openapi-typesafe 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/adapters/redocly-loader/ref-holders.cjs

@@ -2,30 +2,72 @@
 
 const jsonPointer = require('../../domain/openapi/json-pointer.cjs');
 
-function hasStringRef(value) {
-  return !Array.isArray(value) && typeof value.$ref === "string";
+const DATA_KEYWORDS = /* @__PURE__ */ new Set(["example", "examples", "default", "const", "enum"]);
+const EXTENSION_PREFIX = "x-";
+const NAME_MAPS = /* @__PURE__ */ new Set([
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+  "schemas",
+  "responses",
+  "parameters",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems",
+  "mediaTypes",
+  "content",
+  "encoding",
+  "paths",
+  "webhooks"
+]);
+function isDataKey(key) {
+  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);
 }
-function findRefHolders(document) {
+function openApiNodes(document) {
   const found = [];
   const visited = /* @__PURE__ */ new WeakSet();
   const pending = [];
-  const enqueue = (value, pointer) => {
+  const enqueue = (value, pointer, hasNameKeys) => {
     if (typeof value === "object" && value !== null && !visited.has(value)) {
       visited.add(value);
-      pending.push({ value, pointer });
+      pending.push({ value, pointer, hasNameKeys });
     }
   };
-  enqueue(document, "#");
+  enqueue(document, jsonPointer.ROOT_POINTER, false);
   for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
-    if (hasStringRef(next.value)) {
-      found.push({ node: next.value, pointer: next.pointer });
-    }
+    found.push(next);
     for (const [key, child] of Object.entries(next.value)) {
-      enqueue(child, `${next.pointer}/${jsonPointer.escapePointerSegment(key)}`);
+      if (next.hasNameKeys || !isDataKey(key)) {
+        enqueue(child, jsonPointer.childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));
+      }
     }
   }
   return found;
 }
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  return openApiNodes(document).flatMap(
+    ({ value, pointer, hasNameKeys }) => !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : []
+  );
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findMappings(document) {
+  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {
+    const { discriminator } = value;
+    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : void 0;
+    return isMapping(mapping) ? [mapping] : [];
+  });
+}
 
+exports.findMappings = findMappings;
 exports.findRefHolders = findRefHolders;
 //# sourceMappingURL=ref-holders.cjs.map

