@kubb/studio 5.9.5 → 5.10.0

package/README.md

@@ -107,7 +107,8 @@ Every permission is off by default, and each covers one trust boundary:
 | `allowWrite`      | Generated files are written to disk. Off means they exist only in memory and stream to Studio. |
 | `allowExec`       | The formatter, the linter, and `output.postGenerate` run as child processes.                   |
 | `allowConfigEdit` | Studio may change plugin options in `kubb.config.ts`.                                          |
-| `allowRead`       | Studio may read back the files a generation produced and its parsed spec.                      |
+| `allowRead`       | Studio may read back the files a generation produced.                                          |
+| `allowReadAst`    | Studio may read back the parsed spec (the Kubb AST).                                           |
 
 A sandbox never writes or edits config, and always allows reads.
 

package/dist/index.cjs

@@ -177,7 +177,7 @@ function getElapsedMs(hrStart) {
 }
 //#endregion
 //#region package.json
-var version = "5.9.5";
+var version = "5.10.0";
 //#endregion
 //#region src/resolveConfig.ts
 /**
@@ -1606,7 +1606,8 @@ var Agent = class extends capnweb.RpcTarget {
 			...permissions,
 			allowWrite: false,
 			allowConfigEdit: false,
-			allowRead: true
+			allowRead: true,
+			allowReadAst: true
 		} : permissions;
 	}
 	get #generations() {
@@ -1816,7 +1817,7 @@ var Agent = class extends capnweb.RpcTarget {
 		});
 		const inputBytes = await this.#generations.keepInput({
 			jobId,
-			input: this.#permissions.allowRead ? files.input : null,
+			input: this.#permissions.allowReadAst ? files.input : null,
 			maxSetMb: this.#limits.maxMb
 		});
 		if (!output.paths.length && Object.keys(output.hashes).length) await this.#warn({ message: "Kept only the hashes of this generation: its output is too large to keep" });
@@ -1877,13 +1878,13 @@ var Agent = class extends capnweb.RpcTarget {
 		}
 	}
 	/**
-	* Returns the Kubb AST a kept job parsed its spec into. Refused without `allowRead`.
+	* Returns the Kubb AST a kept job parsed its spec into. Refused without `allowReadAst`.
 	*/
 	async readInput(input) {
 		this.#assertConnected();
-		if (!this.#permissions.allowRead) return this.#refuse({
-			message: require_protocol.READ_NOT_ALLOWED_MESSAGE,
-			permission: "allowRead"
+		if (!this.#permissions.allowReadAst) return this.#refuse({
+			message: require_protocol.READ_AST_NOT_ALLOWED_MESSAGE,
+			permission: "allowReadAst"
 		});
 		if (typeof input.jobId !== "string" || !input.jobId) return this.#refuse({ message: "The request must name a job" });
 		const generation = await this.#generations.get(input.jobId);
@@ -2019,6 +2020,7 @@ async function runAgent({ options, openRpc }) {
 			allowConfigEdit: false,
 			allowExec: false,
 			allowRead: false,
+			allowReadAst: false,
 			...options.permissions
 		},
 		hooks: options.hooks ?? new _kubb_core.Hookable(),