openapi-typesafe 1.0.0-rc.0 → 1.0.0-rc.2

package/dist/adapters/redocly-loader/redocly-schema-loader.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"redocly-schema-loader.mjs","sources":["../../../src/adapters/redocly-loader/redocly-schema-loader.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport {\n  type BaseResolver,\n  bundle,\n  type Document,\n  lintDocument,\n  type NormalizedProblem,\n  type Config as RedoclyConfig,\n} from \"@redocly/openapi-core\";\nimport type { Logger } from \"../../application/ports/logger.js\";\nimport type { SchemaLoader, SchemaLoadRequest } from \"../../application/ports/schema-loader.js\";\nimport { withStackOverflowReportedAsync } from \"../../application/stack-overflow.js\";\nimport type { OpenAPI3 } from \"../../types.js\";\nimport { repairBundledRefs } from \"./bundled-ref-repair.js\";\nimport { findMalformedRefs, malformedRefsError } from \"./malformed-refs.js\";\nimport { RefAccessResolver } from \"./ref-access.js\";\nimport { resolveConfigWithAccess } from \"./remote-fetch.js\";\nimport {\n  loadFailedError,\n  refCycleError,\n  schemaInvalidError,\n  versionUnsupportedError,\n} from \"./schema-load-errors.js\";\nimport { parseSchema } from \"./schema-source.js\";\nimport {\n  findUnsupportedKeys,\n  type LoadedDocument,\n  unsupportedKeysError,\n} from \"./unsupported-keys.js\";\n\n/**\n * The SchemaLoader port on Redocly 1.34 (ADR-005): parse any inherited source type, then lint and\n * bundle with the given Redocly config. Problems go to the logger; errors fail the load.\n */\nexport interface RedoclySchemaLoaderOptions {\n  readonly redoc: RedoclyConfig;\n  readonly logger: Logger;\n  /** A monotonic time in milliseconds, for the debug durations. */\n  readonly now: () => number;\n  /** Time limit of one remote fetch, unless the Redocly config brings its own `customFetch`. */\n  readonly remoteRefTimeoutMs: number;\n}\n\nconst UNSUPPORTED_FORMAT_MESSAGE = \"Unsupported schema format, expected `openapi: 3.x`\";\n\n/**\n * Accept OpenAPI 3.x only; Swagger 2 and other formats get their own message. An empty file or a\n * `null` root parses to nothing, so it is checked before any field is read.\n */\nfunction assertOpenAPI3(document: unknown): void {\n  if (typeof document !== \"object\" || document === null) {\n    throw versionUnsupportedError(UNSUPPORTED_FORMAT_MESSAGE, {});\n  }\n  const parsed = document as Record<string, unknown>;\n  const openapiVersion = Number.parseFloat(parsed.openapi as string);\n  const isOpenAPI3 =\n    !parsed.swagger &&\n    Boolean(parsed.openapi) &&\n    !Number.isNaN(openapiVersion) &&\n    openapiVersion >= 3 &&\n    openapiVersion < 4;\n  if (isOpenAPI3) {\n    return;\n  }\n  if (parsed.swagger) {\n    throw versionUnsupportedError(\n      \"Unsupported Swagger version: 2.x. Use OpenAPI 3.x instead.\",\n      parsed,\n    );\n  }\n  if (parsed.openapi || openapiVersion < 3 || openapiVersion >= 4) {\n    throw versionUnsupportedError(`Unsupported OpenAPI version: ${parsed.openapi}`, parsed);\n  }\n  throw versionUnsupportedError(UNSUPPORTED_FORMAT_MESSAGE, parsed);\n}\n\n/** The base for relative `$ref`s: the source file or URL itself, else the working directory. */\nfunction sourceAbsoluteRef(source: unknown, cwd: URL): string {\n  if (source instanceof URL) {\n    return source.protocol === \"file:\" ? sourceFilePath(source) : source.href;\n  }\n  return fileURLToPath(cwd);\n}\n\n/**\n * The path of a `file:` source. A URL that names no path on this platform (an encoded slash, a\n * host on POSIX, no drive letter on Windows) cannot be read, so it fails as a read would.\n */\nfunction sourceFilePath(source: URL): string {\n  try {\n    return fileURLToPath(source);\n  } catch (error) {\n    // Node.js reports these as TypeErrors (ERR_INVALID_FILE_URL_PATH, ERR_INVALID_FILE_URL_HOST).\n    if (!(error instanceof TypeError)) {\n      throw error;\n    }\n    throw loadFailedError(source.href, error);\n  }\n}\n\n/** Redocly throws a plain Error for a `$ref` chain that points back to itself. */\nconst REF_CYCLE_MESSAGE = \"Self-referencing circular pointer\";\n\n/**\n * The root document and every other document the resolver loaded, as far as they parsed. A root\n * read from a file or URL is in the resolver cache too, and is listed once.\n */\nasync function loadedDocuments(root: Document, resolver: BaseResolver): Promise<LoadedDocument[]> {\n  const cached = await Promise.all(resolver.cache.values());\n  const bySource = new Map<string, unknown>([[root.source.absoluteRef, root.parsed]]);\n  for (const document of cached) {\n    if (\"parsed\" in document && !bySource.has(document.source.absoluteRef)) {\n      bySource.set(document.source.absoluteRef, document.parsed);\n    }\n  }\n  return [...bySource].map(([source, parsed]) => ({ source, parsed }));\n}\n\n/** Report the document problems Redocly throws as typed errors; anything else passes through. */\nasync function rethrowDocumentError(\n  error: unknown,\n  root: Document,\n  resolver: BaseResolver,\n): Promise<never> {\n  if (error instanceof Error && error.message === REF_CYCLE_MESSAGE) {\n    throw refCycleError(error);\n  }\n  if (error instanceof URIError) {\n    throw malformedRefsError(findMalformedRefs(await loadedDocuments(root, resolver)), error);\n  }\n  if (error instanceof TypeError) {\n    const keys = findUnsupportedKeys(await loadedDocuments(root, resolver));\n    throw keys.length === 0 ? error : unsupportedKeysError(keys, error);\n  }\n  throw error;\n}\n\nclass RedoclySchemaLoader implements SchemaLoader {\n  readonly #options: RedoclySchemaLoaderOptions;\n\n  constructor(options: RedoclySchemaLoaderOptions) {\n    this.#options = options;\n  }\n\n  async load(request: SchemaLoadRequest): Promise<OpenAPI3> {\n    const resolver = this.#resolver(request);\n    // Parsing is guarded too: `JSON.stringify` of a deep object source overflows the stack on\n    // Node.js 22 and 24, before linting starts.\n    const bundled = await withStackOverflowReportedAsync(\"load\", () =>\n      this.#parseAndBundle(request, resolver),\n    ).catch((error: unknown) => {\n      throw resolver.firstRefusal ?? error;\n    });\n    // A refused `$ref` is an unresolved-`$ref` problem, which a Redocly config can turn off.\n    if (resolver.firstRefusal !== undefined) {\n      throw resolver.firstRefusal;\n    }\n    return bundled;\n  }\n\n  async #parseAndBundle(request: SchemaLoadRequest, resolver: BaseResolver): Promise<OpenAPI3> {\n    const { logger, now } = this.#options;\n    const configLoadedAt = now();\n    logger.debug(\"Loaded Redoc config\", \"redoc\", now() - configLoadedAt);\n    const parseStartedAt = now();\n    const absoluteRef = sourceAbsoluteRef(request.source, request.cwd);\n    const document = await parseSchema(request.source, { absoluteRef, resolver });\n    logger.debug(\"Parsed schema\", \"redoc\", now() - parseStartedAt);\n    assertOpenAPI3(document.parsed);\n    return this.#lintAndBundle(document, resolver, request.shouldLint);\n  }\n\n  #resolver(request: SchemaLoadRequest): RefAccessResolver {\n    const { redoc, remoteRefTimeoutMs } = this.#options;\n    const config = resolveConfigWithAccess(redoc.resolve, {\n      timeoutMs: remoteRefTimeoutMs,\n      access: request.refAccess,\n    });\n    return new RefAccessResolver(config, request.refAccess);\n  }\n\n  async #lintAndBundle(\n    document: Document,\n    resolver: BaseResolver,\n    shouldLint: boolean,\n  ): Promise<OpenAPI3> {\n    const rethrow = (error: unknown) => rethrowDocumentError(error, document, resolver);\n    if (shouldLint) {\n      await this.#lint(document, resolver).catch(rethrow);\n    }\n    return this.#bundle(document, resolver).catch(rethrow);\n  }\n\n  async #lint(document: Document, resolver: BaseResolver): Promise<void> {\n    const startedAt = this.#options.now();\n    const problems = await lintDocument({\n      document,\n      config: this.#options.redoc.styleguide,\n      externalRefResolver: resolver,\n    });\n    this.#report(problems);\n    this.#options.logger.debug(\"Linted schema\", \"lint\", this.#options.now() - startedAt);\n  }\n\n  async #bundle(document: Document, resolver: BaseResolver): Promise<OpenAPI3> {\n    const startedAt = this.#options.now();\n    // The lint resolver: documents it already loaded are not fetched again.\n    const bundled = await bundle({\n      config: this.#options.redoc,\n      dereference: false,\n      doc: document,\n      externalRefResolver: resolver,\n    });\n    this.#report(bundled.problems);\n    repairBundledRefs(bundled.bundle.parsed);\n    this.#options.logger.debug(\"Bundled schema\", \"bundle\", this.#options.now() - startedAt);\n    return bundled.bundle.parsed;\n  }\n\n  /** Report every problem; then throw if any of them is an error. */\n  #report(problems: readonly NormalizedProblem[]): void {\n    const errorMessages: string[] = [];\n    for (const problem of problems) {\n      const message = problemMessage(problem);\n      if (problem.severity === \"error\") {\n        errorMessages.push(message);\n        this.#options.logger.error(message);\n      } else {\n        this.