openapi-typesafe 0.0.0 → 1.0.0-rc.1

package/dist/adapters/redocly-loader/ref-access.cjs

@@ -0,0 +1,107 @@
+'use strict';
+
+const promises = require('node:fs/promises');
+const path = require('node:path');
+const node_url = require('node:url');
+const openapiCore = require('@redocly/openapi-core');
+const errors = require('../../domain/errors.cjs');
+const aliasLimit = require('./alias-limit.cjs');
+const allowedHosts = require('./allowed-hosts.cjs');
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e.default : e; }
+
+const path__default = /*#__PURE__*/_interopDefaultCompat(path);
+
+function isRemoteRef(absoluteRef) {
+  return absoluteRef.startsWith("http://") || absoluteRef.startsWith("https://");
+}
+function isInsideDirectory(target, root) {
+  const relative = path__default.relative(root, target);
+  const isParent = relative === ".." || relative.startsWith(`..${path__default.sep}`);
+  return !isParent && !path__default.isAbsolute(relative);
+}
+async function realPathOrSelf(file) {
+  const absolute = path__default.resolve(file);
+  try {
+    return await promises.realpath(absolute);
+  } catch (error) {
+    const parent = path__default.dirname(absolute);
+    if (error.code === "ENOENT" && parent !== absolute) {
+      return path__default.join(await realPathOrSelf(parent), path__default.basename(absolute));
+    }
+    throw error;
+  }
+}
+async function localRefusal(absoluteRef, localRoot) {
+  const root = await realPathOrSelf(node_url.fileURLToPath(localRoot));
+  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {
+    return void 0;
+  }
+  return schemaLoadErrors.refForbiddenError(absoluteRef, { reason: "outside-local-root", localRoot: root });
+}
+async function refusalOf(absoluteRef, access) {
+  if (!isRemoteRef(absoluteRef)) {
+    return access.localRoot === void 0 ? void 0 : localRefusal(absoluteRef, access.localRoot);
+  }
+  if (access.remoteHosts === void 0 || allowedHosts.isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {
+    return void 0;
+  }
+  return schemaLoadErrors.refForbiddenError(absoluteRef, {
+    reason: "host-not-allowed",
+    allowedHosts: [...access.remoteHosts]
+  });
+}
+class RefAccessResolver extends openapiCore.BaseResolver {
+  #access;
+  #refusals = [];
+  /** The root document's ref: it is chosen by the developer, so it is not limited. */
+  #rootRef;
+  constructor(config, access) {
+    super(config);
+    this.#access = access;
+  }
+  /** The first document that was refused, if any. */
+  get firstRefusal() {
+    return this.#refusals[0];
+  }
+  resolveDocument(base, ref, isRoot = false) {
+    if (isRoot) {
+      this.#rootRef = this.resolveExternalRef(base, ref);
+    }
+    return super.resolveDocument(base, ref, isRoot);
+  }
+  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */
+  parseDocument(source, isRoot = false) {
+    const document = super.parseDocument(source, isRoot);
+    const failure = aliasLimit.aliasExpansionFailure(document.parsed);
+    if (failure !== void 0) {
+      throw new openapiCore.YamlParseError(failure, source);
+    }
+    return document;
+  }
+  async loadExternalRef(absoluteRef) {
+    const refusal = absoluteRef === this.#rootRef ? void 0 : await refusalOf(absoluteRef, this.#access);
+    if (refusal !== void 0) {
+      this.#refusals.push(refusal);
+      throw refusal;
+    }
+    try {
+      return await super.loadExternalRef(absoluteRef);
+    } catch (error) {
+      const cause = error.originalError;
+      if (isRefusal(cause)) {
+        this.#refusals.push(cause);
+      }
+      throw error;
+    }
+  }
+}
+function isRefusal(value) {
+  return value?.code === errors.ERROR_CODES.SCHEMA_REF_FORBIDDEN;
+}
+
+exports.RefAccessResolver = RefAccessResolver;
+exports.isInsideDirectory = isInsideDirectory;
+exports.refusalOf = refusalOf;
+//# sourceMappingURL=ref-access.cjs.map

package/dist/adapters/redocly-loader/ref-access.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-access.cjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #access: RefAccess;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n\n  constructor(config: ResolveConfig, access: RefAccess) {\n    super(config);\n    this.#access = access;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal =\n      absoluteRef === this.#rootRef ? undefined : await refusalOf(absoluteRef, this.#access);\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":["path","realpath","fileURLToPath","refForbiddenError","isHostAllowed","BaseResolver","aliasExpansionFailure","YamlParseError","ERROR_CODES"],"mappings":";;;;;;;;;;;;;;;AAwBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAKA,aAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAACA,aAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAMC,kBAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAASD,aAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAOA,aAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAGA,aAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAeE,sBAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOC,mCAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAaC,0BAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOD,mCAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOO,MAAM,0BAA0BE,wBAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA,EAEA,WAAA,CAAY,QAAuB,MAAA,EAAmB;AACpD,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAUC,gCAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAIC,0BAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GACJ,gBAAgB,IAAA,CAAK,QAAA,GAAW,SAAY,MAAM,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAO,CAAA;AACvF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAASC,kBAAA,CAAY,oBAAA;AACpE;;;;"}

package/dist/adapters/redocly-loader/ref-access.mjs

@@ -0,0 +1,99 @@
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { BaseResolver, YamlParseError } from '@redocly/openapi-core';
+import { ERROR_CODES } from '../../domain/errors.mjs';
+import { aliasExpansionFailure } from './alias-limit.mjs';
+import { isHostAllowed } from './allowed-hosts.mjs';
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+function isRemoteRef(absoluteRef) {
+  return absoluteRef.startsWith("http://") || absoluteRef.startsWith("https://");
+}
+function isInsideDirectory(target, root) {
+  const relative = path.relative(root, target);
+  const isParent = relative === ".." || relative.startsWith(`..${path.sep}`);
+  return !isParent && !path.isAbsolute(relative);
+}
+async function realPathOrSelf(file) {
+  const absolute = path.resolve(file);
+  try {
+    return await realpath(absolute);
+  } catch (error) {
+    const parent = path.dirname(absolute);
+    if (error.code === "ENOENT" && parent !== absolute) {
+      return path.join(await realPathOrSelf(parent), path.basename(absolute));
+    }
+    throw error;
+  }
+}
+async function localRefusal(absoluteRef, localRoot) {
+  const root = await realPathOrSelf(fileURLToPath(localRoot));
+  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {
+    return void 0;
+  }
+  return refForbiddenError(absoluteRef, { reason: "outside-local-root", localRoot: root });
+}
+async function refusalOf(absoluteRef, access) {
+  if (!isRemoteRef(absoluteRef)) {
+    return access.localRoot === void 0 ? void 0 : localRefusal(absoluteRef, access.localRoot);
+  }
+  if (access.remoteHosts === void 0 || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {
+    return void 0;
+  }
+  return refForbiddenError(absoluteRef, {
+    reason: "host-not-allowed",
+    allowedHosts: [...access.remoteHosts]
+  });
+}
+class RefAccessResolver extends BaseResolver {
+  #access;
+  #refusals = [];
+  /** The root document's ref: it is chosen by the developer, so it is not limited. */
+  #rootRef;
+  constructor(config, access) {
+    super(config);
+    this.#access = access;
+  }
+  /** The first document that was refused, if any. */
+  get firstRefusal() {
+    return this.#refusals[0];
+  }
+  resolveDocument(base, ref, isRoot = false) {
+    if (isRoot) {
+      this.#rootRef = this.resolveExternalRef(base, ref);
+    }
+    return super.resolveDocument(base, ref, isRoot);
+  }
+  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */
+  parseDocument(source, isRoot = false) {
+    const document = super.parseDocument(source, isRoot);
+    const failure = aliasExpansionFailure(document.parsed);
+    if (failure !== void 0) {
+      throw new YamlParseError(failure, source);
+    }
+    return document;
+  }
+  async loadExternalRef(absoluteRef) {
+    const refusal = absoluteRef === this.#rootRef ? void 0 : await refusalOf(absoluteRef, this.#access);
+    if (refusal !== void 0) {
+      this.#refusals.push(refusal);
+      throw refusal;
+    }
+    try {
+      return await super.loadExternalRef(absoluteRef);
+    } catch (error) {
+      const cause = error.originalError;
+      if (isRefusal(cause)) {
+        this.#refusals.push(cause);
+      }
+      throw error;
+    }
+  }
+}
+function isRefusal(value) {
+  return value?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;
+}
+
+export { RefAccessResolver, isInsideDirectory, refusalOf };
+//# sourceMappingURL=ref-access.mjs.map

package/dist/adapters/redocly-loader/ref-access.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-access.mjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #access: RefAccess;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n\n  constructor(config: ResolveConfig, access: RefAccess) {\n    super(config);\n    this.#access = access;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal =\n      absoluteRef === this.#rootRef ? undefined : await refusalOf(absoluteRef, this.#access);\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":[],"mappings":";;;;;;;;;AAwBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAK,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAO,IAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,aAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAa,aAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOO,MAAM,0BAA0B,YAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA,EAEA,WAAA,CAAY,QAAuB,MAAA,EAAmB;AACpD,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GACJ,gBAAgB,IAAA,CAAK,QAAA,GAAW,SAAY,MAAM,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAO,CAAA;AACvF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAAS,WAAA,CAAY,oBAAA;AACpE;;"}

package/dist/adapters/redocly-loader/ref-holders.cjs

@@ -0,0 +1,31 @@
+'use strict';
+
+const jsonPointer = require('../../domain/openapi/json-pointer.cjs');
+
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  const found = [];
+  const visited = /* @__PURE__ */ new WeakSet();
+  const pending = [];
+  const enqueue = (value, pointer) => {
+    if (typeof value === "object" && value !== null && !visited.has(value)) {
+      visited.add(value);
+      pending.push({ value, pointer });
+    }
+  };
+  enqueue(document, "#");
+  for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
+    if (hasStringRef(next.value)) {
+      found.push({ node: next.value, pointer: next.pointer });
+    }
+    for (const [key, child] of Object.entries(next.value)) {
+      enqueue(child, `${next.pointer}/${jsonPointer.escapePointerSegment(key)}`);
+    }
+  }
+  return found;
+}
+
+exports.findRefHolders = findRefHolders;
+//# sourceMappingURL=ref-holders.cjs.map

package/dist/adapters/redocly-loader/ref-holders.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-holders.cjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { escapePointerSegment } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, \"#\");\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);\n    }\n  }\n  return found;\n}\n"],"names":["escapePointerSegment"],"mappings":";;;;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAU,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAO,GAAG,IAAA,CAAK,OAAO,IAAIA,gCAAA,CAAqB,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}

package/dist/adapters/redocly-loader/ref-holders.mjs

@@ -0,0 +1,29 @@
+import { escapePointerSegment } from '../../domain/openapi/json-pointer.mjs';
+
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  const found = [];
+  const visited = /* @__PURE__ */ new WeakSet();
+  const pending = [];
+  const enqueue = (value, pointer) => {
+    if (typeof value === "object" && value !== null && !visited.has(value)) {
+      visited.add(value);
+      pending.push({ value, pointer });
+    }
+  };
+  enqueue(document, "#");
+  for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
+    if (hasStringRef(next.value)) {
+      found.push({ node: next.value, pointer: next.pointer });
+    }
+    for (const [key, child] of Object.entries(next.value)) {
+      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);
+    }
+  }
+  return found;
+}
+
+export { findRefHolders };
+//# sourceMappingURL=ref-holders.mjs.map

package/dist/adapters/redocly-loader/ref-holders.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-holders.mjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { escapePointerSegment } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, \"#\");\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);\n    }\n  }\n  return found;\n}\n"],"names":[],"mappings":";;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAU,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAO,GAAG,IAAA,CAAK,OAAO,IAAI,oBAAA,CAAqB,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}

