openapi-typesafe 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/adapters/redocly-loader/ref-access.mjs

@@ -1,11 +1,12 @@
 import { realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { BaseResolver, YamlParseError } from '@redocly/openapi-core';
+import { BaseResolver, YamlParseError, Source } from '@redocly/openapi-core';
 import { ERROR_CODES } from '../../domain/errors.mjs';
 import { redactUrlSecrets } from '../../domain/url-secrets.mjs';
 import { aliasExpansionFailure } from './alias-limit.mjs';
 import { isHostAllowed } from './allowed-hosts.mjs';
+import { pointMappingNamesAtSchemas } from './mapping-schema-names.mjs';
 import { RemoteNodeLimit, isParsedSource } from './remote-node-limit.mjs';
 import { refForbiddenError } from './schema-load-errors.mjs';
 
@@ -94,20 +95,32 @@ class RefAccessResolver extends BaseResolver {
     }
     return super.resolveDocument(base, ref, isRoot);
   }
-  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */
+  /**
+   * Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). A document a
+   * `$ref` loads has its own `components.schemas`, so its mapping names point at those schemas
+   * before Redocly resolves them, as the root's do (`pointMappingNamesAtSchemas`).
+   */
   parseDocument(source, isRoot = false) {
     const document = this.#parsed(source, isRoot);
     const failure = aliasExpansionFailure(document.parsed);
     if (failure !== void 0) {
       throw new YamlParseError(failure, source);
     }
+    pointMappingNamesAtSchemas(document.parsed);
     return document;
   }
-  /** A remote document is parsed within the node limit; any other one as Redocly parses it. */
+  /**
+   * A remote document is parsed within the node limit; a local one as Redocly parses it. Whether
+   * a remote one is parsed at all is decided here (`isParsedSource`), since Redocly read the
+   * extension of a URL with its query.
+   */
   #parsed(source, isRoot) {
-    if (!isRemoteRef(source.absoluteRef) || !isParsedSource(source, isRoot)) {
+    if (!isRemoteRef(source.absoluteRef)) {
       return super.parseDocument(source, isRoot);
     }
+    if (!isParsedSource(source, isRoot)) {
+      return { source, parsed: source.body };
+    }
     try {
       return this.#nodeLimit.parse(source);
     } catch (error) {
@@ -124,7 +137,7 @@ class RefAccessResolver extends BaseResolver {
       throw refusal;
     }
     try {
-      return await super.loadExternalRef(absoluteRef);
+      return this.#atFinalUrl(await super.loadExternalRef(absoluteRef));
     } catch (error) {
       const cause = error.originalError;
       if (isRefusal(cause)) {
@@ -133,6 +146,14 @@ class RefAccessResolver extends BaseResolver {
       throw error;
     }
   }
+  /**
+   * A redirected document is named by the URL it came from, so its relative `$ref`s, its
+   * component names and its problems use that URL. Redocly still finds it by the requested one.
