run402 1.69.4 → 1.69.5

package/lib/ai.mjs

@@ -1,7 +1,7 @@
 import { resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
-import { resolvePositionalProject } from "./argparse.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, resolvePositionalProject } from "./argparse.mjs";
 
 const HELP = `run402 ai — AI translation and moderation tools
 
@@ -103,20 +103,19 @@ Examples:
 `,
 };
 
-function parseFlag(args, flag) {
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === flag && args[i + 1]) return args[i + 1];
-  }
-  return null;
-}
-
 // translate has value-bearing flags (--to, --from, --context, --project) that
 // must not be mistaken for positional bare args when prefix-matching.
 const TRANSLATE_VALUE_FLAGS = ["--to", "--from", "--context", "--project"];
 
 async function translate(args) {
+  args = normalizeArgv(args);
+  assertKnownFlags(args, TRANSLATE_VALUE_FLAGS, TRANSLATE_VALUE_FLAGS);
+
   // --project <id> wins over positional, mirroring previous behavior.
-  const projectOpt = parseFlag(args, "--project");
+  const projectOpt = flagValue(args, "--project");
+  const to = flagValue(args, "--to");
+  const from = flagValue(args, "--from");
+  const context = flagValue(args, "--context");
   let projectId;
   let rest;
   if (projectOpt) {
@@ -139,10 +138,6 @@ async function translate(args) {
     break;
   }
 
-  const to = parseFlag(args, "--to");
-  const from = parseFlag(args, "--from");
-  const context = parseFlag(args, "--context");
-
   if (!text) {
     fail({
       code: "BAD_USAGE",
@@ -165,7 +160,10 @@ async function translate(args) {
 const MODERATE_VALUE_FLAGS = ["--project"];
 
 async function moderate(args) {
-  const projectOpt = parseFlag(args, "--project");
+  args = normalizeArgv(args);
+  assertKnownFlags(args, MODERATE_VALUE_FLAGS, MODERATE_VALUE_FLAGS);
+
+  const projectOpt = flagValue(args, "--project");
   let projectId;
   let rest;
   if (projectOpt) {
@@ -203,7 +201,10 @@ async function moderate(args) {
 }
 
 async function usage(args) {
-  const projectOpt = parseFlag(args, "--project");
+  args = normalizeArgv(args);
+  assertKnownFlags(args, MODERATE_VALUE_FLAGS, MODERATE_VALUE_FLAGS);
+
+  const projectOpt = flagValue(args, "--project");
   let projectId;
   if (projectOpt) {
     projectId = resolveProjectId(projectOpt);

package/lib/allowance.mjs

@@ -1,6 +1,7 @@
 import { readAllowance, saveAllowance, ALLOWANCE_FILE } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, parseIntegerFlag, positionalArgs } from "./argparse.mjs";
 
 const HELP = `run402 allowance — Manage your agent allowance
 
@@ -258,17 +259,25 @@ async function checkout(args) {
       hint: "Run: run402 allowance create",
     });
   }
-  let amount = null;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--amount" && args[i + 1]) amount = parseInt(args[++i], 10);
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--amount", "--help", "-h"], ["--amount"]);
+  const bare = positionalArgs(parsedArgs, ["--amount"]);
+  if (bare.length > 0) {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unexpected argument for allowance checkout: ${bare[0]}`,
+      details: { argument: bare[0] },
+    });
   }
-  if (!amount) {
+  const amountRaw = flagValue(parsedArgs, "--amount");
+  if (amountRaw === null) {
     fail({
       code: "BAD_USAGE",
       message: "Missing --amount <usd_micros>",
       hint: "e.g. --amount 5000000 for $5",
     });
   }
+  const amount = parseIntegerFlag("--amount", amountRaw, { min: 1 });
   try {
     const data = await getSdk().billing.createCheckout(w.address, amount);
     console.log(JSON.stringify(data, null, 2));
@@ -286,10 +295,17 @@ async function history(args) {
       hint: "Run: run402 allowance create",
     });
   }
-  let limit = 20;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--limit" && args[i + 1]) limit = parseInt(args[++i], 10);
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--limit", "--help", "-h"], ["--limit"]);
+  const bare = positionalArgs(parsedArgs, ["--limit"]);
+  if (bare.length > 0) {
+    fail({
+      code: "BAD_USAGE",
+      message: `Unexpected argument for allowance history: ${bare[0]}`,
+      details: { argument: bare[0] },
+    });
   }
+  const limit = parseIntegerFlag("--limit", flagValue(parsedArgs, "--limit"), { min: 1, def: 20 });
   try {
     const data = await getSdk().billing.history(w.address, limit);
     console.log(JSON.stringify(data, null, 2));

