codz-cli 0.0.0-stage → 0.1.0

package/dist/input/apiSpec.js

@@ -0,0 +1,395 @@
+// Reads API description files and turns every operation into the same
+// EndpointSpec that `api add` builds from a cURL command.
+//
+//   OpenAPI 3.x   schemas become models directly (components and inline)
+//   Swagger 2.0   the same, from definitions
+//   Postman 2.x   requests plus their saved example responses (as samples)
+import { parseYamlDocument } from "../core/yamlDoc.js";
+import { ToolError } from "../core/types.js";
+import { stripSecretQuery } from "./curl.js";
+import { analyzePath, buildEndpoint, deriveName } from "./endpoint.js";
+import { signature } from "./infer.js";
+import { isHar, readHar } from "./har.js";
+import { camel, functionName, pascal, singular, typeName } from "./naming.js";
+const METHODS = ['get', 'post', 'put', 'patch', 'delete'];
+const isObj = (v) => !!v && typeof v === 'object' && !Array.isArray(v);
+export function readApiFile(text, opts = {}) {
+    let doc;
+    const t = text.trim();
+    if (t.startsWith('{') || t.startsWith('[')) {
+        try {
+            doc = JSON.parse(t);
+        }
+        catch (e) {
+            throw new ToolError('bad_spec', `The file looks like JSON but does not parse: ${e.message}`);
+        }
+    }
+    else {
+        doc = parseYamlDocument(text);
+    }
+    if (!isObj(doc))
+        throw new ToolError('bad_spec', 'The file is not an OpenAPI, Swagger or Postman document.');
+    if (isHar(doc))
+        return readHar(doc, opts);
+    if (typeof doc.openapi === 'string')
+        return readOpenApi(doc, 'openapi');
+    if (doc.swagger === '2.0' || doc.swagger === 2)
+        return readOpenApi(doc, 'swagger');
+    if (isObj(doc.info) && Array.isArray(doc.item))
+        return readPostman(doc);
+    throw new ToolError('bad_spec', 'Could not tell what this file is.', 'Supported: OpenAPI 3.x and Swagger 2.0 (JSON or YAML), Postman collections (v2.0 or v2.1 JSON) and HAR files from browser DevTools.');
+}
+// ---------------- OpenAPI / Swagger ----------------
+class SchemaConverter {
+    models = new Map();
+    order = [];
+    refNames = new Map();
+    inProgress = new Set();
+    warnings = [];
+    doc;
+    constructor(doc) {
+        this.doc = doc;
+    }
+    resolve(ref) {
+        if (!ref.startsWith('#/')) {
+            this.warnings.push(`External reference ${ref} is not supported; its type is unknown.`);
+            return null;
+        }
+        let cur = this.doc;
+        for (const part of ref.slice(2).split('/'))
+            cur = isObj(cur) ? cur[part.replace(/~1/g, '/').replace(/~0/g, '~')] : undefined;
+        if (!isObj(cur)) {
+            this.warnings.push(`Reference ${ref} was not found; its type is unknown.`);
+            return null;
+        }
+        return { name: ref.split('/').pop(), schema: cur };
+    }
+    uniqueName(base) {
+        let name = typeName(base);
+        if (!this.models.has(name) && !this.inProgress.has(name))
+            return name;
+        let n = 2;
+        while (this.models.has(`${name}${n}`) || this.inProgress.has(`${name}${n}`))
+            n++;
+        return `${name}${n}`;
+    }
+    /** Converts a schema; `nameHint` names inline object models. Returns the type and whether it is nullable. */
+    type(schema, nameHint) {
+        if (!isObj(schema))
+            return { type: { kind: 'unknown' }, nullable: true };
+        if (typeof schema.$ref === 'string') {
+            const ref = schema.$ref;
+            const known = this.refNames.get(ref);
+            if (known)
+                return { type: { kind: 'object', model: known }, nullable: false };
+            const r = this.resolve(ref);
+            if (!r)
+                return { type: { kind: 'unknown' }, nullable: true };
+            const target = Array.isArray(r.schema.allOf) && r.schema.allOf.length > 1 ? this.mergeAllOf(r.schema.allOf) : r.schema;
+            // A referenced schema that is not an object (an enum, a string alias) is inlined.
