@scalar/json-magic 0.13.3 → 0.13.5

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @scalar/json-magic
 
+## 0.13.5
+
+### Patch Changes
+
+- [#9817](https://github.com/scalar/scalar/pull/9817): Resolve relative `externalValue` URLs on example objects against the document origin, so external request and response examples load even when referenced with a relative path
+- [#9666](https://github.com/scalar/scalar/pull/9666): Only normalize OpenAPI Reference Objects during bundling, never Schema Objects. `normalizeRefs` used to strip every sibling except `$ref` on any node outside `components/schemas`, which also hit inline schemas. In JSON Schema 2020-12 a `$ref` may legally carry sibling keywords — for example a `$defs`/`$dynamicAnchor` binding that specializes a generic template like `Paginated<T>` — and such schemas appear inline anywhere a schema is allowed (a response's `content.<media>.schema`, an `allOf` branch, …). Dropping those siblings discarded the binding, leaving `$dynamicRef` to resolve to the template's empty fallback and rendering an empty array (for example the `data` array of `GET /planets` in the Scalar Galaxy). Reference Objects are still normalized as before. A new `@scalar/helpers/openapi/is-schema-path` helper detects schema positions.
+- [#10112](https://github.com/scalar/scalar/pull/10112): Pin guarded requests to validated public IP addresses and reject custom transports that bypass the connection checks.
+- [#10140](https://github.com/scalar/scalar/pull/10140): Replace redundant type assertions with compiler-checked annotations, typed accumulators, and existing guards across helpers, API conversion, request handling, and schema rendering.
+
+  Narrow DOM elements and caught errors before accessing their properties. Correct header lookup to include missing values and handle them during PowerShell snippet generation.
+
+  Validate release-note provider responses, represent unresolved references and absent groups in helper return types, and require narrowing merged object values. Preserve AsyncAPI broker credentials separately from HTTP authentication schemes.
+
+## 0.13.4
+
+### Patch Changes
+
+- [#10079](https://github.com/scalar/scalar/pull/10079): Harden the mock server against SSRF and local file disclosure through OpenAPI `$ref`s. External `$ref` resolution now refuses to fetch private, loopback, link-local, and metadata addresses, and confines local file reads to the document's directory. The `fetchUrls` and `readFiles` bundling plugins gain opt-in `blockPrivateNetworks` and `basePath` options, so other callers keep their current behavior unless they opt in.
+
 ## 0.13.3
 
 ## 0.13.2

package/dist/bundle/bundle.d.ts

@@ -124,13 +124,17 @@ export type LoaderPlugin = {
  *
  * - `path`: The JSON pointer path (as an array of strings) from the document root to the current node.
  * - `resolutionCache`: A cache for storing promises of resolved references.
+ * - `origin`: The origin (URL or file path) of the document this node lives in. Lifecycle plugins can
+ *   use it to resolve relative references (for example an example's `externalValue`) into absolute URLs.
  */
 type NodeProcessContext = {
     path: readonly string[];
+    referencedFromPath?: readonly string[];
     resolutionCache: Map<string, Promise<Readonly<ResolveResult>>>;
     parentNode: UnknownObject | null;
     rootNode: UnknownObject;
     loaders: LoaderPlugin[];
+    origin: string;
 };
 /**
  * A plugin type for lifecycle hooks, allowing custom logic to be injected into the bundler's process.

