Let Serde hand back the scalars it accepts

phpstan.baseline.neon

@@ -915,12 +915,6 @@ parameters:
 			count: 2
 			path: src/Infrastructure/Adapter/In/Web/Controllers/Account/SaveRequestController.php
 
-		-
-			message: '#^Cannot call method getData\(\) on array\|object\.$#'
-			identifier: method.nonObject
-			count: 1
-			path: src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php
-
 		-
 			message: '#^Parameter \#1 \$type of method SP\\Domain\\Core\\Events\\EventMessage\<mixed\>\:\:addExtra\(\) expects class\-string\<mixed\>, string given\.$#'
 			identifier: argument.type

src/Domain/Common/Adapters/Serde.php

@@ -69,8 +69,11 @@ public static function serializeJson(array|object|string|int $data, int $flags =
      *
      * @throws SPException
      */
-    public static function deserialize(string $data, ?string $class = null, string ...$nestedClasses): object|array
-    {
+    public static function deserialize(
+        string $data,
+        ?string $class = null,
+        string ...$nestedClasses
+    ): object|array|string|int {
         $value = @unserialize(
             $data,
             ['allowed_classes' => $class !== null ? [$class, ...$nestedClasses] : true]

src/Infrastructure/Adapter/In/Web/Controllers/Account/ViewLinkController.php

@@ -110,6 +110,7 @@ public function viewLinkAction(string $hash): ActionResponse
             $this->accountService->incrementViewCounter($publicLink->getItemId());
             $this->accountService->incrementDecryptCounter($publicLink->getItemId());
 
+            /** @var Vault $vault The stored blob is a Vault; Serde answers with whatever it holds. */
             $vault = Serde::deserialize($publicLink->getData() ?? '', Vault::class, Crypt::class);
 
             $accountViewDto = AccountViewDto::fromModel(

tests/Unit/Domain/Common/Adapters/SerdeTest.php

@@ -84,6 +84,21 @@ public function testDeserialize()
         $this->assertEquals('0f099212786ab8090432f2889ac37c2a977f164a', $out->attributes['configHash']);
     }
 
+    /**
+     * serialize() takes a scalar — the provider above passes a string and an int through it — so
+     * deserialize() has to hand one back. Declared as object|array, it raised a TypeError on the
+     * way out instead: anything that cached a bare string, the file cache included, could store it
+     * and never read it again.
+     *
+     * @throws SPException
+     */
+    #[DataProvider('serializeDataProvider')]
+    public function testDeserializeReturnsWhateverWasSerialized(mixed $data, string $serialized)
+    {
+        // Equals, not same: an object comes back as a copy, which is the point of serializing it.
+        self::assertEquals($data, Serde::deserialize($serialized));
+    }
+
     /**
      * @throws SPException
      */