@nocobase/plugin-mcp-server 2.1.0-alpha.15 → 2.1.0-alpha.17

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/index.ts

@@ -16,7 +16,6 @@ import {
   isHandledError,
   JSONParserErrorGroup,
 } from "./util/errors.js";
-import { ono } from "@jsdevtools/ono";
 import maybe from "./util/maybe.js";
 import type { ParserOptions } from "./options.js";
 import { getJsonSchemaRefParserDefaultOptions } from "./options.js";
@@ -29,6 +28,7 @@ import type {
   ResolverOptions,
   HTTPResolverOptions,
 } from "./types/index.js";
+import { isUnsafeUrl } from "./util/url.js";
 
 export type RefParserSchema = string | JSONSchema;
 
@@ -70,14 +70,14 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
   public parse(schema: S | string | unknown, callback: SchemaCallback<S>): Promise<void>;
   public parse(schema: S | string | unknown, options: O): Promise<S>;
   public parse(schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
-  public parse(baseUrl: string, schema: S | string | unknown, options: O): Promise<S>;
-  public parse(baseUrl: string, schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
+  public parse(path: string, schema: S | string | unknown, options: O): Promise<S>;
+  public parse(path: string, schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
   async parse() {
     const args = normalizeArgs<S, O>(arguments as any);
     let promise;
 
     if (!args.path && !args.schema) {
-      const err = ono(`Expected a file path, URL, or object. Got ${args.path || args.schema}`);
+      const err = new Error(`Expected a file path, URL, or object. Got ${args.path || args.schema}`);
       return maybe(args.callback, Promise.reject(err));
     }
 
@@ -129,7 +129,7 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
         this.schema = null; // it's already set to null at line 79, but let's set it again for the sake of readability
         return maybe(args.callback, Promise.resolve(this.schema!));
       } else {
-        throw ono.syntax(`"${this.$refs._root$Ref.path || result}" is not a valid JSON Schema`);
+        throw new SyntaxError(`"${this.$refs._root$Ref.path || result}" is not a valid JSON Schema`);
       }
     } catch (err) {
       if (!args.options.continueOnError || !isHandledError(err)) {
@@ -144,10 +144,8 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
     }
   }
 
-  public static parse<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    schema: S | string | unknown,
-  ): Promise<S>;
-  public static parse<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
+  public static parse<S extends object = JSONSchema>(schema: S | string | unknown): Promise<S>;
+  public static parse<S extends object = JSONSchema>(
     schema: S | string | unknown,
     callback: SchemaCallback<S>,
   ): Promise<void>;
@@ -161,12 +159,12 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
     callback: SchemaCallback<S>,
   ): Promise<void>;
   public static parse<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
   ): Promise<S>;
   public static parse<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
     callback: SchemaCallback<S>,
@@ -183,7 +181,7 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * Resolves all JSON references (`$ref` pointers) in the given JSON Schema file. If it references any other files/URLs, then they will be downloaded and resolved as well. This method **does not** dereference anything. It simply gives you a `$Refs` object, which is a map of all the resolved references and their values.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#resolveschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#resolveschema-options-callback
    *
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
@@ -193,13 +191,8 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
   public resolve(schema: S | string | unknown, callback: $RefsCallback<S, O>): Promise<void>;
   public resolve(schema: S | string | unknown, options: O): Promise<$Refs<S, O>>;
   public resolve(schema: S | string | unknown, options: O, callback: $RefsCallback<S, O>): Promise<void>;
-  public resolve(baseUrl: string, schema: S | string | unknown, options: O): Promise<$Refs<S, O>>;
-  public resolve(
-    baseUrl: string,
-    schema: S | string | unknown,
-    options: O,
-    callback: $RefsCallback<S, O>,
-  ): Promise<void>;
+  public resolve(path: string, schema: S | string | unknown, options: O): Promise<$Refs<S, O>>;
+  public resolve(path: string, schema: S | string | unknown, options: O, callback: $RefsCallback<S, O>): Promise<void>;
   async resolve() {
     const args = normalizeArgs<S, O>(arguments);
 
@@ -218,7 +211,7 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * Resolves all JSON references (`$ref` pointers) in the given JSON Schema file. If it references any other files/URLs, then they will be downloaded and resolved as well. This method **does not** dereference anything. It simply gives you a `$Refs` object, which is a map of all the resolved references and their values.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#resolveschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#resolveschema-options-callback
    *
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
@@ -241,12 +234,12 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
     callback: $RefsCallback<S, O>,
   ): Promise<void>;
   public static resolve<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
   ): Promise<$Refs<S, O>>;
   public static resolve<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
     callback: $RefsCallback<S, O>,
@@ -263,16 +256,14 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * This also eliminates the risk of circular references, so the schema can be safely serialized using `JSON.stringify()`.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#bundleschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#bundleschema-options-callback
    *
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
    * @param callback (optional) A callback that will receive the bundled schema object
    */
-  public static bundle<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    schema: S | string | unknown,
-  ): Promise<S>;
-  public static bundle<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
+  public static bundle<S extends object = JSONSchema>(schema: S | string | unknown): Promise<S>;
+  public static bundle<S extends object = JSONSchema>(
     schema: S | string | unknown,
     callback: SchemaCallback<S>,
   ): Promise<void>;
@@ -286,12 +277,12 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
     callback: SchemaCallback<S>,
   ): Promise<void>;
   public static bundle<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
   ): Promise<S>;
   public static bundle<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
     callback: SchemaCallback<S>,
@@ -308,7 +299,7 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * This also eliminates the risk of circular references, so the schema can be safely serialized using `JSON.stringify()`.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#bundleschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#bundleschema-options-callback
    *
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
@@ -318,8 +309,8 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
   public bundle(schema: S | string | unknown, callback: SchemaCallback<S>): Promise<void>;
   public bundle(schema: S | string | unknown, options: O): Promise<S>;
   public bundle(schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
-  public bundle(baseUrl: string, schema: S | string | unknown, options: O): Promise<S>;
-  public bundle(baseUrl: string, schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
+  public bundle(path: string, schema: S | string | unknown, options: O): Promise<S>;
+  public bundle(path: string, schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
   async bundle() {
     const args = normalizeArgs<S, O>(arguments);
     try {
@@ -337,16 +328,14 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * The dereference method maintains object reference equality, meaning that all `$ref` pointers that point to the same object will be replaced with references to the same object. Again, this is great for programmatic usage, but it does introduce the risk of circular references, so be careful if you intend to serialize the schema using `JSON.stringify()`. Consider using the bundle method instead, which does not create circular references.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#dereferenceschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#dereferenceschema-options-callback
    *
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
    * @param callback (optional) A callback that will receive the dereferenced schema object
    */
-  public static dereference<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    schema: S | string | unknown,
-  ): Promise<S>;
-  public static dereference<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
+  public static dereference<S extends object = JSONSchema>(schema: S | string | unknown): Promise<S>;
+  public static dereference<S extends object = JSONSchema>(
     schema: S | string | unknown,
     callback: SchemaCallback<S>,
   ): Promise<void>;
@@ -360,12 +349,12 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
     callback: SchemaCallback<S>,
   ): Promise<void>;
   public static dereference<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
   ): Promise<S>;
   public static dereference<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>>(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
     callback: SchemaCallback<S>,
@@ -382,22 +371,22 @@ export class $RefParser<S extends object = JSONSchema, O extends ParserOptions<S
    *
    * The dereference method maintains object reference equality, meaning that all `$ref` pointers that point to the same object will be replaced with references to the same object. Again, this is great for programmatic usage, but it does introduce the risk of circular references, so be careful if you intend to serialize the schema using `JSON.stringify()`. Consider using the bundle method instead, which does not create circular references.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/ref-parser.html#dereferenceschema-options-callback
+   * See https://apidevtools.com/json-schema-ref-parser/docs/ref-parser.html#dereferenceschema-options-callback
    *
-   * @param baseUrl
+   * @param path
    * @param schema A JSON Schema object, or the file path or URL of a JSON Schema file. See the `parse` method for more info.
    * @param options (optional)
    * @param callback (optional) A callback that will receive the dereferenced schema object
    */
   public dereference(
-    baseUrl: string,
+    path: string,
     schema: S | string | unknown,
     options: O,
     callback: SchemaCallback<S>,
   ): Promise<void>;
   public dereference(schema: S | string | unknown, options: O, callback: SchemaCallback<S>): Promise<void>;
   public dereference(schema: S | string | unknown, callback: SchemaCallback<S>): Promise<void>;
-  public dereference(baseUrl: string, schema: S | string | unknown, options: O): Promise<S>;
+  public dereference(path: string, schema: S | string | unknown, options: O): Promise<S>;
   public dereference(schema: S | string | unknown, options: O): Promise<S>;
   public dereference(schema: S | string | unknown): Promise<S>;
   async dereference() {
@@ -450,4 +439,6 @@ export {
   _dereference as dereferenceInternal,
   normalizeArgs as jsonSchemaParserNormalizeArgs,
   getJsonSchemaRefParserDefaultOptions,
+  $Refs,
+  isUnsafeUrl,
 };

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/options.ts

@@ -29,6 +29,13 @@ export interface DereferenceOptions {
    */
   excludedPathMatcher?(path: string): boolean;
 
+  /**
+   * Callback invoked during circular reference detection.
+   *
+   * @argument {string} path - The path that is circular (ie. the `$ref` string)
+   */
+  onCircular?(path: string): void;
+
   /**
    * Callback invoked during dereferencing.
    *
@@ -39,6 +46,16 @@ export interface DereferenceOptions {
    */
   onDereference?(path: string, value: JSONSchemaObject, parent?: JSONSchemaObject, parentPropName?: string): void;
 
+  /**
+   * An array of properties to preserve when dereferencing a `$ref` schema. Useful if you want to
+   * enforce non-standard dereferencing behavior like present in the OpenAPI 3.1 specification where
+   * `description` and `summary` properties are preserved when alongside a `$ref` pointer.
+   *
+   * If none supplied then no properties will be preserved and the object will be fully replaced
+   * with the dereferenced `$ref`.
+   */
+  preservedProperties?: string[];
+
   /**
    * Whether a reference should resolve relative to its directory/path, or from the cwd
    *

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/parse.ts

@@ -1,4 +1,3 @@
-import { ono } from "@jsdevtools/ono";
 import * as url from "./util/url.js";
 import * as plugins from "./util/plugins.js";
 import {
@@ -92,7 +91,7 @@ async function readFile<S extends object = JSONSchema, O extends ParserOptions<S
       throw new UnmatchedResolverError(file.url);
     } else if (!err || !("error" in err)) {
       // Throw a generic, friendly error.
-      throw ono.syntax(`Unable to resolve $ref pointer "${file.url}"`);
+      throw new SyntaxError(`Unable to resolve $ref pointer "${file.url}"`);
     }
     // Throw the original error, if it's one of our own (user-friendly) errors.
     else if (err.error instanceof ResolverError) {
@@ -133,7 +132,7 @@ async function parseFile<S extends object = JSONSchema, O extends ParserOptions<
   try {
     const parser = await plugins.run<S, O>(parsers, "parse", file, $refs);
     if (!parser.plugin.allowEmpty && isEmpty(parser.result)) {
-      throw ono.syntax(`Error parsing "${file.url}" as ${parser.plugin.name}. \nParsed value is empty`);
+      throw new SyntaxError(`Error parsing "${file.url}" as ${parser.plugin.name}. \nParsed value is empty`);
     } else {
       return parser;
     }
@@ -144,7 +143,7 @@ async function parseFile<S extends object = JSONSchema, O extends ParserOptions<
     } else if (err && err.message && err.message.startsWith("Error parsing")) {
       throw err;
     } else if (!err || !("error" in err)) {
-      throw ono.syntax(`Unable to parse ${file.url}`);
+      throw new SyntaxError(`Unable to parse ${file.url}`);
     } else if (err.error instanceof ParserError) {
       throw err.error;
     } else {

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/pointer.ts

@@ -5,6 +5,8 @@ import * as url from "./util/url.js";
 import { JSONParserError, InvalidPointerError, MissingPointerError, isHandledError } from "./util/errors.js";
 import type { JSONSchema } from "./types";
 
+export const nullSymbol = Symbol("null");
+
 const slashes = /\//g;
 const tildes = /~/g;
 const escapedSlash = /~1/g;
@@ -88,6 +90,7 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
    */
   resolve(obj: S, options?: O, pathFromRoot?: string) {
     const tokens = Pointer.parse(this.path, this.originalPath);
+    const found: any = [];
 
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
@@ -98,11 +101,8 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
         this.path = Pointer.join(this.path, tokens.slice(i));
       }
 
-      if (typeof this.value === "object" && this.value !== null && !isRootPath(pathFromRoot) && "$ref" in this.value) {
-        return this;
-      }
-
       const token = tokens[i];
+
       if (this.value[token] === undefined || (this.value[token] === null && i === tokens.length - 1)) {
         // one final case is if the entry itself includes slashes, and was parsed out as a token - we can join the remaining tokens and try again
         let didFindSubstringSlashMatch = false;
@@ -119,11 +119,30 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
           continue;
         }
 
+        // If the token we're looking for ended up not containing any slashes but is
+        // actually instead pointing to an existing `null` value then we should use that
+        // `null` value.
+        if (token in this.value && this.value[token] === null) {
+          // We use a `null` symbol for internal tracking to differntiate between a general `null`
+          // value and our expected `null` value.
+          this.value = nullSymbol;
+          continue;
+        }
+
         this.value = null;
-        throw new MissingPointerError(token, decodeURI(this.originalPath));
+
+        const path = this.$ref.path || "";
+
+        const targetRef = this.path.replace(path, "");
+        const targetFound = Pointer.join("", found);
+        const parentPath = pathFromRoot?.replace(path, "");
+
+        throw new MissingPointerError(token, decodeURI(this.originalPath), targetRef, targetFound, parentPath);
       } else {
         this.value = this.value[token];
       }
+
+      found.push(token);
     }
 
     // Resolve the final value
@@ -210,7 +229,7 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
     }
 
     if (split[0] !== "") {
-      throw new InvalidPointerError(split, originalPath === undefined ? path : originalPath);
+      throw new InvalidPointerError(pointer, originalPath === undefined ? path : originalPath);
     }
 
     return split.slice(1);

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/ref.ts

@@ -1,4 +1,4 @@
-import Pointer from "./pointer.js";
+import Pointer, { nullSymbol } from "./pointer.js";
 import type { JSONParserError, MissingPointerError, ParserError, ResolverError } from "./util/errors.js";
 import { InvalidPointerError, isHandledError, normalizeError } from "./util/errors.js";
 import { safePointerToPath, stripHash, getHash } from "./util/url.js";
@@ -119,7 +119,12 @@ class $Ref<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOpt
   resolve(path: string, options?: O, friendlyPath?: string, pathFromRoot?: string) {
     const pointer = new Pointer<S, O>(this, path, friendlyPath);
     try {
-      return pointer.resolve(this.value, options, pathFromRoot);
+      const resolved = pointer.resolve(this.value, options, pathFromRoot);
+      if (resolved.value === nullSymbol) {
+        resolved.value = null;
+      }
+
+      return resolved;
     } catch (err: any) {
       if (!options || !options.continueOnError || !isHandledError(err)) {
         throw err;
@@ -148,6 +153,9 @@ class $Ref<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOpt
   set(path: string, value: any) {
     const pointer = new Pointer(this, path);
     this.value = pointer.set(this.value, value);
+    if (this.value === nullSymbol) {
+      this.value = null;
+    }
   }
 
   /**

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/refs.ts

@@ -1,4 +1,3 @@
-import { ono } from "@jsdevtools/ono";
 import $Ref from "./ref.js";
 import * as url from "./util/url.js";
 import type { JSONSchema4Type, JSONSchema6Type, JSONSchema7Type } from "json-schema";
@@ -14,20 +13,20 @@ interface $RefsMap<S extends object = JSONSchema, O extends ParserOptions<S> = P
  *
  * This object is a map of JSON References and their resolved values. It also has several convenient helper methods that make it easy for you to navigate and manipulate the JSON References.
  *
- * See https://apitools.dev/json-schema-ref-parser/docs/refs.html
+ * See https://apidevtools.com/json-schema-ref-parser/docs/refs.html
  */
 export default class $Refs<S extends object = JSONSchema, O extends ParserOptions<S> = ParserOptions<S>> {
   /**
    * This property is true if the schema contains any circular references. You may want to check this property before serializing the dereferenced schema as JSON, since JSON.stringify() does not support circular references by default.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/refs.html#circular
+   * See https://apidevtools.com/json-schema-ref-parser/docs/refs.html#circular
    */
   public circular: boolean;
 
   /**
    * Returns the paths/URLs of all the files in your schema (including the main schema file).
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/refs.html#pathstypes
+   * See https://apidevtools.com/json-schema-ref-parser/docs/refs.html#pathstypes
    *
    * @param types (optional) Optionally only return certain types of paths ("file", "http", etc.)
    */
@@ -41,7 +40,7 @@ export default class $Refs<S extends object = JSONSchema, O extends ParserOption
   /**
    * Returns a map of paths/URLs and their correspond values.
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/refs.html#valuestypes
+   * See https://apidevtools.com/json-schema-ref-parser/docs/refs.html#valuestypes
    *
    * @param types (optional) Optionally only return values from certain locations ("file", "http", etc.)
    */
@@ -57,7 +56,7 @@ export default class $Refs<S extends object = JSONSchema, O extends ParserOption
   /**
    * Returns `true` if the given path exists in the schema; otherwise, returns `false`
    *
-   * See https://apitools.dev/json-schema-ref-parser/docs/refs.html#existsref
+   * See https://apidevtools.com/json-schema-ref-parser/docs/refs.html#existsref
    *
    * @param $ref The JSON Reference path, optionally with a JSON Pointer in the hash
    */
@@ -100,7 +99,7 @@ export default class $Refs<S extends object = JSONSchema, O extends ParserOption
     const $ref = this._$refs[withoutHash];
 
     if (!$ref) {
-      throw ono(`Error resolving $ref pointer "${path}". \n"${withoutHash}" not found.`);
+      throw new Error(`Error resolving $ref pointer "${path}". \n"${withoutHash}" not found.`);
     }
 
     $ref.set(absPath, value);
@@ -150,7 +149,7 @@ export default class $Refs<S extends object = JSONSchema, O extends ParserOption
     const $ref = this._$refs[withoutHash];
 
     if (!$ref) {
-      throw ono(`Error resolving $ref pointer "${path}". \n"${withoutHash}" not found.`);
+      throw new Error(`Error resolving $ref pointer "${path}". \n"${withoutHash}" not found.`);
     }
 
     return $ref.resolve(absPath, options, path, pathFromRoot);

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/resolvers/file.ts

@@ -1,5 +1,4 @@
 import fs from "fs";
-import { ono } from "@jsdevtools/ono";
 import * as url from "../util/url.js";
 import { ResolverError } from "../util/errors.js";
 import type { JSONSchema, ResolverOptions } from "../types/index.js";
@@ -28,12 +27,16 @@ export default {
     try {
       path = url.toFileSystemPath(file.url);
     } catch (err: any) {
-      throw new ResolverError(ono.uri(err, `Malformed URI: ${file.url}`), file.url);
+      const e = err as Error;
+      e.message = `Malformed URI: ${file.url}: ${e.message}`;
+      throw new ResolverError(e, file.url);
     }
     try {
       return await fs.promises.readFile(path);
     } catch (err: any) {
-      throw new ResolverError(ono(err, `Error opening file "${path}"`), path);
+      const e = err as Error;
+      e.message = `Error opening file ${path}: ${e.message}`;
+      throw new ResolverError(e, path);
     }
   },
 } as ResolverOptions<JSONSchema>;

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/resolvers/http.ts

@@ -1,4 +1,3 @@
-import { ono } from "@jsdevtools/ono";
 import * as url from "../util/url.js";
 import { ResolverError } from "../util/errors.js";
 import type { FileInfo, HTTPResolverOptions, JSONSchema } from "../types/index.js";
@@ -37,13 +36,18 @@ export default {
    */
   withCredentials: false,
 
+  /**
+   * Set this to `false` if you want to allow unsafe URLs (e.g., `127.0.0.1`, localhost, and other internal URLs).
+   */
+  safeUrlResolver: true,
+
   /**
    * Determines whether this resolver can read a given file reference.
    * Resolvers that return true will be tried in order, until one successfully resolves the file.
    * Resolvers that return false will not be given a chance to resolve the file.
    */
   canRead(file: FileInfo) {
-    return url.isHttp(file.url);
+    return url.isHttp(file.url) && (!this.safeUrlResolver || !url.isUnsafeUrl(file.url));
   },
 
   /**
@@ -78,17 +82,20 @@ async function download<S extends object = JSONSchema>(
   try {
     const res = await get(u, httpOptions);
     if (res.status >= 400) {
-      throw ono({ status: res.status }, `HTTP ERROR ${res.status}`);
+      const error = new Error(`HTTP ERROR ${res.status}`) as Error & { status?: number };
+      error.status = res.status;
+      throw error;
     } else if (res.status >= 300) {
       if (!Number.isNaN(httpOptions.redirects) && redirects.length > httpOptions.redirects!) {
-        throw new ResolverError(
-          ono(
-            { status: res.status },
-            `Error downloading ${redirects[0]}. \nToo many redirects: \n  ${redirects.join(" \n  ")}`,
-          ),
-        );
+        const error = new Error(
+          `Error downloading ${redirects[0]}. \nToo many redirects: \n  ${redirects.join(" \n  ")}`,
+        ) as Error & { status?: number };
+        error.status = res.status;
+        throw new ResolverError(error);
       } else if (!("location" in res.headers) || !res.headers.location) {
-        throw ono({ status: res.status }, `HTTP ${res.status} redirect with no location header`);
+        const error = new Error(`HTTP ${res.status} redirect with no location header`) as Error & { status?: number };
+        error.status = res.status;
+        throw error;
       } else {
         const redirectTo = url.resolve(u.href, res.headers.location as string);
         return download(redirectTo, httpOptions, redirects);
@@ -101,7 +108,9 @@ async function download<S extends object = JSONSchema>(
       return Buffer.alloc(0);
     }
   } catch (err: any) {
-    throw new ResolverError(ono(err, `Error downloading ${u.href}`), u.href);
+    const e = err as Error;
+    e.message = `Error downloading ${u.href}: ${e.message}`;
+    throw new ResolverError(e, u.href);
   }
 }
 

package/dist/node_modules/@apidevtools/json-schema-ref-parser/lib/types/index.ts

@@ -18,7 +18,7 @@ export type $RefsCallback<S extends object = JSONSchema, O extends ParserOptions
 ) => any;
 
 /**
- * See https://apitools.dev/json-schema-ref-parser/docs/options.html
+ * See https://apidevtools.com/json-schema-ref-parser/docs/options.html
  */
 
 export interface HTTPResolverOptions<S extends object = JSONSchema> extends Partial<ResolverOptions<S>> {
@@ -41,12 +41,17 @@ export interface HTTPResolverOptions<S extends object = JSONSchema> extends Part
    * Set this to `true` if you're downloading files from a CORS-enabled server that requires authentication
    */
   withCredentials?: boolean;
+
+  /**
+   * Set this to `false` if you want to allow unsafe URLs (e.g., `127.0.0.1`, localhost, and other internal URLs).
+   */
+  safeUrlResolver?: boolean;
 }
 
 /**
  * JSON Schema `$Ref` Parser comes with built-in resolvers for HTTP and HTTPS URLs, as well as local filesystem paths (when running in Node.js). You can add your own custom resolvers to support additional protocols, or even replace any of the built-in resolvers with your own custom implementation.
  *
- * See https://apitools.dev/json-schema-ref-parser/docs/plugins/resolvers.html
+ * See https://apidevtools.com/json-schema-ref-parser/docs/plugins/resolvers.html
  */
 export interface ResolverOptions<S extends object = JSONSchema> {
   name?: string;
@@ -126,7 +131,7 @@ export interface Plugin {
  *
  * The file info object currently only consists of a few properties, but it may grow in the future if plug-ins end up needing more information.
  *
- * See https://apitools.dev/json-schema-ref-parser/docs/plugins/file-info-object.html
+ * See https://apidevtools.com/json-schema-ref-parser/docs/plugins/file-info-object.html
  */
 export interface FileInfo {
   /**