@rvoh/psychic 3.8.6 → 3.10.0

package/dist/cjs/src/bin/helpers/OpenApiSpecDiff.js

@@ -189,6 +189,10 @@ export class OpenApiSpecDiff {
     }
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
     getHeadBranchContent(absoluteFilePath) {

package/dist/cjs/src/openapi-renderer/app.js

@@ -7,6 +7,7 @@ import PsychicApp from '../psychic-app/index.js';
 import { HttpMethods } from '../router/types.js';
 import { DEFAULT_OPENAPI_COMPONENT_RESPONSES, DEFAULT_OPENAPI_COMPONENT_SCHEMAS } from './defaults.js';
 import { MissingControllerActionPairingInRoutes, } from './endpoint.js';
+import legacyImplicitRequestBodyParamsConfig from './helpers/legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './helpers/suppressResponseEnumsConfig.js';
 const debugEnabled = debuglog('psychic').enabled;
 export default class OpenapiAppRenderer {
@@ -47,6 +48,7 @@ export default class OpenapiAppRenderer {
         const renderOpts = {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(openapiName),
         };
         const alreadyExtractedDescendantSerializers = {};
         const renderedSchemasOpenapi = {};

package/dist/cjs/src/openapi-renderer/body-segment.js

@@ -54,6 +54,7 @@ export default class OpenapiSegmentExpander {
     bodySegment;
     casing;
     suppressResponseEnums;
+    legacyImplicitRequestBodyParams;
     target;
     source;
     /**
@@ -66,6 +67,7 @@ export default class OpenapiSegmentExpander {
         this.bodySegment = bodySegment;
         this.casing = renderOpts.casing;
         this.suppressResponseEnums = renderOpts.suppressResponseEnums;
+        this.legacyImplicitRequestBodyParams = renderOpts.legacyImplicitRequestBodyParams;
         this.target = target;
         this.source = source ?? 'unknown';
     }
@@ -489,6 +491,7 @@ The following values will be allowed:
             including: ref.including,
             required: ref.required,
             combining: ref.combining,
+            legacyImplicitRequestBodyParams: this.legacyImplicitRequestBodyParams,
         }, this.source);
         return this.recursivelyParseBody(paramsShape);
     }

package/dist/cjs/src/openapi-renderer/endpoint.js

@@ -529,7 +529,17 @@ export default class OpenapiEndpointRenderer {
             including: including,
             required: required,
             combining: combining,
+            legacyImplicitRequestBodyParams: renderOpts.legacyImplicitRequestBodyParams,
         }, source);
+        // When the model-derived shape contributes no properties and no `required`
+        // (e.g. the new none-default with no `params`/`only`/`combining`), there is
+        // nothing meaningful to advertise. Fall back to `defaultRequestBody()`, which
+        // omits the body entirely unless body-level pagination params are present.
+        const shapeProperties = paramsShape.properties;
+        const shapeRequired = paramsShape.required;
+        if (Object.keys(shapeProperties ?? {}).length === 0 && !shapeRequired) {
+            return this.defaultRequestBody();
+        }
         let processedSchema = new OpenapiSegmentExpander(paramsShape, {
             renderOpts,
             target: 'request',

package/dist/cjs/src/openapi-renderer/helpers/OpenapiPayloadValidator.js

@@ -2,6 +2,7 @@ import OpenapiRequestValidationFailure from '../../error/openapi/OpenapiRequestV
 import OpenapiResponseValidationFailure from '../../error/openapi/OpenapResponseValidationFailure.js';
 import { createValidator, formatAjvErrors, } from '../../helpers/validateOpenApiSchema.js';
 import PsychicApp from '../../psychic-app/index.js';
+import legacyImplicitRequestBodyParamsConfig from './legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './suppressResponseEnumsConfig.js';
 import { cacheValidator, getCachedValidator } from './validator-cache.js';
 /**
@@ -207,6 +208,7 @@ export default class OpenapiPayloadValidator {
         return {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(this.openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(this.openapiName),
         };
     }
     /**

