openapi-typesafe 1.0.0-rc.3 → 1.0.0-rc.4

package/dist/adapters/redocly-loader/remote-body-limit.cjs

@@ -0,0 +1,50 @@
+'use strict';
+
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+class RemoteBodyLimit {
+  #limits;
+  #totalBytes = 0;
+  constructor(limits) {
+    this.#limits = limits;
+  }
+  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */
+  async read(response, url) {
+    const reader = response.body?.getReader();
+    if (reader === void 0) {
+      return new ArrayBuffer(0);
+    }
+    const chunks = [];
+    let documentBytes = 0;
+    for (let next = await reader.read(); !next.done; next = await reader.read()) {
+      documentBytes += next.value.byteLength;
+      this.#totalBytes += next.value.byteLength;
+      const refusal = this.#refusal(url, documentBytes);
+      if (refusal !== void 0) {
+        await reader.cancel();
+        throw refusal;
+      }
+      chunks.push(next.value);
+    }
+    return joined(chunks, documentBytes);
+  }
+  #refusal(url, documentBytes) {
+    const { maxDocumentBytes, maxTotalBytes } = this.#limits;
+    if (documentBytes > maxDocumentBytes) {
+      return schemaLoadErrors.refForbiddenError(url, { reason: "remote-document-too-large", maxDocumentBytes });
+    }
+    return this.#totalBytes > maxTotalBytes ? schemaLoadErrors.refForbiddenError(url, { reason: "remote-documents-too-large", maxTotalBytes }) : void 0;
+  }
+}
+function joined(chunks, byteLength) {
+  const body = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body.buffer;
+}
+
+exports.RemoteBodyLimit = RemoteBodyLimit;
+//# sourceMappingURL=remote-body-limit.cjs.map

package/dist/adapters/redocly-loader/remote-body-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-body-limit.cjs","sources":["../../../src/adapters/redocly-loader/remote-body-limit.ts"],"sourcesContent":["import type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** The decoded size limits of the remote documents of one load (threat model T2). */\nexport interface RemoteBodyLimits {\n  /** Bytes of one remote document's body after `Content-Encoding` is decoded. */\n  readonly maxDocumentBytes: number;\n  /** Bytes of the bodies of every remote document of one load together, decoded. */\n  readonly maxTotalBytes: number;\n}\n\n/**\n * Reads remote bodies as a stream and stops at the limits. Fetch decodes `gzip`, `deflate` and\n * `br` before the body reaches the loader, so a body of a few megabytes on the wire can become\n * gigabytes in memory (a \"gzip bomb\"); counting the decoded bytes while they arrive stops it before\n * the memory is taken. One instance per load: the total covers every document of that load.\n */\nexport class RemoteBodyLimit {\n  readonly #limits: RemoteBodyLimits;\n  #totalBytes = 0;\n\n  constructor(limits: RemoteBodyLimits) {\n    this.#limits = limits;\n  }\n\n  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */\n  async read(response: Response, url: string): Promise<ArrayBuffer> {\n    const reader = response.body?.getReader();\n    if (reader === undefined) {\n      return new ArrayBuffer(0);\n    }\n    const chunks: Uint8Array[] = [];\n    let documentBytes = 0;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      documentBytes += next.value.byteLength;\n      this.#totalBytes += next.value.byteLength;\n      const refusal = this.#refusal(url, documentBytes);\n      if (refusal !== undefined) {\n        await reader.cancel();\n        throw refusal;\n      }\n      chunks.push(next.value);\n    }\n    return joined(chunks, documentBytes);\n  }\n\n  #refusal(url: string, documentBytes: number): OpenAPITypesafeError | undefined {\n    const { maxDocumentBytes, maxTotalBytes } = this.#limits;\n    if (documentBytes > maxDocumentBytes) {\n      return refForbiddenError(url, { reason: \"remote-document-too-large\", maxDocumentBytes });\n    }\n    return this.#totalBytes > maxTotalBytes\n      ? refForbiddenError(url, { reason: \"remote-documents-too-large\", maxTotalBytes })\n      : undefined;\n  }\n}\n\nfunction joined(chunks: readonly Uint8Array[], byteLength: number): ArrayBuffer {\n  const body = new Uint8Array(byteLength);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body.buffer;\n}\n"],"names":["refForbiddenError"],"mappings":";;;;AAiBO,MAAM,eAAA,CAAgB;AAAA,EAClB,OAAA;AAAA,EACT,WAAA,GAAc,CAAA;AAAA,EAEd,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,IAAA,CAAK,QAAA,EAAoB,GAAA,EAAmC;AAChE,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,IAAI,YAAY,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG;AAC3E,MAAA,aAAA,IAAiB,KAAK,KAAA,CAAM,UAAA;AAC5B,MAAA,IAAA,CAAK,WAAA,IAAe,KAAK,KAAA,CAAM,UAAA;AAC/B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,aAAa,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,OAAA;AAAA,MACR;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,MAAA,CAAO,QAAQ,aAAa,CAAA;AAAA,EACrC;AAAA,EAEA,QAAA,CAAS,KAAa,aAAA,EAAyD;AAC7E,IAAA,MAAM,EAAE,gBAAA,EAAkB,aAAA,EAAc,GAAI,IAAA,CAAK,OAAA;AACjD,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAOA,mCAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,2BAAA,EAA6B,kBAAkB,CAAA;AAAA,IACzF;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,GAAc,aAAA,GACtBA,kCAAA,CAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAA,EAAe,CAAA,GAC9E,MAAA;AAAA,EACN;AACF;AAEA,SAAS,MAAA,CAAO,QAA+B,UAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,UAAU,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAO,MAAM,CAAA;AACtB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;"}

package/dist/adapters/redocly-loader/remote-body-limit.mjs

@@ -0,0 +1,48 @@
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+class RemoteBodyLimit {
+  #limits;
+  #totalBytes = 0;
+  constructor(limits) {
+    this.#limits = limits;
+  }
+  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */
+  async read(response, url) {
+    const reader = response.body?.getReader();
+    if (reader === void 0) {
+      return new ArrayBuffer(0);
+    }
+    const chunks = [];
+    let documentBytes = 0;
+    for (let next = await reader.read(); !next.done; next = await reader.read()) {
+      documentBytes += next.value.byteLength;
+      this.#totalBytes += next.value.byteLength;
+      const refusal = this.#refusal(url, documentBytes);
+      if (refusal !== void 0) {
+        await reader.cancel();
+        throw refusal;
+      }
+      chunks.push(next.value);
+    }
+    return joined(chunks, documentBytes);
+  }
+  #refusal(url, documentBytes) {
+    const { maxDocumentBytes, maxTotalBytes } = this.#limits;
+    if (documentBytes > maxDocumentBytes) {
+      return refForbiddenError(url, { reason: "remote-document-too-large", maxDocumentBytes });
+    }
+    return this.#totalBytes > maxTotalBytes ? refForbiddenError(url, { reason: "remote-documents-too-large", maxTotalBytes }) : void 0;
+  }
+}
+function joined(chunks, byteLength) {
+  const body = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body.buffer;
+}
+
+export { RemoteBodyLimit };
+//# sourceMappingURL=remote-body-limit.mjs.map

