@oxagen/cli 2.1.4-371 → 2.1.4-374

package/oxagen.mjs

@@ -15267,7 +15267,7 @@ import { readFileSync as readFileSync10 } from "node:fs";
 import { dirname as dirname7, resolve as resolve2 } from "node:path";
 import { fileURLToPath } from "node:url";
 function readVersion() {
-  if (true) return "2.1.4-371";
+  if (true) return "2.1.4-374";
   try {
     const here = dirname7(fileURLToPath(import.meta.url));
     const pkg = JSON.parse(
@@ -48070,7 +48070,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@oxagen/cli",
-      version: "2.1.4-371",
+      version: "2.1.4-374",
       description: "Oxagen governance CLI \u2014 spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
       type: "module",
       main: "./dist/index.js",
@@ -73228,8 +73228,11 @@ var init_upstream_tool = __esm({
       in: external_exports.enum(["path", "query", "header", "cookie"]),
       property: inputNameSchema.describe("The inputSchema property that carries the value."),
       required: external_exports.boolean(),
-      style: external_exports.enum(["simple", "label", "matrix", "form", "spaceDelimited", "pipeDelimited", "deepObject"]).optional().describe("OpenAPI's serialization style, when it differs from the default for `in`."),
-      explode: external_exports.boolean().optional()
+      style: external_exports.enum(["simple", "label", "matrix", "form", "spaceDelimited", "pipeDelimited", "deepObject", "cookie"]).optional().describe("OpenAPI's serialization style, when it differs from the default for `in`."),
+      explode: external_exports.boolean().optional().describe("OpenAPI's explode. Import writes it on every cookie parameter, so the executor never guesses its default."),
+      allow_reserved: external_exports.boolean().optional().describe(
+        "A query parameter only: true sends reserved characters such as / and : in the value without percent-encoding (OpenAPI's allowReserved)."
+      )
     }).strict();
     mediaTypeSchema = external_exports.string().regex(/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/, "a media type is <type>/<subtype> in lowercase");
     httpSpreadBodySchema = external_exports.object({
@@ -73256,8 +73259,11 @@ var init_upstream_tool = __esm({
       kind: external_exports.literal("http"),
       operation: external_exports.string().min(1).max(256).describe('The operationId, or "POST /refunds/{id}/cancel" when the operation has none.'),
       method: httpMethodSchema,
-      path: external_exports.string().regex(/^\/[^\s?#]*$/, "a path template starts with / and has no query or fragment").describe("The path template, relative to the environment's url."),
-      parameters: external_exports.array(httpParameterSchema).describe("Parameters a security scheme names are never here."),
+      path: external_exports.string().regex(/^\/[^\s?#]*$/, "a path template starts with / and has no query or fragment").describe("The path template, relative to the environment's url, or to base_url when the operation has one."),
+      base_url: httpUrlSchema.optional().describe(
+        "The operation's own server, from the servers list on the operation or its path item, when that list differs from the document's. A call sends to it in every environment."
+      ),
+      parameters: external_exports.array(httpParameterSchema).describe("Every parameter the operation declares. Compile drops one that the server's API key scheme supplies."),
       body: httpBodySchema.optional(),
       response: httpResponseSchema.optional().describe("Absent when no 2xx response has a JSON schema."),
       security: external_exports.array(external_exports.record(external_exports.string().min(1), external_exports.array(external_exports.string()))).optional().describe("The operation's security requirements, as OpenAPI writes them. The gateway adds these.")
