Repository navigation
Expand file tree
/
Copy pathrequest.ts
More file actions
840 lines (771 loc) · 32.3 KB
/
Copy pathrequest.ts
File metadata and controls
840 lines (771 loc) · 32.3 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
import { closeSync, existsSync, fstatSync, openSync, readSync } from 'node:fs'
import { CLI_CONTRACT } from '../contract/commands'
import type { CommandSpec, FlagSpec } from '../contract/types'
import { embedStore } from '../embed-context'
import { V2_OPERATIONS, type V2OperationName } from '../generated/v2-api'
import { type QueryValue, SimApiError } from '../http/client'
import { embeddedFileContent } from '../transfer/local-file'
import { camel, kebab } from './derive'
import type { OperationSpec } from './types'
/** One request field, as the generator describes it. */
export interface FieldSpec {
kind: 'string' | 'number' | 'integer' | 'boolean' | 'enum' | 'array' | 'object' | 'unknown'
required?: boolean
/** Numeric fields can represent JSON null without changing literal string flags. */
nullable?: true
values?: readonly string[]
default?: unknown
/** The field's `.describe()` from the route contract, used as `--help` text. */
describe?: string
}
/**
* The workspace never becomes a flag.
*
* It is the one field every workspace-scoped operation declares, and it comes
* from the profile — surfacing it as `--workspace-id` on 30-odd commands would
* duplicate the global `--workspace` and invite the two to disagree.
*/
export const PROFILE_INJECTED_FIELD = 'workspaceId'
/** Whether this path segment comes from the active profile's workspace. */
export function isProfileWorkspacePath(commandSpec: CommandSpec, param: string): boolean {
return commandSpec.profileWorkspacePath === true && param === PROFILE_INJECTED_FIELD
}
/**
* The slot a cursor-paginated operation carries its `cursor` field in.
*
* Pagination, not the name of a field, is what makes `limit` a page size. It
* lives here rather than beside its reader in `execute.ts` because `options.ts`
* has to ask the same question while it builds the flag, and importing
* `execute.ts` from `options.ts` would close a module cycle — `execute.ts`
* already reads `DEFAULT_PAGE_SIZE` from `options.ts`.
*/
export function cursorSlot(
operationSpec: Pick<OperationSpec, 'query' | 'body'>
): 'query' | 'body' | null {
if (operationSpec.query && 'cursor' in operationSpec.query) return 'query'
if (operationSpec.body && 'cursor' in operationSpec.body) return 'body'
return null
}
/** Kinds the CLI can only accept as a JSON string. */
const JSON_KINDS = new Set(['object', 'array', 'unknown'])
/** Kinds read through `Number`, where a blank does not survive: `Number('')` is `0`. */
const NUMERIC_KINDS: ReadonlySet<FieldSpec['kind']> = new Set(['number', 'integer'])
export function flagSpecFor(operation: V2OperationName, field: string): FlagSpec {
return CLI_CONTRACT[operation]?.flags?.[field] ?? {}
}
/** The undocumented spellings a flag also answers to: former names, then hidden aliases. */
export function otherSpellings(flag: FlagSpec): { name: string; renamed: boolean }[] {
return [
...(flag.renamedFrom ?? []).map((name) => ({ name, renamed: true })),
...(flag.hiddenAliases ?? []).map((name) => ({ name, renamed: false })),
]
}
/** The list field whose values may also follow the command as arguments, if any. */
export function trailingListField(commandSpec: CommandSpec): string | undefined {
return Object.entries(commandSpec.flags ?? {}).find(([, flag]) => flag.trailing)?.[0]
}
/**
* Long and short flags the root program has already claimed.
*
* Commander matches the root's own options across the whole of argv, including
* after a subcommand name, so a leaf that declares one of these never sees what
* the caller typed. The two failure modes differ only in how loud they are:
* `--version` and `--help` terminate, so `sim workflows rollback wf_1 --version
* 1` printed the CLI version and exited `0` without issuing a request; the
* root's value flags do not terminate, so a colliding leaf simply reads
* `undefined` and acts as though the flag were never typed.
