feat: add resolver and redirect controls for source requests

[abnegate]

What

Target::call() gains three controls:

• HTTP and HTTPS only. CURLOPT_PROTOCOLS_STR and CURLOPT_REDIR_PROTOCOLS_STR are set to http,https, so an endpoint or redirect with any other scheme (file, gopher, dict, ...) is refused by curl.
• No redirect following by default. A 3xx response throws an exception with the status as its code instead of being returned as the body. setFollowRedirects(true) turns following back on.
• Optional resolver. setResolver(?Closure) takes a callback that receives each request URL and returns the CURLOPT_RESOLVE entries (host:port:address[,address]) the connection must use, so curl connects to addresses the consumer has already validated instead of resolving the host again. The callback can throw to refuse a URL.

Appwrite source SDK client

Most Appwrite source requests go through the Appwrite PHP SDK client rather than Target::call(). The source now builds its client from Sources\Appwrite\Client, a subclass of the SDK 30 Client that overrides createHttpClient():

• redirects are never followed; a 3xx raises an AppwriteException with the status as its code, as Target::call() does (responseType: 'location' still returns the Location header);
• only http and https are allowed;
• setResolver() takes the same callback as Target, called with the endpoint URL, and its CURLOPT_RESOLVE entries apply to every SDK request. The client is rebuilt when the endpoint changes.

Sources\Appwrite::setResolver() passes the resolver to both Target::call() and the SDK client.

Why

Consumers that validate a source endpoint before running a migration need every request to reach the address they approved.

Behaviour change

Redirects are no longer followed unless a consumer opts in, so an endpoint that answers with a redirect (for example http:// to https://) now fails with that status instead of being followed. Without a resolver, connections resolve exactly as before.

Dependencies

• appwrite/appwrite ^27.0 → ^30.0. SDK 29+ needs utopia-php/client 0.4, which pulls utopia-php/storage 4.2, utopia-php/database 7.4 and utopia-php/validators 1.0 forward in the lock. utopia-php/client ^0.4.1 is now required directly, since the subclass builds its cURL adapter.
• SDK 30 sends X-Appwrite-Response-Format: 2.0.0.
• phpstan/phpstan 1.* → ^2.1, because PHPStan 1 can't parse the SDK's PHP 8.5 syntax and reports every SDK class as unknown. PHPStan 2 also flagged two stale ignores, a malformed callable docblock and string content-length arithmetic, all fixed.

Tests

tests/Migration/Unit/General/TargetRequestTest.php runs against a local php -S fixture:

• a 302 is not followed by default (one request reaches the fixture), and is followed with setFollowRedirects(true);
• a followed redirect to file:// is refused;
• a resolver pins pinned.invalid to 127.0.0.1 and receives the full request URL;
• a resolver that throws stops the request before it is sent;
• gopher://, dict:// and file:// endpoints are refused.

tests/Migration/Unit/Sources/AppwriteClientTest.php uses the same fixture for the SDK client:

• a 302 raises AppwriteException with code 302, and only one request reaches the fixture;
• responseType: 'location' still returns the redirect target;
• a resolver pins pinned.invalid for every request, is called once with the endpoint, and runs again after setEndpoint();
• a resolver that throws stops the request before it is sent;
• Sources\Appwrite::setResolver() reaches the SDK client: report() sends GET /v1/users to the pinned host.

With Target.php reverted, all 8 TargetRequestTest cases fail. Without the createHttpClient() override and the forwarding in setResolver(), 5 of the 6 AppwriteClientTest cases fail. The location case guards existing behaviour. The unit suite, pint --test and phpstan --level 3 pass locally.

🤖 Generated with Claude Code

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[greptile-apps]

Your trial has ended. Reactivate Greptile to resume code reviews.

[abnegate]

Merged main in (2f1eac6). Main moved Target::call() and the Appwrite SDK onto utopia-php/client 0.6, so the conflict resolution rebuilds this PR on that transport rather than keeping the raw-curl version:

• Target keeps one shared client for unpinned requests. A request with a resolver set gets its own client carrying CURLOPT_RESOLVE and CURLOPT_PROXY => ''. setFollowRedirects() drops the cached client so the new setting takes effect.
• Sources\Appwrite\Client now imports Utopia\Client\Client (0.6 renamed it from Utopia\Client) and also disables proxies while a resolver is set. This brings over the 2.0.x fix aca9a75 that feat: add resolver and redirect controls for source requests #229 was missing, plus its two regression tests.
• The 0.6 transport refuses non-HTTP schemes before curl runs, and its message no longer contains "protocol". testOnlyHttpProtocolsAreAllowed now asserts that the refusal comes from the transport (ClientExceptionInterface as the previous exception) instead of matching curl's wording.

Behaviour to review: Target::call() no longer follows redirects by default. Main had withFollowRedirects() on, and this PR has always meant to turn it off. Sources that need redirects followed must call setFollowRedirects(true).

The public API used by appwrite/appwrite#14034 is unchanged: setResolver(?\Closure(string): array<string>) on the source.

Locally on the merged head: Pint passes, PHPStan level 3 passes, and tests/Migration/Unit passes. The timeout tests needed a clean php.ini because of a broken local extension.

@greptileai review