@@ -74249,7 +74255,9 @@ var securitySchema;
 var init_operations = __esm({
   "../../packages/mcp-studio/src/openapi/operations.ts"() {
     "use strict";
+    init_primitives();
     init_upstream_tool();
+    init_auth();
     init_json2();
     init_names2();
     init_paging();
@@ -86653,7 +86661,15 @@ function idempotencyInputs(entry2, upstream) {
   const lower = header2.toLowerCase();
   return upstream.request.parameters.filter((parameter) => parameter.in === "header" && parameter.name.toLowerCase() === lower).map((parameter) => parameter.property);
 }
-function shapeInput(key, entry2, upstream, issues) {
+function credentialParameters(auth, upstream) {
+  const apply = auth?.apply;
+  if (apply?.type !== "api_key" || apply.in === void 0 || apply.name === void 0 || upstream.request.kind !== "http") return [];
+  const name = apply.in === "header" ? apply.name.toLowerCase() : apply.name;
+  return upstream.request.parameters.filter(
+    (parameter) => parameter.in === apply.in && (parameter.in === "header" ? parameter.name.toLowerCase() : parameter.name) === name
+  );
+}
+function shapeInput(key, entry2, upstream, supplied, issues) {
   const original = upstream.inputSchema;
   const properties = propertiesOf(original);
   const known = (name) => Object.hasOwn(properties, name);
@@ -86670,6 +86686,7 @@ function shapeInput(key, entry2, upstream, issues) {
     }
   }
   for (const name of idempotencyInputs(entry2, upstream)) removed.add(name);
+  for (const parameter of supplied) removed.add(parameter.property);
   const defaults = Object.entries(entry2.defaults ?? {});
   const rename3 = Object.entries(entry2.rename ?? {});
   if (removed.size === 0 && defaults.length === 0 && rename3.length === 0) return original;
@@ -86780,14 +86797,17 @@ function selectionProblem(selection) {
   if (!/[_A-Za-z]/.test(selection)) return "selection names no field.";
   return void 0;
 }
-function shapeRequest(key, entry2, upstream, issues) {
+function shapeRequest(key, entry2, upstream, supplied, issues) {
   const request3 = upstream.request;
+  if (request3.kind === "http" && supplied.length > 0) {
+    return { ...request3, parameters: request3.parameters.filter((parameter) => !supplied.includes(parameter)) };
+  }
   if (entry2.selection === void 0 || request3.kind !== "graphql") return request3;
   const problem = selectionProblem(entry2.selection);
   if (problem !== void 0) issues.push({ tool: key, field: "selection", message: `${key}: ${problem}` });
   return { ...request3, selection: entry2.selection };
 }
-function compileTool(input, key, entry2, issues) {
+function compileTool(input, key, entry2, auth, issues) {
   const { server, tools } = input;
   if (server.exposure.mode === "search" && SEARCH_MODE_TOOLS.includes(key)) {
     issues.push({
@@ -86806,9 +86826,10 @@ function compileTool(input, key, entry2, issues) {
   }
   const upstream = findUpstream(key, entry2, server.source.type, input.upstream, issues);
   if (upstream === void 0) return void 0;
+  const supplied = credentialParameters(auth, upstream);
   const definition = {
     name,
-    inputSchema: shapeInput(key, entry2, upstream, issues),
+    inputSchema: shapeInput(key, entry2, upstream, supplied, issues),
     annotations: effectiveAnnotations(entry2)
   };
   if (upstream.title !== void 0) definition.title = upstream.title;
@@ -86861,7 +86882,7 @@ function compileTool(input, key, entry2, issues) {
       data_classes: entry2.data_classes ?? []
     },
     shaping,
-    request: shapeRequest(key, entry2, upstream, issues),
+    request: shapeRequest(key, entry2, upstream, supplied, issues),
     upstream
   };
   if (upstream.paging !== void 0) tool.paging = upstream.paging;
@@ -86990,13 +87011,15 @@ function resolveAuth(input, environments2, issues) {
 function compile(input) {
   const { server } = input;
   const issues = [];
+  const serverIssues = [];
+  const environments2 = resolveEnvironments(server, serverIssues);
+  const auth = resolveAuth(input, environments2, serverIssues);
   const tools = {};
   for (const [key, entry2] of Object.entries(input.tools.tools ?? {})) {
-    const tool = compileTool(input, key, entry2, issues);
+    const tool = compileTool(input, key, entry2, auth, issues);
     if (tool !== void 0) tools[key] = tool;
   }
-  const environments2 = resolveEnvironments(server, issues);
-  const auth = resolveAuth(input, environments2, issues);
+  issues.push(...serverIssues);
   let descriptorSet;
   if (server.source.type === "grpc") {
     if (input.descriptor_set === void 0) {
@@ -88359,8 +88382,14 @@ function withQuery(path2, pairs) {
   if (pairs.length === 0) return path2;
   return `${path2}${path2.includes("?") ? "&" : "?"}${pairs.join("&")}`;
 }
-function queryPair(name, value) {
-  return `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;
+function queryValue(value, allowReserved = false) {
+  if (!allowReserved) return encodeURIComponent(value);
+  return value.split(/(%[0-9A-Fa-f]{2})/).map(
