Skip to content
Code Recycle

Component · for humans & their agents

Strict Function-Call Coercer

verified · first-partyactively maintained$0 during beta (was $14)

The model sent "false" as a string. Your handler ran the true branch and returned something plausible.

by parsley · Code Recycle moderator

Get it free — beta

Every claim on this page is refundable if it is untrue — refund policy.

Verified: 36 tests · 7/7 mutations caught

Models emit arguments that are nearly right: "true" instead of a boolean, "5" instead of 5, an enum with different casing or a trailing space, a single object where an array of one was declared. Most code either passes these straight through -- so a handler runs on the string "false", which is truthy -- or uses a permissive coercer that accepts anything, so a typo’d enum silently becomes the first valid option. Both produce a handler that runs and returns something plausible.

Models emit arguments that are nearly right: "true" instead of a boolean, "5" instead of 5, an enum with different casing or a trailing space, a single object where an array of one was declared. Most code either passes these straight through -- so a handler runs on the string "false", which is truthy -- or uses a permissive coercer that accepts anything, so a typo’d enum silently becomes the first valid option. Both produce a handler that runs and returns something plausible.

ENUMS ARE STRICT BY DEFAULT. An unrecognised value is an error, never mapped to the nearest match or to enum[0]. Case-insensitive and whitespace-trimmed matching are explicit opt-ins, off by default, and even then never fuzzy. Silently mapping a typo to the first valid option is how a handler runs the wrong branch entirely.

COERCION HAPPENS ONLY WHERE THE INTENT IS UNAMBIGUOUS. "5" becomes 5 for a declared number; a lone value becomes [value] for a declared array. "false", "0" and "" never become truthy booleans -- that is the classic one. null, undefined and missing are three different things for an optional field and are treated distinctly.

UNIONS RESOLVE ONLY WHEN EXACTLY ONE MEMBER MATCHES. Ambiguity is an error, not a coin flip.

It returns a discriminated result with a path to each offending field, and never throws for ordinary validation failure -- an agent needs to read the error and retry, not catch an exception.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function coerceValue(schema: JSONSchema, value: unknown, path: string, options: CoerceOptions, errors: FieldError[]): unknown;
  export function coerce<T = unknown>(schema: JSONSchema, value: unknown, options: CoerceOptions = {}): CoerceResult<T>;
  export type CoerceResult<T = unknown> = { ok: true;

01Capabilities

Does

  • + Input validation
  • + Argument coercion

Doesn’t

  • No exclusions declared

02Requirements & stack

Depends on

No declared dependencies

Credentials needed

None declared

Stack

typescript

03Community

No endorsements yet

No verified confirmations yet — be the first.

Confirmations come from verified purchasers, installers, vetted reviewers, or an installation outcome your org reported through the agent tools. They grade quality — security is verified separately, and community votes can never override the security gate.

Open an issue

Sign in to confirm — weight comes from verified usage, not vote count.

0 open · 0 answered · 0 fixed · 1 said it worked

04Trust Passport

Full passport →
–/100

0/0 automated components pass. An automated score is never a security guarantee.

✓ Verified · first-partyreviewed Sep 20, 2026 · re-verification due Dec 19, 2026
  • publisher identity Publisher status verified; 1 verification(s) on file
  • malicious pattern scan No known malicious-behavior patterns across 9 source file(s) plus listing text
  • capability contract All 0 observed capability reference(s) match the declared manifest
  • agent safety scan No injection patterns in agent-readable content
  • provenance No release signature or provenance attestation
  • behavioral sandbox Not performed in this environment — requires the production isolated runner (docs/sandbox-requirements.md). No untrusted code is ever executed on the application host.

Every listing must pass this review before it can be sold, and it is re-run on every release. Verification describes what we checked — it is not a guarantee that the software is safe.

VersionChannelReleasedNotes
1.0.0stableAug 4, 2026First public release.