+            if (!this.isObjectSchema(target))
+                return this.type(target, r.name);
+            const name = this.uniqueName(r.name);
+            this.refNames.set(ref, name);
+            this.objectModel(target, name, false);
+            return { type: { kind: 'object', model: name }, nullable: !!r.schema.nullable };
+        }
+        const types = Array.isArray(schema.type) ? schema.type : schema.type ? [String(schema.type)] : [];
+        const nullable = !!schema.nullable || types.includes('null') || schema['x-nullable'] === true;
+        const t = types.filter((x) => x !== 'null')[0];
+        for (const key of ['oneOf', 'anyOf']) {
+            if (Array.isArray(schema[key])) {
+                const opts = schema[key].filter((o) => !(isObj(o) && o.type === 'null'));
+                if (opts.length === 1) {
+                    const inner = this.type(opts[0], nameHint);
+                    return { type: inner.type, nullable: true };
+                }
+                this.warnings.push(`${nameHint} uses ${key} with several options; its type is unknown.`);
+                return { type: { kind: 'unknown' }, nullable: true };
+            }
+        }
+        if (Array.isArray(schema.allOf)) {
+            const parts = schema.allOf;
+            if (parts.length === 1)
+                return this.type(parts[0], nameHint);
+            const merged = this.mergeAllOf(parts);
+            return { type: { kind: 'object', model: this.objectModel(merged, this.uniqueName(singular(pascal(nameHint))), true) }, nullable };
+        }
+        if (t === 'array' || schema.items) {
+            const item = this.type(schema.items, singular(nameHint) === nameHint ? `${nameHint} Item` : singular(nameHint));
+            return { type: { kind: 'array', item: item.type }, nullable };
+        }
+        if (this.isObjectSchema(schema)) {
+            if (!isObj(schema.properties) || Object.keys(schema.properties).length === 0)
+                return { type: { kind: 'unknown' }, nullable };
+            return { type: { kind: 'object', model: this.objectModel(schema, this.uniqueName(singular(pascal(nameHint))), true) }, nullable };
+        }
+        if (t === 'string')
+            return { type: { kind: schema.format === 'date-time' || schema.format === 'date' ? 'date' : 'string' }, nullable };
+        if (t === 'integer')
+            return { type: { kind: 'int' }, nullable };
+        if (t === 'number')
+            return { type: { kind: 'double' }, nullable };
+        if (t === 'boolean')
+            return { type: { kind: 'bool' }, nullable };
+        return { type: { kind: 'unknown' }, nullable: true };
+    }
+    /** Merges allOf parts (resolving references, including nested allOf) into one object schema. */
+    mergeAllOf(parts, depth = 0) {
+        const merged = { type: 'object', properties: {}, required: [] };
+        for (const part of parts) {
+            let p = isObj(part) && typeof part.$ref === 'string' ? this.resolve(part.$ref)?.schema : part;
+            if (isObj(p) && Array.isArray(p.allOf) && depth < 5)
+                p = this.mergeAllOf(p.allOf, depth + 1);
+            if (!isObj(p))
+                continue;
+            Object.assign(merged.properties, p.properties ?? {});
+            merged.required.push(...(p.required ?? []));
+        }
+        return merged;
+    }
+    isObjectSchema(s) {
+        return s.type === 'object' || isObj(s.properties) || (Array.isArray(s.type) && s.type.includes('object'));
+    }
+    /** `inline` models may merge into an identical earlier model; named (component) models never do. */
+    objectModel(schema, name, inline) {
+        if (this.models.has(name) || this.inProgress.has(name))
+            return name;
+        this.inProgress.add(name);
+        const required = new Set(Array.isArray(schema.required) ? schema.required : []);
+        const fields = [];
+        for (const [key, prop] of Object.entries(isObj(schema.properties) ? schema.properties : {})) {
+            const generic = ['item', 'data', 'detail', 'info', 'meta', 'value', 'result', 'attribute', 'entry', 'option', 'setting'].includes(singular(key.toLowerCase()));
+            const hint = generic ? `${name} ${key}` : key;
+            const { type, nullable } = this.type(prop, hint);
+            fields.push({ jsonName: key, type, nullable: nullable || !required.has(key) });
+        }
+        this.inProgress.delete(name);
+        // Identical inline shapes share one model.