*/
export const RESERVED_PROGRAM_FLAGS: ReadonlySet<string> = new Set([
'--version',
'-V',
'--help',
'-h',
'--profile',
'-P',
'--endpoint',
'--workspace',
'-w',
'--output',
])
/**
* Spellings a derived flag name is moved to when it would be shadowed.
*
* Only the name the CLI derives is rewritten. A name the contract states
* outright is left as written and caught by the build-time collision check
* instead — an explicit spelling is somebody's decision, and quietly serving a
* different flag than the one they wrote is how the shadowing went unnoticed in
* the first place.
*/
const RESERVED_FLAG_REPLACEMENTS: Readonly<Record<string, string>> = {
version: 'to-version',
}
/** The flag name a field is exposed under, honouring any contract override. */
export function flagNameFor(operation: V2OperationName, field: string): string {
const declared = flagSpecFor(operation, field).name
if (declared) return declared
const derived = kebab(field)
return RESERVED_FLAG_REPLACEMENTS[derived] ?? derived
}
/** The named option used for a path parameter that is contextual rather than primary. */
export function pathFlagNameFor(commandSpec: CommandSpec, param: string): string {
return commandSpec.pathFlags?.[param]?.name ?? kebab(param)
}
export function takesJson(field: FieldSpec, flag: FlagSpec): boolean {
// `rowCap` builds the object itself from a typed number, so the field's
// object kind must not pull the flag back into the JSON form it replaces.
if (flag.rowCap) return false
return flag.json === true || JSON_KINDS.has(field.kind)
}
/** The route's ceiling on `limit.max`; stated here so the refusal can name it. */
const MAX_ROW_CAP = 1_000_000
/** Reads `--max-rows 100` as the `{ type: 'rows', max: 100 }` the route declares. */
function coerceRowCap(raw: unknown, flagName: string): { type: 'rows'; max: number } {
const value = Number(raw)
if (!Number.isInteger(value) || value < 1 || value > MAX_ROW_CAP) {
throw new SimApiError(
`--${flagName} must be a whole number between 1 and ${MAX_ROW_CAP.toLocaleString('en-US')}`,
0
)
}
return { type: 'rows', max: value }
}
/**
* Drains stdin synchronously.
*
* `readFileSync(0)` looks like the obvious way to do this and fails on the one
* case that matters: a pipe is opened non-blocking, so a single read of an
* upstream process that has not written yet returns EAGAIN rather than waiting,
* and `export … | import --workflow @-` died with a raw stack trace. Reading in
* a loop and treating EAGAIN as "not ready yet" is what makes a pipe work.
*
* `Atomics.wait` is the only synchronous sleep available; without it the retry
* spins a core for as long as the writer takes.
*/
export const MAX_JSON_ARGUMENT_BYTES = 10 * 1024 * 1024
function readArgumentDescriptor(descriptor: number): string {
const idle = new Int32Array(new SharedArrayBuffer(4))
const buffer = Buffer.alloc(64 * 1024)
const chunks: Buffer[] = []
let bytes = 0
for (;;) {
let read: number
try {
read = readSync(descriptor, buffer, 0, buffer.length, null)
} catch (error) {
const code = (error as NodeJS.ErrnoException).code
if (code === 'EAGAIN') {
Atomics.wait(idle, 0, 0, 5)
continue
}
// Some platforms report end-of-input on a pipe as EOF rather than 0.
if (code === 'EOF') break
throw error
}
if (read === 0) break
bytes += read
if (bytes > MAX_JSON_ARGUMENT_BYTES) throw new SimApiError('JSON input exceeds 10 MiB', 0)
chunks.push(Buffer.from(buffer.subarray(0, read)))
}
return Buffer.concat(chunks).toString('utf8')
}
/**
* Resolves a flag argument that may name a file instead of carrying its value
* inline.
