nexus-ai-pro 2.20.2 → 2.22.0

package/dist/agent/openapi.js

@@ -1,3 +1,4 @@
+import { decodeBase64, encodeBase64 } from '../utils/base64.js';
 import { linkSignals } from '../utils/signals.js';
 export class OpenApiError extends Error {
     code;
@@ -12,6 +13,16 @@ export class OpenApiError extends Error {
 const METHODS = ['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace'];
 const IGNORED_HEADERS = new Set(['accept', 'content-type', 'authorization']);
 const OPENAPI_ONLY = new Set(['nullable', 'example', 'xml', 'externalDocs', 'discriminator']);
+const FILE_SCHEMA = {
+    type: 'object',
+    description: 'A file, its bytes as base64',
+    properties: {
+        base64: { type: 'string', description: 'The bytes, base64-encoded' },
+        filename: { type: 'string' },
+        mimeType: { type: 'string' },
+    },
+    required: ['base64'],
+};
 export function openApiTools(document, options = {}) {
     const doc = parseDocument(document);
     const apiName = options.name ?? (slug(doc.info?.title ?? '') || 'api');
@@ -19,8 +30,11 @@ export function openApiTools(document, options = {}) {
     const tools = [];
     const operations = [];
     const results = {};
-    const skipped = [];
     const used = new Set();
+    const schemes = isRecord(doc.components?.securitySchemes)
+        ? doc.components.securitySchemes
+        : {};
+    const tokens = new Map();
     for (const [path, item] of Object.entries(doc.paths ?? {})) {
         const pathItem = deref(doc, item);
         for (const method of METHODS) {
@@ -37,17 +51,13 @@ export function openApiTools(document, options = {}) {
                 ...(typeof raw.summary === 'string' ? { summary: raw.summary } : {}),
                 tags: Array.isArray(raw.tags) ? raw.tags.map(String) : [],
                 access: method === 'delete' ? 'destructive' : ['get', 'head', 'options', 'trace'].includes(method) ? 'read' : 'write',
+                security: securityOf(raw.security ?? doc.security),
             };
             if (options.include && !options.include(operation)) {
                 used.delete(name);
                 continue;
             }
             const built = buildOperation(doc, pathItem, raw);
-            if ('skip' in built) {
-                used.delete(name);
-                skipped.push({ method: operation.method, path, reason: built.skip });
-                continue;
-            }
             operations.push(operation);
             if (built.result)
                 results[name] = built.result;
@@ -59,11 +69,23 @@ export function openApiTools(document, options = {}) {
                     `api.${operation.access}:${apiName}/${name}`,
                     ...(baseUrl ? [`network:${new URL(baseUrl).host}`] : []),
                 ],
-                ...(baseUrl ? { execute: caller(operation, built.placements, built.bodyType, baseUrl, options) } : {}),
+                ...(baseUrl
+                    ? {
+                        execute: caller(operation, built.placements, built.body, baseUrl, options, (headers, url, context) => authorize(operation, schemes, options, context, headers, url, baseUrl, tokens)),
+                    }
+                    : {}),
             });
         }
     }
-    return { name: apiName, ...(baseUrl ? { baseUrl } : {}), tools, operations, results, skipped };
+    return {
+        name: apiName,
+        ...(baseUrl ? { baseUrl } : {}),
+        tools,
+        operations,
+        results,
+        skipped: [],
+        webhooks: webhooksOf(doc),
+    };
 }
 export async function loadOpenApiTools(url, options = {}) {
     const response = await (options.fetch ?? globalThis.fetch)(url, {
@@ -72,7 +94,18 @@ export async function loadOpenApiTools(url, options = {}) {
     });
     if (!response.ok)
         throw new OpenApiError(`The OpenAPI document at ${url} answered ${response.status}`, 'OPENAPI_REQUEST', response.status);
-    return openApiTools(await response.text(), { documentUrl: url, ...options });
+    const doc = parseDocument(await readCapped(response, options.maxBytes ?? 5_000_000, `The OpenAPI document at ${url}`));
+    const bundled = hasOutsideRef(doc) ? await bundleOpenApiDocument(doc, { ...options, documentUrl: url }) : doc;
+    return openApiTools(bundled, { documentUrl: url, ...options });
+}