#options.logger.warn(message);\n      }\n    }\n    if (errorMessages.length > 0) {\n      throw schemaInvalidError(errorMessages);\n    }\n  }\n}\n\nfunction problemMessage(problem: NormalizedProblem): string {\n  const location = problem.location?.[0]?.pointer;\n  return location ? `${problem.message} at ${location}` : problem.message;\n}\n\n/** A schema loader with one Redocly config and logger, for one or more loads. */\nexport function createRedoclySchemaLoader(options: RedoclySchemaLoaderOptions): SchemaLoader {\n  return new RedoclySchemaLoader(options);\n}\n"],"names":[],"mappings":";;;;;;;;;;;AA2CA,MAAM,0BAAA,GAA6B,oDAAA;AAMnC,SAAS,eAAe,QAAA,EAAyB;AAC/C,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,KAAa,IAAA,EAAM;AACrD,IAAA,MAAM,uBAAA,CAAwB,0BAAA,EAA4B,EAAE,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,MAAA,GAAS,QAAA;AACf,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,OAAiB,CAAA;AACjE,EAAA,MAAM,UAAA,GACJ,CAAC,MAAA,CAAO,OAAA,IACR,QAAQ,MAAA,CAAO,OAAO,CAAA,IACtB,CAAC,OAAO,KAAA,CAAM,cAAc,CAAA,IAC5B,cAAA,IAAkB,KAClB,cAAA,GAAiB,CAAA;AACnB,EAAA,IAAI,UAAA,EAAY;AACd,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,uBAAA;AAAA,MACJ,4DAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,IAAW,cAAA,GAAiB,CAAA,IAAK,kBAAkB,CAAA,EAAG;AAC/D,IAAA,MAAM,uBAAA,CAAwB,CAAA,6BAAA,EAAgC,MAAA,CAAO,OAAO,IAAI,MAAM,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,uBAAA,CAAwB,4BAA4B,MAAM,CAAA;AAClE;AAGA,SAAS,iBAAA,CAAkB,QAAiB,GAAA,EAAkB;AAC5D,EAAA,IAAI,kBAAkB,GAAA,EAAK;AACzB,IAAA,OAAO,OAAO,QAAA,KAAa,OAAA,GAAU,cAAA,CAAe,MAAM,IAAI,MAAA,CAAO,IAAA;AAAA,EACvE;AACA,EAAA,OAAO,cAAc,GAAG,CAAA;AAC1B;AAMA,SAAS,eAAe,MAAA,EAAqB;AAC3C,EAAA,IAAI;AACF,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,SAAS,KAAA,EAAO;AAEd,IAAA,IAAI,EAAE,iBAAiB,SAAA,CAAA,EAAY;AACjC,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,EAAM,KAAK,CAAA;AAAA,EAC1C;AACF;AAGA,MAAM,iBAAA,GAAoB,mCAAA;AAM1B,eAAe,eAAA,CAAgB,MAAgB,QAAA,EAAmD;AAChG,EAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,IAAI,QAAA,CAAS,KAAA,CAAM,QAAQ,CAAA;AACxD,EAAA,MAAM,QAAA,mBAAW,IAAI,GAAA,CAAqB,CAAC,CAAC,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,IAAA,CAAK,MAAM,CAAC,CAAC,CAAA;AAClF,EAAA,KAAA,MAAW,YAAY,MAAA,EAAQ;AAC7B,IAAA,IAAI,QAAA,IAAY,YAAY,CAAC,QAAA,CAAS,IAAI,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,EAAG;AACtE,MAAA,QAAA,CAAS,GAAA,CAAI,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,SAAS,MAAM,CAAA;AAAA,IAC3D;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,MAAA,EAAQ,MAAM,CAAA,MAAO,EAAE,MAAA,EAAQ,QAAO,CAAE,CAAA;AACrE;AAGA,eAAe,oBAAA,CACb,KAAA,EACA,IAAA,EACA,QAAA,EACgB;AAChB,EAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,OAAA,KAAY,iBAAA,EAAmB;AACjE,IAAA,MAAM,cAAc,KAAK,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,iBAAiB,QAAA,EAAU;AAC7B,IAAA,MAAM,kBAAA,CAAmB,kBAAkB,MAAM,eAAA,CAAgB,MAAM,QAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,EAC1F;AACA,EAAA,IAAI,iBAAiB,SAAA,EAAW;AAC9B,IAAA,MAAM,OAAO,mBAAA,CAAoB,MAAM,eAAA,CAAgB,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtE,IAAA,MAAM,KAAK,MAAA,KAAW,CAAA,GAAI,KAAA,GAAQ,oBAAA,CAAqB,MAAM,KAAK,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,KAAA;AACR;AAEA,MAAM,mBAAA,CAA4C;AAAA,EACvC,QAAA;AAAA,EAET,YAAY,OAAA,EAAqC;AAC/C,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAAA,EAClB;AAAA,EAEA,MAAM,KAAK,OAAA,EAA+C;AACxD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AAGvC,IAAA,MAAM,UAAU,MAAM,8BAAA;AAAA,MAA+B,MAAA;AAAA,MAAQ,MAC3D,IAAA,CAAK,eAAA,CAAgB,OAAA,EAAS,QAAQ;AAAA,KACxC,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AAC1B,MAAA,MAAM,SAAS,YAAA,IAAgB,KAAA;AAAA,IACjC,CAAC,CAAA;AAED,IAAA,IAAI,QAAA,CAAS,iBAAiB,MAAA,EAAW;AACvC,MAAA,MAAM,QAAA,CAAS,YAAA;AAAA,IACjB;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAA,CAAgB,OAAA,EAA4B,QAAA,EAA2C;AAC3F,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA;AAC7B,IAAA,MAAM,iBAAiB,GAAA,EAAI;AAC3B,IAAA,MAAA,CAAO,KAAA,CAAM,qBAAA,EAAuB,OAAA,EAAS,GAAA,KAAQ,cAAc,CAAA;AACnE,IAAA,MAAM,iBAAiB,GAAA,EAAI;AAC3B,IAAA,MAAM,WAAA,GAAc,iBAAA,CAAkB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,CAAQ,QAAQ,EAAE,WAAA,EAAa,UAAU,CAAA;AAC5E,IAAA,MAAA,CAAO,KAAA,CAAM,eAAA,EAAiB,OAAA,EAAS,GAAA,KAAQ,cAAc,CAAA;AAC7D,IAAA,cAAA,CAAe,SAAS,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,QAAA,EAAU,QAAQ,UAAU,CAAA;AAAA,EACnE;AAAA,EAEA,UAAU,OAAA,EAA+C;AACvD,IAAA,MAAM,EAAE,KAAA,EAAO,kBAAA,EAAmB,GAAI,IAAA,CAAK,QAAA;AAC3C,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,KAAA,CAAM,OAAA,EAAS;AAAA,MACpD,SAAA,EAAW,kBAAA;AAAA,MACX,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AACD,IAAA,OAAO,IAAI,iBAAA,CAAkB,MAAA,EAAQ,OAAA,CAAQ,SAAS,CAAA;AAAA,EACxD;AAAA,EAEA,MAAM,cAAA,CACJ,QAAA,EACA,QAAA,EACA,UAAA,EACmB;AACnB,IAAA,MAAM,UAAU,CAAC,KAAA,KAAmB,oBAAA,CAAqB,KAAA,EAAO,UAAU,QAAQ,CAAA;AAClF,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,KAAK,KAAA,CAAM,QAAA,EAAU,QAAQ,CAAA,CAAE,MAAM,OAAO,CAAA;AAAA,IACpD;AACA,IAAA,OAAO,KAAK,OAAA,CAAQ,QAAA,EAAU,QAAQ,CAAA,CAAE,MAAM,OAAO,CAAA;AAAA,EACvD;AAAA,EAEA,MAAM,KAAA,CAAM,QAAA,EAAoB,QAAA,EAAuC;AACrE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa;AAAA,MAClC,QAAA;AAAA,MACA,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,UAAA;AAAA,MAC5B,mBAAA,EAAqB;AAAA,KACtB,CAAA;AACD,IAAA,IAAA,CAAK,QAAQ,QAAQ,CAAA;AACrB,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,KAAA,CAAM,eAAA,EAAiB,QAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI,GAAI,SAAS,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,OAAA,CAAQ,QAAA,EAAoB,QAAA,EAA2C;AAC3E,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI;AAEpC,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO;AAAA,MAC3B,MAAA,EAAQ,KAAK,QAAA,CAAS,KAAA;AAAA,MACtB,WAAA,EAAa,KAAA;AAAA,MACb,GAAA,EAAK,QAAA;AAAA,MACL,mBAAA,EAAqB;AAAA,KACtB,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,CAAQ,QAAQ,QAAQ,CAAA;AAC7B,IAAA,iBAAA,CAAkB,OAAA,CAAQ,OAAO,MAAM,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,KAAA,CAAM,gBAAA,EAAkB,UAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI,GAAI,SAAS,CAAA;AACtF,IAAA,OAAO,QAAQ,MAAA,CAAO,MAAA;AAAA,EACxB;AAAA;AAAA,EAGA,QAAQ,QAAA,EAA8C;AACpD,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,MAAM,OAAA,GAAU,eAAe,OAAO,CAAA;AACtC,MAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAChC,QAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,QAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAAA,MACpC,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA;AAAA,MACnC;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,MAAA,MAAM,mBAAmB,aAAa,CAAA;AAAA,IACxC;AAAA,EACF;AACF;AAEA,SAAS,eAAe,OAAA,EAAoC;AAC1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,CAAC,CAAA,EAAG,OAAA;AACxC,EAAA,OAAO,WAAW,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,IAAA,EAAO,QAAQ,KAAK,OAAA,CAAQ,OAAA;AAClE;AAGO,SAAS,0BAA0B,OAAA,EAAmD;AAC3F,EAAA,OAAO,IAAI,oBAAoB,OAAO,CAAA;AACxC;;"}
+{"version":3,"file":"redocly-schema-loader.mjs","sources":["../../../src/adapters/redocly-loader/redocly-schema-loader.ts"],"sourcesContent":["import { fileURLToPath } from \"node:url\";\nimport {\n  type BaseResolver,\n  bundle,\n  type Document,\n  lintDocument,\n  type NormalizedProblem,\n  type Config as RedoclyConfig,\n} from \"@redocly/openapi-core\";\nimport type { Logger } from \"../../application/ports/logger.js\";\nimport type { SchemaLoader, SchemaLoadRequest } from \"../../application/ports/schema-loader.js\";\nimport { withStackOverflowReportedAsync } from \"../../application/stack-overflow.js\";\nimport { WARNING_CODES, warningText } from \"../../domain/warnings.js\";\nimport type { OpenAPI3 } from \"../../types.js\";\nimport { repairBundledRefs } from \"./bundled-ref-repair.js\";\nimport { findMalformedRefs, malformedRefsError } from \"./malformed-refs.js\";\nimport { RefAccessResolver } from \"./ref-access.js\";\nimport { checkRefsResolve } from \"./ref-resolution-check.js\";\nimport { REF_CYCLE_MESSAGE } from \"./ref-resolution-steps.js\";\nimport { type RemoteDocumentLimits, resolveConfigWithAccess } from \"./remote-fetch.js\";\nimport {\n  loadFailedError,\n  refCycleError,\n  schemaInvalidError,\n  versionUnsupportedError,\n} from \"./schema-load-errors.js\";\nimport { parseSchema } from \"./schema-source.js\";\nimport {\n  findUnsupportedKeys,\n  type LoadedDocument,\n  unsupportedKeysError,\n} from \"./unsupported-keys.js\";\n\n/**\n * The SchemaLoader port on Redocly 1.34 (ADR-005): parse any inherited source type, then lint and\n * bundle with the given Redocly config. Problems go to the logger; errors fail the load.\n */\nexport interface RedoclySchemaLoaderOptions {\n  readonly redoc: RedoclyConfig;\n  readonly logger: Logger;\n  /** A monotonic time in milliseconds, for the debug durations. */\n  readonly now: () => number;\n  /** Time limit of one remote fetch, unless the Redocly config brings its own `customFetch`. */\n  readonly remoteRefTimeoutMs: number;\n  readonly remoteDocumentLimits: RemoteDocumentLimits;\n}\n\nconst UNSUPPORTED_FORMAT_MESSAGE = \"Unsupported schema format, expected `openapi: 3.x`\";\n\n/**\n * Accept OpenAPI 3.x only; Swagger 2 and other formats get their own message. An empty file or a\n * `null` root parses to nothing, so it is checked before any field is read.