*
* `@path` reads the file and `@-` reads stdin, the curl convention. A workflow
* export is hundreds of lines, and the shell makes passing that literally
* unpleasant — unquoted `$(cat f.json)` word-splits into broken JSON, and the
* quoted form is easy to get wrong. JSON never starts with `@`; primitive list
* flags reserve it for this explicit file-input form.
*
* A value that genuinely starts with `@` is written `@@`, and only the leading
* `@` is dropped. The escape lives here rather than in any one command so that
* every `@`-aware flag inherits it: without it `--tag @urgent` has no spelling
* at all, because it can only be read as a request to open a file named
* `urgent`.
*/
/**
* Points at `@@` when an `@value` names nothing on disk.
*
* `--allowed-emails @example.org` is the natural spelling of a domain pattern
* and reads here as a request to open a file, and "cannot read example.org"
* alone gives no clue the value has a literal spelling at all. Gated on ENOENT
* so a real file that cannot be read (EACCES, EISDIR) is not answered with
* advice about escaping.
*/
function literalAtHint(error: unknown, path: string): string {
return (error as NodeJS.ErrnoException)?.code === 'ENOENT'
? `. To pass the literal value @${path}, write @@${path}`
: ''
}
export async function readArgumentSource(
raw: string,
flagName: string
): Promise<{ text: string; from: string }> {
if (Buffer.byteLength(raw, 'utf8') > MAX_JSON_ARGUMENT_BYTES)
throw new SimApiError(`--${flagName} exceeds the 10 MiB JSON input limit`, 0)
if (raw.startsWith('@@')) return { text: raw.slice(1), from: '' }
if (!raw.startsWith('@')) return { text: raw, from: '' }
// An embedded run executes in-process on the hosting server, so a raw file
// path here would read the SERVER's filesystem with argv the model controls.
// Read through the host's callback only after this flag consumes a file.
const embedded = embedStore.getStore()
if (embedded) {
if (raw === '@-')
throw new SimApiError(
`--${flagName}: this invocation has no stdin; use @path or an inline value`,
0
)
const content = await embeddedFileContent(embedded, raw)
if (Buffer.byteLength(content) > MAX_JSON_ARGUMENT_BYTES)
throw new SimApiError(`--${flagName} exceeds the 10 MiB JSON input limit`, 0)
return {
text:
typeof content === 'string'
? content
: new TextDecoder('utf-8', { fatal: true }).decode(content),
from: ' (read from your machine)',
}
}
const path = raw.slice(1)
if (path === '-') {
if (process.stdin.isTTY) {
throw new SimApiError(`--${flagName} @- reads stdin, but nothing is piped in`, 0)
}
try {
return { text: readArgumentDescriptor(0), from: ' (read from stdin)' }
} catch (error) {
throw new SimApiError(`--${flagName} cannot read stdin: ${(error as Error).message}`, 0)
}
}
try {
const descriptor = openSync(path, 'r')
try {
if (fstatSync(descriptor).size > MAX_JSON_ARGUMENT_BYTES)
throw new SimApiError('JSON input exceeds 10 MiB', 0)
return { text: readArgumentDescriptor(descriptor), from: ` (read from ${path})` }
} finally {
closeSync(descriptor)
}
} catch (error) {
throw new SimApiError(
`--${flagName} cannot read ${path}: ${(error as Error).message}${literalAtHint(error, path)}`,
0
)
}
}
/**
* The file references one list value carries: a JSON array's strings, a comma-joined run of
* ids, or the value itself. See {@link FlagSpec.fileReferences} for why neither reading can
* misread a single id or path.
