@workos/oagen 0.30.0 → 0.30.2

package/dist/cli/index.mjs

@@ -2037,6 +2037,27 @@ function resolveParameterRef(raw, componentParameters, operationContext) {
 	}
 	return current;
 }
+/**
+* Resolve a raw request body to a concrete Request Body Object, following
+* `$ref` chains into `components/requestBodies` with a cycle guard. Throws on
+* an unresolvable ref so a malformed spec fails at parse time instead of
+* silently losing the body — and with it the body-ownership rule that keeps
+* duplicated secrets out of the query string.
+*/
+function resolveRequestBodyRef(raw, componentRequestBodies, operationContext) {
+	if (!raw) return void 0;
+	const seenRefs = /* @__PURE__ */ new Set();
+	let current = raw;
+	while ("$ref" in current) {
+		if (seenRefs.has(current.$ref)) throw new Error(`Circular request body $ref chain starting at "${current.$ref}" in ${operationContext}.`);
+		seenRefs.add(current.$ref);
+		const refName = /^#\/components\/requestBodies\/(.+)$/.exec(current.$ref)?.[1].replace(/~1/g, "/").replace(/~0/g, "~");
+		const resolved = refName ? componentRequestBodies?.[refName] : void 0;
+		if (!resolved) throw new Error(`Unresolved request body $ref "${current.$ref}" in ${operationContext}: no matching entry under components/requestBodies.`);
+		current = resolved;
+	}
+	return current;
+}
 const HTTP_METHODS = [
 	"get",
 	"post",
@@ -2047,7 +2068,7 @@ const HTTP_METHODS = [
 	"options",
 	"trace"
 ];
-function extractOperations(paths, operationIdTransform, componentSchemas, componentParameters) {
+function extractOperations(paths, operationIdTransform, componentSchemas, componentParameters, componentRequestBodies) {
 	if (!paths) return {
 		services: [],
 		inlineModels: []
@@ -2060,7 +2081,7 @@ function extractOperations(paths, operationIdTransform, componentSchemas, compon
 			const op = pathItem[method];
 			if (!op) continue;
 			const serviceName = inferServiceName(path, op.tags?.[0]);
-			const { operation, inlineModels: opModels } = buildOperation(method, path, op, pathLevelParams, operationIdTransform, serviceName, componentSchemas, componentParameters);
+			const { operation, inlineModels: opModels } = buildOperation(method, path, op, pathLevelParams, operationIdTransform, serviceName, componentSchemas, componentParameters, componentRequestBodies);
 			inlineModels.push(...opModels);
 			const ops = serviceMap.get(serviceName) ?? [];
 			ops.push(operation);
@@ -2258,10 +2279,10 @@ function extractParameterGroups(op, allIRParams, operationContext) {
 * the request body. Emitters use the group's presence to generate sum-type
 * interfaces and custom JSON marshalling instead of flat optional fields.
 */
-function extractBodyParameterGroups(op, operationContext, componentSchemas) {
+function extractBodyParameterGroups(op, requestBody, operationContext, componentSchemas) {
 	const raw = op["x-mutually-exclusive-body-groups"];
 	if (!raw || typeof raw !== "object") return void 0;
-	const bodySchema = op.requestBody?.content?.["application/json"]?.schema;
+	const bodySchema = requestBody?.content?.["application/json"]?.schema;
 	const variantFieldSchemas = collectVariantFieldSchemas(bodySchema, componentSchemas);
 	const groups = [];
 	for (const [groupName, groupDef] of Object.entries(raw)) {
@@ -2301,8 +2322,9 @@ function extractBodyParameterGroups(op, operationContext, componentSchemas) {
 	}
 	return groups.length > 0 ? groups : void 0;
 }
-function buildOperation(method, path, op, pathLevelParams, operationIdTransform, serviceName, componentSchemas, componentParameters) {
+function buildOperation(method, path, op, pathLevelParams, operationIdTransform, serviceName, componentSchemas, componentParameters, componentRequestBodies) {
 	const opLabel = op.operationId ?? `${method.toUpperCase()} ${path}`;
+	const requestBodyObject = resolveRequestBodyRef(op.requestBody, componentRequestBodies, opLabel);
 	const paramsByIdentity = /* @__PURE__ */ new Map();