+function hasOutsideRef(value) {
+    if (Array.isArray(value))
+        return value.some(hasOutsideRef);
+    if (!isRecord(value))
+        return false;
+    if (typeof value.$ref === 'string' && !value.$ref.startsWith('#'))
+        return true;
+    return Object.values(value).some(hasOutsideRef);
 }
 function parseDocument(document) {
     let doc = document;
@@ -86,6 +119,8 @@ function parseDocument(document) {
     }
     if (!isRecord(doc))
         throw new OpenApiError('An OpenAPI document is an object', 'OPENAPI_INVALID');
+    if (doc.swagger === '2.0')
+        return swaggerToOpenApi(doc);
     if (typeof doc.swagger === 'string') {
         throw new OpenApiError(`Swagger ${doc.swagger} is not read; convert the document to OpenAPI 3`, 'OPENAPI_UNSUPPORTED');
     }
@@ -124,7 +159,7 @@ function deref(doc, value, seen = []) {
 }
 function resolve(doc, ref) {
     if (!ref.startsWith('#')) {
-        throw new OpenApiError(`${ref} is outside the document; only references within it are followed`, 'OPENAPI_UNSUPPORTED');
+        throw new OpenApiError(`${ref} is outside the document: read it with loadOpenApiTools(), or bundleOpenApiDocument() first`, 'OPENAPI_UNSUPPORTED');
     }
     let node = doc;
     for (const part of ref.slice(1).split('/').slice(1)) {
@@ -223,39 +258,56 @@ function buildOperation(doc, pathItem, raw) {
             required.push(arg);
         placements.push({ arg, name, in: place });
     }
-    let bodyType;
+    let bodyOf;
     const body = deref(doc, raw.requestBody);
-    if (isRecord(body) && isRecord(body.content)) {
+    if (isRecord(body) && isRecord(body.content) && Object.keys(body.content).length) {
         const types = Object.keys(body.content);
-        const json = types.find((type) => /^application\/(?:[\w.+-]+\+)?json\b/i.test(type));
-        const form = types.find((type) => /^application\/x-www-form-urlencoded\b/i.test(type));
-        const chosen = json ?? form;
-        if (!chosen)
-            return { skip: `its request body is ${types.join(' or ')}; only JSON and form bodies are sent` };
-        bodyType = json ? 'json' : 'form';
-        const media = body.content[chosen];
+        const find = (pattern) => types.find((type) => pattern.test(type));
+        const chosen = [
+            ['json', find(/^application\/(?:[\w.+-]+\+)?json\b/i)],
+            ['form', find(/^application\/x-www-form-urlencoded\b/i)],
+            ['multipart', find(/^multipart\/form-data\b/i)],
+            ['text', find(/^text\/|^application\/(?:[\w.+-]+\+)?xml\b/i)],
+        ].find((candidate) => candidate[1] !== undefined) ?? ['binary', types[0]];
+        bodyOf = { type: chosen[0], mediaType: chosen[1] };
+        const media = body.content[bodyOf.mediaType];
         const schema = schemaOf(doc, isRecord(media) ? media.schema : undefined, 'readOnly');
         const fields = isRecord(schema.properties) ? schema.properties : undefined;
-        const flat = fields &&
+        const fielded = bodyOf.type === 'json' || bodyOf.type === 'form' || bodyOf.type === 'multipart';
+        const flat = fielded &&
+            fields &&
             (schema.type === 'object' || schema.type === undefined) &&
             !schema.allOf &&
             !schema.anyOf &&
             !schema.oneOf &&
             Object.keys(fields).every((field) => !(field in properties));
-        if (flat) {
+        if (flat && fields) {
             const fieldsRequired = new Set(Array.isArray(schema.required) ? schema.required.map(String) : []);
             for (const [field, fieldSchema] of Object.entries(fields)) {
-                properties[field] = fieldSchema;
+                const file = bodyOf.type === 'multipart' && isFile(fieldSchema);
+                properties[field] = file
+                    ? {
+                        ...FILE_SCHEMA,
+                        ...(isRecord(fieldSchema) && typeof fieldSchema.description === 'string'
+                            ? { description: fieldSchema.description }
+                            : {}),
+                    }
+                    : fieldSchema;
                 if (body.required === true && fieldsRequired.has(field))
                     required.push(field);
-                placements.push({ arg: field, name: field, in: 'body-field' });
