@kubb/core 5.11.6 → 5.12.1

package/dist/{Hookable-CvStaYYq.js → Hookable-D3jKB944.js}

@@ -1,11 +1,16 @@
 import "node:module";
 import { satisfies } from "verkit";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { glob, mkdir, readFile, rm, writeFile } from "node:fs/promises";
-import path, { dirname, isAbsolute, join, relative, resolve } from "node:path";
+import process$1 from "node:process";
+import { x } from "tinyexec";
+import { glob, mkdir, mkdtemp, readFile, rm, rm as rm$1, writeFile } from "node:fs/promises";
+import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { existsSync as existsSync$1 } from "node:fs";
 import { stripVTControlCharacters, styleText } from "node:util";
 import { ast, collectImportedRefNames, collectUsedSchemaNames, extractStringsFromNodes } from "@kubb/ast";
+import dns from "node:dns";
+import net from "node:net";
+import { tmpdir } from "node:os";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", {
@@ -14,7 +19,7 @@ var __name = (target, value) => __defProp(target, "name", {
 });
 //#endregion
 //#region package.json
-var version = "5.11.6";
+var version = "5.12.1";
 //#endregion
 //#region ../../internals/utils/src/casing.ts
 /**
@@ -364,6 +369,12 @@ const diagnosticCatalog = {
 		cause: "A URL set as `input` (or reached through a `$ref`) never answered, so the request failed before a status came back. A refused connection, an unknown host, an expired certificate, and a timeout all land here.",
 		fix: "Check that the host is running and reachable from this machine. For a local server, start it and confirm the port matches the one in `input`."
 	},
+	gitInputFailed: {
+		code: "KUBB_GIT_INPUT_FAILED",
+		title: "Git input failed",
+		cause: "A git `input` (`git+<repo>#<ref>:<path>`) is malformed, or `git` could not fetch it: git is not installed, the repository or ref does not exist, or the credentials were refused.",
+		fix: "Write the input as `git+<repo>#<ref>:<path>`. Run `git fetch --depth 1 <repo> <ref>` yourself to see the git error, and set up a credential helper or SSH key for a private repository."
+	},
 	inputRequired: {
 		code: "KUBB_INPUT_REQUIRED",
 		title: "Input required",
@@ -1234,18 +1245,209 @@ function definePlugin(definition) {
 	});
 }
 //#endregion
+//#region src/publicAddress.ts
+function createBlockList() {
+	const list = new net.BlockList();
+	for (const [address, prefix] of [
+		["0.0.0.0", 8],
+		["10.0.0.0", 8],
+		["100.64.0.0", 10],
+		["127.0.0.0", 8],
+		["169.254.0.0", 16],
+		["172.16.0.0", 12],
+		["192.0.0.0", 24],
+		["192.168.0.0", 16],
+		["198.18.0.0", 15],
+		["224.0.0.0", 3]
+	]) list.addSubnet(address, prefix, "ipv4");
+	for (const [address, prefix] of [
+		["::", 128],
+		["::1", 128],
+		["64:ff9b::", 96],
+		["fc00::", 7],
+		["fe80::", 10],
+		["ff00::", 8]
+	]) list.addSubnet(address, prefix, "ipv6");
+	return list;
+}
+const privateAddresses = createBlockList();
+/**
+* Whether `address` is a routable public IP. Loopback, private, link-local, cloud metadata, and
+* multicast ranges are not, and an IPv4-mapped IPv6 address counts as the IPv4 address it wraps.
+* Pass `blocked` to replace the ranges.
+*/
+function isPublicAddress(address, blocked = privateAddresses) {
+	const family = net.isIP(address);
+	return family !== 0 && !blocked.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+//#endregion
+//#region src/gitInput.ts
+/** Matches a git `input`: the `git+` prefix npm uses for git dependencies. */
+const gitInputRegExp = /^git\+/i;
+function gitError(message, cause) {
+	return new Diagnostics.Error({
+		code: Diagnostics.code.gitInputFailed,
+		severity: "error",
+		message,
+		help: "Write a git `input` as `git+<repo>#<ref>:<path>`, for example `git+https://github.com/org/api.git#main:specs/openapi.yaml`. Check that `git` is installed and that `git fetch` can reach the repository with your credentials.",
+		location: { kind: "config" },
+		cause: cause === void 0 ? void 0 : toError(cause)
+	});
+}
+/** The repository URL without a user or password, safe to print. */
+function redact(repo) {
+	if (!URL.canParse(repo)) return repo;
+	const url = new URL(repo);
+	url.username = "";
+	url.password = "";
+	return url.href;
+}
+/**
+* Splits `git+<repo>#<ref>:<path>` into its parts. Git refs cannot contain `:`, so the first one
+* in the fragment ends the ref. Throws `KUBB_GIT_INPUT_FAILED` when the fragment or path is missing.