package/dist/bundle/bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/bundle/bundle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAU5C;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAA;AA2BpF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAMhE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAqB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,wBAAwB,GACnC,gBAAgB,OAAO,EACvB,gBAAgB,OAAO,EACvB,eAAe,MAAM,EACrB,iBAAiB,MAAM,EACvB,aAAa,MAAM,EACnB,yBAAuB,EACvB,6BAA0B,SAqD3B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,QAAQ,CAAA;IAEd,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IAEpC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;;GAUG;AACH,KAAK,kBAAkB,GAAG;IACxB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAC9D,UAAU,EAAE,aAAa,GAAG,IAAI,CAAA;IAChC,QAAQ,EAAE,aAAa,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;CACxB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,eAAe,CAAA;AAEnD;;;GAGG;AACH,KAAK,MAAM,GAAG;IACZ;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IAEjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IAEpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;OAIG;IACH,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;IAE3C;;;;OAIG;IACH,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAA;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAEhB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IAErC;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IAEtD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;QACd;;;WAGG;QACH,cAAc,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACvE;;;WAGG;QACH,cAAc,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACvE;;;WAGG;QACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACzE;;;WAGG;QACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/F;;;WAGG;QACH,kBAAkB,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/F,CAAC,CAAA;CACH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB;;;;;OAKG;;IAGH;;;;OAIG;;CAEK,CAAA;AAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,mBAqTzE"}
+{"version":3,"file":"bundle.d.ts","sourceRoot":"","sources":["../../src/bundle/bundle.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAU5C;;;;;;;;;;GAUG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEjD;AAED,MAAM,MAAM,aAAa,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAA;CAAE,CAAA;AA2BpF;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,UAMhE;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAqB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,eAAO,MAAM,wBAAwB,GACnC,gBAAgB,OAAO,EACvB,gBAAgB,OAAO,EACvB,eAAe,MAAM,EACrB,iBAAiB,MAAM,EACvB,aAAa,MAAM,EACnB,yBAAuB,EACvB,6BAA0B,SAqD3B,CAAA;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,QAAQ,CAAA;IAEd,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAA;IAEpC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,aAAa,CAAC,CAAA;CAChD,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,kBAAkB,GAAG;IACxB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;IAC9D,UAAU,EAAE,aAAa,GAAG,IAAI,CAAA;IAChC,QAAQ,EAAE,aAAa,CAAA;IACvB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,MAAM,EAAE,MAAM,CAAA;CACf,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAA;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,MAAM,GAAG,YAAY,GAAG,eAAe,CAAA;AAEnD;;;GAGG;AACH,KAAK,MAAM,GAAG;IACZ;;;;OAIG;IACH,OAAO,EAAE,MAAM,EAAE,CAAA;IAEjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IAEpB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IAEd;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;OAIG;IACH,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAA;IAE3C;;;;OAIG;IACH,YAAY,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,CAAA;IAE3B;;;;OAIG;IACH,SAAS,EAAE,OAAO,CAAA;IAElB;;;;OAIG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAEhB;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAE7B;;;;;OAKG;IACH,4BAA4B,CAAC,EAAE,MAAM,CAAA;IAErC;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAA;IAEtD;;;OAGG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;QACd;;;WAGG;QACH,cAAc,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACvE;;;WAGG;QACH,cAAc,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACvE;;;WAGG;QACH,gBAAgB,EAAE,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;QACzE;;;WAGG;QACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/F;;;WAGG;QACH,kBAAkB,EAAE,CAAC,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KAC/F,CAAC,CAAA;CACH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU;IACrB;;;;;OAKG;;IAGH;;;;OAIG;;CAEK,CAAA;AAMV;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgEG;AACH,wBAAsB,MAAM,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,EAAE,MAAM,EAAE,MAAM,mBA+UzE"}