package/dist/adapters/redocly-loader/remote-body-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-body-limit.mjs","sources":["../../../src/adapters/redocly-loader/remote-body-limit.ts"],"sourcesContent":["import type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** The decoded size limits of the remote documents of one load (threat model T2). */\nexport interface RemoteBodyLimits {\n  /** Bytes of one remote document's body after `Content-Encoding` is decoded. */\n  readonly maxDocumentBytes: number;\n  /** Bytes of the bodies of every remote document of one load together, decoded. */\n  readonly maxTotalBytes: number;\n}\n\n/**\n * Reads remote bodies as a stream and stops at the limits. Fetch decodes `gzip`, `deflate` and\n * `br` before the body reaches the loader, so a body of a few megabytes on the wire can become\n * gigabytes in memory (a \"gzip bomb\"); counting the decoded bytes while they arrive stops it before\n * the memory is taken. One instance per load: the total covers every document of that load.\n */\nexport class RemoteBodyLimit {\n  readonly #limits: RemoteBodyLimits;\n  #totalBytes = 0;\n\n  constructor(limits: RemoteBodyLimits) {\n    this.#limits = limits;\n  }\n\n  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */\n  async read(response: Response, url: string): Promise<ArrayBuffer> {\n    const reader = response.body?.getReader();\n    if (reader === undefined) {\n      return new ArrayBuffer(0);\n    }\n    const chunks: Uint8Array[] = [];\n    let documentBytes = 0;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      documentBytes += next.value.byteLength;\n      this.#totalBytes += next.value.byteLength;\n      const refusal = this.#refusal(url, documentBytes);\n      if (refusal !== undefined) {\n        await reader.cancel();\n        throw refusal;\n      }\n      chunks.push(next.value);\n    }\n    return joined(chunks, documentBytes);\n  }\n\n  #refusal(url: string, documentBytes: number): OpenAPITypesafeError | undefined {\n    const { maxDocumentBytes, maxTotalBytes } = this.#limits;\n    if (documentBytes > maxDocumentBytes) {\n      return refForbiddenError(url, { reason: \"remote-document-too-large\", maxDocumentBytes });\n    }\n    return this.#totalBytes > maxTotalBytes\n      ? refForbiddenError(url, { reason: \"remote-documents-too-large\", maxTotalBytes })\n      : undefined;\n  }\n}\n\nfunction joined(chunks: readonly Uint8Array[], byteLength: number): ArrayBuffer {\n  const body = new Uint8Array(byteLength);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body.buffer;\n}\n"],"names":[],"mappings":";;AAiBO,MAAM,eAAA,CAAgB;AAAA,EAClB,OAAA;AAAA,EACT,WAAA,GAAc,CAAA;AAAA,EAEd,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,IAAA,CAAK,QAAA,EAAoB,GAAA,EAAmC;AAChE,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,IAAI,YAAY,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG;AAC3E,MAAA,aAAA,IAAiB,KAAK,KAAA,CAAM,UAAA;AAC5B,MAAA,IAAA,CAAK,WAAA,IAAe,KAAK,KAAA,CAAM,UAAA;AAC/B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,aAAa,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,OAAA;AAAA,MACR;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,MAAA,CAAO,QAAQ,aAAa,CAAA;AAAA,EACrC;AAAA,EAEA,QAAA,CAAS,KAAa,aAAA,EAAyD;AAC7E,IAAA,MAAM,EAAE,gBAAA,EAAkB,aAAA,EAAc,GAAI,IAAA,CAAK,OAAA;AACjD,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAO,kBAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,2BAAA,EAA6B,kBAAkB,CAAA;AAAA,IACzF;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,GAAc,aAAA,GACtB,iBAAA,CAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAA,EAAe,CAAA,GAC9E,MAAA;AAAA,EACN;AACF;AAEA,SAAS,MAAA,CAAO,QAA+B,UAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,UAAU,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAO,MAAM,CAAA;AACtB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;"}

package/dist/adapters/redocly-loader/remote-fetch.cjs

@@ -2,13 +2,14 @@
 
 const allowedHosts = require('./allowed-hosts.cjs');
 const configuredHeaders = require('./configured-headers.cjs');
+const remoteBodyLimit = require('./remote-body-limit.cjs');
 const schemaLoadErrors = require('./schema-load-errors.cjs');
 