+                placements.push({ arg: field, name: field, in: 'body-field', ...(file ? { file: true } : {}) });
             }
         }
         else {
             const arg = 'body' in properties ? 'requestBody' : 'body';
+            const shape = bodyOf.type === 'binary'
+                ? FILE_SCHEMA
+                : bodyOf.type === 'text'
+                    ? { type: 'string', ...(typeof schema.description === 'string' ? { description: schema.description } : {}) }
+                    : schema;
             properties[arg] = {
-                ...schema,
-                ...(typeof body.description === 'string' && !schema.description ? { description: body.description } : {}),
+                ...shape,
+                ...(typeof body.description === 'string' && !shape.description ? { description: body.description } : {}),
             };
             if (body.required === true)
                 required.push(arg);
@@ -285,16 +337,77 @@ function buildOperation(doc, pathItem, raw) {
             additionalProperties: false,
         },
         placements,
-        ...(bodyType ? { bodyType } : {}),
+        ...(bodyOf ? { body: bodyOf } : {}),
         ...(result ? { result } : {}),
     };
 }
+function isFile(schema) {
+    if (!isRecord(schema))
+        return false;
+    return (schema.format === 'binary' || (typeof schema.contentMediaType === 'string' && schema.contentEncoding === undefined));
+}
+function securityOf(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .filter(isRecord)
+        .map((alternative) => Object.fromEntries(Object.entries(alternative).map(([name, scopes]) => [name, Array.isArray(scopes) ? scopes.map(String) : []])));
+}
+function webhooksOf(doc) {
+    const found = [];
+    const bodyOf = (operation) => {
+        const body = deref(doc, operation.requestBody);
+        const content = isRecord(body) && isRecord(body.content) ? body.content : undefined;
+        const json = content && Object.keys(content).find((type) => /json/i.test(type));
+        const media = json && content ? content[json] : undefined;
+        return isRecord(media) && media.schema !== undefined ? schemaOf(doc, media.schema, 'readOnly') : undefined;
+    };
+    const add = (name, source, item, expression) => {
+        const pathItem = deref(doc, item);
+        if (!isRecord(pathItem))
+            return;
+        for (const method of METHODS) {
+            const operation = pathItem[method];
+            if (!isRecord(operation))
+                continue;
+            const body = bodyOf(operation);
+            found.push({
+                name,
+                source,
+                method: method.toUpperCase(),
+                ...(expression ? { expression } : {}),
+                ...(body ? { body } : {}),
+            });
+        }
+    };
+    for (const [name, item] of Object.entries(isRecord(doc.webhooks) ? doc.webhooks : {}))
+        add(name, 'webhook', item);
+    for (const [path, item] of Object.entries(doc.paths ?? {})) {
+        const pathItem = deref(doc, item);
+        if (!isRecord(pathItem))
+            continue;
+        for (const method of METHODS) {
+            const operation = pathItem[method];
+            if (!isRecord(operation) || !isRecord(operation.callbacks))
+                continue;
+            const owner = typeof operation.operationId === 'string' ? operation.operationId : `${method}_${path}`;
+            for (const [callback, raw] of Object.entries(operation.callbacks)) {
+                const expressions = deref(doc, raw);
+                if (!isRecord(expressions))
+                    continue;
+                for (const [expression, callbackItem] of Object.entries(expressions))
+                    add(`${owner}.${callback}`, 'callback', callbackItem, expression);
+            }
+        }
+    }
+    return found;
+}
 function describe(raw, operation) {
     const text = [raw.summary, raw.description].filter((part) => typeof part === 'string' && part.trim() !== '');
     const said = text.length ? text.join('\n\n') : `${operation.method} ${operation.path}`;
     return said.length > 1_024 ? `${said.slice(0, 1_021)}...` : said;
 }
-function caller(operation, placements, bodyType, baseUrl, options) {
+function caller(operation, placements, bodyOf, baseUrl, options, authorizing) {
