Skip to content

feat: Only accept paginated requests in createPaginator - #1012

Open
razor-x wants to merge 5 commits into
mainfrom
claude/js-sdk-audit-6x115l-m11b-paginator-typegate
Open

feat: Only accept paginated requests in createPaginator#1012
razor-x wants to merge 5 commits into
mainfrom
claude/js-sdk-audit-6x115l-m11b-paginator-typegate

Conversation

@razor-x

@razor-x razor-x commented Aug 24, 2026

Copy link
Copy Markdown
Member

Problem

SDK audit finding M11b (medium): createPaginator accepted any SeamHttpRequest, so seam.createPaginator(seam.devices.get({device_id})) or seam.createPaginator(seam.workspaces.list()) typechecked and failed only at runtime. The accurate SeamHttpEndpointPaginatedQueryPaths type existed in codegen output but was consumed by nothing.

Fix

Pagination support is tracked in a SeamHttpRequest type parameter and expressed through a named, exported alias so signatures read as intent rather than an opaque boolean:

export type SeamPaginatedRequest<TResponse, TResponseKey> =
  SeamHttpRequest<TResponse, TResponseKey, true>

createPaginator<...>(request: SeamPaginatedRequest<TResponse, TResponseKey>): SeamPaginator<...>

Generated request types of paginated endpoints are emitted as SeamPaginatedRequest<...> (e.g. DevicesListRequest), so paginating a non-paginated route is a compile error. Runtime behavior is unchanged — the existing hasPagination runtime guard remains for plain-JS callers. The type-parameter default is boolean, so existing user code holding SeamHttpRequest<R, K> variables keeps compiling everywhere except at the new gate.

Tests

  • new @ts-expect-error assertions: createPaginator(devices.get(...)) and createPaginator(workspaces.list()) are compile errors (on reverted source, typecheck fails — the audit's symptom that these compiled)
  • existing paginator tests and runtime guard test unchanged and green

Regenerated with npm run generate. Full suite (154 tests), lint, typecheck green. Merged with latest main.

Part of applying the rev-3 SDK audit (one PR per finding). Related: #1002#1011.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2

createPaginator accepted any SeamHttpRequest, so paginating a
non-paginated route typechecked and failed only at runtime, or after
the hasPagination guard was added, with a runtime error instead of a
compile error.

Track pagination support in a SeamHttpRequest type parameter set by the
generated route types, and constrain createPaginator to requests from
paginated endpoints, so paginating a non-paginated route is a compile
error. Runtime behavior is unchanged.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
claude added 2 commits August 24, 2026 23:11
A bare boolean type argument in createPaginator's signature was opaque.
Express the pagination gate through an exported SeamPaginatedRequest
alias, used by createPaginator, SeamPaginator, and the generated
request types of paginated endpoints, so signatures read as intent
while non-paginated requests remain a compile error.

Also merges main.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01B8xeJm2Hd923k8uo6eoFd2
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants