exisjs 0.9.0 → 0.9.2

package/dist/validator/rules.js

@@ -4,28 +4,64 @@
 // A rule string such as "string? | min:3 | trim" is parsed once, when the
 // schema is built, into a tree of small check functions. Validating a request
 // is then a plain walk over the data with no parsing and no allocation beyond
-// the result object. Error messages keep the established wording
-// ("Missing required field: x", "Field 'x' must be ...") which TexEngine maps
-// to structured error codes.
+// the result object.
+//
+// The rule string describes the type and its modifiers. Everything a string
+// cannot hold (sanitizer and refinement functions, default values, nested
+// schemas' own options) comes from the schema object the rule was built from,
+// passed alongside as `raw`, so nested fields behave exactly like top-level
+// ones.
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.EMAIL = exports.RuleError = void 0;
-exports.toLegacyError = toLegacyError;
+exports.EMAIL = exports.PATTERN_FAILED = exports.RuleError = void 0;
+exports.formatPath = formatPath;
+exports.prefixErrors = prefixErrors;
+exports.ruleParts = ruleParts;
+exports.ruleBase = ruleBase;
+exports.parseEnumValues = parseEnumValues;
+exports.formatEnumValues = formatEnumValues;
+exports.parseLiteral = parseLiteral;
+exports.refinementMessage = refinementMessage;
 exports.compileRule = compileRule;
+exports.resolveDefault = resolveDefault;
+exports.compileFields = compileFields;
 exports.compileObject = compileObject;
 exports.compileSchema = compileSchema;
+exports.coerceBoolean = coerceBoolean;
+exports.enumLabel = enumLabel;
 exports.parseJsonString = parseJsonString;
 exports.normalizeArrayInput = normalizeArrayInput;
+exports.coerceArrayInput = coerceArrayInput;
 exports.dedupeItems = dedupeItems;
 const text_1 = require("./text");
+const error_1 = require("./error");
 // Thrown by checks. The failing field's path is collected while the error
-// unwinds through containers, so valid input never builds path strings.
-class RuleError extends Error {
-    constructor(kind, detail) {
-        super(detail);
+// unwinds through containers, so valid input never builds path strings. It
+// is not an Error: a failed request should not pay for a stack trace.
+class RuleError {
+    constructor(kind, detail, 
+    /** Error code, when the constraint text alone does not determine it */
+    code, expected) {
         this.kind = kind;
         this.detail = detail;
+        this.code = code;
+        this.expected = expected;
         this.path = [];
     }
+    /** The established message format ("Field 'x' must be ...") */
+    get message() {
+        const path = formatPath(this.path);
+        switch (this.kind) {
+            case 'missing':
+                return `Missing required field: ${path}`;
+            case 'strict':
+                return `Strict mode error: Unknown field '${this.detail}' at path '${path}'`;
+            case 'input':
+            case 'custom':
+                return this.detail;
+            default:
+                return `Field '${path}' ${this.detail}`;
+        }
+    }
 }
 exports.RuleError = RuleError;
 function formatPath(segments) {
@@ -38,23 +74,26 @@ function formatPath(segments) {
     }
     return out;
 }
-// Keeps the established message formats that TexEngine maps to error codes
-function toLegacyError(err) {
-    const path = formatPath(err.path);
-    switch (err.kind) {
-        case 'missing':
-            return new Error(`Missing required field: ${path}`);
-        case 'strict':
-            return new Error(`Strict mode error: Unknown field '${err.detail}' at path '${path}'`);
-        case 'input':
-            return new Error(err.detail);
-        default:
-            return new Error(`Field '${path}' ${err.detail}`);
+/** Puts `segments` in front of every path in a nested schema's errors. */
+function prefixErrors(err, segments) {
+    const prefix = formatPath(segments);
+    if (prefix === '')
+        return;
+    for (const e of err.errors) {
+        const p = e.path;
+        e.path =
+            !p || p === 'root'
+                ? prefix
+                : p.startsWith('[')
+                    ? prefix + p
+                    : `${prefix}.${p}`;