+    (part2, index) => index % 2 === 1 ? part2 : encodeURIComponent(part2).replace(/%(?:3A|2F|3F|40|24|2C|3B)/g, (code) => KEPT_RESERVED[code] ?? code)
+  ).join("");
+}
+function queryPair(name, value, allowReserved = false) {
+  return `${encodeURIComponent(name)}=${queryValue(value, allowReserved)}`;
 }
 function httpTarget(endpoint, method, path2) {
   const target2 = relayHttpTargetSchema.safeParse({
@@ -88489,7 +88518,7 @@ async function runHttp(spec) {
   const exchanges = exchange === void 0 ? [] : [exchange];
   return result2.ok ? { ok: true, value: result2.value, attempts: result2.attempts, exchanges } : { ok: false, error: result2.error, attempts: result2.attempts, exchanges };
 }
-var RETRY_STATUSES, MAX_DETAIL;
+var KEPT_RESERVED, RETRY_STATUSES, MAX_DETAIL;
 var init_http_call = __esm({
   "../../packages/mcp-studio/src/execute/http-call.ts"() {
     "use strict";
@@ -88499,6 +88528,15 @@ var init_http_call = __esm({
     init_retry();
     init_util3();
     init_endpoint();
+    KEPT_RESERVED = {
+      "%3A": ":",
+      "%2F": "/",
+      "%3F": "?",
+      "%40": "@",
+      "%24": "$",
+      "%2C": ",",
+      "%3B": ";"
+    };
     RETRY_STATUSES = /* @__PURE__ */ new Set([429, 502, 503, 504]);
     MAX_DETAIL = 1e3;
   }
@@ -107504,7 +107542,8 @@ function headerText(parameter, value) {
 }
 function cookiePairs(parameter, value) {
   const name = checkedName(parameter);
-  const explode = parameter.explode ?? (parameter.style ?? "form") === "form";
+  const style = parameter.style ?? "form";
+  const explode = parameter.explode ?? (style === "form" || style === "cookie");
   const shape = shapeOf(value, parameter.name);
   const pairs = shape.kind === "scalar" ? [[name, shape.text]] : !explode ? [[name, shape.kind === "list" ? shape.items.join(",") : shape.entries.flat().join(",")]] : shape.kind === "list" ? shape.items.map((item) => [name, item]) : shape.entries;
   for (const [cookie, text4] of pairs) {
@@ -107517,7 +107556,7 @@ function cookiePairs(parameter, value) {
   }
   return pairs;
 }
-function entry(name, value, encoded = queryPair(name, value)) {
+function entry(name, value, encoded) {
   return { name, value, encoded };
 }
 function queryEntries(parameter, value) {
@@ -107526,26 +107565,29 @@ function queryEntries(parameter, value) {
   const shape = shapeOf(value, parameter.name);
   const name = parameter.name;
   const enc = encodeURIComponent;
-  if (shape.kind === "scalar") return [entry(name, shape.text)];
+  const reserved = parameter.allow_reserved === true;
+  const val = (text4) => queryValue(text4, reserved);
+  const pair = (key, text4) => entry(key, text4, queryPair(key, text4, reserved));
+  if (shape.kind === "scalar") return [pair(name, shape.text)];
   switch (style) {
     case "form":
     case "spaceDelimited":
     case "pipeDelimited": {
       if (shape.kind === "object") {
-        if (explode) return shape.entries.map(([k, v]) => entry(k, v));
+        if (explode) return shape.entries.map(([k, v]) => pair(k, v));
         const raw2 = shape.entries.flat().join(",");
-        return [entry(name, raw2, `${enc(name)}=${shape.entries.flat().map(enc).join(",")}`)];
+        return [entry(name, raw2, `${enc(name)}=${shape.entries.flat().map(val).join(",")}`)];
       }
       if (shape.items.length === 0) return [];
-      if (explode) return shape.items.map((item) => entry(name, item));
+      if (explode) return shape.items.map((item) => pair(name, item));
       const [raw, delimiter] = style === "form" ? [",", ","] : style === "spaceDelimited" ? [" ", "%20"] : ["|", "|"];
-      return [entry(name, shape.items.join(raw), `${enc(name)}=${shape.items.map(enc).join(delimiter)}`)];
+      return [entry(name, shape.items.join(raw), `${enc(name)}=${shape.items.map(val).join(delimiter)}`)];
     }
     case "deepObject": {
       if (shape.kind !== "object") {
         throw invalidArguments(`The query parameter ${name} uses the deepObject style, so it takes an object.`);
       }
-      return shape.entries.map(([k, v]) => entry(`${name}[${k}]`, v, `${enc(name)}[${enc(k)}]=${enc(v)}`));
+      return shape.entries.map(([k, v]) => entry(`${name}[${k}]`, v, `${enc(name)}[${enc(k)}]=${val(v)}`));
     }
     default:
       throw new BuildError("Invalid request", `The query parameter ${name} cannot use the ${style} style.`);
@@ -107630,7 +107672,7 @@ function interpret2(template) {
   };
 }
 function buildHttpExchange(template, args, context, backoff_ms) {
-  const endpoint = parseEndpoint(context.environment.url, "base");
+  const endpoint = parseEndpoint(template.base_url ?? context.environment.url, "base");
   const path2 = expandTemplate(template, args);
   const idempotencyHeader = context.shaping.idempotency_header;
   const key = context.idempotency_key;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oxagen/cli",
-  "version": "2.1.4-371",
+  "version": "2.1.4-374",
   "description": "Oxagen governance CLI — spend, lineage, grounding, credentials, and audit (agentic coding lives in the stella CLI)",
   "type": "module",
   "bin": {