+        const sig = signature(fields);
+        if (inline)
+            for (const [other, m] of this.models)
+                if (other !== name && signature(m.fields) === sig)
+                    return other;
+        this.models.set(name, { name, fields });
+        this.order.push(name);
+        return name;
+    }
+    /** Models needed by the given types, dependencies first. */
+    modelsFor(types) {
+        const need = new Set();
+        const visit = (t) => {
+            if (!t)
+                return;
+            if (t.kind === 'array')
+                return visit(t.item);
+            if (t.kind !== 'object' || need.has(t.model))
+                return;
+            need.add(t.model);
+            for (const f of this.models.get(t.model)?.fields ?? [])
+                visit(f.type);
+        };
+        types.forEach(visit);
+        return this.order.filter((n) => need.has(n)).map((n) => structuredClone(this.models.get(n)));
+    }
+}
+function serverBase(doc, format) {
+    let url = '';
+    if (format === 'openapi' && Array.isArray(doc.servers) && isObj(doc.servers[0])) {
+        url = String(doc.servers[0].url ?? '');
+        const vars = isObj(doc.servers[0].variables) ? doc.servers[0].variables : {};
+        url = url.replace(/\{([^/{}]+)\}/g, (_m, v) => String(isObj(vars[v]) ? vars[v].default ?? '' : ''));
+    }
+    else if (format === 'swagger') {
+        const scheme = Array.isArray(doc.schemes) && doc.schemes.length ? String(doc.schemes.includes('https') ? 'https' : doc.schemes[0]) : 'https';
+        url = doc.host ? `${scheme}://${doc.host}${doc.basePath ?? ''}` : String(doc.basePath ?? '');
+    }
+    if (/^https?:\/\//.test(url)) {
+        try {
+            const u = new URL(url);
+            // A host with quotes, backticks or $ is never written into code: treat the paths as relative instead.
+            if (!/^[A-Za-z0-9.-]+$|^\[[0-9A-Fa-f:.]+\]$/.test(u.hostname))
+                return { origin: '', prefix: '' };
+            return { origin: u.origin, prefix: u.pathname.replace(/\/$/, '') };
+        }
+        catch {
+            // A server URL that is not a URL: treat the paths as relative.
+            return { origin: '', prefix: '' };
+        }
+    }
+    return { origin: '', prefix: url.replace(/\/$/, '') };
+}
+function jsonContent(content) {
+    if (!isObj(content))
+        return undefined;
+    const key = Object.keys(content).find((k) => /json/.test(k)) ?? Object.keys(content).find((k) => k === '*/*');
+    return key && isObj(content[key]) ? content[key].schema : undefined;
+}
+function readOpenApi(doc, format) {
+    const conv = new SchemaConverter(doc);
+    const warnings = [];
+    const { origin, prefix } = serverBase(doc, format);
+    const operations = [];
+    const usedNames = new Set();
+    const paths = isObj(doc.paths) ? doc.paths : {};
+    for (const [rawPath, item] of Object.entries(paths)) {
+        if (!isObj(item))
+            continue;
+        const shared = Array.isArray(item.parameters) ? item.parameters : [];
+        for (const method of METHODS) {
+            const op = item[method];
+            if (!isObj(op))
+                continue;
+            const source = `${method.toUpperCase()} ${rawPath}`;
+            const params = [...shared, ...(Array.isArray(op.parameters) ? op.parameters : [])]
+                .map((p) => (isObj(p) && typeof p.$ref === 'string' ? (() => {
+                let cur = doc;
+                for (const part of p.$ref.slice(2).split('/'))
+                    cur = isObj(cur) ? cur[part] : undefined;
+                return cur;
+            })() : p))
+                .filter(isObj);
+            const fullPath = `${prefix}${rawPath}`;
+            const analysis = analyzePath(fullPath.replace(/\{([^/{}]+)\}/g, ':$1'));
+            const derived = deriveName(method.toUpperCase(), analysis).name;
+            let name = typeof op.operationId === 'string' && op.operationId ? functionName(op.operationId, method, derived) : derived;
+            if (usedNames.has(name)) {
+                let n = 2;
+                while (usedNames.has(`${name}${n}`))
+                    n++;
+                warnings.push(`${source}: the name ${name} is used twice; this one is ${name}${n}.`);
+                name = `${name}${n}`;
+            }
+            usedNames.add(name);
+            const pathParams = analysis.params.map((pp) => {
+                const decl = params.find((p) => p.in === 'path' && camel(String(p.name)) === pp.name);
+                const schema = isObj(decl?.schema) ? decl.schema : decl;
+                const kind = isObj(schema) && (schema.type === 'integer' || schema.type === 'number') ? 'int' : 'string';
+                return { name: pp.name, example: '', type: kind };
+            });
+            const queryParams = params
+                .filter((p) => p.in === 'query' && typeof p.name === 'string')
+                .map((p) => ({ name: String(p.name), type: conv.type(isObj(p.schema) ? p.schema : p, String(p.name)).type }))
+                .filter((q) => q.type.kind !== 'object' && q.type.kind !== 'array');
+            const base = pascal(name);
+            // Request body.