+   */
+  #atFinalUrl(source) {
+    const finalUrl = this.#limits.redirects.finalUrlOf(source.absoluteRef);
+    return finalUrl === source.absoluteRef ? source : new Source(finalUrl, source.body, source.mimeType);
+  }
   #accessRefusal(absoluteRef) {
     return absoluteRef === this.#rootRef ? Promise.resolve(void 0) : refusalOf(absoluteRef, this.#limits.access);
   }

package/dist/adapters/redocly-loader/ref-access.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-access.mjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  type Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlSecrets } from \"../../domain/url-secrets.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { isParsedSource, RemoteNodeLimit } from \"./remote-node-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A remote document may refer only to other URLs (threat model T3). Redocly resolves a `$ref`\n * against a URL base with `new URL()`, so `C:/x` becomes `c:/x` and `file:///x` stays as it is;\n * Redocly then reads either from disk, and on Windows a drive letter is an absolute path.\n */\nfunction localFromRemoteRefusal(\n  base: string,\n  absoluteRef: string,\n): OpenAPITypesafeError | undefined {\n  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {\n    return undefined;\n  }\n  const shownBase = redactUrlSecrets(base);\n  return refForbiddenError(absoluteRef, { reason: \"local-ref-from-remote\", base: shownBase });\n}\n\n/** The scheme of an `http(s)` URL, in any case. */\nconst REMOTE_SCHEME_RE = /^https?:(?=\\/\\/)/i;\n\n/** The limits one resolver checks; each load gets its own resolver. */\nexport interface RefAccessLimits {\n  readonly access: RefAccess;\n  /** Remote documents one load may fetch, the root included (threat model T2). */\n  readonly maxRemoteDocuments: number;\n  /** Nodes the remote documents of one load may parse into together (threat model T2). */\n  readonly maxRemoteNodes: number;\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #limits: RefAccessLimits;\n  readonly #nodeLimit: RemoteNodeLimit;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */\n  #remoteDocumentCount = 0;\n\n  constructor(config: ResolveConfig, limits: RefAccessLimits) {\n    super(config);\n    this.#limits = limits;\n    this.#nodeLimit = new RemoteNodeLimit(limits.maxRemoteNodes);\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  /**\n   * A scheme is the same in any case (RFC 3986, section 3.1), but Redocly takes only `http://` and\n   * `https://` as URLs: it read `HTTP://host/x.yaml` as a file path, and its \"not found\" message\n   * showed the user info and the query of the URL, which no longer looked like one. The scheme\n   * is written in lowercase first, so the `$ref` loads as the URL it is, within the same limits.\n   */\n  override resolveExternalRef(base: string | null, ref: string): string {\n    const normalized = ref.replace(REMOTE_SCHEME_RE, (scheme) => scheme.toLowerCase());\n    return super.resolveExternalRef(base, normalized);\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    const refusal =\n      base === null ? undefined : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      return Promise.reject(refusal);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /** Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = this.#parsed(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    return document;\n  }\n\n  /** A remote document is parsed within the node limit; any other one as Redocly parses it. */\n  #parsed(source: Source, isRoot: boolean): Document {\n    if (!isRemoteRef(source.absoluteRef) || !isParsedSource(source, isRoot)) {\n      return super.parseDocument(source, isRoot);\n    }\n    try {\n      return this.#nodeLimit.parse(source);\n    } catch (error) {\n      if (isRefusal(error)) {\n        this.#refusals.push(error);\n      }\n      throw new YamlParseError(error as Error, source);\n    }\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal = this.#countRefusal(absoluteRef) ?? (await this.#accessRefusal(absoluteRef));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return await super.loadExternalRef(absoluteRef);\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n\n  #accessRefusal(absoluteRef: string): Promise<OpenAPITypesafeError | undefined> {\n    return absoluteRef === this.#rootRef\n      ? Promise.resolve(undefined)\n      : refusalOf(absoluteRef, this.