 const MAX_REDIRECTS = 20;
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
-async function bufferedResponse(response) {
-  const body = await response.arrayBuffer();
+async function bufferedResponse(response, url, bodyLimit) {
+  const body = await bodyLimit.read(response, url);
   const { status, statusText, headers } = response;
   return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
     status,
@@ -16,17 +17,44 @@ async function bufferedResponse(response) {
     headers
   });
 }
-function fetchWithTimeout(timeoutMs) {
+const CLOSED_CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "UND_ERR_SOCKET"
+]);
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const DEFAULT_METHOD = "GET";
+function isClosedConnection(error) {
+  const cause = error instanceof TypeError ? error.cause : void 0;
+  const code = cause instanceof Error && "code" in cause ? cause.code : void 0;
+  return typeof code === "string" && CLOSED_CONNECTION_CODES.has(code);
+}
+async function fetchOnOpenConnection(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();
+    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {
+      throw error;
+    }
+    return fetch(input, init);
+  }
+}
+function fetchWithTimeout(timeoutMs, bodyLimit) {
   return async (input, init = {}) => {
     try {
-      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-      return await bufferedResponse(response);
+      const signal = AbortSignal.timeout(timeoutMs);
+      const response = await fetchOnOpenConnection(input, { ...init, signal });
+      return await bufferedResponse(response, input, bodyLimit);
     } catch (cause) {
       const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
       throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
     }
   };
 }
+function fetchWithBodyLimit(fetchImpl, bodyLimit) {
+  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
     let url = new URL(input);
@@ -71,7 +99,8 @@ function fetchWithConcurrencyLimit(fetchImpl, limit) {
 }
 function resolveConfigWithAccess(resolve, options) {
   const configured = resolve.http.customFetch;
-  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const bodyLimit = new remoteBodyLimit.RemoteBodyLimit(options.bodyLimits);
+  const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
     hosts: options.access.remoteHosts

package/dist/adapters/redocly-loader/remote-fetch.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, the host limit and the configured headers\n * checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor"],"mappings":";;;;;;AAoBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAcO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAeO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;"}
+{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor","RemoteBodyLimit"],"mappings":";;;;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAiBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAIC,+BAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;"}

package/dist/adapters/redocly-loader/remote-fetch.mjs

@@ -1,12 +1,13 @@
 import { isHostAllowed } from './allowed-hosts.mjs';
 import { headersFor } from './configured-headers.mjs';
+import { RemoteBodyLimit } from './remote-body-limit.mjs';
 import { refForbiddenError } from './schema-load-errors.mjs';
 
 const MAX_REDIRECTS = 20;
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
-async function bufferedResponse(response) {
-  const body = await response.arrayBuffer();
+async function bufferedResponse(response, url, bodyLimit) {
+  const body = await bodyLimit.read(response, url);
   const { status, statusText, headers } = response;
   return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
     status,
@@ -14,17 +15,44 @@ async function bufferedResponse(response) {
     headers
   });
 }
-function fetchWithTimeout(timeoutMs) {
+const CLOSED_CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "UND_ERR_SOCKET"
+]);
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const DEFAULT_METHOD = "GET";
+function isClosedConnection(error) {
+  const cause = error instanceof TypeError ? error.cause : void 0;
+  const code = cause instanceof Error && "code" in cause ? cause.code : void 0;
+  return typeof code === "string" && CLOSED_CONNECTION_CODES.has(code);
+}
+async function fetchOnOpenConnection(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();
+    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {
+      throw error;
+    }
+    return fetch(input, init);
+  }
+}
+function fetchWithTimeout(timeoutMs, bodyLimit) {
   return async (input, init = {}) => {
     try {
-      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-      return await bufferedResponse(response);
+      const signal = AbortSignal.timeout(timeoutMs);
+      const response = await fetchOnOpenConnection(input, { ...init, signal });
+      return await bufferedResponse(response, input, bodyLimit);
     } catch (cause) {
       const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
       throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
     }
   };
 }
+function fetchWithBodyLimit(fetchImpl, bodyLimit) {
+  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
     let url = new URL(input);
@@ -69,7 +97,8 @@ function fetchWithConcurrencyLimit(fetchImpl, limit) {
 }
 function resolveConfigWithAccess(resolve, options) {
   const configured = resolve.http.customFetch;
-  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);
+  const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
     hosts: options.access.remoteHosts

package/dist/adapters/redocly-loader/remote-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-fetch.mjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, the host limit and the configured headers\n * checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":[],"mappings":";;;;AAoBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAAC,aAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAM,iBAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAcO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAeO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;"}
+{"version":3,"file":"remote-fetch.mjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":[],"mappings":";;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAAC,aAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAM,iBAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAiBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAI,eAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;"}