 	for (const raw of [...pathLevelParams, ...op.parameters ?? []]) {
 		const param = resolveParameterRef(raw, componentParameters, opLabel);
@@ -2310,13 +2332,21 @@ function buildOperation(method, path, op, pathLevelParams, operationIdTransform,
 	}
 	const allParams = [...paramsByIdentity.values()];
 	const hasIdempotencyHeader = allParams.some((p) => p.in === "header" && p.name.toLowerCase() === "idempotency-key");
+	const groupedQueryNames = collectParameterGroupMemberNames(op);
+	const bodyOwnedNames = /* @__PURE__ */ new Set();
+	if (BODY_CARRYING_METHODS.has(method)) {
+		const bodySchema = selectRequestBodyContent(requestBodyObject).schema;
+		for (const name of collectBodyPropertyNames(bodySchema, componentSchemas)) if (!groupedQueryNames.has(name)) bodyOwnedNames.add(name);
+	}
+	const wireParams = bodyOwnedNames.size > 0 ? allParams.filter((p) => !(p.in === "query" && bodyOwnedNames.has(p.name))) : allParams;
 	const opContext = serviceName;
-	const pathParams = extractParams(allParams, "path", opContext, componentSchemas);
-	const queryParams = extractParams(allParams, "query", opContext, componentSchemas);
-	const headerParams = extractParams(allParams, "header", opContext, componentSchemas).filter((p) => p.name.toLowerCase() !== "idempotency-key");
-	const cookieParams = extractParams(allParams, "cookie", opContext, componentSchemas);
+	const pathParams = extractParams(wireParams, "path", opContext, componentSchemas);
+	const queryParams = extractParams(wireParams, "query", opContext, componentSchemas);
+	const headerParams = extractParams(wireParams, "header", opContext, componentSchemas).filter((p) => p.name.toLowerCase() !== "idempotency-key");
+	const cookieParams = extractParams(wireParams, "cookie", opContext, componentSchemas);
+	const bodyOwnedQueryParams = bodyOwnedNames.size > 0 ? extractParams(allParams.filter((p) => p.in === "query" && bodyOwnedNames.has(p.name)), "query", opContext, componentSchemas) : [];
 	const reqBodyModels = [];
-	const { body: requestBody, encoding: requestBodyEncoding } = extractRequestBody(op.requestBody, op, reqBodyModels);
+	const { body: requestBody, encoding: requestBodyEncoding } = extractRequestBody(requestBodyObject, op, reqBodyModels);
 	const { response, successResponses, errors, inlineModels, isPaginated, dataPath: responseDataPath, itemType: responseItemType } = extractResponses(op.responses, op, path, method, componentSchemas);
 	inlineModels.push(...reqBodyModels);
 	const paginationFromParams = detectPagination(response, queryParams, responseDataPath);
@@ -2338,7 +2368,7 @@ function buildOperation(method, path, op, pathLevelParams, operationIdTransform,
 		...headerParams,
 		...cookieParams
 	], opLabel);
-	const bodyParamGroups = extractBodyParameterGroups(op, opLabel, componentSchemas);
+	const bodyParamGroups = extractBodyParameterGroups(op, requestBodyObject, opLabel, componentSchemas);
 	const parameterGroups = queryParamGroups || bodyParamGroups ? [...queryParamGroups ?? [], ...bodyParamGroups ?? []] : void 0;
 	return {
 		operation: {
@@ -2348,6 +2378,7 @@ function buildOperation(method, path, op, pathLevelParams, operationIdTransform,
 			path,
 			pathParams,
 			queryParams,
+			bodyOwnedQueryParams: bodyOwnedQueryParams.length > 0 ? bodyOwnedQueryParams : void 0,
 			headerParams,
 			cookieParams: cookieParams.length > 0 ? cookieParams : void 0,
 			requestBody,
@@ -2470,26 +2501,91 @@ function resolveSchemaRefObject(schema, componentSchemas) {
 	if (!match) return void 0;
 	return componentSchemas[match[1]];
 }
+/** HTTP methods whose request body is the primary parameter carrier. */
+const BODY_CARRYING_METHODS = new Set([
+	"post",
+	"put",
+	"patch"
+]);
+/**
+* Pick the request body's schema and wire encoding from its content map, in
+* priority order. JSON wins over form encodings; binary and text bodies may
+* legitimately carry no schema at all.
