@constructive-io/coerce

@constructive-io/coerce

Coerce untrusted unknown values — JSON request bodies, database rows, Kubernetes specs, env strings — into narrow TypeScript types. Zero dependencies.

why?

Because every service ends up re-typing the same four functions inline, each subtly different:

// don't
const asString = (v: unknown) => (typeof v === 'string' && v ? v : null);
const asInteger = (v: unknown) => (typeof v === 'number' && Number.isInteger(v) ? v : null);

install

npm install @constructive-io/coerce

usage

Two families. as* is lenient and returns null; require* throws a labelled CoerceError.

import { asInteger, asOneOf, asString, requireString } from '@constructive-io/coerce';

const model = asString(body.model);                            // string | null
const attempt = asInteger(body.attempt);                       // number | null
const role = asOneOf(body.author_role, ['user', 'assistant']);  // 'user' | 'assistant' | null
const messageId = requireString(body.message_id, 'message_id'); // string, or throws

lenient	strict	accepts
asString	requireString	a non-empty, non-whitespace string
asNumber	requireNumber	a finite number
asInteger	requireInteger	an integer
asBoolean	requireBoolean	a boolean, or true/false, 1/0, yes/no, on/off, t/f, y/n
asStringArray	requireStringArray	an array whose every entry is a non-empty string
asStringList	requireStringList	an array, or a delimited string ('a, b')
asRecord	requireRecord	a plain object (not null, not an array)
asDate	requireDate	a valid Date, or a parseable date string
asIsoString	requireIsoString	a Date (serialised) or a string (verbatim)
asOneOf	requireOneOf	one of the given string literals

Then the text-carried and named shapes — what an env var, a query string or a header hands you:

lenient	strict	accepts
asNumeric	requireNumeric	a finite number, or a numeric string ('5')
asNumericInteger	requireNumericInteger	an integer, or an integral string ('5')
asNumberIn	requireNumberIn	a finite number within { min, max }, inclusive
asIntegerIn	requireIntegerIn	an integer within { min, max }, inclusive
asPort	requirePort	a port: an integer in 1..65535, from a number or a string
asBigInt	requireBigInt	a bigint, an integer, or a digit string
asBigIntString	requireBigIntString	the same, answered as canonical digits — the wire form of an int8
asUrl	requireUrl	an absolute URL — a scheme is required
asHostname	requireHostname	a hostname or IP address — no scheme, port or path
asEmail	requireEmail	an email address
asUuid	requireUuid	a canonical UUID
asDuration	requireDuration	milliseconds, or a suffixed duration ('30s', '5m', '2h', '1d', '1w')
asJson	requireJson	an object or array, or a string that parses to one

const port = asPort(process.env.PORT);   // 1..65535, or null
const ttl = asDuration('30s');           // 30000
const timeout = asIntegerIn(body.timeout_ms, { min: 1, max: 60_000 });

rules

• No guessing across types. '5' is not an integer to asInteger and 1 is not a string. A JSON body that sent a string meant a string; the coercers that do read text (asNumeric, asPort, asDuration, asBoolean, asDate, asJson) say so in their names, because an env var or a query string carries nothing else.
• A blank string is absent. '' and ' ' coerce to null, so an empty value can never read as a supplied identifier.
• All-or-nothing lists. asStringArray rejects the whole array rather than dropping bad entries — that is how a list of allowed origins quietly shrinks.
• No transport semantics. CoerceError carries the label that failed, not an HTTP status. Map it at your boundary:

try {
  return handle(requireString(body.message_id, 'message_id'));
} catch (err) {
  if (err instanceof CoerceError) throw new HttpError(400, err.message);
  throw err;
}

related

12factor-env coerces through this package: its port/url/host/email/uuid/duration/num/int/list/enumerated validators are these coercers wrapped in envalid specs, so a variable and a request body agree on what each shape accepts. On top it adds what is environment-only — schemas (cleanEnv), defaults, secret redaction, cross-field checks. Reach for 12factor-env when validating process.env at boot, and for this package when validating a value at runtime.

