@pome-sh/cli 0.21.13 → 0.21.15

package/dist/{src-JWB5RQSN.js → src-ECRGORXR.js}

@@ -1,7 +1,8 @@
-export { LINEAR_CHECKS } from './chunk-3QVSXFJI.js';
+export { LINEAR_CHECKS } from './chunk-XBT6ZLBG.js';
 import { MCP_PAGE_MAX, defaultSeedState, linearSeedSchema, notFound, badUserInput, MCP_PAGE_DEFAULT, DEFAULT_LINEAR_EMAIL, RELAY_PAGE_MAX, RELAY_PAGE_DEFAULT, STATE_EXPORT_CAP, parseSeed, DEFAULT_LINEAR_CLOCK, LINEAR_PROVIDER_TOKEN_PREFIX, DEFAULT_LINEAR_SID, DEFAULT_SCOPES, linearErrorEnvelope, unauthorizedEnvelope, unsupportedEnvelope, assertWebhookUrl, ACCESS_TOKEN_TTL_SECONDS, OAUTH_CODE_TTL_SECONDS, TITLE_MAX_BYTES, BODY_MAX_BYTES, LinearTwinError, GRAPHQL_QUERY_MAX_BYTES, GRAPHQL_SELECTION_DEPTH_MAX } from './chunk-ZKID2HS3.js';
 export { DEFAULT_LINEAR_CLOCK, DEFAULT_LINEAR_EMAIL, DEFAULT_LINEAR_PORT, DEFAULT_LINEAR_SID, DEFAULT_LINEAR_TOKEN, LINEAR_PROVIDER_TOKEN_PREFIX, LinearTwinError, STATE_EXPORT_CAP, assertWebhookUrl, defaultSeedState, linearErrorEnvelope, linearSeedSchema, loadSeedFromEnv, parseSeed, unauthorizedEnvelope, unsupportedEnvelope, webhookUrlError } from './chunk-ZKID2HS3.js';
-import './chunk-NY55QTVQ.js';
+import './chunk-JWJYNAWI.js';
+import { declareRouteInputs, mountDeclaredRoute, UndeclaredInputError } from './chunk-4MQULI7E.js';
 import { loadMcpToolFixture, deriveMcpToolTable, openTwinDatabase, defineTwin, createApp } from './chunk-TV5S6WQV.js';
 import './chunk-VBATFCWR.js';
 import './chunk-SG6ZTIMT.js';
@@ -3358,16 +3359,105 @@ function shouldRedact(key) {
     return true;
   return false;
 }
+var VARIABLES_STRING = z.string().optional();
+var VARIABLES_OBJECT = z.union([z.record(z.string(), z.unknown()), z.string()]).optional();
+var AUTHORIZE_PARAMS = {
+  client_id: z.string().optional(),
+  redirect_uri: z.string().optional(),
+  state: z.string().optional(),
+  scope: z.string().optional(),
+  actor: z.string().optional(),
+  code_challenge: z.string().optional(),
+  code_challenge_method: z.string().optional()
+};
+var LINEAR_ROUTES = {
+  graphqlGet: declareRouteInputs({
+    method: "GET",
+    path: "/graphql",
+    query: {
+      query: z.string().optional(),
+      variables: VARIABLES_STRING,
+      operationName: z.string().optional()
+    }
+  }),
+  graphqlPost: declareRouteInputs({
+    method: "POST",
+    path: "/graphql",
+    bodyEncoding: "form",
+    body: {
+      query: z.string().optional(),
+      variables: VARIABLES_OBJECT,
+      operationName: z.string().optional()
+    }
+  }),
+  oauthAuthorize: declareRouteInputs({
+    method: "GET",
+    path: "/oauth/authorize",
+    query: { ...AUTHORIZE_PARAMS, response_type: z.string().optional() }
+  }),
+  oauthAuthorizeCallback: declareRouteInputs({
+    method: "POST",
+    path: "/oauth/authorize/callback",
+    bodyEncoding: "form",
+    // `user_ref` is the twin's own field: the consent page renders one form per
+    // Linear user and posts back which one was picked. Real Linear has no
+    // equivalent, and declaring it says so out loud.
+    body: { ...AUTHORIZE_PARAMS, user_ref: z.string().optional() }
+  }),
+  oauthToken: declareRouteInputs({
+    method: "POST",
+    path: "/oauth/token",
+    bodyEncoding: "form",
+    // Client credentials arrive EITHER as HTTP Basic or as body fields, so both
+    // are declared; `clientCredentials()` prefers the header.