package/dist/adapters/redocly-loader/ref-holders.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-holders.cjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { escapePointerSegment } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, \"#\");\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);\n    }\n  }\n  return found;\n}\n"],"names":["escapePointerSegment"],"mappings":";;;;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAU,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAO,GAAG,IAAA,CAAK,OAAO,IAAIA,gCAAA,CAAqB,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}
+{"version":3,"file":"ref-holders.cjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\n/**\n * Keywords whose value is data, not OpenAPI: a `$ref` or a `discriminator` in an example, a\n * default, a `const` or an `enum` value, or an extension is part of the data and stays as written.\n */\nconst DATA_KEYWORDS = new Set([\"example\", \"examples\", \"default\", \"const\", \"enum\"]);\nconst EXTENSION_PREFIX = \"x-\";\n\n/**\n * Keywords whose value maps names to objects: a property, a schema or a response may be named\n * `default` or `example`, and is OpenAPI all the same.\n */\nconst NAME_MAPS = new Set([\n  \"properties\",\n  \"patternProperties\",\n  \"dependentSchemas\",\n  \"$defs\",\n  \"definitions\",\n  \"schemas\",\n  \"responses\",\n  \"parameters\",\n  \"requestBodies\",\n  \"headers\",\n  \"securitySchemes\",\n  \"links\",\n  \"callbacks\",\n  \"pathItems\",\n  \"mediaTypes\",\n  \"content\",\n  \"encoding\",\n  \"paths\",\n  \"webhooks\",\n]);\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n  /** Whether the keys of `value` are names (of properties, schemas, responses), not keywords. */\n  readonly hasNameKeys: boolean;\n}\n\nfunction isDataKey(key: string): boolean {\n  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);\n}\n\n/**\n * Every object of a parsed document that is OpenAPI, not data (`DATA_KEYWORDS`), with its JSON\n * Pointer, in no particular order. The walk uses its own stack, so a deeply nested document does\n * not run out of call stack, and a node shared by YAML aliases (or a cycle of them) is visited\n * once.\n */\nfunction openApiNodes(document: unknown): PendingNode[] {\n  const found: PendingNode[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string, hasNameKeys: boolean): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer, hasNameKeys });\n    }\n  };\n  enqueue(document, ROOT_POINTER, false);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    found.push(next);\n    // One push per child: spreading an array of millions of children overflows the stack.\n    for (const [key, child] of Object.entries(next.value)) {\n      if (next.hasNameKeys || !isDataKey(key)) {\n        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));\n      }\n    }\n  }\n  return found;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/** Every object with a string `$ref` in a parsed document, outside data, in no particular order. */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  return openApiNodes(document).flatMap(({ value, pointer, hasNameKeys }) =>\n    !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : [],\n  );\n}\n\nfunction isMapping(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Every `discriminator.mapping` object of a parsed document, outside data. */\nexport function findMappings(document: unknown): Record<string, unknown>[] {\n  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {\n    const { discriminator } = value as { discriminator?: unknown };\n    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : undefined;\n    return isMapping(mapping) ? [mapping] : [];\n  });\n}\n"],"names":["ROOT_POINTER","childPointer"],"mappings":";;;;AAYA,MAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,WAAW,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,MAAM,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,IAAA;AAMzB,MAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,UAAU,GAAA,EAAsB;AACvC,EAAA,OAAO,cAAc,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,CAAI,WAAW,gBAAgB,CAAA;AAClE;AAQA,SAAS,aAAa,QAAA,EAAkC;AACtD,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,EAAiB,WAAA,KAA+B;AAC/E,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,aAAa,CAAA;AAAA,IAC9C;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,QAAA,EAAUA,0BAAc,KAAK,CAAA;AACrC,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAEf,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,IAAI,IAAA,CAAK,WAAA,IAAe,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AACvC,QAAA,OAAA,CAAQ,KAAA,EAAOC,wBAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA,EAAG,CAAC,IAAA,CAAK,WAAA,IAAe,SAAA,CAAU,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAGO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA;AAAA,IAAQ,CAAC,EAAE,KAAA,EAAO,SAAS,WAAA,EAAY,KACnE,CAAC,WAAA,IAAe,YAAA,CAAa,KAAK,CAAA,GAAI,CAAC,EAAE,IAAA,EAAM,OAAO,OAAA,EAAS,IAAI;AAAC,GACtE;AACF;AAEA,SAAS,UAAU,KAAA,EAAkD;AACnE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGO,SAAS,aAAa,QAAA,EAA8C;AACzE,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAO,aAAY,KAAM;AAChE,IAAA,MAAM,EAAE,eAAc,GAAI,KAAA;AAC1B,IAAA,MAAM,UAAU,CAAC,WAAA,IAAe,UAAU,aAAa,CAAA,GAAI,cAAc,OAAA,GAAU,MAAA;AACnF,IAAA,OAAO,UAAU,OAAO,CAAA,GAAI,CAAC,OAAO,IAAI,EAAC;AAAA,EAC3C,CAAC,CAAA;AACH;;;"}

package/dist/adapters/redocly-loader/ref-holders.mjs

@@ -1,29 +1,70 @@
-import { escapePointerSegment } from '../../domain/openapi/json-pointer.mjs';
+import { childPointer, ROOT_POINTER } from '../../domain/openapi/json-pointer.mjs';
 
-function hasStringRef(value) {
-  return !Array.isArray(value) && typeof value.$ref === "string";
+const DATA_KEYWORDS = /* @__PURE__ */ new Set(["example", "examples", "default", "const", "enum"]);
+const EXTENSION_PREFIX = "x-";
+const NAME_MAPS = /* @__PURE__ */ new Set([
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+  "schemas",
+  "responses",
+  "parameters",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems",
+  "mediaTypes",
+  "content",
+  "encoding",
+  "paths",
+  "webhooks"
+]);
+function isDataKey(key) {
+  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);
 }
-function findRefHolders(document) {
+function openApiNodes(document) {
   const found = [];
   const visited = /* @__PURE__ */ new WeakSet();
   const pending = [];
-  const enqueue = (value, pointer) => {
+  const enqueue = (value, pointer, hasNameKeys) => {
     if (typeof value === "object" && value !== null && !visited.has(value)) {
       visited.add(value);
-      pending.push({ value, pointer });
+      pending.push({ value, pointer, hasNameKeys });
     }
   };
-  enqueue(document, "#");
+  enqueue(document, ROOT_POINTER, false);
   for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
-    if (hasStringRef(next.value)) {
-      found.push({ node: next.value, pointer: next.pointer });
-    }
+    found.push(next);
     for (const [key, child] of Object.entries(next.value)) {
-      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);
+      if (next.hasNameKeys || !isDataKey(key)) {
+        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));
+      }
     }
   }
   return found;
 }
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  return openApiNodes(document).flatMap(
+    ({ value, pointer, hasNameKeys }) => !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : []
+  );
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findMappings(document) {
+  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {
+    const { discriminator } = value;
+    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : void 0;
+    return isMapping(mapping) ? [mapping] : [];
+  });
+}
 
-export { findRefHolders };
+export { findMappings, findRefHolders };
 //# sourceMappingURL=ref-holders.mjs.map

package/dist/adapters/redocly-loader/ref-holders.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-holders.mjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { escapePointerSegment } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, \"#\");\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, `${next.pointer}/${escapePointerSegment(key)}`);\n    }\n  }\n  return found;\n}\n"],"names":[],"mappings":";;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAU,GAAG,CAAA;AACrB,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAO,GAAG,IAAA,CAAK,OAAO,IAAI,oBAAA,CAAqB,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,IAC/D;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}
+{"version":3,"file":"ref-holders.mjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\n/**\n * Keywords whose value is data, not OpenAPI: a `$ref` or a `discriminator` in an example, a\n * default, a `const` or an `enum` value, or an extension is part of the data and stays as written.\n */\nconst DATA_KEYWORDS = new Set([\"example\", \"examples\", \"default\", \"const\", \"enum\"]);\nconst EXTENSION_PREFIX = \"x-\";\n\n/**\n * Keywords whose value maps names to objects: a property, a schema or a response may be named\n * `default` or `example`, and is OpenAPI all the same.\n */\nconst NAME_MAPS = new Set([\n  \"properties\",\n  \"patternProperties\",\n  \"dependentSchemas\",\n  \"$defs\",\n  \"definitions\",\n  \"schemas\",\n  \"responses\",\n  \"parameters\",\n  \"requestBodies\",\n  \"headers\",\n  \"securitySchemes\",\n  \"links\",\n  \"callbacks\",\n  \"pathItems\",\n  \"mediaTypes\",\n  \"content\",\n  \"encoding\",\n  \"paths\",\n  \"webhooks\",\n]);\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n  /** Whether the keys of `value` are names (of properties, schemas, responses), not keywords. */\n  readonly hasNameKeys: boolean;\n}\n\nfunction isDataKey(key: string): boolean {\n  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);\n}\n\n/**\n * Every object of a parsed document that is OpenAPI, not data (`DATA_KEYWORDS`), with its JSON\n * Pointer, in no particular order. The walk uses its own stack, so a deeply nested document does\n * not run out of call stack, and a node shared by YAML aliases (or a cycle of them) is visited\n * once.\n */\nfunction openApiNodes(document: unknown): PendingNode[] {\n  const found: PendingNode[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string, hasNameKeys: boolean): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer, hasNameKeys });\n    }\n  };\n  enqueue(document, ROOT_POINTER, false);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    found.push(next);\n    // One push per child: spreading an array of millions of children overflows the stack.\n    for (const [key, child] of Object.entries(next.value)) {\n      if (next.hasNameKeys || !isDataKey(key)) {\n        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));\n      }\n    }\n  }\n  return found;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/** Every object with a string `$ref` in a parsed document, outside data, in no particular order. */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  return openApiNodes(document).flatMap(({ value, pointer, hasNameKeys }) =>\n    !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : [],\n  );\n}\n\nfunction isMapping(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Every `discriminator.mapping` object of a parsed document, outside data. */\nexport function findMappings(document: unknown): Record<string, unknown>[] {\n  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {\n    const { discriminator } = value as { discriminator?: unknown };\n    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : undefined;\n    return isMapping(mapping) ? [mapping] : [];\n  });\n}\n"],"names":[],"mappings":";;AAYA,MAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,WAAW,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,MAAM,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,IAAA;AAMzB,MAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,UAAU,GAAA,EAAsB;AACvC,EAAA,OAAO,cAAc,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,CAAI,WAAW,gBAAgB,CAAA;AAClE;AAQA,SAAS,aAAa,QAAA,EAAkC;AACtD,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,EAAiB,WAAA,KAA+B;AAC/E,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,aAAa,CAAA;AAAA,IAC9C;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,QAAA,EAAU,cAAc,KAAK,CAAA;AACrC,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAEf,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,IAAI,IAAA,CAAK,WAAA,IAAe,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AACvC,QAAA,OAAA,CAAQ,KAAA,EAAO,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA,EAAG,CAAC,IAAA,CAAK,WAAA,IAAe,SAAA,CAAU,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAGO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA;AAAA,IAAQ,CAAC,EAAE,KAAA,EAAO,SAAS,WAAA,EAAY,KACnE,CAAC,WAAA,IAAe,YAAA,CAAa,KAAK,CAAA,GAAI,CAAC,EAAE,IAAA,EAAM,OAAO,OAAA,EAAS,IAAI;AAAC,GACtE;AACF;AAEA,SAAS,UAAU,KAAA,EAAkD;AACnE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGO,SAAS,aAAa,QAAA,EAA8C;AACzE,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAO,aAAY,KAAM;AAChE,IAAA,MAAM,EAAE,eAAc,GAAI,KAAA;AAC1B,IAAA,MAAM,UAAU,CAAC,WAAA,IAAe,UAAU,aAAa,CAAA,GAAI,cAAc,OAAA,GAAU,MAAA;AACnF,IAAA,OAAO,UAAU,OAAO,CAAA,GAAI,CAAC,OAAO,IAAI,EAAC;AAAA,EAC3C,CAAC,CAAA;AACH;;"}

