@base44-preview/cli 0.1.32-pr.663.16bdb8e → 0.1.32-pr.663.1a6cb8e

package/dist/cli/index.js

@@ -39570,9 +39570,9 @@ function tm(e, t, r) {
     return l(["<", r("name"), r("typeArguments"), " ", ...e.map(r, "attributes"), n.selfClosing ? " />" : ">"]);
   let i = n.attributes?.some((u) => V3(u.value) && u.value.value.includes(`
 `)), o = t.singleAttributePerLine && n.attributes.length > 1 ? E : A;
-  return l(["<", r("name"), r("typeArguments"), m(e.map(() => [o, r()], "attributes")), ...rm2(n, t, s)], { shouldBreak: i });
+  return l(["<", r("name"), r("typeArguments"), m(e.map(() => [o, r()], "attributes")), ...rm3(n, t, s)], { shouldBreak: i });
 }
-function rm2(e, t, r) {
+function rm3(e, t, r) {
   return e.selfClosing ? [A, "/>"] : nm(e, t, r) ? [">"] : [f, ">"];
 }
 function nm(e, t, r) {
@@ -111521,7 +111521,7 @@ function N62(e) {
 function nm2(e, t, a) {
   return ie10(t, a, e.typeParameters) || ie10(t, a, e.parameters) || S7(t, e.type);
 }
-function rm3(e, t, a) {
+function rm4(e, t, a) {
   return ie10(t, a, e.types);
 }
 function im2(e, t, a) {
@@ -114489,7 +114489,7 @@ ${Me.join(`
     return S7(a, t.elementType);
   }, 190: function(t, a, _) {
     return ie10(a, _, t.elements);
-  }, 193: rm3, 194: rm3, 195: function(t, a, _) {
+  }, 193: rm4, 194: rm4, 195: function(t, a, _) {
     return S7(a, t.checkType) || S7(a, t.extendsType) || S7(a, t.trueType) || S7(a, t.falseType);
   }, 196: function(t, a, _) {
     return S7(a, t.typeParameter);
@@ -239451,7 +239451,7 @@ var package_default = {
     jsonwebtoken: "^9.0.3",
     ky: "^1.14.2",
     lodash: "^4.17.23",
-    minisearch: "7.1.2",
+    minisearch: "^7.1.2",
     ms: "^2.1.3",
     multer: "^2.0.0",
     nanoid: "^5.1.6",
@@ -249234,7 +249234,7 @@ var ParameterSchema = looseObject({
   example: unknown().optional()
 });
 var MediaTypesSchema = record(string2(), looseObject({ schema: unknown().optional() }));
-var RequestBodySchema = looseObject({
+var MediaContentSchema = looseObject({
   content: MediaTypesSchema.optional()
 });
 var ResponseObjectSchema = looseObject({
@@ -249251,18 +249251,22 @@ var OperationSchema = looseObject({
   responses: record(string2(), unknown()).optional(),
   security: array(SecurityRequirementSchema).optional()
 });
-var PathItemSchema = looseObject({
-  ...Object.fromEntries(HTTP_METHODS.map((method) => [method, OperationSchema.optional()])),
-  parameters: array(unknown()).optional()
-});
 var OpenApiSpecSchema = looseObject({
   openapi: string2(),
-  paths: record(string2(), PathItemSchema),
+  paths: record(string2(), record(string2(), unknown())),
   components: looseObject({
     schemas: record(string2(), unknown()).optional()
   }).optional(),
-  security: array(SecurityRequirementSchema).optional()
+  security: array(SecurityRequirementSchema).optional().catch(undefined)
 });
+var ParameterListSchema = array(unknown());
+
+// src/core/api-spec/text.ts
+var DOCS_CALLOUT = /<(Info|Note|Tip|Check|Warning)>([\s\S]*?)<\/\1>/g;
+var RELATIVE_LINK = /\[([^\]]+)\]\(\/[^)]*\)/g;
+function cleanText(text) {
+  return text.replace(DOCS_CALLOUT, (_, kind, body) => kind === "Warning" ? `Warning: ${body}` : body).replace(RELATIVE_LINK, "$1");
+}
 
 // src/core/api-spec/operations.ts
 var PERSONAL_ACCESS_TOKEN_SCHEME = "PersonalAccessTokenAuth";
@@ -249274,9 +249278,19 @@ function isReadOnly(operation, spec) {
 function parameterText(operation) {
   return (operation.parameters ?? []).flatMap((parameter) => {
     const parsed = ParameterSchema.safeParse(parameter);
-    return parsed.success ? [parsed.data.name, parsed.data.description ?? ""] : [];
+    return parsed.success ? [parsed.data.name, cleanText(parsed.data.description ?? "")] : [];
   }).join(" ");
 }
+var COMPONENT_REF = /^#\/components\/([^/]+)\/([^/]+)$/;
+function resolveComponentRef(spec, value) {
+  const ref = value !== null && typeof value === "object" ? value.$ref : undefined;
+  const match = typeof ref === "string" ? COMPONENT_REF.exec(ref) : null;
+  if (!match?.[1] || !match[2]) {
+    return value;