     }
 }
 function prefixPath(err, segment) {
     if (err instanceof RuleError)
         err.path.unshift(segment);
+    else if (err instanceof error_1.ValidatorError)
+        prefixErrors(err, [segment]);
     throw err;
 }
 // ─── Rule string parsing ─────────────────────────────────────────────────────
@@ -103,8 +142,69 @@ function splitTopLevel(s, sep) {
         parts.push(tail);
     return parts;
 }
+/** A rule string split into its type and modifiers, nesting kept intact */
+function ruleParts(rule) {
+    return splitTopLevel(rule, '|');
+}
+/** The type part of a rule string: "string? | min:2" -> "string" */
+function ruleBase(rule) {
+    const base = splitTopLevel(rule, '|')[0];
+    return base.endsWith('?') ? base.slice(0, -1).trim() : base;
+}
+/** Values of an `enum:` rule: JSON when a value holds `,` `|` or spaces at an end. */
+function parseEnumValues(spec) {
+    if (spec.startsWith('[')) {
+        try {
+            const values = JSON.parse(spec);
+            if (Array.isArray(values))
+                return values.map(String);
+        }
+        catch {
+            // fall through to the plain list
+        }
+    }
+    return spec.split(',').map((v) => v.trim());
+}
+/** Encodes enum values for a rule string. */
+function formatEnumValues(values) {
+    const plain = values.every((v) => v !== '' && v === v.trim() && !/[,|"<>{}()[\]]/.test(v));
+    return plain ? values.join(',') : JSON.stringify(values);
+}
+/**
+ * The value of a `literal:` rule. The builder writes JSON, so `literal:42`
+ * is the number and `literal:"42"` the string; unquoted text that is not a
+ * number or boolean is a string, as in hand-written rules.
+ */
+function parseLiteral(spec) {
+    if (spec.startsWith('"')) {
+        try {
+            return JSON.parse(spec);
+        }
+        catch {
+            return spec;
+        }
+    }
+    if (spec === 'true')
+        return true;
+    if (spec === 'false')
+        return false;
+    if (spec.trim() !== '' && Number.isFinite(Number(spec)))
+        return Number(spec);
+    return spec;
+}
+function readPattern(arg) {
+    try {
+        const [source, flags] = JSON.parse(arg);
+        // g and y make test() stateful across calls
+        return new RegExp(source, String(flags ?? '').replace(/[gy]/g, ''));
+    }
+    catch {
+        return undefined;
+    }
+}
 function readModifiers(parts, field) {
     const m = {
+        int: false,
         coerce: false,
         dedupe: false,
         trim: false,
@@ -128,7 +228,7 @@ function readModifiers(parts, field) {
         if (colon !== -1) {
             const name = p.slice(0, colon);
             const arg = p.slice(colon + 1);
-            if (name === 'min' || name === 'max') {
+            if (name === 'min' || name === 'max' || name === 'length') {
                 const n = Number(arg);
                 if (arg.trim() !== '' && Number.isFinite(n))
                     m[name] = n;
@@ -140,8 +240,14 @@ function readModifiers(parts, field) {
                 if (Number.isInteger(n))
                     m.version = n;
             }
-            // minDate/maxDate/maxSize/mimeTypes are enforced by TexEngine and the
-            // upload middleware
+            else if (name === 'minDate' || name === 'maxDate')
+                m[name] = arg;
+            else if (name === 'pattern')
+                m.pattern = readPattern(arg);
+            else if (name === 'protocols') {
+                m.protocols = arg.split(',').map((s) => s.trim().toLowerCase());
+            }
+            // maxSize/mimeTypes are enforced by the upload middleware
             continue;
         }
         switch (p) {
@@ -155,6 +261,7 @@ function readModifiers(parts, field) {
                 field.optional = true;
                 field.nullable = true;
                 break;
+            case 'int':
             case 'coerce':
             case 'dedupe':
             case 'trim':
@@ -177,10 +284,99 @@ function readModifiers(parts, field) {
     }
     return m;
 }
-function compileRule(rule) {
+// ─── Schema objects next to the rule string ──────────────────────────────────
+// Duck-typed so this file does not import the builder classes.
+function isTexType(raw) {
+    return (raw != null && typeof raw._raw === 'string' && Array.isArray(raw.sanitizers));
+}
+function isEngine(raw) {
+    return raw != null && typeof raw.getCompiledSchema === 'function';
+}
+/** The object schema behind `raw`: an engine, or the inner engine of `.transform()` */
+function engineOf(raw) {
+    if (isEngine(raw))
+        return raw;
+    if (raw != null &&
+        isEngine(raw.inner) &&
+        typeof raw.transformFn === 'function') {
+        return raw.inner;
+    }
+    return undefined;
+}
+function isDiscriminatedUnion(raw) {
+    return (raw != null &&
+        typeof raw.discriminator === 'string' &&
+        typeof raw.parse === 'function');
+}
+function sanitizerCheck(fns) {
+    return (v) => {
+        for (const fn of fns) {
+            if (v === undefined || v === null)
+                return v;
+            try {
+                v = fn(v);
+            }
+            catch (err) {
+                throw new RuleError('custom', err?.message || 'Sanitization failed', 'SANITIZATION_FAILED', 'a value the sanitizer accepts');
+            }
+        }
+        return v;
+    };
+}
+function refinementMessage(r, value) {
+    return typeof r.message === 'function'
+        ? r.message(value)
+        : r.message || 'Invalid value';
+}
+function postCheck(refinements, transforms) {
+    return (v) => {
+        for (const r of refinements) {
+            if (!r.fn(v)) {
+                throw new RuleError('custom', refinementMessage(r, v), 'CUSTOM_VALIDATION', 'custom refinement rule');
+            }
+        }
+        for (const t of transforms)
+            v = t(v);
+        return v;
+    };
+}
+/** Adds the functions and default of the schema object to a compiled rule. */
+function attachRaw(field, raw) {
+    if (isTexType(raw)) {
+        if (raw.sanitizers.length > 0)
+            field.pre = sanitizerCheck(raw.sanitizers);
+        const sync = raw.refinements.filter((r) => !r.async);
+        if (sync.length > 0 || raw.transformations.length > 0) {
+            field.post = postCheck(sync, raw.transformations);
+        }
+        if (raw.defaultValue !== undefined) {
+            field.defaultRef = { value: raw.defaultValue };
+        }
+    }
+    else {
+        const objectCheck = engineOf(raw)?._objectCheck;
+        const transform = raw?.transformFn;
+        if (objectCheck && transform)
+            field.post = (v) => transform(objectCheck(v));
+        else if (objectCheck || transform)
+            field.post = objectCheck ?? transform;
+    }
+    const { pre, base, post } = field;
+    field.check =
+        pre && post
+            ? (v) => post(base(pre(v)))
+            : pre
+                ? (v) => base(pre(v))
+                : post
+                    ? (v) => post(base(v))
+                    : base;
+    return field;
+}
+function compileRule(rule, raw) {
     const field = {
         optional: false,
         nullable: false,
+        base: passThrough,
         check: passThrough,
         gen: { kind: 'pass' },
     };
@@ -188,12 +384,13 @@ function compileRule(rule) {
     // modifiers) using "||", so "number | coerce || email" is two rules
     const alternatives = splitTopLevel(rule, '||');
     if (alternatives.length > 1) {
-        const rules = alternatives.map(compileRule);
+        const options = raw?._options;
+        const rules = alternatives.map((a, i) => compileRule(a, options?.[i]));
         field.optional = rules.some((r) => r.optional);
         field.nullable = rules.some((r) => r.nullable);
-        field.check = unionCheck(rules);
+        field.base = unionCheck(rules);
         field.gen = undefined;
-        return field;
+        return attachRaw(field, raw);
     }
     const parts = splitTopLevel(rule, '|');
     let base = parts[0];
@@ -205,84 +402,122 @@ function compileRule(rule) {
     field.defaultValue = m.defaultValue;
     // "(a || b)?" groups a whole rule; compile the inside and keep its flags
     if (base.startsWith('(') && base.endsWith(')')) {
-        const inner = compileRule(base.slice(1, -1));
-        field.check = inner.check;
+        const inner = compileRule(base.slice(1, -1), { _options: raw?._options });
+        field.base = inner.check;
         field.gen = inner.gen;