package/dist/cjs/src/openapi-renderer/helpers/buildDreamRequestBodyShape.js

@@ -11,9 +11,15 @@ import { dreamColumnOpenapiShape } from './dreamColumnOpenapiShape.js';
  * truth keeps top-level and nested semantics identical.
  */
 export default function buildDreamRequestBodyShape(dreamClass, opts, source) {
-    const { params, only, including, required, combining } = opts;
+    const { params, only, including, required, combining, legacyImplicitRequestBodyParams } = opts;
+    // When neither `params` nor `only` is provided, the default is to resolve to
+    // NO model columns (an empty allowlist), rather than implicitly exposing every
+    // param-safe column. The legacy implicit-all behavior can be re-activated via
+    // the `legacyImplicitRequestBodyParams` opt-in.
+    const resolvedOnly = params ?? only;
+    const onlyForResolution = resolvedOnly === undefined && !legacyImplicitRequestBodyParams ? [] : resolvedOnly;
     const paramSafeColumns = openapiParamNamesForDreamClass(dreamClass, {
-        only: params ?? only,
+        only: onlyForResolution,
         including,
     });
     const paramsShape = {

package/dist/cjs/src/openapi-renderer/helpers/dreamColumnOpenapiShape.js

@@ -18,6 +18,7 @@ source, dreamClass, column, openapi = undefined, { suppressResponseEnums = false
                     renderOpts: {
                         casing: 'camel',
                         suppressResponseEnums: false,
+                        legacyImplicitRequestBodyParams: false,
                     },
                     target: 'request',
                 }).render().openapi,

package/dist/cjs/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.js

@@ -0,0 +1,9 @@
+import openapiOpts from './openapiOpts.js';
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName) {
+    return !!openapiOpts(openapiName)?.legacyImplicitRequestBodyParams;
+}

package/dist/cjs/src/psychic-app/index.js

@@ -44,7 +44,9 @@ export default class PsychicApp {
             if (!psychicApp.routesCb)
                 throw new PsychicAppInitMissingRoutesCallback();
             if (psychicApp.encryption?.cookies?.current)
-                this.checkEncryptionKey('cookies', psychicApp.encryption.cookies.current.key, psychicApp.encryption.cookies.current.algorithm);
+                this.checkEncryptionKey('cookies', 'current', psychicApp.encryption.cookies.current.key, psychicApp.encryption.cookies.current.algorithm);
+            if (psychicApp.encryption?.cookies?.legacy)
+                this.checkEncryptionKey('cookies', 'legacy', psychicApp.encryption.cookies.legacy.key, psychicApp.encryption.cookies.legacy.algorithm);
             await psychicApp.inflections?.();
             dreamApp.on('repl:start', context => {
                 const psychicApp = PsychicApp.getOrFail();
@@ -187,14 +189,15 @@ export default class PsychicApp {
      * are not broken by a hard failure.
      *
      * @param encryptionIdentifier - currently must be 'cookies', though this may change in the future
+     * @param keyType - whether this is the 'current' or 'legacy' key (named in the error so a misconfigured legacy key is not mistaken for the current one)
      * @param key - the encryption key you want to check
      * @param algorithm - the encryption algorithm you want to check
      */
-    static checkEncryptionKey(encryptionIdentifier, key, algorithm) {
+    static checkEncryptionKey(encryptionIdentifier, keyType, key, algorithm) {
         if (Encrypt.validateKey(key, algorithm))
             return;
         const message = `
-Your current key value for ${encryptionIdentifier} encryption is invalid.
+Your ${keyType} key value for ${encryptionIdentifier} encryption is invalid.
 Try setting it to something valid, like:
   ${Encrypt.generateKey(algorithm)}
 

package/dist/cjs/src/server/params.js

@@ -59,8 +59,11 @@ export default class Params {
                 else if (columnMetadata?.enumValues) {
                     const paramValue = params[columnName];
                     if (columnMetadata.isArray) {
+                        // Single-value query arrays are conformed to arrays upstream in
+                        // conformQueryArrayParamsToOpenapiShape, so a non-array reaching
+                        // here is a real error rather than something to coerce.
                         if (!Array.isArray(paramValue))
-                            returnObj[columnName] = ['expected an array of enum values'];
+                            throw new ParamValidationError(columnName.toString(), ['expected an array of enum values']);
                         returnObj[columnName] = paramValue.map(p => {
                             return new this(params).cast(columnName.toString(), p, 'string', {
                                 allowNull: columnMetadata.allowNull,
@@ -177,10 +180,16 @@ export default class Params {
             return paramValue;
         }
         const integerRegexp = /^-?\d+$/;
+        // Plain decimal numeric string: optional sign, digits with an optional
+        // fractional part (or a bare fractional part), and an optional decimal
+        // exponent. Deliberately excludes hex/octal/binary literals and the
+        // "Infinity"/"NaN" keywords that `Number()` would otherwise accept.
+        const decimalNumberRegexp = /^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
         switch (expectedType) {
             case 'string':
                 if (typeof paramValue !== 'string')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                this.throwUnlessWithinLength(paramName, paramValue, opts);
                 if (opts?.enum && !opts.enum.includes(paramValue))
                     throw new ParamValidationError(paramName, ['did not match expected enum values']);
                 if (opts?.match)
@@ -191,6 +200,7 @@ export default class Params {
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 if (!integerRegexp.test(paramValue?.toString()))
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                this.throwUnlessWithinRange(paramName, BigInt(paramValue.toString()), opts);
                 return paramValue.toString();
             case 'boolean':
                 if ([true, 'true', 1, '1'].includes(paramValue))
@@ -254,25 +264,47 @@ export default class Params {
                 }
                 throw new ParamValidationError(paramName, [typeToError(expectedType)]);
             }
-            case 'integer':
+            case 'integer': {
                 if (typeof paramValue !== 'string' && typeof paramValue !== 'number')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 if (!integerRegexp.test(paramValue?.toString()))
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
-                return parseInt(paramValue, 10);
+                const integerValue = parseInt(paramValue, 10);
+                // Reject values outside the safe-integer range: a long digit string
+                // (e.g. a 40-digit number) would otherwise be silently rounded to a
+                // nearby float by parseInt. Genuinely large integers should be cast as
+                // `bigint`, which preserves the exact value as a string.
+                if (!Number.isSafeInteger(integerValue))
+                    throw new ParamValidationError(paramName, [
+                        'expected an integer within the safe integer range (use bigint for larger values)',
+                    ]);
+                this.throwUnlessWithinRange(paramName, integerValue, opts);
+                return integerValue;
+            }
             case 'json':
                 if (typeof paramValue !== 'object')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 return paramValue;
-            case 'number':
-                if (typeof paramValue === 'number')
+            case 'number': {
+                if (typeof paramValue === 'number') {
+                    if (!Number.isFinite(paramValue))
+                        throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                    this.throwUnlessWithinRange(paramName, paramValue, opts);
                     return paramValue;
+                }
                 if (typeof paramValue === 'string') {
-                    if (paramValue.length === 0 || Number.isNaN(Number(paramValue)))
+                    // Require a plain decimal numeric string and a finite result. This
+                    // rejects hex/octal/binary forms ("0x10"), the literals "Infinity"/
+                    // "NaN", and magnitudes that overflow to Infinity ("1e999"), all of
+                    // which `Number()` would otherwise silently coerce.
+                    const numberValue = Number(paramValue);
+                    if (!decimalNumberRegexp.test(paramValue) || !Number.isFinite(numberValue))
                         throw new ParamValidationError(paramName, [typeToError(expectedType)]);
-                    return Number(paramValue);
+                    this.throwUnlessWithinRange(paramName, numberValue, opts);
+                    return numberValue;
                 }
                 throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+            }
             case 'null':
                 if (paramValue !== null)
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
@@ -352,6 +384,45 @@ export default class Params {
             return paramValue;
         throw new ParamValidationError(paramName, [typeToError(expectedType)]);
     }
+    /**
+     * Enforces `minLength`/`maxLength` (inclusive) against an already-coerced
+     * string value, throwing {@link ParamValidationError} on violation. Mirrors
+     * JSON-schema / OpenAPI string-length constraints.
+     */
+    throwUnlessWithinLength(paramName, paramValue, opts) {
+        if (opts?.minLength !== undefined && paramValue.length < opts.minLength)
+            throw new ParamValidationError(paramName, [
+                `expected string with length no less than ${opts.minLength}`,
+            ]);
+        if (opts?.maxLength !== undefined && paramValue.length > opts.maxLength)
+            throw new ParamValidationError(paramName, [
+                `expected string with length no greater than ${opts.maxLength}`,
+            ]);
+    }
+    /**
+     * Enforces `minimum`/`maximum` (inclusive) against an already-coerced numeric
+     * value, throwing {@link ParamValidationError} on violation. Accepts a
+     * `bigint` so `bigint` casts are checked without precision loss; the bounds
+     * themselves are compared as `bigint` when they are integers and otherwise
+     * fall back to floating-point comparison. Mirrors JSON-schema / OpenAPI
+     * numeric-range constraints.
+     */
+    throwUnlessWithinRange(paramName, paramValue, opts) {
+        if (opts?.minimum !== undefined && this.isBelowNumericBound(paramValue, opts.minimum))
+            throw new ParamValidationError(paramName, [`expected a value no less than ${opts.minimum}`]);
+        if (opts?.maximum !== undefined && this.isAboveNumericBound(paramValue, opts.maximum))
+            throw new ParamValidationError(paramName, [`expected a value no greater than ${opts.maximum}`]);
+    }
+    isBelowNumericBound(value, bound) {
+        if (typeof value === 'bigint')
+            return Number.isInteger(bound) ? value < BigInt(bound) : Number(value) < bound;
+        return value < bound;
+    }
+    isAboveNumericBound(value, bound) {
+        if (typeof value === 'bigint')
+            return Number.isInteger(bound) ? value > BigInt(bound) : Number(value) > bound;
+        return value > bound;
+    }
     throwUnlessAllowNull(paramName, paramValue, message, { allowNull = false } = {}) {
         const isNullOrUndefined = [null, undefined].includes(paramValue);
         if (allowNull && isNullOrUndefined)