package/dist/adapters/redocly-loader/remote-node-limit.cjs

@@ -0,0 +1,47 @@
+'use strict';
+
+const openapiCore = require('@redocly/openapi-core');
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+const PARSED_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".yml", ".yaml"]);
+const PARSED_MIME_TYPE = /(json|yaml|openapi)/;
+function isParsedSource(source, isRoot) {
+  const { absoluteRef, mimeType } = source;
+  const extension = absoluteRef.slice(absoluteRef.lastIndexOf("."));
+  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType ?? "");
+}
+const NODE_OPENED = "open";
+class RemoteNodeLimit {
+  #maxNodes;
+  #nodes = 0;
+  constructor(maxNodes) {
+    this.#maxNodes = maxNodes;
+  }
+  /**
+   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`
+   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.
+   */
+  parse(source) {
+    const listener = (event) => {
+      if (event !== NODE_OPENED) {
+        return;
+      }
+      this.#nodes += 1;
+      const refusal = this.#refusal(source.absoluteRef);
+      if (refusal !== void 0) {
+        throw refusal;
+      }
+    };
+    return { source, parsed: openapiCore.parseYaml(source.body, { filename: source.absoluteRef, listener }) };
+  }
+  #refusal(url) {
+    return this.#nodes > this.#maxNodes ? schemaLoadErrors.refForbiddenError(url, {
+      reason: "remote-documents-too-many-nodes",
+      maxNodes: this.#maxNodes
+    }) : void 0;
+  }
+}
+
+exports.RemoteNodeLimit = RemoteNodeLimit;
+exports.isParsedSource = isParsedSource;
+//# sourceMappingURL=remote-node-limit.cjs.map

package/dist/adapters/redocly-loader/remote-node-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-node-limit.cjs","sources":["../../../src/adapters/redocly-loader/remote-node-limit.ts"],"sourcesContent":["import { type Document, parseYaml, type Source } from \"@redocly/openapi-core\";\nimport type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Bounds the parsed size of the remote documents of one load (threat model T2). The byte limits\n * do not bound memory: parsing multiplies it by the density of the text, and 250 MiB of `{},`\n * (87 million empty objects, under a quarter of a megabyte as gzip) took the process past its\n * 4 GB heap. The parser reports every node it builds, keys included, and the parse stops when\n * the nodes of all remote documents of the load pass the limit, before their memory is taken.\n */\n\n/** The extensions that Redocly 1.34's `BaseResolver.parseDocument` parses as YAML or JSON. */\nconst PARSED_EXTENSIONS: ReadonlySet<string> = new Set([\".json\", \".yml\", \".yaml\"]);\nconst PARSED_MIME_TYPE = /(json|yaml|openapi)/;\n\n/** Whether Redocly parses this source, or keeps its text: the same rule as its own resolver. */\nexport function isParsedSource(source: Source, isRoot: boolean): boolean {\n  const { absoluteRef, mimeType } = source;\n  const extension = absoluteRef.slice(absoluteRef.lastIndexOf(\".\"));\n  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType ?? \"\");\n}\n\n/** The parser's event for a node it starts to build. */\nconst NODE_OPENED = \"open\";\n\n/** One instance per load: the count covers every remote document of that load. */\nexport class RemoteNodeLimit {\n  readonly #maxNodes: number;\n  #nodes = 0;\n\n  constructor(maxNodes: number) {\n    this.#maxNodes = maxNodes;\n  }\n\n  /**\n   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`\n   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.\n   */\n  parse(source: Source): Document {\n    const listener = (event: string): void => {\n      if (event !== NODE_OPENED) {\n        return;\n      }\n      this.#nodes += 1;\n      const refusal = this.#refusal(source.absoluteRef);\n      if (refusal !== undefined) {\n        throw refusal;\n      }\n    };\n    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };\n  }\n\n  #refusal(url: string): OpenAPITypesafeError | undefined {\n    return this.#nodes > this.#maxNodes\n      ? refForbiddenError(url, {\n          reason: \"remote-documents-too-many-nodes\",\n          maxNodes: this.#maxNodes,\n        })\n      : undefined;\n  }\n}\n"],"names":["parseYaml","refForbiddenError"],"mappings":";;;;;AAaA,MAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,qBAAA;AAGlB,SAAS,cAAA,CAAe,QAAgB,MAAA,EAA0B;AACvE,EAAA,MAAM,EAAE,WAAA,EAAa,QAAA,EAAS,GAAI,MAAA;AAClC,EAAA,MAAM,YAAY,WAAA,CAAY,KAAA,CAAM,WAAA,CAAY,WAAA,CAAY,GAAG,CAAC,CAAA;AAChE,EAAA,OAAO,MAAA,IAAU,kBAAkB,GAAA,CAAI,SAAS,KAAK,gBAAA,CAAiB,IAAA,CAAK,YAAY,EAAE,CAAA;AAC3F;AAGA,MAAM,WAAA,GAAc,MAAA;AAGb,MAAM,eAAA,CAAgB;AAAA,EAClB,SAAA;AAAA,EACT,MAAA,GAAS,CAAA;AAAA,EAET,YAAY,QAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,EAA0B;AAC9B,IAAA,MAAM,QAAA,GAAW,CAAC,KAAA,KAAwB;AACxC,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,MAAA,IAAU,CAAA;AACf,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQA,qBAAA,CAAU,MAAA,CAAO,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,QAAA,EAAU,CAAA,EAAE;AAAA,EAC9F;AAAA,EAEA,SAAS,GAAA,EAA+C;AACtD,IAAA,OAAO,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,SAAA,GACtBC,mCAAkB,GAAA,EAAK;AAAA,MACrB,MAAA,EAAQ,iCAAA;AAAA,MACR,UAAU,IAAA,CAAK;AAAA,KAChB,CAAA,GACD,MAAA;AAAA,EACN;AACF;;;"}