\n */\nfunction assertOpenAPI3(document: unknown): void {\n  if (typeof document !== \"object\" || document === null) {\n    throw versionUnsupportedError(UNSUPPORTED_FORMAT_MESSAGE, {});\n  }\n  const parsed = document as Record<string, unknown>;\n  const openapiVersion = Number.parseFloat(parsed.openapi as string);\n  const isOpenAPI3 =\n    !parsed.swagger &&\n    Boolean(parsed.openapi) &&\n    !Number.isNaN(openapiVersion) &&\n    openapiVersion >= 3 &&\n    openapiVersion < 4;\n  if (isOpenAPI3) {\n    return;\n  }\n  if (parsed.swagger) {\n    throw versionUnsupportedError(\n      \"Unsupported Swagger version: 2.x. Use OpenAPI 3.x instead.\",\n      parsed,\n    );\n  }\n  if (parsed.openapi || openapiVersion < 3 || openapiVersion >= 4) {\n    throw versionUnsupportedError(`Unsupported OpenAPI version: ${parsed.openapi}`, parsed);\n  }\n  throw versionUnsupportedError(UNSUPPORTED_FORMAT_MESSAGE, parsed);\n}\n\n/**\n * The name an inline source (a string, object, buffer or stream) gets inside the working\n * directory. Redocly resolves relative `$ref`s against the directory of the document, so the\n * document must be named as a file in the working directory, not as the directory itself.\n */\nconst INLINE_SOURCE_NAME = \"inline-source\";\n\n/** The base for relative `$ref`s: the source file or URL itself, else a file in the cwd. */\nfunction sourceAbsoluteRef(source: unknown, cwd: URL): string {\n  const document = source instanceof URL ? source : new URL(INLINE_SOURCE_NAME, cwd);\n  return document.protocol === \"file:\" ? sourceFilePath(document) : document.href;\n}\n\n/**\n * The path of a `file:` source. A URL that names no path on this platform (an encoded slash, a\n * host on POSIX, no drive letter on Windows) cannot be read, so it fails as a read would.\n */\nfunction sourceFilePath(source: URL): string {\n  try {\n    return fileURLToPath(source);\n  } catch (error) {\n    // Node.js reports these as TypeErrors (ERR_INVALID_FILE_URL_PATH, ERR_INVALID_FILE_URL_HOST).\n    if (!(error instanceof TypeError)) {\n      throw error;\n    }\n    throw loadFailedError(source.href, error);\n  }\n}\n\n/**\n * The root document and every other document the resolver loaded, as far as they parsed. A root\n * read from a file or URL is in the resolver cache too, and is listed once.\n */\nasync function loadedDocuments(root: Document, resolver: BaseResolver): Promise<LoadedDocument[]> {\n  const cached = await Promise.all(resolver.cache.values());\n  const bySource = new Map<string, unknown>([[root.source.absoluteRef, root.parsed]]);\n  for (const document of cached) {\n    if (\"parsed\" in document && !bySource.has(document.source.absoluteRef)) {\n      bySource.set(document.source.absoluteRef, document.parsed);\n    }\n  }\n  return [...bySource].map(([source, parsed]) => ({ source, parsed }));\n}\n\n/** Report the document problems Redocly throws as typed errors; anything else passes through. */\nasync function rethrowDocumentError(\n  error: unknown,\n  root: Document,\n  resolver: BaseResolver,\n): Promise<never> {\n  if (error instanceof Error && error.message === REF_CYCLE_MESSAGE) {\n    throw refCycleError(error);\n  }\n  if (error instanceof URIError) {\n    throw malformedRefsError(findMalformedRefs(await loadedDocuments(root, resolver)), error);\n  }\n  if (error instanceof TypeError) {\n    const keys = findUnsupportedKeys(await loadedDocuments(root, resolver));\n    throw keys.length === 0 ? error : unsupportedKeysError(keys, error);\n  }\n  throw error;\n}\n\nclass RedoclySchemaLoader implements SchemaLoader {\n  readonly #options: RedoclySchemaLoaderOptions;\n\n  constructor(options: RedoclySchemaLoaderOptions) {\n    this.#options = options;\n  }\n\n  async load(request: SchemaLoadRequest): Promise<OpenAPI3> {\n    const resolver = this.#resolver(request);\n    // Parsing is guarded too: `JSON.stringify` of a deep object source overflows the stack on\n    // Node.js 22 and 24, before linting starts.\n    const bundled = await withStackOverflowReportedAsync(\"load\", () =>\n      this.#parseAndBundle(request, resolver),\n    ).catch((error: unknown) => {\n      throw resolver.firstRefusal ?? error;\n    });\n    // A refused `$ref` is an unresolved-`$ref` problem, which a Redocly config can turn off.\n    if (resolver.firstRefusal !== undefined) {\n      throw resolver.firstRefusal;\n    }\n    return bundled;\n  }\n\n  async #parseAndBundle(request: SchemaLoadRequest, resolver: BaseResolver): Promise<OpenAPI3> {\n    const { logger, now } = this.#options;\n    const configLoadedAt = now();\n    logger.debug(\"Loaded Redoc config\", \"redoc\", now() - configLoadedAt);\n    const parseStartedAt = now();\n    const absoluteRef = sourceAbsoluteRef(request.source, request.cwd);\n    const document = await parseSchema(request.source, { absoluteRef, resolver });\n    logger.debug(\"Parsed schema\", \"redoc\", now() - parseStartedAt);\n    assertOpenAPI3(document.parsed);\n    return this.#lintAndBundle(document, resolver, request.shouldLint);\n  }\n\n  #resolver(request: SchemaLoadRequest): RefAccessResolver {\n    const { redoc, remoteRefTimeoutMs, remoteDocumentLimits } = this.#options;\n    const config = resolveConfigWithAccess(redoc.resolve, {\n      timeoutMs: remoteRefTimeoutMs,\n      access: request.refAccess,\n      maxParallelFetches: remoteDocumentLimits.maxParallelFetches,\n    });\n    return new RefAccessResolver(config, {\n      access: request.refAccess,\n      maxRemoteDocuments: remoteDocumentLimits.maxDocuments,\n    });\n  }\n\n  async #lintAndBundle(\n    document: Document,\n    resolver: BaseResolver,\n    shouldLint: boolean,\n  ): Promise<OpenAPI3> {\n    const rethrow = (error: unknown) => rethrowDocumentError(error, document, resolver);\n    // Redocly leaves unhandled rejections behind when a `$ref` fails in two documents (ADR-031).\n    await checkRefsResolve(document, resolver, this.#options.redoc.styleguide).catch(rethrow);\n    if (shouldLint) {\n      await this.#lint(document, resolver).catch(rethrow);\n    }\n    return this.#bundle(document, resolver).catch(rethrow);\n  }\n\n  async #lint(document: Document, resolver: BaseResolver): Promise<void> {\n    const startedAt = this.#options.now();\n    const problems = await lintDocument({\n      document,\n      config: this.#options.redoc.styleguide,\n      externalRefResolver: resolver,\n    });\n    this.#report(problems);\n    this.#options.logger.debug(\"Linted schema\", \"lint\", this.#options.now() - startedAt);\n  }\n\n  async #bundle(document: Document, resolver: BaseResolver): Promise<OpenAPI3> {\n    const startedAt = this.#options.now();\n    // The lint resolver: documents it already loaded are not fetched again.\n    const bundled = await bundle({\n      config: this.#options.redoc,\n      dereference: false,\n      doc: document,\n      externalRefResolver: resolver,\n    });\n    this.#report(bundled.problems);\n    repairBundledRefs(bundled.bundle.parsed);\n    this.#options.logger.debug(\"Bundled schema\", \"bundle\", this.#options.now() - startedAt);\n    return bundled.bundle.parsed;\n  }\n\n  /**\n   * Report every problem; then throw if any of them is an error. A problem that the Redocly\n   * config's `.redocly.lint-ignore.yaml` lists is left out, as `redocly lint` leaves it out\n   * (upstream #2189).\n   */\n  #report(problems: readonly NormalizedProblem[]): void {\n    const errorMessages: string[] = [];\n    for (const problem of problems) {\n      if (problem.ignored === true) {\n        this.#options.logger.debug(\n          `Ignored by the lint ignore file: ${problemMessage(problem)}`,\n          \"lint\",\n        );\n        continue;\n      }\n      const message = problemMessage(problem);\n      if (problem.severity === \"error\") {\n        errorMessages.push(message);\n        this.#options.logger.error(message);\n      } else {\n        this.#options.logger.warn(lintWarningText(problem));\n      }\n    }\n    if (errorMessages.length > 0) {\n      throw schemaInvalidError(errorMessages);\n    }\n  }\n}\n\n/** A lint warning names its rule, which `redocly.yaml` can turn off, and ends with its code. */\nfunction lintWarningText(problem: NormalizedProblem): string {\n  return warningText(\n    `${problemMessage(problem)}, rule ${problem.ruleId}`,\n    WARNING_CODES.LINT_PROBLEM,\n  );\n}\n\nfunction problemMessage(problem: NormalizedProblem): string {\n  const location = problem.location?.