poe-code 4.0.39 → 4.0.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "poe-code",
-  "version": "4.0.39",
+  "version": "4.0.40",
   "description": "CLI tool to configure Poe API for developer workflows.",
   "license": "MIT",
   "type": "module",

package/packages/toolcraft-openapi/dist/generate.js

@@ -550,7 +550,12 @@ function collectRequestBodyParams(document, operation, operationId, method) {
         ? Object.entries(schema.properties)
             .filter(([, property]) => {
             const resolved = resolveBodySchema(document, property, operationId, "requestBody multipart field");
-            return resolved.type === "string" && resolved.format === "binary";
+            if (resolved.type === "string" && resolved.format === "binary")
+                return true;
+            if (resolved.type !== "array" || resolved.items === undefined)
+                return false;
+            const items = resolveBodySchema(document, resolved.items, operationId, "requestBody multipart array item");
+            return items.type === "string" && items.format === "binary";
         })
             .map(([name]) => name)
         : undefined;
@@ -579,10 +584,18 @@ function collectRequestBodyParams(document, operation, operationId, method) {
     const assemblies = [];
     const declaredPropertyCount = Object.keys(schema.properties).length;
     for (const [name, property] of Object.entries(schema.properties)) {
-        const propertySchema = resolveBodySchema(document, property, operationId, `requestBody.properties.${name}`);
-        if (propertySchema.readOnly === true) {
+        const resolvedPropertySchema = resolveBodySchema(document, property, operationId, `requestBody.properties.${name}`);
+        if (resolvedPropertySchema.readOnly === true) {
             continue;
         }
+        const propertySchema = multipartBinaryFields?.includes(name) === true
+            ? {
+                ...resolvedPropertySchema,
+                description: resolvedPropertySchema.description === undefined
+                    ? "Local path, HTTP(S) URL, or base64 value."
+                    : `${resolvedPropertySchema.description} Local path, HTTP(S) URL, or base64 value.`
+            }
+            : resolvedPropertySchema;
         const generated = createBodyField(document, name, propertySchema, bodyOptional || !required.has(name), operationId);
         assemblies.push(generated);
     }
@@ -1564,6 +1577,7 @@ function createCommandFile(options) {
             lines.push(`      multipartBinaryFields: ${JSON.stringify(options.multipartBinaryFields)},`);
             lines.push("      fs,");
             lines.push("      env,");
+            lines.push("      fetch,");
             lines.push("    });");
         }
         else {
@@ -1627,6 +1641,9 @@ function createCommandFile(options) {
     if (usesBinaryOutput) {
         lines.push("    return writeBinaryResponseOutput(result, params.output, { fs, env });");
     }
+    else if (usesRequestShapeVariable) {
+        lines.push("    return result;");
+    }
     lines.push("  },");
     lines.push("});");
     lines.push("");

package/packages/toolcraft-openapi/dist/http.d.ts

@@ -56,6 +56,8 @@ export declare function prepareMultipartFileInputs(requestShape: RequestShape, o
     multipartBinaryFields?: readonly string[];
     fs?: RuntimeFileSystem;
     env?: RuntimeEnvironment;
+    fetch?: typeof globalThis.fetch;
+    signal?: AbortSignal;
 }): Promise<RequestShape>;
 export declare function writeBinaryResponseOutput(result: unknown, outputPath: unknown, runtime: {
     fs?: RuntimeFileSystem;