package/dist/bundle/bundle.js

@@ -349,7 +349,7 @@ export async function bundle(input, config) {
             }
         }
     };
-    const bundler = async (root, origin = defaultOrigin, isChunkParent = false, depth = 0, currentPath = [], parent = null) => {
+    const bundler = async (root, origin = defaultOrigin, isChunkParent = false, depth = 0, currentPath = [], parent = null, referencedFromPath) => {
         // If a maximum depth is set in the config, stop bundling when the current depth reaches or exceeds it
         if (config.depth !== undefined && depth > config.depth) {
             return;
@@ -364,15 +364,19 @@ export async function bundle(input, config) {
         }
         // Mark this node as processed before continuing
         processedNodes.add(root);
+        // A node with its own `$id` establishes a new base for resolving relative references within it.
+        // Fall back to the origin inherited from the parent document otherwise.
+        const id = getId(root);
         const context = {
             path: currentPath,
+            referencedFromPath,
             resolutionCache: cache,
             parentNode: parent,
             rootNode: documentRoot,
             loaders: loaderPlugins,
+            origin: id ?? origin,
         };
         await executeHooks('onBeforeNodeProcess', root, context);
-        const id = getId(root);
         if (hasRef(root)) {
             const ref = root['$ref'];
             const isChunk = '$global' in root && typeof root['$global'] === 'boolean' && root['$global'];
@@ -393,7 +397,7 @@ export async function bundle(input, config) {
                     // referenced by this local reference to ensure the partial bundle is complete.
                     // This includes not just the direct reference but also all its dependencies,
                     // creating a complete and self-contained partial bundle.
-                    await bundler(targetValue.value, targetValue.context, isChunkParent, depth + 1, segments, parent);
+                    await bundler(targetValue.value, targetValue.context, isChunkParent, depth + 1, segments, parent, referencedFromPath);
                 }
                 await executeHooks('onAfterNodeProcess', root, context);
                 return;
@@ -436,11 +440,9 @@ export async function bundle(input, config) {
                     // to handle any nested references it may contain. We pass the resolvedPath as the new origin
                     // to ensure any relative references within this content are resolved correctly relative to
                     // their new location in the bundled document.
-                    await bundler(result.data, isChunk ? origin : resolvedPath, isChunk, depth + 1, [
-                        config.externalDocumentsKey,
-                        compressedPath,
-                        documentRoot[config.externalDocumentsMappingsKey],
-                    ]);
+                    await bundler(result.data, isChunk ? origin : resolvedPath, isChunk, depth + 1, [config.externalDocumentsKey, compressedPath], null, 
+                    // Keep the referring document path across external hops, replacing the storage wrapper.
+                    referencedFromPath ? [...referencedFromPath, ...currentPath.slice(2)] : currentPath);
                     // Store the mapping between hashed keys and original URLs in x-ext-urls
                     // This allows tracking which external URLs were bundled and their corresponding locations
                     setValueAtPath(documentRoot, `/${config.externalDocumentsMappingsKey}/${escapeJsonPointer(compressedPath)}`, relativePath);
@@ -478,7 +480,7 @@ export async function bundle(input, config) {
             if (key === config.externalDocumentsKey || key === config.externalDocumentsMappingsKey) {
                 continue;
             }
-            await bundler(root[key], id ?? origin, isChunkParent, depth + 1, [...currentPath, key], root);
+            await bundler(root[key], id ?? origin, isChunkParent, depth + 1, [...currentPath, key], root, referencedFromPath);
         }
         await executeHooks('onAfterNodeProcess', root, context);
     };

package/dist/bundle/index.d.ts

@@ -1,3 +1,4 @@
+export { resolveReferencePath } from '../helpers/resolve-reference-path.js';
 export type { LifecyclePlugin, LoaderPlugin, Plugin, ResolveResult } from './bundle.js';
 export { bundle, extensions, isLocalRef, prefixInternalRef, prefixInternalRefRecursive, resolveAndCopyReferences, } from './bundle.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/bundle/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundle/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACpF,OAAO,EACL,MAAM,EACN,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,UAAU,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/bundle/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAA;AAEvE,YAAY,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACpF,OAAO,EACL,MAAM,EACN,UAAU,EACV,UAAU,EACV,iBAAiB,EACjB,0BAA0B,EAC1B,wBAAwB,GACzB,MAAM,UAAU,CAAA"}

package/dist/bundle/index.js

@@ -1 +1,2 @@
+export { resolveReferencePath } from '../helpers/resolve-reference-path.js';
 export { bundle, extensions, isLocalRef, prefixInternalRef, prefixInternalRefRecursive, resolveAndCopyReferences, } from './bundle.js';

package/dist/bundle/plugins/browser.d.ts

@@ -1,4 +1,4 @@
-export { fetchUrls } from './fetch-urls/index.js';
+export { fetchUrls } from './fetch-urls/browser.js';
 export { parseJson } from './parse-json/index.js';
 export { parseYaml } from './parse-yaml/index.js';
 //# sourceMappingURL=browser.d.ts.map

package/dist/bundle/plugins/browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/bundle/plugins/browser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA"}
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../src/bundle/plugins/browser.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAA"}

package/dist/bundle/plugins/browser.js

@@ -1,4 +1,4 @@
 // biome-ignore lint/performance/noBarrelFile: entrypoint
-export { fetchUrls } from './fetch-urls/index.js';
+export { fetchUrls } from './fetch-urls/browser.js';
 export { parseJson } from './parse-json/index.js';
 export { parseYaml } from './parse-yaml/index.js';

package/dist/bundle/plugins/fetch-urls/browser.d.ts

@@ -0,0 +1,16 @@
+import type { LoaderPlugin } from '../../../bundle/index.js';
+type FetchConfig = Partial<{
+    headers: {
+        headers: HeadersInit;
+        domains: string[];
+    }[];
+    fetch: (input: string | URL | globalThis.Request, init?: RequestInit) => Promise<Response>;
+}>;
+/**
+ * Creates a browser-safe plugin for handling remote URL references.
+ */
+export declare const fetchUrls: (config?: FetchConfig & Partial<{
+    limit: number | null;
+}>) => LoaderPlugin;
+export {};
+//# sourceMappingURL=browser.d.ts.map

package/dist/bundle/plugins/fetch-urls/browser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/fetch-urls/browser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,UAAU,CAAA;AAI3D,KAAK,WAAW,GAAG,OAAO,CAAC;IACzB,OAAO,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;IACtD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3F,CAAC,CAAA;AA+CF;;GAEG;AACH,eAAO,MAAM,SAAS,GAAI,SAAS,WAAW,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,KAAG,YAQpF,CAAA"}

package/dist/bundle/plugins/fetch-urls/browser.js

@@ -0,0 +1,51 @@
+import { createLimiter } from '@scalar/helpers/general/create-limiter';
+import { isHttpUrl } from '../../../helpers/is-http-url.js';
+import { normalize } from '../../../helpers/normalize.js';
+/**
+ * Safely checks for host from a URL.
+ * Needed because we cannot create a URL from a relative remote URL such as examples/openapi.json.
+ */
+const getHost = (url) => {
+    try {
+        return new URL(url).host;
+    }
+    catch {
+        return null;
+    }
+};
+/**
+ * Fetches and normalizes data from a remote URL in a browser environment.
+ */
+const fetchUrl = async (url, limiter, config) => {
+    try {
+        const host = getHost(url);
+        const headers = config?.headers?.find((a) => a.domains.find((d) => d === host) !== undefined)?.headers;
+        const exec = config?.fetch ?? fetch;
+        const result = await limiter(() => exec(url, { headers }));
+        if (result.ok) {
+            const body = await result.text();
+            return { ok: true, data: normalize(body), raw: body };
+        }
+        const contentType = result.headers.get('Content-Type') ?? '';
+        if (['text/html', 'application/xml'].includes(contentType)) {
+            console.warn(`[WARN] We only support JSON/YAML formats, received ${contentType}`);
+        }
+        console.warn(`[WARN] Fetch failed with status ${result.status} ${result.statusText} for URL: ${url}`);
+        return { ok: false };
+    }
+    catch {
+        console.warn(`[WARN] Failed to parse JSON/YAML from URL: ${url}`);
+        return { ok: false };
+    }
+};
+/**
+ * Creates a browser-safe plugin for handling remote URL references.
+ */
+export const fetchUrls = (config) => {
+    const limiter = config?.limit ? createLimiter(config.limit) : (fn) => fn();
+    return {
+        type: 'loader',
+        validate: isHttpUrl,
+        exec: (value) => fetchUrl(value, limiter, config),
+    };
+};

package/dist/bundle/plugins/fetch-urls/fetch-public-url.d.ts

@@ -0,0 +1,3 @@
+/** Fetches through a connection pinned to validated addresses while preserving the host and TLS name. */
+export declare const fetchPublicUrl: (url: string, headers?: HeadersInit) => Promise<Response>;
+//# sourceMappingURL=fetch-public-url.d.ts.map

package/dist/bundle/plugins/fetch-urls/fetch-public-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-public-url.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/fetch-urls/fetch-public-url.ts"],"names":[],"mappings":"AAIA,yGAAyG;AACzG,eAAO,MAAM,cAAc,GAAU,KAAK,MAAM,EAAE,UAAU,WAAW,KAAG,OAAO,CAAC,QAAQ,CAwCzF,CAAA"}

package/dist/bundle/plugins/fetch-urls/fetch-public-url.js

@@ -0,0 +1,42 @@
+import { Agent, fetch } from 'undici';
+import { resolvePublicHost } from './is-blocked-host.js';
+/** Fetches through a connection pinned to validated addresses while preserving the host and TLS name. */
+export const fetchPublicUrl = async (url, headers) => {
+    const target = new URL(url);
+    if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+        throw new Error('Only HTTP and HTTPS URLs are supported');
+    }
+    const addresses = await resolvePublicHost(target.hostname);
+    if (!addresses) {
+        throw new Error('Refused to fetch a private or internal address');
+    }
+    // Never resolve the hostname again when connecting. A later DNS answer could point at a private IP.
+    const dispatcher = new Agent({
+        connect: {
+            lookup: (_hostname, options, callback) => {
+                if (options.all) {
+                    callback(null, addresses);
+                }
+                else {
+                    callback(null, addresses[0].address, addresses[0].family);
+                }
+            },
+        },
+    });
+    try {
+        const response = await fetch(target, {
+            headers: Object.fromEntries(new Headers(headers)),
+            redirect: 'error',
+            dispatcher,
+        });
+        const body = !response.ok || [204, 205].includes(response.status) ? null : await response.arrayBuffer();
+        return new Response(body, {
+            status: response.status,
+            statusText: response.statusText,
+            headers: Object.fromEntries(response.headers),
+        });
+    }
+    finally {
+        await dispatcher.destroy();
+    }
+};

package/dist/bundle/plugins/fetch-urls/index.d.ts

@@ -4,7 +4,14 @@ type FetchConfig = Partial<{
         headers: HeadersInit;
         domains: string[];
     }[];
+    /** Custom transports cannot be combined with blockPrivateNetworks. */
     fetch: (input: string | URL | globalThis.Request, init?: RequestInit) => Promise<Response>;
+    /**
+     * When true, refuse to fetch URLs that resolve to a private, loopback, link-local, or otherwise
+     * internal address. Only enforced in Node, where DNS resolution is available. Off by default so
+     * existing callers keep working unchanged.
+     */
+    blockPrivateNetworks: boolean;
 }>;
 /**
  * Fetches and normalizes data from a remote URL

package/dist/bundle/plugins/fetch-urls/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/fetch-urls/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAI3D,KAAK,WAAW,GAAG,OAAO,CAAC;IACzB,OAAO,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;IACtD,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC3F,CAAC,CAAA;AAcF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAChD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,aAAa,CAAC,CA0CxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,GAAG,YAAY,CAShG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/fetch-urls/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAI3D,KAAK,WAAW,GAAG,OAAO,CAAC;IACzB,OAAO,EAAE;QAAE,OAAO,EAAE,WAAW,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAA;IACtD,sEAAsE;IACtE,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1F;;;;OAIG;IACH,oBAAoB,EAAE,OAAO,CAAA;CAC9B,CAAC,CAAA;AAcF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,EAChD,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,GAAG,YAAY,CAShG"}

package/dist/bundle/plugins/fetch-urls/index.js

@@ -30,12 +30,19 @@ const getHost = (url) => {
 export async function fetchUrl(url, limiter, config) {
     try {
         const host = getHost(url);
-        // Get the headers that match the domain
         const headers = config?.headers?.find((a) => a.domains.find((d) => d === host) !== undefined)?.headers;
-        const exec = config?.fetch ?? fetch;
-        const result = await limiter(() => exec(url, {
-            headers,
-        }));
+        const guarded = config?.blockPrivateNetworks && typeof window === 'undefined';
+        const result = await limiter(async () => {
+            if (guarded) {
+                // A custom fetch can ignore the pinned connection and resolve the host again.
+                if (config?.fetch) {
+                    throw new Error('Custom fetch cannot be combined with private network blocking');
+                }
+                const { fetchPublicUrl } = await import('./fetch-public-url.js');
+                return fetchPublicUrl(url, headers);
+            }
+            return (config?.fetch ?? fetch)(url, { headers });
+        });
         if (result.ok) {
             const body = await result.text();
             return {