package/dist/adapters/redocly-loader/remote-body-limit.cjs

@@ -0,0 +1,50 @@
+'use strict';
+
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+class RemoteBodyLimit {
+  #limits;
+  #totalBytes = 0;
+  constructor(limits) {
+    this.#limits = limits;
+  }
+  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */
+  async read(response, url) {
+    const reader = response.body?.getReader();
+    if (reader === void 0) {
+      return new ArrayBuffer(0);
+    }
+    const chunks = [];
+    let documentBytes = 0;
+    for (let next = await reader.read(); !next.done; next = await reader.read()) {
+      documentBytes += next.value.byteLength;
+      this.#totalBytes += next.value.byteLength;
+      const refusal = this.#refusal(url, documentBytes);
+      if (refusal !== void 0) {
+        await reader.cancel();
+        throw refusal;
+      }
+      chunks.push(next.value);
+    }
+    return joined(chunks, documentBytes);
+  }
+  #refusal(url, documentBytes) {
+    const { maxDocumentBytes, maxTotalBytes } = this.#limits;
+    if (documentBytes > maxDocumentBytes) {
+      return schemaLoadErrors.refForbiddenError(url, { reason: "remote-document-too-large", maxDocumentBytes });
+    }
+    return this.#totalBytes > maxTotalBytes ? schemaLoadErrors.refForbiddenError(url, { reason: "remote-documents-too-large", maxTotalBytes }) : void 0;
+  }
+}
+function joined(chunks, byteLength) {
+  const body = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body.buffer;
+}
+
+exports.RemoteBodyLimit = RemoteBodyLimit;
+//# sourceMappingURL=remote-body-limit.cjs.map