[0]?.pointer;\n  return location ? `${problem.message} at ${location}` : problem.message;\n}\n\n/** A schema loader with one Redocly config and logger, for one or more loads. */\nexport function createRedoclySchemaLoader(options: RedoclySchemaLoaderOptions): SchemaLoader {\n  return new RedoclySchemaLoader(options);\n}\n"],"names":[],"mappings":";;;;;;;;;;;;;;AA+CA,MAAM,0BAAA,GAA6B,oDAAA;AAMnC,SAAS,eAAe,QAAA,EAAyB;AAC/C,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,QAAA,KAAa,IAAA,EAAM;AACrD,IAAA,MAAM,uBAAA,CAAwB,0BAAA,EAA4B,EAAE,CAAA;AAAA,EAC9D;AACA,EAAA,MAAM,MAAA,GAAS,QAAA;AACf,EAAA,MAAM,cAAA,GAAiB,MAAA,CAAO,UAAA,CAAW,MAAA,CAAO,OAAiB,CAAA;AACjE,EAAA,MAAM,UAAA,GACJ,CAAC,MAAA,CAAO,OAAA,IACR,QAAQ,MAAA,CAAO,OAAO,CAAA,IACtB,CAAC,OAAO,KAAA,CAAM,cAAc,CAAA,IAC5B,cAAA,IAAkB,KAClB,cAAA,GAAiB,CAAA;AACnB,EAAA,IAAI,UAAA,EAAY;AACd,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,uBAAA;AAAA,MACJ,4DAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,IAAW,cAAA,GAAiB,CAAA,IAAK,kBAAkB,CAAA,EAAG;AAC/D,IAAA,MAAM,uBAAA,CAAwB,CAAA,6BAAA,EAAgC,MAAA,CAAO,OAAO,IAAI,MAAM,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,uBAAA,CAAwB,4BAA4B,MAAM,CAAA;AAClE;AAOA,MAAM,kBAAA,GAAqB,eAAA;AAG3B,SAAS,iBAAA,CAAkB,QAAiB,GAAA,EAAkB;AAC5D,EAAA,MAAM,WAAW,MAAA,YAAkB,GAAA,GAAM,SAAS,IAAI,GAAA,CAAI,oBAAoB,GAAG,CAAA;AACjF,EAAA,OAAO,SAAS,QAAA,KAAa,OAAA,GAAU,cAAA,CAAe,QAAQ,IAAI,QAAA,CAAS,IAAA;AAC7E;AAMA,SAAS,eAAe,MAAA,EAAqB;AAC3C,EAAA,IAAI;AACF,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,SAAS,KAAA,EAAO;AAEd,IAAA,IAAI,EAAE,iBAAiB,SAAA,CAAA,EAAY;AACjC,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,MAAM,eAAA,CAAgB,MAAA,CAAO,IAAA,EAAM,KAAK,CAAA;AAAA,EAC1C;AACF;AAMA,eAAe,eAAA,CAAgB,MAAgB,QAAA,EAAmD;AAChG,EAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,IAAI,QAAA,CAAS,KAAA,CAAM,QAAQ,CAAA;AACxD,EAAA,MAAM,QAAA,mBAAW,IAAI,GAAA,CAAqB,CAAC,CAAC,IAAA,CAAK,MAAA,CAAO,WAAA,EAAa,IAAA,CAAK,MAAM,CAAC,CAAC,CAAA;AAClF,EAAA,KAAA,MAAW,YAAY,MAAA,EAAQ;AAC7B,IAAA,IAAI,QAAA,IAAY,YAAY,CAAC,QAAA,CAAS,IAAI,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA,EAAG;AACtE,MAAA,QAAA,CAAS,GAAA,CAAI,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,SAAS,MAAM,CAAA;AAAA,IAC3D;AAAA,EACF;AACA,EAAA,OAAO,CAAC,GAAG,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,MAAA,EAAQ,MAAM,CAAA,MAAO,EAAE,MAAA,EAAQ,QAAO,CAAE,CAAA;AACrE;AAGA,eAAe,oBAAA,CACb,KAAA,EACA,IAAA,EACA,QAAA,EACgB;AAChB,EAAA,IAAI,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,OAAA,KAAY,iBAAA,EAAmB;AACjE,IAAA,MAAM,cAAc,KAAK,CAAA;AAAA,EAC3B;AACA,EAAA,IAAI,iBAAiB,QAAA,EAAU;AAC7B,IAAA,MAAM,kBAAA,CAAmB,kBAAkB,MAAM,eAAA,CAAgB,MAAM,QAAQ,CAAC,GAAG,KAAK,CAAA;AAAA,EAC1F;AACA,EAAA,IAAI,iBAAiB,SAAA,EAAW;AAC9B,IAAA,MAAM,OAAO,mBAAA,CAAoB,MAAM,eAAA,CAAgB,IAAA,EAAM,QAAQ,CAAC,CAAA;AACtE,IAAA,MAAM,KAAK,MAAA,KAAW,CAAA,GAAI,KAAA,GAAQ,oBAAA,CAAqB,MAAM,KAAK,CAAA;AAAA,EACpE;AACA,EAAA,MAAM,KAAA;AACR;AAEA,MAAM,mBAAA,CAA4C;AAAA,EACvC,QAAA;AAAA,EAET,YAAY,OAAA,EAAqC;AAC/C,IAAA,IAAA,CAAK,QAAA,GAAW,OAAA;AAAA,EAClB;AAAA,EAEA,MAAM,KAAK,OAAA,EAA+C;AACxD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AAGvC,IAAA,MAAM,UAAU,MAAM,8BAAA;AAAA,MAA+B,MAAA;AAAA,MAAQ,MAC3D,IAAA,CAAK,eAAA,CAAgB,OAAA,EAAS,QAAQ;AAAA,KACxC,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AAC1B,MAAA,MAAM,SAAS,YAAA,IAAgB,KAAA;AAAA,IACjC,CAAC,CAAA;AAED,IAAA,IAAI,QAAA,CAAS,iBAAiB,MAAA,EAAW;AACvC,MAAA,MAAM,QAAA,CAAS,YAAA;AAAA,IACjB;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEA,MAAM,eAAA,CAAgB,OAAA,EAA4B,QAAA,EAA2C;AAC3F,IAAA,MAAM,EAAE,MAAA,EAAQ,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA;AAC7B,IAAA,MAAM,iBAAiB,GAAA,EAAI;AAC3B,IAAA,MAAA,CAAO,KAAA,CAAM,qBAAA,EAAuB,OAAA,EAAS,GAAA,KAAQ,cAAc,CAAA;AACnE,IAAA,MAAM,iBAAiB,GAAA,EAAI;AAC3B,IAAA,MAAM,WAAA,GAAc,iBAAA,CAAkB,OAAA,CAAQ,MAAA,EAAQ,QAAQ,GAAG,CAAA;AACjE,IAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,CAAQ,QAAQ,EAAE,WAAA,EAAa,UAAU,CAAA;AAC5E,IAAA,MAAA,CAAO,KAAA,CAAM,eAAA,EAAiB,OAAA,EAAS,GAAA,KAAQ,cAAc,CAAA;AAC7D,IAAA,cAAA,CAAe,SAAS,MAAM,CAAA;AAC9B,IAAA,OAAO,IAAA,CAAK,cAAA,CAAe,QAAA,EAAU,QAAA,EAAU,QAAQ,UAAU,CAAA;AAAA,EACnE;AAAA,EAEA,UAAU,OAAA,EAA+C;AACvD,IAAA,MAAM,EAAE,KAAA,EAAO,kBAAA,EAAoB,oBAAA,KAAyB,IAAA,CAAK,QAAA;AACjE,IAAA,MAAM,MAAA,GAAS,uBAAA,CAAwB,KAAA,CAAM,OAAA,EAAS;AAAA,MACpD,SAAA,EAAW,kBAAA;AAAA,MACX,QAAQ,OAAA,CAAQ,SAAA;AAAA,MAChB,oBAAoB,oBAAA,CAAqB;AAAA,KAC1C,CAAA;AACD,IAAA,OAAO,IAAI,kBAAkB,MAAA,EAAQ;AAAA,MACnC,QAAQ,OAAA,CAAQ,SAAA;AAAA,MAChB,oBAAoB,oBAAA,CAAqB;AAAA,KAC1C,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,cAAA,CACJ,QAAA,EACA,QAAA,EACA,UAAA,EACmB;AACnB,IAAA,MAAM,UAAU,CAAC,KAAA,KAAmB,oBAAA,CAAqB,KAAA,EAAO,UAAU,QAAQ,CAAA;AAElF,IAAA,MAAM,gBAAA,CAAiB,UAAU,QAAA,EAAU,IAAA,CAAK,SAAS,KAAA,CAAM,UAAU,CAAA,CAAE,KAAA,CAAM,OAAO,CAAA;AACxF,IAAA,IAAI,UAAA,EAAY;AACd,MAAA,MAAM,KAAK,KAAA,CAAM,QAAA,EAAU,QAAQ,CAAA,CAAE,MAAM,OAAO,CAAA;AAAA,IACpD;AACA,IAAA,OAAO,KAAK,OAAA,CAAQ,QAAA,EAAU,QAAQ,CAAA,CAAE,MAAM,OAAO,CAAA;AAAA,EACvD;AAAA,EAEA,MAAM,KAAA,CAAM,QAAA,EAAoB,QAAA,EAAuC;AACrE,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI;AACpC,IAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa;AAAA,MAClC,QAAA;AAAA,MACA,MAAA,EAAQ,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,UAAA;AAAA,MAC5B,mBAAA,EAAqB;AAAA,KACtB,CAAA;AACD,IAAA,IAAA,CAAK,QAAQ,QAAQ,CAAA;AACrB,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,KAAA,CAAM,eAAA,EAAiB,QAAQ,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI,GAAI,SAAS,CAAA;AAAA,EACrF;AAAA,EAEA,MAAM,OAAA,CAAQ,QAAA,EAAoB,QAAA,EAA2C;AAC3E,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI;AAEpC,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO;AAAA,MAC3B,MAAA,EAAQ,KAAK,QAAA,CAAS,KAAA;AAAA,MACtB,WAAA,EAAa,KAAA;AAAA,MACb,GAAA,EAAK,QAAA;AAAA,MACL,mBAAA,EAAqB;AAAA,KACtB,CAAA;AACD,IAAA,IAAA,CAAK,OAAA,CAAQ,QAAQ,QAAQ,CAAA;AAC7B,IAAA,iBAAA,CAAkB,OAAA,CAAQ,OAAO,MAAM,CAAA;AACvC,IAAA,IAAA,CAAK,QAAA,CAAS,OAAO,KAAA,CAAM,gBAAA,EAAkB,UAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAI,GAAI,SAAS,CAAA;AACtF,IAAA,OAAO,QAAQ,MAAA,CAAO,MAAA;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,QAAQ,QAAA,EAA8C;AACpD,IAAA,MAAM,gBAA0B,EAAC;AACjC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI,OAAA,CAAQ,YAAY,IAAA,EAAM;AAC5B,QAAA,IAAA,CAAK,SAAS,MAAA,CAAO,KAAA;AAAA,UACnB,CAAA,iCAAA,EAAoC,cAAA,CAAe,OAAO,CAAC,CAAA,CAAA;AAAA,UAC3D;AAAA,SACF;AACA,QAAA;AAAA,MACF;AACA,MAAA,MAAM,OAAA,GAAU,eAAe,OAAO,CAAA;AACtC,MAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAChC,QAAA,aAAA,CAAc,KAAK,OAAO,CAAA;AAC1B,QAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,KAAA,CAAM,OAAO,CAAA;AAAA,MACpC,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,IAAA,CAAK,eAAA,CAAgB,OAAO,CAAC,CAAA;AAAA,MACpD;AAAA,IACF;AACA,IAAA,IAAI,aAAA,CAAc,SAAS,CAAA,EAAG;AAC5B,MAAA,MAAM,mBAAmB,aAAa,CAAA;AAAA,IACxC;AAAA,EACF;AACF;AAGA,SAAS,gBAAgB,OAAA,EAAoC;AAC3D,EAAA,OAAO,WAAA;AAAA,IACL,GAAG,cAAA,CAAe,OAAO,CAAC,CAAA,OAAA,EAAU,QAAQ,MAAM,CAAA,CAAA;AAAA,IAClD,aAAA,CAAc;AAAA,GAChB;AACF;AAEA,SAAS,eAAe,OAAA,EAAoC;AAC1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,GAAW,CAAC,CAAA,EAAG,OAAA;AACxC,EAAA,OAAO,WAAW,CAAA,EAAG,OAAA,CAAQ,OAAO,CAAA,IAAA,EAAO,QAAQ,KAAK,OAAA,CAAQ,OAAA;AAClE;AAGO,SAAS,0BAA0B,OAAA,EAAmD;AAC3F,EAAA,OAAO,IAAI,oBAAoB,OAAO,CAAA;AACxC;;"}

package/dist/adapters/redocly-loader/ref-access.cjs

@@ -5,6 +5,7 @@ const path = require('node:path');
 const node_url = require('node:url');
 const openapiCore = require('@redocly/openapi-core');
 const errors = require('../../domain/errors.cjs');
+const urlCredentials = require('../../domain/url-credentials.cjs');
 const aliasLimit = require('./alias-limit.cjs');
 const allowedHosts = require('./allowed-hosts.cjs');
 const schemaLoadErrors = require('./schema-load-errors.cjs');
@@ -52,14 +53,23 @@ async function refusalOf(absoluteRef, access) {
     allowedHosts: [...access.remoteHosts]
   });
 }
+function localFromRemoteRefusal(base, absoluteRef) {
+  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {
+    return void 0;
+  }
+  const shownBase = urlCredentials.redactUrlCredentials(base);
+  return schemaLoadErrors.refForbiddenError(absoluteRef, { reason: "local-ref-from-remote", base: shownBase });
+}
 class RefAccessResolver extends openapiCore.BaseResolver {
-  #access;
+  #limits;
   #refusals = [];
   /** The root document's ref: it is chosen by the developer, so it is not limited. */
   #rootRef;
-  constructor(config, access) {
+  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */
+  #remoteDocumentCount = 0;
+  constructor(config, limits) {
     super(config);
-    this.#access = access;
+    this.#limits = limits;
   }
   /** The first document that was refused, if any. */
   get firstRefusal() {
@@ -69,6 +79,11 @@ class RefAccessResolver extends openapiCore.BaseResolver {
     if (isRoot) {
       this.#rootRef = this.resolveExternalRef(base, ref);
     }
+    const refusal = base === null ? void 0 : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));
+    if (refusal !== void 0) {
+      this.#refusals.push(refusal);
+      return Promise.reject(refusal);
+    }
     return super.resolveDocument(base, ref, isRoot);
   }
   /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */
@@ -81,7 +96,7 @@ class RefAccessResolver extends openapiCore.BaseResolver {
     return document;
   }
   async loadExternalRef(absoluteRef) {
-    const refusal = absoluteRef === this.#rootRef ? void 0 : await refusalOf(absoluteRef, this.#access);
+    const refusal = this.#countRefusal(absoluteRef) ?? await this.#accessRefusal(absoluteRef);
     if (refusal !== void 0) {
       this.#refusals.push(refusal);
       throw refusal;
@@ -96,6 +111,24 @@ class RefAccessResolver extends openapiCore.BaseResolver {
       throw error;
     }
   }
+  #accessRefusal(absoluteRef) {
+    return absoluteRef === this.#rootRef ? Promise.resolve(void 0) : refusalOf(absoluteRef, this.#limits.access);
+  }
+  /**
+   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three
+   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).
