openapi-typesafe 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/adapters/redocly-loader/remote-fetch.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-fetch.mjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, the host limit and the configured headers\n * checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/** A response whose body is already read, so that reading it again cannot wait or fail. */\nasync function bufferedResponse(response: Response): Promise<Response> {\n  const body = await response.arrayBuffer();\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      const response = await fetch(input, { ...init, signal: AbortSignal.timeout(timeoutMs) });\n      return await bufferedResponse(response);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  const base = configured ?? fetchWithTimeout(options.timeoutMs);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":[],"mappings":";;;;AAoBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG5D,eAAe,iBAAiB,QAAA,EAAuC;AACrE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,WAAA,EAAY;AACxC,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AASA,SAAS,iBAAiB,SAAA,EAAgC;AACxD,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AACF,MAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,MAAA,EAAQ,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA,EAAG,CAAA;AACvF,MAAA,OAAO,MAAM,iBAAiB,QAAQ,CAAA;AAAA,IACxC,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAAC,aAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAM,iBAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAcO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAeO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAChC,EAAA,MAAM,IAAA,GAAO,UAAA,IAAc,gBAAA,CAAiB,OAAA,CAAQ,SAAS,CAAA;AAC7D,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;"}
+{"version":3,"file":"remote-fetch.mjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n  /**\n   * The URL of the root document, if it is remote. The developer chose it, so neither it nor its\n   * redirects are limited to the hosts (ADR-017): a spec URL that redirects to a CDN loads.\n   */\n  readonly rootUrl: string | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    const hosts = input === policy.rootUrl ? undefined : policy.hosts;\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && hosts !== undefined && !isHostAllowed(url, hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  /** The root document's URL, whose redirects are not limited to the hosts. */\n  readonly rootUrl: string | undefined;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n    rootUrl: options.rootUrl,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":[],"mappings":";;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAuBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,MAAA,CAAO,OAAA,GAAU,SAAY,MAAA,CAAO,KAAA;AAC5D,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,KAAK,KAAA,KAAU,MAAA,IAAa,CAAC,aAAA,CAAc,GAAA,EAAK,KAAK,CAAA,EAAG;AAChE,QAAA,MAAM,iBAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,KAAK;AAAA,SACxB,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAmBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAI,eAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO,WAAA;AAAA,IACtB,SAAS,OAAA,CAAQ;AAAA,GAClB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;"}

package/dist/adapters/redocly-loader/remote-node-limit.cjs

@@ -0,0 +1,61 @@
+'use strict';
+
+const openapiCore = require('@redocly/openapi-core');
+const schemaLoadErrors = require('./schema-load-errors.cjs');
+
+const PARSED_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".yml", ".yaml"]);
+const PARSED_MIME_TYPE = /(json|yaml|openapi)/;
+const TEXT_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".markdown", ".txt", ".html", ".htm"]);
+const TEXT_MIME_TYPE = /^text\/(markdown|x-markdown|html)\b/;
+const REMOTE_URL_RE = /^https?:\/\//;
+const PATH_SEPARATOR_RE = /[/\\]/;
+const EXTENSION_START = ".";
+function extensionOf(path) {
+  const name = path.split(PATH_SEPARATOR_RE).at(-1) ?? "";
+  const start = name.lastIndexOf(EXTENSION_START);
+  return start === -1 ? "" : name.slice(start);
+}
+function documentPath(absoluteRef) {
+  return REMOTE_URL_RE.test(absoluteRef) && URL.canParse(absoluteRef) ? new URL(absoluteRef).pathname : absoluteRef;
+}
+function isParsedSource(source, isRoot) {
+  const { absoluteRef, mimeType = "" } = source;
+  const extension = extensionOf(documentPath(absoluteRef));
+  const isTextUrl = TEXT_EXTENSIONS.has(extension) || TEXT_MIME_TYPE.test(mimeType);
+  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType) || REMOTE_URL_RE.test(absoluteRef) && !isTextUrl;
+}
+const NODE_OPENED = "open";
+class RemoteNodeLimit {
+  #maxNodes;
+  #nodes = 0;
+  constructor(maxNodes) {
+    this.#maxNodes = maxNodes;
+  }
+  /**
+   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`
+   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.
+   */
+  parse(source) {
+    const listener = (event) => {
+      if (event !== NODE_OPENED) {
+        return;
+      }
+      this.#nodes += 1;
+      const refusal = this.#refusal(source.absoluteRef);
+      if (refusal !== void 0) {
+        throw refusal;
+      }
+    };
+    return { source, parsed: openapiCore.parseYaml(source.body, { filename: source.absoluteRef, listener }) };
+  }
+  #refusal(url) {
+    return this.#nodes > this.#maxNodes ? schemaLoadErrors.refForbiddenError(url, {
+      reason: "remote-documents-too-many-nodes",
+      maxNodes: this.#maxNodes
+    }) : void 0;
+  }
+}
+
+exports.RemoteNodeLimit = RemoteNodeLimit;
+exports.isParsedSource = isParsedSource;
+//# sourceMappingURL=remote-node-limit.cjs.map

package/dist/adapters/redocly-loader/remote-node-limit.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-node-limit.cjs","sources":["../../../src/adapters/redocly-loader/remote-node-limit.ts"],"sourcesContent":["import { type Document, parseYaml, type Source } from \"@redocly/openapi-core\";\nimport type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Bounds the parsed size of the remote documents of one load (threat model T2). The byte limits\n * do not bound memory: parsing multiplies it by the density of the text, and 250 MiB of `{},`\n * (87 million empty objects, under a quarter of a megabyte as gzip) took the process past its\n * 4 GB heap. The parser reports every node it builds, keys included, and the parse stops when\n * the nodes of all remote documents of the load pass the limit, before their memory is taken.\n */\n\n/** The extensions that Redocly 1.34's `BaseResolver.parseDocument` parses as YAML or JSON. */\nconst PARSED_EXTENSIONS: ReadonlySet<string> = new Set([\".json\", \".yml\", \".yaml\"]);\nconst PARSED_MIME_TYPE = /(json|yaml|openapi)/;\n/**\n * The text formats that a `$ref` loads as text, as a `description` from a Markdown file. A URL\n * keeps its document as text only when its extension or type names one of them: the last segment\n * of an API's path often has a dot that is no file type (`/schemas/v1.0`, `/schemas/pet.v2`).\n */\nconst TEXT_EXTENSIONS: ReadonlySet<string> = new Set([\".md\", \".markdown\", \".txt\", \".html\", \".htm\"]);\nconst TEXT_MIME_TYPE = /^text\\/(markdown|x-markdown|html)\\b/;\nconst REMOTE_URL_RE = /^https?:\\/\\//;\nconst PATH_SEPARATOR_RE = /[/\\\\]/;\nconst EXTENSION_START = \".\";\n\n/** The extension of the last segment of a path, with its dot; empty when it has none. */\nfunction extensionOf(path: string): string {\n  const name = path.split(PATH_SEPARATOR_RE).at(-1) ?? \"\";\n  const start = name.lastIndexOf(EXTENSION_START);\n  return start === -1 ? \"\" : name.slice(start);\n}\n\n/**\n * The path of a document: the path of a URL, without its query and fragment, or the file path.\n * Redocly took the extension of the whole URL, so `pet.yaml?token=…` had none it knew.\n */\nfunction documentPath(absoluteRef: string): string {\n  return REMOTE_URL_RE.test(absoluteRef) && URL.canParse(absoluteRef)\n    ? new URL(absoluteRef).pathname\n    : absoluteRef;\n}\n\n/**\n * Whether a source is parsed as YAML or JSON, or kept as text (a Markdown `description`, say).\n * It is parsed when it is the root, when its type or the extension of its path says JSON or YAML,\n * and when it is a URL whose path and type name no text format: an API serves its documents at\n * paths like `/schemas/pet` or `/schemas/v1.0`, often as `text/plain`, and Redocly kept those as\n * text, which failed as a schema. A local file is kept as text unless its name says JSON or YAML,\n * as Redocly keeps it.\n */\nexport function isParsedSource(source: Source, isRoot: boolean): boolean {\n  const { absoluteRef, mimeType = \"\" } = source;\n  const extension = extensionOf(documentPath(absoluteRef));\n  const isTextUrl = TEXT_EXTENSIONS.has(extension) || TEXT_MIME_TYPE.test(mimeType);\n  return (\n    isRoot ||\n    PARSED_EXTENSIONS.has(extension) ||\n    PARSED_MIME_TYPE.test(mimeType) ||\n    (REMOTE_URL_RE.test(absoluteRef) && !isTextUrl)\n  );\n}\n\n/** The parser's event for a node it starts to build. */\nconst NODE_OPENED = \"open\";\n\n/** One instance per load: the count covers every remote document of that load. */\nexport class RemoteNodeLimit {\n  readonly #maxNodes: number;\n  #nodes = 0;\n\n  constructor(maxNodes: number) {\n    this.#maxNodes = maxNodes;\n  }\n\n  /**\n   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`\n   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.\n   */\n  parse(source: Source): Document {\n    const listener = (event: string): void => {\n      if (event !== NODE_OPENED) {\n        return;\n      }\n      this.#nodes += 1;\n      const refusal = this.#refusal(source.absoluteRef);\n      if (refusal !== undefined) {\n        throw refusal;\n      }\n    };\n    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };\n  }\n\n  #refusal(url: string): OpenAPITypesafeError | undefined {\n    return this.#nodes > this.#maxNodes\n      ? refForbiddenError(url, {\n          reason: \"remote-documents-too-many-nodes\",\n          maxNodes: this.#maxNodes,\n        })\n      : undefined;\n  }\n}\n"],"names":["parseYaml","refForbiddenError"],"mappings":";;;;;AAaA,MAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,qBAAA;AAMzB,MAAM,eAAA,uBAA2C,GAAA,CAAI,CAAC,OAAO,WAAA,EAAa,MAAA,EAAQ,OAAA,EAAS,MAAM,CAAC,CAAA;AAClG,MAAM,cAAA,GAAiB,qCAAA;AACvB,MAAM,aAAA,GAAgB,cAAA;AACtB,MAAM,iBAAA,GAAoB,OAAA;AAC1B,MAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,YAAY,IAAA,EAAsB;AACzC,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,iBAAiB,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,eAAe,CAAA;AAC9C,EAAA,OAAO,KAAA,KAAU,EAAA,GAAK,EAAA,GAAK,IAAA,CAAK,MAAM,KAAK,CAAA;AAC7C;AAMA,SAAS,aAAa,WAAA,EAA6B;AACjD,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,GAC9D,IAAI,GAAA,CAAI,WAAW,CAAA,CAAE,QAAA,GACrB,WAAA;AACN;AAUO,SAAS,cAAA,CAAe,QAAgB,MAAA,EAA0B;AACvE,EAAA,MAAM,EAAE,WAAA,EAAa,QAAA,GAAW,EAAA,EAAG,GAAI,MAAA;AACvC,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,YAAA,CAAa,WAAW,CAAC,CAAA;AACvD,EAAA,MAAM,YAAY,eAAA,CAAgB,GAAA,CAAI,SAAS,CAAA,IAAK,cAAA,CAAe,KAAK,QAAQ,CAAA;AAChF,EAAA,OACE,MAAA,IACA,iBAAA,CAAkB,GAAA,CAAI,SAAS,CAAA,IAC/B,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,IAC7B,aAAA,CAAc,IAAA,CAAK,WAAW,KAAK,CAAC,SAAA;AAEzC;AAGA,MAAM,WAAA,GAAc,MAAA;AAGb,MAAM,eAAA,CAAgB;AAAA,EAClB,SAAA;AAAA,EACT,MAAA,GAAS,CAAA;AAAA,EAET,YAAY,QAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,EAA0B;AAC9B,IAAA,MAAM,QAAA,GAAW,CAAC,KAAA,KAAwB;AACxC,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,MAAA,IAAU,CAAA;AACf,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQA,qBAAA,CAAU,MAAA,CAAO,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,QAAA,EAAU,CAAA,EAAE;AAAA,EAC9F;AAAA,EAEA,SAAS,GAAA,EAA+C;AACtD,IAAA,OAAO,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,SAAA,GACtBC,mCAAkB,GAAA,EAAK;AAAA,MACrB,MAAA,EAAQ,iCAAA;AAAA,MACR,UAAU,IAAA,CAAK;AAAA,KAChB,CAAA,GACD,MAAA;AAAA,EACN;AACF;;;"}