package/lib/argparse.mjs

@@ -75,6 +75,13 @@ export function parseIntegerFlag(name, value, { min = 1, max = Number.POSITIVE_I
     });
   }
   const n = Number.parseInt(raw, 10);
+  if (!Number.isSafeInteger(n)) {
+    fail({
+      code: "BAD_FLAG",
+      message: `${name} must be a safe integer, got: ${raw}`,
+      details: { flag: name, value: raw },
+    });
+  }
   if (n < min) {
     fail({
       code: "BAD_FLAG",

package/lib/auth.mjs

@@ -1,6 +1,7 @@
 import { resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { assertKnownFlags, hasHelp, normalizeArgv } from "./argparse.mjs";
 
 const HELP = `run402 auth — Manage project user authentication
 
@@ -230,6 +231,61 @@ Examples:
 `,
 };
 
+const AUTH_FLAGS = {
+  "magic-link": {
+    known: ["--email", "--redirect", "--intent", "--state", "--project", "--help", "-h"],
+    values: ["--email", "--redirect", "--intent", "--state", "--project"],
+  },
+  "create-user": {
+    known: ["--email", "--admin", "--invite", "--redirect", "--state", "--project", "--help", "-h"],
+    values: ["--email", "--admin", "--redirect", "--state", "--project"],
+  },
+  "invite-user": {
+    known: ["--email", "--redirect", "--admin", "--state", "--project", "--help", "-h"],
+    values: ["--email", "--redirect", "--admin", "--state", "--project"],
+  },
+  verify: {
+    known: ["--token", "--project", "--help", "-h"],
+    values: ["--token", "--project"],
+  },
+  "set-password": {
+    known: ["--token", "--new", "--current", "--project", "--help", "-h"],
+    values: ["--token", "--new", "--current", "--project"],
+  },
+  settings: {
+    known: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--project", "--help", "-h"],
+    values: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--project"],
+  },
+  "passkey-register-options": {
+    known: ["--token", "--app-origin", "--project", "--help", "-h"],
+    values: ["--token", "--app-origin", "--project"],
+  },
+  "passkey-register-verify": {
+    known: ["--token", "--challenge", "--response", "--label", "--project", "--help", "-h"],
+    values: ["--token", "--challenge", "--response", "--label", "--project"],
+  },
+  "passkey-login-options": {
+    known: ["--app-origin", "--email", "--project", "--help", "-h"],
+    values: ["--app-origin", "--email", "--project"],
+  },
+  "passkey-login-verify": {
+    known: ["--challenge", "--response", "--project", "--help", "-h"],
+    values: ["--challenge", "--response", "--project"],
+  },
+  passkeys: {
+    known: ["--token", "--project", "--help", "-h"],
+    values: ["--token", "--project"],
+  },
+  "delete-passkey": {
+    known: ["--token", "--id", "--project", "--help", "-h"],
+    values: ["--token", "--id", "--project"],
+  },
+  providers: {
+    known: ["--project", "--help", "-h"],
+    values: ["--project"],
+  },
+};
+
 function parseFlag(args, flag) {
   for (let i = 0; i < args.length; i++) {
     if (args[i] === flag && args[i + 1]) return args[i + 1];
@@ -557,10 +613,15 @@ async function providers(args) {
 
 export async function run(sub, args) {
   if (!sub || sub === "--help" || sub === "-h") { console.log(HELP); process.exit(0); }
-  if (Array.isArray(args) && (args.includes("--help") || args.includes("-h"))) {
+  args = normalizeArgv(args);
+  if (Array.isArray(args) && hasHelp(args)) {
     console.log(SUB_HELP[sub] || HELP);
     process.exit(0);
   }
+  const flagSpec = AUTH_FLAGS[sub];
+  if (flagSpec) {
+    assertKnownFlags(args, flagSpec.known, flagSpec.values);
+  }
   switch (sub) {
     case "magic-link": await magicLink(args); break;
     case "verify": await verify(args); break;

package/lib/billing.mjs

@@ -1,5 +1,6 @@
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail } from "./sdk-errors.mjs";
+import { parseIntegerFlag } from "./argparse.mjs";
 
 const HELP = `run402 billing — Email billing accounts, Stripe tier checkout, email packs
 