package/dist/adapters/redocly-loader/remote-fetch.cjs

@@ -0,0 +1,60 @@
+'use strict';
+
+const allowedHosts = require('./allowed-hosts.cjs');
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+const MAX_CHECKED_REDIRECTS = 5;
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+async function bufferedResponse(response) {
+  const body = await response.arrayBuffer();
+  const { status, statusText, headers } = response;
+  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
+    status,
+    statusText,
+    headers
+  });
+}
+function fetchWithTimeout(timeoutMs) {
+  return async (input, init = {}) => {
+    try {
+      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+      return await bufferedResponse(response);
+    } catch (cause) {
+      const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
+      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
+    }
+  };
+}
+function fetchWithCheckedRedirects(fetchImpl, hosts) {
+  return async (input, init = {}) => {
+    const firstOrigin = new URL(input).origin;
+    let url = new URL(input);
+    for (let hop = 0; hop <= MAX_CHECKED_REDIRECTS; hop += 1) {
+      if (hop > 0 && !allowedHosts.isHostAllowed(url, hosts)) {
+        throw schemaLoadErrors.refForbiddenError(url.href, { reason: "host-not-allowed", allowedHosts: [...hosts] });
+      }
+      const { headers, ...rest } = init;
+      const hopInit = url.origin === firstOrigin && headers !== void 0 ? { ...rest, headers } : rest;
+      const response = await fetchImpl(url.href, { ...hopInit, redirect: "manual" });
+      const location = response.headers.get("location");
+      if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+        return response;
+      }
+      url = new URL(location, url);
+    }
+    throw new Error(`More than ${MAX_CHECKED_REDIRECTS} redirects loading ${input}`);
+  };
+}
+function resolveConfigWithAccess(resolve, options) {
+  const configured = resolve.http.customFetch;
+  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const hosts = options.access.remoteHosts;
+  const customFetch = hosts === void 0 ? base : fetchWithCheckedRedirects(base, hosts);
+  return { ...resolve, http: { ...resolve.http, customFetch } };
+}
+
+exports.MAX_CHECKED_REDIRECTS = MAX_CHECKED_REDIRECTS;
+exports.fetchWithCheckedRedirects = fetchWithCheckedRedirects;
+exports.resolveConfigWithAccess = resolveConfigWithAccess;
+//# sourceMappingURL=remote-fetch.cjs.map

package/dist/adapters/redocly-loader/remote-fetch.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** How the loader fetches remote documents: a time limit, and the host limit on redirects. */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for a remote `$ref` when hosts are limited. Each hop is checked, so fetch\n * cannot follow them on its own; 5 covers http → https plus a moved file, and a loop stops early.\n */\nexport const MAX_CHECKED_REDIRECTS = 5;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/**\n * Follow redirects one by one, and refuse a redirect to a host that is not listed. The first URL\n * was checked by the resolver (or is the root document). As fetch does, the configured headers\n * (often credentials) are not sent on to another origin.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  hosts: readonly string[],\n): RemoteFetch {\n  return async (input, init = {}) => {\n    const firstOrigin = new URL(input).origin;\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_CHECKED_REDIRECTS; hop += 1) {\n      if (hop > 0 && !isHostAllowed(url, hosts)) {\n        throw refForbiddenError(url.href, { reason: \"host-not-allowed\", allowedHosts: [...hosts] });\n      }\n      const { headers, ...rest } = init;\n      const hopInit: RequestInit =\n        url.origin === firstOrigin && headers !== undefined ? { ...rest, headers } : rest;\n      const response = await fetchImpl(url.href, { ...hopInit, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_CHECKED_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept; with a host limit, it is wrapped so that each redirect is checked.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const hosts = options.access.remoteHosts;\n  const customFetch = hosts === undefined ? base : fetchWithCheckedRedirects(base, hosts);\n  return { ...resolve, http: { ...resolve.http, customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError"],"mappings":";;;;;AAgBO,MAAM,qBAAA,GAAwB;AAErC,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAOO,SAAS,yBAAA,CACd,WACA,KAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,MAAA;AACnC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,qBAAA,EAAuB,OAAO,CAAA,EAAG;AACxD,MAAA,IAAI,MAAM,CAAA,IAAK,CAACA,0BAAA,CAAc,GAAA,EAAK,KAAK,CAAA,EAAG;AACzC,QAAA,MAAMC,kCAAA,CAAkB,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,kBAAA,EAAoB,YAAA,EAAc,CAAC,GAAG,KAAK,CAAA,EAAG,CAAA;AAAA,MAC5F;AACA,MAAA,MAAM,EAAE,OAAA,EAAS,GAAG,IAAA,EAAK,GAAI,IAAA;AAC7B,MAAA,MAAM,OAAA,GACJ,GAAA,CAAI,MAAA,KAAW,WAAA,IAAe,OAAA,KAAY,SAAY,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,GAAI,IAAA;AAC/E,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AAC7E,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,qBAAqB,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF,CAAA;AACF;AAYO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,QAAQ,MAAA,CAAO,WAAA;AAC7B,EAAA,MAAM,cAAc,KAAA,KAAU,MAAA,GAAY,IAAA,GAAO,yBAAA,CAA0B,MAAM,KAAK,CAAA;AACtF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,WAAA,EAAY,EAAE;AAC9D;;;;"}