     const base = new URL(`${baseUrl}/`);
     return async (args, context) => {
         context?.signal?.throwIfAborted();
@@ -333,13 +446,41 @@ function caller(operation, placements, bodyType, baseUrl, options) {
         const own = typeof options.headers === 'function' ? await options.headers({ operation, context }) : options.headers;
         for (const [name, value] of Object.entries(own ?? {}))
             headers[name.toLowerCase()] = value;
+        await authorizing(headers, url, context);
         let payload;
-        if (body !== undefined && bodyType === 'form') {
+        const type = bodyOf?.type ?? 'json';
+        if (body !== undefined && type === 'form') {
             headers['content-type'] = 'application/x-www-form-urlencoded';
             payload = new URLSearchParams(Object.entries(body).map(([key, value]) => [key, text(value)])).toString();
         }
+        else if (body !== undefined && type === 'multipart') {
+            const form = new FormData();
+            const files = new Set(placements.filter((item) => item.file).map((item) => item.name));
+            for (const [key, value] of Object.entries(body)) {
+                if (files.has(key)) {
+                    const file = fileOf(value, `${operation.name}'s "${key}"`);
+                    form.append(key, new Blob([file.bytes], { type: file.mimeType ?? 'application/octet-stream' }), file.filename ?? key);
+                }
+                else
+                    form.append(key, text(value));
+            }
+            payload = form;
+        }
+        else if (body !== undefined && type === 'text') {
+            headers['content-type'] = bodyOf?.mediaType ?? 'text/plain';
+            payload = text(body);
+        }
+        else if (body !== undefined && type === 'binary') {
+            const file = fileOf(body, `${operation.name}'s body`);
+            headers['content-type'] =
+                file.mimeType ??
+                    (bodyOf?.mediaType.includes('*')
+                        ? 'application/octet-stream'
+                        : (bodyOf?.mediaType ?? 'application/octet-stream'));
+            payload = file.bytes;
+        }
         else if (body !== undefined) {
-            headers['content-type'] = 'application/json';
+            headers['content-type'] = bodyOf?.mediaType ?? 'application/json';
             payload = JSON.stringify(body);
         }
         const linked = linkSignals([context?.signal, AbortSignal.timeout(options.timeoutMs ?? 30_000)]);
@@ -351,7 +492,7 @@ function caller(operation, placements, bodyType, baseUrl, options) {
                 redirect: 'manual',
                 signal: linked.signal,
             });
-            const answer = await readCapped(response, options.maxResponseBytes ?? 1_000_000, operation);
+            const answer = await readCapped(response, options.maxResponseBytes ?? 1_000_000, operation.name);
             if (response.status >= 300 && response.status < 400) {
                 throw new OpenApiError(`${operation.name} was redirected to ${response.headers.get('location') ?? 'another place'}, which is not followed`, 'OPENAPI_REQUEST', response.status);
             }
@@ -380,7 +521,105 @@ function caller(operation, placements, bodyType, baseUrl, options) {
         }
     };
 }
-async function readCapped(response, limit, operation) {
+function fileOf(value, what) {
+    const given = typeof value === 'string' ? { base64: value } : isRecord(value) ? value : {};
+    if (typeof given.base64 !== 'string')
+        throw new OpenApiError(`${what} is a file: give its base64`, 'OPENAPI_INVALID');
+    if (!/^[A-Za-z0-9+/=\s]*$/.test(given.base64))
+        throw new OpenApiError(`${what} is not base64`, 'OPENAPI_INVALID');
+    return {
+        bytes: decodeBase64(given.base64),
+        ...(typeof given.filename === 'string' ? { filename: given.filename } : {}),
+        ...(typeof given.mimeType === 'string' ? { mimeType: given.mimeType } : {}),
+    };
+}
+async function authorize(operation, schemes, options, context, headers, url, baseUrl, tokens) {
+    const credentials = options.credentials;
+    if (!credentials || operation.security.length === 0)
+        return;
+    const has = (name) => Object.hasOwn(credentials, name) && isRecord(schemes[name]);
