@kubb/studio 5.11.6 → 5.12.1

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { F as PublishedSnapshot, G as SnapshotUploadMetadata, O as InstalledExtensions, a as AgentConnectInfo, c as AgentPermissions, d as ConfigEditOutcome, s as AgentPermission, u as ConfigEdit } from "./protocol-dCzUP4dH.cjs";
+import { F as PublishedSnapshot, G as SnapshotUploadMetadata, O as InstalledExtensions, a as AgentConnectInfo, c as AgentPermissions, d as ConfigEditOutcome, s as AgentPermission, u as ConfigEdit } from "./protocol-CG1bPO_H.cjs";
 import { Config, Hookable, KubbHooks } from "@kubb/core";
 //#region src/connect.d.ts
 /**

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { F as PublishedSnapshot, G as SnapshotUploadMetadata, O as InstalledExtensions, a as AgentConnectInfo, c as AgentPermissions, d as ConfigEditOutcome, s as AgentPermission, u as ConfigEdit } from "./protocol-dCzUP4dH.js";
+import { F as PublishedSnapshot, G as SnapshotUploadMetadata, O as InstalledExtensions, a as AgentConnectInfo, c as AgentPermissions, d as ConfigEditOutcome, s as AgentPermission, u as ConfigEdit } from "./protocol-CG1bPO_H.js";
 import { Config, Hookable, KubbHooks } from "@kubb/core";
 //#region src/connect.d.ts
 /**