package/dist/adapters/redocly-loader/remote-node-limit.mjs

@@ -0,0 +1,44 @@
+import { parseYaml } from '@redocly/openapi-core';
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+const PARSED_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".yml", ".yaml"]);
+const PARSED_MIME_TYPE = /(json|yaml|openapi)/;
+function isParsedSource(source, isRoot) {
+  const { absoluteRef, mimeType } = source;
+  const extension = absoluteRef.slice(absoluteRef.lastIndexOf("."));
+  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType ?? "");
+}
+const NODE_OPENED = "open";
+class RemoteNodeLimit {
+  #maxNodes;
+  #nodes = 0;
+  constructor(maxNodes) {
+    this.#maxNodes = maxNodes;
+  }
+  /**
+   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`
+   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.
+   */
+  parse(source) {
+    const listener = (event) => {
+      if (event !== NODE_OPENED) {
+        return;
+      }
+      this.#nodes += 1;
+      const refusal = this.#refusal(source.absoluteRef);
+      if (refusal !== void 0) {
+        throw refusal;
+      }
+    };
+    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };
+  }
+  #refusal(url) {
+    return this.#nodes > this.#maxNodes ? refForbiddenError(url, {
+      reason: "remote-documents-too-many-nodes",
+      maxNodes: this.#maxNodes
+    }) : void 0;
+  }
+}
+
+export { RemoteNodeLimit, isParsedSource };
+//# sourceMappingURL=remote-node-limit.mjs.map