+            let requestSchema;
+            if (format === 'openapi' && isObj(op.requestBody)) {
+                const rb = typeof op.requestBody.$ref === 'string' ? undefined : op.requestBody;
+                requestSchema = jsonContent(rb?.content);
+                if (!requestSchema && isObj(op.requestBody.content))
+                    warnings.push(`${source}: the request body is not JSON (for example a file upload); add it by hand.`);
+            }
+            else if (format === 'swagger') {
+                requestSchema = params.find((p) => p.in === 'body')?.schema;
+                if (params.some((p) => p.in === 'formData'))
+                    warnings.push(`${source}: form data parameters are not generated; add them by hand.`);
+            }
+            const request = requestSchema ? conv.type(requestSchema, `${base} Request`).type : undefined;
+            // Response: the first 2xx with JSON.
+            const responses = isObj(op.responses) ? op.responses : {};
+            const okKey = Object.keys(responses).sort().find((k) => /^2\d\d$|^2XX$/i.test(k)) ?? (responses.default ? 'default' : undefined);
+            let responseSchema;
+            if (okKey && isObj(responses[okKey])) {
+                const r = responses[okKey];
+                responseSchema = format === 'openapi' ? jsonContent(r.content) : r.schema;
+            }
+            const resourceName = analysis.nouns[analysis.nouns.length - 1] ?? 'item';
+            // A list response is named from the plural resource so its items are singular (users → User).
+            const response = responseSchema ? conv.type(responseSchema, resourceName).type : undefined;
+            const spec = {
+                name,
+                method: method.toUpperCase(),
+                origin,
+                serverPrefix: prefix,
+                path: analysis.path,
+                resource: analysis.nouns[0] ?? 'root',
+                pathParams,
+                queryParams,
+                response,
+                unwrapData: false,
+                request,
+                models: conv.modelsFor([response, request]),
+                warnings: [],
+            };
+            operations.push({ spec, tags: Array.isArray(op.tags) ? op.tags.map(String) : [], source });
+        }
+    }
+    const title = isObj(doc.info) ? String(doc.info.title ?? 'API') : 'API';
+    return { format, title, operations, warnings: [...warnings, ...new Set(conv.warnings)] };
+}
+function readPostman(doc) {
+    const vars = new Map();
+    for (const v of Array.isArray(doc.variable) ? doc.variable : [])
+        if (v.key)
+            vars.set(String(v.key), String(v.value ?? ''));
+    const warnings = [];
+    const operations = [];
+    const used = new Set();
+    const visit = (items, folder) => {
+        for (const it of items) {
+            if (Array.isArray(it.item)) {
+                visit(it.item, [...folder, String(it.name ?? '')]);
+                continue;
+            }
+            if (!it.request)
+                continue;
+            const req = typeof it.request === 'string' ? { url: it.request, method: 'GET' } : it.request;
+            const method = String(req.method ?? 'GET').toUpperCase();
+            const urlRaw = typeof req.url === 'string' ? req.url : isObj(req.url) ? String(req.url.raw ?? '') : '';
+            const source = `${it.name ?? method} (${method} ${urlRaw})`;
+            // Resolve {{variables}}; an unresolved leading variable is the base URL.