+*/
+function selectRequestBodyContent(body) {
+	const content = body?.content;
+	if (!content) return { encoding: "json" };
+	if (content["application/json"]?.schema) return {
+		encoding: "json",
+		schema: content["application/json"].schema
+	};
+	if (content["multipart/form-data"]?.schema) return {
+		encoding: "form-data",
+		schema: content["multipart/form-data"].schema
+	};
+	if (content["application/x-www-form-urlencoded"]?.schema) return {
+		encoding: "form-urlencoded",
+		schema: content["application/x-www-form-urlencoded"].schema
+	};
+	if (content["application/octet-stream"]) return {
+		encoding: "binary",
+		schema: content["application/octet-stream"].schema
+	};
+	if (content["text/plain"]) return {
+		encoding: "text",
+		schema: content["text/plain"].schema
+	};
+	return { encoding: "json" };
+}
+/** Parameter names referenced by any `x-mutually-exclusive-parameter-groups` variant. */
+function collectParameterGroupMemberNames(op) {
+	const names = /* @__PURE__ */ new Set();
+	const raw = op["x-mutually-exclusive-parameter-groups"];
+	if (!raw || typeof raw !== "object") return names;
+	for (const groupDef of Object.values(raw)) {
+		const variants = groupDef && typeof groupDef === "object" ? groupDef.variants : void 0;
+		if (!variants || typeof variants !== "object") continue;
+		for (const members of Object.values(variants)) {
+			if (!Array.isArray(members)) continue;
+			for (const member of members) if (typeof member === "string") names.add(member);
+		}
+	}
+	return names;
+}
+/**
+* Every property name a request body is guaranteed to accept, following
+* `$ref`s and descending through composition. `allOf` members all apply, so
+* their properties union. `oneOf` / `anyOf` alternatives are choices, so only
+* a property every non-null alternative declares counts — otherwise a caller
+* on another branch would have no slot for the value in either the body or
+* the query. Used to decide which `in: query` declarations are body-owned.
+*/
+function collectBodyPropertyNames(schema, componentSchemas, seen = /* @__PURE__ */ new Set()) {
+	if (!schema) return /* @__PURE__ */ new Set();
+	const ref = schema.$ref;
+	if (ref) {
+		if (seen.has(ref)) return /* @__PURE__ */ new Set();
+		return collectBodyPropertyNames(resolveSchemaRefObject(schema, componentSchemas), componentSchemas, new Set([...seen, ref]));
+	}
+	const names = new Set(Object.keys(schema.properties ?? {}));
+	for (const sub of schema.allOf ?? []) for (const name of collectBodyPropertyNames(sub, componentSchemas, seen)) names.add(name);
+	for (const alternatives of [schema.oneOf, schema.anyOf]) {
+		const branches = (alternatives ?? []).filter((alt) => alt.type !== "null");
+		if (branches.length === 0) continue;
+		let common;
+		for (const branch of branches) {
+			const branchNames = collectBodyPropertyNames(branch, componentSchemas, seen);
+			common = common ? new Set([...common].filter((name) => branchNames.has(name))) : branchNames;
+		}
+		for (const name of common ?? []) names.add(name);
+	}
+	return names;
+}
 function extractRequestBody(body, op, inlineModels) {
 	if (!body?.content) return {};
-	let encoding = "json";
-	let schema;
-	if (body.content["application/json"]?.schema) {
-		encoding = "json";
-		schema = body.content["application/json"].schema;
-	} else if (body.content["multipart/form-data"]?.schema) {
-		encoding = "form-data";
-		schema = body.content["multipart/form-data"].schema;
-	} else if (body.content["application/x-www-form-urlencoded"]?.schema) {
-		encoding = "form-urlencoded";
-		schema = body.content["application/x-www-form-urlencoded"].schema;
-	} else if (body.content["application/octet-stream"]) {
-		encoding = "binary";
-		schema = body.content["application/octet-stream"].schema;
-	} else if (body.content["text/plain"]) {
-		encoding = "text";
-		schema = body.content["text/plain"].schema;
-	}
+	const selected = selectRequestBodyContent(body);