@@ -128,6 +129,23 @@ function parseFlag(args, flag) {
   return null;
 }
 
+function requireSingleBillingIdentifier(email, wallet) {
+  if (email && wallet) {
+    fail({
+      code: "BAD_USAGE",
+      message: "Provide either --email or --wallet, not both.",
+      hint: "[--email <e> | --wallet <w>]",
+    });
+  }
+  if (!email && !wallet) {
+    fail({
+      code: "BAD_USAGE",
+      message: "Must provide --email or --wallet",
+      hint: "[--email <e> | --wallet <w>]",
+    });
+  }
+}
+
 async function createEmail(args) {
   const email = args[0];
   if (!email) {
@@ -174,9 +192,7 @@ async function tierCheckout(args) {
   }
   const email = parseFlag(args, "--email");
   const wallet = parseFlag(args, "--wallet");
-  if (!email && !wallet) {
-    fail({ code: "BAD_USAGE", message: "Must provide --email or --wallet" });
-  }
+  requireSingleBillingIdentifier(email, wallet);
   try {
     const data = await getSdk().billing.tierCheckout(tier, { email: email ?? undefined, wallet: wallet ?? undefined });
     console.log(JSON.stringify(data, null, 2));
@@ -188,9 +204,7 @@ async function tierCheckout(args) {
 async function buyPack(args) {
   const email = parseFlag(args, "--email");
   const wallet = parseFlag(args, "--wallet");
-  if (!email && !wallet) {
-    fail({ code: "BAD_USAGE", message: "Must provide --email or --wallet" });
-  }
+  requireSingleBillingIdentifier(email, wallet);
   try {
     const data = await getSdk().billing.buyEmailPack({ email: email ?? undefined, wallet: wallet ?? undefined });
     console.log(JSON.stringify(data, null, 2));
@@ -210,11 +224,14 @@ async function autoRecharge(args) {
     });
   }
   const thresholdStr = parseFlag(args, "--threshold");
+  const threshold = args.includes("--threshold")
+    ? parseIntegerFlag("--threshold", thresholdStr, { min: 0 })
+    : undefined;
   try {
     await getSdk().billing.setAutoRecharge({
       billingAccountId: accountId,
       enabled: state === "on",
-      threshold: thresholdStr ? Number(thresholdStr) : undefined,
+      threshold,
     });
     console.log(JSON.stringify({ status: "ok", billing_account_id: accountId, enabled: state === "on" }));
   } catch (err) {

package/lib/contracts.mjs

@@ -135,6 +135,15 @@ function parseFlag(args, flag) {
 function hasFlag(args, flag) {
   return args.includes(flag);
 }
+function validateWeiFlag(flag, value) {
+  if (!/^\d+$/.test(String(value))) {
+    fail({
+      code: "BAD_FLAG",
+      message: `${flag} must be a decimal non-negative integer string in wei`,
+      details: { flag, value: String(value) },
+    });
+  }
+}
 
 async function provisionWallet(projectId, args) {
   const chain = parseFlag(args, "--chain");
@@ -210,6 +219,7 @@ async function setAlert(projectId, walletId, args) {
   if (!threshold) {
     fail({ code: "BAD_USAGE", message: "Missing --threshold-wei <n>" });
   }
+  validateWeiFlag("--threshold-wei", threshold);
   try {
     await getSdk().contracts.setLowBalanceAlert(projectId, walletId, threshold);
     console.log(JSON.stringify({ status: "ok", wallet_id: walletId, threshold_wei: threshold }));
@@ -233,6 +243,7 @@ async function call(projectId, walletId, args) {
       hint: "Cost: chain gas + $0.000005 KMS sign fee.",
     });
   }
+  if (value !== null) validateWeiFlag("--value-wei", value);
   const abiFragment = parseFlagJson("--abi", abi);
   const callArgs = parseFlagJson("--args", argsJson);
   try {

package/lib/email.mjs

@@ -1,6 +1,7 @@
 import { resolveProjectId } from "./config.mjs";
 import { getSdk } from "./sdk.mjs";
 import { reportSdkError, fail, parseFlagJson } from "./sdk-errors.mjs";
+import { assertKnownFlags, flagValue, normalizeArgv, parseIntegerFlag, positionalArgs } from "./argparse.mjs";
 
 const HELP = `run402 email — Send emails from your project
 
@@ -152,17 +153,39 @@ Examples:
 `,
 };
 
