Add workflow sink commands and typed sink flags

[jordiori]

Resolves RAW-539.

Workflow sinks could only be passed as raw JSON through --sink, with two examples in the help as the only hint at the shape. Changing one sink meant re-sending the whole list with every existing sink ID.

Changes

• rtree workflow sink list|create|update|delete manages one sink at a time. The CLI reads the current list and sends the other sinks back by ID, since the API replaces the whole list.
• rtree workflow sink schema [--type table|http] lists each sink type's fields, rules, and examples (JSON with --json). It needs no login.
• workflow create gains --sink-table, --sink-http, and --sink-header.
• --sink on create and update also takes an array, @path, or - for stdin.
• The CLI checks only the shape of each sink before sending it: known fields, required fields, and JSON types. Values and limits (URLs, identifiers, sink counts) are left to the API. Shape errors name the sink and field, show an example, and point to sink schema; header values are never echoed. Sink input errors exit as validation_error (2); a missing sink as not_found (4).

Examples

Typed flags:

rtree workflow create --name alerts --database analytics --sql "SELECT 1" \
  --sink-table alerts \
  --sink-http https://example.com/hook --sink-header 'Authorization: Bearer ...'

One sink at a time:

rtree workflow sink list <workflow-id>
rtree workflow sink create <workflow-id> --table analytics.audit
rtree workflow sink create <workflow-id> --http https://example.com/hook --header 'Authorization: Bearer ...'
rtree workflow sink update <workflow-id> <sink-id> --header 'Authorization: Bearer rotated'
rtree workflow sink update <workflow-id> <sink-id> --remove-header X-Team
rtree workflow sink update <workflow-id> <sink-id> --table alerts_v2
rtree workflow sink delete <workflow-id> <sink-id>
rtree workflow sink schema --type http

JSON, inline or as an array:

rtree workflow create --name alerts --database analytics --sql "SELECT 1" \
  --sink '[{"type":"table","settings":{"database":"analytics","table":"alerts"}},
           {"type":"http","settings":{"url":"https://example.com/hook"}}]'

From a file or stdin, which keeps header credentials out of shell history:

cat > sinks.json <<'JSON'
[
  {"type": "table", "settings": {"database": "analytics", "table": "alerts"}},
  {"type": "http", "settings": {"url": "https://example.com/hook",
                                "headers": {"Authorization": "Bearer ..."}}}
]
JSON

rtree workflow create --name alerts --database analytics --sql "SELECT 1" --sink @sinks.json
cat sinks.json | rtree workflow create --name alerts --database analytics --sql "SELECT 1" --sink -

Replacing the full list keeps existing sinks by ID; an existing HTTP sink needs only its ID to keep its URL and headers:

rtree workflow update <workflow-id> --sink '[
  {"type": "table", "id": "<table-sink-id>", "settings": {"database": "analytics", "table": "alerts"}},
  {"type": "http", "id": "<http-sink-id>"},
  {"type": "table", "settings": {"database": "analytics", "table": "audit"}}
]'

Local validation:

$ rtree workflow update <workflow-id> --sink '{"type":"table","settings":{"database":"analytics"}}'
Error: invalid table sink #1: settings.table is required.
Expected, e.g.: {"type":"table","settings":{"database":"analytics","table":"alerts"}}
Run `rtree workflow sink schema --type table` for every field.

---

Note

Medium Risk
Changes how workflow results are routed (tables/webhooks) and how HTTP sink credentials are merged on update; mistakes or concurrent sink edits could misconfigure delivery, though the API still enforces limits.

Overview
Workflow sink configuration moves from raw JSON-only --sink to typed flags, dedicated subcommands, and local shape validation before API calls.

workflow create adds --sink-table, --sink-http, and --sink-header (header only with a single HTTP URL). --sink on create/update now accepts a JSON object or array, @path, or stdin; create blocks using both --sql - and --sink -.

rtree workflow sink adds list, create, update, delete, and schema (no auth). Per-sink changes GET the workflow, rebuild the full sink list (unchanged sinks sent back by ID; HTTP sinks omit settings to preserve write-only URLs/headers), then PATCH—documented race if sinks are edited concurrently.

A new sink module validates sink shape client-side (field names, types, helpful errors without echoing header secrets), merges HTTP header updates via null for unchanged stored headers, and maps validation/not-found to exit codes 2 and 4.

README and help text are updated; contract, CLI parsing, unit, and live Platform tests cover typed create, pre-request validation, and incremental sink CRUD.

^{Reviewed by Cursor Bugbot for commit 7afccec. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

Devin Review found 3 potential issues.