+   */
+  #countRefusal(absoluteRef) {
+    if (!isRemoteRef(absoluteRef)) {
+      return void 0;
+    }
+    this.#remoteDocumentCount += 1;
+    const { maxRemoteDocuments } = this.#limits;
+    return this.#remoteDocumentCount > maxRemoteDocuments ? schemaLoadErrors.refForbiddenError(absoluteRef, {
+      reason: "too-many-remote-documents",
+      maxDocuments: maxRemoteDocuments
+    }) : void 0;
+  }
 }
 function isRefusal(value) {
   return value?.code === errors.ERROR_CODES.SCHEMA_REF_FORBIDDEN;

package/dist/adapters/redocly-loader/ref-access.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-access.cjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #access: RefAccess;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n\n  constructor(config: ResolveConfig, access: RefAccess) {\n    super(config);\n    this.#access = access;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal =\n      absoluteRef === this.#rootRef ? undefined : await refusalOf(absoluteRef, this.#access);\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":["path","realpath","fileURLToPath","refForbiddenError","isHostAllowed","BaseResolver","aliasExpansionFailure","YamlParseError","ERROR_CODES"],"mappings":";;;;;;;;;;;;;;;AAwBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAKA,aAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAACA,aAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAMC,kBAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAASD,aAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAOA,aAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAGA,aAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAeE,sBAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOC,mCAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAaC,0BAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOD,mCAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOO,MAAM,0BAA0BE,wBAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA,EAEA,WAAA,CAAY,QAAuB,MAAA,EAAmB;AACpD,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAUC,gCAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAIC,0BAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GACJ,gBAAgB,IAAA,CAAK,QAAA,GAAW,SAAY,MAAM,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAO,CAAA;AACvF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAASC,kBAAA,CAAY,oBAAA;AACpE;;;;"}
+{"version":3,"file":"ref-access.cjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlCredentials } from \"../../domain/url-credentials.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A remote document may refer only to other URLs (threat model T3). Redocly resolves a `$ref`\n * against a URL base with `new URL()`, so `C:/x` becomes `c:/x` and `file:///x` stays as it is;\n * Redocly then reads either from disk, and on Windows a drive letter is an absolute path.\n */\nfunction localFromRemoteRefusal(\n  base: string,\n  absoluteRef: string,\n): OpenAPITypesafeError | undefined {\n  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {\n    return undefined;\n  }\n  const shownBase = redactUrlCredentials(base);\n  return refForbiddenError(absoluteRef, { reason: \"local-ref-from-remote\", base: shownBase });\n}\n\n/** The limits one resolver checks; each load gets its own resolver. */\nexport interface RefAccessLimits {\n  readonly access: RefAccess;\n  /** Remote documents one load may fetch, the root included (threat model T2). */\n  readonly maxRemoteDocuments: number;\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #limits: RefAccessLimits;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */\n  #remoteDocumentCount = 0;\n\n  constructor(config: ResolveConfig, limits: RefAccessLimits) {\n    super(config);\n    this.#limits = limits;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    const refusal =\n      base === null ? undefined : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      return Promise.reject(refusal);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal = this.#countRefusal(absoluteRef) ?? (await this.#accessRefusal(absoluteRef));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n\n  #accessRefusal(absoluteRef: string): Promise<OpenAPITypesafeError | undefined> {\n    return absoluteRef === this.#rootRef\n      ? Promise.resolve(undefined)\n      : refusalOf(absoluteRef, this.#limits.access);\n  }\n\n  /**\n   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three\n   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).\n   */\n  #countRefusal(absoluteRef: string): OpenAPITypesafeError | undefined {\n    if (!isRemoteRef(absoluteRef)) {\n      return undefined;\n    }\n    this.#remoteDocumentCount += 1;\n    const { maxRemoteDocuments } = this.#limits;\n    return this.#remoteDocumentCount > maxRemoteDocuments\n      ? refForbiddenError(absoluteRef, {\n          reason: \"too-many-remote-documents\",\n          maxDocuments: maxRemoteDocuments,\n        })\n      : undefined;\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":["path","realpath","fileURLToPath","refForbiddenError","isHostAllowed","redactUrlCredentials","BaseResolver","aliasExpansionFailure","YamlParseError","ERROR_CODES"],"mappings":";;;;;;;;;;;;;;;;AAyBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAKA,aAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAACA,aAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAWA,aAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAMC,kBAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAASD,aAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAOA,aAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAGA,aAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAeE,sBAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOC,mCAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAaC,0BAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAOD,mCAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOA,SAAS,sBAAA,CACP,MACA,WAAA,EACkC;AAClC,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,IAAK,WAAA,CAAY,WAAW,CAAA,EAAG;AAClD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAYE,oCAAqB,IAAI,CAAA;AAC3C,EAAA,OAAOF,mCAAkB,WAAA,EAAa,EAAE,QAAQ,uBAAA,EAAyB,IAAA,EAAM,WAAW,CAAA;AAC5F;AAcO,MAAM,0BAA0BG,wBAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA;AAAA,EAEA,oBAAA,GAAuB,CAAA;AAAA,EAEvB,WAAA,CAAY,QAAuB,MAAA,EAAyB;AAC1D,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GACJ,IAAA,KAAS,IAAA,GAAO,MAAA,GAAY,sBAAA,CAAuB,MAAM,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAC,CAAA;AAC7F,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAUC,gCAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAIC,0BAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GAAU,KAAK,aAAA,CAAc,WAAW,KAAM,MAAM,IAAA,CAAK,eAAe,WAAW,CAAA;AACzF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,eAAe,WAAA,EAAgE;AAC7E,IAAA,OAAO,WAAA,KAAgB,IAAA,CAAK,QAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA,GACzB,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,WAAA,EAAuD;AACnE,IAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,oBAAA,IAAwB,CAAA;AAC7B,IAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,IAAA,CAAK,OAAA;AACpC,IAAA,OAAO,IAAA,CAAK,oBAAA,GAAuB,kBAAA,GAC/BL,kCAAA,CAAkB,WAAA,EAAa;AAAA,MAC7B,MAAA,EAAQ,2BAAA;AAAA,MACR,YAAA,EAAc;AAAA,KACf,CAAA,GACD,MAAA;AAAA,EACN;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAASM,kBAAA,CAAY,oBAAA;AACpE;;;;"}

package/dist/adapters/redocly-loader/ref-access.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { BaseResolver, YamlParseError } from '@redocly/openapi-core';
 import { ERROR_CODES } from '../../domain/errors.mjs';
+import { redactUrlCredentials } from '../../domain/url-credentials.mjs';
 import { aliasExpansionFailure } from './alias-limit.mjs';
 import { isHostAllowed } from './allowed-hosts.mjs';
 import { refForbiddenError } from './schema-load-errors.mjs';
@@ -46,14 +47,23 @@ async function refusalOf(absoluteRef, access) {
     allowedHosts: [...access.remoteHosts]
   });
 }
+function localFromRemoteRefusal(base, absoluteRef) {
+  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {
+    return void 0;
+  }
+  const shownBase = redactUrlCredentials(base);
+  return refForbiddenError(absoluteRef, { reason: "local-ref-from-remote", base: shownBase });
+}
 class RefAccessResolver extends BaseResolver {
-  #access;
+  #limits;
   #refusals = [];
   /** The root document's ref: it is chosen by the developer, so it is not limited. */
   #rootRef;
-  constructor(config, access) {
+  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */
+  #remoteDocumentCount = 0;
+  constructor(config, limits) {
     super(config);
-    this.#access = access;
+    this.#limits = limits;
   }
   /** The first document that was refused, if any. */
   get firstRefusal() {
@@ -63,6 +73,11 @@ class RefAccessResolver extends BaseResolver {
     if (isRoot) {
       this.#rootRef = this.resolveExternalRef(base, ref);
     }
+    const refusal = base === null ? void 0 : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));
+    if (refusal !== void 0) {
+      this.#refusals.push(refusal);
+      return Promise.reject(refusal);
+    }
     return super.resolveDocument(base, ref, isRoot);
   }
   /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */
@@ -75,7 +90,7 @@ class RefAccessResolver extends BaseResolver {
     return document;
   }
   async loadExternalRef(absoluteRef) {
-    const refusal = absoluteRef === this.#rootRef ? void 0 : await refusalOf(absoluteRef, this.#access);
+    const refusal = this.#countRefusal(absoluteRef) ?? await this.#accessRefusal(absoluteRef);
     if (refusal !== void 0) {
       this.#refusals.push(refusal);
       throw refusal;
@@ -90,6 +105,24 @@ class RefAccessResolver extends BaseResolver {
       throw error;
     }
   }
+  #accessRefusal(absoluteRef) {
+    return absoluteRef === this.#rootRef ? Promise.resolve(void 0) : refusalOf(absoluteRef, this.#limits.access);
+  }
+  /**
+   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three
+   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).