+  }
+  const components = spec.components;
+  return components?.[match[1]]?.[match[2]] ?? value;
+}
 function mergeParameters(shared, own) {
   if (!shared?.length) {
     return own;
@@ -249293,13 +249307,15 @@ function mergeParameters(shared, own) {
 }
 function listOperations(spec) {
   return Object.entries(spec.paths).flatMap(([path, item]) => HTTP_METHODS.flatMap((method) => {
-    const declared = item[method];
-    if (!declared) {
+    const parsed = OperationSchema.safeParse(item[method]);
+    if (!parsed.success) {
       return [];
     }
+    const shared = ParameterListSchema.safeParse(item.parameters);
+    const resolve = (list) => list?.map((parameter) => resolveComponentRef(spec, parameter));
     const operation = {
-      ...declared,
-      parameters: mergeParameters(item.parameters, declared.parameters)
+      ...parsed.data,
+      parameters: mergeParameters(resolve(shared.success ? shared.data : undefined), resolve(parsed.data.parameters))
     };
     return [
       {
@@ -249307,7 +249323,7 @@ function listOperations(spec) {
         method: method.toUpperCase(),
         path,
         summary: operation.summary ?? "",
-        description: operation.description ?? "",
+        description: cleanText(operation.description ?? ""),
         parameterText: parameterText(operation),
         readOnly: isReadOnly(operation, spec),
         operation
@@ -249317,22 +249333,14 @@ function listOperations(spec) {
 }
 function pathSegments(path) {
   const pathname = path.split(/[?#]/, 1)[0] ?? "";
-  return pathname.split("/").filter(Boolean);
+  return pathname.replace(/^\/+|\/+$/g, "").split("/");
 }
 function segmentPattern(segment) {
   const source = segment.split(/(\{[^}]+\})/).map((part) => part.startsWith("{") ? "[^/]+" : part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("");
   return new RegExp(`^${source}$`);
 }
-function specificity(templateSegments) {
-  return templateSegments.map((segment) => segment.includes("{") ? 0 : 1);
-}
-function compareSpecificity(a, b) {
-  for (let i = 0;i < a.length; i++) {
-    if (a[i] !== b[i]) {
-      return (b[i] ?? 0) - (a[i] ?? 0);
-    }
-  }
-  return 0;
+function literalSegments(path) {
+  return pathSegments(path).map((segment) => segment.includes("{") ? "0" : "1").join("");
 }
 function matchOperation(operations, method, concretePath) {
   const upperMethod = method.toUpperCase();
@@ -249344,11 +249352,12 @@ function matchOperation(operations, method, concretePath) {
     const template = pathSegments(op.path);
     return template.length === segments.length && template.every((part, i) => segmentPattern(part).test(segments[i] ?? ""));
   });
-  return candidates.sort((a, b) => compareSpecificity(specificity(pathSegments(a.path)), specificity(pathSegments(b.path))))[0];
+  return candidates.sort((a, b) => literalSegments(b.path).localeCompare(literalSegments(a.path)))[0];
 }
+
+// src/core/api-spec/contract.ts
 var SCHEMA_REF_PREFIX = "#/components/schemas/";
 var MAX_REF_DEPTH = 4;
-var FRAMEWORK_VALIDATION_ERROR = "Validation Error";
 function inlineRefs(node, schemas, seen = new Set, depth = 0) {
   if (depth > MAX_REF_DEPTH) {
     return node;
@@ -249373,12 +249382,8 @@ function inlineRefs(node, schemas, seen = new Set, depth = 0) {
     inlineRefs(value, schemas, seen, depth)
   ]));
 }
-function jsonSchemaOf(value) {
-  const parsed = RequestBodySchema.safeParse(value);
-  return parsed.success ? parsed.data.content?.["application/json"]?.schema : undefined;
-}
-function requestBodyOf(value) {
-  const parsed = RequestBodySchema.safeParse(value);
+function bodyOf(value) {
+  const parsed = MediaContentSchema.safeParse(value);
   const content = parsed.success ? parsed.data.content ?? {} : {};
   const contentType = "application/json" in content ? "application/json" : Object.keys(content)[0];
   return contentType ? { contentType, schema: content[contentType]?.schema } : {};
@@ -249392,8 +249397,10 @@ function leftoverRefs(node, schemas, found = new Map) {
     for (const [key, value] of Object.entries(node)) {