package/dist/esm/src/bin/helpers/OpenApiSpecDiff.js

@@ -189,6 +189,10 @@ export class OpenApiSpecDiff {
     }
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
     getHeadBranchContent(absoluteFilePath) {

package/dist/esm/src/openapi-renderer/app.js

@@ -7,6 +7,7 @@ import PsychicApp from '../psychic-app/index.js';
 import { HttpMethods } from '../router/types.js';
 import { DEFAULT_OPENAPI_COMPONENT_RESPONSES, DEFAULT_OPENAPI_COMPONENT_SCHEMAS } from './defaults.js';
 import { MissingControllerActionPairingInRoutes, } from './endpoint.js';
+import legacyImplicitRequestBodyParamsConfig from './helpers/legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './helpers/suppressResponseEnumsConfig.js';
 const debugEnabled = debuglog('psychic').enabled;
 export default class OpenapiAppRenderer {
@@ -47,6 +48,7 @@ export default class OpenapiAppRenderer {
         const renderOpts = {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(openapiName),
         };
         const alreadyExtractedDescendantSerializers = {};
         const renderedSchemasOpenapi = {};

package/dist/esm/src/openapi-renderer/body-segment.js

@@ -54,6 +54,7 @@ export default class OpenapiSegmentExpander {
     bodySegment;
     casing;
     suppressResponseEnums;
+    legacyImplicitRequestBodyParams;
     target;
     source;
     /**
@@ -66,6 +67,7 @@ export default class OpenapiSegmentExpander {
         this.bodySegment = bodySegment;
         this.casing = renderOpts.casing;
         this.suppressResponseEnums = renderOpts.suppressResponseEnums;
+        this.legacyImplicitRequestBodyParams = renderOpts.legacyImplicitRequestBodyParams;
         this.target = target;
         this.source = source ?? 'unknown';
     }
@@ -489,6 +491,7 @@ The following values will be allowed:
             including: ref.including,
             required: ref.required,
             combining: ref.combining,
+            legacyImplicitRequestBodyParams: this.legacyImplicitRequestBodyParams,
         }, this.source);
         return this.recursivelyParseBody(paramsShape);
     }

package/dist/esm/src/openapi-renderer/endpoint.js

@@ -529,7 +529,17 @@ export default class OpenapiEndpointRenderer {
             including: including,
             required: required,
             combining: combining,
+            legacyImplicitRequestBodyParams: renderOpts.legacyImplicitRequestBodyParams,
         }, source);
+        // When the model-derived shape contributes no properties and no `required`
+        // (e.g. the new none-default with no `params`/`only`/`combining`), there is
+        // nothing meaningful to advertise. Fall back to `defaultRequestBody()`, which
+        // omits the body entirely unless body-level pagination params are present.
+        const shapeProperties = paramsShape.properties;
+        const shapeRequired = paramsShape.required;
+        if (Object.keys(shapeProperties ?? {}).length === 0 && !shapeRequired) {
+            return this.defaultRequestBody();
+        }
         let processedSchema = new OpenapiSegmentExpander(paramsShape, {
             renderOpts,
             target: 'request',

package/dist/esm/src/openapi-renderer/helpers/OpenapiPayloadValidator.js

@@ -2,6 +2,7 @@ import OpenapiRequestValidationFailure from '../../error/openapi/OpenapiRequestV
 import OpenapiResponseValidationFailure from '../../error/openapi/OpenapResponseValidationFailure.js';
 import { createValidator, formatAjvErrors, } from '../../helpers/validateOpenApiSchema.js';
 import PsychicApp from '../../psychic-app/index.js';
+import legacyImplicitRequestBodyParamsConfig from './legacyImplicitRequestBodyParamsConfig.js';
 import suppressResponseEnumsConfig from './suppressResponseEnumsConfig.js';
 import { cacheValidator, getCachedValidator } from './validator-cache.js';
 /**
@@ -207,6 +208,7 @@ export default class OpenapiPayloadValidator {
         return {
             casing: 'camel',
             suppressResponseEnums: suppressResponseEnumsConfig(this.openapiName),
+            legacyImplicitRequestBodyParams: legacyImplicitRequestBodyParamsConfig(this.openapiName),
         };
     }
     /**