         field.optional = field.optional || inner.optional;
         field.nullable = field.nullable || inner.nullable;
-        return field;
+        return attachRaw(field, raw);
+    }
+    if (isDiscriminatedUnion(raw)) {
+        field.base = (v) => raw.parse(parseJsonString(v, '{', '}'));
+        field.gen = undefined;
     }
-    if (base.startsWith('object<') && base.endsWith('>')) {
-        const inner = parseObjectSchema(base.slice(7, -1));
-        field.check = objectCheck(inner);
-        if (inner)
-            field.gen = { kind: 'object', schema: inner };
+    else if (base.startsWith('object<') && base.endsWith('>')) {
+        const engine = engineOf(raw);
+        const schema = engine
+            ? engine.getCompiledSchema()
+            : parseObjectSchema(base.slice(7, -1));
+        const strict = engine ? Boolean(engine.strict) : false;
+        const rawSchema = engine?.rawSchema;
+        field.base = objectCheck(schema, strict, rawSchema);
+        field.gen = schema
+            ? { kind: 'object', schema, raw: rawSchema, strict }
+            : { kind: 'pass' };
     }
     else if (base.startsWith('array<') && base.endsWith('>')) {
-        const item = compileRule(base.slice(6, -1));
-        field.check = arrayCheck(item, m);
+        let inner = base.slice(6, -1);
+        // Comma-split query values are strings; their items convert with the array
+        if (m.coerce && /^(number|boolean)\b/.test(inner))
+            inner += ' | coerce';
+        const item = compileRule(inner, raw?._item);
+        field.base = arrayCheck(item, m);
         field.gen = { kind: 'array', item, m };
     }
     else if (base.startsWith('record<') && base.endsWith('>')) {
-        field.check = recordCheck(compileRule(base.slice(7, -1)));
+        field.base = recordCheck(compileRule(base.slice(7, -1), raw?._value));
         field.gen = undefined;
     }
     else if (base.startsWith('enum:')) {
-        const values = base
-            .slice(5)
-            .split(',')
-            .map((v) => v.trim());
-        field.check = enumCheck(values);
+        const values = parseEnumValues(base.slice(5));
+        field.base = enumCheck(values);
         field.gen = { kind: 'enum', values };
     }
     else if (base.startsWith('literal:')) {
-        field.check = literalCheck(base.slice(8));
+        field.base = literalCheck(parseLiteral(base.slice(8)));
         field.gen = undefined;
     }
     else {
+        field.gen = undefined;
         switch (base) {
             case 'string':
-                field.check = stringCheck(m);
+                field.base = stringCheck(m);
                 field.gen = { kind: 'string', m };
                 break;
             case 'number':
-                field.check = numberCheck(m);
+                field.base = numberCheck(m);
                 field.gen = { kind: 'number', m };
                 break;
             case 'boolean':
-                field.check = booleanCheck(m);
+                field.base = booleanCheck(m);
                 field.gen = { kind: 'boolean', m };
                 break;
             case 'email':
-                field.check = emailCheck(m);
+                field.base = emailCheck(m);
                 field.gen = { kind: 'email', m };
                 break;
+            case 'url':
+                field.base = urlCheck(m);
+                break;
+            case 'date':
+                field.base = dateCheck(m);
+                break;
             case 'password':
-                field.check = passwordCheck(m);
-                field.gen = undefined;
+                field.base = passwordCheck(m);
                 break;
             case 'uuid':
-                field.check = uuidCheck(m.version);
-                field.gen = undefined;
+                field.base = uuidCheck(m.version);
                 break;
             case 'cuid':
-                field.check = patternCheck(CUID, 'must be a valid CUID');
-                field.gen = undefined;
+                field.base = patternCheck(CUID, 'must be a valid CUID');
                 break;
             case 'creditcard':
-                field.check = creditCardCheck(m);
-                field.gen = undefined;
+                field.base = creditCardCheck(m);
                 break;