+    const chosen = operation.security.find((alternative) => Object.keys(alternative).every(has));
+    if (!chosen) {
+        const asked = operation.security.map((alternative) => Object.keys(alternative).join(' and ')).join(', or ');
+        throw new OpenApiError(`${operation.name} needs credentials for ${asked}`, 'OPENAPI_INVALID');
+    }
+    for (const [name, scopes] of Object.entries(chosen)) {
+        const scheme = schemes[name];
+        const given = credentials[name];
+        const credential = typeof given === 'function' ? await given({ operation, context }) : given;
+        const fields = (isRecord(credential) ? credential : {});
+        const token = () => {
+            if (typeof credential === 'string')
+                return credential;
+            if (typeof fields.token === 'string')
+                return fields.token;
+            throw new OpenApiError(`The credential for ${name} is a token, as text or { token }`, 'OPENAPI_INVALID');
+        };
+        if (scheme.type === 'apiKey') {
+            const key = String(scheme.name ?? '');
+            if (scheme.in === 'query')
+                url.searchParams.set(key, token());
+            else if (scheme.in === 'cookie') {
+                const cookie = `${key}=${encodeURIComponent(token())}`;
+                headers.cookie = headers.cookie ? `${headers.cookie}; ${cookie}` : cookie;
+            }
+            else
+                headers[key.toLowerCase()] = token();
+        }
+        else if (scheme.type === 'http') {
+            const kind = String(scheme.scheme ?? 'bearer').toLowerCase();
+            if (kind === 'basic') {
+                if (typeof fields.username !== 'string' || typeof fields.password !== 'string') {
+                    throw new OpenApiError(`The credential for ${name} is { username, password }`, 'OPENAPI_INVALID');
+                }
+                headers.authorization = `Basic ${encodeBase64(new TextEncoder().encode(`${fields.username}:${fields.password}`))}`;
+            }
+            else
+                headers.authorization = `${kind === 'bearer' ? 'Bearer' : String(scheme.scheme)} ${token()}`;
+        }
+        else if (scheme.type === 'oauth2' || scheme.type === 'openIdConnect') {
+            const client = typeof fields.clientId === 'string' && typeof fields.clientSecret === 'string'
+                ? { clientId: fields.clientId, clientSecret: fields.clientSecret }
+                : undefined;
+            headers.authorization = `Bearer ${client ? await clientCredentials(name, scheme, client, scopes, baseUrl, options, tokens) : token()}`;
+        }
+        else {
+            throw new OpenApiError(`${name} is ${String(scheme.type)}, which the tools do not send`, 'OPENAPI_UNSUPPORTED');
+        }
+    }
+}
+async function clientCredentials(name, scheme, client, scopes, baseUrl, options, tokens) {
+    const flow = isRecord(scheme.flows) && isRecord(scheme.flows.clientCredentials) ? scheme.flows.clientCredentials : undefined;
+    if (!flow || typeof flow.tokenUrl !== 'string') {
+        throw new OpenApiError(`${name} has no client-credentials flow to fetch a token from`, 'OPENAPI_UNSUPPORTED');
+    }
+    const key = `${name}\u0000${client.clientId}\u0000${[...scopes].sort().join(' ')}`;
+    const kept = tokens.get(key);
+    if (kept && kept.until > Date.now())
+        return kept.token;
+    const response = await (options.fetch ?? globalThis.fetch)(new URL(flow.tokenUrl, `${baseUrl}/`).href, {
+        method: 'POST',
+        headers: {
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+            authorization: `Basic ${encodeBase64(new TextEncoder().encode(`${encodeURIComponent(client.clientId)}:${encodeURIComponent(client.clientSecret)}`))}`,
+        },
+        body: new URLSearchParams({
+            grant_type: 'client_credentials',
+            ...(scopes.length ? { scope: scopes.join(' ') } : {}),
+        }).toString(),
+        redirect: 'manual',
+        signal: AbortSignal.timeout(options.timeoutMs ?? 30_000),
+    });
+    const answer = (await response.json().catch(() => ({})));
+    if (typeof answer.access_token !== 'string') {
+        throw new OpenApiError(`${name}'s token URL answered ${response.status}: ${String(answer.error ?? 'no token')}`, 'OPENAPI_REQUEST', response.status);
+    }