package/dist/adapters/redocly-loader/remote-fetch.mjs

@@ -0,0 +1,56 @@
+import { isHostAllowed } from './allowed-hosts.mjs';
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+const MAX_CHECKED_REDIRECTS = 5;
+const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
+async function bufferedResponse(response) {
+  const body = await response.arrayBuffer();
+  const { status, statusText, headers } = response;
+  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
+    status,
+    statusText,
+    headers
+  });
+}
+function fetchWithTimeout(timeoutMs) {
+  return async (input, init = {}) => {
+    try {
+      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
+      return await bufferedResponse(response);
+    } catch (cause) {
+      const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
+      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
+    }
+  };
+}
+function fetchWithCheckedRedirects(fetchImpl, hosts) {
+  return async (input, init = {}) => {
+    const firstOrigin = new URL(input).origin;
+    let url = new URL(input);
+    for (let hop = 0; hop <= MAX_CHECKED_REDIRECTS; hop += 1) {
+      if (hop > 0 && !isHostAllowed(url, hosts)) {
+        throw refForbiddenError(url.href, { reason: "host-not-allowed", allowedHosts: [...hosts] });
+      }
+      const { headers, ...rest } = init;
+      const hopInit = url.origin === firstOrigin && headers !== void 0 ? { ...rest, headers } : rest;
+      const response = await fetchImpl(url.href, { ...hopInit, redirect: "manual" });
+      const location = response.headers.get("location");
+      if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+        return response;
+      }
+      url = new URL(location, url);
+    }
+    throw new Error(`More than ${MAX_CHECKED_REDIRECTS} redirects loading ${input}`);
+  };
+}
+function resolveConfigWithAccess(resolve, options) {
+  const configured = resolve.http.customFetch;
+  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const hosts = options.access.remoteHosts;
+  const customFetch = hosts === void 0 ? base : fetchWithCheckedRedirects(base, hosts);
+  return { ...resolve, http: { ...resolve.http, customFetch } };
+}
+
+export { MAX_CHECKED_REDIRECTS, fetchWithCheckedRedirects, resolveConfigWithAccess };
+//# sourceMappingURL=remote-fetch.mjs.map

package/dist/adapters/redocly-loader/remote-fetch.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-fetch.mjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** How the loader fetches remote documents: a time limit, and the host limit on redirects. */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for a remote `$ref` when hosts are limited. Each hop is checked, so fetch\n * cannot follow them on its own; 5 covers http → https plus a moved file, and a loop stops early.\n */\nexport const MAX_CHECKED_REDIRECTS = 5;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/**\n * Follow redirects one by one, and refuse a redirect to a host that is not listed. The first URL\n * was checked by the resolver (or is the root document). As fetch does, the configured headers\n * (often credentials) are not sent on to another origin.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  hosts: readonly string[],\n): RemoteFetch {\n  return async (input, init = {}) => {\n    const firstOrigin = new URL(input).origin;\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_CHECKED_REDIRECTS; hop += 1) {\n      if (hop > 0 && !isHostAllowed(url, hosts)) {\n        throw refForbiddenError(url.href, { reason: \"host-not-allowed\", allowedHosts: [...hosts] });\n      }\n      const { headers, ...rest } = init;\n      const hopInit: RequestInit =\n        url.origin === firstOrigin && headers !== undefined ? { ...rest, headers } : rest;\n      const response = await fetchImpl(url.href, { ...hopInit, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_CHECKED_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept; with a host limit, it is wrapped so that each redirect is checked.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const hosts = options.access.remoteHosts;\n  const customFetch = hosts === undefined ? base : fetchWithCheckedRedirects(base, hosts);\n  return { ...resolve, http: { ...resolve.http, customFetch } };\n}\n"],"names":[],"mappings":";;;AAgBO,MAAM,qBAAA,GAAwB;AAErC,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAOO,SAAS,yBAAA,CACd,WACA,KAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,MAAM,WAAA,GAAc,IAAI,GAAA,CAAI,KAAK,CAAA,CAAE,MAAA;AACnC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,qBAAA,EAAuB,OAAO,CAAA,EAAG;AACxD,MAAA,IAAI,MAAM,CAAA,IAAK,CAAC,aAAA,CAAc,GAAA,EAAK,KAAK,CAAA,EAAG;AACzC,QAAA,MAAM,iBAAA,CAAkB,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,kBAAA,EAAoB,YAAA,EAAc,CAAC,GAAG,KAAK,CAAA,EAAG,CAAA;AAAA,MAC5F;AACA,MAAA,MAAM,EAAE,OAAA,EAAS,GAAG,IAAA,EAAK,GAAI,IAAA;AAC7B,MAAA,MAAM,OAAA,GACJ,GAAA,CAAI,MAAA,KAAW,WAAA,IAAe,OAAA,KAAY,SAAY,EAAE,GAAG,IAAA,EAAM,OAAA,EAAQ,GAAI,IAAA;AAC/E,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AAC7E,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,qBAAqB,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACjF,CAAA;AACF;AAYO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,QAAQ,MAAA,CAAO,WAAA;AAC7B,EAAA,MAAM,cAAc,KAAA,KAAU,MAAA,GAAY,IAAA,GAAO,yBAAA,CAA0B,MAAM,KAAK,CAAA;AACtF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,WAAA,EAAY,EAAE;AAC9D;;"}

package/dist/adapters/redocly-loader/schema-load-errors.cjs

@@ -0,0 +1,87 @@
+'use strict';
+
+const errors = require('../../domain/errors.cjs');
+
+function sourceEmptyError(message) {
+  return new errors.OpenAPITypesafeError({ code: errors.ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });
+}
+function sourceInvalidError(source) {
+  const received = Array.isArray(source) ? "Array" : typeof source;
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
+    message: `Expected string, object, or Buffer. Got ${received}`,
+    details: { received }
+  });
+}
+function causeMessage(cause) {
+  return cause instanceof Error ? cause.message : String(cause);
+}
+const SOURCE_TEXT_IN_MESSAGE = 200;
+function pathStringError(text) {
+  const shown = text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}\u2026` : text;
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
+    message: `The string "${shown}" was parsed as YAML text, not loaded as a file. To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.`,
+    details: { reason: "path", received: "string" }
+  });
+}
+function loadFailedError(absoluteRef, cause) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_LOAD_FAILED,
+    message: causeMessage(cause),
+    details: { source: absoluteRef },
+    cause
+  });
+}
+function parseFailedError(format, absoluteRef, cause) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_PARSE_FAILED,
+    message: causeMessage(cause),
+    details: { format, source: absoluteRef },
+    cause
+  });
+}
+function versionUnsupportedError(message, parsed) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,
+    message,
+    details: { openapi: parsed.openapi, swagger: parsed.swagger }
+  });
+}
+function schemaInvalidError(problems) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_INVALID,
+    message: problems.at(-1) ?? "",
+    details: { problems: [...problems] }
+  });
+}
+function refCycleError(cause) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_REF_INVALID,
+    message: cause.message,
+    details: { reason: "cycle" },
+    cause
+  });
+}
+function hostListText(hosts) {
+  return hosts.length === 0 ? "none" : hosts.join(", ");
+}
+function refForbiddenError(ref, details) {
+  const limit = details.reason === "outside-local-root" ? `it is outside the local $ref root ${details.localRoot}` : `its host is not in the allowed remote $ref hosts (${hostListText(details.allowedHosts)})`;
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_REF_FORBIDDEN,
+    message: `Refused to load ${ref}: ${limit}`,
+    details: { ref, ...details }
+  });
+}
+
+exports.loadFailedError = loadFailedError;
+exports.parseFailedError = parseFailedError;
+exports.pathStringError = pathStringError;
+exports.refCycleError = refCycleError;
+exports.refForbiddenError = refForbiddenError;
+exports.schemaInvalidError = schemaInvalidError;
+exports.sourceEmptyError = sourceEmptyError;
+exports.sourceInvalidError = sourceInvalidError;
+exports.versionUnsupportedError = versionUnsupportedError;
+//# sourceMappingURL=schema-load-errors.cjs.map