-function parseFlag(args, flag) {
+function strictFlagValue(args, flag) {
+  const value = flagValue(args, flag);
+  if (typeof value === "string" && value.startsWith("--")) {
+    fail({
+      code: "BAD_FLAG",
+      message: `${flag} requires a value`,
+      details: { flag },
+    });
+  }
+  return value;
+}
+
+function validateArgs(args, knownFlags, flagsWithValues = knownFlags) {
+  assertKnownFlags(args, knownFlags, flagsWithValues);
+  const valueFlags = new Set(flagsWithValues);
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === flag && args[i + 1]) return args[i + 1];
+    const flag = args[i];
+    if (!valueFlags.has(flag)) continue;
+    if (i + 1 >= args.length || (typeof args[i + 1] === "string" && args[i + 1].startsWith("--"))) {
+      fail({
+        code: "BAD_FLAG",
+        message: `${flag} requires a value`,
+        details: { flag },
+      });
+    }
+    i += 1;
   }
-  return null;
 }
 
 function parseVars(args) {
   const vars = {};
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--vars" && args[i + 1]) {
+    if (args[i] === "--vars") {
       const raw = args[++i];
       const parsed = parseFlagJson("--vars", raw);
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
@@ -175,7 +198,7 @@ function parseVars(args) {
     }
   }
   for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--var" && args[i + 1]) {
+    if (args[i] === "--var") {
       const raw = args[++i];
       const eq = raw.indexOf("=");
       if (eq > 0) vars[raw.slice(0, eq)] = raw.slice(eq + 1);
@@ -185,12 +208,9 @@ function parseVars(args) {
 }
 
 async function create(args) {
-  let slug = null;
-  let projectOpt = null;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--project" && args[i + 1]) { projectOpt = args[++i]; }
-    else if (!args[i].startsWith("--") && !slug) { slug = args[i]; }
-  }
+  validateArgs(args, ["--project"]);
+  const slug = positionalArgs(args, ["--project"])[0] ?? null;
+  const projectOpt = strictFlagValue(args, "--project");
   const projectId = resolveProjectId(projectOpt);
   if (!slug) {
     fail({
@@ -209,13 +229,15 @@ async function create(args) {
 }
 
 async function send(args) {
-  const template = parseFlag(args, "--template");
-  const to = parseFlag(args, "--to");
-  const subject = parseFlag(args, "--subject");
-  const html = parseFlag(args, "--html");
-  const text = parseFlag(args, "--text");
-  const fromName = parseFlag(args, "--from-name");
-  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  const valueFlags = ["--template", "--to", "--subject", "--html", "--text", "--from-name", "--project", "--vars", "--var"];
+  validateArgs(args, valueFlags);
+  const template = strictFlagValue(args, "--template");
+  const to = strictFlagValue(args, "--to");
+  const subject = strictFlagValue(args, "--subject");
+  const html = strictFlagValue(args, "--html");
+  const text = strictFlagValue(args, "--text");
+  const fromName = strictFlagValue(args, "--from-name");
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
   const variables = parseVars(args);
 
   if (!to) {
@@ -239,12 +261,14 @@ async function send(args) {
 }
 
 async function list(args) {
-  const projectId = resolveProjectId(parseFlag(args, "--project"));
-  const limit = parseFlag(args, "--limit");
-  const after = parseFlag(args, "--after");
+  const valueFlags = ["--project", "--limit", "--after"];
+  validateArgs(args, valueFlags);
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
+  const limit = strictFlagValue(args, "--limit");
+  const after = strictFlagValue(args, "--after");
   try {
     const data = await getSdk().email.list(projectId, {
-      limit: limit ? Number(limit) : undefined,
+      limit: limit ? parseIntegerFlag("--limit", limit) : undefined,
       after: after ?? undefined,
     });
     console.log(JSON.stringify(data, null, 2));
@@ -254,13 +278,9 @@ async function list(args) {
 }
 
