feat!: compile-time wire-string check; always-decoded params/query args

[christensena]

Closes #2.

Path and query values reach the server as raw strings, so a bare z.number() or z.boolean() in a params/query schema type-checks but fails validation with a 400 on every request (verified against the real stack: no coercion layer anywhere in @hono/zod-openapi). This PR makes route() reject such schemas at compile time and splits the client's request IO: params/query/headers are always decoded values, while encodeRequests governs only the body.

Compile-time wire-string check (@zodapi/hono)

• WireCheck type in route() — alongside the existing params/path key check: errors unless each params/query value schema's z.input admits a string (or readonly string[], for repeated query keys). Both checks now report through a conditional parameter type (ValidatedRouteConfig<R>): on failure the expected type collapses to just the error object — a one-line message naming the offending keys and the fix — instead of dumping the whole zod-typed config twice. Enums, z.string(), z.stringbool(), z.coerce.number() (input unknown, passes unchecked), queryArray(z.string()), and non-literal-key shapes (looseObject) pass; bare z.number(), z.boolean(), z.number().optional(), and z.array(z.number()) are rejected with an error-shaped type naming the keys and the fix. Type-level only — no runtime behavior change.
• Idiom: plain z.coerce.number() / z.stringbool() — no type argument. z.coerce.number<number>() narrows the declared input to number, making it structurally identical to z.number() in zod's typings, so the check rejects it too (covered by its own type test). Since client args are typed from z.output (below), the input type never leaks into client code.
• Docs — JSDoc on route() and queryArray(), plus a "Params and query are strings on the wire" README section covering the z.coerce.boolean() truthiness trap ("false" → true); the example API demonstrates z.stringbool() and coerced numeric ids/limits end to end.

Split request IO (@zodapi/client)

• Params, query, and headers are always supplied decoded — the transport turns them into strings regardless, so callers pass natural types (number for a coerced param, true for z.stringbool(), Date for a codec), typed z.output with input-side optionality preserved (.default()ed / .optional() keys stay omittable). Codec-bearing values are always z.encoded to their wire form — per key for object schemas, so a codec can sit beside a one-way transform like queryArray() that whole-schema z.encode would reject (covered by runtime tests: a date-only codec query param serializes as 2024-01-02, not toISOString()'s full datetime).
• encodeRequests now governs only the body, at its previous default (false: wire-form z.input bodies). encodeRequests: true (client-level or per call) flips the body arg to decoded z.output, encoded before sending.

Compile break notes

• Contracts using bare z.number()/z.boolean() in params/query stop compiling — they were already 400ing on every request. z.coerce.number<number>() also stops compiling: drop the type argument.
• Client callers passing wire-form strings for params/query ({ id: '1' } against a coerced-number param) get a type error — pass the natural type ({ id: 1 }). Body handling is unchanged from the released behavior.
• Changesets: @zodapi/hono minor, @zodapi/client minor (breaking, pre-1.0), @zodapi/core patch. Codegen output is unaffected (generated contracts are plain RouteDef objects).

-- Claude

🤖 Generated with Claude Code

https://claude.ai/code/session_0197TQhAzcfxR5LQigesnfmv