package/dist/adapters/redocly-loader/schema-load-errors.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-load-errors.cjs","sources":["../../../src/adapters/redocly-loader/schema-load-errors.ts"],"sourcesContent":["import { ERROR_CODES, OpenAPITypesafeError } from \"../../domain/errors.js\";\n\n/**\n * The typed errors of loading, validating and bundling a document (ADR-011). Messages are the\n * original messages, so Node API users who match on them keep working.\n */\n\n/** No source was given, or the source is empty. */\nexport function sourceEmptyError(message: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });\n}\n\n/** The source is neither a URL, text, buffer, stream nor plain object. */\nexport function sourceInvalidError(source: unknown): OpenAPITypesafeError {\n  const received = Array.isArray(source) ? \"Array\" : typeof source;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `Expected string, object, or Buffer. Got ${received}`,\n    details: { received },\n  });\n}\n\nfunction causeMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n\n/** Enough of a source string to recognise it in the message. */\nconst SOURCE_TEXT_IN_MESSAGE = 200;\n\n/**\n * A string source is document text, so a file path parses as a YAML string scalar, not as a\n * document (docs/node.md). The message says how to load the file instead.\n */\nexport function pathStringError(text: string): OpenAPITypesafeError {\n  const shown =\n    text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}…` : text;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message:\n      `The string \"${shown}\" was parsed as YAML text, not loaded as a file. ` +\n      \"To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.\",\n    details: { reason: \"path\", received: \"string\" },\n  });\n}\n\n/** Reading the document from a file or URL failed; the message is the reader's message. */\nexport function loadFailedError(absoluteRef: string, cause: unknown): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_LOAD_FAILED,\n    message: causeMessage(cause),\n    details: { source: absoluteRef },\n    cause,\n  });\n}\n\n/** The document text is not valid JSON or YAML; the message is the parser's message. */\nexport function parseFailedError(\n  format: \"json\" | \"yaml\",\n  absoluteRef: string,\n  cause: unknown,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_PARSE_FAILED,\n    message: causeMessage(cause),\n    details: { format, source: absoluteRef },\n    cause,\n  });\n}\n\n/** The document is not OpenAPI 3.x. */\nexport function versionUnsupportedError(\n  message: string,\n  parsed: Readonly<Record<string, unknown>>,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,\n    message,\n    details: { openapi: parsed.openapi, swagger: parsed.swagger },\n  });\n}\n\n/**\n * Linting or bundling found errors. The message is the last error, as in the original; all error\n * messages are in `details.problems`.