package/dist/adapters/redocly-loader/remote-body-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-body-limit.cjs","sources":["../../../src/adapters/redocly-loader/remote-body-limit.ts"],"sourcesContent":["import type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** The decoded size limits of the remote documents of one load (threat model T2). */\nexport interface RemoteBodyLimits {\n  /** Bytes of one remote document's body after `Content-Encoding` is decoded. */\n  readonly maxDocumentBytes: number;\n  /** Bytes of the bodies of every remote document of one load together, decoded. */\n  readonly maxTotalBytes: number;\n}\n\n/**\n * Reads remote bodies as a stream and stops at the limits. Fetch decodes `gzip`, `deflate` and\n * `br` before the body reaches the loader, so a body of a few megabytes on the wire can become\n * gigabytes in memory (a \"gzip bomb\"); counting the decoded bytes while they arrive stops it before\n * the memory is taken. One instance per load: the total covers every document of that load.\n */\nexport class RemoteBodyLimit {\n  readonly #limits: RemoteBodyLimits;\n  #totalBytes = 0;\n\n  constructor(limits: RemoteBodyLimits) {\n    this.#limits = limits;\n  }\n\n  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */\n  async read(response: Response, url: string): Promise<ArrayBuffer> {\n    const reader = response.body?.getReader();\n    if (reader === undefined) {\n      return new ArrayBuffer(0);\n    }\n    const chunks: Uint8Array[] = [];\n    let documentBytes = 0;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      documentBytes += next.value.byteLength;\n      this.#totalBytes += next.value.byteLength;\n      const refusal = this.#refusal(url, documentBytes);\n      if (refusal !== undefined) {\n        await reader.cancel();\n        throw refusal;\n      }\n      chunks.push(next.value);\n    }\n    return joined(chunks, documentBytes);\n  }\n\n  #refusal(url: string, documentBytes: number): OpenAPITypesafeError | undefined {\n    const { maxDocumentBytes, maxTotalBytes } = this.#limits;\n    if (documentBytes > maxDocumentBytes) {\n      return refForbiddenError(url, { reason: \"remote-document-too-large\", maxDocumentBytes });\n    }\n    return this.#totalBytes > maxTotalBytes\n      ? refForbiddenError(url, { reason: \"remote-documents-too-large\", maxTotalBytes })\n      : undefined;\n  }\n}\n\nfunction joined(chunks: readonly Uint8Array[], byteLength: number): ArrayBuffer {\n  const body = new Uint8Array(byteLength);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body.buffer;\n}\n"],"names":["refForbiddenError"],"mappings":";;;;AAiBO,MAAM,eAAA,CAAgB;AAAA,EAClB,OAAA;AAAA,EACT,WAAA,GAAc,CAAA;AAAA,EAEd,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,IAAA,CAAK,QAAA,EAAoB,GAAA,EAAmC;AAChE,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,IAAI,YAAY,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG;AAC3E,MAAA,aAAA,IAAiB,KAAK,KAAA,CAAM,UAAA;AAC5B,MAAA,IAAA,CAAK,WAAA,IAAe,KAAK,KAAA,CAAM,UAAA;AAC/B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,aAAa,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,OAAA;AAAA,MACR;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,MAAA,CAAO,QAAQ,aAAa,CAAA;AAAA,EACrC;AAAA,EAEA,QAAA,CAAS,KAAa,aAAA,EAAyD;AAC7E,IAAA,MAAM,EAAE,gBAAA,EAAkB,aAAA,EAAc,GAAI,IAAA,CAAK,OAAA;AACjD,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAOA,mCAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,2BAAA,EAA6B,kBAAkB,CAAA;AAAA,IACzF;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,GAAc,aAAA,GACtBA,kCAAA,CAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAA,EAAe,CAAA,GAC9E,MAAA;AAAA,EACN;AACF;AAEA,SAAS,MAAA,CAAO,QAA+B,UAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,UAAU,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAO,MAAM,CAAA;AACtB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;"}

package/dist/adapters/redocly-loader/remote-body-limit.mjs

@@ -0,0 +1,48 @@
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+class RemoteBodyLimit {
+  #limits;
+  #totalBytes = 0;
+  constructor(limits) {
+    this.#limits = limits;
+  }
+  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */
+  async read(response, url) {
+    const reader = response.body?.getReader();
+    if (reader === void 0) {
+      return new ArrayBuffer(0);
+    }
+    const chunks = [];
+    let documentBytes = 0;
+    for (let next = await reader.read(); !next.done; next = await reader.read()) {
+      documentBytes += next.value.byteLength;
+      this.#totalBytes += next.value.byteLength;
+      const refusal = this.#refusal(url, documentBytes);
+      if (refusal !== void 0) {
+        await reader.cancel();
+        throw refusal;
+      }
+      chunks.push(next.value);
+    }
+    return joined(chunks, documentBytes);
+  }
+  #refusal(url, documentBytes) {
+    const { maxDocumentBytes, maxTotalBytes } = this.#limits;
+    if (documentBytes > maxDocumentBytes) {
+      return refForbiddenError(url, { reason: "remote-document-too-large", maxDocumentBytes });
+    }
+    return this.#totalBytes > maxTotalBytes ? refForbiddenError(url, { reason: "remote-documents-too-large", maxTotalBytes }) : void 0;
+  }
+}
+function joined(chunks, byteLength) {
+  const body = new Uint8Array(byteLength);
+  let offset = 0;
+  for (const chunk of chunks) {
+    body.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return body.buffer;
+}
+
+export { RemoteBodyLimit };
+//# sourceMappingURL=remote-body-limit.mjs.map