package/dist/adapters/redocly-loader/remote-node-limit.mjs

@@ -0,0 +1,58 @@
+import { parseYaml } from '@redocly/openapi-core';
+import { refForbiddenError } from './schema-load-errors.mjs';
+
+const PARSED_EXTENSIONS = /* @__PURE__ */ new Set([".json", ".yml", ".yaml"]);
+const PARSED_MIME_TYPE = /(json|yaml|openapi)/;
+const TEXT_EXTENSIONS = /* @__PURE__ */ new Set([".md", ".markdown", ".txt", ".html", ".htm"]);
+const TEXT_MIME_TYPE = /^text\/(markdown|x-markdown|html)\b/;
+const REMOTE_URL_RE = /^https?:\/\//;
+const PATH_SEPARATOR_RE = /[/\\]/;
+const EXTENSION_START = ".";
+function extensionOf(path) {
+  const name = path.split(PATH_SEPARATOR_RE).at(-1) ?? "";
+  const start = name.lastIndexOf(EXTENSION_START);
+  return start === -1 ? "" : name.slice(start);
+}
+function documentPath(absoluteRef) {
+  return REMOTE_URL_RE.test(absoluteRef) && URL.canParse(absoluteRef) ? new URL(absoluteRef).pathname : absoluteRef;
+}
+function isParsedSource(source, isRoot) {
+  const { absoluteRef, mimeType = "" } = source;
+  const extension = extensionOf(documentPath(absoluteRef));
+  const isTextUrl = TEXT_EXTENSIONS.has(extension) || TEXT_MIME_TYPE.test(mimeType);
+  return isRoot || PARSED_EXTENSIONS.has(extension) || PARSED_MIME_TYPE.test(mimeType) || REMOTE_URL_RE.test(absoluteRef) && !isTextUrl;
+}
+const NODE_OPENED = "open";
+class RemoteNodeLimit {
+  #maxNodes;
+  #nodes = 0;
+  constructor(maxNodes) {
+    this.#maxNodes = maxNodes;
+  }
+  /**
+   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`
+   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.
+   */
+  parse(source) {
+    const listener = (event) => {
+      if (event !== NODE_OPENED) {
+        return;
+      }
+      this.#nodes += 1;
+      const refusal = this.#refusal(source.absoluteRef);
+      if (refusal !== void 0) {
+        throw refusal;
+      }
+    };
+    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };
+  }
+  #refusal(url) {
+    return this.#nodes > this.#maxNodes ? refForbiddenError(url, {
+      reason: "remote-documents-too-many-nodes",
+      maxNodes: this.#maxNodes
+    }) : void 0;
+  }
+}
+
+export { RemoteNodeLimit, isParsedSource };
+//# sourceMappingURL=remote-node-limit.mjs.map

package/dist/adapters/redocly-loader/remote-node-limit.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-node-limit.mjs","sources":["../../../src/adapters/redocly-loader/remote-node-limit.ts"],"sourcesContent":["import { type Document, parseYaml, type Source } from \"@redocly/openapi-core\";\nimport type { OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Bounds the parsed size of the remote documents of one load (threat model T2). The byte limits\n * do not bound memory: parsing multiplies it by the density of the text, and 250 MiB of `{},`\n * (87 million empty objects, under a quarter of a megabyte as gzip) took the process past its\n * 4 GB heap. The parser reports every node it builds, keys included, and the parse stops when\n * the nodes of all remote documents of the load pass the limit, before their memory is taken.\n */\n\n/** The extensions that Redocly 1.34's `BaseResolver.parseDocument` parses as YAML or JSON. */\nconst PARSED_EXTENSIONS: ReadonlySet<string> = new Set([\".json\", \".yml\", \".yaml\"]);\nconst PARSED_MIME_TYPE = /(json|yaml|openapi)/;\n/**\n * The text formats that a `$ref` loads as text, as a `description` from a Markdown file. A URL\n * keeps its document as text only when its extension or type names one of them: the last segment\n * of an API's path often has a dot that is no file type (`/schemas/v1.0`, `/schemas/pet.v2`).\n */\nconst TEXT_EXTENSIONS: ReadonlySet<string> = new Set([\".md\", \".markdown\", \".txt\", \".html\", \".htm\"]);\nconst TEXT_MIME_TYPE = /^text\\/(markdown|x-markdown|html)\\b/;\nconst REMOTE_URL_RE = /^https?:\\/\\//;\nconst PATH_SEPARATOR_RE = /[/\\\\]/;\nconst EXTENSION_START = \".\";\n\n/** The extension of the last segment of a path, with its dot; empty when it has none. */\nfunction extensionOf(path: string): string {\n  const name = path.split(PATH_SEPARATOR_RE).at(-1) ?? \"\";\n  const start = name.lastIndexOf(EXTENSION_START);\n  return start === -1 ? \"\" : name.slice(start);\n}\n\n/**\n * The path of a document: the path of a URL, without its query and fragment, or the file path.\n * Redocly took the extension of the whole URL, so `pet.yaml?token=…` had none it knew.\n */\nfunction documentPath(absoluteRef: string): string {\n  return REMOTE_URL_RE.test(absoluteRef) && URL.canParse(absoluteRef)\n    ? new URL(absoluteRef).pathname\n    : absoluteRef;\n}\n\n/**\n * Whether a source is parsed as YAML or JSON, or kept as text (a Markdown `description`, say).\n * It is parsed when it is the root, when its type or the extension of its path says JSON or YAML,\n * and when it is a URL whose path and type name no text format: an API serves its documents at\n * paths like `/schemas/pet` or `/schemas/v1.0`, often as `text/plain`, and Redocly kept those as\n * text, which failed as a schema. A local file is kept as text unless its name says JSON or YAML,\n * as Redocly keeps it.\n */\nexport function isParsedSource(source: Source, isRoot: boolean): boolean {\n  const { absoluteRef, mimeType = \"\" } = source;\n  const extension = extensionOf(documentPath(absoluteRef));\n  const isTextUrl = TEXT_EXTENSIONS.has(extension) || TEXT_MIME_TYPE.test(mimeType);\n  return (\n    isRoot ||\n    PARSED_EXTENSIONS.has(extension) ||\n    PARSED_MIME_TYPE.test(mimeType) ||\n    (REMOTE_URL_RE.test(absoluteRef) && !isTextUrl)\n  );\n}\n\n/** The parser's event for a node it starts to build. */\nconst NODE_OPENED = \"open\";\n\n/** One instance per load: the count covers every remote document of that load. */\nexport class RemoteNodeLimit {\n  readonly #maxNodes: number;\n  #nodes = 0;\n\n  constructor(maxNodes: number) {\n    this.#maxNodes = maxNodes;\n  }\n\n  /**\n   * The parsed document of `source`, as Redocly parses it. Fails with `SCHEMA_REF_FORBIDDEN`\n   * (`remote-documents-too-many-nodes`) once the nodes of the load pass the limit.\n   */\n  parse(source: Source): Document {\n    const listener = (event: string): void => {\n      if (event !== NODE_OPENED) {\n        return;\n      }\n      this.#nodes += 1;\n      const refusal = this.#refusal(source.absoluteRef);\n      if (refusal !== undefined) {\n        throw refusal;\n      }\n    };\n    return { source, parsed: parseYaml(source.body, { filename: source.absoluteRef, listener }) };\n  }\n\n  #refusal(url: string): OpenAPITypesafeError | undefined {\n    return this.#nodes > this.#maxNodes\n      ? refForbiddenError(url, {\n          reason: \"remote-documents-too-many-nodes\",\n          maxNodes: this.#maxNodes,\n        })\n      : undefined;\n  }\n}\n"],"names":[],"mappings":";;;AAaA,MAAM,oCAAyC,IAAI,GAAA,CAAI,CAAC,OAAA,EAAS,MAAA,EAAQ,OAAO,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,qBAAA;AAMzB,MAAM,eAAA,uBAA2C,GAAA,CAAI,CAAC,OAAO,WAAA,EAAa,MAAA,EAAQ,OAAA,EAAS,MAAM,CAAC,CAAA;AAClG,MAAM,cAAA,GAAiB,qCAAA;AACvB,MAAM,aAAA,GAAgB,cAAA;AACtB,MAAM,iBAAA,GAAoB,OAAA;AAC1B,MAAM,eAAA,GAAkB,GAAA;AAGxB,SAAS,YAAY,IAAA,EAAsB;AACzC,EAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,iBAAiB,CAAA,CAAE,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AACrD,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,eAAe,CAAA;AAC9C,EAAA,OAAO,KAAA,KAAU,EAAA,GAAK,EAAA,GAAK,IAAA,CAAK,MAAM,KAAK,CAAA;AAC7C;AAMA,SAAS,aAAa,WAAA,EAA6B;AACjD,EAAA,OAAO,aAAA,CAAc,IAAA,CAAK,WAAW,CAAA,IAAK,GAAA,CAAI,QAAA,CAAS,WAAW,CAAA,GAC9D,IAAI,GAAA,CAAI,WAAW,CAAA,CAAE,QAAA,GACrB,WAAA;AACN;AAUO,SAAS,cAAA,CAAe,QAAgB,MAAA,EAA0B;AACvE,EAAA,MAAM,EAAE,WAAA,EAAa,QAAA,GAAW,EAAA,EAAG,GAAI,MAAA;AACvC,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,YAAA,CAAa,WAAW,CAAC,CAAA;AACvD,EAAA,MAAM,YAAY,eAAA,CAAgB,GAAA,CAAI,SAAS,CAAA,IAAK,cAAA,CAAe,KAAK,QAAQ,CAAA;AAChF,EAAA,OACE,MAAA,IACA,iBAAA,CAAkB,GAAA,CAAI,SAAS,CAAA,IAC/B,gBAAA,CAAiB,IAAA,CAAK,QAAQ,CAAA,IAC7B,aAAA,CAAc,IAAA,CAAK,WAAW,KAAK,CAAC,SAAA;AAEzC;AAGA,MAAM,WAAA,GAAc,MAAA;AAGb,MAAM,eAAA,CAAgB;AAAA,EAClB,SAAA;AAAA,EACT,MAAA,GAAS,CAAA;AAAA,EAET,YAAY,QAAA,EAAkB;AAC5B,IAAA,IAAA,CAAK,SAAA,GAAY,QAAA;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAA,EAA0B;AAC9B,IAAA,MAAM,QAAA,GAAW,CAAC,KAAA,KAAwB;AACxC,MAAA,IAAI,UAAU,WAAA,EAAa;AACzB,QAAA;AAAA,MACF;AACA,MAAA,IAAA,CAAK,MAAA,IAAU,CAAA;AACf,MAAA,MAAM,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAW,CAAA;AAChD,MAAA,IAAI,YAAY,MAAA,EAAW;AACzB,QAAA,MAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA;AACA,IAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,SAAA,CAAU,MAAA,CAAO,IAAA,EAAM,EAAE,QAAA,EAAU,MAAA,CAAO,WAAA,EAAa,QAAA,EAAU,CAAA,EAAE;AAAA,EAC9F;AAAA,EAEA,SAAS,GAAA,EAA+C;AACtD,IAAA,OAAO,IAAA,CAAK,MAAA,GAAS,IAAA,CAAK,SAAA,GACtB,kBAAkB,GAAA,EAAK;AAAA,MACrB,MAAA,EAAQ,iCAAA;AAAA,MACR,UAAU,IAAA,CAAK;AAAA,KAChB,CAAA,GACD,MAAA;AAAA,EACN;AACF;;"}

