fix(sources): make the nested non-finite guard real — capture Json pins as YAML, convert fallibly

Review finding on r3710042428: first_non_finite was dead code. By the
time it ran, serde_json's f64 visitor had already mapped a nested
.nan/.inf to Value::Null during the untagged Json variant's
deserialization (Number::from_f64(...).map_or(Value::Null, …) in
serde_json 1.0.150), so a nested non-finite silently pinned
{"threshold": null} — exactly the silent-null-at-query-time failure
the guard's own comment promised to prevent — and the guard's Some arm
was unreachable by construction.

FixedValueDoc::Json now captures serde_yaml::Value, where the
non-finite is still observable, and converts through a fallible
yaml_to_json that rejects everything JSON cannot spell: non-finite
floats at any depth, non-string mapping keys, and YAML tags (the last
already rejected upstream by serde's untagged buffering — pinned by a
test — and kept as defense in depth). first_non_finite is deleted;
into_fixed folds into the single convert_table match so no arm is
unreachable. Regression tests cover nested .nan in an object, .inf in
a nested list, a numeric mapping key, the tag rejection message, and
the pass side (nested finite floats/bools/nulls convert faithfully,
asserted on to_json output).

Also tightens the users cursor e2e per r3710042432: each request now
asserts its EXACT input key set ([pageSize] page 1,
[pageSize, startCursor] page 2), the same nothing-extra-on-the-wire
guard the search test applies.

Full suite: cargo test -p skardi --lib → 818 passed.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bakey

crates/skardi/src/sources/providers/open_connector/packs/loader.rs

@@ -106,19 +106,32 @@ fn convert_table(
         // YAML happily parses `.nan` / `.inf` / `-.inf`, but JSON has no
         // spelling for them — FixedValue::to_json would silently send null
         // at query time, bypassing the startup diagnostic this loader
-        // promises. Finite-only, enforced here.
-        let non_finite = match &value {
-            FixedValueDoc::Float(v) => (!v.is_finite()).then(|| v.to_string()),
-            FixedValueDoc::Json(v) => first_non_finite(v),
-            _ => None,
+        // promises. Finite-only, enforced here. The nested case CANNOT be
+        // checked after the fact on a `serde_json::Value`: serde_json's
+        // f64 visitor maps a non-finite to `Value::Null` during
+        // deserialization (`Number::from_f64(...).map_or(Value::Null, …)`),
+        // so the loss has already happened by then — which is why the
+        // `Json` variant captures `serde_yaml::Value` and converts here,
+        // where the non-finite is still observable.
+        let fixed = match value {
+            FixedValueDoc::Float(v) if !v.is_finite() => {
+                return Err(format!(
+                    "{id}: fixed input '{key}' contains {v}, which has no JSON \
+                     spelling; pin finite numbers only"
+                ));
+            }
+            FixedValueDoc::Bool(v) => FixedValue::Bool(v),
+            FixedValueDoc::Int(v) => FixedValue::Int(v),
+            FixedValueDoc::Float(v) => FixedValue::Float(v),
+            FixedValueDoc::Str(v) => FixedValue::Str(leak_str(v)),
+            FixedValueDoc::StrList(v) => FixedValue::StrList(leak_str_slice(v)),
+            FixedValueDoc::Json(v) => {
+                let json = yaml_to_json(v)
+                    .map_err(|reason| format!("{id}: fixed input '{key}' {reason}"))?;
+                FixedValue::Json(Box::leak(Box::new(json)))
+            }
         };
-        if let Some(shown) = non_finite {
-            return Err(format!(
-                "{id}: fixed input '{key}' contains {shown}, which has no JSON \
-                 spelling; pin finite numbers only"
-            ));
-        }
-        fixed_inputs.push((leak_str(key), value.into_fixed()));
+        fixed_inputs.push((leak_str(key), fixed));
     }
     let table = SourcePackTable {
         id,
@@ -337,21 +350,6 @@ fn convert_filter(doc: FilterDoc) -> FilterMapping {
     }
 }
 
-/// First non-finite float inside a JSON value, if any. serde_json parses
-/// no non-finite literals itself, but serde_yaml's `.nan`/`.inf` arrive
-/// through the untagged `Json` variant as f64s that `Number::from_f64`
-/// silently turns into null on write — the same trap as bare floats.
-fn first_non_finite(value: &serde_json::Value) -> Option<String> {
-    match value {
-        serde_json::Value::Number(n) => {
-            n.as_f64().filter(|f| !f.is_finite()).map(|f| f.to_string())
-        }
-        serde_json::Value::Array(items) => items.iter().find_map(first_non_finite),
-        serde_json::Value::Object(map) => map.values().find_map(first_non_finite),
-        _ => None,
-    }
-}
-
 fn leak_str(s: String) -> &'static str {
     Box::leak(s.into_boxed_str())
 }
@@ -510,22 +508,67 @@ enum FixedValueDoc {
     Str(String),
     StrList(Vec<String>),
     /// Object-shaped inputs (e.g. Notion's search `filter`). Captured as a
-    /// JSON value so nesting is unrestricted; converted with the same
-    /// finite-floats guard as the scalar variants.
-    Json(serde_json::Value),
+    /// YAML value — NOT `serde_json::Value`, whose f64 visitor converts a
+    /// nested `.nan`/`.inf` to `Value::Null` during deserialization,
+    /// destroying the evidence before any guard can run — and converted
+    /// fallibly by [`yaml_to_json`] at the call site, where non-finite
+    /// floats, non-string mapping keys, and YAML tags are rejected with
+    /// targeted messages.
+    Json(serde_yaml::Value),
 }
 
-impl FixedValueDoc {
-    fn into_fixed(self) -> FixedValue {
-        match self {
-            Self::Bool(v) => FixedValue::Bool(v),
-            Self::Int(v) => FixedValue::Int(v),
-            Self::Float(v) => FixedValue::Float(v),
-            Self::Str(v) => FixedValue::Str(leak_str(v)),
-            Self::StrList(v) => FixedValue::StrList(leak_str_slice(v)),
-            Self::Json(v) => FixedValue::Json(Box::leak(Box::new(v))),
+/// Convert a YAML value to JSON, rejecting everything JSON cannot spell:
+/// non-finite floats (`.nan` / `.inf` / `-.inf`, which `serde_json` would
+/// silently write as `null`), non-string mapping keys, and YAML tags. The
+/// error is a reason fragment; callers prefix the table/key identity.
+fn yaml_to_json(value: serde_yaml::Value) -> Result<serde_json::Value, String> {
+    use serde_yaml::Value as Yaml;
+    Ok(match value {
+        Yaml::Null => serde_json::Value::Null,
+        Yaml::Bool(b) => serde_json::Value::from(b),
+        Yaml::Number(n) => {
+            if let Some(i) = n.as_i64() {
+                serde_json::Value::from(i)
+            } else if let Some(u) = n.as_u64() {
+                serde_json::Value::from(u)
+            } else {
+                let f = n.as_f64().unwrap_or(f64::NAN);
+                if !f.is_finite() {
+                    return Err(format!(
+                        "contains {f}, which has no JSON spelling; pin finite numbers only"
+                    ));
+                }
+                serde_json::Value::from(f)
+            }
         }
-    }
+        Yaml::String(s) => serde_json::Value::from(s),
+        Yaml::Sequence(items) => serde_json::Value::Array(
+            items
+                .into_iter()
+                .map(yaml_to_json)
+                .collect::<Result<_, _>>()?,
+        ),
+        Yaml::Mapping(map) => {
+            let mut out = serde_json::Map::with_capacity(map.len());
+            for (k, v) in map {
+                let Yaml::String(k) = k else {
+                    return Err(
+                        "contains a non-string mapping key, which JSON cannot represent"
+                            .to_string(),
+                    );
+                };
+                out.insert(k, yaml_to_json(v)?);
+            }
+            serde_json::Value::Object(out)
+        }
+        // Unreachable through the untagged FixedValueDoc path (serde's
+        // untagged buffering rejects tags during deserialization, pinned by
+        // the loader test), kept as defense in depth for any future direct
+        // caller.
+        Yaml::Tagged(_) => {
+            return Err("contains a YAML tag, which JSON cannot represent".to_string());
+        }
+    })
 }
 
 #[derive(Deserialize)]
@@ -593,6 +636,43 @@ mod tests {
         }
     }
 
+    /// The pass side of the nested-value conversion: a finite nested float
+    /// (and the rest of the JSON scalar set) survives the YAML→JSON
+    /// conversion faithfully — proving the strict rejection above is a
+    /// guard, not a ban on nesting.
+    #[test]
+    fn nested_finite_values_in_a_json_pin_convert_faithfully() {
+        let pack = parse_pack(
+            r#"kind: pack
+pack: demo
+version: 1
+tables:
+  things:
+    action: demo.list
+    row_path: "$.items"
+    pagination: { strategy: page_number, page_input: page, page_size_input: perPage, page_size: 10 }
+    fixed_inputs:
+      filter:
+        threshold: 1.5
+        flags: [true, 2, "three"]
+        inner: { level: null }
+    columns:
+      - { name: id, path: id, type: uint64, nullable: false }
+"#,
+        )
+        .expect("nested finite values are legal");
+        let (key, value) = &pack.tables[0].fixed_inputs[0];
+        assert_eq!(*key, "filter");
+        assert_eq!(
+            value.to_json(),
+            serde_json::json!({
+                "threshold": 1.5,
+                "flags": [true, 2, "three"],
+                "inner": { "level": null }
+            })
+        );
+    }
+
     #[test]
     fn misspelled_keys_fail_loudly() {
         // deny_unknown_fields end to end: a typo'd pagination key must not
@@ -808,6 +888,62 @@ tables:
       - { name: id, path: id, type: uint64, nullable: false }"#,
                 "no JSON spelling",
             ),
+            // NESTED non-finites, through the untagged Json variant. These
+            // are the regression for the dead first_non_finite guard: a
+            // `serde_json::Value` capture had already converted the nested
+            // `.nan` to null before any check could run (serde_json's f64
+            // visitor maps non-finite to Value::Null), so the pin silently
+            // became `{"threshold": null}`. The YAML capture keeps the
+            // non-finite observable and the conversion rejects it.
+            (
+                r#"    action: demo.list
+    row_path: "$.items"
+    pagination: { strategy: page_number, page_input: page, page_size_input: perPage, page_size: 10 }
+    fixed_inputs:
+      filter:
+        threshold: .nan
+    columns:
+      - { name: id, path: id, type: uint64, nullable: false }"#,
+                "no JSON spelling",
+            ),
+            (
+                r#"    action: demo.list
+    row_path: "$.items"
+    pagination: { strategy: page_number, page_input: page, page_size_input: perPage, page_size: 10 }
+    fixed_inputs:
+      filter:
+        bounds: [1.5, .inf]
+    columns:
+      - { name: id, path: id, type: uint64, nullable: false }"#,
+                "no JSON spelling",
+            ),
+            // The other two YAML shapes JSON cannot spell, same variant.
+            (
+                r#"    action: demo.list
+    row_path: "$.items"
+    pagination: { strategy: page_number, page_input: page, page_size_input: perPage, page_size: 10 }
+    fixed_inputs:
+      filter:
+        1: numeric-key
+    columns:
+      - { name: id, path: id, type: uint64, nullable: false }"#,
+                "non-string mapping key",
+            ),
+            (
+                r#"    action: demo.list
+    row_path: "$.items"
+    pagination: { strategy: page_number, page_input: page, page_size_input: perPage, page_size: 10 }
+    fixed_inputs:
+      filter:
+        payload: !custom tagged
+    columns:
+      - { name: id, path: id, type: uint64, nullable: false }"#,
+                // Rejected before yaml_to_json ever runs: serde's untagged
+                // buffering cannot represent a YAML tag, so deserialization
+                // itself fails — the Tagged arm in yaml_to_json is defense
+                // in depth behind this.
+                "do not support enum input",
+            ),
             (
                 r#"    action: demo.list
     row_path: "$.items"

crates/skardi/src/sources/providers/open_connector/packs/notion.rs

@@ -511,10 +511,25 @@ bindings:
 
         let inputs = execute_inputs(&gateway);
         assert_eq!(inputs.len(), 2, "two cursor pages");
-        assert!(inputs[0].get("startCursor").is_none(), "{}", inputs[0]);
         assert_eq!(inputs[1]["startCursor"], "cur-2");
-        for input in &inputs {
+        for (page, (input, expected_keys)) in inputs
+            .iter()
+            .zip([vec!["pageSize"], vec!["pageSize", "startCursor"]])
+            .enumerate()
+        {
             assert_eq!(input["pageSize"], 100, "page-size hint: {input}");
+            // Exactly the declared inputs, nothing else — the same
+            // nothing-extra-on-the-wire guard the search test applies, so
+            // users' wire declaration is pinned in full, absence included
+            // (page 1 carries no cursor).
+            let mut keys: Vec<&str> = input
+                .as_object()
+                .expect("input object")
+                .keys()
+                .map(String::as_str)
+                .collect();
+            keys.sort_unstable();
+            assert_eq!(keys, expected_keys, "page {} input keys", page + 1);
         }
     }