       if (key === "$ref" && typeof value === "string" && value.startsWith(SCHEMA_REF_PREFIX) && !found.has(value)) {
         const schema = schemas[value.slice(SCHEMA_REF_PREFIX.length)];
-        found.set(value, schema);
-        leftoverRefs(schema, schemas, found);
+        if (schema !== undefined) {
+          found.set(value, schema);
+          leftoverRefs(schema, schemas, found);
+        }
       } else {
         leftoverRefs(value, schemas, found);
       }
@@ -249401,16 +249408,51 @@ function leftoverRefs(node, schemas, found = new Map) {
   }
   return found;
 }
+var SCHEMA_DATA_KEYS = new Set([
+  "example",
+  "examples",
+  "default",
+  "enum",
+  "const"
+]);
+function slimSchema(node, isPropertyMap = false) {
+  if (Array.isArray(node)) {
+    return node.map((item) => slimSchema(item));
+  }
+  if (node === null || typeof node !== "object") {
+    return node;
+  }
+  const entries = Object.entries(node);
+  if (isPropertyMap) {
+    return Object.fromEntries(entries.map(([name, value]) => [name, slimSchema(value)]));
+  }
+  const slim = {};
+  for (const [key, value] of entries) {
+    if (key === "title" && typeof value === "string") {
+      continue;
+    }
+    slim[key] = SCHEMA_DATA_KEYS.has(key) ? value : key === "properties" ? slimSchema(value, true) : key === "description" && typeof value === "string" ? cleanText(value) : slimSchema(value);
+  }
+  const { anyOf, ...rest } = slim;
+  const nullable = Array.isArray(anyOf) && anyOf.length === 2 ? nullableType(anyOf) : undefined;
+  return nullable ? { type: [nullable, "null"], ...rest } : slim;
+}
+function nullableType(variants) {
+  const types = variants.map((variant) => variant !== null && typeof variant === "object" && Object.keys(variant).length === 1 && typeof variant.type === "string" ? variant.type : undefined);
+  if (types.includes(undefined) || !types.includes("null")) {
+    return;
+  }
+  return types.find((type) => type !== "null");
+}
 function getOperationContract(spec, op) {
   const schemas = spec.components?.schemas ?? {};
-  const inline = (node) => node === undefined ? null : inlineRefs(node, schemas);
+  const inline = (node) => node === undefined ? null : slimSchema(inlineRefs(node, schemas));
   const responses = Object.entries(op.operation.responses ?? {}).flatMap(([status, response]) => {
-    const parsed = ResponseObjectSchema.safeParse(response);
+    const parsed = ResponseObjectSchema.safeParse(resolveComponentRef(spec, response));
     return parsed.success ? [[status, parsed.data]] : [];
   });
-  const success = responses.filter(([status]) => status.startsWith("2")).sort(([a], [b]) => a.localeCompare(b)).map(([, response]) => jsonSchemaOf(response)).find(Boolean);
-  const errors = responses.filter(([status, response]) => !status.startsWith("2") && response.description !== FRAMEWORK_VALIDATION_ERROR);
-  const requestBody = requestBodyOf(op.operation.requestBody);
+  const success = responses.filter(([status]) => status.startsWith("2")).sort(([a], [b]) => a.localeCompare(b)).map(([, response]) => bodyOf(response).schema).find(Boolean);
+  const requestBody = bodyOf(resolveComponentRef(spec, op.operation.requestBody));
   const contract = {
     endpoint: op.endpoint,
     method: op.method,
@@ -249420,7 +249462,7 @@ function getOperationContract(spec, op) {
     parameters: (op.operation.parameters ?? []).flatMap((parameter) => {
       const parsed = ParameterSchema.safeParse(parameter);
       if (!parsed.success) {
-        return [];
+        return [parameter];
       }
       const { name, in: location2, required, schema, description } = parsed.data;
       const inSchema = schema !== null && typeof schema === "object" && "description" in schema;
@@ -249430,23 +249472,23 @@ function getOperationContract(spec, op) {
           in: location2,
           required: required ?? false,
           schema: inline(schema ?? {}),
-          ...description && !inSchema ? { description } : {},