+    const lifetime = typeof answer.expires_in === 'number' ? answer.expires_in * 1_000 : 3_600_000;
+    tokens.set(key, { token: answer.access_token, until: Date.now() + Math.max(0, lifetime - 60_000) });
+    return answer.access_token;
+}
+async function readCapped(response, limit, what) {
     if (!response.body)
         return '';
     const reader = response.body.getReader();
@@ -393,7 +632,7 @@ async function readCapped(response, limit, operation) {
         size += value.byteLength;
         if (size > limit) {
             await reader.cancel().catch(() => undefined);
-            throw new OpenApiError(`${operation.name} answered more than ${limit} bytes`, 'OPENAPI_REQUEST', response.status);
+            throw new OpenApiError(`${what} answered more than ${limit} bytes`, 'OPENAPI_REQUEST', response.status);
         }
         chunks.push(value);
     }
@@ -453,3 +692,260 @@ function isRecord(value) {
 function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+export function swaggerToOpenApi(swagger) {
+    if (swagger.swagger !== '2.0') {
+        throw new OpenApiError(`Swagger ${String(swagger.swagger)} is not 2.0`, 'OPENAPI_UNSUPPORTED');
+    }
+    const moved = renameRefs(swagger);
+    const consumes = stringList(moved.consumes) ?? ['application/json'];
+    const produces = stringList(moved.produces) ?? ['application/json'];
+    const schemes = stringList(moved.schemes) ?? ['https'];
+    const host = typeof moved.host === 'string' ? moved.host : undefined;
+    const basePath = typeof moved.basePath === 'string' ? moved.basePath : '';
+    const components = {};
+    if (isRecord(moved.definitions))
+        components.schemas = moved.definitions;
+    if (isRecord(moved.parameters)) {
+        components.parameters = Object.fromEntries(Object.entries(moved.parameters).map(([name, parameter]) => [
+            name,
+            isRecord(parameter) ? parameterOf(parameter) : parameter,
+        ]));
+    }
+    if (isRecord(moved.responses)) {
+        components.responses = Object.fromEntries(Object.entries(moved.responses).map(([name, response]) => [name, responseOf(response, produces)]));
+    }
+    if (isRecord(moved.securityDefinitions)) {
+        components.securitySchemes = Object.fromEntries(Object.entries(moved.securityDefinitions).map(([name, scheme]) => [name, securitySchemeOf(scheme)]));
+    }
+    const paths = {};
+    for (const [path, item] of Object.entries(isRecord(moved.paths) ? moved.paths : {})) {
+        if (!isRecord(item))
+            continue;
+        const converted = {};
+        const shared = Array.isArray(item.parameters) ? item.parameters : [];
+        for (const [key, value] of Object.entries(item)) {
+            if (key === 'parameters') {
+                converted.parameters = shared.filter((parameter) => !isBodyLike(moved, parameter)).map(parameterOf);
+                continue;
+            }
+            if (!METHODS.includes(key) || !isRecord(value)) {
+                converted[key] = value;
+                continue;
+            }
+            converted[key] = operationOf(moved, value, shared, stringList(value.consumes) ?? consumes, stringList(value.produces) ?? produces);
+        }
+        paths[path] = converted;
+    }
+    const { swagger: _swagger, host: _host, basePath: _basePath, schemes: _schemes, consumes: _consumes, produces: _produces, definitions: _definitions, parameters: _parameters, responses: _responses, securityDefinitions: _security, paths: _paths, ...rest } = moved;
+    return {
+        ...rest,
+        openapi: '3.0.3',
+        ...(host
+            ? { servers: [{ url: `${schemes[0]}://${host}${basePath}` }] }
+            : basePath
+                ? { servers: [{ url: basePath }] }
+                : {}),
+        paths,
+        ...(Object.keys(components).length ? { components } : {}),
+    };
+}
+function renameRefs(value) {
+    if (Array.isArray(value))
+        return value.map(renameRefs);
+    if (!isRecord(value))
+        return value;
+    const out = {};
+    for (const [key, item] of Object.entries(value)) {
+        out[key] =
+            key === '$ref' && typeof item === 'string'
+                ? item
+                    .replace(/^#\/definitions\//, '#/components/schemas/')
+                    .replace(/^#\/parameters\//, '#/components/parameters/')
