@kubb/studio 5.12.0 → 5.12.1

package/dist/index.cjs

@@ -30,6 +30,7 @@ let node_process = require("node:process");
 node_process = __toESM(node_process, 1);
 let node_timers_promises = require("node:timers/promises");
 let node_url = require("node:url");
+let node_stream = require("node:stream");
 let node_fs = require("node:fs");
 let node_fs_promises = require("node:fs/promises");
 let _kubb_core = require("@kubb/core");
@@ -39,6 +40,14 @@ let node_module = require("node:module");
 let diff = require("diff");
 let node_util = require("node:util");
 let _kubb_ast = require("@kubb/ast");
+let node_dns = require("node:dns");
+node_dns = __toESM(node_dns, 1);
+let node_http = require("node:http");
+node_http = __toESM(node_http, 1);
+let node_https = require("node:https");
+node_https = __toESM(node_https, 1);
+let node_net = require("node:net");
+node_net = __toESM(node_net, 1);
 let ofetch = require("ofetch");
 let node_zlib = require("node:zlib");
 //#region ../../internals/utils/src/casing.ts
@@ -220,7 +229,7 @@ function getElapsedMs(hrStart) {
 }
 //#endregion
 //#region package.json
-var version = "5.12.0";
+var version = "5.12.1";
 //#endregion
 //#region src/resolveConfig.ts
 /**
@@ -1866,6 +1875,106 @@ function createGenerationStream(hooks, jobId) {
 	};
 }
 //#endregion
+//#region src/publicFetch.ts
+const MAX_REDIRECTS = 5;
+const MAX_BYTES = 52428800;
+const REDIRECTS = /* @__PURE__ */ new Set([
+	301,
+	302,
+	303,
+	307,
+	308
+]);
+const NO_BODY = /* @__PURE__ */ new Set([
+	204,
+	205,
+	304
+]);
+function notPublic(host) {
+	return /* @__PURE__ */ new Error(`${host} is not a public address, so a managed agent does not fetch from it`);
+}
+function createLookup(blocked) {
+	return (hostname, options, callback) => {
+		node_dns.default.lookup(hostname, {
+			...options,
+			all: true
+		}, (error, addresses) => {
+			if (error) return callback(error, "", 0);
+			const found = addresses;
+			if (!found.length || found.some(({ address }) => !(0, _kubb_core.isPublicAddress)(address, blocked))) return callback(notPublic(hostname), "", 0);
+			return options.all ? callback(null, found) : callback(null, found[0].address, found[0].family);
+		});
+	};
+}
+function request({ url, blocked, signal }) {
+	if (url.protocol !== "http:" && url.protocol !== "https:") return Promise.reject(/* @__PURE__ */ new Error(`Only http and https URLs are fetched, not ${url.protocol}`));
+	const host = url.hostname.replace(/^\[|\]$/g, "");
+	if (node_net.default.isIP(host) && !(0, _kubb_core.isPublicAddress)(host, blocked)) return Promise.reject(notPublic(host));
+	return new Promise((resolve, reject) => {
+		const req = (url.protocol === "https:" ? node_https.default.request : node_http.default.request)(url, {
+			method: "GET",
+			lookup: createLookup(blocked),
+			signal: signal ?? void 0,
+			headers: { "accept-encoding": "identity" }
+		}, (res) => {
+			const headers = new Headers();
+			for (const [key, value] of Object.entries(res.headers)) for (const item of [value].flat()) if (item !== void 0) headers.append(key, item);
+			let total = 0;
+			const limit = new node_stream.Transform({ transform(chunk, _encoding, done) {
+				total += chunk.length;
+				done(total > MAX_BYTES ? /* @__PURE__ */ new Error("The response is larger than 50 MB") : null, chunk);
+			} });
+			res.on("error", (error) => limit.destroy(error));
+			res.pipe(limit);
+			const body = NO_BODY.has(res.statusCode ?? 0) ? null : node_stream.Readable.toWeb(limit);
+			resolve(new Response(body, {
+				status: res.statusCode,
+				statusText: res.statusMessage,
+				headers
+			}));
+		});
+		req.on("error", reject);
+		req.end();
+	});
+}
+/**
+* Builds a `fetch` that only reaches addresses `blocked` does not list. It follows redirects itself
+* and checks every hop, and takes GET requests only, since that is all a spec load needs.
+*/
+function createPublicFetch(blocked) {
+	const publicFetch = async (input, init) => {
+		if (typeof input !== "string" && !(input instanceof URL)) throw new TypeError("A managed agent fetches by URL only");
+		if (init?.method && init.method.toUpperCase() !== "GET") throw new TypeError("A managed agent only sends GET requests");
+		let url = new URL(input);
+		for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+			const response = await request({
+				url,
+				blocked,
+				signal: init?.signal
+			});
+			const location = response.headers.get("location");
+			if (!REDIRECTS.has(response.status) || !location) return response;
+			await response.body?.cancel();
+			url = new URL(location, url);
+		}
+		throw new Error(`Stopped after ${MAX_REDIRECTS} redirects from ${String(input)}`);
+	};
+	return publicFetch;
+}
+/**
+* Runs `run` with the global `fetch` limited to public addresses, then puts the original back.