+          ...description && !inSchema ? { description: cleanText(description) } : {},
           ..."example" in parsed.data ? { example: parsed.data.example } : {}
         }
       ];
     }),
     ...requestBody.contentType && requestBody.contentType !== "application/json" ? { requestBodyContentType: requestBody.contentType } : {},
     requestBodySchema: inline(requestBody.schema),
-    responseSchema: inline(success),
-    errors: Object.fromEntries(errors.map(([status, response]) => [status, response.description ?? ""]))
+    responseSchema: inline(success)
   };
   const refs = leftoverRefs(contract, schemas);
   return {
     ...contract,
-    ...refs.size > 0 ? { refs: Object.fromEntries(refs) } : {}
+    ...refs.size > 0 ? {
+      refs: Object.fromEntries([...refs].map(([ref, schema]) => [ref, slimSchema(schema)]))
+    } : {}
   };
 }
-
 // src/core/api-spec/grep.ts
 function grepOperations(spec, operations, pattern, options = {}) {
   const regex = new RegExp(pattern, options.ignoreCase ? "i" : "");
@@ -249454,6 +249496,7 @@ function grepOperations(spec, operations, pattern, options = {}) {
 }
 // src/core/api-spec/request.ts
 var MAX_ERROR_BODY_CHARS = 4000;
+var QUERY_STRING = /\?\S*/g;
 async function readBody(response) {
   try {
     const text = (await response.clone().text()).trim();
@@ -249462,13 +249505,18 @@ async function readBody(response) {
     return;
   }
 }
+function normalizePath(path) {
+  const url = new URL(path.replace(/^\/*/, "/"), "http://placeholder");
+  return `${url.pathname}${url.search}`;
+}
 async function sendApiRequest(method, path, body) {
   try {
     const response = await base44Client(path.replace(/^\/+/, ""), {
       method,
       body,
-      headers: body === undefined ? {} : { "Content-Type": "application/json" },
-      timeout: false
+      headers: typeof body === "string" ? { "Content-Type": "application/json" } : {},
+      timeout: false,
+      retry: { methods: ["get", "head"] }
     });
     return {
       status: response.status,
@@ -249477,19 +249525,30 @@ async function sendApiRequest(method, path, body) {
     };
   } catch (error) {
     const apiError = await ApiError.fromHttpError(error, `calling ${method} ${path}`);
-    const raw = error instanceof HTTPError ? await readBody(error.response) : undefined;
-    throw new ApiError(apiError.message, {
-      statusCode: apiError.statusCode,
-      requestUrl: apiError.requestUrl,
-      requestMethod: apiError.requestMethod,
-      requestId: apiError.requestId,
-      hints: apiError.hints,
-      details: raw ? [`Response body: ${raw}`] : apiError.details
-    });
-  }
+    const response = error instanceof HTTPError ? error.response : undefined;
+    const raw = response ? await readBody(response) : undefined;
+    const retryAfter = response?.headers.get("retry-after") ?? undefined;
+    throw redactedApiError(apiError, raw, method, path, retryAfter);
+  }
+}
+function redactedApiError(apiError, raw, method, path, retryAfter) {
+  const wait = retryAfter ? ` (retry after ${/^\d+$/.test(retryAfter) ? `${retryAfter} s` : retryAfter})` : "";
+  const reason = apiError.statusCode !== undefined ? `HTTP ${apiError.statusCode}${wait}` : (apiError.cause?.message ?? "request failed").replace(QUERY_STRING, "");
+  const message = `Error calling ${method} ${path.split("?", 1)[0]}: ${reason}`;
+  return new ApiError(message, {
+    statusCode: apiError.statusCode,
+    requestUrl: apiError.requestUrl?.split("?", 1)[0],
+    requestMethod: apiError.requestMethod,
+    requestId: apiError.requestId,
+    hints: apiError.hints,
+    details: [
+      ...raw ? [`Response body: ${raw}`] : apiError.details ?? [],
+      ...apiError.requestId ? [`Request ID: ${apiError.requestId}`] : []
+    ]
+  });
 }
 // src/core/api-spec/spec.ts
-import { rename, stat as stat3 } from "node:fs/promises";
+import { rename, rm, stat as stat3 } from "node:fs/promises";
 import { join as join22 } from "node:path";
 var SPEC_CACHE_TTL_MS = 60 * 60 * 1000;
 function getSpecCachePath(apiUrl = getBase44ApiUrl()) {