*/
function fileReferenceEntries(value: string, flagName: string): string[] {
const entries = value.startsWith('[')
? jsonStringArray(value)
: value.includes(',') && !value.includes('/')
? value.split(',')
: undefined
if (!entries) return [value]
const trimmed = entries.map((entry) => entry.trim())
if (trimmed.some((entry) => !entry)) {
throw new SimApiError(`--${flagName} values cannot be empty: ${value}`, 0)
}
return trimmed
}
function jsonStringArray(value: string): string[] | undefined {
try {
const parsed: unknown = JSON.parse(value)
return Array.isArray(parsed) && parsed.every((entry) => typeof entry === 'string')
? parsed
: undefined
} catch {
return undefined
}
}
/** A manifest line that carries no value: blank, or a `#` comment. */
function isManifestNoise(line: string): boolean {
const trimmed = line.trim()
return trimmed === '' || trimmed.startsWith('#')
}
/**
* Reads a primitive list from argv or a newline-delimited file. A `manifest`
* list drops blank and `#` comment lines read from a file, so a requirements
* file can be passed as it is on disk.
*/
export async function readListValues(
raw: unknown,
flagName: string,
manifest = false
): Promise<string[]> {
const arguments_ = Array.isArray(raw) ? raw : [raw]
const values: string[] = []
for (const argument of arguments_) {
if (typeof argument !== 'string') {
throw new SimApiError(`--${flagName} values must be strings`, 0)
}
if (!argument.startsWith('@')) {
values.push(argument)
continue
}
const source = await readArgumentSource(argument, flagName)
const lines = source.text.split(/\r?\n/)
if (lines.at(-1) === '') lines.pop()
const kept = manifest ? lines.filter((line) => !isManifestNoise(line)) : lines
if (kept.length === 0) {
throw new SimApiError(`--${flagName}${source.from} contains no values`, 0)
}
values.push(
...kept.map((line, index) => {
const value = line.trim()
if (!value) {
throw new SimApiError(
`--${flagName}${source.from} has an empty value on line ${index + 1}`,
0
)
}
return value
})
)
}
return values.map((value) => {
const trimmed = value.trim()
if (!trimmed) throw new SimApiError(`--${flagName} values cannot be empty`, 0)
return trimmed
})
}
/** A percent-escape the caller has already applied, well-formed enough to decode. */
const PERCENT_ESCAPE = /%[0-9A-Fa-f]{2}/
/** What `encodeURIComponent` leaves raw and the server's canonical encoder does not. */
const SUB_DELIMITERS = /[!'()*]/g
/**
* Encodes one segment exactly as `encodeFolderPathSegment` does server-side.
*
* The route does not merely decode a path, it re-encodes each segment and
* demands the result match byte for byte, so "close enough" is rejected outright
* with `Path must be a canonical folder path`. `encodeURIComponent` alone leaves
* `!'()*` raw — common in real folder names (`Q1 (draft)`, `Sam's stuff`) — and
* spells a lone `.` or `..` as itself, which the server refuses to let address a
* folder actually named that.
*/
function encodeFolderPathSegment(name: string): string {
if (name === '.') return '%2E'
if (name === '..') return '%2E%2E'
return encodeURIComponent(name).replace(
SUB_DELIMITERS,
(character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`
)
}
/**
* Rewrites one folder path into the API's canonical wire form.
*
* The wire form encodes each segment, so `/Folder 1` in the app is
* `/Folder%201` to the API — and typing the name you can see was rejected with
* a message that never said the word encoding. Splitting on `/` first is what
* keeps the separators: `encodeURIComponent` over the whole path would turn
* every one of them into `%2F` and address a single top-level folder whose name
* contains slashes.
*
* Decoding each segment before encoding it is what makes this idempotent, and
* it has to be: the encoded spelling is what the CLI prints today, what the
* README shows, and therefore what people will paste back. `/Folder 1` and
* `/Folder%201` must reach the same folder, and `%2520` is the failure to
* avoid. The limit of that rule is a folder whose name really contains a `%`
* followed by two hex digits — `100%20off` reads as `100 off`. A stray `%` is
* safe, because it fails to decode and is encoded literally, and the ambiguous
* name can always be typed in its encoded form (`100%2520off`).