package/dist/adapters/redocly-loader/schema-load-errors.cjs

@@ -2,7 +2,7 @@
 
 const assertNever = require('../../domain/assert-never.cjs');
 const errors = require('../../domain/errors.cjs');
-const urlCredentials = require('../../domain/url-credentials.cjs');
+const urlSecrets = require('../../domain/url-secrets.cjs');
 
 function sourceEmptyError(message) {
   return new errors.OpenAPITypesafeError({ code: errors.ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });
@@ -15,23 +15,32 @@ function sourceInvalidError(source) {
     details: { received }
   });
 }
+function urlInvalidError(text) {
+  return new errors.OpenAPITypesafeError({
+    code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
+    message: `The string ${urlSecrets.redactUnparsedUrl(text)} starts like a URL but is not a valid URL`,
+    details: { reason: "url", received: "string" }
+  });
+}
 function causeMessage(cause) {
   return cause instanceof Error ? cause.message : String(cause);
 }
 const SOURCE_TEXT_IN_MESSAGE = 200;
-function pathStringError(text) {
+const LOAD_FILE_ADVICE = "To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.";
+function pathStringError(text, origin) {
   const shown = text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}\u2026` : text;
+  const message = origin === "string" ? `The string "${shown}" was parsed as YAML text, not loaded as a file. ${LOAD_FILE_ADVICE}` : `The stream held only the YAML string "${shown}", not an OpenAPI document. ` + LOAD_FILE_ADVICE;
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_SOURCE_INVALID,
-    message: `The string "${shown}" was parsed as YAML text, not loaded as a file. To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.`,
-    details: { reason: "path", received: "string" }
+    message,
+    details: { reason: "path", received: origin, text: shown }
   });
 }
 function loadFailedError(absoluteRef, cause) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_LOAD_FAILED,
     message: causeMessage(cause),
-    details: { source: urlCredentials.redactUrlCredentials(absoluteRef) },
+    details: { source: urlSecrets.redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -39,7 +48,7 @@ function parseFailedError(format, absoluteRef, cause) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_PARSE_FAILED,
     message: causeMessage(cause),
-    details: { format, source: urlCredentials.redactUrlCredentials(absoluteRef) },
+    details: { format, source: urlSecrets.redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -54,7 +63,7 @@ function schemaInvalidError(problems) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_INVALID,
     message: problems.at(-1) ?? "",
-    details: { problems: problems.map(urlCredentials.redactUrlCredentials) }
+    details: { problems: problems.map(urlSecrets.redactUrlSecrets) }
   });
 }
 function refCycleError(cause) {
@@ -68,6 +77,10 @@ function refCycleError(cause) {
 function hostListText(hosts) {
   return hosts.length === 0 ? "none" : hosts.join(", ");
 }
+const BYTES_PER_MEBIBYTE = 1024 * 1024;
+function sizeText(bytes) {
+  return bytes % BYTES_PER_MEBIBYTE === 0 ? `${bytes / BYTES_PER_MEBIBYTE} MiB` : `${bytes} bytes`;
+}
 function limitText(details) {
   switch (details.reason) {
     case "outside-local-root":
@@ -80,6 +93,16 @@ function limitText(details) {
       return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;
     case "too-many-remote-documents":
       return `the document refers to more than ${details.maxDocuments} remote documents`;
+    case "remote-document-too-large":
+      return `its body is larger than ${sizeText(details.maxDocumentBytes)} once decoded`;
+    case "remote-documents-too-large": {
+      const limit = sizeText(details.maxTotalBytes);
+      return `the remote documents of this run are larger than ${limit} together once decoded`;
+    }
+    case "remote-documents-too-many-nodes": {
+      const limit = details.maxNodes;
+      return `the remote documents of this run parse into more than ${limit} nodes together`;
+    }
     default:
       return assertNever.assertNever(details);
   }
@@ -89,7 +112,7 @@ function refForbiddenError(ref, details) {
   return new errors.OpenAPITypesafeError({
     code: errors.ERROR_CODES.SCHEMA_REF_FORBIDDEN,
     message: `Refused to load ${ref}: ${limit}`,
-    details: { ref: urlCredentials.redactUrlCredentials(ref), ...details }
+    details: { ref: urlSecrets.redactUrlSecrets(ref), ...details }
   });
 }
 
@@ -101,5 +124,6 @@ exports.refForbiddenError = refForbiddenError;
 exports.schemaInvalidError = schemaInvalidError;
 exports.sourceEmptyError = sourceEmptyError;
 exports.sourceInvalidError = sourceInvalidError;
+exports.urlInvalidError = urlInvalidError;
 exports.versionUnsupportedError = versionUnsupportedError;
 //# sourceMappingURL=schema-load-errors.cjs.map

package/dist/adapters/redocly-loader/schema-load-errors.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-load-errors.cjs","sources":["../../../src/adapters/redocly-loader/schema-load-errors.ts"],"sourcesContent":["import { assertNever } from \"../../domain/assert-never.js\";\nimport { ERROR_CODES, OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlCredentials } from \"../../domain/url-credentials.js\";\n\n/**\n * The typed errors of loading, validating and bundling a document (ADR-011). Messages are the\n * original messages, so Node API users who match on them keep working; URLs in them and in the\n * details never show user info.\n */\n\n/** No source was given, or the source is empty. */\nexport function sourceEmptyError(message: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });\n}\n\n/** The source is neither a URL, text, buffer, stream nor plain object. */\nexport function sourceInvalidError(source: unknown): OpenAPITypesafeError {\n  const received = Array.isArray(source) ? \"Array\" : typeof source;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `Expected string, object, or Buffer. Got ${received}`,\n    details: { received },\n  });\n}\n\nfunction causeMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n\n/** Enough of a source string to recognise it in the message. */\nconst SOURCE_TEXT_IN_MESSAGE = 200;\n\n/**\n * A string source is document text, so a file path parses as a YAML string scalar, not as a\n * document (docs/node.md). The message says how to load the file instead.\n */\nexport function pathStringError(text: string): OpenAPITypesafeError {\n  const shown =\n    text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}…` : text;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message:\n      `The string \"${shown}\" was parsed as YAML text, not loaded as a file. ` +\n      \"To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.\",\n    details: { reason: \"path\", received: \"string\" },\n  });\n}\n\n/** Reading the document from a file or URL failed; the message is the reader's message. */\nexport function loadFailedError(absoluteRef: string, cause: unknown): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_LOAD_FAILED,\n    message: causeMessage(cause),\n    details: { source: redactUrlCredentials(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document text is not valid JSON or YAML; the message is the parser's message. */\nexport function parseFailedError(\n  format: \"json\" | \"yaml\",\n  absoluteRef: string,\n  cause: unknown,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_PARSE_FAILED,\n    message: causeMessage(cause),\n    details: { format, source: redactUrlCredentials(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document is not OpenAPI 3.x. */\nexport function versionUnsupportedError(\n  message: string,\n  parsed: Readonly<Record<string, unknown>>,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,\n    message,\n    details: { openapi: parsed.openapi, swagger: parsed.swagger },\n  });\n}\n\n/**\n * Linting or bundling found errors. The message is the last error, as in the original; all error\n * messages are in `details.problems`.\n */\nexport function schemaInvalidError(problems: readonly string[]): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_INVALID,\n    message: problems.at(-1) ?? \"\",\n    details: { problems: problems.map(redactUrlCredentials) },\n  });\n}\n\n/** A `$ref` chain points back to itself with no schema in between (`A: $ref B`, `B: $ref A`). */\nexport function refCycleError(cause: Error): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_INVALID,\n    message: cause.message,\n    details: { reason: \"cycle\" },\n    cause,\n  });\n}\n\nfunction hostListText(hosts: readonly string[]): string {\n  return hosts.length === 0 ? \"none\" : hosts.join(\", \");\n}\n\n/** Why a `$ref` document was refused, with the limit it broke (ADR-017). */\nexport type RefRefusalDetails =\n  | { readonly reason: \"outside-local-root\"; readonly localRoot: string }\n  | { readonly reason: \"host-not-allowed\"; readonly allowedHosts: readonly string[] }\n  | { readonly reason: \"local-ref-from-remote\"; readonly base: string }\n  | { readonly reason: \"too-many-remote-documents\"; readonly maxDocuments: number };\n\nfunction limitText(details: RefRefusalDetails): string {\n  switch (details.reason) {\n    case \"outside-local-root\":\n      return `it is outside the local $ref root ${details.localRoot}`;\n    case \"host-not-allowed\": {\n      const hosts = hostListText(details.allowedHosts);\n      return `its host is not in the allowed remote $ref hosts (${hosts})`;\n    }\n    case \"local-ref-from-remote\":\n      return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;\n    case \"too-many-remote-documents\":\n      return `the document refers to more than ${details.maxDocuments} remote documents`;\n    default:\n      return assertNever(details);\n  }\n}\n\n/**\n * A `$ref` is outside the local root, its host is not allowed (threat model R1, R2), a remote\n * document refers to a local file (T3), or there are too many remote documents (T2).\n */\nexport function refForbiddenError(ref: string, details: RefRefusalDetails): OpenAPITypesafeError {\n  const limit = limitText(details);\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,\n    message: `Refused to load ${ref}: ${limit}`,\n    details: { ref: redactUrlCredentials(ref), ...details },\n  });\n}\n"],"names":["OpenAPITypesafeError","ERROR_CODES","redactUrlCredentials","assertNever"],"mappings":";;;;;;AAWO,SAAS,iBAAiB,OAAA,EAAuC;AACtE,EAAA,OAAO,IAAIA,2BAAA,CAAqB,EAAE,MAAMC,kBAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA;AACpF;AAGO,SAAS,mBAAmB,MAAA,EAAuC;AACxE,EAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,UAAU,OAAO,MAAA;AAC1D,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,2CAA2C,QAAQ,CAAA,CAAA;AAAA,IAC5D,OAAA,EAAS,EAAE,QAAA;AAAS,GACrB,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAGA,MAAM,sBAAA,GAAyB,GAAA;AAMxB,SAAS,gBAAgB,IAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,MAAA,GAAS,sBAAA,GAAyB,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAC,CAAA,MAAA,CAAA,GAAM,IAAA;AACvF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EACE,eAAe,KAAK,CAAA,0HAAA,CAAA;AAAA,IAEtB,OAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,UAAU,QAAA;AAAS,GAC/C,CAAA;AACH;AAGO,SAAS,eAAA,CAAgB,aAAqB,KAAA,EAAsC;AACzF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQC,mCAAA,CAAqB,WAAW,CAAA,EAAE;AAAA,IACrD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,gBAAA,CACd,MAAA,EACA,WAAA,EACA,KAAA,EACsB;AACtB,EAAA,OAAO,IAAIF,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,mBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,SAAS,EAAE,MAAA,EAAQ,MAAA,EAAQC,mCAAA,CAAqB,WAAW,CAAA,EAAE;AAAA,IAC7D;AAAA,GACD,CAAA;AACH;AAGO,SAAS,uBAAA,CACd,SACA,MAAA,EACsB;AACtB,EAAA,OAAO,IAAIF,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,0BAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,OAAO,OAAA;AAAQ,GAC7D,CAAA;AACH;AAMO,SAAS,mBAAmB,QAAA,EAAmD;AACpF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,cAAA;AAAA,IAClB,OAAA,EAAS,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AAAA,IAC5B,SAAS,EAAE,QAAA,EAAU,QAAA,CAAS,GAAA,CAAIC,mCAAoB,CAAA;AAAE,GACzD,CAAA;AACH;AAGO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,IAAIF,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACD,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAkC;AACtD,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtD;AASA,SAAS,UAAU,OAAA,EAAoC;AACrD,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,oBAAA;AACH,MAAA,OAAO,CAAA,kCAAA,EAAqC,QAAQ,SAAS,CAAA,CAAA;AAAA,IAC/D,KAAK,kBAAA,EAAoB;AACvB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,YAAY,CAAA;AAC/C,MAAA,OAAO,qDAAqD,KAAK,CAAA,CAAA,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,uBAAA;AACH,MAAA,OAAO,CAAA,iEAAA,EAAoE,QAAQ,IAAI,CAAA,CAAA;AAAA,IACzF,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,iCAAA,EAAoC,QAAQ,YAAY,CAAA,iBAAA,CAAA;AAAA,IACjE;AACE,MAAA,OAAOE,wBAAY,OAAO,CAAA;AAAA;AAEhC;AAMO,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAkD;AAC/F,EAAA,MAAM,KAAA,GAAQ,UAAU,OAAO,CAAA;AAC/B,EAAA,OAAO,IAAIH,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,oBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,gBAAA,EAAmB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,IACzC,SAAS,EAAE,GAAA,EAAKC,oCAAqB,GAAG,CAAA,EAAG,GAAG,OAAA;AAAQ,GACvD,CAAA;AACH;;;;;;;;;;"}
+{"version":3,"file":"schema-load-errors.cjs","sources":["../../../src/adapters/redocly-loader/schema-load-errors.ts"],"sourcesContent":["import { assertNever } from \"../../domain/assert-never.js\";\nimport { ERROR_CODES, OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUnparsedUrl, redactUrlSecrets } from \"../../domain/url-secrets.js\";\n\n/**\n * The typed errors of loading, validating and bundling a document (ADR-011). Messages are the\n * original messages, so Node API users who match on them keep working; URLs in them and in the\n * details never show user info.\n */\n\n/** No source was given, or the source is empty. */\nexport function sourceEmptyError(message: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });\n}\n\n/** The source is neither a URL, text, buffer, stream nor plain object. */\nexport function sourceInvalidError(source: unknown): OpenAPITypesafeError {\n  const received = Array.isArray(source) ? \"Array\" : typeof source;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `Expected string, object, or Buffer. Got ${received}`,\n    details: { received },\n  });\n}\n\n/** A source string starts with a URL scheme but does not parse as a URL. */\nexport function urlInvalidError(text: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `The string ${redactUnparsedUrl(text)} starts like a URL but is not a valid URL`,\n    details: { reason: \"url\", received: \"string\" },\n  });\n}\n\nfunction causeMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n\n/** Enough of a source string to recognise it in the message. */\nconst SOURCE_TEXT_IN_MESSAGE = 200;\n\n/** Where document text that is only a YAML string came from. */\nexport type TextOrigin = \"string\" | \"stream\";\n\nconst LOAD_FILE_ADVICE =\n  \"To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.\";\n\n/**\n * A string source is document text, so a file path parses as a YAML string scalar, not as a\n * document (docs/node.md). The message says how to load the file instead. Text read from a\n * stream (stdin in the CLI) is named as such; `details.text` lets the CLI give its own advice.\n */\nexport function pathStringError(text: string, origin: TextOrigin): OpenAPITypesafeError {\n  const shown =\n    text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}…` : text;\n  const message =\n    origin === \"string\"\n      ? `The string \"${shown}\" was parsed as YAML text, not loaded as a file. ${LOAD_FILE_ADVICE}`\n      : `The stream held only the YAML string \"${shown}\", not an OpenAPI document. ` +\n        LOAD_FILE_ADVICE;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message,\n    details: { reason: \"path\", received: origin, text: shown },\n  });\n}\n\n/** Reading the document from a file or URL failed; the message is the reader's message. */\nexport function loadFailedError(absoluteRef: string, cause: unknown): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_LOAD_FAILED,\n    message: causeMessage(cause),\n    details: { source: redactUrlSecrets(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document text is not valid JSON or YAML; the message is the parser's message. */\nexport function parseFailedError(\n  format: \"json\" | \"yaml\",\n  absoluteRef: string,\n  cause: unknown,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_PARSE_FAILED,\n    message: causeMessage(cause),\n    details: { format, source: redactUrlSecrets(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document is not OpenAPI 3.x. */\nexport function versionUnsupportedError(\n  message: string,\n  parsed: Readonly<Record<string, unknown>>,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,\n    message,\n    details: { openapi: parsed.openapi, swagger: parsed.swagger },\n  });\n}\n\n/**\n * Linting or bundling found errors. The message is the last error, as in the original; all error\n * messages are in `details.problems`.\n */\nexport function schemaInvalidError(problems: readonly string[]): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_INVALID,\n    message: problems.at(-1) ?? \"\",\n    details: { problems: problems.map(redactUrlSecrets) },\n  });\n}\n\n/** A `$ref` chain points back to itself with no schema in between (`A: $ref B`, `B: $ref A`). */\nexport function refCycleError(cause: Error): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_INVALID,\n    message: cause.message,\n    details: { reason: \"cycle\" },\n    cause,\n  });\n}\n\nfunction hostListText(hosts: readonly string[]): string {\n  return hosts.length === 0 ? \"none\" : hosts.join(\", \");\n}\n\n/** Why a `$ref` document was refused, with the limit it broke (ADR-017). */\nexport type RefRefusalDetails =\n  | { readonly reason: \"outside-local-root\"; readonly localRoot: string }\n  | { readonly reason: \"host-not-allowed\"; readonly allowedHosts: readonly string[] }\n  | { readonly reason: \"local-ref-from-remote\"; readonly base: string }\n  | { readonly reason: \"too-many-remote-documents\"; readonly maxDocuments: number }\n  | { readonly reason: \"remote-document-too-large\"; readonly maxDocumentBytes: number }\n  | { readonly reason: \"remote-documents-too-large\"; readonly maxTotalBytes: number }\n  | { readonly reason: \"remote-documents-too-many-nodes\"; readonly maxNodes: number };\n\nconst BYTES_PER_MEBIBYTE = 1024 * 1024;\n\n/** A byte count in MiB, as the limits are chosen: `256 MiB`; a smaller limit in bytes. */\nfunction sizeText(bytes: number): string {\n  return bytes % BYTES_PER_MEBIBYTE === 0 ? `${bytes / BYTES_PER_MEBIBYTE} MiB` : `${bytes} bytes`;\n}\n\nfunction limitText(details: RefRefusalDetails): string {\n  switch (details.reason) {\n    case \"outside-local-root\":\n      return `it is outside the local $ref root ${details.localRoot}`;\n    case \"host-not-allowed\": {\n      const hosts = hostListText(details.allowedHosts);\n      return `its host is not in the allowed remote $ref hosts (${hosts})`;\n    }\n    case \"local-ref-from-remote\":\n      return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;\n    case \"too-many-remote-documents\":\n      return `the document refers to more than ${details.maxDocuments} remote documents`;\n    case \"remote-document-too-large\":\n      return `its body is larger than ${sizeText(details.maxDocumentBytes)} once decoded`;\n    case \"remote-documents-too-large\": {\n      const limit = sizeText(details.maxTotalBytes);\n      return `the remote documents of this run are larger than ${limit} together once decoded`;\n    }\n    case \"remote-documents-too-many-nodes\": {\n      const limit = details.maxNodes;\n      return `the remote documents of this run parse into more than ${limit} nodes together`;\n    }\n    default:\n      return assertNever(details);\n  }\n}\n\n/**\n * A `$ref` is outside the local root, its host is not allowed (threat model R1, R2), a remote\n * document refers to a local file (T3), or there are too many or too large remote documents (T2).\n */\nexport function refForbiddenError(ref: string, details: RefRefusalDetails): OpenAPITypesafeError {\n  const limit = limitText(details);\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,\n    message: `Refused to load ${ref}: ${limit}`,\n    details: { ref: redactUrlSecrets(ref), ...details },\n  });\n}\n"],"names":["OpenAPITypesafeError","ERROR_CODES","redactUnparsedUrl","redactUrlSecrets","assertNever"],"mappings":";;;;;;AAWO,SAAS,iBAAiB,OAAA,EAAuC;AACtE,EAAA,OAAO,IAAIA,2BAAA,CAAqB,EAAE,MAAMC,kBAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA;AACpF;AAGO,SAAS,mBAAmB,MAAA,EAAuC;AACxE,EAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,UAAU,OAAO,MAAA;AAC1D,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,2CAA2C,QAAQ,CAAA,CAAA;AAAA,IAC5D,OAAA,EAAS,EAAE,QAAA;AAAS,GACrB,CAAA;AACH;AAGO,SAAS,gBAAgB,IAAA,EAAoC;AAClE,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,WAAA,EAAcC,4BAAA,CAAkB,IAAI,CAAC,CAAA,yCAAA,CAAA;AAAA,IAC9C,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,UAAU,QAAA;AAAS,GAC9C,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAGA,MAAM,sBAAA,GAAyB,GAAA;AAK/B,MAAM,gBAAA,GACJ,2EAAA;AAOK,SAAS,eAAA,CAAgB,MAAc,MAAA,EAA0C;AACtF,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,MAAA,GAAS,sBAAA,GAAyB,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAC,CAAA,MAAA,CAAA,GAAM,IAAA;AACvF,EAAA,MAAM,OAAA,GACJ,MAAA,KAAW,QAAA,GACP,CAAA,YAAA,EAAe,KAAK,oDAAoD,gBAAgB,CAAA,CAAA,GACxF,CAAA,sCAAA,EAAyC,KAAK,CAAA,4BAAA,CAAA,GAC9C,gBAAA;AACN,EAAA,OAAO,IAAIF,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,qBAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,MAAA,EAAQ,QAAQ,QAAA,EAAU,MAAA,EAAQ,MAAM,KAAA;AAAM,GAC1D,CAAA;AACH;AAGO,SAAS,eAAA,CAAgB,aAAqB,KAAA,EAAsC;AACzF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQE,2BAAA,CAAiB,WAAW,CAAA,EAAE;AAAA,IACjD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,gBAAA,CACd,MAAA,EACA,WAAA,EACA,KAAA,EACsB;AACtB,EAAA,OAAO,IAAIH,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,mBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,SAAS,EAAE,MAAA,EAAQ,MAAA,EAAQE,2BAAA,CAAiB,WAAW,CAAA,EAAE;AAAA,IACzD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,uBAAA,CACd,SACA,MAAA,EACsB;AACtB,EAAA,OAAO,IAAIH,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,0BAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,OAAO,OAAA;AAAQ,GAC7D,CAAA;AACH;AAMO,SAAS,mBAAmB,QAAA,EAAmD;AACpF,EAAA,OAAO,IAAID,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,cAAA;AAAA,IAClB,OAAA,EAAS,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AAAA,IAC5B,SAAS,EAAE,QAAA,EAAU,QAAA,CAAS,GAAA,CAAIE,2BAAgB,CAAA;AAAE,GACrD,CAAA;AACH;AAGO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,IAAIH,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,kBAAA;AAAA,IAClB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACD,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAkC;AACtD,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtD;AAYA,MAAM,qBAAqB,IAAA,GAAO,IAAA;AAGlC,SAAS,SAAS,KAAA,EAAuB;AACvC,EAAA,OAAO,KAAA,GAAQ,uBAAuB,CAAA,GAAI,CAAA,EAAG,QAAQ,kBAAkB,CAAA,IAAA,CAAA,GAAS,GAAG,KAAK,CAAA,MAAA,CAAA;AAC1F;AAEA,SAAS,UAAU,OAAA,EAAoC;AACrD,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,oBAAA;AACH,MAAA,OAAO,CAAA,kCAAA,EAAqC,QAAQ,SAAS,CAAA,CAAA;AAAA,IAC/D,KAAK,kBAAA,EAAoB;AACvB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,YAAY,CAAA;AAC/C,MAAA,OAAO,qDAAqD,KAAK,CAAA,CAAA,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,uBAAA;AACH,MAAA,OAAO,CAAA,iEAAA,EAAoE,QAAQ,IAAI,CAAA,CAAA;AAAA,IACzF,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,iCAAA,EAAoC,QAAQ,YAAY,CAAA,iBAAA,CAAA;AAAA,IACjE,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,wBAAA,EAA2B,QAAA,CAAS,OAAA,CAAQ,gBAAgB,CAAC,CAAA,aAAA,CAAA;AAAA,IACtE,KAAK,4BAAA,EAA8B;AACjC,MAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA;AAC5C,MAAA,OAAO,oDAAoD,KAAK,CAAA,sBAAA,CAAA;AAAA,IAClE;AAAA,IACA,KAAK,iCAAA,EAAmC;AACtC,MAAA,MAAM,QAAQ,OAAA,CAAQ,QAAA;AACtB,MAAA,OAAO,yDAAyD,KAAK,CAAA,eAAA,CAAA;AAAA,IACvE;AAAA,IACA;AACE,MAAA,OAAOG,wBAAY,OAAO,CAAA;AAAA;AAEhC;AAMO,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAkD;AAC/F,EAAA,MAAM,KAAA,GAAQ,UAAU,OAAO,CAAA;AAC/B,EAAA,OAAO,IAAIJ,2BAAA,CAAqB;AAAA,IAC9B,MAAMC,kBAAA,CAAY,oBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,gBAAA,EAAmB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,IACzC,SAAS,EAAE,GAAA,EAAKE,4BAAiB,GAAG,CAAA,EAAG,GAAG,OAAA;AAAQ,GACnD,CAAA;AACH;;;;;;;;;;;"}