 async function get(args) {
-  let messageId = null;
-  let projectOpt = null;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--project" && args[i + 1]) { projectOpt = args[++i]; }
-    else if (!args[i].startsWith("--") && !messageId) { messageId = args[i]; }
-  }
-  const projectId = resolveProjectId(projectOpt);
+  validateArgs(args, ["--project"]);
+  const messageId = positionalArgs(args, ["--project"])[0] ?? null;
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
   if (!messageId) {
     fail({
       code: "BAD_USAGE",
@@ -277,15 +297,11 @@ async function get(args) {
 }
 
 async function getRaw(args) {
-  let messageId = null;
-  let projectOpt = null;
-  let outputFile = null;
-  for (let i = 0; i < args.length; i++) {
-    if (args[i] === "--project" && args[i + 1]) { projectOpt = args[++i]; }
-    else if (args[i] === "--output" && args[i + 1]) { outputFile = args[++i]; }
-    else if (!args[i].startsWith("--") && !messageId) { messageId = args[i]; }
-  }
-  const projectId = resolveProjectId(projectOpt);
+  const valueFlags = ["--project", "--output"];
+  validateArgs(args, valueFlags);
+  const messageId = positionalArgs(args, valueFlags)[0] ?? null;
+  const outputFile = strictFlagValue(args, "--output");
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
   if (!messageId) {
     fail({
       code: "BAD_USAGE",
@@ -311,19 +327,14 @@ async function getRaw(args) {
 }
 
 async function reply(args) {
-  let messageId = null;
-  let projectOpt = null;
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--project" && args[i + 1]) { projectOpt = args[++i]; }
-    else if (a === "--html" || a === "--text" || a === "--subject" || a === "--from-name") { i++; }
-    else if (!a.startsWith("--") && !messageId) { messageId = a; }
-  }
-  const html = parseFlag(args, "--html");
-  const text = parseFlag(args, "--text");
-  const subjectOverride = parseFlag(args, "--subject");
-  const fromName = parseFlag(args, "--from-name");
-  const projectId = resolveProjectId(projectOpt);
+  const valueFlags = ["--project", "--html", "--text", "--subject", "--from-name"];
+  validateArgs(args, valueFlags);
+  const messageId = positionalArgs(args, valueFlags)[0] ?? null;
+  const html = strictFlagValue(args, "--html");
+  const text = strictFlagValue(args, "--text");
+  const subjectOverride = strictFlagValue(args, "--subject");
+  const fromName = strictFlagValue(args, "--from-name");
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
 
   if (!messageId) {
     fail({
@@ -371,15 +382,9 @@ async function reply(args) {
 }
 
 async function deleteMailbox(args) {
-  let positional = null;
-  let projectOpt = null;
-  for (let i = 0; i < args.length; i++) {
-    const a = args[i];
-    if (a === "--project" && args[i + 1]) { projectOpt = args[++i]; }
-    else if (a === "--confirm") { /* flag */ }
-    else if (!a.startsWith("--") && !positional) { positional = a; }
-  }
-  const projectId = resolveProjectId(projectOpt);
+  validateArgs(args, ["--project", "--confirm"], ["--project"]);
+  const positional = positionalArgs(args, ["--project"])[0] ?? null;
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
   const confirmed = args.includes("--confirm");
 
   if (!confirmed) {
@@ -398,7 +403,8 @@ async function deleteMailbox(args) {
 }
 
 async function status(args) {
-  const projectId = resolveProjectId(parseFlag(args, "--project"));
+  validateArgs(args, ["--project"]);
+  const projectId = resolveProjectId(strictFlagValue(args, "--project"));
   try {
     const mb = await getSdk().email.getMailbox(projectId);
     console.log(JSON.stringify({ status: "ok", mailbox_id: mb.mailbox_id, address: mb.address, slug: mb.slug }));
@@ -408,6 +414,7 @@ async function status(args) {
 }
 
 export async function run(sub, args) {
+  args = normalizeArgv(args);
   if (!sub || sub === '--help' || sub === '-h') { console.log(HELP); process.exit(0); }
   if (Array.isArray(args) && (args.includes("--help") || args.includes("-h")) && sub !== "webhooks") { console.log(SUB_HELP[sub] || HELP); process.exit(0); }
   switch (sub) {