*/
export function encodeFolderPath(value: string): string {
return value
.split('/')
.map((segment) => {
if (!PERCENT_ESCAPE.test(segment)) return encodeFolderPathSegment(segment)
try {
return encodeFolderPathSegment(decodeURIComponent(segment))
} catch {
return encodeFolderPathSegment(segment)
}
})
.join('/')
}
/**
* A fractional part `Number` cannot keep.
*
* Above 2^52 a double's spacing is 1, so `Number('4503599627370496.5')` is an
* integer — `Number.isInteger` passes and the API receives a value the caller
* did not type. Read the text as well as the parsed number so the refusal
* covers the range where the parse itself loses the fraction. Digits that are
* all zero are not a fraction, so `1.0` stays a whole number.
*/
const FRACTIONAL_DIGITS = /\.\d*[1-9]/
/**
* Points at `@` when a value that failed to parse looks like a filename.
*
* `--workflow export.json` is the natural first guess, and "must be valid JSON"
* alone gives no clue that passing a file is even supported.
*/
function pathHint(raw: string): string {
if (raw.startsWith('@') || /^\s*[[{"\-\d]|^\s*(true|false|null)/.test(raw)) return ''
return !embedStore.getStore() && existsSync(raw)
? `. ${raw} is a file — pass it as @${raw}`
: '. To read a file, pass @path (or @- for stdin)'
}
/**
* Turns the string argv provides into the value the contract expects.
*
* Every failure names the flag rather than the field, because the flag is what
* the caller typed — and every one of these is caught before any request is
* made, so a typo costs nothing.
*/
export async function coerce(
raw: unknown,
field: FieldSpec,
flag: FlagSpec,
flagName: string
): Promise<unknown> {
if (raw === undefined) return undefined
/**
* A repeated flag. `list` says the CLI accepts several values; the *wire*
* encoding follows the field's own kind, because the two are not the same
* question:
*
* - `string` — the route splits on commas (`workflowIds`, `folderPaths`,
* `triggers`), so the values are joined.
* - anything else — the wire genuinely wants an array (`rowIds`,
* `selectedOutputs`) or a string-or-array union whose array branch is the
* right one (`knowledgeBaseIds`). Joining those produced a single bogus id
* or failed validation outright.
*/
if (flag.list) {
const listed = await readListValues(raw, flagName, flag.manifest === true)
const values = (
flag.fileReferences
? listed.flatMap((value) => fileReferenceEntries(value, flagName))
: listed
).map((value) => (flag.folderPath ? encodeFolderPath(value) : value))
// Encoding first is also what keeps the comma-joined form unambiguous: a
// folder name containing a comma leaves here as `%2C`, so the route's split
// cannot cut one path in half.
return field.kind === 'string' ? values.join(',') : values
}
if (flag.rowCap) return coerceRowCap(raw, flagName)
if (flag.textSource && typeof raw === 'string') {
return (await readArgumentSource(raw, flagName)).text
}
if (takesJson(field, flag)) {
if (typeof raw !== 'string') return raw
const source = await readArgumentSource(raw, flagName)
try {
return JSON.parse(source.text)
} catch (error) {
throw new SimApiError(
`--${flagName} must be valid JSON${source.from}: ${(error as Error).message}${pathHint(raw)}`,
0
)
}
}
if (NUMERIC_KINDS.has(field.kind)) {
if (field.nullable && (raw === null || (typeof raw === 'string' && raw.trim() === 'null')))
return null
const value = Number(raw)
if (Number.isNaN(value)) throw new SimApiError(`--${flagName} must be a number`, 0)
if (!Number.isFinite(value)) throw new SimApiError(`--${flagName} must be a finite number`, 0)
/**
* An `integer` field said so in the contract, and every other constraint on
* one is already refused here by hand. Leaving integrality to the server
* answered `--max-bytes 5.5` with `Invalid input: expected int, received
* number` and `--max-bytes 999999999999999999999` with `Too big: expected
* int to be <=9007199254740991` — library wording naming neither the flag
* nor anything the caller typed, on the one flag whose blank, zero and
* non-numeric cases all had a sentence written for them.