\n */\nexport function schemaInvalidError(problems: readonly string[]): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_INVALID,\n    message: problems.at(-1) ?? \"\",\n    details: { problems: [...problems] },\n  });\n}\n\n/** A `$ref` chain points back to itself with no schema in between (`A: $ref B`, `B: $ref A`). */\nexport function refCycleError(cause: Error): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_INVALID,\n    message: cause.message,\n    details: { reason: \"cycle\" },\n    cause,\n  });\n}\n\nfunction hostListText(hosts: readonly string[]): string {\n  return hosts.length === 0 ? \"none\" : hosts.join(\", \");\n}\n\n/** Why a `$ref` document was refused, with the limit it broke (ADR-017). */\nexport type RefRefusalDetails =\n  | { readonly reason: \"outside-local-root\"; readonly localRoot: string }\n  | { readonly reason: \"host-not-allowed\"; readonly allowedHosts: readonly string[] };\n\n/** A `$ref` is outside the local root, or its host is not allowed (threat model R1, R2). */\nexport function refForbiddenError(ref: string, details: RefRefusalDetails): OpenAPITypesafeError {\n  const limit =\n    details.reason === \"outside-local-root\"\n      ? `it is outside the local $ref root ${details.localRoot}`\n      : `its host is not in the allowed remote $ref hosts (${hostListText(details.allowedHosts)})`;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,\n    message: `Refused to load ${ref}: ${limit}`,\n    details: { ref, ...details },\n  });\n}\n"],"names":["OpenAPITypesafeError","ERROR_CODES"],"mappings":";;;;AAQO,SAAS,iBAAiB,OAAA,EAAuC;AACtE,EAAA,OAAO,IAAIA,2BAAA,CAAqB,EAAE,MAAMC,kBAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA;AACpF;AAGO,SAAS,mBAAmB,MAAA,EAAuC;AACxE,EAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,UAAU,OAAO,MAAA;AAC1D,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,2CAA2C,QAAQ,CAAA,CAAA;AAAA,IAC5D,OAAA,EAAS,EAAE,QAAA;AAAS,GACrB,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAGA,MAAM,sBAAA,GAAyB,GAAA;AAMxB,SAAS,gBAAgB,IAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,MAAA,GAAS,sBAAA,GAAyB,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAC,CAAA,MAAA,CAAA,GAAM,IAAA;AACvF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EACE,eAAe,KAAK,CAAA,0HAAA,CAAA;AAAA,IAEtB,OAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,UAAU,QAAA;AAAS,GAC/C,CAAA;AACH;AAGO,SAAS,eAAA,CAAgB,aAAqB,KAAA,EAAsC;AACzF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQ,WAAA,EAAY;AAAA,IAC/B;AAAA,GACD,CAAA;AACH;AAGO,SAAS,gBAAA,CACd,MAAA,EACA,WAAA,EACA,KAAA,EACsB;AACtB,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,mBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,WAAA,EAAY;AAAA,IACvC;AAAA,GACD,CAAA;AACH;AAGO,SAAS,uBAAA,CACd,SACA,MAAA,EACsB;AACtB,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,0BAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,OAAO,OAAA;AAAQ,GAC7D,CAAA;AACH;AAMO,SAAS,mBAAmB,QAAA,EAAmD;AACpF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,cAAA;AAAA,IAClB,OAAA,EAAS,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AAAA,IAC5B,SAAS,EAAE,QAAA,EAAU,CAAC,GAAG,QAAQ,CAAA;AAAE,GACpC,CAAA;AACH;AAGO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACD,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAkC;AACtD,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtD;AAQO,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAkD;AAC/F,EAAA,MAAM,KAAA,GACJ,OAAA,CAAQ,MAAA,KAAW,oBAAA,GACf,CAAA,kCAAA,EAAqC,OAAA,CAAQ,SAAS,CAAA,CAAA,GACtD,CAAA,kDAAA,EAAqD,YAAA,CAAa,OAAA,CAAQ,YAAY,CAAC,CAAA,CAAA,CAAA;AAC7F,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,oBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,gBAAA,EAAmB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,IACzC,OAAA,EAAS,EAAE,GAAA,EAAK,GAAG,OAAA;AAAQ,GAC5B,CAAA;AACH;;;;;;;;;;"}