package/dist/esm/src/openapi-renderer/helpers/buildDreamRequestBodyShape.js

@@ -11,9 +11,15 @@ import { dreamColumnOpenapiShape } from './dreamColumnOpenapiShape.js';
  * truth keeps top-level and nested semantics identical.
  */
 export default function buildDreamRequestBodyShape(dreamClass, opts, source) {
-    const { params, only, including, required, combining } = opts;
+    const { params, only, including, required, combining, legacyImplicitRequestBodyParams } = opts;
+    // When neither `params` nor `only` is provided, the default is to resolve to
+    // NO model columns (an empty allowlist), rather than implicitly exposing every
+    // param-safe column. The legacy implicit-all behavior can be re-activated via
+    // the `legacyImplicitRequestBodyParams` opt-in.
+    const resolvedOnly = params ?? only;
+    const onlyForResolution = resolvedOnly === undefined && !legacyImplicitRequestBodyParams ? [] : resolvedOnly;
     const paramSafeColumns = openapiParamNamesForDreamClass(dreamClass, {
-        only: params ?? only,
+        only: onlyForResolution,
         including,
     });
     const paramsShape = {

package/dist/esm/src/openapi-renderer/helpers/dreamColumnOpenapiShape.js

@@ -18,6 +18,7 @@ source, dreamClass, column, openapi = undefined, { suppressResponseEnums = false
                     renderOpts: {
                         casing: 'camel',
                         suppressResponseEnums: false,
+                        legacyImplicitRequestBodyParams: false,
                     },
                     target: 'request',
                 }).render().openapi,

package/dist/esm/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.js

@@ -0,0 +1,9 @@
+import openapiOpts from './openapiOpts.js';
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName) {
+    return !!openapiOpts(openapiName)?.legacyImplicitRequestBodyParams;
+}

package/dist/esm/src/psychic-app/index.js

@@ -44,7 +44,9 @@ export default class PsychicApp {
             if (!psychicApp.routesCb)
                 throw new PsychicAppInitMissingRoutesCallback();
             if (psychicApp.encryption?.cookies?.current)
-                this.checkEncryptionKey('cookies', psychicApp.encryption.cookies.current.key, psychicApp.encryption.cookies.current.algorithm);
+                this.checkEncryptionKey('cookies', 'current', psychicApp.encryption.cookies.current.key, psychicApp.encryption.cookies.current.algorithm);
+            if (psychicApp.encryption?.cookies?.legacy)
+                this.checkEncryptionKey('cookies', 'legacy', psychicApp.encryption.cookies.legacy.key, psychicApp.encryption.cookies.legacy.algorithm);
             await psychicApp.inflections?.();
             dreamApp.on('repl:start', context => {
                 const psychicApp = PsychicApp.getOrFail();
@@ -187,14 +189,15 @@ export default class PsychicApp {
      * are not broken by a hard failure.
      *
      * @param encryptionIdentifier - currently must be 'cookies', though this may change in the future
+     * @param keyType - whether this is the 'current' or 'legacy' key (named in the error so a misconfigured legacy key is not mistaken for the current one)
      * @param key - the encryption key you want to check
      * @param algorithm - the encryption algorithm you want to check
      */
-    static checkEncryptionKey(encryptionIdentifier, key, algorithm) {
+    static checkEncryptionKey(encryptionIdentifier, keyType, key, algorithm) {
         if (Encrypt.validateKey(key, algorithm))
             return;
         const message = `
-Your current key value for ${encryptionIdentifier} encryption is invalid.
+Your ${keyType} key value for ${encryptionIdentifier} encryption is invalid.
 Try setting it to something valid, like:
   ${Encrypt.generateKey(algorithm)}
 

package/dist/esm/src/server/params.js

@@ -59,8 +59,11 @@ export default class Params {
                 else if (columnMetadata?.enumValues) {
                     const paramValue = params[columnName];
                     if (columnMetadata.isArray) {
+                        // Single-value query arrays are conformed to arrays upstream in
+                        // conformQueryArrayParamsToOpenapiShape, so a non-array reaching
+                        // here is a real error rather than something to coerce.
                         if (!Array.isArray(paramValue))
-                            returnObj[columnName] = ['expected an array of enum values'];
+                            throw new ParamValidationError(columnName.toString(), ['expected an array of enum values']);
                         returnObj[columnName] = paramValue.map(p => {
                             return new this(params).cast(columnName.toString(), p, 'string', {
                                 allowNull: columnMetadata.allowNull,
@@ -177,10 +180,16 @@ export default class Params {
             return paramValue;
         }
         const integerRegexp = /^-?\d+$/;
+        // Plain decimal numeric string: optional sign, digits with an optional
+        // fractional part (or a bare fractional part), and an optional decimal
+        // exponent. Deliberately excludes hex/octal/binary literals and the
+        // "Infinity"/"NaN" keywords that `Number()` would otherwise accept.
+        const decimalNumberRegexp = /^-?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
         switch (expectedType) {
             case 'string':
                 if (typeof paramValue !== 'string')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                this.throwUnlessWithinLength(paramName, paramValue, opts);
                 if (opts?.enum && !opts.enum.includes(paramValue))
                     throw new ParamValidationError(paramName, ['did not match expected enum values']);
                 if (opts?.match)
@@ -191,6 +200,7 @@ export default class Params {
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 if (!integerRegexp.test(paramValue?.toString()))
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                this.throwUnlessWithinRange(paramName, BigInt(paramValue.toString()), opts);
                 return paramValue.toString();
             case 'boolean':
                 if ([true, 'true', 1, '1'].includes(paramValue))
@@ -254,25 +264,47 @@ export default class Params {
                 }
                 throw new ParamValidationError(paramName, [typeToError(expectedType)]);
             }
-            case 'integer':
+            case 'integer': {
                 if (typeof paramValue !== 'string' && typeof paramValue !== 'number')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 if (!integerRegexp.test(paramValue?.toString()))
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
-                return parseInt(paramValue, 10);
+                const integerValue = parseInt(paramValue, 10);
+                // Reject values outside the safe-integer range: a long digit string
+                // (e.g. a 40-digit number) would otherwise be silently rounded to a
+                // nearby float by parseInt. Genuinely large integers should be cast as
+                // `bigint`, which preserves the exact value as a string.
+                if (!Number.isSafeInteger(integerValue))
+                    throw new ParamValidationError(paramName, [
+                        'expected an integer within the safe integer range (use bigint for larger values)',
+                    ]);
+                this.throwUnlessWithinRange(paramName, integerValue, opts);
+                return integerValue;
+            }
             case 'json':
                 if (typeof paramValue !== 'object')
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
                 return paramValue;
-            case 'number':
-                if (typeof paramValue === 'number')
+            case 'number': {
+                if (typeof paramValue === 'number') {
+                    if (!Number.isFinite(paramValue))
+                        throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+                    this.throwUnlessWithinRange(paramName, paramValue, opts);
                     return paramValue;
+                }
                 if (typeof paramValue === 'string') {
-                    if (paramValue.length === 0 || Number.isNaN(Number(paramValue)))
+                    // Require a plain decimal numeric string and a finite result. This
+                    // rejects hex/octal/binary forms ("0x10"), the literals "Infinity"/
+                    // "NaN", and magnitudes that overflow to Infinity ("1e999"), all of
+                    // which `Number()` would otherwise silently coerce.
+                    const numberValue = Number(paramValue);
+                    if (!decimalNumberRegexp.test(paramValue) || !Number.isFinite(numberValue))
                         throw new ParamValidationError(paramName, [typeToError(expectedType)]);
-                    return Number(paramValue);
+                    this.throwUnlessWithinRange(paramName, numberValue, opts);
+                    return numberValue;
                 }
                 throw new ParamValidationError(paramName, [typeToError(expectedType)]);
+            }
             case 'null':
                 if (paramValue !== null)
                     throw new ParamValidationError(paramName, [typeToError(expectedType)]);
@@ -352,6 +384,45 @@ export default class Params {
             return paramValue;
         throw new ParamValidationError(paramName, [typeToError(expectedType)]);
     }
+    /**
+     * Enforces `minLength`/`maxLength` (inclusive) against an already-coerced
+     * string value, throwing {@link ParamValidationError} on violation. Mirrors
+     * JSON-schema / OpenAPI string-length constraints.
+     */
+    throwUnlessWithinLength(paramName, paramValue, opts) {
+        if (opts?.minLength !== undefined && paramValue.length < opts.minLength)
+            throw new ParamValidationError(paramName, [
+                `expected string with length no less than ${opts.minLength}`,
+            ]);
+        if (opts?.maxLength !== undefined && paramValue.length > opts.maxLength)
+            throw new ParamValidationError(paramName, [
+                `expected string with length no greater than ${opts.maxLength}`,
+            ]);
+    }
+    /**
+     * Enforces `minimum`/`maximum` (inclusive) against an already-coerced numeric
+     * value, throwing {@link ParamValidationError} on violation. Accepts a
+     * `bigint` so `bigint` casts are checked without precision loss; the bounds
+     * themselves are compared as `bigint` when they are integers and otherwise
+     * fall back to floating-point comparison. Mirrors JSON-schema / OpenAPI
+     * numeric-range constraints.
+     */
+    throwUnlessWithinRange(paramName, paramValue, opts) {
+        if (opts?.minimum !== undefined && this.isBelowNumericBound(paramValue, opts.minimum))
+            throw new ParamValidationError(paramName, [`expected a value no less than ${opts.minimum}`]);
+        if (opts?.maximum !== undefined && this.isAboveNumericBound(paramValue, opts.maximum))
+            throw new ParamValidationError(paramName, [`expected a value no greater than ${opts.maximum}`]);
+    }
+    isBelowNumericBound(value, bound) {
+        if (typeof value === 'bigint')
+            return Number.isInteger(bound) ? value < BigInt(bound) : Number(value) < bound;
+        return value < bound;
+    }
+    isAboveNumericBound(value, bound) {
+        if (typeof value === 'bigint')
+            return Number.isInteger(bound) ? value > BigInt(bound) : Number(value) > bound;
+        return value > bound;
+    }
     throwUnlessAllowNull(paramName, paramValue, message, { allowNull = false } = {}) {
         const isNullOrUndefined = [null, undefined].includes(paramValue);
         if (allowNull && isNullOrUndefined)