-            // date is validated by TexEngine; file by the upload middleware
+            // any; file is validated by the upload middleware
             default:
-                field.check = passThrough;
+                field.base = passThrough;
+                field.gen = { kind: 'pass' };
         }
     }
-    return field;
+    return attachRaw(field, raw);
 }
-function compileObject(schema, strict) {
+/** Default values that are objects are copied, so parses never share them */
+function resolveDefault(value) {
+    if (typeof value === 'function')
+        return value();
+    if (value !== null && typeof value === 'object' && !(value instanceof Date)) {
+        try {
+            return structuredClone(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    return value;
+}
+// Query strings and path params are text; number and boolean fields convert
+function withQueryCoercion(rule) {
+    return /^(number|boolean)\b/.test(rule) && !rule.includes('||')
+        ? `${rule} | coerce`
+        : rule;
+}
+function compileFields(schema, raw, query = false) {
+    return Object.keys(schema).map((k) => compileRule(query ? withQueryCoercion(schema[k]) : schema[k], raw?.[k]));
+}
+function compileObject(schema, strict, raw, query = false) {
     const keys = Object.keys(schema);
-    const fields = keys.map((k) => compileRule(schema[k]));
+    const fields = compileFields(schema, raw, query);
     const known = new Set(keys);
     return (obj) => {
         if (strict) {
@@ -298,22 +533,32 @@ function compileObject(schema, strict) {
                 const key = keys[i];
                 const field = fields[i];
                 let value = obj[key];
+                // A blank form field counts as left out (or null when only nullable)
+                if ((field.optional || field.nullable) &&
+                    typeof value === 'string' &&
+                    value.trim() === '') {
+                    value = field.nullable && !field.optional ? null : undefined;
+                }
+                if (value === undefined || (value === null && !field.nullable)) {
+                    if (field.defaultRef)
+                        value = resolveDefault(field.defaultRef.value);
+                    else if (field.defaultValue !== undefined)
+                        value = field.defaultValue;
+                }
+                if (field.pre && value !== undefined && value !== null) {
+                    value = field.pre(value);
+                }
                 if (value === undefined || value === null) {
                     if (value === null && field.nullable) {
                         out[key] = null;
                         continue;
                     }
-                    if (field.defaultValue !== undefined) {
-                        value = field.defaultValue;
-                    }
-                    else if (!field.optional) {
+                    if (!field.optional)
                         throw new RuleError('missing', '');
-                    }
-                    else {
-                        continue;
-                    }
+                    continue;
                 }
-                out[key] = field.check(value);
+                value = field.base(value);
+                out[key] = field.post ? field.post(value) : value;
             }
         }
         catch (err) {
@@ -323,24 +568,19 @@ function compileObject(schema, strict) {
     };
 }
 /** Builds the top-level validator TexEngine calls for every parse */
-function compileSchema(schema, strict) {
-    const validate = compileObject(schema, strict);
+function compileSchema(schema, strict, raw, query = false) {
+    const validate = compileObject(schema, strict, raw, query);
     return (data) => {
         if (data === null || typeof data !== 'object' || Array.isArray(data)) {
             throw new RuleError('input', 'Input must be a JSON object');
         }
-        try {
-            return validate(data);
-        }
-        catch (err) {
-            throw err instanceof RuleError ? toLegacyError(err) : err;
-        }
+        return validate(data);
     };
 }
 // ─── Field checks ────────────────────────────────────────────────────────────
 const passThrough = (value) => value;
-function fail(constraint) {