package/dist/index.js

@@ -6,14 +6,19 @@ import path, { dirname, isAbsolute, join, relative, resolve, sep } from "node:pa
 import process$1 from "node:process";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { pathToFileURL } from "node:url";
+import { Readable, Transform } from "node:stream";
 import { existsSync } from "node:fs";
 import { mkdir, mkdir as mkdir$1, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { Diagnostics, Hookable, cacheStorage, createKubb, fsStorage, getInputKind, isPackageName, readInstalledPackages, resolveCacheDir, resolveMeta } from "@kubb/core";
+import { Diagnostics, Hookable, cacheStorage, checkoutGitInput, createKubb, fsStorage, getInputKind, isPackageName, isPublicAddress, readInstalledPackages, resolveCacheDir, resolveMeta } from "@kubb/core";
 import { RpcTarget, newWebSocketRpcSession } from "capnweb";
 import { detectCodeFormat, parseExpression, parseModule } from "magicast";
 import { structuredPatch } from "diff";
 import { stripVTControlCharacters } from "node:util";
 import { ast } from "@kubb/ast";
+import dns from "node:dns";
+import http from "node:http";
+import https from "node:https";
+import net from "node:net";
 import { ofetch } from "ofetch";
 import { gzipSync } from "node:zlib";
 //#endregion
@@ -196,7 +201,7 @@ function getElapsedMs(hrStart) {
 }
 //#endregion
 //#region package.json
-var version = "5.11.6";
+var version = "5.12.1";
 //#endregion
 //#region src/resolveConfig.ts
 /**
@@ -1842,6 +1847,106 @@ function createGenerationStream(hooks, jobId) {
 	};
 }
 //#endregion
+//#region src/publicFetch.ts
+const MAX_REDIRECTS = 5;
+const MAX_BYTES = 52428800;
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const NO_BODY = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+function notPublic(host) {
+	return /* @__PURE__ */ new Error(`${host} is not a public address, so a managed agent does not fetch from it`);
+}
+function createLookup(blocked) {
+	return (hostname, options, callback) => {
+		dns.lookup(hostname, {
+			...options,
+			all: true
+		}, (error, addresses) => {
+			if (error) return callback(error, "", 0);
+			const found = addresses;
+			if (!found.length || found.some(({ address }) => !isPublicAddress(address, blocked))) return callback(notPublic(hostname), "", 0);
+			return options.all ? callback(null, found) : callback(null, found[0].address, found[0].family);
+		});
+	};
+}
+function request({ url, blocked, signal }) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return Promise.reject(/* @__PURE__ */ new Error(`Only http and https URLs are fetched, not ${url.protocol}`));
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	if (net.isIP(host) && !isPublicAddress(host, blocked)) return Promise.reject(notPublic(host));
+	return new Promise((resolve, reject) => {
+		const req = (url.protocol === "https:" ? https.request : http.request)(url, {
+			method: "GET",
+			lookup: createLookup(blocked),
+			signal: signal ?? void 0,
+			headers: { "accept-encoding": "identity" }
+		}, (res) => {
+			const headers = new Headers();
+			for (const [key, value] of Object.entries(res.headers)) for (const item of [value].flat()) if (item !== void 0) headers.append(key, item);
+			let total = 0;
+			const limit = new Transform({ transform(chunk, _encoding, done) {
+				total += chunk.length;
+				done(total > MAX_BYTES ? /* @__PURE__ */ new Error("The response is larger than 50 MB") : null, chunk);
+			} });
+			res.on("error", (error) => limit.destroy(error));
+			res.pipe(limit);
+			const body = NO_BODY.has(res.statusCode ?? 0) ? null : Readable.toWeb(limit);
+			resolve(new Response(body, {
+				status: res.statusCode,
+				statusText: res.statusMessage,
+				headers
+			}));
+		});
+		req.on("error", reject);
+		req.end();
+	});
+}
+/**
+* Builds a `fetch` that only reaches addresses `blocked` does not list. It follows redirects itself
+* and checks every hop, and takes GET requests only, since that is all a spec load needs.
+*/
+function createPublicFetch(blocked) {
+	const publicFetch = async (input, init) => {
+		if (typeof input !== "string" && !(input instanceof URL)) throw new TypeError("A managed agent fetches by URL only");
+		if (init?.method && init.method.toUpperCase() !== "GET") throw new TypeError("A managed agent only sends GET requests");
+		let url = new URL(input);
+		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+			const response = await request({
+				url,
+				blocked,
+				signal: init?.signal
+			});
+			const location = response.headers.get("location");
+			if (!REDIRECTS.has(response.status) || !location) return response;
+			await response.body?.cancel();
+			url = new URL(location, url);
+		}
+		throw new Error(`Stopped after ${MAX_REDIRECTS} redirects from ${String(input)}`);
+	};
+	return publicFetch;
+}
+/**
+* Runs `run` with the global `fetch` limited to public addresses, then puts the original back.
+* A managed agent runs one job at a time, so nothing else shares the window.
+*/
+async function withPublicFetch(run) {
+	const original = globalThis.fetch;
+	globalThis.fetch = createPublicFetch();
+	try {
+		return await run();
+	} finally {
+		globalThis.fetch = original;
+	}
+}
+//#endregion
 //#region src/url.ts
 /**
 * Hosted Kubb Studio URL, used when a host passes none.
@@ -1878,6 +1983,11 @@ const OPEN_TIMEOUT_MS = 5e3;
 const MAX_RETRY_DELAY_MS = 3e4;
 const DISK_SNAPSHOT_MAX_FILES = 1e4;
 const SANDBOX_GENERATION_TTL_MS = 9e5;
+const MANAGED_INPUT_KINDS = /* @__PURE__ */ new Set([
+	"inline",
+	"url",
+	"git"
+]);
 /** Extensions `kubb` ships with, so they count as installed without being a direct dependency. */
 const BUILT_IN_PACKAGES = [
 	"@kubb/adapter-oas",
@@ -1964,6 +2074,9 @@ var Agent = class extends RpcTarget {
 	get #sandbox() {
 		return this.#session.info?.sandbox === true;
 	}
+	get #managed() {
+		return this.#session.info?.managed === true;
+	}
 	get #permissions() {
 		const { permissions } = this.#options;
 		return this.#sandbox ? {
@@ -2159,8 +2272,9 @@ var Agent = class extends RpcTarget {
 	*/
 	async #generate({ input, root, outputRoot, signal }) {
 		const { jobId, config: patch } = input;
-		const studioInput = this.#sandbox ? patch?.input : void 0;
+		const studioInput = this.#sandbox || this.#managed ? patch?.input : void 0;
 		if (this.#sandbox && (typeof studioInput !== "string" || !studioInput.trim() || getInputKind(studioInput) !== "inline")) return this.#refuse({ message: AgentMessage.SANDBOX_INPUT_ONLY });
+		if (this.#managed && studioInput !== void 0 && !MANAGED_INPUT_KINDS.has(getInputKind(studioInput))) return this.#refuse({ message: AgentMessage.MANAGED_INPUT_KIND });
 		const [configs, extensions] = await Promise.all([this.#options.loadConfigs(), this.#installedExtensions()]);
 		const config = pickConfig(configs, patch?.config);
 		if (!config) return this.#refuse({ message: AgentMessage.CONFIG_ENTRY_NOT_FOUND });
@@ -2189,12 +2303,13 @@ var Agent = class extends RpcTarget {
 			throw error;
 		});
 		const activePlugins = plugins ?? config.plugins;
-		if (patch?.input && !this.#sandbox) await emit(this.#options.hooks, "kubb:warn", { message: "Ignored the spec from Studio: generating from a Studio spec is only available to a sandbox agent" });
-		const files = await generate({
+		if (patch?.input && !this.#sandbox && !this.#managed) await emit(this.#options.hooks, "kubb:warn", { message: "Ignored the spec from Studio: generating from a Studio spec is only available to a sandbox or managed agent" });
+		const checkout = this.#managed && studioInput !== void 0 && getInputKind(studioInput) === "git" ? await checkoutGitInput(studioInput, signal, { publicOnly: true }).catch((error) => this.#refuse({ message: getErrorMessage(error) })) : void 0;
+		const run = () => generate({
 			config: {
 				...config,
 				root,
-				input: studioInput ?? config.input,
+				input: checkout?.path ?? studioInput ?? config.input,
 				storage: outputRoot ? stagingStorage({
 					root,
 					directory: outputRoot
@@ -2206,11 +2321,12 @@ var Agent = class extends RpcTarget {
 			hooks: this.#options.hooks,
 			signal,
 			allowExec: this.#permissions.allowWrite && this.#permissions.allowExec
-		}).catch(async (error) => {
+		});
+		const files = await (this.#managed ? withPublicFetch(run) : run()).catch(async (error) => {
 			await this.#generations.drop(jobId);
 			await this.#logCommand("generate", getErrorMessage(error), input.requestedBy, true);
 			throw error;
-		});
+		}).finally(() => checkout?.dispose());
 		const output = await this.#generations.keep({
 			jobId,
 			files,
@@ -2478,7 +2594,7 @@ function reportedInput(input) {
 	if (typeof input !== "string") return void 0;
 	const kind = getInputKind(input);
 	if (kind === "inline") return void 0;
-	if (kind !== "url") return input;
+	if (kind !== "url" && kind !== "git" || !URL.canParse(input)) return input;
 	const url = new URL(input);
 	url.username = "";
 	url.password = "";