package/dist/adapters/redocly-loader/schema-load-errors.mjs

@@ -1,6 +1,6 @@
 import { assertNever } from '../../domain/assert-never.mjs';
 import { OpenAPITypesafeError, ERROR_CODES } from '../../domain/errors.mjs';
-import { redactUrlCredentials } from '../../domain/url-credentials.mjs';
+import { redactUrlSecrets, redactUnparsedUrl } from '../../domain/url-secrets.mjs';
 
 function sourceEmptyError(message) {
   return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });
@@ -13,23 +13,32 @@ function sourceInvalidError(source) {
     details: { received }
   });
 }
+function urlInvalidError(text) {
+  return new OpenAPITypesafeError({
+    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,
+    message: `The string ${redactUnparsedUrl(text)} starts like a URL but is not a valid URL`,
+    details: { reason: "url", received: "string" }
+  });
+}
 function causeMessage(cause) {
   return cause instanceof Error ? cause.message : String(cause);
 }
 const SOURCE_TEXT_IN_MESSAGE = 200;
-function pathStringError(text) {
+const LOAD_FILE_ADVICE = "To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.";
+function pathStringError(text, origin) {
   const shown = text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}\u2026` : text;
+  const message = origin === "string" ? `The string "${shown}" was parsed as YAML text, not loaded as a file. ${LOAD_FILE_ADVICE}` : `The stream held only the YAML string "${shown}", not an OpenAPI document. ` + LOAD_FILE_ADVICE;
   return new OpenAPITypesafeError({
     code: ERROR_CODES.SCHEMA_SOURCE_INVALID,
-    message: `The string "${shown}" was parsed as YAML text, not loaded as a file. To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.`,
-    details: { reason: "path", received: "string" }
+    message,
+    details: { reason: "path", received: origin, text: shown }
   });
 }
 function loadFailedError(absoluteRef, cause) {
   return new OpenAPITypesafeError({
     code: ERROR_CODES.SCHEMA_LOAD_FAILED,
     message: causeMessage(cause),
-    details: { source: redactUrlCredentials(absoluteRef) },
+    details: { source: redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -37,7 +46,7 @@ function parseFailedError(format, absoluteRef, cause) {
   return new OpenAPITypesafeError({
     code: ERROR_CODES.SCHEMA_PARSE_FAILED,
     message: causeMessage(cause),
-    details: { format, source: redactUrlCredentials(absoluteRef) },
+    details: { format, source: redactUrlSecrets(absoluteRef) },
     cause
   });
 }
@@ -52,7 +61,7 @@ function schemaInvalidError(problems) {
   return new OpenAPITypesafeError({
     code: ERROR_CODES.SCHEMA_INVALID,
     message: problems.at(-1) ?? "",
-    details: { problems: problems.map(redactUrlCredentials) }
+    details: { problems: problems.map(redactUrlSecrets) }
   });
 }
 function refCycleError(cause) {
@@ -66,6 +75,10 @@ function refCycleError(cause) {
 function hostListText(hosts) {
   return hosts.length === 0 ? "none" : hosts.join(", ");
 }
+const BYTES_PER_MEBIBYTE = 1024 * 1024;
+function sizeText(bytes) {
+  return bytes % BYTES_PER_MEBIBYTE === 0 ? `${bytes / BYTES_PER_MEBIBYTE} MiB` : `${bytes} bytes`;
+}
 function limitText(details) {
   switch (details.reason) {
     case "outside-local-root":
@@ -78,6 +91,16 @@ function limitText(details) {
       return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;
     case "too-many-remote-documents":
       return `the document refers to more than ${details.maxDocuments} remote documents`;
+    case "remote-document-too-large":
+      return `its body is larger than ${sizeText(details.maxDocumentBytes)} once decoded`;
+    case "remote-documents-too-large": {
+      const limit = sizeText(details.maxTotalBytes);
+      return `the remote documents of this run are larger than ${limit} together once decoded`;
+    }
+    case "remote-documents-too-many-nodes": {
+      const limit = details.maxNodes;
+      return `the remote documents of this run parse into more than ${limit} nodes together`;
+    }
     default:
       return assertNever(details);
   }
@@ -87,9 +110,9 @@ function refForbiddenError(ref, details) {
   return new OpenAPITypesafeError({
     code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,
     message: `Refused to load ${ref}: ${limit}`,
-    details: { ref: redactUrlCredentials(ref), ...details }
+    details: { ref: redactUrlSecrets(ref), ...details }
   });
 }
 
-export { loadFailedError, parseFailedError, pathStringError, refCycleError, refForbiddenError, schemaInvalidError, sourceEmptyError, sourceInvalidError, versionUnsupportedError };
+export { loadFailedError, parseFailedError, pathStringError, refCycleError, refForbiddenError, schemaInvalidError, sourceEmptyError, sourceInvalidError, urlInvalidError, versionUnsupportedError };
 //# sourceMappingURL=schema-load-errors.mjs.map