+            let resolved = urlRaw.replace(/\{\{(\w+)\}\}/g, (m, v) => vars.get(v) ?? m);
+            resolved = resolved.replace(/^\{\{\w+\}\}/, '');
+            if (/\{\{\w+\}\}/.test(resolved))
+                warnings.push(`${source}: unresolved variables were left in the URL.`);
+            resolved = resolved.replace(/\{\{(\w+)\}\}/g, ':$1');
+            let url;
+            try {
+                url = new URL(/^https?:\/\//.test(resolved) ? resolved : `https://api.invalid${resolved.startsWith('/') ? '' : '/'}${resolved}`);
+            }
+            catch {
+                warnings.push(`${source}: the URL could not be read, so it was skipped.`);
+                continue;
+            }
+            stripSecretQuery(url, []);
+            const body = isObj(req.body) && req.body.mode === 'raw' ? String(req.body.raw ?? '') : undefined;
+            const samples = [];
+            for (const r of it.response ?? []) {
+                const code = Number(r.code ?? 200);
+                if (code < 200 || code >= 300 || typeof r.body !== 'string')
+                    continue;
+                try {
+                    samples.push(JSON.parse(r.body));
+                }
+                catch {
+                    // Not JSON; ignore.
+                }
+            }
+            const nameFromItem = it.name && /[A-Za-z]/.test(it.name) ? camel(it.name) : undefined;
+            let name = nameFromItem && nameFromItem.length <= 40 ? nameFromItem : undefined;
+            if (name && used.has(name))
+                name = undefined;
+            try {
+                const spec = buildEndpoint({ method, url, body: body && body.trim() ? body : undefined, responseSamples: samples, name });
+                if (used.has(spec.name)) {
+                    let n = 2;
+                    while (used.has(`${spec.name}${n}`))
+                        n++;
+                    spec.name = `${spec.name}${n}`;
+                }
+                used.add(spec.name);
+                if (!samples.length && method !== 'DELETE') {
+                    spec.warnings = spec.warnings.filter((w) => !w.startsWith('No response sample'));
+                    spec.warnings.push(`The collection has no saved example response, so the response type is unknown. Save an example in Postman, or run codz api update ${spec.name} --sample <file> later.`);
+                }
+                operations.push({ spec, tags: folder.filter(Boolean), source });
+            }
+            catch (e) {
+                warnings.push(`${source}: ${e.message}`);
+            }
+        }
+    };
+    visit(doc.item, []);
+    return { format: 'postman', title: isObj(doc.info) ? String(doc.info.name ?? 'Collection') : 'Collection', operations, warnings };
+}

package/dist/input/curl.js

@@ -0,0 +1,259 @@
+// Parses a pasted cURL command into a neutral request description.
+// Secrets (auth headers, cookies, credentials, tokens in the query) are
+// detected here and never passed on to code generation.
+import { ToolError } from "../core/types.js";
+/** decodeURIComponent that keeps text such as "100%" as it is instead of throwing. */
+export function safeDecode(s) {
+    try {
+        return decodeURIComponent(s.replace(/\+/g, ' '));
+    }
+    catch {
+        return s;
+    }
+}
+/** Splits a shell command line into words, handling quotes, escapes and line continuations. */
+export function shellSplit(input) {
+    const out = [];
+    let cur = '';
+    let hasToken = false;
+    let i = 0;
+    const s = input.replace(/\\\r?\n/g, ' ');
+    while (i < s.length) {
+        const c = s[i];
+        if (c === "'") {
+            const end = s.indexOf("'", i + 1);
+            if (end === -1)
+                throw new ToolError('curl_parse', 'Unclosed single quote in the cURL command.');
+            cur += s.slice(i + 1, end);
+            hasToken = true;
+            i = end + 1;
+        }
+        else if (c === '$' && s[i + 1] === "'") {
+            // ANSI-C quoting: $'...'