+    headers: { Authorization: z.string().optional() },
+    body: {
+      grant_type: z.string().optional(),
+      client_id: z.string().optional(),
+      client_secret: z.string().optional(),
+      code: z.string().optional(),
+      redirect_uri: z.string().optional(),
+      code_verifier: z.string().optional(),
+      refresh_token: z.string().optional(),
+      scope: z.string().optional()
+    }
+  }),
+  oauthRevoke: declareRouteInputs({
+    method: "POST",
+    path: "/oauth/revoke",
+    bodyEncoding: "form",
+    body: {
+      token: z.string().optional(),
+      access_token: z.string().optional(),
+      refresh_token: z.string().optional()
+    }
+  })
+};
+
+// ../packages/twin-linear/dist/src/oauth/routes.js
+async function parseDeclared(declaration, c, onUndeclared) {
+  try {
+    return { input: await declaration.parse(c.req) };
+  } catch (error) {
+    if (error instanceof UndeclaredInputError)
+      return { response: onUndeclared(error) };
+    throw error;
+  }
+}
 function registerOAuthRoutes(app, commands) {
-  app.get("/oauth/authorize", (c) => {
-    const clientId = c.req.query("client_id") ?? "";
-    const redirectUri = c.req.query("redirect_uri") ?? "";
-    const responseType = c.req.query("response_type") ?? "code";
-    const state = c.req.query("state") ?? "";
-    const scope = c.req.query("scope") ?? "read";
-    const requestedActor = normalizeActor(c.req.query("actor"));
-    const codeChallenge = c.req.query("code_challenge") ?? "";
-    const codeChallengeMethod = c.req.query("code_challenge_method") ?? "";
+  mountDeclaredRoute(app, LINEAR_ROUTES.oauthAuthorize, async (c) => {
+    const parsed = await parseDeclared(LINEAR_ROUTES.oauthAuthorize, c, (error) => c.html(errorPage("Unknown parameter", `The ${error.first} parameter is not supported.`), 400));
+    if ("response" in parsed)
+      return parsed.response;
+    const query = parsed.input.query;
+    const clientId = query.client_id ?? "";
+    const redirectUri = query.redirect_uri ?? "";
+    const responseType = query.response_type ?? "code";
+    const state = query.state ?? "";
+    const scope = query.scope ?? "read";
+    const requestedActor = normalizeActor(query.actor);
+    const codeChallenge = query.code_challenge ?? "";
+    const codeChallengeMethod = query.code_challenge_method ?? "";
     if (responseType !== "code") {
       return c.html(errorPage("Unsupported response_type", "Only response_type=code is supported."), 400);
     }
@@ -3427,8 +3517,11 @@ function registerOAuthRoutes(app, commands) {
     })).join("\n");
     return c.html(cardPage(title, `Continue to <strong>${escapeHtml(appName)}</strong> with scopes <strong>${escapeHtml(requestedScopes.join(", "))}</strong>.`, buttons || '<p class="empty">No users in the Linear twin store.</p>'));
   });
-  app.post("/oauth/authorize/callback", async (c) => {
-    const body = await c.req.parseBody();
+  mountDeclaredRoute(app, LINEAR_ROUTES.oauthAuthorizeCallback, async (c) => {
+    const parsed = await parseDeclared(LINEAR_ROUTES.oauthAuthorizeCallback, c, (error) => c.html(errorPage("Unknown parameter", `The ${error.first} parameter is not supported.`), 400));
+    if ("response" in parsed)
+      return parsed.response;
+    const body = parsed.input.body;
     const clientId = bodyStr(body.client_id);
     const redirectUri = bodyStr(body.redirect_uri);
     const state = bodyStr(body.state);
@@ -3479,10 +3572,13 @@ function registerOAuthRoutes(app, commands) {
       url.searchParams.set("state", state);
     return c.redirect(url.toString());
   });
-  app.post("/oauth/token", async (c) => {
-    const body = await c.req.parseBody();
+  mountDeclaredRoute(app, LINEAR_ROUTES.oauthToken, async (c) => {
+    const parsed = await parseDeclared(LINEAR_ROUTES.oauthToken, c, (error) => oauthError("invalid_request", `Unknown parameter: ${error.first}.`));
+    if ("response" in parsed)
+      return parsed.response;
+    const { body, header } = parsed.input;
     const grantType = bodyStr(body.grant_type);
-    const clientAuth = clientCredentials(c.req.header("Authorization"), body);