package/dist/adapters/redocly-loader/schema-load-errors.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema-load-errors.mjs","sources":["../../../src/adapters/redocly-loader/schema-load-errors.ts"],"sourcesContent":["import { assertNever } from \"../../domain/assert-never.js\";\nimport { ERROR_CODES, OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlCredentials } from \"../../domain/url-credentials.js\";\n\n/**\n * The typed errors of loading, validating and bundling a document (ADR-011). Messages are the\n * original messages, so Node API users who match on them keep working; URLs in them and in the\n * details never show user info.\n */\n\n/** No source was given, or the source is empty. */\nexport function sourceEmptyError(message: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });\n}\n\n/** The source is neither a URL, text, buffer, stream nor plain object. */\nexport function sourceInvalidError(source: unknown): OpenAPITypesafeError {\n  const received = Array.isArray(source) ? \"Array\" : typeof source;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `Expected string, object, or Buffer. Got ${received}`,\n    details: { received },\n  });\n}\n\nfunction causeMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n\n/** Enough of a source string to recognise it in the message. */\nconst SOURCE_TEXT_IN_MESSAGE = 200;\n\n/**\n * A string source is document text, so a file path parses as a YAML string scalar, not as a\n * document (docs/node.md). The message says how to load the file instead.\n */\nexport function pathStringError(text: string): OpenAPITypesafeError {\n  const shown =\n    text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}…` : text;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message:\n      `The string \"${shown}\" was parsed as YAML text, not loaded as a file. ` +\n      \"To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.\",\n    details: { reason: \"path\", received: \"string\" },\n  });\n}\n\n/** Reading the document from a file or URL failed; the message is the reader's message. */\nexport function loadFailedError(absoluteRef: string, cause: unknown): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_LOAD_FAILED,\n    message: causeMessage(cause),\n    details: { source: redactUrlCredentials(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document text is not valid JSON or YAML; the message is the parser's message. */\nexport function parseFailedError(\n  format: \"json\" | \"yaml\",\n  absoluteRef: string,\n  cause: unknown,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_PARSE_FAILED,\n    message: causeMessage(cause),\n    details: { format, source: redactUrlCredentials(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document is not OpenAPI 3.x. */\nexport function versionUnsupportedError(\n  message: string,\n  parsed: Readonly<Record<string, unknown>>,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,\n    message,\n    details: { openapi: parsed.openapi, swagger: parsed.swagger },\n  });\n}\n\n/**\n * Linting or bundling found errors. The message is the last error, as in the original; all error\n * messages are in `details.problems`.\n */\nexport function schemaInvalidError(problems: readonly string[]): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_INVALID,\n    message: problems.at(-1) ?? \"\",\n    details: { problems: problems.map(redactUrlCredentials) },\n  });\n}\n\n/** A `$ref` chain points back to itself with no schema in between (`A: $ref B`, `B: $ref A`). */\nexport function refCycleError(cause: Error): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_INVALID,\n    message: cause.message,\n    details: { reason: \"cycle\" },\n    cause,\n  });\n}\n\nfunction hostListText(hosts: readonly string[]): string {\n  return hosts.length === 0 ? \"none\" : hosts.join(\", \");\n}\n\n/** Why a `$ref` document was refused, with the limit it broke (ADR-017). */\nexport type RefRefusalDetails =\n  | { readonly reason: \"outside-local-root\"; readonly localRoot: string }\n  | { readonly reason: \"host-not-allowed\"; readonly allowedHosts: readonly string[] }\n  | { readonly reason: \"local-ref-from-remote\"; readonly base: string }\n  | { readonly reason: \"too-many-remote-documents\"; readonly maxDocuments: number };\n\nfunction limitText(details: RefRefusalDetails): string {\n  switch (details.reason) {\n    case \"outside-local-root\":\n      return `it is outside the local $ref root ${details.localRoot}`;\n    case \"host-not-allowed\": {\n      const hosts = hostListText(details.allowedHosts);\n      return `its host is not in the allowed remote $ref hosts (${hosts})`;\n    }\n    case \"local-ref-from-remote\":\n      return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;\n    case \"too-many-remote-documents\":\n      return `the document refers to more than ${details.maxDocuments} remote documents`;\n    default:\n      return assertNever(details);\n  }\n}\n\n/**\n * A `$ref` is outside the local root, its host is not allowed (threat model R1, R2), a remote\n * document refers to a local file (T3), or there are too many remote documents (T2).\n */\nexport function refForbiddenError(ref: string, details: RefRefusalDetails): OpenAPITypesafeError {\n  const limit = limitText(details);\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,\n    message: `Refused to load ${ref}: ${limit}`,\n    details: { ref: redactUrlCredentials(ref), ...details },\n  });\n}\n"],"names":[],"mappings":";;;;AAWO,SAAS,iBAAiB,OAAA,EAAuC;AACtE,EAAA,OAAO,IAAI,oBAAA,CAAqB,EAAE,MAAM,WAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA;AACpF;AAGO,SAAS,mBAAmB,MAAA,EAAuC;AACxE,EAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,UAAU,OAAO,MAAA;AAC1D,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,2CAA2C,QAAQ,CAAA,CAAA;AAAA,IAC5D,OAAA,EAAS,EAAE,QAAA;AAAS,GACrB,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAGA,MAAM,sBAAA,GAAyB,GAAA;AAMxB,SAAS,gBAAgB,IAAA,EAAoC;AAClE,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,MAAA,GAAS,sBAAA,GAAyB,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAC,CAAA,MAAA,CAAA,GAAM,IAAA;AACvF,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EACE,eAAe,KAAK,CAAA,0HAAA,CAAA;AAAA,IAEtB,OAAA,EAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,UAAU,QAAA;AAAS,GAC/C,CAAA;AACH;AAGO,SAAS,eAAA,CAAgB,aAAqB,KAAA,EAAsC;AACzF,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,kBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAE;AAAA,IACrD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,gBAAA,CACd,MAAA,EACA,WAAA,EACA,KAAA,EACsB;AACtB,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,mBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,SAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,oBAAA,CAAqB,WAAW,CAAA,EAAE;AAAA,IAC7D;AAAA,GACD,CAAA;AACH;AAGO,SAAS,uBAAA,CACd,SACA,MAAA,EACsB;AACtB,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,0BAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,OAAO,OAAA;AAAQ,GAC7D,CAAA;AACH;AAMO,SAAS,mBAAmB,QAAA,EAAmD;AACpF,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,cAAA;AAAA,IAClB,OAAA,EAAS,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AAAA,IAC5B,SAAS,EAAE,QAAA,EAAU,QAAA,CAAS,GAAA,CAAI,oBAAoB,CAAA;AAAE,GACzD,CAAA;AACH;AAGO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,kBAAA;AAAA,IAClB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACD,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAkC;AACtD,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtD;AASA,SAAS,UAAU,OAAA,EAAoC;AACrD,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,oBAAA;AACH,MAAA,OAAO,CAAA,kCAAA,EAAqC,QAAQ,SAAS,CAAA,CAAA;AAAA,IAC/D,KAAK,kBAAA,EAAoB;AACvB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,YAAY,CAAA;AAC/C,MAAA,OAAO,qDAAqD,KAAK,CAAA,CAAA,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,uBAAA;AACH,MAAA,OAAO,CAAA,iEAAA,EAAoE,QAAQ,IAAI,CAAA,CAAA;AAAA,IACzF,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,iCAAA,EAAoC,QAAQ,YAAY,CAAA,iBAAA,CAAA;AAAA,IACjE;AACE,MAAA,OAAO,YAAY,OAAO,CAAA;AAAA;AAEhC;AAMO,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAkD;AAC/F,EAAA,MAAM,KAAA,GAAQ,UAAU,OAAO,CAAA;AAC/B,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,oBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,gBAAA,EAAmB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,IACzC,SAAS,EAAE,GAAA,EAAK,qBAAqB,GAAG,CAAA,EAAG,GAAG,OAAA;AAAQ,GACvD,CAAA;AACH;;"}
+{"version":3,"file":"schema-load-errors.mjs","sources":["../../../src/adapters/redocly-loader/schema-load-errors.ts"],"sourcesContent":["import { assertNever } from \"../../domain/assert-never.js\";\nimport { ERROR_CODES, OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUnparsedUrl, redactUrlSecrets } from \"../../domain/url-secrets.js\";\n\n/**\n * The typed errors of loading, validating and bundling a document (ADR-011). Messages are the\n * original messages, so Node API users who match on them keep working; URLs in them and in the\n * details never show user info.\n */\n\n/** No source was given, or the source is empty. */\nexport function sourceEmptyError(message: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({ code: ERROR_CODES.SCHEMA_SOURCE_EMPTY, message });\n}\n\n/** The source is neither a URL, text, buffer, stream nor plain object. */\nexport function sourceInvalidError(source: unknown): OpenAPITypesafeError {\n  const received = Array.isArray(source) ? \"Array\" : typeof source;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `Expected string, object, or Buffer. Got ${received}`,\n    details: { received },\n  });\n}\n\n/** A source string starts with a URL scheme but does not parse as a URL. */\nexport function urlInvalidError(text: string): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message: `The string ${redactUnparsedUrl(text)} starts like a URL but is not a valid URL`,\n    details: { reason: \"url\", received: \"string\" },\n  });\n}\n\nfunction causeMessage(cause: unknown): string {\n  return cause instanceof Error ? cause.message : String(cause);\n}\n\n/** Enough of a source string to recognise it in the message. */\nconst SOURCE_TEXT_IN_MESSAGE = 200;\n\n/** Where document text that is only a YAML string came from. */\nexport type TextOrigin = \"string\" | \"stream\";\n\nconst LOAD_FILE_ADVICE =\n  \"To load a file, pass a URL: openapiTS(pathToFileURL(path)) from node:url.