chore: validate config arguments using Zod

This removes a lot of boilerplate validation code and makes the UserConfigSchema the main entry point for our parsing. There's actually a couple more follow-ups I want to do with i.e. storing secrets but don't want to make this too big.

Author: gagik

eslint-rules/enforce-zod-v4.js

@@ -3,6 +3,7 @@ import path from "path";
 
 // The file that is allowed to import from zod/v4
 const configFilePath = path.resolve(import.meta.dirname, "../src/common/config.ts");
+const schemasFilePath = path.resolve(import.meta.dirname, "../src/common/schemas.ts");
 
 // Ref: https://eslint.org/docs/latest/extend/custom-rules
 export default {
@@ -22,8 +23,7 @@ export default {
     create(context) {
         const currentFilePath = path.resolve(context.getFilename());
 
-        // Only enforce rule in config.ts
-        if (currentFilePath !== configFilePath) {
+        if (currentFilePath === configFilePath || currentFilePath === schemasFilePath) {
             return {};
         }
 
@@ -36,11 +36,9 @@ export default {
                     return;
                 }
 
-                // If importing from 'zod' or any 'zod/...' except 'zod/v4', only allow 'zod/v4' in config.ts
-                const isZodImport = importPath === "zod" || importPath.startsWith("zod/");
                 const isZodV4Import = importPath === "zod/v4";
 
-                if (isZodImport && !isZodV4Import) {
+                if (isZodV4Import) {
                     context.report({
                         node,
                         messageId: "enforceZodV4",

scripts/generateArguments.ts

@@ -11,9 +11,10 @@
 import { readFileSync, writeFileSync } from "fs";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
-import { OPTIONS, UserConfigSchema, defaultUserConfig, configRegistry } from "../src/common/config.js";
+import { UserConfigSchema, configRegistry } from "../src/common/config.js";
 import assert from "assert";
 import { execSync } from "child_process";
+import { OPTIONS } from "../src/common/argsParserOptions.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -68,7 +69,8 @@ function extractZodDescriptions(): Record<string, ConfigMetadata> {
         let description = schema.description || `Configuration option: ${key}`;
 
         if ("innerType" in schema.def) {
-            if (schema.def.innerType.def.type === "array") {
+            // "pipe" is used for our comma-separated arrays
+            if (schema.def.innerType.def.type === "pipe") {
                 assert(
                     description.startsWith("An array of"),
                     `Field description for field "${key}" with array type does not start with 'An array of'`
@@ -255,9 +257,7 @@ function generateReadmeConfigTable(argumentInfos: ArgumentInfo[]): string {
         const cliOption = `\`${argumentInfo.configKey}\``;
         const envVarName = `\`${argumentInfo.name}\``;
 
-        // Get default value from Zod schema or fallback to defaultUserConfig
-        const config = defaultUserConfig as unknown as Record<string, unknown>;
-        const defaultValue = argumentInfo.defaultValue ?? config[argumentInfo.configKey];
+        const defaultValue = argumentInfo.defaultValue;
 
         let defaultValueString = argumentInfo.defaultValueDescription ?? "`<not set>`";
         if (!argumentInfo.defaultValueDescription && defaultValue !== undefined && defaultValue !== null) {

src/common/argsParserOptions.ts

@@ -0,0 +1,109 @@
+type ArgsParserOptions = {
+    string: string[];
+    number: string[];
+    boolean: string[];
+    array: string[];
+    alias: Record<string, string>;
+    configuration: Record<string, boolean>;
+};
+
+// TODO: Export this from arg-parser or find a better way to do this
+// From: https://github.com/mongodb-js/mongosh/blob/main/packages/cli-repl/src/arg-parser.ts
+export const OPTIONS = {
+    number: ["maxDocumentsPerQuery", "maxBytesPerQuery"],
+    string: [
+        "apiBaseUrl",
+        "apiClientId",
+        "apiClientSecret",
+        "connectionString",
+        "httpHost",
+        "httpPort",
+        "idleTimeoutMs",
+        "logPath",
+        "notificationTimeoutMs",
+        "telemetry",
+        "transport",
+        "apiVersion",
+        "authenticationDatabase",
+        "authenticationMechanism",
+        "browser",
+        "db",
+        "gssapiHostName",
+        "gssapiServiceName",
+        "host",
+        "oidcFlows",
+        "oidcRedirectUri",
+        "password",
+        "port",
+        "sslCAFile",
+        "sslCRLFile",
+        "sslCertificateSelector",
+        "sslDisabledProtocols",
+        "sslPEMKeyFile",
+        "sslPEMKeyPassword",
+        "sspiHostnameCanonicalization",
+        "sspiRealmOverride",
+        "tlsCAFile",
+        "tlsCRLFile",
+        "tlsCertificateKeyFile",
+        "tlsCertificateKeyFilePassword",
+        "tlsCertificateSelector",
+        "tlsDisabledProtocols",
+        "username",
+        "atlasTemporaryDatabaseUserLifetimeMs",
+        "exportsPath",
+        "exportTimeoutMs",
+        "exportCleanupIntervalMs",
+        "voyageApiKey",
+    ],
+    boolean: [
+        "apiDeprecationErrors",
+        "apiStrict",
+        "disableEmbeddingsValidation",
+        "help",
+        "indexCheck",
+        "ipv6",
+        "nodb",
+        "oidcIdTokenAsAccessToken",
+        "oidcNoNonce",
+        "oidcTrustedEndpoint",
+        "readOnly",
+        "retryWrites",
+        "ssl",
+        "sslAllowInvalidCertificates",
+        "sslAllowInvalidHostnames",
+        "sslFIPSMode",
+        "tls",
+        "tlsAllowInvalidCertificates",
+        "tlsAllowInvalidHostnames",
+        "tlsFIPSMode",
+        "version",
+    ],
+    array: ["disabledTools", "loggers", "confirmationRequiredTools", "previewFeatures"],
+    alias: {
+        h: "help",
+        p: "password",
+        u: "username",
+        "build-info": "buildInfo",
+        browser: "browser",
+        oidcDumpTokens: "oidcDumpTokens",
+        oidcRedirectUrl: "oidcRedirectUri",
+        oidcIDTokenAsAccessToken: "oidcIdTokenAsAccessToken",
+    },
+    configuration: {
+        "camel-case-expansion": false,
+        "unknown-options-as-args": true,
+        "parse-positional-numbers": false,
+        "parse-numbers": false,
+        "greedy-arrays": true,
+        "short-option-groups": false,
+    },
+} as Readonly<ArgsParserOptions>;
+
+export const ALL_CONFIG_KEYS = new Set(
+    (OPTIONS.string as readonly string[])
+        .concat(OPTIONS.number)
+        .concat(OPTIONS.array)
+        .concat(OPTIONS.boolean)
+        .concat(Object.keys(OPTIONS.alias))
+);