE,OAAO,aAAa,EAAE,WAAW,CAAC;IAC1C,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACxC;AAED,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW,EACzB,iIAUC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAG,YAkDpC,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,cAAc,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EACvD,UAAU,cAAc;;;;;;;;;;;;;;;;;;;;;CA8BzB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,aAAa,MAAM,EACnB,UAAU,WAAW;;;;;;;;;;;;;;;;;;;;;;;;CAyBmD,CAAC"}
+{"version":3,"file":"pipeline.d.ts","sourceRoot":"","sources":["../src/pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAmB,MAAM,KAAK,CAAC;AAEzC,OAAO,KAAK,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EAKX,cAAc,EACd,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,YAAY,EACZ,aAAa,EACb,YAAY,EAGb,MAAM,YAAY,CAAC;AAMpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAOrD,OAAO,EAAE,KAAK,kBAAkB,EAAqB,MAAM,WAAW,CAAC;AA2PvE,MAAM,WAAW,sBAAsB,CACrC,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW;IAEzB,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,OAAO,EAAE,YAAY,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,cAAc,CAAC,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,YAAY,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC;IACpC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,eAAe,GAC1B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW,EAEzB,SAAS,sBAAsB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAC/C,OAAO,CAAC,aAAa,CAmVvB,CAAC;AAEF,UAAU,cAAc,CACtB,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW;IAEzB,MAAM,EAAE,OAAO,aAAa,EAAE,WAAW,CAAC;IAC1C,iBAAiB,EAAE,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;IAChE,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACtC,YAAY,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,cAAc,CAAC,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACtD,KAAK,CAAC,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACnC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,UAAU,CAAC,EAAE,kBAAkB,GAAG,IAAI,CAAC;CACxC;AAED,eAAO,MAAM,kBAAkB,GAC7B,QAAQ,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACxC,KAAK,SAAS,WAAW,EACzB,iIAUC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAG,YAkDpC,CAAC;AAEF,eAAO,MAAM,qBAAqB,GAChC,MAAM,MAAM,EACZ,cAAc,MAAM,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,EACvD,UAAU,cAAc;;;;;;;;;;;;;;;;;;;;;CA8BzB,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAC7B,MAAM,MAAM,EACZ,aAAa,MAAM,EACnB,UAAU,WAAW;;;;;;;;;;;;;;;;;;;;;;;;CAyBmD,CAAC"}

package/dist/pipeline.js

@@ -8,6 +8,7 @@ import { ServeHttpError } from './errors.js';
 import { checkRoleAuthorization, checkScopeAuthorization, AuthError, } from './auth.js';
 import { handleCorsRequest } from './cors.js';
 import { resolveLocalAuthRequirement } from './auth-requirement.js';
+import { coerceQueryInput } from './query-coercion.js';
 const safeInvokeHook = async (name, hook, payload) => {
     if (!hook)
         return;
@@ -23,6 +24,13 @@ const createErrorResponse = (status, type, message, details, headers) => ({
     headers: headers ?? {},
     body: { error: { type, message, ...(details ? { details } : {}) } },
 });
+/**
+ * True when {@link buildContextInput} sourced the input from the query string
+ * rather than a body. Query values are always strings, so they need coercing
+ * against the schema before validation; JSON bodies already carry types.
+ */
+const inputCameFromQuery = (request) => (request.body === undefined || request.body === null) &&
+    Boolean(request.query && Object.keys(request.query).length > 0);
 const buildContextInput = (request) => {
     if (request.body !== undefined && request.body !== null) {
         return request.body;
@@ -326,6 +334,9 @@ export const executeEndpoint = async (options) => {
                 });
             }
         }
+        if (inputCameFromQuery(request)) {
+            context.input = coerceQueryInput(endpoint.inputSchema, context.input);
+        }
         const validationResult = validateInput(endpoint.inputSchema, context.input);
         if (!validationResult.success) {
             await safeInvokeHook('onError', hooks.onError, {

package/dist/query-coercion.d.ts

@@ -0,0 +1,8 @@
+import type { ZodTypeAny } from "zod";
+/**
+ * Returns a copy of `raw` with values coerced toward `schema`. Returns `raw`
+ * untouched when the schema is absent, is not an object schema, or when the
+ * payload is not a plain object.
+ */
+export declare function coerceQueryInput(schema: ZodTypeAny | undefined, raw: unknown): unknown;
+//# sourceMappingURL=query-coercion.d.ts.map