\";\n\n/**\n * A string source is document text, so a file path parses as a YAML string scalar, not as a\n * document (docs/node.md). The message says how to load the file instead. Text read from a\n * stream (stdin in the CLI) is named as such; `details.text` lets the CLI give its own advice.\n */\nexport function pathStringError(text: string, origin: TextOrigin): OpenAPITypesafeError {\n  const shown =\n    text.length > SOURCE_TEXT_IN_MESSAGE ? `${text.slice(0, SOURCE_TEXT_IN_MESSAGE)}…` : text;\n  const message =\n    origin === \"string\"\n      ? `The string \"${shown}\" was parsed as YAML text, not loaded as a file. ${LOAD_FILE_ADVICE}`\n      : `The stream held only the YAML string \"${shown}\", not an OpenAPI document. ` +\n        LOAD_FILE_ADVICE;\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_SOURCE_INVALID,\n    message,\n    details: { reason: \"path\", received: origin, text: shown },\n  });\n}\n\n/** Reading the document from a file or URL failed; the message is the reader's message. */\nexport function loadFailedError(absoluteRef: string, cause: unknown): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_LOAD_FAILED,\n    message: causeMessage(cause),\n    details: { source: redactUrlSecrets(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document text is not valid JSON or YAML; the message is the parser's message. */\nexport function parseFailedError(\n  format: \"json\" | \"yaml\",\n  absoluteRef: string,\n  cause: unknown,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_PARSE_FAILED,\n    message: causeMessage(cause),\n    details: { format, source: redactUrlSecrets(absoluteRef) },\n    cause,\n  });\n}\n\n/** The document is not OpenAPI 3.x. */\nexport function versionUnsupportedError(\n  message: string,\n  parsed: Readonly<Record<string, unknown>>,\n): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_VERSION_UNSUPPORTED,\n    message,\n    details: { openapi: parsed.openapi, swagger: parsed.swagger },\n  });\n}\n\n/**\n * Linting or bundling found errors. The message is the last error, as in the original; all error\n * messages are in `details.problems`.\n */\nexport function schemaInvalidError(problems: readonly string[]): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_INVALID,\n    message: problems.at(-1) ?? \"\",\n    details: { problems: problems.map(redactUrlSecrets) },\n  });\n}\n\n/** A `$ref` chain points back to itself with no schema in between (`A: $ref B`, `B: $ref A`). */\nexport function refCycleError(cause: Error): OpenAPITypesafeError {\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_INVALID,\n    message: cause.message,\n    details: { reason: \"cycle\" },\n    cause,\n  });\n}\n\nfunction hostListText(hosts: readonly string[]): string {\n  return hosts.length === 0 ? \"none\" : hosts.join(\", \");\n}\n\n/** Why a `$ref` document was refused, with the limit it broke (ADR-017). */\nexport type RefRefusalDetails =\n  | { readonly reason: \"outside-local-root\"; readonly localRoot: string }\n  | { readonly reason: \"host-not-allowed\"; readonly allowedHosts: readonly string[] }\n  | { readonly reason: \"local-ref-from-remote\"; readonly base: string }\n  | { readonly reason: \"too-many-remote-documents\"; readonly maxDocuments: number }\n  | { readonly reason: \"remote-document-too-large\"; readonly maxDocumentBytes: number }\n  | { readonly reason: \"remote-documents-too-large\"; readonly maxTotalBytes: number }\n  | { readonly reason: \"remote-documents-too-many-nodes\"; readonly maxNodes: number };\n\nconst BYTES_PER_MEBIBYTE = 1024 * 1024;\n\n/** A byte count in MiB, as the limits are chosen: `256 MiB`; a smaller limit in bytes. */\nfunction sizeText(bytes: number): string {\n  return bytes % BYTES_PER_MEBIBYTE === 0 ? `${bytes / BYTES_PER_MEBIBYTE} MiB` : `${bytes} bytes`;\n}\n\nfunction limitText(details: RefRefusalDetails): string {\n  switch (details.reason) {\n    case \"outside-local-root\":\n      return `it is outside the local $ref root ${details.localRoot}`;\n    case \"host-not-allowed\": {\n      const hosts = hostListText(details.allowedHosts);\n      return `its host is not in the allowed remote $ref hosts (${hosts})`;\n    }\n    case \"local-ref-from-remote\":\n      return `it is not an http(s) URL, and the $ref is in the remote document ${details.base}`;\n    case \"too-many-remote-documents\":\n      return `the document refers to more than ${details.maxDocuments} remote documents`;\n    case \"remote-document-too-large\":\n      return `its body is larger than ${sizeText(details.maxDocumentBytes)} once decoded`;\n    case \"remote-documents-too-large\": {\n      const limit = sizeText(details.maxTotalBytes);\n      return `the remote documents of this run are larger than ${limit} together once decoded`;\n    }\n    case \"remote-documents-too-many-nodes\": {\n      const limit = details.maxNodes;\n      return `the remote documents of this run parse into more than ${limit} nodes together`;\n    }\n    default:\n      return assertNever(details);\n  }\n}\n\n/**\n * A `$ref` is outside the local root, its host is not allowed (threat model R1, R2), a remote\n * document refers to a local file (T3), or there are too many or too large remote documents (T2).\n */\nexport function refForbiddenError(ref: string, details: RefRefusalDetails): OpenAPITypesafeError {\n  const limit = limitText(details);\n  return new OpenAPITypesafeError({\n    code: ERROR_CODES.SCHEMA_REF_FORBIDDEN,\n    message: `Refused to load ${ref}: ${limit}`,\n    details: { ref: redactUrlSecrets(ref), ...details },\n  });\n}\n"],"names":[],"mappings":";;;;AAWO,SAAS,iBAAiB,OAAA,EAAuC;AACtE,EAAA,OAAO,IAAI,oBAAA,CAAqB,EAAE,MAAM,WAAA,CAAY,mBAAA,EAAqB,SAAS,CAAA;AACpF;AAGO,SAAS,mBAAmB,MAAA,EAAuC;AACxE,EAAA,MAAM,WAAW,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,GAAI,UAAU,OAAO,MAAA;AAC1D,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,2CAA2C,QAAQ,CAAA,CAAA;AAAA,IAC5D,OAAA,EAAS,EAAE,QAAA;AAAS,GACrB,CAAA;AACH;AAGO,SAAS,gBAAgB,IAAA,EAAoC;AAClE,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,qBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,WAAA,EAAc,iBAAA,CAAkB,IAAI,CAAC,CAAA,yCAAA,CAAA;AAAA,IAC9C,OAAA,EAAS,EAAE,MAAA,EAAQ,KAAA,EAAO,UAAU,QAAA;AAAS,GAC9C,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAwB;AAC5C,EAAA,OAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC9D;AAGA,MAAM,sBAAA,GAAyB,GAAA;AAK/B,MAAM,gBAAA,GACJ,2EAAA;AAOK,SAAS,eAAA,CAAgB,MAAc,MAAA,EAA0C;AACtF,EAAA,MAAM,KAAA,GACJ,IAAA,CAAK,MAAA,GAAS,sBAAA,GAAyB,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,sBAAsB,CAAC,CAAA,MAAA,CAAA,GAAM,IAAA;AACvF,EAAA,MAAM,OAAA,GACJ,MAAA,KAAW,QAAA,GACP,CAAA,YAAA,EAAe,KAAK,oDAAoD,gBAAgB,CAAA,CAAA,GACxF,CAAA,sCAAA,EAAyC,KAAK,CAAA,4BAAA,CAAA,GAC9C,gBAAA;AACN,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,qBAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,MAAA,EAAQ,QAAQ,QAAA,EAAU,MAAA,EAAQ,MAAM,KAAA;AAAM,GAC1D,CAAA;AACH;AAGO,SAAS,eAAA,CAAgB,aAAqB,KAAA,EAAsC;AACzF,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,kBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,OAAA,EAAS,EAAE,MAAA,EAAQ,gBAAA,CAAiB,WAAW,CAAA,EAAE;AAAA,IACjD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,gBAAA,CACd,MAAA,EACA,WAAA,EACA,KAAA,EACsB;AACtB,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,mBAAA;AAAA,IAClB,OAAA,EAAS,aAAa,KAAK,CAAA;AAAA,IAC3B,SAAS,EAAE,MAAA,EAAQ,MAAA,EAAQ,gBAAA,CAAiB,WAAW,CAAA,EAAE;AAAA,IACzD;AAAA,GACD,CAAA;AACH;AAGO,SAAS,uBAAA,CACd,SACA,MAAA,EACsB;AACtB,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,0BAAA;AAAA,IAClB,OAAA;AAAA,IACA,SAAS,EAAE,OAAA,EAAS,OAAO,OAAA,EAAS,OAAA,EAAS,OAAO,OAAA;AAAQ,GAC7D,CAAA;AACH;AAMO,SAAS,mBAAmB,QAAA,EAAmD;AACpF,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,cAAA;AAAA,IAClB,OAAA,EAAS,QAAA,CAAS,EAAA,CAAG,EAAE,CAAA,IAAK,EAAA;AAAA,IAC5B,SAAS,EAAE,QAAA,EAAU,QAAA,CAAS,GAAA,CAAI,gBAAgB,CAAA;AAAE,GACrD,CAAA;AACH;AAGO,SAAS,cAAc,KAAA,EAAoC;AAChE,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,kBAAA;AAAA,IAClB,SAAS,KAAA,CAAM,OAAA;AAAA,IACf,OAAA,EAAS,EAAE,MAAA,EAAQ,OAAA,EAAQ;AAAA,IAC3B;AAAA,GACD,CAAA;AACH;AAEA,SAAS,aAAa,KAAA,EAAkC;AACtD,EAAA,OAAO,MAAM,MAAA,KAAW,CAAA,GAAI,MAAA,GAAS,KAAA,CAAM,KAAK,IAAI,CAAA;AACtD;AAYA,MAAM,qBAAqB,IAAA,GAAO,IAAA;AAGlC,SAAS,SAAS,KAAA,EAAuB;AACvC,EAAA,OAAO,KAAA,GAAQ,uBAAuB,CAAA,GAAI,CAAA,EAAG,QAAQ,kBAAkB,CAAA,IAAA,CAAA,GAAS,GAAG,KAAK,CAAA,MAAA,CAAA;AAC1F;AAEA,SAAS,UAAU,OAAA,EAAoC;AACrD,EAAA,QAAQ,QAAQ,MAAA;AAAQ,IACtB,KAAK,oBAAA;AACH,MAAA,OAAO,CAAA,kCAAA,EAAqC,QAAQ,SAAS,CAAA,CAAA;AAAA,IAC/D,KAAK,kBAAA,EAAoB;AACvB,MAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,YAAY,CAAA;AAC/C,MAAA,OAAO,qDAAqD,KAAK,CAAA,CAAA,CAAA;AAAA,IACnE;AAAA,IACA,KAAK,uBAAA;AACH,MAAA,OAAO,CAAA,iEAAA,EAAoE,QAAQ,IAAI,CAAA,CAAA;AAAA,IACzF,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,iCAAA,EAAoC,QAAQ,YAAY,CAAA,iBAAA,CAAA;AAAA,IACjE,KAAK,2BAAA;AACH,MAAA,OAAO,CAAA,wBAAA,EAA2B,QAAA,CAAS,OAAA,CAAQ,gBAAgB,CAAC,CAAA,aAAA,CAAA;AAAA,IACtE,KAAK,4BAAA,EAA8B;AACjC,MAAA,MAAM,KAAA,GAAQ,QAAA,CAAS,OAAA,CAAQ,aAAa,CAAA;AAC5C,MAAA,OAAO,oDAAoD,KAAK,CAAA,sBAAA,CAAA;AAAA,IAClE;AAAA,IACA,KAAK,iCAAA,EAAmC;AACtC,MAAA,MAAM,QAAQ,OAAA,CAAQ,QAAA;AACtB,MAAA,OAAO,yDAAyD,KAAK,CAAA,eAAA,CAAA;AAAA,IACvE;AAAA,IACA;AACE,MAAA,OAAO,YAAY,OAAO,CAAA;AAAA;AAEhC;AAMO,SAAS,iBAAA,CAAkB,KAAa,OAAA,EAAkD;AAC/F,EAAA,MAAM,KAAA,GAAQ,UAAU,OAAO,CAAA;AAC/B,EAAA,OAAO,IAAI,oBAAA,CAAqB;AAAA,IAC9B,MAAM,WAAA,CAAY,oBAAA;AAAA,IAClB,OAAA,EAAS,CAAA,gBAAA,EAAmB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAA;AAAA,IACzC,SAAS,EAAE,GAAA,EAAK,iBAAiB,GAAG,CAAA,EAAG,GAAG,OAAA;AAAQ,GACnD,CAAA;AACH;;"}