+            let j = i + 2;
+            while (j < s.length && s[j] !== "'") {
+                if (s[j] === '\\' && j + 1 < s.length) {
+                    const n = s[j + 1];
+                    cur += n === 'n' ? '\n' : n === 't' ? '\t' : n;
+                    j += 2;
+                }
+                else {
+                    cur += s[j++];
+                }
+            }
+            hasToken = true;
+            i = j + 1;
+        }
+        else if (c === '"') {
+            let j = i + 1;
+            while (j < s.length && s[j] !== '"') {
+                if (s[j] === '\\' && j + 1 < s.length && '"\\$`'.includes(s[j + 1])) {
+                    cur += s[j + 1];
+                    j += 2;
+                }
+                else {
+                    cur += s[j++];
+                }
+            }
+            if (j >= s.length)
+                throw new ToolError('curl_parse', 'Unclosed double quote in the cURL command.');
+            hasToken = true;
+            i = j + 1;
+        }
+        else if (c === '\\' && i + 1 < s.length) {
+            cur += s[i + 1];
+            hasToken = true;
+            i += 2;
+        }
+        else if (/\s/.test(c)) {
+            if (hasToken)
+                out.push(cur);
+            cur = '';
+            hasToken = false;
+            i++;
+        }
+        else {
+            cur += c;
+            hasToken = true;
+            i++;
+        }
+    }
+    if (hasToken)
+        out.push(cur);
+    return out;
+}
+const SECRET_HEADERS = /^(authorization|proxy-authorization|cookie|x-api-key|api-key|apikey|x-auth-token|x-access-token|x-csrf-token|x-xsrf-token|x-amz-security-token)$/i;
+const SECRET_QUERY = /^(api[_-]?key|key|token|access[_-]?token|auth|signature|sig|secret|password|client[_-]?secret)$/i;
+const HARMLESS_HEADERS = /^(content-type|accept|accept-encoding|accept-language|user-agent|connection|cache-control|pragma|origin|referer|sec-.*|dnt|host|content-length|priority|if-none-match|if-modified-since)$/i;
+/** Short options that take a value (so -XPOST means -X POST). */
+const SHORT_WITH_VALUE = new Set(['X', 'H', 'd', 'F', 'u', 'b', 'o', 'w', 'm', 'A', 'e', 'x', 'r', 'c', 'T', 'E', 'K', 'Y', 'y', 'z', 'C', 'P', 'Q', 'U']);
+export const METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'HEAD', 'OPTIONS'];
+function asMethod(value) {
+    const m = value.toUpperCase();
+    if (!METHODS.includes(m))
+        throw new ToolError('curl_parse', `Unsupported HTTP method "${value}".`);
+    return m;
+}
+export function parseUrl(raw) {
+    let text = raw.trim();
+    if (!/^https?:\/\//i.test(text)) {
+        if (text.startsWith('/'))
+            text = `https://api.invalid${text}`;
+        else
+            text = `https://${text}`;
+    }
+    try {
+        return new URL(text);
+    }
+    catch {
+        throw new ToolError('bad_url', `"${raw}" is not a valid URL.`);
+    }
+}
+/** Strips secret query parameters from a URL, recording what was removed. */
+export function stripSecretQuery(url, removed) {
+    for (const key of [...url.searchParams.keys()]) {
+        if (SECRET_QUERY.test(key)) {
+            url.searchParams.delete(key);
+            removed.push(`query parameter "${key}"`);
+        }
+    }
+}
+export function parseCurl(command) {
+    const words = shellSplit(command.trim());
+    if (words[0] !== 'curl')
+        throw new ToolError('curl_parse', 'Expected the command to start with "curl".');
+    let method;
+    let url;
+    const headers = [];
+    const dataParts = [];
+    let forceGet = false;
+    const removedSecrets = [];
+    const ignoredHeaders = [];
+    const form = [];
+    const notes = [];
+    const takesValue = new Set(['-o', '--output', '-w', '--write-out', '-m', '--max-time', '--connect-timeout', '-A', '--user-agent', '-e', '--referer', '--retry', '-x', '--proxy', '--cacert', '--cert', '--key', '-r', '--range', '--limit-rate', '-c', '--cookie-jar']);
+    for (let i = 1; i < words.length; i++) {
+        const w = words[i];
+        const next = () => {
+            const v = words[++i];
+            if (v === undefined)
+                throw new ToolError('curl_parse', `Missing value after ${w}.`);
+            return v;
+        };
+        // Support --flag=value and short flags with the value attached (-XPOST, -HAccept:x, -sSX POST).
+        const eq = w.startsWith('--') ? w.indexOf('=') : -1;
+        let flag = eq > 0 ? w.slice(0, eq) : w;
+        let inline = eq > 0 ? w.slice(eq + 1) : undefined;
+        if (/^-[A-Za-z]{2,}/.test(w) || /^-[A-Za-z]./.test(w)) {
+            // Walk the cluster: boolean letters first, then one letter that takes a value.