-    throw new RuleError('field', constraint);
+function fail(constraint, code, expected) {
+    throw new RuleError('field', constraint, code, expected);
 }
 function nullableCheck(rule) {
     return rule.nullable ? (v) => (v === null ? null : rule.check(v)) : rule.check;
@@ -367,6 +607,21 @@ function applyTextModifiers(s, m) {
     }
     return s;
 }
+exports.PATTERN_FAILED = 'must match the required format';
+function checkLength(s, m) {
+    if (m.min !== undefined && s.length < m.min) {
+        fail(`must be at least ${m.min} characters`);
+    }
+    if (m.max !== undefined && s.length > m.max) {
+        fail(`must be at most ${m.max} characters`);
+    }
+    if (m.length !== undefined && s.length !== m.length) {
+        fail(`must be exactly ${m.length} characters`, 'INVALID_LENGTH');
+    }
+    if (m.pattern !== undefined && !m.pattern.test(s)) {
+        fail(exports.PATTERN_FAILED, 'INVALID_FORMAT', `match ${m.pattern}`);
+    }
+}
 function stringCheck(m) {
     return (v) => {
         if (m.coerce && (typeof v === 'number' || typeof v === 'boolean')) {
@@ -374,16 +629,9 @@ function stringCheck(m) {
         }
         if (typeof v !== 'string')
             fail('must be a string');
-        let s = applyTextModifiers(v, m);
-        if (m.mask)
-            s = (0, text_1.maskString)(s);
-        if (m.min !== undefined && s.length < m.min) {
-            fail(`must be at least ${m.min} characters`);
-        }
-        if (m.max !== undefined && s.length > m.max) {
-            fail(`must be at most ${m.max} characters`);
-        }
-        return s;
+        const s = applyTextModifiers(v, m);
+        checkLength(s, m);
+        return m.mask ? (0, text_1.maskString)(s) : s;
     };
 }
 function numberCheck(m) {
@@ -396,6 +644,9 @@ function numberCheck(m) {
         if (typeof v !== 'number' || !Number.isFinite(v)) {
             fail('must be a number');
         }
+        if (m.int && !Number.isInteger(v)) {
+            fail('must be an integer', 'INVALID_TYPE', 'integer');
+        }
         if (m.min !== undefined && v < m.min)
             fail(`must be >= ${m.min}`);
         if (m.max !== undefined && v > m.max)
@@ -403,14 +654,26 @@ function numberCheck(m) {
         return v;
     };
 }
+/** "true" / "1" / 1 and "false" / "0" / 0, ignoring case and surrounding spaces */
+function coerceBoolean(v) {
+    if (typeof v === 'string') {
+        const s = v.trim().toLowerCase();
+        if (s === 'true' || s === '1')
+            return true;
+        if (s === 'false' || s === '0')
+            return false;
+        return v;
+    }
+    if (v === 1)
+        return true;
+    if (v === 0)
+        return false;
+    return v;
+}
 function booleanCheck(m) {
     return (v) => {
-        if (m.coerce) {
-            if (v === 'true' || v === '1' || v === 1)
-                v = true;
-            else if (v === 'false' || v === '0' || v === 0)
-                v = false;
-        }
+        if (m.coerce)
+            v = coerceBoolean(v);
         if (typeof v !== 'boolean')
             fail('must be a boolean');
         return v;
@@ -433,6 +696,61 @@ function emailCheck(m) {
         return s;
     };
 }
+function urlCheck(m) {
+    const protocols = new Set((m.protocols ?? ['http', 'https']).map((p) => `${p.replace(/:$/, '')}:`));
+    const allowed = [...protocols].map((p) => p.slice(0, -1)).join(', ');
+    return (v) => {
+        if (typeof v !== 'string')
+            fail('must be a string');
+        const s = m.trim ? v.trim() : v;
+        let url;
+        try {
+            url = new URL(s);
+        }
+        catch {
+            return fail('must be a valid URL', 'INVALID_URL', 'absolute URL');
+        }
+        if (!protocols.has(url.protocol)) {
+            fail(`must use ${allowed}`, 'INVALID_URL', `${allowed} URL`);
+        }
+        if ((url.protocol === 'http:' || url.protocol === 'https:') &&
+            !url.hostname) {
+            fail('must be a valid URL', 'INVALID_URL', 'absolute URL');
+        }
+        checkLength(s, m);
+        return s;
+    };
+}
+/**
+ * Accepts a Date, or a date string or timestamp, and always returns a Date
+ * (JSON has no date type, so a body always sends text). `coerce` is accepted
+ * for compatibility and changes nothing.