package/packages/toolcraft-openapi/dist/http.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { isIP } from "node:net";
 import { randomUUID } from "node:crypto";
 import { text as designText } from "toolcraft-design";
 import { HttpError, UserError, createHttpError, shouldEmitDiagnostic } from "toolcraft";
@@ -6,6 +7,10 @@ import { classifyNetworkError } from "./network-error.js";
 import { redactHeaders, redactHeaderValue, redactSensitiveQueryValues } from "./redaction.js";
 export { HttpError };
 const TRANSCRIPT_BODY_BYTE_LIMIT = 4 * 1024;
+const MULTIPART_FILE_BYTE_LIMIT = 100 * 1024 * 1024;
+const MULTIPART_REQUEST_BYTE_LIMIT = 250 * 1024 * 1024;
+const MULTIPART_DOWNLOAD_TIMEOUT_MS = 30_000;
+const MULTIPART_REDIRECT_LIMIT = 5;
 export async function requestJson(options) {
     const token = options.auth === "none" ? undefined : await options.tokenSource.getToken();
     const method = options.method.toUpperCase();
@@ -214,25 +219,174 @@ export async function prepareMultipartFileInputs(requestShape, options) {
         return requestShape;
     }
     const body = { ...requestShape.body };
+    const runtime = {
+        field: "",
+        fs: options.fs,
+        env: options.env,
+        fetch: options.fetch ?? globalThis.fetch,
+        signal: options.signal,
+        totalBytes: 0
+    };
     for (const field of options.multipartBinaryFields) {
         const value = body[field];
-        if (typeof value !== "string") {
-            continue;
-        }
-        const filePath = resolveUserPath(value, options.env);
-        if (!(await options.fs.exists(filePath))) {
+        const sources = Array.isArray(value) ? value : [value];
+        if (sources.some((source) => typeof source !== "string")) {
             continue;
         }
-        body[field] = {
-            data: await options.fs.readFile(filePath, "base64"),
-            filename: path.basename(filePath) || field
-        };
+        runtime.field = field;
+        const resolved = await Promise.all(sources.map((source) => resolveMultipartSource(source, runtime)));
+        body[field] = Array.isArray(value) ? resolved : resolved[0];
     }
     return {
         ...requestShape,
         body
     };
 }
+async function resolveMultipartSource(source, runtime) {
+    if (URL.canParse(source) && source.includes(":")) {
+        const sourceUrl = new URL(source);
+        validateMultipartUrl(sourceUrl, runtime.field);
+        return downloadMultipartSource(sourceUrl, runtime);
+    }
+    const filePath = resolveUserPath(source, runtime.env);
+    if (await runtime.fs.exists(filePath)) {
+        const data = await runtime.fs.readFile(filePath, "base64");
+        accountMultipartBytes(Buffer.byteLength(data, "base64"), source, runtime);
+        return {
+            data,
+            filename: path.basename(filePath) || runtime.field,
+            contentType: inferContentType(filePath)
+        };
+    }
+    if (isValidBase64(source))
+        return source;
+    throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(source)} does not exist.`);
+}
+async function downloadMultipartSource(initialUrl, runtime) {
+    let url = initialUrl;
+    const timeoutSignal = AbortSignal.timeout(MULTIPART_DOWNLOAD_TIMEOUT_MS);
+    const signal = runtime.signal === undefined
+        ? timeoutSignal
+        : AbortSignal.any([runtime.signal, timeoutSignal]);
+    for (let redirects = 0; redirects <= MULTIPART_REDIRECT_LIMIT; redirects += 1) {
+        validateMultipartUrl(url, runtime.field);
+        let response;
+        try {
+            response = await runtime.fetch(url, { redirect: "manual", signal });
+        }
+        catch {
+            throw new UserError(`Could not download multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(redactMultipartUrl(url))}.`);
+        }
+        if (response.status >= 300 && response.status < 400) {
+            const location = response.headers.get("location");
+            if (location === null || redirects === MULTIPART_REDIRECT_LIMIT) {
+                throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(redactMultipartUrl(initialUrl))} exceeded the redirect limit.`);
+            }
+            url = new URL(location, url);
+            continue;
+        }
+        if (!response.ok) {
+            throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(redactMultipartUrl(url))} returned HTTP ${response.status}.`);
+        }
+        const declaredLength = Number(response.headers.get("content-length"));
+        if (Number.isFinite(declaredLength) && declaredLength > MULTIPART_FILE_BYTE_LIMIT) {
+            throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(redactMultipartUrl(url))} exceeds the 100 MiB file limit.`);
+        }
+        const bytes = await readMultipartResponse(response, url, runtime);
+        accountMultipartBytes(bytes.byteLength, redactMultipartUrl(url), runtime);
+        return {
+            data: Buffer.from(bytes).toString("base64"),
+            filename: selectRemoteFilename(response, url, runtime.field),
+            contentType: normalizeContentType(response.headers.get("content-type"))
+        };
+    }
+    throw new UserError("Unexpected multipart redirect state.");
+}
+async function readMultipartResponse(response, url, runtime) {
+    if (response.body === null)
+        return new Uint8Array();
+    const reader = response.body.getReader();
+    const chunks = [];
+    let byteLength = 0;
+    while (true) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        byteLength += value.byteLength;
+        if (byteLength > MULTIPART_FILE_BYTE_LIMIT) {
+            await reader.cancel();