package/dist/adapters/redocly-loader/schema-source.cjs

@@ -19,14 +19,17 @@ async function readStream(stream, absoluteRef) {
     throw schemaLoadErrors.loadFailedError(absoluteRef, error);
   }
 }
-const URL_PREFIXES = ["http://", "https://", "file://"];
+const URL_PREFIX_RE = /^(?:https?|file):\/\//i;
 function parseSchemaText(schema, options) {
-  if (URL_PREFIXES.some((prefix) => schema.startsWith(prefix))) {
-    const url = new URL(schema);
+  if (URL_PREFIX_RE.test(schema)) {
+    const url = URL.parse(schema);
+    if (url === null) {
+      throw schemaLoadErrors.urlInvalidError(schema);
+    }
     const absoluteRef = url.protocol === "file:" ? node_url.fileURLToPath(url) : url.href;
     return parseSchema(url, { absoluteRef, resolver: options.resolver });
   }
-  return schema[0] === "{" ? parseJsonText(schema, options.absoluteRef) : parseYamlText(schema, options.absoluteRef);
+  return schema[0] === "{" ? parseJsonText(schema, options.absoluteRef) : parseYamlText(schema, options.absoluteRef, options.textOrigin ?? "string");
 }
 function parseJsonText(text2, absoluteRef) {
   try {
@@ -35,15 +38,20 @@ function parseJsonText(text2, absoluteRef) {
     throw schemaLoadErrors.parseFailedError("json", absoluteRef, cause);
   }
 }
-function parseYamlText(text2, absoluteRef) {
+const TEXT_ORIGIN_NAMES = {
+  string: "the schema string",
+  stream: "the schema stream"
+};
+function parseYamlText(text2, absoluteRef, origin) {
+  const source = new openapiCore.Source(absoluteRef, text2);
   let document;
   try {
-    document = openapiCore.makeDocumentFromString(text2, absoluteRef);
+    document = { source, parsed: openapiCore.parseYaml(text2, { filename: TEXT_ORIGIN_NAMES[origin] }) };
   } catch (cause) {
-    throw schemaLoadErrors.parseFailedError("yaml", absoluteRef, cause);
+    throw schemaLoadErrors.parseFailedError("yaml", absoluteRef, new openapiCore.YamlParseError(cause, source));
   }
   if (typeof document.parsed === "string") {
-    throw schemaLoadErrors.pathStringError(text2);
+    throw schemaLoadErrors.pathStringError(text2, origin);
   }
   const failure = aliasLimit.aliasExpansionFailure(document.parsed);
   if (failure !== void 0) {
@@ -89,7 +97,8 @@ async function parseSchema(schema, options) {
     return resolveSchemaURL(options);
   }
   if (schema instanceof node_stream.Readable) {
-    return parseSchema(await readStream(schema, options.absoluteRef), options);
+    const text2 = await readStream(schema, options.absoluteRef);
+    return parseSchema(text2, { ...options, textOrigin: "stream" });
   }
   if (schema instanceof Buffer) {
     return parseSchema(schema.toString("utf8"), options);