*/
if (
field.kind === 'integer' &&
(!Number.isInteger(value) || FRACTIONAL_DIGITS.test(String(raw)))
) {
throw new SimApiError(`--${flagName} must be a whole number`, 0)
}
if (field.kind === 'integer' && !Number.isSafeInteger(value)) {
throw new SimApiError(
`--${flagName} is outside the whole-number range the API accepts (±${Number.MAX_SAFE_INTEGER})`,
0
)
}
return value
}
if (field.kind === 'boolean' || flag.boolean) return raw === true || raw === 'true'
const choices = flag.choices ?? field.values
if (choices && !choices.includes(String(raw))) {
throw new SimApiError(`--${flagName} must be one of: ${choices.join(', ')}`, 0)
}
if (flag.folderPath && typeof raw === 'string') return encodeFolderPath(raw)
return raw
}
/**
* The workspace precondition as stated when the profile is not at hand.
*
* `executeOperation` resolves the workspace through `SimClient.requireWorkspace`
* first, which names the profile and checks the API key, so this is a defensive
* floor rather than the wording a caller sees.
*/
const NO_WORKSPACE_FALLBACK =
'No workspace set. Pass --workspace, or run: sim configure --set-workspace <id>'
export interface BuiltRequest {
/** The values filling the operation's `[param]` path segments, encoded when routed. */
params: Record<string, string>
query: Record<string, QueryValue>
body: Record<string, unknown> | undefined
/** Contract-declared request headers, absent when the operation declares none. */
headers?: Record<string, string>
}
/**
* A query string can only carry scalars. Every v2 query field is one today, but
* a structured field could be added — serializing it here keeps that a working
* request rather than `[object Object]`.
*/
function asQueryValue(value: unknown): QueryValue {
if (value === null || value === undefined) return undefined
if (typeof value === 'object') return JSON.stringify(value)
return value as QueryValue
}
/**
* Assembles one operation's HTTP request from positional args, parsed flags,
* and the profile's workspace.
*
* Primary path params come from positional arguments in declared order. A
* contextual path param can instead come from a named option declared by the
* CLI contract. Every other field is looked up by its flag name in the slot the
* API contract declares it in, so a field that moved from query to body moves
* here on the next regeneration.
*/
function boundedRequest(request: BuiltRequest): BuiltRequest {
if (
request.body &&
Buffer.byteLength(JSON.stringify(request.body), 'utf8') > MAX_JSON_ARGUMENT_BYTES
)
throw new SimApiError('Aggregate JSON request body exceeds 10 MiB', 0)
return request
}
export async function buildRequest(
operation: V2OperationName,
positional: string[],
flags: Record<string, unknown>,
workspaceId: string | null
): Promise<BuiltRequest> {
const commandSpec: CommandSpec = CLI_CONTRACT[operation] ?? {}
const spec: OperationSpec = V2_OPERATIONS[operation]
const params: Record<string, string> = {}
let positionalIndex = 0
for (const param of spec.pathParams) {
const pathFlag = commandSpec.pathFlags?.[param]
const profileWorkspacePath = isProfileWorkspacePath(commandSpec, param)
const flagName = pathFlagNameFor(commandSpec, param)
const argumentName = commandSpec.pathArgumentNames?.[param] ?? param
const value = profileWorkspacePath
? workspaceId
: pathFlag
? flags[camel(flagName)]
: positional[positionalIndex++]
if (value === undefined || value === null) {
if (profileWorkspacePath) {
throw new SimApiError(NO_WORKSPACE_FALLBACK, 0)
}
throw new SimApiError(pathFlag ? `--${flagName} is required` : `Missing <${argumentName}>`, 0)
}
if (typeof value !== 'string' || value.length === 0) {
throw new SimApiError(
pathFlag ? `--${flagName} cannot be empty` : `<${argumentName}> cannot be empty`,
0
)
}
params[param] = value
}
const query: Record<string, QueryValue> = {}
const body: Record<string, unknown> = {}
const headers: Record<string, string> = {}
/**
* On a paginating operation `limit` is the walk size rather than a filter,
* and the pager reads it from the flags itself — including refusing a blank
* one, in wording that says what `0` means there. Left to it, so the caller
* gets that message instead of the generic refusal below.