+   */
+  #countRefusal(absoluteRef) {
+    if (!isRemoteRef(absoluteRef)) {
+      return void 0;
+    }
+    this.#remoteDocumentCount += 1;
+    const { maxRemoteDocuments } = this.#limits;
+    return this.#remoteDocumentCount > maxRemoteDocuments ? refForbiddenError(absoluteRef, {
+      reason: "too-many-remote-documents",
+      maxDocuments: maxRemoteDocuments
+    }) : void 0;
+  }
 }
 function isRefusal(value) {
   return value?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;

package/dist/adapters/redocly-loader/ref-access.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-access.mjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #access: RefAccess;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n\n  constructor(config: ResolveConfig, access: RefAccess) {\n    super(config);\n    this.#access = access;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal =\n      absoluteRef === this.#rootRef ? undefined : await refusalOf(absoluteRef, this.#access);\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":[],"mappings":";;;;;;;;;AAwBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAK,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAO,IAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,aAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAa,aAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOO,MAAM,0BAA0B,YAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA,EAEA,WAAA,CAAY,QAAuB,MAAA,EAAmB;AACpD,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GACJ,gBAAgB,IAAA,CAAK,QAAA,GAAW,SAAY,MAAM,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAO,CAAA;AACvF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAAS,WAAA,CAAY,oBAAA;AACpE;;"}
+{"version":3,"file":"ref-access.mjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlCredentials } from \"../../domain/url-credentials.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A remote document may refer only to other URLs (threat model T3). Redocly resolves a `$ref`\n * against a URL base with `new URL()`, so `C:/x` becomes `c:/x` and `file:///x` stays as it is;\n * Redocly then reads either from disk, and on Windows a drive letter is an absolute path.\n */\nfunction localFromRemoteRefusal(\n  base: string,\n  absoluteRef: string,\n): OpenAPITypesafeError | undefined {\n  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {\n    return undefined;\n  }\n  const shownBase = redactUrlCredentials(base);\n  return refForbiddenError(absoluteRef, { reason: \"local-ref-from-remote\", base: shownBase });\n}\n\n/** The limits one resolver checks; each load gets its own resolver. */\nexport interface RefAccessLimits {\n  readonly access: RefAccess;\n  /** Remote documents one load may fetch, the root included (threat model T2). */\n  readonly maxRemoteDocuments: number;\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #limits: RefAccessLimits;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */\n  #remoteDocumentCount = 0;\n\n  constructor(config: ResolveConfig, limits: RefAccessLimits) {\n    super(config);\n    this.#limits = limits;\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    const refusal =\n      base === null ? undefined : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      return Promise.reject(refusal);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = super.parseDocument(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal = this.#countRefusal(absoluteRef) ?? (await this.#accessRefusal(absoluteRef));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n\n  #accessRefusal(absoluteRef: string): Promise<OpenAPITypesafeError | undefined> {\n    return absoluteRef === this.#rootRef\n      ? Promise.resolve(undefined)\n      : refusalOf(absoluteRef, this.#limits.access);\n  }\n\n  /**\n   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three\n   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).\n   */\n  #countRefusal(absoluteRef: string): OpenAPITypesafeError | undefined {\n    if (!isRemoteRef(absoluteRef)) {\n      return undefined;\n    }\n    this.#remoteDocumentCount += 1;\n    const { maxRemoteDocuments } = this.#limits;\n    return this.#remoteDocumentCount > maxRemoteDocuments\n      ? refForbiddenError(absoluteRef, {\n          reason: \"too-many-remote-documents\",\n          maxDocuments: maxRemoteDocuments,\n        })\n      : undefined;\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":[],"mappings":";;;;;;;;;;AAyBA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAK,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAO,IAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,aAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAa,aAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOA,SAAS,sBAAA,CACP,MACA,WAAA,EACkC;AAClC,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,IAAK,WAAA,CAAY,WAAW,CAAA,EAAG;AAClD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,qBAAqB,IAAI,CAAA;AAC3C,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,uBAAA,EAAyB,IAAA,EAAM,WAAW,CAAA;AAC5F;AAcO,MAAM,0BAA0B,YAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA;AAAA,EAEA,oBAAA,GAAuB,CAAA;AAAA,EAEvB,WAAA,CAAY,QAAuB,MAAA,EAAyB;AAC1D,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GACJ,IAAA,KAAS,IAAA,GAAO,MAAA,GAAY,sBAAA,CAAuB,MAAM,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAC,CAAA;AAC7F,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AACnD,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GAAU,KAAK,aAAA,CAAc,WAAW,KAAM,MAAM,IAAA,CAAK,eAAe,WAAW,CAAA;AACzF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,eAAe,WAAA,EAAgE;AAC7E,IAAA,OAAO,WAAA,KAAgB,IAAA,CAAK,QAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA,GACzB,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,WAAA,EAAuD;AACnE,IAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,oBAAA,IAAwB,CAAA;AAC7B,IAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,IAAA,CAAK,OAAA;AACpC,IAAA,OAAO,IAAA,CAAK,oBAAA,GAAuB,kBAAA,GAC/B,iBAAA,CAAkB,WAAA,EAAa;AAAA,MAC7B,MAAA,EAAQ,2BAAA;AAAA,MACR,YAAA,EAAc;AAAA,KACf,CAAA,GACD,MAAA;AAAA,EACN;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAAS,WAAA,CAAY,oBAAA;AACpE;;"}

package/dist/adapters/redocly-loader/ref-resolution-check.cjs

@@ -0,0 +1,191 @@
+'use strict';
+
+const openapiCore = require('@redocly/openapi-core');
+const refResolutionSteps = require('./ref-resolution-steps.cjs');
+
+class RefResolutionWalk {
+  #resolver;
+  /** Redocly's `SpecExtension` type: its values are walked like values of no known type. */
+  specExtension;
+  /** Walked nodes per type name; a node walked again with the same type starts the same lookups. */
+  #seenNodes = /* @__PURE__ */ new Map();
+  #lookups = [];
+  constructor(resolver, specExtension) {
+    this.#resolver = resolver;
+    this.specExtension = specExtension;
+  }
+  isWalkedLikeUnknown(type) {
+    return type === refResolutionSteps.UNKNOWN_TYPE || type === this.specExtension;
+  }
+  /** Wait for every lookup, including those started while waiting; return the first failure. */
+  async settle() {
+    let settled;
+    do {
+      settled = await Promise.allSettled(this.#lookups);
+    } while (settled.length !== this.#lookups.length);
+    return settled.find((result) => result.status === "rejected");
+  }
+  walkFrom(node, document, pointer, type) {
+    new DocumentWalk(this, document).walk(node, type, document.source.absoluteRef + pointer);
+  }
+  /** Whether the node was walked with this type before; marks it walked. */
+  isSeen(type, node) {
+    let seen = this.#seenNodes.get(type.name);
+    if (seen === void 0) {
+      seen = /* @__PURE__ */ new WeakSet();
+      this.#seenNodes.set(type.name, seen);
+    }
+    if (seen.has(node)) {
+      return true;
+    }
+    seen.add(node);
+    return false;
+  }
+  track(lookup, type) {
+    this.#lookups.push(
+      lookup.then((resolved) => {
+        if (resolved.resolved && resolved.document !== void 0) {
+          this.walkFrom(resolved.node, resolved.document, resolved.nodePointer ?? "#/", type);
+        }
+      })
+    );
+  }
+  async loadDocument(base, uri) {
+    try {
+      return await this.#resolver.resolveDocument(base.source.absoluteRef, uri);
+    } catch {
+      return void 0;
+    }
+  }
+}
+class DocumentWalk {
+  #walk;
+  #document;
+  #anchors = /* @__PURE__ */ new Map();
+  constructor(walk, document) {
+    this.#walk = walk;
+    this.#document = document;
+  }
+  walk(node, type, absoluteRef) {
+    if (typeof node !== "object" || node === null || this.#walk.isSeen(type, node)) {
+      return;
+    }
+    const anchor = node.$anchor;
+    if (Object.hasOwn(node, "$anchor") && anchor) {
+      this.#anchors.set(`#${String(anchor)}`, node);
+    }
+    if (Array.isArray(node)) {
+      this.#walkItems(node, type, absoluteRef);
+      return;
+    }
+    for (const name of Object.keys(node)) {
+      const value = node[name];
+      const [propType, walked] = refResolutionSteps.propertyType(type, name, value, this.#walk.specExtension);
+      if (refResolutionSteps.isNamedType(propType) && typeof walked === "object") {
+        this.walk(walked, propType, refResolutionSteps.joinPointer(absoluteRef, refResolutionSteps.escapePointer(name)));
+      }
+    }
+    if (openapiCore.isRef(node)) {
+      this.#walk.track(this.#follow(this.#document, node, { prev: null, node }), type);
+    }
+    if (refResolutionSteps.isExternalValue(node)) {
+      const ref = { $ref: node.externalValue };
+      this.#walk.track(this.#follow(this.#document, ref, { prev: null, node }), type);
+    }
+  }
+  #walkItems(items, type, absoluteRef) {
+    const itemsType = type.items;
+    if (itemsType === void 0 && !this.#walk.isWalkedLikeUnknown(type)) {
+      return;
+    }
+    items.forEach((item, index) => {
+      const pointer = refResolutionSteps.joinPointer(absoluteRef, index);
+      const itemType = typeof itemsType === "function" ? itemsType(item, pointer) : itemsType;
+      if (itemType === void 0 && !this.#walk.isWalkedLikeUnknown(type)) {
+        return;
+      }
+      this.walk(item, refResolutionSteps.isNamedType(itemType) ? itemType : refResolutionSteps.UNKNOWN_TYPE, pointer);
+    });
+  }
+  async #follow(document, ref, refStack) {
+    if (refResolutionSteps.hasRef(refStack.prev, ref)) {
+      throw new Error(refResolutionSteps.REF_CYCLE_MESSAGE);
+    }