package/dist/adapters/redocly-loader/remote-body-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-body-limit.mjs","sources":["../../../src/adapters/redocly-loader/remote-body-limit.ts"],"sourcesContent":["import type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/** The decoded size limits of the remote documents of one load (threat model T2). */\nexport interface RemoteBodyLimits {\n  /** Bytes of one remote document's body after `Content-Encoding` is decoded. */\n  readonly maxDocumentBytes: number;\n  /** Bytes of the bodies of every remote document of one load together, decoded. */\n  readonly maxTotalBytes: number;\n}\n\n/**\n * Reads remote bodies as a stream and stops at the limits. Fetch decodes `gzip`, `deflate` and\n * `br` before the body reaches the loader, so a body of a few megabytes on the wire can become\n * gigabytes in memory (a \"gzip bomb\"); counting the decoded bytes while they arrive stops it before\n * the memory is taken. One instance per load: the total covers every document of that load.\n */\nexport class RemoteBodyLimit {\n  readonly #limits: RemoteBodyLimits;\n  #totalBytes = 0;\n\n  constructor(limits: RemoteBodyLimits) {\n    this.#limits = limits;\n  }\n\n  /** The whole body of `response` from `url`; fails with `SCHEMA_REF_FORBIDDEN` past a limit. */\n  async read(response: Response, url: string): Promise<ArrayBuffer> {\n    const reader = response.body?.getReader();\n    if (reader === undefined) {\n      return new ArrayBuffer(0);\n    }\n    const chunks: Uint8Array[] = [];\n    let documentBytes = 0;\n    for (let next = await reader.read(); !next.done; next = await reader.read()) {\n      documentBytes += next.value.byteLength;\n      this.#totalBytes += next.value.byteLength;\n      const refusal = this.#refusal(url, documentBytes);\n      if (refusal !== undefined) {\n        await reader.cancel();\n        throw refusal;\n      }\n      chunks.push(next.value);\n    }\n    return joined(chunks, documentBytes);\n  }\n\n  #refusal(url: string, documentBytes: number): OpenAPITypesafeError | undefined {\n    const { maxDocumentBytes, maxTotalBytes } = this.#limits;\n    if (documentBytes > maxDocumentBytes) {\n      return refForbiddenError(url, { reason: \"remote-document-too-large\", maxDocumentBytes });\n    }\n    return this.#totalBytes > maxTotalBytes\n      ? refForbiddenError(url, { reason: \"remote-documents-too-large\", maxTotalBytes })\n      : undefined;\n  }\n}\n\nfunction joined(chunks: readonly Uint8Array[], byteLength: number): ArrayBuffer {\n  const body = new Uint8Array(byteLength);\n  let offset = 0;\n  for (const chunk of chunks) {\n    body.set(chunk, offset);\n    offset += chunk.byteLength;\n  }\n  return body.buffer;\n}\n"],"names":[],"mappings":";;AAiBO,MAAM,eAAA,CAAgB;AAAA,EAClB,OAAA;AAAA,EACT,WAAA,GAAc,CAAA;AAAA,EAEd,YAAY,MAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AAAA,EACjB;AAAA;AAAA,EAGA,MAAM,IAAA,CAAK,QAAA,EAAoB,GAAA,EAAmC;AAChE,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,WAAW,MAAA,EAAW;AACxB,MAAA,OAAO,IAAI,YAAY,CAAC,CAAA;AAAA,IAC1B;AACA,IAAA,MAAM,SAAuB,EAAC;AAC9B,IAAA,IAAI,aAAA,GAAgB,CAAA;AACpB,IAAA,KAAA,IAAS,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG,CAAC,IAAA,CAAK,IAAA,EAAM,IAAA,GAAO,MAAM,MAAA,CAAO,IAAA,EAAK,EAAG;AAC3E,MAAA,aAAA,IAAiB,KAAK,KAAA,CAAM,UAAA;AAC5B,MAAA,IAAA,CAAK,WAAA,IAAe,KAAK,KAAA,CAAM,UAAA;AAC/B,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,aAAa,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAO,MAAA,EAAO;AACpB,QAAA,MAAM,OAAA;AAAA,MACR;AACA,MAAA,MAAA,CAAO,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,IACxB;AACA,IAAA,OAAO,MAAA,CAAO,QAAQ,aAAa,CAAA;AAAA,EACrC;AAAA,EAEA,QAAA,CAAS,KAAa,aAAA,EAAyD;AAC7E,IAAA,MAAM,EAAE,gBAAA,EAAkB,aAAA,EAAc,GAAI,IAAA,CAAK,OAAA;AACjD,IAAA,IAAI,gBAAgB,gBAAA,EAAkB;AACpC,MAAA,OAAO,kBAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,2BAAA,EAA6B,kBAAkB,CAAA;AAAA,IACzF;AACA,IAAA,OAAO,IAAA,CAAK,WAAA,GAAc,aAAA,GACtB,iBAAA,CAAkB,GAAA,EAAK,EAAE,MAAA,EAAQ,4BAAA,EAA8B,aAAA,EAAe,CAAA,GAC9E,MAAA;AAAA,EACN;AACF;AAEA,SAAS,MAAA,CAAO,QAA+B,UAAA,EAAiC;AAC9E,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,UAAU,CAAA;AACtC,EAAA,IAAI,MAAA,GAAS,CAAA;AACb,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,IAAA,CAAK,GAAA,CAAI,OAAO,MAAM,CAAA;AACtB,IAAA,MAAA,IAAU,KAAA,CAAM,UAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;"}