package/dist/types/src/bin/helpers/OpenApiSpecDiff.d.ts

@@ -96,9 +96,13 @@ export declare class OpenApiSpecDiff {
     private createTempFilePath;
     /**
      * Retrieves head branch content for a file
+     *
+     * Marked `protected` so tests can supply a deterministic baseline instead of
+     * the live head branch. Production code never overrides this.
+     *
      * @param absoluteFilePath - Absolute path to the file
      */
-    private getHeadBranchContent;
+    protected getHeadBranchContent(absoluteFilePath: string): string;
     /**
      * Compares a single OpenAPI file against head branch
      */

package/dist/types/src/openapi-renderer/body-segment.d.ts

@@ -56,6 +56,7 @@ export default class OpenapiSegmentExpander {
     private bodySegment;
     private casing;
     private suppressResponseEnums;
+    private legacyImplicitRequestBodyParams;
     private target;
     private source;
     /**

package/dist/types/src/openapi-renderer/endpoint.d.ts

@@ -11,6 +11,7 @@ import { OpenapiBodySegment, ReferencedSerializersAndOpenapiEndpointResponse, Se
 export interface OpenapiRenderOpts {
     casing: SerializerCasing;
     suppressResponseEnums: boolean;
+    legacyImplicitRequestBodyParams: boolean;
 }
 export interface ToPathObjectOpts {
     openapiName: string;

package/dist/types/src/openapi-renderer/helpers/buildDreamRequestBodyShape.d.ts

@@ -6,6 +6,13 @@ export interface BuildDreamRequestBodyShapeOpts {
     including?: readonly string[] | undefined;
     required?: readonly string[] | undefined;
     combining?: Record<string, unknown> | undefined;
+    /**
+     * When true, restores the legacy behavior of resolving to ALL param-safe
+     * columns when no `params`/`only` are provided. When false/undefined (the
+     * default), an absent `params`/`only` resolves to NO model columns, so that
+     * database-level structure is not implicitly leaked into the OpenAPI shape.
+     */
+    legacyImplicitRequestBodyParams?: boolean | undefined;
 }
 /**
  * @internal

package/dist/types/src/openapi-renderer/helpers/legacyImplicitRequestBodyParamsConfig.d.ts