+    if (refResolutionSteps.ANCHOR_REF.test(ref.$ref)) {
+      await refResolutionSteps.nextTick();
+      return { resolved: true, node: this.#anchors.get(ref.$ref), document, nodePointer: ref.$ref };
+    }
+    const { uri, pointer } = refResolutionSteps.parseRef(ref.$ref);
+    const targetDocument = uri === null ? document : await this.#walk.loadDocument(document, uri);
+    if (targetDocument === void 0) {
+      return { resolved: false };
+    }
+    const found = await this.#followSegments(targetDocument, pointer, refStack);
+    if (found.document !== void 0 && openapiCore.isRef(found.node)) {
+      return this.#follow(found.document, found.node, pushRef(refStack, found.node));
+    }
+    return found;
+  }
+  /** Follow the pointer segments; a `$ref` met on the way is resolved first. */
+  async #followSegments(targetDocument, segments, refStack) {
+    let document = targetDocument;
+    let nodePointer = "#/";
+    let target = targetDocument.parsed;
+    for (const segment of segments) {
+      if (typeof target !== "object") {
+        return { resolved: true, node: void 0, document, nodePointer };
+      }
+      const step = target[segment];
+      if (step !== void 0) {
+        target = step;
+      } else if (openapiCore.isRef(target)) {
+        const resolved = await this.#follow(document, target, pushRef(refStack, target));
+        document = resolved.document ?? document;
+        if (typeof resolved.node !== "object") {
+          return {
+            resolved: true,
+            node: void 0,
+            document,
+            nodePointer: resolved.nodePointer ?? nodePointer
+          };
+        }
+        target = resolved.node[segment];
+        nodePointer = resolved.nodePointer ?? nodePointer;
+      } else {
+        return { resolved: true, node: void 0, document, nodePointer };
+      }
+      nodePointer = refResolutionSteps.joinPointer(nodePointer, refResolutionSteps.escapePointer(segment));
+    }
+    return { resolved: true, node: target, document, nodePointer };
+  }
+}
+function pushRef(head, node) {
+  return { prev: head, node };
+}
+async function checkRefsResolve(document, resolver, styleguide) {
+  const specVersion = openapiCore.detectSpec(document.parsed);
+  const types = openapiCore.normalizeTypes(
+    styleguide.extendTypes(openapiCore.getTypes(specVersion), specVersion),
+    styleguide
+  );
+  const rootType = types.Root;
+  const specExtension = types.SpecExtension;
+  if (rootType === void 0 || specExtension === void 0) {
+    throw new Error(`Redocly has no Root or SpecExtension type for ${specVersion}`);
+  }
+  const walk = new RefResolutionWalk(resolver, specExtension);
+  let rootFailure;
+  try {
+    walk.walkFrom(document.parsed, document, "#/", rootType);
+  } catch (error) {
+    rootFailure = { status: "rejected", reason: error };
+  }
+  const lookupFailure = await walk.settle();
+  const failure = rootFailure ?? lookupFailure;
+  if (failure !== void 0) {
+    throw failure.reason;
+  }
+}
+
+exports.checkRefsResolve = checkRefsResolve;
+//# sourceMappingURL=ref-resolution-check.cjs.map

package/dist/adapters/redocly-loader/ref-resolution-check.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-resolution-check.cjs","sources":["../../../src/adapters/redocly-loader/ref-resolution-check.ts"],"sourcesContent":["import {\n  type BaseResolver,\n  type Document,\n  detectSpec,\n  getTypes,\n  isRef,\n  normalizeTypes,\n  type Config as RedoclyConfig,\n} from \"@redocly/openapi-core\";\nimport {\n  ANCHOR_REF,\n  escapePointer,\n  hasRef,\n  isExternalValue,\n  isNamedType,\n  joinPointer,\n  nextTick,\n  parseRef,\n  propertyType,\n  REF_CYCLE_MESSAGE,\n  type Ref,\n  type RefStack,\n  type ResolvedRef,\n  UNKNOWN_TYPE,\n  type WalkType,\n} from \"./ref-resolution-steps.js\";\n\n/**\n * Redocly 1.34 resolves `$ref`s with `Promise.all` over the lookups it has started and stops at\n * the first one that fails. Lookups it starts after that (the walk of a document that was still\n * loading) are never awaited: when one of them fails too, its rejection is unhandled, and Node.js\n * ends the process on an unhandled rejection (ADR-031). Redocly 2.x has the same loop.\n *\n * This is a port of Redocly's `resolveDocument` (`lib/resolve.js`, 1.34.22, MIT) that waits for\n * every lookup and then throws the first failure. The loader runs it before Redocly lints or\n * bundles, so Redocly only resolves documents in which no lookup fails. It walks the same nodes\n * with the same types and throws the same errors: the \"Self-referencing circular pointer\" Error,\n * the URIError of a malformed percent escape, and the TypeError of a key such as `valueOf`.\n */\n\n/** One walk of the documents a root reaches, with every `$ref` lookup it starts. */\nclass RefResolutionWalk {\n  readonly #resolver: BaseResolver;\n  /** Redocly's `SpecExtension` type: its values are walked like values of no known type. */\n  readonly specExtension: WalkType;\n  /** Walked nodes per type name; a node walked again with the same type starts the same lookups. */\n  readonly #seenNodes = new Map<string, WeakSet<object>>();\n  readonly #lookups: Promise<void>[] = [];\n\n  constructor(resolver: BaseResolver, specExtension: WalkType) {\n    this.#resolver = resolver;\n    this.specExtension = specExtension;\n  }\n\n  isWalkedLikeUnknown(type: WalkType): boolean {\n    return type === UNKNOWN_TYPE || type === this.specExtension;\n  }\n\n  /** Wait for every lookup, including those started while waiting; return the first failure. */\n  async settle(): Promise<PromiseRejectedResult | undefined> {\n    let settled: PromiseSettledResult<void>[];\n    do {\n      settled = await Promise.allSettled(this.#lookups);\n    } while (settled.length !== this.#lookups.length);\n    return settled.find((result) => result.status === \"rejected\");\n  }\n\n  walkFrom(node: unknown, document: Document, pointer: string, type: WalkType): void {\n    new DocumentWalk(this, document).walk(node, type, document.source.absoluteRef + pointer);\n  }\n\n  /** Whether the node was walked with this type before; marks it walked. */\n  isSeen(type: WalkType, node: object): boolean {\n    let seen = this.#seenNodes.get(type.name);\n    if (seen === undefined) {\n      seen = new WeakSet();\n      this.#seenNodes.set(type.name, seen);\n    }\n    if (seen.has(node)) {\n      return true;\n    }\n    seen.add(node);\n    return false;\n  }\n\n  track(lookup: Promise<ResolvedRef>, type: WalkType): void {\n    this.#lookups.push(\n      lookup.then((resolved) => {\n        if (resolved.resolved && resolved.document !== undefined) {\n          this.walkFrom(resolved.node, resolved.document, resolved.nodePointer ?? \"#/\", type);\n        }\n      }),\n    );\n  }\n\n  async loadDocument(base: Document, uri: string): Promise<Document | undefined> {\n    try {\n      return (await this.#resolver.resolveDocument(base.source.absoluteRef, uri)) as Document;\n    } catch {\n      // Redocly records the failed lookup as an unresolved `$ref`; the lint reports it.\n      return undefined;\n    }\n  }\n}\n\n/** The walk of one document from one node, with the anchors it collects (as in Redocly). */\nclass DocumentWalk {\n  readonly #walk: RefResolutionWalk;\n  readonly #document: Document;\n  readonly #anchors = new Map<string, unknown>();\n\n  constructor(walk: RefResolutionWalk, document: Document) {\n    this.#walk = walk;\n    this.#document = document;\n  }\n\n  walk(node: unknown, type: WalkType, absoluteRef: string): void {\n    if (typeof node !== \"object\" || node === null || this.#walk.isSeen(type, node)) {\n      return;\n    }\n    const anchor = (node as { $anchor?: unknown }).$anchor;\n    if (Object.hasOwn(node, \"$anchor\") && anchor) {\n      this.#anchors.set(`#${String(anchor)}`, node);\n    }\n    if (Array.isArray(node)) {\n      this.#walkItems(node, type, absoluteRef);\n      return;\n    }\n    for (const name of Object.keys(node)) {\n      const value = (node as Record<string, unknown>)[name];\n      const [propType, walked] = propertyType(type, name, value, this.#walk.specExtension);\n      if (isNamedType(propType) && typeof walked === \"object\") {\n        this.walk(walked, propType, joinPointer(absoluteRef, escapePointer(name)));\n      }\n    }\n    if (isRef(node)) {\n      this.#walk.track(this.#follow(this.#document, node, { prev: null, node }), type);\n    }\n    if (isExternalValue(node)) {\n      const ref = { $ref: node.externalValue };\n      this.#walk.track(this.#follow(this.#document, ref, { prev: null, node }), type);\n    }\n  }\n\n  #walkItems(items: readonly unknown[], type: WalkType, absoluteRef: string): void {\n    const itemsType = type.items;\n    if (itemsType === undefined && !this.#walk.isWalkedLikeUnknown(type)) {\n      return;\n    }\n    items.forEach((item, index) => {\n      const pointer = joinPointer(absoluteRef, index);\n      const itemType = typeof itemsType === \"function\" ? itemsType(item, pointer) : itemsType;\n      if (itemType === undefined && !this.#walk.isWalkedLikeUnknown(type)) {\n        return;\n      }\n      this.walk(item, isNamedType(itemType) ? itemType : UNKNOWN_TYPE, pointer);\n    });\n  }\n\n  async #follow(document: Document, ref: Ref, refStack: RefStack): Promise<ResolvedRef> {\n    if (hasRef(refStack.prev, ref)) {\n      throw new Error(REF_CYCLE_MESSAGE);\n    }\n    if (ANCHOR_REF.test(ref.$ref)) {\n      await nextTick();\n      return { resolved: true, node: this.#anchors.get(ref.$ref), document, nodePointer: ref.$ref };\n    }\n    const { uri, pointer } = parseRef(ref.$ref);\n    const targetDocument = uri === null ? document : await this.#walk.loadDocument(document, uri);\n    if (targetDocument === undefined) {\n      return { resolved: false };\n    }\n    const found = await this.#followSegments(targetDocument, pointer, refStack);\n    if (found.document !== undefined && isRef(found.node)) {\n      return this.#follow(found.document, found.node, pushRef(refStack, found.node));\n    }\n    return found;\n  }\n\n  /** Follow the pointer segments; a `$ref` met on the way is resolved first. */\n  async #followSegments(\n    targetDocument: Document,\n    segments: readonly string[],\n    refStack: RefStack,\n  ): Promise<ResolvedRef> {\n    let document = targetDocument;\n    let nodePointer = \"#/\";\n    let target: unknown = targetDocument.parsed;\n    for (const segment of segments) {\n      if (typeof target !