package/dist/bundle/plugins/fetch-urls/is-blocked-host.d.ts

@@ -0,0 +1,18 @@
+import type { LookupAddress } from 'node:dns';
+/**
+ * Reports whether a hostname resolves to a private, loopback, link-local, or otherwise internal
+ * address that a bundled `$ref` should not be allowed to reach.
+ *
+ * Literal IPs are checked directly. Hostnames are resolved via DNS and every returned address is
+ * checked, so a name that points at an internal IP is rejected. A host that cannot be resolved is
+ * treated as blocked.
+ *
+ * This lives in a Node-only module because it depends on `node:dns` and `node:net`. Load it with a
+ * dynamic import so the browser build of the fetch plugin stays free of Node built-ins.
+ *
+ * @param hostname - The hostname or IP (brackets around an IPv6 literal are tolerated).
+ */
+export declare const isBlockedHost: (hostname: string) => Promise<boolean>;
+/** Resolves a host once and returns only validated public addresses, or null when blocked. */
+export declare const resolvePublicHost: (hostname: string) => Promise<LookupAddress[] | null>;
+//# sourceMappingURL=is-blocked-host.d.ts.map

package/dist/bundle/plugins/fetch-urls/is-blocked-host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-blocked-host.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/fetch-urls/is-blocked-host.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAqE7C;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,aAAa,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,OAAO,CAAiD,CAAA;AAEvH,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,GAAU,UAAU,MAAM,KAAG,OAAO,CAAC,aAAa,EAAE,GAAG,IAAI,CAWxF,CAAA"}

package/dist/bundle/plugins/fetch-urls/is-blocked-host.js

@@ -0,0 +1,81 @@
+import { lookup } from 'node:dns/promises';
+import { BlockList, isIP, isIPv4 } from 'node:net';
+/**
+ * Address ranges that must never be reachable through a bundled `$ref`.
+ *
+ * Covers loopback, private, link-local (including the cloud metadata endpoint 169.254.169.254),
+ * carrier-grade NAT, and their IPv6 equivalents. The IPv6 transition ranges (6to4, NAT64, Teredo,
+ * IPv4-compatible) are blocked wholesale so an address like 64:ff9b::a9fe:a9fe cannot smuggle a
+ * private IPv4 destination past the checks. Those ranges are deprecated or rarely used for real API
+ * hosting, so blocking them outright is a safe trade.
+ */
+const blockList = new BlockList();
+blockList.addAddress('0.0.0.0', 'ipv4');
+blockList.addSubnet('127.0.0.0', 8, 'ipv4');
+blockList.addSubnet('10.0.0.0', 8, 'ipv4');
+blockList.addSubnet('172.16.0.0', 12, 'ipv4');
+blockList.addSubnet('192.168.0.0', 16, 'ipv4');
+blockList.addSubnet('169.254.0.0', 16, 'ipv4');
+blockList.addSubnet('100.64.0.0', 10, 'ipv4');
+blockList.addSubnet('::', 96, 'ipv6'); // unspecified, loopback (::1), and deprecated IPv4-compatible
+blockList.addSubnet('fe80::', 10, 'ipv6'); // link-local
+blockList.addSubnet('fc00::', 7, 'ipv6'); // unique local
+blockList.addSubnet('2002::', 16, 'ipv6'); // 6to4
+blockList.addSubnet('64:ff9b::', 96, 'ipv6'); // NAT64
+blockList.addSubnet('64:ff9b:1::', 48, 'ipv6'); // local NAT64 translation prefixes
+blockList.addSubnet('2001::', 32, 'ipv6'); // Teredo
+/**
+ * Checks whether a single IP address falls inside a blocked range.
+ */
+const ipIsBlocked = (ip) => {
+    const family = isIP(ip);
+    if (family === 0) {
+        // Not a valid IP, block to be safe
+        return true;
+    }
+    if (blockList.check(ip, family === 4 ? 'ipv4' : 'ipv6')) {
+        return true;
+    }
+    // Normalize an IPv4-mapped IPv6 address (::ffff:x.x.x.x, in dotted or hex form) and re-check it
+    // against the IPv4 rules, since it targets the embedded IPv4 destination.
+    const dotted = ip.match(/^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i);
+    if (dotted && isIPv4(dotted[1]) && blockList.check(dotted[1], 'ipv4')) {
+        return true;
+    }
+    const hex = ip.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i);
+    if (hex) {
+        const high = Number.parseInt(hex[1], 16);
+        const low = Number.parseInt(hex[2], 16);
+        const mapped = `${(high >> 8) & 0xff}.${high & 0xff}.${(low >> 8) & 0xff}.${low & 0xff}`;
+        if (blockList.check(mapped, 'ipv4')) {
+            return true;
+        }
+    }
+    return false;
+};
+/**
+ * Reports whether a hostname resolves to a private, loopback, link-local, or otherwise internal
+ * address that a bundled `$ref` should not be allowed to reach.
+ *
+ * Literal IPs are checked directly. Hostnames are resolved via DNS and every returned address is
+ * checked, so a name that points at an internal IP is rejected. A host that cannot be resolved is
+ * treated as blocked.
+ *
+ * This lives in a Node-only module because it depends on `node:dns` and `node:net`. Load it with a
+ * dynamic import so the browser build of the fetch plugin stays free of Node built-ins.
+ *
+ * @param hostname - The hostname or IP (brackets around an IPv6 literal are tolerated).
+ */
+export const isBlockedHost = async (hostname) => (await resolvePublicHost(hostname)) === null;
+/** Resolves a host once and returns only validated public addresses, or null when blocked. */
+export const resolvePublicHost = async (hostname) => {
+    const host = hostname.replace(/^\[/, '').replace(/\]$/, '');
+    try {
+        const family = isIP(host);
+        const addresses = family ? [{ address: host, family }] : await lookup(host, { all: true });
+        return addresses.length === 0 || addresses.some(({ address }) => ipIsBlocked(address)) ? null : addresses;
+    }
+    catch {
+        return null;
+    }
+};