Education and Tutorials

• 🚀 Quickstart: Getting Up and Running Get started with modular databases in minutes. Install prerequisites and deploy your first module.

• 📦 Modular PostgreSQL Development with Database Packages Learn to organize PostgreSQL projects with pgpm workspaces and reusable database modules.

• ✏️ Authoring Database Changes Master the workflow for adding, organizing, and managing database changes with pgpm.

• 🧪 End-to-End PostgreSQL Testing with TypeScript Master end-to-end PostgreSQL testing with ephemeral databases, RLS testing, and CI/CD automation.

• ⚡ Supabase Testing Use TypeScript-first tools to test Supabase projects with realistic RLS, policies, and auth contexts.

• 💧 Drizzle ORM Testing Run full-stack tests with Drizzle ORM, including database setup, teardown, and RLS enforcement.

• 🔧 Troubleshooting Common issues and solutions for pgpm, PostgreSQL, and testing.

Related Constructive Tooling

📦 Package Management

• pgpm: 🖥️ PostgreSQL Package Manager for modular Postgres development. Works with database workspaces, scaffolding, migrations, seeding, and installing database packages.

🧪 Testing

• pgsql-test: 📊 Isolated testing environments with per-test transaction rollbacks—ideal for integration tests, complex migrations, and RLS simulation.
• pglite-test: 🪶 Drop-in pgsql-test replacement backed by PGlite — in-process Postgres, no server required, instance-per-suite isolation.
• pgsql-seed: 🌱 PostgreSQL seeding utilities for CSV, JSON, SQL data loading, and pgpm deployment.
• supabase-test: 🧪 Supabase-native test harness preconfigured for the local Supabase stack—per-test rollbacks, JWT/role context helpers, and CI/GitHub Actions ready.
• graphile-test: 🔐 Authentication mocking for Graphile-focused test helpers and emulating row-level security contexts.
• pg-query-context: 🔒 Session context injection to add session-local context (e.g., SET LOCAL) into queries—ideal for setting role, jwt.claims, and other session settings.

🧠 Parsing & AST

• pgsql-parser: 🔄 SQL conversion engine that interprets and converts PostgreSQL syntax.
• libpg-query-node: 🌉 Node.js bindings for libpg_query, converting SQL into parse trees.
• pg-proto-parser: 📦 Protobuf parser for parsing PostgreSQL Protocol Buffers definitions to generate TypeScript interfaces, utility functions, and JSON mappings for enums.
• @pgsql/enums: 🏷️ TypeScript enums for PostgreSQL AST for safe and ergonomic parsing logic.
• @pgsql/types: 📝 Type definitions for PostgreSQL AST nodes in TypeScript.
• @pgsql/utils: 🛠️ AST utilities for constructing and transforming PostgreSQL syntax trees.

📚 Documentation & Skills

• constructive-skills: 📖 Platform documentation and AI agent skills — feature catalog, blueprint reference, SDK guides (i18n, billing, limits, events, uploads, security, entities, search, AI), and deployment guides.

Install skills for AI coding agents:

# All platform skills (security, blueprints, codegen, billing, etc.)
npx skills add constructive-io/constructive-skills

# Individual repo skills (pgpm, testing, CLI, search, etc.)
npx skills add https://github.com/constructive-io/constructive --skill pgpm
npx skills add https://github.com/constructive-io/constructive --skill constructive-testing

Credits

🛠 Built by the Constructive team — creators of modular Postgres tooling for secure, composable backends. If you like our work, contribute on GitHub.

Disclaimer

AS DESCRIBED IN THE LICENSES, THE SOFTWARE IS PROVIDED "AS IS", AT YOUR OWN RISK, AND WITHOUT WARRANTIES OF ANY KIND.

No developer or entity involved in creating this software will be liable for any claims or damages whatsoever associated with your use, inability to use, or your interaction with other users of the code, including any direct, indirect, incidental, special, exemplary, punitive or consequential damages, or loss of profits, cryptocurrencies, tokens, or anything else of value.