== \"object\") {\n        return { resolved: true, node: undefined, document, nodePointer };\n      }\n      // A `null` target throws a TypeError here, as it does in Redocly.\n      const step = (target as Record<string, unknown>)[segment];\n      if (step !== undefined) {\n        target = step;\n      } else if (isRef(target)) {\n        const resolved = await this.#follow(document, target, pushRef(refStack, target));\n        document = resolved.document ?? document;\n        if (typeof resolved.node !== \"object\") {\n          return {\n            resolved: true,\n            node: undefined,\n            document,\n            nodePointer: resolved.nodePointer ?? nodePointer,\n          };\n        }\n        target = (resolved.node as Record<string, unknown>)[segment];\n        nodePointer = resolved.nodePointer ?? nodePointer;\n      } else {\n        return { resolved: true, node: undefined, document, nodePointer };\n      }\n      nodePointer = joinPointer(nodePointer, escapePointer(segment));\n    }\n    return { resolved: true, node: target, document, nodePointer };\n  }\n}\n\nfunction pushRef(head: RefStack, node: unknown): RefStack {\n  return { prev: head, node };\n}\n\n/**\n * Resolve every `$ref` the document reaches, as Redocly's lint and bundle do, and throw the first\n * failure only after all lookups have finished. Documents are loaded through the given resolver,\n * whose cache Redocly then reuses.\n */\nexport async function checkRefsResolve(\n  document: Document,\n  resolver: BaseResolver,\n  styleguide: RedoclyConfig[\"styleguide\"],\n): Promise<void> {\n  const specVersion = detectSpec(document.parsed);\n  const types = normalizeTypes(\n    styleguide.extendTypes(getTypes(specVersion), specVersion),\n    styleguide,\n  );\n  const rootType = types.Root;\n  const specExtension = types.SpecExtension;\n  if (rootType === undefined || specExtension === undefined) {\n    // Redocly gives every spec version both types; a missing one is a Redocly change to port.\n    throw new Error(`Redocly has no Root or SpecExtension type for ${specVersion}`);\n  }\n  const walk = new RefResolutionWalk(resolver, specExtension);\n  let rootFailure: PromiseRejectedResult | undefined;\n  try {\n    walk.walkFrom(document.parsed, document, \"#/\", rootType);\n  } catch (error) {\n    // The walk of the root can fail after it started lookups; they are awaited all the same.\n    rootFailure = { status: \"rejected\", reason: error };\n  }\n  const lookupFailure = await walk.settle();\n  const failure = rootFailure ?? lookupFailure;\n  if (failure !== undefined) {\n    throw failure.reason;\n  }\n}\n"],"names":["UNKNOWN_TYPE","propertyType","isNamedType","joinPointer","escapePointer","isRef","isExternalValue","hasRef","REF_CYCLE_MESSAGE","ANCHOR_REF","nextTick","parseRef","detectSpec","normalizeTypes","getTypes"],"mappings":";;;;;AAyCA,MAAM,iBAAA,CAAkB;AAAA,EACb,SAAA;AAAA;AAAA,EAEA,aAAA;AAAA;AAAA,EAEA,UAAA,uBAAiB,GAAA,EAA6B;AAAA,EAC9C,WAA4B,EAAC;AAAA,EAEtC,WAAA,CAAY,UAAwB,aAAA,EAAyB;AAC3D,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AACjB,IAAA,IAAA,CAAK,aAAA,GAAgB,aAAA;AAAA,EACvB;AAAA,EAEA,oBAAoB,IAAA,EAAyB;AAC3C,IAAA,OAAO,IAAA,KAASA,+BAAA,IAAgB,IAAA,KAAS,IAAA,CAAK,aAAA;AAAA,EAChD;AAAA;AAAA,EAGA,MAAM,MAAA,GAAqD;AACzD,IAAA,IAAI,OAAA;AACJ,IAAA,GAAG;AACD,MAAA,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA,CAAW,IAAA,CAAK,QAAQ,CAAA;AAAA,IAClD,CAAA,QAAS,OAAA,CAAQ,MAAA,KAAW,IAAA,CAAK,QAAA,CAAS,MAAA;AAC1C,IAAA,OAAO,QAAQ,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,WAAW,UAAU,CAAA;AAAA,EAC9D;AAAA,EAEA,QAAA,CAAS,IAAA,EAAe,QAAA,EAAoB,OAAA,EAAiB,IAAA,EAAsB;AACjF,IAAA,IAAI,YAAA,CAAa,IAAA,EAAM,QAAQ,CAAA,CAAE,IAAA,CAAK,MAAM,IAAA,EAAM,QAAA,CAAS,MAAA,CAAO,WAAA,GAAc,OAAO,CAAA;AAAA,EACzF;AAAA;AAAA,EAGA,MAAA,CAAO,MAAgB,IAAA,EAAuB;AAC5C,IAAA,IAAI,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,KAAK,IAAI,CAAA;AACxC,IAAA,IAAI,SAAS,MAAA,EAAW;AACtB,MAAA,IAAA,uBAAW,OAAA,EAAQ;AACnB,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAM,IAAI,CAAA;AAAA,IACrC;AACA,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,EAAG;AAClB,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,IAAI,IAAI,CAAA;AACb,IAAA,OAAO,KAAA;AAAA,EACT;AAAA,EAEA,KAAA,CAAM,QAA8B,IAAA,EAAsB;AACxD,IAAA,IAAA,CAAK,QAAA,CAAS,IAAA;AAAA,MACZ,MAAA,CAAO,IAAA,CAAK,CAAC,QAAA,KAAa;AACxB,QAAA,IAAI,QAAA,CAAS,QAAA,IAAY,QAAA,CAAS,QAAA,KAAa,MAAA,EAAW;AACxD,UAAA,IAAA,CAAK,QAAA,CAAS,SAAS,IAAA,EAAM,QAAA,CAAS,UAAU,QAAA,CAAS,WAAA,IAAe,MAAM,IAAI,CAAA;AAAA,QACpF;AAAA,MACF,CAAC;AAAA,KACH;AAAA,EACF;AAAA,EAEA,MAAM,YAAA,CAAa,IAAA,EAAgB,GAAA,EAA4C;AAC7E,IAAA,IAAI;AACF,MAAA,OAAQ,MAAM,IAAA,CAAK,SAAA,CAAU,gBAAgB,IAAA,CAAK,MAAA,CAAO,aAAa,GAAG,CAAA;AAAA,IAC3E,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AACF;AAGA,MAAM,YAAA,CAAa;AAAA,EACR,KAAA;AAAA,EACA,SAAA;AAAA,EACA,QAAA,uBAAe,GAAA,EAAqB;AAAA,EAE7C,WAAA,CAAY,MAAyB,QAAA,EAAoB;AACvD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA,EAEA,IAAA,CAAK,IAAA,EAAe,IAAA,EAAgB,WAAA,EAA2B;AAC7D,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,IAAQ,KAAK,KAAA,CAAM,MAAA,CAAO,IAAA,EAAM,IAAI,CAAA,EAAG;AAC9E,MAAA;AAAA,IACF;AACA,IAAA,MAAM,SAAU,IAAA,CAA+B,OAAA;AAC/C,IAAA,IAAI,MAAA,CAAO,MAAA,CAAO,IAAA,EAAM,SAAS,KAAK,MAAA,EAAQ;AAC5C,MAAA,IAAA,CAAK,SAAS,GAAA,CAAI,CAAA,CAAA,EAAI,OAAO,MAAM,CAAC,IAAI,IAAI,CAAA;AAAA,IAC9C;AACA,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,MAAA,IAAA,CAAK,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,WAAW,CAAA;AACvC,MAAA;AAAA,IACF;AACA,IAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,IAAA,CAAK,IAAI,CAAA,EAAG;AACpC,MAAA,MAAM,KAAA,GAAS,KAAiC,IAAI,CAAA;AACpD,MAAA,MAAM,CAAC,QAAA,EAAU,MAAM,CAAA,GAAIC,+BAAA,CAAa,MAAM,IAAA,EAAM,KAAA,EAAO,IAAA,CAAK,KAAA,CAAM,aAAa,CAAA;AACnF,MAAA,IAAIC,8BAAA,CAAY,QAAQ,CAAA,IAAK,OAAO,WAAW,QAAA,EAAU;AACvD,QAAA,IAAA,CAAK,IAAA,CAAK,QAAQ,QAAA,EAAUC,8BAAA,CAAY,aAAaC,gCAAA,CAAc,IAAI,CAAC,CAAC,CAAA;AAAA,MAC3E;AAAA,IACF;AACA,IAAA,IAAIC,iBAAA,CAAM,IAAI,CAAA,EAAG;AACf,MAAA,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAW,IAAA,EAAM,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,IACjF;AACA,IAAA,IAAIC,kCAAA,CAAgB,IAAI,CAAA,EAAG;AACzB,MAAA,MAAM,GAAA,GAAM,EAAE,IAAA,EAAM,IAAA,CAAK,aAAA,EAAc;AACvC,MAAA,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,SAAA,EAAW,GAAA,EAAK,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,GAAG,IAAI,CAAA;AAAA,IAChF;AAAA,EACF;AAAA,EAEA,UAAA,CAAW,KAAA,EAA2B,IAAA,EAAgB,WAAA,EAA2B;AAC/E,IAAA,MAAM,YAAY,IAAA,CAAK,KAAA;AACvB,IAAA,IAAI,cAAc,MAAA,IAAa,CAAC,KAAK,KAAA,CAAM,mBAAA,CAAoB,IAAI,CAAA,EAAG;AACpE,MAAA;AAAA,IACF;AACA,IAAA,KAAA,CAAM,OAAA,CAAQ,CAAC,IAAA,EAAM,KAAA,KAAU;AAC7B,MAAA,MAAM,OAAA,GAAUH,8BAAA,CAAY,WAAA,EAAa,KAAK,CAAA;AAC9C,MAAA,MAAM,WAAW,OAAO,SAAA,KAAc,aAAa,SAAA,CAAU,IAAA,EAAM,OAAO,CAAA,GAAI,SAAA;AAC9E,MAAA,IAAI,aAAa,MAAA,IAAa,CAAC,KAAK,KAAA,CAAM,mBAAA,CAAoB,IAAI,CAAA,EAAG;AACnE,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,KAAK,IAAA,EAAMD,8BAAA,CAAY,QAAQ,CAAA,GAAI,QAAA,GAAWF,iCAAc,OAAO,CAAA;AAAA,IAC1E,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,OAAA,CAAQ,QAAA,EAAoB,GAAA,EAAU,QAAA,EAA0C;AACpF,IAAA,IAAIO,yBAAA,CAAO,QAAA,CAAS,IAAA,EAAM,GAAG,CAAA,EAAG;AAC9B,MAAA,MAAM,IAAI,MAAMC,oCAAiB,CAAA;AAAA,IACnC;AACA,IAAA,IAAIC,6BAAA,CAAW,IAAA,CAAK,GAAA,CAAI,IAAI,CAAA,EAAG;AAC7B,MAAA,MAAMC,2BAAA,EAAS;AACf,MAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,GAAA,CAAI,IAAI,CAAA,EAAG,QAAA,EAAU,WAAA,EAAa,IAAI,IAAA,EAAK;AAAA,IAC9F;AACA,IAAA,MAAM,EAAE,GAAA,EAAK,OAAA,EAAQ,GAAIC,2BAAA,CAAS,IAAI,IAAI,CAAA;AAC1C,IAAA,MAAM,cAAA,GAAiB,QAAQ,IAAA,GAAO,QAAA,GAAW,MAAM,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,QAAA,EAAU,GAAG,CAAA;AAC5F,IAAA,IAAI,mBAAmB,MAAA,EAAW;AAChC,MAAA,OAAO,EAAE,UAAU,KAAA,EAAM;AAAA,IAC3B;AACA,IAAA,MAAM,QAAQ,MAAM,IAAA,CAAK,eAAA,CAAgB,cAAA,EAAgB,SAAS,QAAQ,CAAA;AAC1E,IAAA,IAAI,MAAM,QAAA,KAAa,MAAA,IAAaN,iBAAA,CAAM,KAAA,CAAM,IAAI,CAAA,EAAG;AACrD,MAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,KAAA,CAAM,QAAA,EAAU,KAAA,CAAM,MAAM,OAAA,CAAQ,QAAA,EAAU,KAAA,CAAM,IAAI,CAAC,CAAA;AAAA,IAC/E;AACA,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,eAAA,CACJ,cAAA,EACA,QAAA,EACA,QAAA,EACsB;AACtB,IAAA,IAAI,QAAA,GAAW,cAAA;AACf,IAAA,IAAI,WAAA,GAAc,IAAA;AAClB,IAAA,IAAI,SAAkB,cAAA,CAAe,MAAA;AACrC,IAAA,KAAA,MAAW,WAAW,QAAA,EAAU;AAC9B,MAAA,IAAI,OAAO,WAAW,QAAA,EAAU;AAC9B,QAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,MAAA,EAAW,UAAU,WAAA,EAAY;AAAA,MAClE;AAEA,MAAA,MAAM,IAAA,GAAQ,OAAmC,OAAO,CAAA;AACxD,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,MAAA,GAAS,IAAA;AAAA,MACX,CAAA,MAAA,IAAWA,iBAAA,CAAM,MAAM,CAAA,EAAG;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,OAAA,CAAQ,UAAU,MAAA,EAAQ,OAAA,CAAQ,QAAA,EAAU,MAAM,CAAC,CAAA;AAC/E,QAAA,QAAA,GAAW,SAAS,QAAA,IAAY,QAAA;AAChC,QAAA,IAAI,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,EAAU;AACrC,UAAA,OAAO;AAAA,YACL,QAAA,EAAU,IAAA;AAAA,YACV,IAAA,EAAM,MAAA;AAAA,YACN,QAAA;AAAA,YACA,WAAA,EAAa,SAAS,WAAA,IAAe;AAAA,WACvC;AAAA,QACF;AACA,QAAA,MAAA,GAAU,QAAA,CAAS,KAAiC,OAAO,CAAA;AAC3D,QAAA,WAAA,GAAc,SAAS,WAAA,IAAe,WAAA;AAAA,MACxC,CAAA,MAAO;AACL,QAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,MAAA,EAAW,UAAU,WAAA,EAAY;AAAA,MAClE;AACA,MAAA,WAAA,GAAcF,8BAAA,CAAY,WAAA,EAAaC,gCAAA,CAAc,OAAO,CAAC,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,UAAU,WAAA,EAAY;AAAA,EAC/D;AACF;AAEA,SAAS,OAAA,CAAQ,MAAgB,IAAA,EAAyB;AACxD,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,IAAA,EAAK;AAC5B;AAOA,eAAsB,gBAAA,CACpB,QAAA,EACA,QAAA,EACA,UAAA,EACe;AACf,EAAA,MAAM,WAAA,GAAcQ,sBAAA,CAAW,QAAA,CAAS,MAAM,CAAA;AAC9C,EAAA,MAAM,KAAA,GAAQC,0BAAA;AAAA,IACZ,UAAA,CAAW,WAAA,CAAYC,oBAAA,CAAS,WAAW,GAAG,WAAW,CAAA;AAAA,IACzD;AAAA,GACF;AACA,EAAA,MAAM,WAAW,KAAA,CAAM,IAAA;AACvB,EAAA,MAAM,gBAAgB,KAAA,CAAM,aAAA;AAC5B,EAAA,IAAI,QAAA,KAAa,MAAA,IAAa,aAAA,KAAkB,MAAA,EAAW;AAEzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,8CAAA,EAAiD,WAAW,CAAA,CAAE,CAAA;AAAA,EAChF;AACA,EAAA,MAAM,IAAA,GAAO,IAAI,iBAAA,CAAkB,QAAA,EAAU,aAAa,CAAA;AAC1D,EAAA,IAAI,WAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,CAAK,QAAA,CAAS,QAAA,CAAS,MAAA,EAAQ,QAAA,EAAU,MAAM,QAAQ,CAAA;AAAA,EACzD,SAAS,KAAA,EAAO;AAEd,IAAA,WAAA,GAAc,EAAE,MAAA,EAAQ,UAAA,EAAY,MAAA,EAAQ,KAAA,EAAM;AAAA,EACpD;AACA,EAAA,MAAM,aAAA,GAAgB,MAAM,IAAA,CAAK,MAAA,EAAO;AACxC,EAAA,MAAM,UAAU,WAAA,IAAe,aAAA;AAC/B,EAAA,IAAI,YAAY,MAAA,EAAW;AACzB,IAAA,MAAM,OAAA,CAAQ,MAAA;AAAA,EAChB;AACF;;"}