@@ -249544,12 +249603,18 @@ async function loadSpec(options = {}) {
   const text = await downloadSpec();
   const spec = parseSpec(text);
   const partial = `${path}.${process.pid}.tmp`;
-  await writeFile(partial, text);
-  await rename(partial, path);
+  try {
+    await writeFile(partial, text);
+    await rename(partial, path);
+  } catch {
+    await rm(partial, { force: true }).catch(() => {
+      return;
+    });
+  }
   return { text, spec };
 }
 // src/cli/commands/api/shared.ts
-import { fstatSync } from "node:fs";
+import { basename as basename6 } from "node:path";
 function formatJson(value) {
   return toJsonStdout(value, { compact: !process.stdout.isTTY });
 }
@@ -249581,36 +249646,60 @@ function operationsInArea(operations, area) {
   }
   return inArea;
 }
-function isPipedStdin() {
-  try {
-    const stats = fstatSync(0);
-    return stats.isFIFO() || stats.isFile();
-  } catch {
-    return false;
-  }
-}
-async function readRequestBody(flag, log) {
+async function readRequestBody(flag) {
   if (flag === "@-") {
     return readStdin("--body @-", { trim: false });
   }
   if (flag?.startsWith("@")) {
     return readTextFile(flag.slice(1));
   }
-  if (flag === undefined && isPipedStdin()) {
-    log.warn("stdin is ignored; pass --body @- to send it as the body.");
-  }
   return flag;
 }
+var FORM_FILE = /^@(.+?)(?:;type=([^;]+))?$/;
+async function readFormBody(fields) {
+  const form = new FormData;
+  for (const field of fields) {
+    const separator = field.indexOf("=");
+    if (separator < 1) {
+      throw new InvalidInputError(`--form takes name=value or name=@file, got "${field}".`);
+    }
+    const name = field.slice(0, separator);
+    const value = field.slice(separator + 1);
+    const file = FORM_FILE.exec(value);
+    if (file?.[1]) {
+      const type = file[2] ?? "application/octet-stream";
+      const blob = new Blob([await readFile(file[1])], { type });
+      form.append(name, blob, basename6(file[1]));
+    } else {
+      form.append(name, value);
+    }
+  }
+  return form;
+}
+function withoutQuery(path) {
+  return path.split("?", 1)[0] ?? "";
+}
+function reportedFetchCommand(method, path, options) {
+  return {
+    name: "api fetch",
+    args: [method, withoutQuery(path)],
+    options: {
+      ...options,
+      ...options.body === undefined ? {} : { body: "[not reported]" },
+      ...Array.isArray(options.form) && options.form.length > 0 ? { form: "[not reported]" } : {}
+    }
+  };
+}
 
 // src/cli/commands/api/catalog.ts
 async function catalogAction(ctx, area, options) {
   const { spec } = await loadSpecTask(ctx, options.refresh);
   const operations = listOperations(spec);
-  const readOnly = (ops) => options.readOnly ? ops.filter((op) => op.readOnly) : ops;
-  if (area === undefined) {
-    return { stdout: formatJson(catalogIndex(readOnly(operations))) };
+  const filterReadOnly = (ops) => options.readOnly ? ops.filter((op) => op.readOnly) : ops;
+  if (!area) {
+    return { stdout: formatJson(catalogIndex(filterReadOnly(operations))) };
   }
-  const inArea = readOnly(operationsInArea(operations, area));
+  const inArea = filterReadOnly(operationsInArea(operations, area));
   return { stdout: formatJson(areaListing(area, inArea)) };
 }
 function getApiCatalogCommand() {
@@ -249625,7 +249714,7 @@ async function findOperation(ctx, method, path, { refresh, flag }) {
   const { spec } = await loadSpecTask(ctx, refresh);
   const op = matchOperation(listOperations(spec), method, path);
   if (!op) {
-    throw new InvalidInputError(`No operation in the API spec matches ${method} ${path}.`, {
+    throw new InvalidInputError(`No operation in the API spec matches ${method} ${withoutQuery(path)}.`, {
       hints: [
         {
           message: "The cached spec may predate this route; fetch it again",
@@ -249640,6 +249729,22 @@ async function findOperation(ctx, method, path, { refresh, flag }) {
   }
   return { spec, op };
 }
+var ENCODED_SEPARATOR = /%(2f|5c|2e)/i;
+async function fillAppId(ctx, path, command) {
+  let filled = path;