+*/
+function parseGitInput(input) {
+	const hashIndex = input.indexOf("#");
+	const repo = input.slice(4, hashIndex === -1 ? void 0 : hashIndex);
+	const fragment = hashIndex === -1 ? "" : input.slice(hashIndex + 1);
+	const colonIndex = fragment.indexOf(":");
+	const ref = colonIndex === -1 ? void 0 : fragment.slice(0, colonIndex);
+	const path = colonIndex === -1 ? fragment : fragment.slice(colonIndex + 1);
+	if (!repo || !path || ref === "") throw gitError(`The git \`input\` for ${redact(repo)} has no repository, ref, or spec path after \`#\`.`);
+	return {
+		repo,
+		ref,
+		path
+	};
+}
+/**
+* The `git -c` settings that confine a fetch to https and to `addresses`: the connection goes to
+* the addresses already checked, whatever the host answers to a second lookup, and a redirect to
+* another host is an error. Needs git 2.37 for the pinning.
+*
+* @internal
+*/
+function publicFetchConfig({ host, port, addresses }) {
+	const pinned = addresses.map((address) => net.isIPv6(address) ? `[${address}]` : address).join(",");
+	const config = [
+		"http.followRedirects=false",
+		"protocol.allow=never",
+		"protocol.https.allow=always"
+	];
+	if (!net.isIP(host)) config.push(`http.curloptResolve=${host}:${port}:${pinned}`);
+	return config.flatMap((setting) => ["-c", setting]);
+}
+async function resolvePublicFetchConfig(repo, signal) {
+	if (!URL.canParse(repo) || new URL(repo).protocol !== "https:") throw gitError("A public git `input` must be an https repository URL, not an ssh, git, or file address.");
+	const url = new URL(repo);
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	const isLiteral = net.isIP(host) !== 0;
+	const addresses = isLiteral ? [host] : (await dns.promises.lookup(host, { all: true })).map(({ address }) => address);
+	if (!addresses.length || addresses.some((address) => !isPublicAddress(address))) throw gitError(`${host} is not a public address, so this git \`input\` is not fetched.`);
+	if (!isLiteral) {
+		const { stdout } = await x("git", ["--version"], {
+			nodeOptions: { signal },
+			throwOnError: true
+		});
+		const [, major = 0, minor = 0] = /(\d+)\.(\d+)/.exec(stdout)?.map(Number) ?? [];
+		if (major < 2 || major === 2 && minor < 37) throw gitError(`Fetching a public git \`input\` needs git 2.37 or newer, found ${stdout.trim()}.`);
+	}
+	return publicFetchConfig({
+		host,
+		port: url.port || "443",
+		addresses
+	});
+}
+/**
+* Fetches one commit of a git repository into a temporary directory with a shallow `git fetch`,
+* so any host and the user's own git credentials work, and relative `$ref` files resolve.
+* Resolves to the spec path on disk and a `dispose` that deletes the checkout.
+*
+* With `publicOnly`, the repository must be an https URL on public addresses, the fetch connects to
+* the addresses checked, and it does not follow a redirect.
+*/
+async function checkoutGitInput(input, signal, { publicOnly = false } = {}) {
+	const { repo, ref, path } = parseGitInput(input);
+	const fetchConfig = publicOnly ? await resolvePublicFetchConfig(repo, signal) : [];
+	const dir = await mkdtemp(join(tmpdir(), "kubb-git-"));
+	const dispose = () => rm(dir, {
+		recursive: true,
+		force: true
+	});
+	const specPath = resolve(dir, path);
+	const relativePath = relative(dir, specPath);
+	if (relativePath === ".." || relativePath.startsWith(`..${sep}`) || isAbsolute(relativePath)) {
+		await dispose();
+		throw gitError(`The spec path "${path}" in the git \`input\` points outside the repository.`);
+	}
+	const label = `${redact(repo)}${ref ? ` at ${ref}` : ""}`;
+	const env = {
+		...process$1.env,
+		GIT_TERMINAL_PROMPT: "0"
+	};
+	const steps = [
+		["init", "--quiet"],
+		[
+			"config",
+			"core.symlinks",
+			"false"
+		],
+		[
+			...fetchConfig,
+			"fetch",
+			"--quiet",
+			"--depth",
+			"1",
+			"--end-of-options",
+			repo,
+			ref ?? "HEAD"
+		],
+		[
+			"checkout",
+			"--quiet",
+			"FETCH_HEAD"
+		]
+	];
+	try {
+		for (const args of steps) {
+			const result = await x("git", args, {
+				nodeOptions: {
+					cwd: dir,
+					env,
+					signal
+				},
+				throwOnError: false
+			});
+			if (result.exitCode !== 0) {
+				const stderr = result.stderr.replaceAll(repo, redact(repo)).trim();
+				throw gitError(`\`git ${args[0]}\` failed for ${label}: ${stderr || `exit code ${result.exitCode}`}`);
+			}
+		}
+	} catch (error) {
+		await dispose();
+		if (Diagnostics.isError(error)) throw error;
+		throw gitError(`Cannot run \`git\` for ${label}: ${getErrorMessage(error)}`, error);
+	}
+	return {
+		path: specPath,
+		dispose
+	};
+}
+//#endregion
 //#region src/input.ts
 /**
 * Classifies an `input` value so callers branch on it once instead of repeating the checks.