+* A managed agent runs one job at a time, so nothing else shares the window.
+*/
+async function withPublicFetch(run) {
+	const original = globalThis.fetch;
+	globalThis.fetch = createPublicFetch();
+	try {
+		return await run();
+	} finally {
+		globalThis.fetch = original;
+	}
+}
+//#endregion
 //#region src/url.ts
 /**
 * Hosted Kubb Studio URL, used when a host passes none.
@@ -1902,6 +2011,11 @@ const OPEN_TIMEOUT_MS = 5e3;
 const MAX_RETRY_DELAY_MS = 3e4;
 const DISK_SNAPSHOT_MAX_FILES = 1e4;
 const SANDBOX_GENERATION_TTL_MS = 9e5;
+const MANAGED_INPUT_KINDS = /* @__PURE__ */ new Set([
+	"inline",
+	"url",
+	"git"
+]);
 /** Extensions `kubb` ships with, so they count as installed without being a direct dependency. */
 const BUILT_IN_PACKAGES = [
 	"@kubb/adapter-oas",
@@ -1988,6 +2102,9 @@ var Agent = class extends capnweb.RpcTarget {
 	get #sandbox() {
 		return this.#session.info?.sandbox === true;
 	}
+	get #managed() {
+		return this.#session.info?.managed === true;
+	}
 	get #permissions() {
 		const { permissions } = this.#options;
 		return this.#sandbox ? {
@@ -2183,8 +2300,9 @@ var Agent = class extends capnweb.RpcTarget {
 	*/
 	async #generate({ input, root, outputRoot, signal }) {
 		const { jobId, config: patch } = input;
-		const studioInput = this.#sandbox ? patch?.input : void 0;
+		const studioInput = this.#sandbox || this.#managed ? patch?.input : void 0;
 		if (this.#sandbox && (typeof studioInput !== "string" || !studioInput.trim() || (0, _kubb_core.getInputKind)(studioInput) !== "inline")) return this.#refuse({ message: require_protocol.AgentMessage.SANDBOX_INPUT_ONLY });
+		if (this.#managed && studioInput !== void 0 && !MANAGED_INPUT_KINDS.has((0, _kubb_core.getInputKind)(studioInput))) return this.#refuse({ message: require_protocol.AgentMessage.MANAGED_INPUT_KIND });
 		const [configs, extensions] = await Promise.all([this.#options.loadConfigs(), this.#installedExtensions()]);
 		const config = pickConfig(configs, patch?.config);
 		if (!config) return this.#refuse({ message: require_protocol.AgentMessage.CONFIG_ENTRY_NOT_FOUND });
@@ -2213,12 +2331,13 @@ var Agent = class extends capnweb.RpcTarget {
 			throw error;
 		});
 		const activePlugins = plugins ?? config.plugins;
-		if (patch?.input && !this.#sandbox) await emit(this.#options.hooks, "kubb:warn", { message: "Ignored the spec from Studio: generating from a Studio spec is only available to a sandbox agent" });
-		const files = await generate({
+		if (patch?.input && !this.#sandbox && !this.#managed) await emit(this.#options.hooks, "kubb:warn", { message: "Ignored the spec from Studio: generating from a Studio spec is only available to a sandbox or managed agent" });
+		const checkout = this.#managed && studioInput !== void 0 && (0, _kubb_core.getInputKind)(studioInput) === "git" ? await (0, _kubb_core.checkoutGitInput)(studioInput, signal, { publicOnly: true }).catch((error) => this.#refuse({ message: getErrorMessage(error) })) : void 0;
+		const run = () => generate({
 			config: {
 				...config,
 				root,
-				input: studioInput ?? config.input,
+				input: checkout?.path ?? studioInput ?? config.input,
 				storage: outputRoot ? stagingStorage({
 					root,
 					directory: outputRoot
@@ -2230,11 +2349,12 @@ var Agent = class extends capnweb.RpcTarget {
 			hooks: this.#options.hooks,
 			signal,
 			allowExec: this.#permissions.allowWrite && this.#permissions.allowExec
-		}).catch(async (error) => {
+		});
+		const files = await (this.#managed ? withPublicFetch(run) : run()).catch(async (error) => {
 			await this.#generations.drop(jobId);
 			await this.#logCommand("generate", getErrorMessage(error), input.requestedBy, true);
 			throw error;
-		});
+		}).finally(() => checkout?.dispose());
 		const output = await this.#generations.keep({
 			jobId,
 			files,