+                    .replace(/^#\/responses\//, '#/components/responses/')
+                : renameRefs(item);
+    }
+    return out;
+}
+function isBodyLike(doc, parameter) {
+    const found = swaggerParameter(doc, parameter);
+    return found !== undefined && (found.in === 'body' || found.in === 'formData');
+}
+function swaggerParameter(doc, parameter) {
+    if (!isRecord(parameter))
+        return undefined;
+    if (typeof parameter.$ref !== 'string')
+        return parameter;
+    const name = parameter.$ref.replace(/^#\/components\/parameters\//, '');
+    const shared = isRecord(doc.parameters) ? doc.parameters[name] : undefined;
+    return isRecord(shared) ? shared : undefined;
+}
+function parameterOf(parameter) {
+    if (!isRecord(parameter) ||
+        typeof parameter.$ref === 'string' ||
+        parameter.in === 'body' ||
+        parameter.in === 'formData') {
+        return parameter;
+    }
+    const { name, in: place, description, required, ...schema } = parameter;
+    const { collectionFormat: _format, allowEmptyValue: _empty, ...kept } = schema;
+    return {
+        name,
+        in: place,
+        ...(description !== undefined ? { description } : {}),
+        ...(required !== undefined ? { required } : {}),
+        schema: kept,
+    };
+}
+function responseOf(response, produces) {
+    if (!isRecord(response) || typeof response.$ref === 'string')
+        return response;
+    const { schema, examples: _examples, ...rest } = response;
+    return {
+        ...rest,
+        description: typeof rest.description === 'string' ? rest.description : '',
+        ...(schema !== undefined ? { content: { [produces[0] ?? 'application/json']: { schema } } } : {}),
+    };
+}
+function securitySchemeOf(scheme) {
+    if (!isRecord(scheme))
+        return scheme;
+    if (scheme.type === 'basic')
+        return { type: 'http', scheme: 'basic', ...(scheme.description ? { description: scheme.description } : {}) };
+    if (scheme.type !== 'oauth2')
+        return scheme;
+    const flowName = { implicit: 'implicit', password: 'password', application: 'clientCredentials', accessCode: 'authorizationCode' }[String(scheme.flow)] ?? 'clientCredentials';
+    return {
+        type: 'oauth2',
+        ...(scheme.description ? { description: scheme.description } : {}),
+        flows: {
+            [flowName]: {
+                ...(scheme.authorizationUrl ? { authorizationUrl: scheme.authorizationUrl } : {}),
+                ...(scheme.tokenUrl ? { tokenUrl: scheme.tokenUrl } : {}),
+                scopes: isRecord(scheme.scopes) ? scheme.scopes : {},
+            },
+        },
+    };
+}
+function operationOf(doc, operation, shared, consumes, produces) {
+    const own = Array.isArray(operation.parameters) ? operation.parameters : [];
+    const all = [...shared, ...own].map((parameter) => swaggerParameter(doc, parameter) ?? parameter);
+    const body = all.find((parameter) => isRecord(parameter) && parameter.in === 'body');
+    const form = all.filter((parameter) => isRecord(parameter) && parameter.in === 'formData');
+    const { parameters: _parameters, consumes: _consumes, produces: _produces, responses, ...rest } = operation;
+    const out = {
+        ...rest,
+        ...(own.length ? { parameters: own.filter((parameter) => !isBodyLike(doc, parameter)).map(parameterOf) } : {}),
+        responses: Object.fromEntries(Object.entries(isRecord(responses) ? responses : {}).map(([code, response]) => [
+            code,
+            responseOf(response, produces),
+        ])),
+    };
+    if (body) {
+        out.requestBody = {
+            ...(body.description ? { description: body.description } : {}),
+            ...(body.required !== undefined ? { required: body.required } : {}),
+            content: {
+                [consumes.find((type) => /json/i.test(type)) ?? consumes[0] ?? 'application/json']: {
+                    schema: body.schema ?? {},
+                },
+            },
+        };
+    }
+    else if (form.length) {
+        const files = form.some((field) => field.type === 'file');
+        const type = files || consumes.some((item) => /multipart\/form-data/i.test(item))
+            ? 'multipart/form-data'
+            : 'application/x-www-form-urlencoded';