+  if (withoutQuery(path).includes("{app_id}")) {
+    const { appId } = command.optsWithGlobals();
+    await ensureAppContext(ctx, { appId });
+    filled = path.replaceAll("{app_id}", requireApp(ctx).id);
+  }
+  const placeholder = withoutQuery(filled).match(/\{[^}/]*\}/);
+  if (placeholder) {
+    throw new InvalidInputError(`Replace ${placeholder[0]} in the path with a real value; only {app_id} is filled in.`);
+  }
+  return filled;
+}
+var MULTIPART_HINT = "Send this body with --form name=value, and --form name=@path for files.";
+var CONTRACT_HELP = "The contract is JSON; cut it down with e.g. | jq '.parameters, .requestBodySchema'";
 var TEXT_CONTENT_TYPES = [
   "json",
   "text/",
@@ -249647,18 +249752,27 @@ var TEXT_CONTENT_TYPES = [
   "javascript",
   "x-www-form-urlencoded"
 ];
-function isText(contentType) {
-  return !contentType || TEXT_CONTENT_TYPES.some((hint) => contentType.toLowerCase().includes(hint));
+function decodeText(body, contentType) {
+  const type = contentType.toLowerCase();
+  if (type && !TEXT_CONTENT_TYPES.some((hint) => type.includes(hint))) {
+    return;
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(body);
+  } catch {
+    return;
+  }
 }
 async function formatResponse({ status, contentType, body }, output, jsonMode) {
-  if (output !== undefined) {
+  if (output) {
     await writeFile(output, body);
     return formatJson({ status, contentType, bytes: body.length, output });
   }
   if (body.length === 0) {
     return formatJson({ status });
   }
-  if (!isText(contentType)) {
+  const text = decodeText(body, contentType);
+  if (text === undefined) {
     return formatJson({
       status,
       contentType,
@@ -249666,36 +249780,46 @@ async function formatResponse({ status, contentType, body }, output, jsonMode) {
       note: "Binary body not printed; add --output <file> to save it."
     });
   }
-  const text = new TextDecoder().decode(body);
-  try {
-    return formatJson(JSON.parse(text));
-  } catch {
-    if (jsonMode) {
-      return formatJson({ status, contentType, body: text });
-    }
-    return text.endsWith(`
+  const asIs = text.endsWith(`
 `) ? text : `${text}
 `;
+  try {
+    const parsed = JSON.parse(text);
+    return process.stdout.isTTY ? formatJson(parsed) : asIs;
+  } catch {
+    return jsonMode ? formatJson({ status, contentType, body: text }) : asIs;
   }
 }
 async function fetchAction(ctx, methodArg, path, options, command) {
+  ctx.errorReporter.setContext({
+    command: reportedFetchCommand(methodArg ?? "", path ?? "", { ...options })
+  });
   if (!methodArg || !path) {
     if (options.help) {
-      const usage = command.helpInformation();
+      const usage = `${command.helpInformation()}
+${CONTRACT_HELP}
+`;
       return { stdout: ctx.jsonMode ? formatJson({ usage }) : usage };
     }
     throw new InvalidInputError("Provide a method and a path, e.g. GET /api/apps.");
   }
   const method = methodArg.toUpperCase();
   if (options.help) {
-    const { spec, op } = await findOperation(ctx, method, path, {
+    const { spec, op } = await findOperation(ctx, method, normalizePath(path), {
       refresh: options.refresh,
       flag: "--help"
     });
-    return { stdout: formatJson(getOperationContract(spec, op)) };
+    const contract = getOperationContract(spec, op);
+    return {
+      stdout: formatJson(contract.requestBodyContentType === "multipart/form-data" ? { ...contract, hint: MULTIPART_HINT } : contract)
+    };
   }
+  const target = normalizePath(await fillAppId(ctx, path, command));
   if (options.readOnly) {
-    const { op } = await findOperation(ctx, method, path, {
+    if (ENCODED_SEPARATOR.test(withoutQuery(target))) {
+      throw new InvalidInputError("Refused under --read-only: the path has an encoded /, \\ or ., so it can't be checked. Nothing was sent.");
+    }
+    const { op } = await findOperation(ctx, method, target, {
       refresh: options.refresh,
       flag: "--read-only"
     });
@@ -249703,17 +249827,13 @@ async function fetchAction(ctx, methodArg, path, options, command) {