*/
const paginatedLimit = cursorSlot(spec) !== null
let bodyFields = spec.body
if (spec.bodyDiscriminator) {
const { field, variants } = spec.bodyDiscriminator
const flagName = flagNameFor(operation, field)
const descriptor = spec.body?.[field]
if (!descriptor) throw new Error(`Missing body discriminator field: ${field}`)
const flag = flagSpecFor(operation, field)
const value = await coerce(
flags[camel(flagName)] ?? flag.requestDefault ?? descriptor.default,
descriptor,
flag,
flagName
)
if (value === undefined) throw new SimApiError(`--${flagName} is required`, 0)
if (typeof value !== 'string' || !Object.hasOwn(variants, value))
throw new SimApiError(`--${flagName} must be one of: ${Object.keys(variants).join(', ')}`, 0)
bodyFields = variants[value]
for (const candidate of Object.keys(spec.body ?? {})) {
const candidateFlag = flagNameFor(operation, candidate)
if (!Object.hasOwn(bodyFields, candidate) && flags[camel(candidateFlag)] !== undefined)
throw new SimApiError(
`--${candidateFlag} is not available when --${flagName} is ${value}`,
0
)
}
}
for (const slot of ['query', 'body', 'headers'] as const) {
for (const [field, descriptor] of Object.entries(
(slot === 'body' ? bodyFields : spec[slot]) ?? {}
)) {
const flag = flagSpecFor(operation, field)
if (flag.omit) continue
const flagName = flagNameFor(operation, field)
// Commander stores `--min-duration-ms` as `minDurationMs`; reading by the
// flag's own name silently finds nothing.
const omitProfileWorkspace = commandSpec.allWorkspaces && flags.allWorkspaces === true
const provided =
field === PROFILE_INJECTED_FIELD
? omitProfileWorkspace
? undefined
: workspaceId
: flags[camel(flagName)]
// A contract default only applies to what the caller left unsaid, so
// typing the flag — including typing the server's own default back — still
// decides. It is validated like any other value, enum choices included.
const raw =
provided ??
(embedStore.getStore() ? flag.embeddedRequestDefault : undefined) ??
flag.requestDefault
/**
* A blank filter is a mistake, and every v2 JSON route says so
* (`rejectBlankQueryValues`). The CLI never let one reach the wire: the
* URL builder skips an empty value, so `logs list --status ""` searched
* everything and answered `0`, a wider result set presented as an answer.
* Refused here, before the request, the way an empty list entry and an
* empty path parameter already are.
*
* Read from what the caller typed rather than from the coerced value,
* because coercion erases the blank on a numeric field: `Number('')` is
* `0`, so `--max-cost ""` reached the wire as a real "costing at most
* nothing" filter that a check on the coerced value cannot see. An
* explicit `--max-cost 0` is a value the caller chose and is still sent.
*
* That erasure is what a numeric *body* field suffers too, so the rule is
* the whole query slot plus every numeric field wherever it sits: `tables
* rows batch-delete --limit ""` sent `"limit":0`, a cap the caller never
* typed. The slot alone is not the distinction — a blank is meaningful
* only where it can survive as itself, which is a body *string*, where it
* clears a description.
*
* Blank is `trim()`-empty rather than exactly empty, matching both the
* route — `blankQueryValueValidationError` reads `?status=%20` as blank —
* and the list flag beside it, which trims each entry before refusing it.
