Reject invalid store execute variables

[dmerand]

WHY are these changes introduced?

--variables and --variable-file accepted non-object JSON values, which reached GraphQL despite the variables object contract.

WHAT is this pull request doing?

Validate variable JSON locally and raise AbortError for null, arrays, primitives, and explicit empty inline input. Preserve malformed JSON and missing-file errors, including their contextual output. Add focused inline and file-backed regression coverage.

How to test your changes?

shadowenv exec -- pnpm exec vitest run packages/store/src/cli/services/store/execute/request.test.ts
shadowenv exec -- pnpm exec nx run store:type-check

Post-release steps

None.

Checklist

• I've considered possible cross-platform impacts (Mac, Linux, Windows)
• I've considered possible documentation changes
• I've considered analytics changes to measure impact
• The change is user-facing — I've identified the correct bump type (patch) and added a changeset.

[Copilot]

Pull request overview

Adds local validation for store execute GraphQL variables so only non-null JSON objects are accepted, preventing invalid variable payloads from reaching the GraphQL client.

Changes:

• Introduces validateVariables to reject null, arrays, and primitive JSON values (and rejects explicitly empty --variables input).
• Preserves existing malformed-JSON and missing-file error paths while rethrowing the new validation AbortErrors unchanged.
• Adds regression tests for invalid inline/file variables and a changeset documenting the user-facing behavior change.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
packages/store/src/cli/services/store/execute/request.ts	Adds local variables parsing/validation and new AbortError paths for invalid variable shapes.
packages/store/src/cli/services/store/execute/request.test.ts	Adds coverage for invalid variables inputs and acceptance of {} variables.
.changeset/fuzzy-store-variables.md	Declares a patch changeset for rejecting invalid variables before requests are sent.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.