@hardfin/cli 0.1.0-dev.34 → 0.1.0-dev.35

package/README.md

@@ -60,7 +60,7 @@ Everything an endpoint takes becomes a flag or an argument. No command asks for
 
 ```sh
 hardfin asset ownership create ast_4f9xk2mq7plr8stz \
-  --customer-id cst_a1 --date 2026-09-23 --sale-price 1500.00
+  --customer-id 0192f7d4-3b6a-7c1e-9f2d-5a8b4c6e7d73 --date 2026-09-23 --sale-price 1500.00
 
 hardfin asset move execute create \
   --move assetId=0192f7d4-3b6a-7c1e-9f2d-5a8b4c6e7d70,originId=0192f7d4-3b6a-7c1e-9f2d-5a8b4c6e7d71,destinationId=0192f7d4-3b6a-7c1e-9f2d-5a8b4c6e7d72,shipAt=2026-09-24T10:00:00Z

package/dist/cli.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="f2529e6e-d7d4-5fe2-b460-7e86ca865c25")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e0ebce65-52b6-5732-b4b2-1becfe72bdef")}catch(e){}}();
 import module from "node:module";
 //#region src/cli.ts
 module.enableCompileCache?.();
-process.stdout.on("error", (error) => {
-	if (error.code === "EPIPE") process.exit(0);
+for (const stream of [process.stdout, process.stderr]) stream.on("error", (error) => {
+	if (error.code === "EPIPE") process.exit(process.exitCode ?? 0);
 	throw error;
 });
 let isCrashing = false;
@@ -14,7 +14,7 @@ process.on("unhandledRejection", (error) => void toCrash(error));
 try {
 	const answer = await toQuickAnswer(process.argv.slice(2));
 	if (answer === void 0) {
-		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-DTsxnjRj.js");
+		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-BdRDIa3u.js");
 		try {
 			await toCli().parseAsync(process.argv);
 		} catch (error) {
@@ -33,7 +33,7 @@ async function toCrash(error) {
 	isCrashing = true;
 	process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
 	try {
-		const { toReported } = await import("./program-DTsxnjRj.js");
+		const { toReported } = await import("./program-BdRDIa3u.js");
 		await toReported(error, false, void 0, "fatal");
 	} finally {
 		process.exit(1);
@@ -51,4 +51,4 @@ async function toQuickAnswer(args) {
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=f2529e6e-d7d4-5fe2-b460-7e86ca865c25
+//# debugId=e0ebce65-52b6-5732-b4b2-1becfe72bdef

package/dist/{program-DTsxnjRj.js → program-BdRDIa3u.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="c7f8ce05-d638-5d0f-a088-655ddade6f45")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6057a656-73c2-55b1-9f09-873e3b83b368")}catch(e){}}();
 import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BN3gyBpR.js";
 import { n as toCompletion, t as toAnswer$1 } from "./completion-tree-rR_Rmeij.js";
 import { createRequire } from "node:module";
@@ -1157,8 +1157,8 @@ async function runApi(input) {
 		writeFailure("invalid_arguments", "a path is required, such as /customer", input.isJSON);
 		return ExitCode.USAGE;
 	}
-	if (path.split("/").includes("..")) {
-		writeFailure("invalid_arguments", "a path stays inside the API, so it cannot contain ..", input.isJSON);
+	if (!isInsideApi(input.resolved.settings.apiUrl, path)) {
+		writeFailure("invalid_arguments", "a path stays inside the API, so it cannot climb out of it with ..", input.isJSON);
 		return ExitCode.USAGE;
 	}
 	const query = toQuery$1(input.flags["field"]);
@@ -1196,6 +1196,17 @@ async function runApi(input) {
 		throw error;
 	}
 }
+/** isInsideApi reports whether a path, once parsed, still lands under the API's own path. */
+function isInsideApi(apiUrl, path) {
+	try {
+		const base = new URL(apiUrl);
+		const target = new URL(`${apiUrl}${path.startsWith("/") ? "" : "/"}${path}`);
+		const root = base.pathname.replace(/\/+$/, "");
+		return target.origin === base.origin && (target.pathname === root || target.pathname.startsWith(`${root}/`));
+	} catch {
+		return false;
+	}
+}
 /** toQuery folds the repeated --field flags into query parameters. */
 function toQuery$1(fields) {
 	const query = new URLSearchParams();
@@ -3493,7 +3504,9 @@ function toElements(flag, values) {
 			const key = pair.slice(0, split).trim();
 			if (flag.element && !flag.element.includes(key)) return /* @__PURE__ */ new Error(`--${flag.name} has no field ${key}. It takes ${flag.element.join(", ")}`);
 			if (key in element) return /* @__PURE__ */ new Error(`--${flag.name} names ${key} twice in one element, so which one it takes is not clear`);
-			element[key] = pair.slice(split + 1).trim();
+			const value = pair.slice(split + 1).trim();
+			if (flag.elementUuids?.includes(key) && !z.uuid().safeParse(value).success) return /* @__PURE__ */ new Error(`--${flag.name} needs a UUID for ${key}, such as 3f2a9c1e-5b7d-4e8a-9c21-7d4e5f6a8b90, and ${value || "nothing"} is not one`);
+			element[key] = value;
 		}
 		elements.push(element);
 	}
@@ -3925,6 +3938,11 @@ const commands = [
 									"shipAt",
 									"shipAtTimezone"
 								],
+								elementUuids: [
+									"assetId",
+									"destinationId",
+									"originId"
+								],
 								schema: z.array(z.string())
 							}]
 						})]
@@ -3954,6 +3972,7 @@ const commands = [
 									"id",
 									"shipAt"
 								],
+								elementUuids: ["assetId"],
 								schema: z.array(z.string())
 							}]
 						})]
@@ -4030,6 +4049,7 @@ const commands = [
 							valueName: "fieldId=,value=",
 							repeatable: true,
 							element: ["fieldId", "value"],
+							elementUuids: ["fieldId"],
 							schema: z.array(z.string())
 						},
 						{
@@ -5373,6 +5393,7 @@ const commands = [
 								"order",
 								"section"
 							],
+							elementUuids: ["fieldId"],
 							schema: z.array(z.string())
 						},
 						{
@@ -6309,5 +6330,5 @@ async function toReported(error, isJSON, resolved, level = "error") {
 //#endregion
 export { toCli, toParseExitCode, toReported, wasReportAttempted };
 
-//# sourceMappingURL=program-DTsxnjRj.js.map
-//# debugId=c7f8ce05-d638-5d0f-a088-655ddade6f45
+//# sourceMappingURL=program-BdRDIa3u.js.map
+//# debugId=6057a656-73c2-55b1-9f09-873e3b83b368

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.1.0-dev.34",
+    "version": "0.1.0-dev.35",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",