       throw new InvalidInputError(`Refused under --read-only: ${op.method} ${op.path} is not a read-only operation. Nothing was sent.`);
     }
   }
-  ctx.errorReporter.setContext({
-    command: {
-      name: "api fetch",
-      args: [method, path.split("?", 1)[0] ?? ""],
-      options: { ...options, body: options.body && "[not reported]" }
-    }
-  });
+  if (options.body !== undefined && options.form.length > 0) {
+    throw new InvalidInputError("Use --body or --form, not both.");
+  }
   await ensureAuth(ctx);
-  const body = await readRequestBody(options.body, ctx.log);
-  const response = await ctx.runTask(`Calling ${method} ${path}`, () => sendApiRequest(method, path, body), {
-    successMessage: `Called ${method} ${path}`,
+  const body = options.form.length > 0 ? await readFormBody(options.form) : await readRequestBody(options.body);
+  const response = await ctx.runTask(`Calling ${method} ${target}`, () => sendApiRequest(method, target, body), {
+    successMessage: `Called ${method} ${target}`,
     errorMessage: "Request failed"
   });
   return {
@@ -249724,7 +249844,8 @@ function getApiFetchCommand() {
   return new Base44Command("fetch", {
     requireAuth: false,
     requireAppContext: false
-  }).description("Call a Base44 API operation; add --help after a path for its contract").helpOption(false).argument("[method]", "HTTP method, e.g. GET or POST").argument("[path]", 'Concrete path with any query string, e.g. "/api/apps/<app-id>/workflows/runs?status=failed"').option("--body <json>", "Request body: JSON, @file.json, or @- to read it from stdin").option("--output <file>", "Save the response body to a file").option("--read-only", "Refuse, before sending, any operation the spec does not mark read-only").option("--refresh", REFRESH_OPTION_HELP).option("-h, --help", "With a method and path, print that operation's contract; otherwise this help").action(fetchAction);
+  }).description("Call a Base44 API operation; add --help after a path for its contract").helpOption(false).argument("[method]", "HTTP method, e.g. GET or POST").argument("[path]", 'Path with any query string; {app_id} is filled from --app-id or the project, e.g. "/api/apps/{app_id}/workflows/runs?status=failed"').option("--body <json>", "Request body: JSON, @file.json, or @- to read it from stdin").option("--form <field>", "Multipart field: name=value, or name=@file to attach a file (repeatable)", (field, fields) => [...fields, field], []).option("--output <file>", "Save the response body to a file").option("--read-only", "Refuse, before sending, any operation the spec does not mark read-only").option("--refresh", REFRESH_OPTION_HELP).option("-h, --help", "With a method and path, print that operation's contract; otherwise this help").addHelpText("after", `
+${CONTRACT_HELP}`).action(fetchAction);
 }
 
 // src/cli/commands/api/grep.ts
@@ -249740,7 +249861,7 @@ async function grepAction(ctx, pattern, options) {
   assertValidRegex(pattern);
   const { spec } = await loadSpecTask(ctx, options.refresh);
   let operations = listOperations(spec);
-  if (options.area !== undefined) {
+  if (options.area) {
     operations = operationsInArea(operations, options.area);
   }
   if (options.readOnly) {
@@ -249756,7 +249877,7 @@ function getApiGrepCommand() {
   return new Base44Command("grep", {
     requireAuth: false,
     requireAppContext: false
-  }).description("Search the API spec with a regular expression, for when search misses").argument("<pattern>", 'Regular expression, e.g. "runs.*status"').option("--area <area>", "Search only one area's operations (see base44 api catalog)").option("-i, --ignore-case", "Case-insensitive match").option("--limit <n>", "Most operations to return (default 20)").option("--read-only", READ_ONLY_FILTER_HELP).option("--refresh", REFRESH_OPTION_HELP).action(grepAction);