+        const properties = Object.fromEntries(form.map((field) => {
+            const { name: _name, in: _in, required: _required, collectionFormat: _format, ...schema } = field;
+            return [String(field.name), field.type === 'file' ? { ...schema, type: 'string', format: 'binary' } : schema];
+        }));
+        const required = form.filter((field) => field.required === true).map((field) => String(field.name));
+        out.requestBody = {
+            ...(required.length ? { required: true } : {}),
+            content: { [type]: { schema: { type: 'object', properties, ...(required.length ? { required } : {}) } } },
+        };
+    }
+    return out;
+}
+function stringList(value) {
+    return Array.isArray(value) && value.length ? value.map(String) : undefined;
+}
+export async function bundleOpenApiDocument(document, options) {
+    const root = new URL(options.documentUrl);
+    const allowed = (url) => options.references === 'any'
+        ? url.protocol === 'https:' || url.protocol === 'http:'
+        : typeof options.references === 'function'
+            ? options.references(url.href)
+            : url.origin === root.origin;
+    const loaded = new Map([[stripHash(root), Promise.resolve(document)]]);
+    const load = (url) => {
+        const key = stripHash(url);
+        let found = loaded.get(key);
+        if (!found) {
+            if (!allowed(url)) {
+                return Promise.reject(new OpenApiError(`${key} is not a document references may name here`, 'OPENAPI_UNSUPPORTED'));
+            }
+            if (loaded.size >= (options.maxDocuments ?? 50)) {
+                return Promise.reject(new OpenApiError(`The document refers to more than ${options.maxDocuments ?? 50} documents`, 'OPENAPI_INVALID'));
+            }
+            found = fetchDocument(key, options);
+            loaded.set(key, found);
+        }
+        return found;
+    };
+    const inline = async (value, from, trail) => {
+        if (Array.isArray(value))
+            return Promise.all(value.map((item) => inline(item, from, trail)));
+        if (!isRecord(value))
+            return value;
+        if (typeof value.$ref === 'string') {
+            const target = new URL(value.$ref, from);
+            if (stripHash(target) === stripHash(root)) {
+                const { $ref: _ref, ...siblings } = value;
+                return { $ref: target.hash || '#', ...(await inlineFields(siblings, from, trail)) };
+            }
+            if (trail.includes(target.href))
+                return { description: `The same shape as ${target.hash.split('/').at(-1) || target.pathname}, nested` };
+            const named = pointer(await load(target), target.hash, target.href);
+            const { $ref: _ref, ...siblings } = value;
+            return {
+                ...(await inline(named, target, [...trail, target.href])),
+                ...(await inlineFields(siblings, from, trail)),
+            };
+        }
+        return inlineFields(value, from, trail);
+    };
+    const inlineFields = async (value, from, trail) => Object.fromEntries(await Promise.all(Object.entries(value).map(async ([key, item]) => [key, await inline(item, from, trail)])));
+    return (await inline(document, root, []));
+}
+async function fetchDocument(url, options) {
+    const response = await (options.fetch ?? globalThis.fetch)(url, {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!response.ok)
+        throw new OpenApiError(`${url} answered ${response.status}`, 'OPENAPI_REQUEST', response.status);
+    const text = await readCapped(response, options.maxBytes ?? 5_000_000, url);
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new OpenApiError(`${url} is not JSON; parse a YAML document first`, 'OPENAPI_INVALID');
+    }
+}
+function pointer(document, hash, where) {
+    let node = document;
+    for (const part of hash.replace(/^#/, '').split('/').slice(1)) {
+        const key = decodeURIComponent(part).replace(/~1/g, '/').replace(/~0/g, '~');
+        node = isRecord(node) || Array.isArray(node) ? node[key] : undefined;
+        if (node === undefined)
+            throw new OpenApiError(`${where} names nothing`, 'OPENAPI_INVALID');
+    }
+    return node;
+}
+function stripHash(url) {
+    const copy = new URL(url.href);
+    copy.hash = '';
+    return copy.href;
+}