#limits.access);\n  }\n\n  /**\n   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three\n   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).\n   */\n  #countRefusal(absoluteRef: string): OpenAPITypesafeError | undefined {\n    if (!isRemoteRef(absoluteRef)) {\n      return undefined;\n    }\n    this.#remoteDocumentCount += 1;\n    const { maxRemoteDocuments } = this.#limits;\n    return this.#remoteDocumentCount > maxRemoteDocuments\n      ? refForbiddenError(absoluteRef, {\n          reason: \"too-many-remote-documents\",\n          maxDocuments: maxRemoteDocuments,\n        })\n      : undefined;\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":[],"mappings":";;;;;;;;;;;AA0BA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAK,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAO,IAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,aAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAa,aAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOA,SAAS,sBAAA,CACP,MACA,WAAA,EACkC;AAClC,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,IAAK,WAAA,CAAY,WAAW,CAAA,EAAG;AAClD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,iBAAiB,IAAI,CAAA;AACvC,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,uBAAA,EAAyB,IAAA,EAAM,WAAW,CAAA;AAC5F;AAGA,MAAM,gBAAA,GAAmB,mBAAA;AAgBlB,MAAM,0BAA0B,YAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA;AAAA,EAEA,oBAAA,GAAuB,CAAA;AAAA,EAEvB,WAAA,CAAY,QAAuB,MAAA,EAAyB;AAC1D,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,eAAA,CAAgB,MAAA,CAAO,cAAc,CAAA;AAAA,EAC7D;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQS,kBAAA,CAAmB,MAAqB,GAAA,EAAqB;AACpE,IAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,gBAAA,EAAkB,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,CAAA;AACjF,IAAA,OAAO,KAAA,CAAM,kBAAA,CAAmB,IAAA,EAAM,UAAU,CAAA;AAAA,EAClD;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GACJ,IAAA,KAAS,IAAA,GAAO,MAAA,GAAY,sBAAA,CAAuB,MAAM,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAC,CAAA;AAC7F,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA,EAGS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA,EAGA,OAAA,CAAQ,QAAgB,MAAA,EAA2B;AACjD,IAAA,IAAI,CAAC,YAAY,MAAA,CAAO,WAAW,KAAK,CAAC,cAAA,CAAe,MAAA,EAAQ,MAAM,CAAA,EAAG;AACvE,MAAA,OAAO,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC3C;AACA,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,IAAI,cAAA,CAAe,KAAA,EAAgB,MAAM,CAAA;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GAAU,KAAK,aAAA,CAAc,WAAW,KAAM,MAAM,IAAA,CAAK,eAAe,WAAW,CAAA;AACzF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAA;AAAA,IAChD,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,eAAe,WAAA,EAAgE;AAC7E,IAAA,OAAO,WAAA,KAAgB,IAAA,CAAK,QAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA,GACzB,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,WAAA,EAAuD;AACnE,IAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,oBAAA,IAAwB,CAAA;AAC7B,IAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,IAAA,CAAK,OAAA;AACpC,IAAA,OAAO,IAAA,CAAK,oBAAA,GAAuB,kBAAA,GAC/B,iBAAA,CAAkB,WAAA,EAAa;AAAA,MAC7B,MAAA,EAAQ,2BAAA;AAAA,MACR,YAAA,EAAc;AAAA,KACf,CAAA,GACD,MAAA;AAAA,EACN;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAAS,WAAA,CAAY,oBAAA;AACpE;;"}
+{"version":3,"file":"ref-access.mjs","sources":["../../../src/adapters/redocly-loader/ref-access.ts"],"sourcesContent":["import { realpath } from \"node:fs/promises\";\nimport path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  BaseResolver,\n  type Document,\n  type Config as RedoclyConfig,\n  Source,\n  YamlParseError,\n} from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { ERROR_CODES, type OpenAPITypesafeError } from \"../../domain/errors.js\";\nimport { redactUrlSecrets } from \"../../domain/url-secrets.js\";\nimport { aliasExpansionFailure } from \"./alias-limit.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { pointMappingNamesAtSchemas } from \"./mapping-schema-names.js\";\nimport type { RedirectedUrls } from \"./remote-fetch.js\";\nimport { isParsedSource, RemoteNodeLimit } from \"./remote-node-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * Limits on where `$ref` documents may be loaded from (threat model R1 and R2, ADR-017). The root\n * document is chosen by the developer and is always loaded; every other document must pass.