packages/apps-engine/deno-runtime/handlers/app/handleOnPreSettingUpdate.ts (1)

17-23: Validate params length and first element shape before destructuring.

Array.isArray(params) allows [], which yields setting === undefined and can surface as a harder-to-debug runtime error inside the app handler. Consider guarding for length and a non-null object before calling the hook.

🔧 Suggested fix

-	if (!Array.isArray(params)) {
+	if (!Array.isArray(params) || params.length < 1 || typeof params[0] !== 'object' || params[0] === null) {
 		throw new Error('Invalid params', { cause: 'invalid_param_type' });
 	}
 
-	const [setting] = params as [Record<string, unknown>];
+	const [setting] = params as [Record<string, unknown>];

packages/apps-engine/deno-runtime/handlers/app/handleOnSettingUpdated.ts (1)

17-21: Missing validation for empty params array.

If params is an empty array, setting will be undefined after destructuring, and app.onSettingUpdated will be called with an undefined setting. Consider validating that the setting exists.

Proposed fix

 if (!Array.isArray(params)) {
   throw new Error('Invalid params', { cause: 'invalid_param_type' });
 }

 const [setting] = params as [Record<string, unknown>];

+if (!setting) {
+  throw new Error('Setting is required', { cause: 'invalid_param_type' });
+}
+
 await app.onSettingUpdated(setting, AppAccessorsInstance.getConfigurationModify(), AppAccessorsInstance.getReader(), AppAccessorsInstance.getHttp());

packages/apps-engine/deno-runtime/handlers/outboundcomms-handler.ts (1)

8-18: Add validation for params shape before spreading.
In JSON-RPC 2.0, params can be either an Array (positional) or an Object (named). The current code casts params to Array<unknown> without validation, which silently fails when params is an object—the spread operator produces an empty array, causing the provider method to receive incorrect arguments. Add a guard to validate params is array-shaped and return a controlled error for invalid shapes, consistent with patterns already used in scheduler-handler.ts and construct.ts.

Proposed fix

 export default async function outboundMessageHandler(request: RequestObject): Promise<JsonRpcError | Defined> {
 	const { method: call, params } = request;
 	const [, providerName, methodName] = call.split(':');
 
+	if (params !== undefined && !Array.isArray(params)) {
+		return new JsonRpcError('error-invalid-params', -32000);
+	}
 	const provider = AppObjectRegistry.get<IOutboundMessageProviders>(`outboundCommunication:${providerName}`);
 	if (!provider) {
 		return new JsonRpcError('error-invalid-provider', -32000);
 	}
 	const method = provider[methodName as keyof IOutboundMessageProviders];
 	const logger = AppObjectRegistry.get<Logger>('logger');
 	const args = (params as Array<unknown>) ?? [];

packages/apps-engine/deno-runtime/handlers/videoconference-handler.ts (1)

27-27: Consider handling undefined params.

In jsonrpc-lite, RequestObject.params is optional. If a request arrives without params, this line will throw when attempting to destructure undefined. Consider defaulting to an empty array.

Suggested fix

-	const [videoconf, user, options] = params as Array<unknown>;
+	const [videoconf, user, options] = (params ?? []) as Array<unknown>;

packages/apps-engine/deno-runtime/handlers/api-handler.ts (1)

2-32: Validate params shape before destructuring.

If params is missing or not an array, requestData/endpointInfo become undefined and the endpoint call can fail with an internal error instead of a JSON‑RPC invalid‑params response. Other handlers in this codebase validate this consistently.

🔧 Proposed fix

-	const [requestData, endpointInfo] = params as Array<unknown>;
+	if (!Array.isArray(params) || params.length < 2) {
+		return JsonRpcError.invalidParams(null);
+	}
+	const [requestData, endpointInfo] = params as [unknown, unknown];

packages/apps-engine/deno-runtime/handlers/api-handler.ts (1)

8-27: Add params validation before destructuring to prevent uncaught exceptions.

Line 25 destructures params without guarding against undefined, null, or non-array values. If params is invalid, destructuring throws and bypasses error handling. Add an early Array.isArray check, consistent with scheduler-handler.ts and listener/handler.ts:

Suggested fix

 export default async function apiHandler(request: RequestObject): Promise<JsonRpcError | Defined> {
 	const { method: call, params } = request;
 	const [, path, httpMethod] = call.split(':');
 
 	const endpoint = AppObjectRegistry.get<IApiEndpoint>(`api:${path}`);
 	const logger = AppObjectRegistry.get<Logger>('logger');
 
 	if (!endpoint) {
 		return new JsonRpcError(`Endpoint ${path} not found`, -32000);
 	}
 
 	const method = endpoint[httpMethod as keyof IApiEndpoint];
 
 	if (typeof method !== 'function') {
 		return new JsonRpcError(`${path}'s ${httpMethod} not exists`, -32000);
 	}
 
+	if (!Array.isArray(params)) {
+		return JsonRpcError.invalidParams(null);
+	}
+
 	const [requestData, endpointInfo] = params as Array<unknown>;

packages/apps-engine/deno-runtime/handlers/api-handler.ts (1)

26-41: Guard against non‑array params before destructuring.

If params is not an array, the destructuring throws and is reported as an internal error. Consider validating and returning a JSON‑RPC invalid‑params error instead.

🛠️ Suggested fix

-	const [requestData, endpointInfo] = params as Array<unknown>;
+	if (!Array.isArray(params) || params.length < 1) {
+		return new JsonRpcError('Invalid params', -32602);
+	}
+	const [requestData, endpointInfo] = params as Array<unknown>;

packages/apps-engine/deno-runtime/handlers/tests/uikit-handler.test.ts (1)

4-103: Tests pass RequestObject but handler expects RequestContext with logger.

The handleUIKitInteraction function explicitly requires RequestContext (which includes context.logger), but the tests pass plain RequestObject instances from jsonrpc.request(). While the handler doesn't currently use the logger field, this violates the type contract and should be fixed for type safety.

Wrap request objects with the required context:

🛠️ Suggested fix

 import { afterAll, beforeEach, describe, it } from 'https://deno.land/[email protected]/testing/bdd.ts';
 import jsonrpc from 'jsonrpc-lite';
+import { Logger } from '../../lib/logger.ts';

 import { AppObjectRegistry } from '../../AppObjectRegistry.ts';
 import handleUIKitInteraction, {
 	UIKitActionButtonInteractionContext,
 	UIKitBlockInteractionContext,
 	UIKitLivechatBlockInteractionContext,
 	UIKitViewCloseInteractionContext,
 	UIKitViewSubmitInteractionContext,
 } from '../uikit/handler.ts';

+const makeRequest = (id: number, method: string, params: unknown[]) =>
+	Object.assign(jsonrpc.request(id, method, params), {
+		context: { logger: new Logger(method) },
+	});

 describe('handlers > uikit', () => {
 	const mockApp = {
 		getID: (): string => 'appId',
 		executeBlockActionHandler: (context: any): Promise<any> => Promise.resolve(context),
 		executeViewSubmitHandler: (context: any): Promise<any> => Promise.resolve(context),
 		executeViewClosedHandler: (context: any): Promise<any> => Promise.resolve(context),
 		executeActionButtonHandler: (context: any): Promise<any> => Promise.resolve(context),
 		executeLivechatBlockActionHandler: (context: any): Promise<any> => Promise.resolve(context),
 	};

 	beforeEach(() => {
 		AppObjectRegistry.set('app', mockApp);
 	});

 	afterAll(() => {
 		AppObjectRegistry.clear();
 	});

 	it('successfully handles a call for "executeBlockActionHandler"', async () => {
-		const request = jsonrpc.request(1, 'app:executeBlockActionHandler', [
+		const request = makeRequest(1, 'app:executeBlockActionHandler', [
 			{
 				actionId: 'actionId',
 				blockId: 'blockId',
 				value: 'value',
 				viewId: 'viewId',
 			},
 		]);

 		const result = await handleUIKitInteraction(request);
 		assertInstanceOf(result, UIKitBlockInteractionContext);
 	});

 	it('successfully handles a call for "executeViewSubmitHandler"', async () => {
-		const request = jsonrpc.request(1, 'app:executeViewSubmitHandler', [
+		const request = makeRequest(1, 'app:executeViewSubmitHandler', [
 			{
 				viewId: 'viewId',
 				appId: 'appId',
 				userId: 'userId',
 				isAppUser: true,
 				values: {},
 			},
 		]);

 		const result = await handleUIKitInteraction(request);
 		assertInstanceOf(result, UIKitViewSubmitInteractionContext);
 	});

 	it('successfully handles a call for "executeViewClosedHandler"', async () => {
-		const request = jsonrpc.request(1, 'app:executeViewClosedHandler', [
+		const request = makeRequest(1, 'app:executeViewClosedHandler', [
 			{
 				viewId: 'viewId',
 				appId: 'appId',
 				userId: 'userId',
 				isAppUser: true,
 			},
 		]);

 		const result = await handleUIKitInteraction(request);
 		assertInstanceOf(result, UIKitViewCloseInteractionContext);
 	});

 	it('successfully handles a call for "executeActionButtonHandler"', async () => {
-		const request = jsonrpc.request(1, 'app:executeActionButtonHandler', [
+		const request = makeRequest(1, 'app:executeActionButtonHandler', [
 			{
 				actionId: 'actionId',
 				appId: 'appId',
 				userId: 'userId',
 				isAppUser: true,
 			},
 		]);

 		const result = await handleUIKitInteraction(request);
 		assertInstanceOf(result, UIKitActionButtonInteractionContext);
 	});

 	it('successfully handles a call for "executeLivechatBlockActionHandler"', async () => {
-		const request = jsonrpc.request(1, 'app:executeLivechatBlockActionHandler', [
+		const request = makeRequest(1, 'app:executeLivechatBlockActionHandler', [
 			{
 				actionId: 'actionId',
 				appId: 'appId',
 				userId: 'userId',
 				visitor: {},
 				isAppUser: true,
 				room: {},
 			},
 		]);

 		const result = await handleUIKitInteraction(request);
 		assertInstanceOf(result, UIKitLivechatBlockInteractionContext);
 	});
 });