package/dist/adapters/redocly-loader/remote-node-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-node-limit.mjs","sources":["../../../src/adapters/redocly-loader/remote-node-limit.ts"],"sourcesContent":["import { type Document, parseYaml, type Source } from \"@redocly/openapi-core\";\nimport type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Bounds the parsed size of the remote documents of one load (threat model T2). The byte limits\n * do not bound memory: parsing multiplies it by the density of the text, and 250 MiB of `{},`\n * (87 million empty objects, under a quarter of a megabyte as gzip) took the process past its\n * 4 GB heap. The parser reports every node it builds, keys included, and the parse stops when\n * the nodes of all remote documents of the load pass the limit, before their memory is taken.\n */\n\n/** The extensions that Redocly 1.34's `BaseResolver.parseDocument` parses as YAML or JSON. */\nconst PARSED_EXTENSIONS: ReadonlySet<string> = new Set([\".json\", \".yml\", \".yaml\"]);\nconst PARSED_MIME_TYPE = /(json|yaml|openapi)/;\n\n/** Whether Redocly parses this source, or keeps its text: the same rule as its own resolver. */\nexport function isParsedSource(source: Source, isRoot: boolean): boolean {\n  const { absoluteRef, mimeType } = source;\n  const extension = absoluteRef.slice(absoluteRef.lastIndexOf(\".\"));\n  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType ?? \"\");\n}\n\n/** The parser's event for a node it starts to build. */\nconst NODE_OPENED = \"open\";\n\n/** One instance per load: the count covers every remote document of that load. */\nexport class RemoteNodeLimit {\n  readonly #maxNodes: number;\n  #nodes = 0;\n\n  constructor(maxNodes: number) {\n    this.#maxNodes = maxNodes;\n  }\n\n  /**\n   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`\n   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.\n   */\n  parse(source: Source): Document {\n    const listener = (event: string): void => {\n      if (event !== NODE_OPENED) {\n        return;\n      }\n      this.#nodes += 1;\n      const refusal = this.#refusal(source.absoluteRef);\n      if (refusal !== undefined) {\n        throw refusal;\n      }\n    };\n    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };\n  }\n\n  #refusal(url: string): OpenAPITypesafeError | undefined {\n    return this.#nodes > this.#maxNodes\n      ? refForbiddenError(url, {\n          reason: \"remote-documents-too-many-nodes\",\n          maxNodes: this.#maxNodes,\n        })\n      : undefined;\n  }\n}\n"],"names":[],"mappings":";;;AAaA,MAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,qBAAA;AAGlB,SAAS,cAAA,CAAe,QAAgB,MAAA,EAA0B;AACvE,EAAA,MAAM,EAAE,WAAA,EAAa,QAAA,EAAS,GAAI,MAAA;AAClC,EAAA,MAAM,YAAY,WAAA,CAAY,KAAA,CAAM,WAAA,CAAY,WAAA,CAAY,GAAG,CAAC,CAAA;AAChE,EAAA,OAAO,MAAA,IAAU,kBAAkB,GAAA,CAAI,SAAS,KAAK,gBAAA,CAAiB,IAAA,CAAK,YAAY,EAAE,CAAA;AAC3F;AAGA,MAAM,WAAA,GAAc,MAAA;AAGb,MAAM,eAAA,CAAgB;AAAA,EAClB,SAAA;AAAA,EACT,MAAA,GAAS,CAAA;AAAA,EAET,YAAY,QAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,EAA0B;AAC9B,IAAA,MAAM,QAAA,GAAW,CAAC,KAAA,KAAwB;AACxC,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,MAAA,IAAU,CAAA;AACf,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,QAAA,EAAU,CAAA,EAAE;AAAA,EAC9F;AAAA,EAEA,SAAS,GAAA,EAA+C;AACtD,IAAA,OAAO,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,SAAA,GACtB,kBAAkB,GAAA,EAAK;AAAA,MACrB,MAAA,EAAQ,iCAAA;AAAA,MACR,UAAU,IAAA,CAAK;AAAA,KAChB,CAAA,GACD,MAAA;AAAA,EACN;AACF;;"}

package/dist/adapters/redocly-loader/schema-load-errors.cjs

@@ -2,7 +2,7 @@
 
 const assertNever = require('../../domain/assert-never.cjs');
 const errors = require('../../domain/errors.cjs');
-const urlCredentials = require('../../domain/url-credentials.cjs');
+const urlSecrets = require('../../domain/url-secrets.cjs');
 