+ */
+function dateCheck(m) {
+    const min = m.minDate !== undefined ? new Date(m.minDate).getTime() : NaN;
+    const max = m.maxDate !== undefined ? new Date(m.maxDate).getTime() : NaN;
+    return (v) => {
+        const isText = typeof v === 'string' || typeof v === 'number';
+        if (!isText && !(v instanceof Date)) {
+            fail('must be a valid date', 'INVALID_TYPE', 'valid date or date string');
+        }
+        const time = v instanceof Date
+            ? v.getTime()
+            : typeof v === 'string' && v.trim() === ''
+                ? NaN
+                : new Date(v).getTime();
+        if (Number.isNaN(time)) {
+            fail('must be a valid date', 'INVALID_DATE', 'valid date string or timestamp');
+        }
+        if (time < min) {
+            fail(`date must be after ${m.minDate}`, 'DATE_TOO_EARLY', `>= ${m.minDate}`);
+        }
+        if (time > max) {
+            fail(`date must be before ${m.maxDate}`, 'DATE_TOO_LATE', `<= ${m.maxDate}`);
+        }
+        return v instanceof Date ? v : new Date(time);
+    };
+}
 function passwordCheck(m) {
     return (v) => {
         if (typeof v !== 'string')
@@ -458,9 +776,12 @@ function passwordCheck(m) {
         return v;
     };
 }
+function enumLabel(values) {
+    return `[${values.map((v) => JSON.stringify(v)).join(', ')}]`;
+}
 function enumCheck(values) {
     const allowed = new Set(values);
-    const label = `[${values.map((v) => JSON.stringify(v)).join(', ')}]`;
+    const label = enumLabel(values);
     return (v) => {
         if (typeof v !== 'string')
             fail('must be a string');
@@ -469,16 +790,10 @@ function enumCheck(values) {
         return v;
     };
 }
-// A literal rule is text ("literal:42"), so compare the value's string form;
-// the value itself keeps its original type
 function literalCheck(literal) {
     return (v) => {
-        if ((typeof v !== 'string' &&
-            typeof v !== 'number' &&
-            typeof v !== 'boolean') ||
-            String(v) !== literal) {
+        if (v !== literal)
             fail(`must be exactly ${JSON.stringify(literal)}`);
-        }
         return v;
     };
 }
@@ -556,6 +871,15 @@ function normalizeArrayInput(v) {
         return [v];
     return v;
 }
+/** `coerce` arrays also accept "a,b,c" and a single value */
+function coerceArrayInput(v) {
+    const normalized = normalizeArrayInput(v);
+    if (Array.isArray(normalized))
+        return normalized;
+    if (typeof v === 'string')
+        return v.split(',').map((s) => s.trim());
+    return [v];
+}
 function dedupeItems(items) {
     const seen = new Set();
     return items.filter((x) => {
@@ -568,9 +892,10 @@ function dedupeItems(items) {
 }
 function arrayCheck(item, m) {
     const checkItem = nullableCheck(item);
+    const toArray = m.coerce ? coerceArrayInput : normalizeArrayInput;
     return (v) => {
         if (!Array.isArray(v))
-            v = normalizeArrayInput(v);
+            v = toArray(v);
         if (!Array.isArray(v))
             fail('must be an array');
         if (m.min !== undefined && v.length < m.min) {
@@ -604,10 +929,10 @@ function parseObjectSchema(innerJson) {
     }
     return null;
 }
-function objectCheck(schema) {
+function objectCheck(schema, strict, raw) {
     if (!schema)
         return passThrough;
-    const validate = compileObject(schema, false);
+    const validate = compileObject(schema, strict, raw);
     return (v) => {
         v = parseJsonString(v, '{', '}');
         if (v === null || typeof v !== 'object' || Array.isArray(v)) {
@@ -645,8 +970,9 @@ function unionCheck(options) {
                 return check(v);
             }
             catch (err) {
-                if (!(err instanceof RuleError))
+                if (!(err instanceof RuleError) && !(err instanceof error_1.ValidatorError)) {
                     throw err;
+                }
             }
         }
         return fail('must match one of the allowed types');