ingestron 0.16.1 → 0.16.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.16.2
+
+- Pin core 0.12.6 so mixed local and native-target projects validate correctly.
+- Add a JSON-stdin operation boundary for Studio hosts, with explicit write,
+  download and execution permissions and a bounded request size.
+
 ## 0.16.1
 
 - Add `contract scaffold` for a minimal draft from a known field.

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-### @ingestron/core@0.12.5
+### @ingestron/core@0.12.6
 
 Declared licence: Apache-2.0
 

package/build/cli/cli/index.js

@@ -4,7 +4,7 @@ import * as prompts from "@clack/prompts";
 import { resolve, basename, dirname } from "node:path";
 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "node:fs";
 import { parseDocument } from "yaml";
-import { execute, executeAsync, } from "@ingestron/core";
+import { execute, executeAsync, operationSchemas, } from "@ingestron/core";
 import { fence } from "@ingestron/core/adapter";
 import { Configuration } from "@ingestron/core/adapter";
 import { check, Problem } from "@ingestron/core/adapter";
@@ -79,6 +79,38 @@ const run = async (name, args = {}, ctx = context()) => {
         : await executeAsync(ctx, name, args);
     print(result, args);
 };
+// Structured host boundary: request bytes are data, never shell arguments.
+app
+    .command("operation <name>")
+    .description("Invoke a versioned core operation with a JSON request on stdin")
+    .option("--allow-write", "Permit this operation to write project files")
+    .option("--allow-network", "Permit this operation to download packages")
+    .option("--allow-execute", "Permit this operation to execute a local runtime")
+    .action(async (name, flags) => {
+    check(Object.hasOwn(operationSchemas, name), "OPERATION", "Unknown operation");
+    let bytes = 0;
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        const value = Buffer.from(chunk);
+        bytes += value.length;
+        check(bytes <= 1024 * 1024, "LIMIT", "Operation request exceeds 1 MiB");
+        chunks.push(value);
+    }
+    let request;
+    try {
+        request = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+    }
+    catch {
+        throw new Problem("INPUT", "Expected a JSON operation request on stdin");
+    }
+    const result = await executeAsync({
+        ...context(),
+        allowWrite: !!flags.allowWrite && !opts().dryRun,
+        allowNetwork: !!flags.allowNetwork && !opts().dryRun,
+        allowExecute: !!flags.allowExecute && !opts().dryRun,
+    }, name, request);
+    print(result, request);
+});
 function author(name, args, ctx = context()) {
     const result = execute(ctx, name, args);
     return print(!result.ok || opts().dryRun

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ingestron",
-  "version": "0.16.1",
+  "version": "0.16.2",
   "type": "module",
   "description": "Build repeatable data pipelines from reviewed contracts and versioned standards.",
   "license": "Apache-2.0",
@@ -22,9 +22,25 @@
   "engines": {
     "node": ">=22.12.0"
   },
+  "packageManager": "pnpm@10.15.0",
+  "scripts": {
+    "build": "node scripts/clean-build.mjs && tsc",
+    "test": "tsx --test --test-concurrency=1 test/unit/*.test.ts test/providers/*.test.ts test/integration/*.test.ts",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "secrets:check": "node scripts/secrets.mjs",
+    "validate": "pnpm format:check && pnpm build && pnpm test && pnpm examples:check && pnpm secrets:check && pnpm docs:check && pnpm release:check && pnpm package:check",
+    "prepack": "pnpm build",
+    "package:check": "tsx scripts/package-check.ts",
+    "release:check": "node scripts/release-check.mjs",
+    "prepublishOnly": "node scripts/release-check.mjs --publish",
+    "docs:check": "node scripts/docs-check.mjs",
+    "examples:check": "node examples/quickstart.mjs",
+    "licences:inventory": "node scripts/licence-inventory.mjs"
+  },
   "dependencies": {
     "@clack/prompts": "1.7.0",
-    "@ingestron/core": "0.12.5",
+    "@ingestron/core": "0.12.6",
     "@modelcontextprotocol/sdk": "1.30.0",
     "commander": "15.0.0",
     "yaml": "2.9.0"
@@ -56,18 +72,5 @@
     "cli",
     "mcp",
     "code-generation"
-  ],
-  "scripts": {
-    "build": "node scripts/clean-build.mjs && tsc",
-    "test": "tsx --test --test-concurrency=1 test/unit/*.test.ts test/providers/*.test.ts test/integration/*.test.ts",
-    "format": "prettier --write .",
-    "format:check": "prettier --check .",
-    "secrets:check": "node scripts/secrets.mjs",
-    "validate": "pnpm format:check && pnpm build && pnpm test && pnpm examples:check && pnpm secrets:check && pnpm docs:check && pnpm release:check && pnpm package:check",
-    "package:check": "tsx scripts/package-check.ts",
-    "release:check": "node scripts/release-check.mjs",
-    "docs:check": "node scripts/docs-check.mjs",
-    "examples:check": "node examples/quickstart.mjs",
-    "licences:inventory": "node scripts/licence-inventory.mjs"
-  }
-}
+  ]
+}