package/dist/adapters/redocly-loader/remote-fetch.cjs

@@ -2,13 +2,14 @@
 
 const allowedHosts = require('./allowed-hosts.cjs');
 const configuredHeaders = require('./configured-headers.cjs');
+const remoteBodyLimit = require('./remote-body-limit.cjs');
 const schemaLoadErrors = require('./schema-load-errors.cjs');
 
 const MAX_REDIRECTS = 20;
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
-async function bufferedResponse(response) {
-  const body = await response.arrayBuffer();
+async function bufferedResponse(response, url, bodyLimit) {
+  const body = await bodyLimit.read(response, url);
   const { status, statusText, headers } = response;
   return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
     status,
@@ -16,25 +17,53 @@ async function bufferedResponse(response) {
     headers
   });
 }
-function fetchWithTimeout(timeoutMs) {
+const CLOSED_CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "UND_ERR_SOCKET"
+]);
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const DEFAULT_METHOD = "GET";
+function isClosedConnection(error) {
+  const cause = error instanceof TypeError ? error.cause : void 0;
+  const code = cause instanceof Error && "code" in cause ? cause.code : void 0;
+  return typeof code === "string" && CLOSED_CONNECTION_CODES.has(code);
+}
+async function fetchOnOpenConnection(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();
+    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {
+      throw error;
+    }
+    return fetch(input, init);
+  }
+}
+function fetchWithTimeout(timeoutMs, bodyLimit) {
   return async (input, init = {}) => {
     try {
-      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-      return await bufferedResponse(response);
+      const signal = AbortSignal.timeout(timeoutMs);
+      const response = await fetchOnOpenConnection(input, { ...init, signal });
+      return await bufferedResponse(response, input, bodyLimit);
     } catch (cause) {
       const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
       throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
     }
   };
 }
+function fetchWithBodyLimit(fetchImpl, bodyLimit) {
+  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
+    const hosts = input === policy.rootUrl ? void 0 : policy.hosts;
     let url = new URL(input);
     for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-      if (hop > 0 && policy.hosts !== void 0 && !allowedHosts.isHostAllowed(url, policy.hosts)) {
+      if (hop > 0 && hosts !== void 0 && !allowedHosts.isHostAllowed(url, hosts)) {
         throw schemaLoadErrors.refForbiddenError(url.href, {
           reason: "host-not-allowed",
-          allowedHosts: [...policy.hosts]
+          allowedHosts: [...hosts]
         });
       }
       const headers = await configuredHeaders.headersFor(url, policy.headers);
@@ -71,10 +100,12 @@ function fetchWithConcurrencyLimit(fetchImpl, limit) {
 }
 function resolveConfigWithAccess(resolve, options) {
   const configured = resolve.http.customFetch;
-  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const bodyLimit = new remoteBodyLimit.RemoteBodyLimit(options.bodyLimits);
+  const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
-    hosts: options.access.remoteHosts
+    hosts: options.access.remoteHosts,
+    rootUrl: options.rootUrl
   });
   const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);
   return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };

package/dist/adapters/redocly-loader/remote-fetch.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, the host limit and the configured headers\n * checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor"],"mappings":";;;;;;AAoBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAcO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAeO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;"}
+{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n  /**\n   * The URL of the root document, if it is remote. The developer chose it, so neither it nor its\n   * redirects are limited to the hosts (ADR-017): a spec URL that redirects to a CDN loads.\n   */\n  readonly rootUrl: string | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    const hosts = input === policy.rootUrl ? undefined : policy.hosts;\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && hosts !== undefined && !isHostAllowed(url, hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  /** The root document's URL, whose redirects are not limited to the hosts. */\n  readonly rootUrl: string | undefined;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n    rootUrl: options.rootUrl,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor","RemoteBodyLimit"],"mappings":";;;;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAuBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,MAAA,CAAO,OAAA,GAAU,SAAY,MAAA,CAAO,KAAA;AAC5D,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,KAAK,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,KAAK,CAAA,EAAG;AAChE,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,KAAK;AAAA,SACxB,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAmBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAIC,+BAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO,WAAA;AAAA,IACtB,SAAS,OAAA,CAAQ;AAAA,GAClB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;"}

package/dist/adapters/redocly-loader/remote-fetch.mjs

@@ -1,12 +1,13 @@
 import { isHostAllowed } from './allowed-hosts.mjs';
 import { headersFor } from './configured-headers.mjs';
+import { RemoteBodyLimit } from './remote-body-limit.mjs';
 import { refForbiddenError } from './schema-load-errors.mjs';
 
 const MAX_REDIRECTS = 20;
 const REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
 const NULL_BODY_STATUSES = /* @__PURE__ */ new Set([101, 103, 204, 205, 304]);
-async function bufferedResponse(response) {
-  const body = await response.arrayBuffer();
+async function bufferedResponse(response, url, bodyLimit) {
+  const body = await bodyLimit.read(response, url);
   const { status, statusText, headers } = response;
   return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {
     status,
@@ -14,25 +15,53 @@ async function bufferedResponse(response) {
     headers
   });
 }
-function fetchWithTimeout(timeoutMs) {
+const CLOSED_CONNECTION_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "EPIPE",
+  "UND_ERR_SOCKET"
+]);
+const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
+const DEFAULT_METHOD = "GET";
+function isClosedConnection(error) {
+  const cause = error instanceof TypeError ? error.cause : void 0;
+  const code = cause instanceof Error && "code" in cause ? cause.code : void 0;
+  return typeof code === "string" && CLOSED_CONNECTION_CODES.has(code);
+}
+async function fetchOnOpenConnection(input, init) {
+  try {
+    return await fetch(input, init);
+  } catch (error) {
+    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();
+    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {
+      throw error;
+    }
+    return fetch(input, init);
+  }
+}
+function fetchWithTimeout(timeoutMs, bodyLimit) {
   return async (input, init = {}) => {
     try {
-      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });
-      return await bufferedResponse(response);
+      const signal = AbortSignal.timeout(timeoutMs);
+      const response = await fetchOnOpenConnection(input, { ...init, signal });
+      return await bufferedResponse(response, input, bodyLimit);
     } catch (cause) {
       const isTimeout = cause instanceof Error && cause.name === "TimeoutError";
       throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;
     }
   };
 }
+function fetchWithBodyLimit(fetchImpl, bodyLimit) {
+  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
+    const hosts = input === policy.rootUrl ? void 0 : policy.hosts;
     let url = new URL(input);
     for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-      if (hop > 0 && policy.hosts !== void 0 && !isHostAllowed(url, policy.hosts)) {
+      if (hop > 0 && hosts !== void 0 && !isHostAllowed(url, hosts)) {
         throw refForbiddenError(url.href, {
           reason: "host-not-allowed",
-          allowedHosts: [...policy.hosts]
+          allowedHosts: [...hosts]
         });
       }
       const headers = await headersFor(url, policy.headers);
@@ -69,10 +98,12 @@ function fetchWithConcurrencyLimit(fetchImpl, limit) {
 }
 function resolveConfigWithAccess(resolve, options) {
   const configured = resolve.http.customFetch;
-  const base = configured ?? fetchWithTimeout(options.timeoutMs);
+  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);
+  const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
-    hosts: options.access.remoteHosts
+    hosts: options.access.remoteHosts,
+    rootUrl: options.rootUrl
   });
   const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);
   return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };