@redocly/cli 2.38.0 → 2.40.0

package/THIRD_PARTY_NOTICES

@@ -646,9 +646,9 @@ Packages:
   @noble/hashes@1.8.0 — Copyright (c) 2022 Paul Miller (https://paulmillr.com)
   @redocly/ajv@8.11.2 — Copyright (c) 2015-2021 Evgeny Poberezkin
   @redocly/ajv@8.18.3 — Copyright (c) 2015-2021 Evgeny Poberezkin
-  @redocly/cli-otel@0.3.1 — Copyright 2025 Redocly Inc, all rights reserved.
+  @redocly/cli-otel@0.3.4 — Copyright 2025 Redocly Inc, all rights reserved.
   @redocly/config@0.22.0 — Copyright 2024 Redocly Inc.
-  @redocly/config@0.50.1 — Copyright 2024 Redocly Inc.
+  @redocly/config@0.52.0 — Copyright 2024 Redocly Inc.
   @redocly/openapi-core@1.34.16
   agent-base@7.1.4 — Copyright (c) 2013 Nathan Rajlich <nathan@tootallnate.net>
   ajv-formats@3.0.1 — Copyright (c) 2020 Evgeny Poberezkin
@@ -678,6 +678,7 @@ Packages:
   js-levenshtein@1.1.6 — Copyright (c) 2017 Gustaf Andersson
   js-tokens@4.0.0 — Copyright (c) 2014, 2015, 2016, 2017, 2018 Simon Lydell
   js-yaml@4.2.0 — Copyright (C) 2011-2015 by Vitaly Puzrin
+  js-yaml@5.2.1 — Copyright (C) 2011-2015 by Vitaly Puzrin
   json-pointer@0.6.2 — Copyright (c) 2016 Manuel Stofer
   json-schema-traverse@1.0.0 — Copyright (c) 2017 Evgeny Poberezkin
   jsonpointer@5.0.1 — Copyright (c) 2011-2015 Jan Lehnardt <jan@apache.org> & Marc Bachmann <https://github.com/marcbachmann>

package/lib/chunks/{QUMOPKXU.js → 325TP2UK.js}

@@ -3,7 +3,7 @@ const require = __createRequire(import.meta.url);
 import {
   AbortFlowError,
   exitWithError
-} from "./FL4Q7PMA.js";
+} from "./4BR7G6JO.js";
 import {
   ConfigValidationError,
   HandledError,
@@ -27,7 +27,7 @@ import {
   red,
   stringifyYaml,
   yellow
-} from "./MIPR6NCD.js";
+} from "./HT6ZGKQQ.js";
 
 // src/commands/lint.ts
 import { performance as performance3 } from "perf_hooks";

package/lib/chunks/{NPHT727D.js → 3E6EHT7M.js}

@@ -2,24 +2,26 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   ValidationSession,
-  createNormalizedExchange,
-  isJsonMime,
   loadOpenApiIndex,
-  normalizeFsPath,
   parseCsv,
   renderReport
-} from "./AAQTUNZI.js";
+} from "./V2UTD4F3.js";
+import {
+  createNormalizedExchange,
+  isJsonMime,
+  normalizeFsPath
+} from "./TYUOO44G.js";
 import {
   AbortFlowError,
   exitWithError
-} from "./FL4Q7PMA.js";
+} from "./4BR7G6JO.js";
 import {
   require_undici
 } from "./XB6C62FW.js";
 import {
   isPlainObject,
   logger
-} from "./MIPR6NCD.js";
+} from "./HT6ZGKQQ.js";
 import "./Z2I5YXYN.js";
 import {
   __toESM
@@ -437,6 +439,7 @@ async function handleProxy({ argv, config, version }) {
       openApiIndex,
       matchMode: argv["match-mode"],
       ignoreCookies: argv["ignore-cookies"],
+      ignoreHeaders: argv["ignore-headers"] ? parseCsv(argv["ignore-headers"]) : void 0,
       previewFindingsLimit: argv["max-findings"],
       activeRules: argv.rules ? parseCsv(argv.rules) : void 0
     });

package/lib/chunks/{FL4Q7PMA.js → 4BR7G6JO.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
   HandledError
-} from "./MIPR6NCD.js";
+} from "./HT6ZGKQQ.js";
 
 // src/utils/error.ts
 var AbortFlowError = class extends Error {

package/lib/chunks/4GKD2B4N.js

@@ -0,0 +1,175 @@
+import { createRequire as __createRequire } from 'node:module';
+const require = __createRequire(import.meta.url);
+import {
+  selectTrafficParser
+} from "./JBIFNX5C.js";
+import {
+  ValidationSession,
+  loadOpenApiIndex,
+  parseCsv,
+  renderReport
+} from "./V2UTD4F3.js";
+import {
+  listFilesRecursively,
+  normalizeFsPath
+} from "./TYUOO44G.js";
+import {
+  AbortFlowError,
+  exitWithError
+} from "./4BR7G6JO.js";
+import {
+  logger
+} from "./HT6ZGKQQ.js";
+import "./Z2I5YXYN.js";
+import "./5ILQMFXK.js";
+
+// src/commands/drift/index.ts
+import { mkdir, writeFile } from "node:fs/promises";
+import path from "node:path";
+
+// src/commands/drift/engine/runner.ts
+async function runTrafficValidation(options) {
+  const trafficFiles = await listFilesRecursively(options.trafficPath);
+  if (trafficFiles.length === 0) {
+    throw new Error("No traffic files found in the provided traffic path.");
+  }
+  const session = ValidationSession.create({
+    openApiIndex: options.openApiIndex,
+    matchMode: options.matchMode,
+    ignoreCookies: options.ignoreCookies,
+    ignoreHeaders: options.ignoreHeaders,
+    previewFindingsLimit: options.previewFindingsLimit,
+    activeRules: options.activeRules,
+    server: options.server,
+    minSeverity: options.minSeverity
+  });
+  let supportedTrafficFileCount = 0;
+  let exchangeIndex = 0;
+  for (const trafficFile of trafficFiles) {
+    const parser = await selectTrafficParser(trafficFile, options.format);
+    if (!parser) {
+      logger.warn(`Skipping traffic file with unrecognized format: ${trafficFile}
+`);
+      continue;
+    }
+    supportedTrafficFileCount += 1;
+    for await (const exchange of parser.parse(trafficFile)) {
+      await session.process({ ...exchange, index: exchangeIndex });
+      exchangeIndex += 1;
+    }
+  }
+  if (supportedTrafficFileCount === 0) {
+    throw new Error(
+      "No supported traffic files found. In auto mode, files must match built-in traffic parser signatures."
+    );
+  }
+  if (exchangeIndex === 0) {
+    throw new Error("No HTTP exchanges were parsed from the provided traffic files.");
+  }
+  return session.finalize();
+}
+
+// src/commands/drift/index.ts
+var USE_COLOR = Boolean(process.stdout.isTTY) && process.env.NO_COLOR === void 0;
+function collectSpecServerUrls(openApiIndex) {
+  const urls = /* @__PURE__ */ new Set();
+  for (const operations of openApiIndex.operationsByMethod.values()) {
+    for (const operation of operations) {
+      for (const server of operation.servers) {
+        urls.add(server.rawUrl);
+      }
+    }
+  }
+  return Array.from(urls).sort();
+}
+function warnWhenNothingMatched(summary, openApiIndex, server) {
+  const validatedExchanges = summary.totalExchanges - summary.skippedExchanges;
+  if (validatedExchanges === 0 && summary.skippedExchanges > 0) {
+    logger.warn(
+      `All ${summary.skippedExchanges} exchange(s) were outside the --server "${server}" and were skipped. Check that the server matches the traffic URLs.
+`
+    );
+    return;
+  }
+  if (summary.documentedExchanges > 0 || validatedExchanges === 0) {
+    return;
+  }
+  const serverUrls = collectSpecServerUrls(openApiIndex);
+  const hint = server ? `Check that the --server "${server}" matches the traffic URLs and that the description paths align with the remainder.` : summary.hostCompatibleExchanges === validatedExchanges ? `The traffic hosts are compatible with the description servers (${serverUrls.join(
+    ", "
+  )}), so the endpoints are likely undocumented; if they should be documented, check that the description base paths and paths align with the traffic URLs, or use --server to declare the server the traffic was captured against.` : `Check that the traffic host and base path match the description servers (${serverUrls.join(
+    ", "
+  )}), or use --server to declare the server the traffic was captured against.`;
+  logger.warn(
+    `None of the ${validatedExchanges} validated exchange(s) matched a documented operation. ${hint}
+`
+  );
+}
+async function writeOutput(outputPath, content) {
+  const resolved = normalizeFsPath(outputPath);
+  await mkdir(path.dirname(resolved), { recursive: true });
+  await writeFile(resolved, content, "utf8");
+}
+async function handleDrift({ argv, config }) {
+  const trafficPath = normalizeFsPath(argv.traffic);
+  const trafficFormat = argv["traffic-format"];
+  const activeRules = argv.rules ? parseCsv(argv.rules) : void 0;
+  const ignoreHeaders = argv["ignore-headers"] ? parseCsv(argv["ignore-headers"]) : void 0;
+  const server = argv.server;
+  if (server && argv["match-mode"]) {
+    return exitWithError(
+      "The --server and --match-mode options are mutually exclusive: --match-mode controls how requests are located via the description servers, while --server replaces the description servers with the one the traffic was captured against."
+    );
+  }
+  const matchMode = argv["match-mode"] ?? "strict-host";
+  const specPath = normalizeFsPath(argv.api);
+  const openApiIndex = await loadOpenApiIndex(specPath, config);
+  if (openApiIndex.loadedOperations === 0) {
+    return exitWithError(`No OpenAPI operations were loaded from: ${specPath}`);
+  }
+  const { runId, summary, findings } = await runTrafficValidation({
+    trafficPath,
+    format: trafficFormat,
+    matchMode,
+    ignoreCookies: argv["ignore-cookies"],
+    ignoreHeaders,
+    previewFindingsLimit: argv["max-findings"],
+    activeRules,
+    openApiIndex,
+    server,
+    minSeverity: argv["min-severity"]
+  });
+  warnWhenNothingMatched(summary, openApiIndex, server);
+  const report = renderReport(
+    {
+      runId,
+      summary,
+      findings,
+      meta: {
+        specSource: specPath,
+        trafficPath,
+        format: trafficFormat,
+        matchMode,
+        server
+      }
+    },
+    {
+      format: argv["report-format"],
+      color: USE_COLOR && argv["report-format"] === "pretty" && !argv.output,
+      maxFindings: argv["max-findings"]
+    }
+  );
+  if (argv.output) {
+    await writeOutput(argv.output, report);
+    logger.info(`Drift report written to: ${normalizeFsPath(argv.output)}
+`);
+  } else {
+    logger.output(report);
+  }
+  if (summary.findingsBySeverity.error > 0) {
+    throw new AbortFlowError("Drift detected.");
+  }
+}
+export {
+  handleDrift
+};

package/lib/chunks/{PIMMKQJ7.js → 6DYZ77KC.js}

@@ -4,7 +4,7 @@ const require = __createRequire(import.meta.url);
 // package.json
 var package_default = {
   name: "@redocly/cli",
-  version: "2.38.0",
+  version: "2.40.0",
   description: "",
   license: "MIT",
   bin: {
@@ -48,9 +48,9 @@ var package_default = {
     "@opentelemetry/resources": "2.8.0",
     "@opentelemetry/sdk-trace-node": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.41.1",
-    "@redocly/cli-otel": "0.3.1",
-    "@redocly/openapi-core": "2.38.0",
-    "@redocly/respect-core": "2.38.0",
+    "@redocly/cli-otel": "0.3.4",
+    "@redocly/openapi-core": "2.40.0",
+    "@redocly/respect-core": "2.40.0",
     "@types/cookie": "0.6.0",
     "@types/har-format": "^1.2.16",
     "@types/react": "^17.0.0 || ^18.2.21 || ^19.2.16",

package/lib/chunks/{OPV3WWWU.js → 73MCRGNI.js}

@@ -3,17 +3,17 @@ const require = __createRequire(import.meta.url);
 import {
   getExecutionTime,
   getFallbackApisOrExit
-} from "./QUMOPKXU.js";
+} from "./325TP2UK.js";
 import {
   exitWithError
-} from "./FL4Q7PMA.js";
+} from "./4BR7G6JO.js";
 import {
   require_dist
 } from "./4FB5ZIPP.js";
 import {
   redocStandaloneSri,
   redocVersion
-} from "./PIMMKQJ7.js";
+} from "./6DYZ77KC.js";
 import {
   require_json_pointer,
   require_openapi_sampler
@@ -25,7 +25,7 @@ import {
   require_fast_deep_equal,
   require_json_schema_traverse,
   require_pluralize
-} from "./MIPR6NCD.js";
+} from "./HT6ZGKQQ.js";
 import "./Z2I5YXYN.js";
 import {
   __commonJS,

package/lib/chunks/{G76UYYPW.js → BFQ3EROY.js}

@@ -1,16 +1,16 @@
 import { createRequire as __createRequire } from 'node:module';
 const require = __createRequire(import.meta.url);
 import {
-  G,
+  F,
   ulid
-} from "./ICAVAH7N.js";
+} from "./ICPYP2LP.js";
 import {
   DEFAULT_FETCH_TIMEOUT,
   OTEL_TRACES_URL
 } from "./Y6DTFCLS.js";
 import {
   version
-} from "./PIMMKQJ7.js";
+} from "./6DYZ77KC.js";
 import {
   diag,
   esm_exports,
@@ -13359,7 +13359,7 @@ var OtelServerTelemetry = class {
     const time = new Date(cloudEvent.time);
     const tracer = this.nodeTracerProvider.getTracer("CliTelemetry");
     const spanName = `event.${cloudEvent.type}`;
-    const attributes = G(cloudEvent, time);
+    const attributes = F(cloudEvent, time);
     const span = tracer.startSpan(spanName, {
       attributes,
       startTime: time