+    const clientAuth = clientCredentials(header.Authorization, body);
     const oauthApp = requireRegisteredOAuthApp(commands, clientAuth.clientId);
     if (!oauthApp) {
       return oauthError("invalid_client", "The OAuth app is not registered.");
@@ -3552,8 +3648,11 @@ function registerOAuthRoutes(app, commands) {
     }
     return oauthError("unsupported_grant_type", "Only authorization_code, refresh_token, and client_credentials are supported.");
   });
-  app.post("/oauth/revoke", async (c) => {
-    const body = await c.req.parseBody();
+  mountDeclaredRoute(app, LINEAR_ROUTES.oauthRevoke, async (c) => {
+    const parsed = await parseDeclared(LINEAR_ROUTES.oauthRevoke, c, (error) => oauthError("invalid_request", `Unknown parameter: ${error.first}.`));
+    if ("response" in parsed)
+      return parsed.response;
+    const body = parsed.input.body;
     const value = bodyStr(body.token) || bodyStr(body.access_token) || bodyStr(body.refresh_token);
     if (value)
       commands.revokeToken(value);
@@ -4953,21 +5052,34 @@ var linearGraphQLSchema = buildSchema(`
 
 // ../packages/twin-linear/dist/src/graphql/routes.js
 function registerGraphqlRoutes(app, ctx) {
-  app.get("/graphql", ctx.recorder.handle({ mutation: false }, async (c) => {
-    const query = c.req.query("query") ?? "";
-    return executeRecordedGraphQL(ctx, c, query, {
-      variables: parseVariables(c.req.query("variables")),
-      operationName: c.req.query("operationName") ?? void 0
+  mountDeclaredRoute(app, LINEAR_ROUTES.graphqlGet, ctx.recorder.handle({ mutation: false }, async (c) => {
+    const { query } = await parseDeclared2(LINEAR_ROUTES.graphqlGet, c);
+    return executeRecordedGraphQL(ctx, c, query.query ?? "", {
+      variables: parseVariables(query.variables),
+      operationName: query.operationName
     });
   }));
-  app.post("/graphql", ctx.recorder.handle({ mutation: false }, async (c) => {
-    const body = await readGraphQLBody(c);
-    return executeRecordedGraphQL(ctx, c, body.query, {
-      variables: body.variables,
+  mountDeclaredRoute(app, LINEAR_ROUTES.graphqlPost, ctx.recorder.handle({ mutation: false }, async (c) => {
+    const { body } = await parseDeclared2(LINEAR_ROUTES.graphqlPost, c);
+    return executeRecordedGraphQL(ctx, c, body.query ?? "", {
+      // Form-posted variables arrive as a JSON string, JSON-posted ones as an
+      // object. The declaration accepts both spellings, so both are handled
+      // here rather than at two content-type-sniffing call sites.
+      variables: typeof body.variables === "string" ? parseVariables(body.variables) : body.variables,
       operationName: body.operationName
     });
   }));
 }
+async function parseDeclared2(declaration, c) {
+  try {
+    return await declaration.parse(c.req);
+  } catch (error) {
+    if (error instanceof UndeclaredInputError) {
+      badUserInput(`Unknown ${error.location} parameter: ${error.first}`);
+    }
+    throw error;
+  }
+}
 async function executeRecordedGraphQL(ctx, c, query, opts) {
   const before = ctx.domain.exportState();
   const result = await runGraphQL(ctx.domain, c, query, opts);
@@ -5058,23 +5170,6 @@ function isMutationOperation(source, operationName) {
     return /^\s*mutation\b/i.test(source);
   }
 }
-async function readGraphQLBody(c) {
-  const contentType = c.req.header("content-type") ?? "";
-  if (contentType.includes("application/x-www-form-urlencoded")) {
-    const body2 = await c.req.parseBody();
-    return {
-      query: typeof body2.query === "string" ? body2.query : "",
-      variables: parseVariables(typeof body2.variables === "string" ? body2.variables : void 0),
-      operationName: typeof body2.operationName === "string" && body2.operationName ? body2.operationName : void 0
-    };
-  }
-  const body = await c.req.json().catch(() => ({}));
-  return {
-    query: typeof body.query === "string" ? body.query : "",
-    variables: isRecord(body.variables) ? body.variables : void 0,
-    operationName: typeof body.operationName === "string" ? body.operationName : void 0
-  };
-}
 function parseVariables(raw) {
   if (!raw)
     return void 0;