+            let k = 1;
+            while (k < w.length && !SHORT_WITH_VALUE.has(w[k]))
+                k++;
+            if (k < w.length) {
+                flag = `-${w[k]}`;
+                inline = w.length > k + 1 ? w.slice(k + 1) : undefined;
+            }
+        }
+        const value = () => inline ?? next();
+        switch (flag) {
+            case '-X':
+            case '--request':
+                method = asMethod(value());
+                break;
+            case '-H':
+            case '--header': {
+                const h = value();
+                const idx = h.indexOf(':');
+                if (idx > 0)
+                    headers.push({ name: h.slice(0, idx).trim(), value: h.slice(idx + 1).trim() });
+                break;
+            }
+            case '-d':
+            case '--data':
+            case '--data-raw':
+            case '--data-binary':
+            case '--data-ascii':
+            case '--data-urlencode':
+                dataParts.push(value());
+                break;
+            case '--json':
+                dataParts.push(value());
+                headers.push({ name: 'Content-Type', value: 'application/json' });
+                break;
+            case '-F':
+            case '--form':
+            case '--form-string': {
+                const f = value();
+                const i2 = f.indexOf('=');
+                const name = i2 > 0 ? f.slice(0, i2) : f;
+                const isFile = flag !== '--form-string' && i2 > 0 && /^[@<]/.test(f.slice(i2 + 1));
+                form.push({ name, file: isFile });
+                break;
+            }
+            case '-G':
+            case '--get':
+                forceGet = true;
+                break;
+            case '-u':
+            case '--user':
+                value();
+                removedSecrets.push('basic auth credentials (-u)');
+                break;
+            case '-b':
+            case '--cookie':
+                value();
+                removedSecrets.push('cookies (-b)');
+                break;
+            case '--oauth2-bearer':
+                value();
+                removedSecrets.push('bearer token (--oauth2-bearer)');
+                break;
+            case '--url':
+                url = value();
+                break;
+            default:
+                if (w.startsWith('-')) {
+                    if (takesValue.has(flag) && inline === undefined)
+                        i++;
+                    // Other flags (-s, -L, -k, -v, --compressed, -i) do not affect the endpoint.
+                }
+                else if (!url) {
+                    url = w;
+                }
+        }
+    }
+    if (!url)
+        throw new ToolError('curl_parse', 'No URL found in the cURL command.');
+    const parsed = parseUrl(url);
+    const kept = [];
+    for (const h of headers) {
+        if (SECRET_HEADERS.test(h.name))
+            removedSecrets.push(`header "${h.name}"`);
+        else if (HARMLESS_HEADERS.test(h.name))
+            kept.push(h);
+        else
+            ignoredHeaders.push(h.name);
+    }
+    stripSecretQuery(parsed, removedSecrets);
+    let body = dataParts.length ? dataParts.join('&') : undefined;
+    if (forceGet && body) {
+        for (const pair of body.split('&')) {
+            const eqAt = pair.indexOf('=');
+            const k = eqAt === -1 ? pair : pair.slice(0, eqAt);
+            const v = eqAt === -1 ? '' : pair.slice(eqAt + 1);
+            if (k)
+                parsed.searchParams.append(safeDecode(k), safeDecode(v));
+        }
+        stripSecretQuery(parsed, removedSecrets);
+        body = undefined;
+    }
+    if (form.length) {
+        if (body !== undefined)
+            notes.push('The command has both -d and -F; only the -F form fields were used.');
+        body = undefined;
+        const files = form.filter((f) => f.file).map((f) => f.name);
+        notes.push(`This is a multipart form upload (${form.map((f) => f.name + (f.file ? ' (file)' : '')).join(', ')}). The generated function sends no body yet${files.length ? `; send ${files.join(', ')} with FormData (Next.js) or Dio's FormData (Flutter)` : ''}.`);
+    }
+    const finalMethod = method ?? (forceGet ? 'GET' : body !== undefined || form.length ? 'POST' : 'GET');
+    return { method: finalMethod, url: parsed, headers: kept, body, removedSecrets, ignoredHeaders, form, notes };
+}