+  }).description("Search the API spec with a regular expression, for when search misses").argument("<pattern>", `Regular expression over each operation's contract as JSON text (quotes and newlines appear escaped), e.g. "runs.*status"`).option("--area <area>", "Search only one area's operations (see base44 api catalog)").option("-i, --ignore-case", "Case-insensitive match").option("--limit <n>", "Most operations to return (default 20)").option("--read-only", READ_ONLY_FILTER_HELP).option("--refresh", REFRESH_OPTION_HELP).action(grepAction);
 }
 
 // src/cli/commands/api/search.ts
@@ -251543,7 +251664,7 @@ function getBuildCommand() {
 }
 
 // src/cli/commands/project/create.ts
-import { basename as basename6, resolve as resolve11 } from "node:path";
+import { basename as basename7, resolve as resolve11 } from "node:path";
 var import_kebabCase = __toESM(require_kebabCase(), 1);
 
 // src/cli/commands/project/scaffold-shared.ts
@@ -251708,8 +251829,8 @@ async function createInteractive(options, ctx) {
     name: () => {
       return options.name ? Promise.resolve(options.name) : Ze({
         message: "What is the name of your project?",
-        placeholder: basename6(process.cwd()),
-        initialValue: basename6(process.cwd()),
+        placeholder: basename7(process.cwd()),
+        initialValue: basename7(process.cwd()),
         validate: (value) => {
           if (!value || value.trim().length === 0) {
             return "Every project deserves a name";
@@ -252404,7 +252525,7 @@ function getLogsCommand() {
 }
 
 // src/cli/commands/project/scaffold.ts
-import { basename as basename7, resolve as resolve12 } from "node:path";
+import { basename as basename8, resolve as resolve12 } from "node:path";
 function resolveAppId(options) {
   const appId = options.appId;
   if (!appId) {
@@ -252421,7 +252542,7 @@ async function scaffoldAction(ctx, name, options, command) {
   const { log, runTask } = ctx;
   const appId = resolveAppId(command.optsWithGlobals());
   const resolvedPath = resolve12("./");
-  const projectName = (name ?? basename7(resolvedPath)).trim();
+  const projectName = (name ?? basename8(resolvedPath)).trim();
   const template = await getTemplateById("backend-only");
   log.info(`Scaffolding project at ${resolvedPath}`);
   const { projectId } = await runTask("Setting up your project...", async () => {
@@ -262316,7 +262437,7 @@ var nativeEnumType = ZodNativeEnum.create;
 var promiseType = ZodPromise.create;
 var effectsType = ZodEffects.create;
 var optionalType = ZodOptional2.create;
-var nullableType = ZodNullable2.create;
+var nullableType2 = ZodNullable2.create;
 var preprocessType = ZodEffects.createWithPreprocess;
 var pipelineType = ZodPipeline.create;
 // ../functions-compiler/src/contracts.ts
@@ -262346,7 +262467,7 @@ var bundleAppRequestSchema = objectType({
 var ACTIVATION_MODE = "pull";
 
 // ../functions-compiler/src/deno-bundle.ts
-import { mkdtemp, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { mkdtemp, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
 import { tmpdir as tmpdir2 } from "node:os";
 import path21 from "node:path";
 
@@ -262953,7 +263074,7 @@ async function bundleToModule(prepared, nodeModulesDir = "none") {
       warnings: result.warnings.map((w) => w.text)
     };
   } finally {
-    await rm(dir, { recursive: true, force: true });
+    await rm2(dir, { recursive: true, force: true });
   }
 }
 function buildFailureErrors(e, dir) {
@@ -267944,7 +268065,7 @@ function createPattern(matcher) {
   }
   return () => false;
 }
-function normalizePath(path) {
+function normalizePath2(path) {
   if (typeof path !== "string")
     throw new Error("string expected");
   path = sp3.normalize(path);
@@ -267958,7 +268079,7 @@ function normalizePath(path) {
   return path;
 }
 function matchPatterns(patterns, testString, stats) {
-  const path = normalizePath(testString);
+  const path = normalizePath2(testString);
   for (let index = 0;index < patterns.length; index++) {
     const pattern = patterns[index];
     if (pattern(path, stats)) {
@@ -273318,4 +273439,4 @@ export {
   runCLI
 };
 
-//# debugId=719BE22CF0CDD92864756E2164756E21
+//# debugId=4213AA6F0A5C795F64756E2164756E21