+            throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(redactMultipartUrl(url))} exceeds the 100 MiB file limit.`);
+        }
+        chunks.push(value);
+    }
+    const result = new Uint8Array(byteLength);
+    let offset = 0;
+    for (const chunk of chunks) {
+        result.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return result;
+}
+function validateMultipartUrl(url, field) {
+    if ((url.protocol !== "http:" && url.protocol !== "https:") || url.username || url.password) {
+        throw new UserError(`Multipart field ${JSON.stringify(field)} uses a disallowed URL.`);
+    }
+    const hostname = url.hostname.toLowerCase();
+    if (hostname === "localhost" || hostname.endsWith(".localhost") || isPrivateIpLiteral(hostname)) {
+        throw new UserError(`Multipart field ${JSON.stringify(field)} uses a private network URL.`);
+    }
+}
+function isPrivateIpLiteral(hostname) {
+    const normalized = hostname.startsWith("[") && hostname.endsWith("]")
+        ? hostname.slice(1, -1)
+        : hostname;
+    const version = isIP(normalized);
+    if (version === 4) {
+        const octets = normalized.split(".").map(Number);
+        return octets[0] === 10 || octets[0] === 127 || octets[0] === 0 ||
+            (octets[0] === 169 && octets[1] === 254) ||
+            (octets[0] === 172 && (octets[1] ?? 0) >= 16 && (octets[1] ?? 0) <= 31) ||
+            (octets[0] === 192 && octets[1] === 168);
+    }
+    return version === 6 && (normalized === "::1" || normalized.startsWith("fe80:") || normalized.startsWith("fc") || normalized.startsWith("fd"));
+}
+function accountMultipartBytes(bytes, source, runtime) {
+    if (bytes > MULTIPART_FILE_BYTE_LIMIT) {
+        throw new UserError(`Multipart field ${JSON.stringify(runtime.field)} source ${JSON.stringify(source)} exceeds the 100 MiB file limit.`);
+    }
+    runtime.totalBytes += bytes;
+    if (runtime.totalBytes > MULTIPART_REQUEST_BYTE_LIMIT) {
+        throw new UserError("Multipart file inputs exceed the 250 MiB request limit.");
+    }
+}
+function selectRemoteFilename(response, url, fallback) {
+    const disposition = response.headers.get("content-disposition");
+    const candidate = disposition?.split(";").map((part) => part.trim()).find((part) => part.toLowerCase().startsWith("filename="))?.slice("filename=".length).replaceAll('"', "");
+    return sanitizeFilename(candidate ?? path.posix.basename(url.pathname) ?? fallback, fallback);
+}
+function sanitizeFilename(value, fallback) {
+    const basename = path.basename(value.replaceAll("\\", "/"));
+    const cleaned = Array.from(basename).filter((character) => character >= " " && character !== "\u007f").join("").trim();
+    return cleaned === "" || cleaned === "." || cleaned === ".." ? fallback : cleaned;
+}
+function normalizeContentType(value) {
+    const mediaType = value?.split(";", 1)[0]?.trim().toLowerCase();
+    return mediaType?.includes("/") === true ? mediaType : "application/octet-stream";
+}
+function inferContentType(filePath) {
+    const extension = path.extname(filePath).toLowerCase();
+    return {
+        ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".gif": "image/gif",
+        ".webp": "image/webp", ".pdf": "application/pdf", ".txt": "text/plain", ".json": "application/json",
+        ".wav": "audio/wav", ".mp3": "audio/mpeg", ".mp4": "video/mp4"
+    }[extension] ?? "application/octet-stream";
+}
+function redactMultipartUrl(url) {
+    const redacted = new URL(url);
+    redacted.username = "";
+    redacted.password = "";
+    return redactSensitiveQueryValues(redacted.toString());
+}
 export async function writeBinaryResponseOutput(result, outputPath, runtime) {
     if (outputPath === undefined) {
         return result;
@@ -375,14 +529,16 @@ function decodeMultipartBinaryValue(value, fallbackFilename) {
     if (typeof value === "string") {
         return {
             data: value,
-            filename: fallbackFilename
+            filename: fallbackFilename,
+            contentType: "application/octet-stream"
         };
     }
     if (value !== null &&
         typeof value === "object" &&
         !Array.isArray(value) &&
         typeof value.data === "string" &&
-        typeof value.filename === "string") {
+        typeof value.filename === "string" &&
+        typeof value.contentType === "string") {
         return value;
     }
     throw new UserError("Multipart binary request fields must be base64 strings or resolved file inputs.");
@@ -397,8 +553,11 @@ function serializeMultipartBody(body, binaryFields = []) {
         if (value === undefined)
             continue;
         if (binary.has(key)) {
-            const file = decodeMultipartBinaryValue(value, key);
-            form.append(key, new Blob([decodeBase64Body(file.data)]), file.filename);
+            const values = Array.isArray(value) ? value : [value];
+            for (const item of values) {
+                const file = decodeMultipartBinaryValue(item, key);
+                form.append(key, new Blob([decodeBase64Body(file.data)], { type: file.contentType }), file.filename);
+            }
         }
         else if (Array.isArray(value)) {
             for (const item of value)

package/packages/toolcraft-openapi/dist/runtime.js

@@ -134,7 +134,8 @@ function createRuntimeHandler(command) {
             bodyMode: command.bodyMode,
             multipartBinaryFields: command.multipartBinaryFields,
             fs,
-            env
+            env,
+            fetch
         });
         const result = await requestJson({
             baseUrl: command.baseUrl ?? baseUrl,