@@ -0,0 +1,6 @@
+/**
+ * returns whether the named openapi config opts in to the legacy behavior of
+ * implicitly exposing all param-safe columns when a model-derived request body
+ * is given no `params`/`only`.
+ */
+export default function legacyImplicitRequestBodyParamsConfig(openapiName: string): boolean;

package/dist/types/src/psychic-app/index.d.ts

@@ -125,6 +125,7 @@ export default class PsychicApp {
      * are not broken by a hard failure.
      *
      * @param encryptionIdentifier - currently must be 'cookies', though this may change in the future
+     * @param keyType - whether this is the 'current' or 'legacy' key (named in the error so a misconfigured legacy key is not mistaken for the current one)
      * @param key - the encryption key you want to check
      * @param algorithm - the encryption algorithm you want to check
      */
@@ -356,6 +357,29 @@ interface PsychicOpenapiBaseOptions {
      * ```
      */
     suppressResponseEnums?: boolean;
+    /**
+     * @deprecated escape hatch — prefer explicit `params`/`only` on each request body.
+     *
+     * When true, restores the legacy behavior where a model-derived `requestBody`
+     * (or nested `$dream`/`for:` segment) given no `params`/`only` implicitly
+     * exposes ALL param-safe columns of the model.
+     *
+     * As of 3.9.0 the default flipped: an absent `params`/`only` now resolves to
+     * NO model columns, so that database-level structure is not implicitly leaked
+     * into the OpenAPI shape (an attacker could otherwise infer the column set).
+     * A top-level model-derived `requestBody` with nothing to contribute is
+     * omitted entirely; a nested `$dream`/`for:` segment renders an empty object.
+     *
+     * Set this to true to keep the pre-3.9.0 implicit-all behavior while you
+     * migrate to explicit allowlists.
+     *
+     * ```ts
+     * psy.set('openapi', {
+     *   legacyImplicitRequestBodyParams: true,
+     * })
+     * ```
+     */
+    legacyImplicitRequestBodyParams?: boolean;
     /**
      * When true, psychic will use the `openapi-typescript` package
      * to read this openapi.json file and create typescript interfaces

package/dist/types/src/server/params.d.ts

@@ -77,6 +77,23 @@ export default class Params {
     private validateOpenapiOrThrow;
     restrict(allowed: string[]): PsychicParamsDictionary;
     private matchRegexOrThrow;
+    /**
+     * Enforces `minLength`/`maxLength` (inclusive) against an already-coerced
+     * string value, throwing {@link ParamValidationError} on violation. Mirrors
+     * JSON-schema / OpenAPI string-length constraints.
+     */
+    private throwUnlessWithinLength;
+    /**
+     * Enforces `minimum`/`maximum` (inclusive) against an already-coerced numeric
+     * value, throwing {@link ParamValidationError} on violation. Accepts a
+     * `bigint` so `bigint` casts are checked without precision loss; the bounds
+     * themselves are compared as `bigint` when they are integers and otherwise
+     * fall back to floating-point comparison. Mirrors JSON-schema / OpenAPI
+     * numeric-range constraints.
+     */
+    private throwUnlessWithinRange;
+    private isBelowNumericBound;
+    private isAboveNumericBound;
     private throwUnlessAllowNull;
 }
 export type ValidatedReturnType<ExpectedType, OptsType> = ExpectedType extends RegExp ? string : ExpectedType extends 'string' ? OptsType extends {
@@ -113,6 +130,30 @@ export type ParamsCastOptions<EnumType> = {
     allowNull?: boolean;
     match?: RegExp;
     enum?: EnumType;
+    /**
+     * Maximum permitted string length (inclusive). Enforced after coercion for
+     * `string` casts (and element-wise for `string[]`). Mirrors JSON-schema /
+     * OpenAPI `maxLength`.
+     */
+    maxLength?: number;
+    /**
+     * Minimum permitted string length (inclusive). Enforced after coercion for
+     * `string` casts (and element-wise for `string[]`). Mirrors JSON-schema /
+     * OpenAPI `minLength`.
+     */
+    minLength?: number;
+    /**
+     * Minimum permitted numeric value (inclusive). Enforced after coercion for
+     * `number`/`integer`/`bigint` casts (and element-wise for their array
+     * variants). Mirrors JSON-schema / OpenAPI `minimum`.
+     */
+    minimum?: number;
+    /**
+     * Maximum permitted numeric value (inclusive). Enforced after coercion for
+     * `number`/`integer`/`bigint` casts (and element-wise for their array
+     * variants). Mirrors JSON-schema / OpenAPI `maximum`.
+     */
+    maximum?: number;
 };
 interface ParamsForOptsBase<OnlyArray> {
     array?: boolean;

package/package.json

@@ -2,7 +2,7 @@
   "type": "module",
   "name": "@rvoh/psychic",
   "description": "Typescript web framework",
-  "version": "3.8.6",
+  "version": "3.10.0",
   "author": "RVOHealth",
   "publishConfig": {
     "access": "public"