package/dist/bundle/plugins/read-files/index.d.ts

@@ -1,7 +1,8 @@
 import type { LoaderPlugin, ResolveResult } from '../../../bundle/index.js';
 /**
  * Reads and normalizes data from a local file
- * @param path - The file path to read from
+ * @param filePath - The file path to read from
+ * @param basePath - When set, reads are confined to this directory so a `$ref` cannot escape it
  * @returns A promise that resolves to either the normalized data or an error result
  * @example
  * ```ts
@@ -13,17 +14,20 @@ import type { LoaderPlugin, ResolveResult } from '../../../bundle/index.js';
  * }
  * ```
  */
-export declare function readFile(path: string): Promise<ResolveResult>;
+export declare function readFile(filePath: string, basePath?: string): Promise<ResolveResult>;
 /**
  * Creates a plugin for handling local file references.
  * This plugin validates and reads data from local filesystem paths.
  *
  * @returns A plugin object with validate and exec functions
+ * @param config - Optional settings. `basePath` confines reads to a directory.
  * @example
  * const filePlugin = readFiles()
  * if (filePlugin.validate('./local-schema.json')) {
  *   const result = await filePlugin.exec('./local-schema.json')
  * }
  */
-export declare function readFiles(): LoaderPlugin;
+export declare function readFiles(config?: {
+    basePath?: string;
+}): LoaderPlugin;
 //# sourceMappingURL=index.d.ts.map

package/dist/bundle/plugins/read-files/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/read-files/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAI3D;;;;;;;;;;;;;GAaG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBnE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,IAAI,YAAY,CAMxC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/bundle/plugins/read-files/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AA8B3D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CA6B1F;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAMtE"}