+	const encoding = selected.encoding;
+	let schema = selected.schema;
 	if (!schema) {
 		if (encoding === "binary") return {
 			body: {
@@ -2877,6 +2973,7 @@ function collectInlineEnumsFromOperations(services, enums) {
 	for (const service of services) for (const op of service.operations) for (const param of [
 		...op.pathParams,
 		...op.queryParams,
+		...op.bodyOwnedQueryParams ?? [],
 		...op.headerParams,
 		...op.cookieParams ?? []
 	]) collectInlineEnumFromRef(param.type, enums, enumNames);
@@ -3153,6 +3250,7 @@ function validateModelRefs(spec) {
 		for (const p of [
 			...op.pathParams,
 			...op.queryParams,
+			...op.bodyOwnedQueryParams ?? [],
 			...op.headerParams
 		]) walkRef(p.type, `${service.name}.${op.name}.${p.name}`);
 		if (op.requestBody) walkRef(op.requestBody, `${service.name}.${op.name}.requestBody`);
@@ -3167,7 +3265,7 @@ async function parseSpec(specPath, options) {
 	const version = spec.openapi ?? "";
 	if (!version.startsWith("3.")) throw new SpecParseError(`Unsupported OpenAPI version: ${version}. oagen requires OpenAPI 3.x`, `Update the spec to OpenAPI 3.0 or 3.1. If you are using Swagger 2.x, convert it first with \`npx swagger2openapi ${specPath}\`.`);
 	const { models, enums } = extractSchemas(spec.components?.schemas, { schemaNameTransform: options?.schemaNameTransform });
-	const { services, inlineModels } = extractOperations(spec.paths, options?.operationIdTransform, spec.components?.schemas, spec.components?.parameters);
+	const { services, inlineModels } = extractOperations(spec.paths, options?.operationIdTransform, spec.components?.schemas, spec.components?.parameters, spec.components?.requestBodies);
 	const responseNormalizedModels = mergeInlineResponseModels(models, inlineModels);
 	const fieldInlineModels = extractInlineModelsFromSchemas(spec.components?.schemas);
 	clearSchemaNameTransform();
@@ -6529,6 +6627,7 @@ function collectReferencedNames(services, models, opts = {}) {
 		for (const p of [
 			...op.pathParams,
 			...op.queryParams,
+			...op.bodyOwnedQueryParams ?? [],
 			...op.headerParams,
 			...op.cookieParams ?? []
 		]) collectFromTypeRef(p.type);
@@ -7793,6 +7892,10 @@ function expandDocUrls(spec, docUrl) {
 					...p,
 					description: expand(p.description)
 				})),
+				bodyOwnedQueryParams: op.bodyOwnedQueryParams?.map((p) => ({
+					...p,
+					description: expand(p.description)
+				})),
 				headerParams: op.headerParams.map((p) => ({
 					...p,
 					description: expand(p.description)
@@ -7886,6 +7989,7 @@ function buildDirectionIndex(...specs) {
 		for (const param of [
 			...op.pathParams,
 			...op.queryParams,
+			...op.bodyOwnedQueryParams ?? [],
 			...op.headerParams,
 			...op.cookieParams ?? []
 		]) requestSeeds.push(param.type);
@@ -9229,7 +9333,8 @@ function classifyParameterChanges(baseline, candidate, policy, specRef, language
 			old: { parameter: "(absent)" },
 			new: {
 				parameter: candParam.publicName,
-				required: "true"
+				required: "true",
+				position: String(candParam.position)
 			},
 			message: `Required parameter "${candParam.publicName}" added to "${baseline.displayName}"`,
 			policy,
@@ -9239,7 +9344,10 @@ function classifyParameterChanges(baseline, candidate, policy, specRef, language
 			category,
 			symbol: baseline.fqName,
 			old: { parameter: "(absent)" },
-			new: { parameter: candParam.publicName },
+			new: {
+				parameter: candParam.publicName,
+				position: String(candParam.position)
+			},
 			message: `Optional parameter "${candParam.publicName}" added to "${baseline.displayName}"`,
 			policy,
 			specRef
@@ -9329,6 +9437,7 @@ function specDerivedNames(spec, hints) {
 			for (const p of [
 				...op.pathParams,
 				...op.queryParams,
+				...op.bodyOwnedQueryParams ?? [],
 				...op.headerParams,
 				...op.cookieParams ?? []
 			]) collectTypeRefNames(p.type, names, hints, topLevelEnumNames);