* A quoted space is invisible in a shell and read as every blank the
* empty string did: `--max-cost " "` as `0`, `--deployed-only " "` as an
* explicit `false`, `--status " "` as a `%20` the server answers `400`.
*/
if (
(slot === 'query' || NUMERIC_KINDS.has(descriptor.kind)) &&
typeof raw === 'string' &&
raw.trim() === '' &&
!(field === 'limit' && paginatedLimit)
) {
throw new SimApiError(`--${flagName} cannot be empty`, 0)
}
const value = await coerce(raw ?? undefined, descriptor, flag, flagName)
/**
* A non-paginated `limit` is a row cap the route bounds at `1`, which is
* what `--help` already tells the caller ("note 0 is not accepted") — so
* `--limit 0`, `-1` and `1.5` were shipping a round trip to be told
* something the CLI had documented. The ceiling stays with the server:
* it is per-route policy, and nothing in the terminal states it.
*/
if (
field === 'limit' &&
!paginatedLimit &&
NUMERIC_KINDS.has(descriptor.kind) &&
typeof value === 'number' &&
value < 1
) {
throw new SimApiError(`--${flagName} must be 1 or more`, 0)
}
if (value === undefined) {
if (descriptor.required) {
throw new SimApiError(
field === PROFILE_INJECTED_FIELD ? NO_WORKSPACE_FALLBACK : `--${flagName} is required`,
0
)
}
// Omitted rather than sent as null: the server applies its own default,
// and sending an explicit undefined would override it with nothing.
continue
}
if (slot === 'query') query[field] = asQueryValue(value)
// A header is a wire string: the contracts declare only string headers,
// and anything else would reach `fetch` as `[object Object]`.
else if (slot === 'headers') headers[field] = String(value)
else body[field] = value
}
}
/**
* Left off entirely when the operation declared none, so a request without
* contract headers is byte-for-byte the request it was before.
*/
const headerSlot = Object.keys(headers).length > 0 ? { headers } : {}
// A union body comes in whole through `--body`, merged over the fields the
// branches share. Replacing outright dropped the profile's `workspaceId`,
// which both branches require, so every insert came back as invalid input.
// The caller's JSON still wins on any key it sets.
if (spec.opaqueBody) {
if (commandSpec.bodyVariants) {
const provided = commandSpec.bodyVariants.filter(
(variant) => flags[camel(variant.name)] !== undefined
)
const names = commandSpec.bodyVariants.map((variant) => `--${variant.name}`).join(' or ')
if (provided.length !== 1) {
throw new SimApiError(`Pass exactly one of ${names}`, 0)
}
const variant = provided[0]
const raw = flags[camel(variant.name)]
if (typeof raw !== 'string') throw new SimApiError(`--${variant.name} is required`, 0)
const parsed = await coerce(raw, { kind: variant.kind }, { json: true }, variant.name)
if (
(variant.kind === 'object' &&
(!parsed || typeof parsed !== 'object' || Array.isArray(parsed))) ||
(variant.kind === 'array' && !Array.isArray(parsed))
) {
throw new SimApiError(`--${variant.name} must be a JSON ${variant.kind}`, 0)
}
return boundedRequest({
params,
query,
body: { ...body, [variant.property]: parsed },
...headerSlot,
})
}
const raw = flags.body
if (typeof raw !== 'string') throw new SimApiError('--body is required', 0)
const parsed = await coerce(raw, { kind: 'object' }, { json: true }, 'body')
if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
throw new SimApiError('--body must be a JSON object', 0)
}
return boundedRequest({
params,
query,
body: { ...body, ...(parsed as Record<string, unknown>) },
...headerSlot,
})
}
return boundedRequest({
params,
query,
/**
* A declared JSON body is still an object when all of its fields are optional.
* Sending no bytes makes the server reject before field defaults can apply.
*/
body: spec.body ? body : undefined,
...headerSlot,
})
}