package/dist/bundle/plugins/read-files/index.js

@@ -1,8 +1,32 @@
+import path from 'pathe';
 import { isFilePath } from '../../../helpers/is-file-path.js';
 import { normalize } from '../../../helpers/normalize.js';
+/**
+ * Resolves a path to its real location, following symlinks. Falls back to a lexical resolve when the
+ * path does not exist yet, so a missing file is still confined (the read fails afterwards anyway).
+ */
+const realpathOrResolve = async (fs, target) => {
+    try {
+        return await fs.realpath(path.resolve(target));
+    }
+    catch {
+        return path.resolve(target);
+    }
+};
+/**
+ * Reports whether a file escapes the allowed base directory. Symlinks are dereferenced first, so a
+ * link inside the base directory cannot point at a file outside it.
+ */
+const isOutsideBasePath = async (fs, filePath, basePath) => {
+    const realBase = await realpathOrResolve(fs, basePath);
+    const realTarget = await realpathOrResolve(fs, filePath);
+    const relative = path.relative(realBase, realTarget);
+    return relative === '..' || relative.startsWith('../') || path.isAbsolute(relative);
+};
 /**
  * Reads and normalizes data from a local file
- * @param path - The file path to read from
+ * @param filePath - The file path to read from
+ * @param basePath - When set, reads are confined to this directory so a `$ref` cannot escape it
  * @returns A promise that resolves to either the normalized data or an error result
  * @example
  * ```ts
@@ -14,13 +38,21 @@ import { normalize } from '../../../helpers/normalize.js';
  * }
  * ```
  */
-export async function readFile(path) {
+export async function readFile(filePath, basePath) {
     const fs = typeof window === 'undefined' ? await import('node:fs/promises') : undefined;
     if (fs === undefined) {
         throw 'Can not use readFiles plugin outside of a node environment';
     }
+    // Confine reads to basePath when provided, so a `$ref` like `../../../../etc/passwd` (or a symlink
+    // pointing outside the directory) cannot read files outside the document's directory.
+    if (basePath !== undefined && (await isOutsideBasePath(fs, filePath, basePath))) {
+        console.warn(`[WARN] Refused to read a file outside the allowed directory: ${filePath}`);
+        return {
+            ok: false,
+        };
+    }
     try {
-        const fileContents = await fs.readFile(path, { encoding: 'utf-8' });
+        const fileContents = await fs.readFile(filePath, { encoding: 'utf-8' });
         return {
             ok: true,
             data: normalize(fileContents),
@@ -38,16 +70,17 @@ export async function readFile(path) {
  * This plugin validates and reads data from local filesystem paths.
  *
  * @returns A plugin object with validate and exec functions
+ * @param config - Optional settings. `basePath` confines reads to a directory.
  * @example
  * const filePlugin = readFiles()
  * if (filePlugin.validate('./local-schema.json')) {
  *   const result = await filePlugin.exec('./local-schema.json')
  * }
  */
-export function readFiles() {
+export function readFiles(config) {
     return {
         type: 'loader',
         validate: isFilePath,
-        exec: readFile,
+        exec: (value) => readFile(value, config?.basePath),
     };
 }

package/dist/diff/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/diff/utils.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,OAAO,EAAE,GAAG,OAAO,KAAG,OAoCxD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAsB3G,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,YAY7C,CAAA"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/diff/utils.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,eAAe,GAAI,GAAG,OAAO,EAAE,GAAG,OAAO,KAAG,OAoCxD,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,GAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAsB3G,CAAA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,YAAY,GAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,YAY7C,CAAA"}

package/dist/diff/utils.js

@@ -1,3 +1,4 @@
+import { isObjectLike } from '@scalar/helpers/object/is-object';
 import { isPollutionKey } from '@scalar/helpers/object/prevent-pollution';
 /**
  * Deep check for objects for collisions
@@ -96,7 +97,7 @@ export const mergeObjects = (a, b) => {
         else {
             const aValue = a[key];
             const bValue = b[key];
-            if (typeof aValue === 'object' && aValue !== null && typeof bValue === 'object' && bValue !== null) {
+            if (isObjectLike(aValue) && isObjectLike(bValue)) {
                 a[key] = mergeObjects(aValue, bValue);
             }
         }

package/package.json

@@ -10,7 +10,7 @@
     "url": "git+https://github.com/scalar/scalar.git",
     "directory": "packages/json-magic"
   },
-  "version": "0.13.3",
+  "version": "0.13.5",
   "engines": {
     "node": ">=22"
   },
@@ -108,8 +108,9 @@
   ],
   "dependencies": {
     "pathe": "^2.0.3",
+    "undici": "7.24.4",
     "yaml": "^2.9.0",
-    "@scalar/helpers": "0.11.2"
+    "@scalar/helpers": "0.12.0"
   },
   "devDependencies": {
     "fastify": "^5.11.2",