 function sourceEmptyError(message) {
   return new errors.OpenAPITypesafeError({ code: errors.ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });
@@ -15,23 +15,32 @@ function sourceInvalidError(source) {
     details: { received }
   });
 }
+function urlInvalidError(text) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
+    message: `The string ${urlSecrets.redactUnparsedUrl(text)} starts like a URL but is not a valid URL`,
+    details: { reason: "url", received: "string" }
+  });
+}
 function causeMessage(cause) {
   return cause instanceof Error ? cause.message : String(cause);
 }
 const SOURCE_TEXT_IN_MESSAGE = 200;
-function pathStringError(text) {
+const LOAD_FILE_ADVICE = "To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.";
+function pathStringError(text, origin) {
   const shown = text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}\u2026` : text;
+  const message = origin === "string" ? `The string "${shown}" was parsed as YAML text, not loaded as a file. ${LOAD_FILE_ADVICE}` : `The stream held only the YAML string "${shown}", not an OpenAPI document. ` + LOAD_FILE_ADVICE;
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
-    message: `The string "${shown}" was parsed as YAML text, not loaded as a file. To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.`,
-    details: { reason: "path", received: "string" }
+    message,
+    details: { reason: "path", received: origin, text: shown }
   });
 }
 function loadFailedError(absoluteRef, cause) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_LOAD_FAILED,
     message: causeMessage(cause),
-    details: { source: urlCredentials.redactUrlCredentials(absoluteRef) },
+    details: { source: urlSecrets.redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -39,7 +48,7 @@ function parseFailedError(format, absoluteRef, cause) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_PARSE_FAILED,
     message: causeMessage(cause),
-    details: { format, source: urlCredentials.redactUrlCredentials(absoluteRef) },
+    details: { format, source: urlSecrets.redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -54,7 +63,7 @@ function schemaInvalidError(problems) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_INVALID,
     message: problems.at(-1) ?? "",
-    details: { problems: problems.map(urlCredentials.redactUrlCredentials) }
+    details: { problems: problems.map(urlSecrets.redactUrlSecrets) }
   });
 }
 function refCycleError(cause) {
@@ -68,6 +77,10 @@ function refCycleError(cause) {
 function hostListText(hosts) {
   return hosts.length === 0 ? "none" : hosts.join(", ");
 }
+const BYTES_PER_MEBIBYTE = 1024 * 1024;
+function sizeText(bytes) {
+  return bytes % BYTES_PER_MEBIBYTE === 0 ? `${bytes / BYTES_PER_MEBIBYTE} MiB` : `${bytes} bytes`;
+}
 function limitText(details) {
   switch (details.reason) {
     case "outside-local-root":
@@ -80,6 +93,16 @@ function limitText(details) {
       return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;
     case "too-many-remote-documents":
       return `the document refers to more than ${details.maxDocuments} remote documents`;
+    case "remote-document-too-large":
+      return `its body is larger than ${sizeText(details.maxDocumentBytes)} once decoded`;
+    case "remote-documents-too-large": {
+      const limit = sizeText(details.maxTotalBytes);
+      return `the remote documents of this run are larger than ${limit} together once decoded`;
+    }
+    case "remote-documents-too-many-nodes": {
+      const limit = details.maxNodes;
+      return `the remote documents of this run parse into more than ${limit} nodes together`;
+    }
     default:
       return assertNever.assertNever(details);
   }
@@ -89,7 +112,7 @@ function refForbiddenError(ref, details) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_REF_FORBIDDEN,
     message: `Refused to load ${ref}: ${limit}`,
-    details: { ref: urlCredentials.redactUrlCredentials(ref), ...details }
+    details: { ref: urlSecrets.redactUrlSecrets(ref), ...details }
   });
 }
 
@@ -101,5 +124,6 @@ exports.refForbiddenError = refForbiddenError;
 exports.schemaInvalidError = schemaInvalidError;
 exports.sourceEmptyError = sourceEmptyError;
 exports.sourceInvalidError = sourceInvalidError;
+exports.urlInvalidError = urlInvalidError;
 exports.versionUnsupportedError = versionUnsupportedError;
 //# sourceMappingURL=schema-load-errors.cjs.map