package/dist/query-coercion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"query-coercion.d.ts","sourceRoot":"","sources":["../src/query-coercion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,KAAK,CAAC;AAyGtC;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAkCtF"}

package/dist/query-coercion.js

@@ -0,0 +1,124 @@
+const defOf = (schema) => schema?._def;
+const typeNameOf = (schema) => defOf(schema)?.typeName;
+/**
+ * Strips wrappers that do not change what a query value should be coerced to.
+ * `ZodPipeline` unwraps to its input side, since that is what validation
+ * receives. Preprocess effects stay wrapped so their callback sees the raw wire
+ * value as declared by the schema.
+ */
+function unwrap(schema, depth = 0) {
+    if (!schema || depth > 10)
+        return schema;
+    const def = defOf(schema);
+    switch (def?.typeName) {
+        case "ZodOptional":
+        case "ZodNullable":
+        case "ZodDefault":
+        case "ZodCatch":
+        case "ZodReadonly":
+            return unwrap(def.innerType, depth + 1);
+        case "ZodBranded":
+            return unwrap(def.type, depth + 1);
+        case "ZodEffects": {
+            const effect = def.effect;
+            if (effect?.type === "preprocess")
+                return schema;
+            return unwrap(def.schema, depth + 1);
+        }
+        case "ZodPipeline":
+            return unwrap(def.in, depth + 1);
+        default:
+            return schema;
+    }
+}
+function coerceScalar(target, value) {
+    switch (typeNameOf(target)) {
+        case "ZodNumber": {
+            if (value.trim() === "")
+                return value;
+            const parsed = Number(value);
+            return Number.isFinite(parsed) ? parsed : value;
+        }
+        case "ZodBigInt": {
+            if (value.trim() === "")
+                return value;
+            try {
+                return BigInt(value);
+            }
+            catch {
+                return value;
+            }
+        }
+        case "ZodBoolean": {
+            const normalized = value.trim().toLowerCase();
+            if (normalized === "true" || normalized === "1")
+                return true;
+            if (normalized === "false" || normalized === "0")
+                return false;
+            return value;
+        }
+        case "ZodDate": {
+            const parsed = new Date(value);
+            return Number.isNaN(parsed.getTime()) ? value : parsed;
+        }
+        default:
+            // Strings, enums, literals, unions, and anything unrecognised are already
+            // in their wire form or too ambiguous to guess at.
+            return value;
+    }
+}
+function coerceValue(target, value) {
+    const unwrapped = unwrap(target);
+    if (typeNameOf(unwrapped) === "ZodArray") {
+        const element = (defOf(unwrapped)?.type ?? undefined);
+        // A key that appears once arrives as a scalar, but the schema wants a list.
+        const items = Array.isArray(value) ? value : [value];
+        return items.map((item) => coerceValue(element, item));
+    }
+    // A repeated key produced an array the schema does not want. Leave it so zod
+    // reports the real mismatch.
+    if (Array.isArray(value))
+        return value;
+    if (typeof value !== "string")
+        return value;
+    return coerceScalar(unwrapped, value);
+}
+/**
+ * Returns a copy of `raw` with values coerced toward `schema`. Returns `raw`
+ * untouched when the schema is absent, is not an object schema, or when the
+ * payload is not a plain object.
+ */
+export function coerceQueryInput(schema, raw) {
+    if (!schema || raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+        return raw;
+    }
+    try {
+        const objectSchema = unwrap(schema);
+        if (typeNameOf(objectSchema) !== "ZodObject")
+            return raw;
+        const objectDef = defOf(objectSchema);
+        const shapeFactory = objectDef?.shape;
+        const shape = (typeof shapeFactory === "function" ? shapeFactory() : shapeFactory);
+        if (!shape)
+            return raw;
+        const catchall = typeNameOf(objectDef?.catchall) === "ZodNever"
+            ? undefined
+            : objectDef?.catchall;
+        const coerced = { ...raw };
+        for (const [key, value] of Object.entries(coerced)) {
+            const target = Object.prototype.hasOwnProperty.call(shape, key)
+                ? shape[key]
+                : catchall;
+            // Untyped unknown keys are left for the schema to strip or reject.
+            if (!target)
+                continue;
+            coerced[key] = coerceValue(target, value);
+        }
+        return coerced;
+    }
+    catch {
+        // Coercion is a convenience, never a failure mode. Fall back to the raw
+        // payload so validation reports the genuine problem.
+        return raw;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/serve",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Code-first TypeScript runtime for validated ClickHouse analytics APIs, OpenAPI, auth, and tenancy",
   "keywords": [
     "clickhouse",