feat(core): wire parsers for the remaining spec'd endpoints, and strict element keys

[cuibonobo]

Summary

Closes #354.

Wire parsers. Every endpoint core specifies now has a parser in @haverstack/core/wire. A server no longer needs its own copies of core's param and field names (as in haverstack/server#130's knownParams() / readJson() lists).

Endpoint	Parser
POST /auth/challenge	parseAuthChallengeBody()
POST /auth/token	parseAuthTokenBody()
PATCH /entity	parseEntityPatchBody()
POST /types	parseTypeBody()
POST /records/:id/migrate	parseMigrationBody()
DELETE /records/:id	parseDeleteParams()
GET /attachments/:fileId	parseDownloadParams()
GET /records/:id/associations	parseAssociationParams()

Each parser answers bad input the way POST /records already does:

• 400: an unknown name, a malformed boolean, a repeated single-value param, or a missing required field.
• 422, with the field's path: a known field whose value has the wrong type.

The body parsers live in a new wire-body.ts, which also holds the helpers wire-record.ts now imports from it.

Element keys. Stack now refuses a key that an element's kind does not define, with a 400. This covers association, permission, relationship-target and grant-target elements, at every depth. It applies to:

• create(), mutate(), associate(), dissociate(), grantAccess(), revokeAccess()
• relatedTo filter targets
• grantType(), revokeType(), listTypeGrants()

A _grant record's grantee is held to the same keys and refused as content with a 422. The key tables are typed against each union arm, so adding a field to an arm fails to compile until the field is listed.

Spec

• docs/spec/wire-format.md § Unrecognized input: a table matching each endpoint to its parser, the 400/422 split, and element keys added to "at every depth".
• docs/spec/wire-format.md § Types: baseId, version, schemaHash and createdAt are accepted and ignored.
• docs/spec/data-model.md § Associations: an element carries only the keys its kind defines.
• New error fixtures: error-bad-request-non-boolean-purge, error-bad-request-unknown-auth-token-key and error-bad-request-unknown-grantee-key.

Verification

All six checks pass locally: pnpm run format:check, check:refs, lint, test, build and typecheck.

• New tests: packages/core/tests/wire-body.test.ts and element-keys.test.ts, plus additions to wire-request.test.ts.
• One test turns a whole StackType into JSON the way APIAdapter.saveType() sends it and runs it through parseTypeBody().
• Another checks that a malformed schema still gets to defineType() and comes back as a 422.

Notes for reviewers

• schemaHash: POST /types accepts and ignores schemaHash, which the issue didn't list. APIAdapter.saveType() sends the whole Type, so refusing it would break every client.
• Why refusing element keys on write strands nothing: the SQLite adapters already dropped these keys, because they only store keys they have a column for. MemoryAdapter kept them, so the two adapters disagreed about the same write, and this removes that disagreement. There's also no install base. The one cost: a foreign export whose elements carry extension fields is now refused on import, where it used to lose those fields silently.
• Auth endpoints: a malformed body on the handshake endpoints now gets bad_request or validation. invalid_did still covers a string that isn't a verifiable DID.

🤖 Generated with Claude Code

https://claude.ai/code/session_014ah52eTkayJ1JxPuEmgVGe

---

Generated by Claude Code

[changeset-bot]

🦋 Changeset detected

Latest commit: 73e98de

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@haverstack/core	Minor
@haverstack/conformance-fixtures	Minor
@haverstack/adapter-api	Patch
@haverstack/adapter-conformance	Patch
@haverstack/adapter-local	Patch
@haverstack/blob-adapter-disk	Patch
@haverstack/blob-adapter-s3	Patch
@haverstack/commons	Patch
@haverstack/record-adapter-do-sqlite	Patch
@haverstack/record-adapter-sqlite	Patch
@haverstack/wire-types	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR