Module request 

Pure request shaping for the write plane’s two intake surfaces.

Transport, authentication, project fencing, body limits, and response wrapping stay in each host. This module owns the shared path/body validation and returns either a host-neutral PublicSqlRequest or PublicSqlRejection. Functions that validate time-bearing identities take now_ms from the host; this module never reads a clock.

Two surfaces shape through here:

• the public /v1/sql/* routes (shape_public_sql_request), whose failures carry the typed public error plane; and
• the private deploy /migrate route (shape_deploy_migrations), whose failure currency is the plain 400 message both hosts already emitted. That route was left per-host by the original extraction (“shaping moves, dispatch stays” covered only /v1/sql/*), so each host grew its own parser over the same nine error strings; they live here once now.

Structs

DeployMigrationRequest

One private deploy migration after transport parsing. This is deliberately distinct from the public /v1/sql/migrate request (PublicSqlRequest::Migration): deploy migrations also admit data-only files and an operator-reviewed checksum override.

PublicSqlRejection

A transport-neutral public SQL parse/validation failure. The host supplies only its concrete HTTP response wrapper; status, typed code, retry scope, and transaction-state semantics are fixed here.

Enums

PublicReadConsistency

The read routing posture selected by the public request’s explicit or client-wide default.

PublicSqlRequest

A fully shaped request from the public SQL surface. Hosts map this value into their own dispatch currency; no transport-specific response or command type crosses this boundary.

Functions

shape_deploy_migrations

Shape the private /migrate body into its migrations plus whether the caller used the batch form.

shape_public_sql_request

Shape one public SQL path/body pair. None means the path is not a recognized public SQL route and lets the host preserve its ordinary 404 behavior.

take_changes

Move a validated changes array out of a parsed request body without cloning its Value tree. Non-array and absent fields preserve the existing empty-vector fallback.