 *
 * A non-string is a parsed spec (`object`). A string is `inline` when it holds OpenAPI content,
 * meaning it starts with `{` or `[`, spans multiple lines, or opens with a YAML `openapi:` or
-* `swagger:` key. Otherwise a string is a `url` when it parses as one, or a `file` path.
+* `swagger:` key. Otherwise a string is `git` when it starts with `git+`, a `url` when it parses as
+* one, or a `file` path.
 */
 function getInputKind(input) {
 	if (typeof input !== "string") return "object";
 	const trimmed = input.trimStart();
 	if (trimmed.startsWith("{") || trimmed.startsWith("[") || input.includes("\n") || /^(openapi|swagger)\s*:/i.test(trimmed)) return "inline";
+	if (gitInputRegExp.test(input)) return "git";
 	if (URL.canParse(input)) return "url";
 	return "file";
 }
@@ -1269,8 +1471,9 @@ function isLegacyInput(input) {
 /**
 * Normalizes `config.input` into an `AdapterSource` the adapter can parse.
 *
-* A parsed object and inline content become `{ type: 'data' }`; a URL is kept verbatim and a
-* local path is resolved against `config.root`, both as `{ type: 'path' }`.
+* A parsed object and inline content become `{ type: 'data' }`; a URL or git input is kept
+* verbatim and a local path is resolved against `config.root`, all as `{ type: 'path' }`. The
+* driver checks out a git input before the adapter parses it.
 */
 function inputToAdapterSource(config) {
 	const input = config.input;
@@ -1297,7 +1500,7 @@ function inputToAdapterSource(config) {
 		type: "data",
 		data: input
 	};
-	if (kind === "url") return {
+	if (kind === "url" || kind === "git") return {
 		type: "path",
 		path: input
 	};
@@ -2231,13 +2434,20 @@ var KubbDriver = class {
 	async #parseInput() {
 		if (this.inputNode || !this.adapter || !this.#adapterSource) return;
 		this.options.signal?.throwIfAborted();
+		const source = this.#adapterSource;
+		const checkout = source.type === "path" && gitInputRegExp.test(source.path) ? await checkoutGitInput(source.path, this.options.signal) : void 0;
 		try {
-			this.inputNode = await this.adapter.parse(this.#adapterSource, { signal: this.options.signal });
+			this.inputNode = await this.adapter.parse(checkout ? {
+				type: "path",
+				path: checkout.path
+			} : source, { signal: this.options.signal });
 		} catch (caughtError) {
 			throw new Diagnostics.Error(Diagnostics.fromExtension(caughtError, {
 				kind: "adapter",
 				extension: this.adapter
 			}));
+		} finally {
+			await checkout?.dispose();
 		}
 	}
 	/**
@@ -2856,6 +3066,6 @@ var Hookable = class {
 	}
 };
 //#endregion
-export { inParallel as A, __name as B, useOptions as C, Diagnostics as D, resolveMeta as E, rm as F, write as I, writeRaw as L, isPathInside as M, listFiles as N, formatMs as O, read as P, toError as R, useKubb as S, defineExtension as T, setMacros as _, FileManager as a, tryUseKubb as b, Resolver as c, definePlugin as d, addGenerator as f, requirePlugin as g, kubbContext as h, createNodeCache as i, existsSync$1 as j, getElapsedMs as k, getInputKind as l, injectFile as m, KubbDriver as n, _usingCtx as o, addMacro as p, pluginNotFoundError as r, createResolver as s, Hookable as t, assertPluginOption as u, setOptions as v, checkCompatibility as w, useConfig as x, setResolver as y, camelCase as z };
+export { formatMs as A, toError as B, useConfig as C, defineExtension as D, checkCompatibility as E, listFiles as F, __name as H, read as I, rm$1 as L, inParallel as M, existsSync$1 as N, resolveMeta as O, isPathInside as P, write as R, tryUseKubb as S, useOptions as T, camelCase as V, kubbContext as _, FileManager as a, setOptions as b, Resolver as c, isPublicAddress as d, assertPluginOption as f, injectFile as g, addMacro as h, createNodeCache as i, getElapsedMs as j, Diagnostics as k, getInputKind as l, addGenerator as m, KubbDriver as n, _usingCtx as o, definePlugin as p, pluginNotFoundError as r, createResolver as s, Hookable as t, checkoutGitInput as u, requirePlugin as v, useKubb as w, setResolver as x, setMacros as y, writeRaw as z };
 
-//# sourceMappingURL=Hookable-CvStaYYq.js.map
+//# sourceMappingURL=Hookable-D3jKB944.js.map