fix(apiquery): reject non-string map keys

internal/apiquery/encoder.go

@@ -43,10 +43,15 @@ func (e *encoder) Encode(key string, value reflect.Value) ([]Pair, error) {
 }
 
 func (e *encoder) encodeMap(key string, value reflect.Value) ([]Pair, error) {
+	if value.Type().Key().Kind() != reflect.String {
+		return nil, fmt.Errorf("apiquery: cannot encode a map with a non-string key")
+	}
+
 	var pairs []Pair
 	iter := value.MapRange()
 	for iter.Next() {
-		subkey := iter.Key().String()
+		mapKey := iter.Key()
+		subkey := mapKey.String()
 		keyPath := subkey
 		if len(key) > 0 {
 			if e.settings.NestedFormat == NestedQueryFormatDots {

internal/apiquery/map_key_test.go

@@ -0,0 +1,35 @@
+package apiquery
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestMarshalRejectsNonStringMapKeys(t *testing.T) {
+	t.Parallel()
+
+	for name, input := range map[string]map[int]string{
+		"populated": {1: "one"},
+		"empty":     {},
+		"nil":       nil,
+	} {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			values, err := Marshal(input)
+
+			require.ErrorContains(t, err, "non-string key")
+			require.Nil(t, values)
+		})
+	}
+}
+
+func TestMarshalKeepsStringMapKeys(t *testing.T) {
+	t.Parallel()
+
+	values, err := Marshal(map[string]string{"one": "1"})
+
+	require.NoError(t, err)
+	require.Equal(t, "1", values.Get("one"))
+}