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** Redocly treats only these prefixes as remote; any other `$ref` is a local file path. */\nfunction isRemoteRef(absoluteRef: string): boolean {\n  return absoluteRef.startsWith(\"http://\") || absoluteRef.startsWith(\"https://\");\n}\n\n/** Whether `target` is `root` or below it; both are absolute paths. */\nexport function isInsideDirectory(target: string, root: string): boolean {\n  const relative = path.relative(root, target);\n  // Compare the first segment: a directory named `..hidden` is inside, `../x` is not.\n  const isParent = relative === \"..\" || relative.startsWith(`..${path.sep}`);\n  return !isParent && !path.isAbsolute(relative);\n}\n\n/** The real path, so a link inside the root that points outside it is caught. */\nasync function realPathOrSelf(file: string): Promise<string> {\n  const absolute = path.resolve(file);\n  try {\n    return await realpath(absolute);\n  } catch (error) {\n    // A missing file is never read, and Redocly reports it. Resolve its nearest existing\n    // directory instead, so it compares with the root's real path: the root may be reached\n    // through a link (macOS `/tmp` is one), and the missing file must not look outside it.\n    const parent = path.dirname(absolute);\n    if ((error as NodeJS.ErrnoException).code === \"ENOENT\" && parent !== absolute) {\n      return path.join(await realPathOrSelf(parent), path.basename(absolute));\n    }\n    throw error;\n  }\n}\n\nasync function localRefusal(\n  absoluteRef: string,\n  localRoot: URL,\n): Promise<OpenAPITypesafeError | undefined> {\n  const root = await realPathOrSelf(fileURLToPath(localRoot));\n  if (isInsideDirectory(await realPathOrSelf(absoluteRef), root)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, { reason: \"outside-local-root\", localRoot: root });\n}\n\n/** The refusal for one document, or undefined when the limits allow it. */\nexport async function refusalOf(\n  absoluteRef: string,\n  access: RefAccess,\n): Promise<OpenAPITypesafeError | undefined> {\n  if (!isRemoteRef(absoluteRef)) {\n    return access.localRoot === undefined ? undefined : localRefusal(absoluteRef, access.localRoot);\n  }\n  if (access.remoteHosts === undefined || isHostAllowed(new URL(absoluteRef), access.remoteHosts)) {\n    return undefined;\n  }\n  return refForbiddenError(absoluteRef, {\n    reason: \"host-not-allowed\",\n    allowedHosts: [...access.remoteHosts],\n  });\n}\n\n/**\n * A remote document may refer only to other URLs (threat model T3). Redocly resolves a `$ref`\n * against a URL base with `new URL()`, so `C:/x` becomes `c:/x` and `file:///x` stays as it is;\n * Redocly then reads either from disk, and on Windows a drive letter is an absolute path.\n */\nfunction localFromRemoteRefusal(\n  base: string,\n  absoluteRef: string,\n): OpenAPITypesafeError | undefined {\n  if (!isRemoteRef(base) || isRemoteRef(absoluteRef)) {\n    return undefined;\n  }\n  const shownBase = redactUrlSecrets(base);\n  return refForbiddenError(absoluteRef, { reason: \"local-ref-from-remote\", base: shownBase });\n}\n\n/** The scheme of an `http(s)` URL, in any case. */\nconst REMOTE_SCHEME_RE = /^https?:(?=\\/\\/)/i;\n\n/** The limits one resolver checks; each load gets its own resolver. */\nexport interface RefAccessLimits {\n  readonly access: RefAccess;\n  /** Remote documents one load may fetch, the root included (threat model T2). */\n  readonly maxRemoteDocuments: number;\n  /** Nodes the remote documents of one load may parse into together (threat model T2). */\n  readonly maxRemoteNodes: number;\n  /** The final URLs of redirected documents, which their relative `$ref`s resolve against. */\n  readonly redirects: RedirectedUrls;\n}\n\n/**\n * A Redocly resolver that checks each document before it loads it. Redocly turns a failed load\n * into an unresolved-`$ref` problem, so the refusals are also kept for the loader to report as\n * the typed error.\n */\nexport class RefAccessResolver extends BaseResolver {\n  readonly #limits: RefAccessLimits;\n  readonly #nodeLimit: RemoteNodeLimit;\n  readonly #refusals: OpenAPITypesafeError[] = [];\n  /** The root document's ref: it is chosen by the developer, so it is not limited. */\n  #rootRef: string | undefined;\n  /** Remote documents asked for so far; Redocly caches each one, so each is counted once. */\n  #remoteDocumentCount = 0;\n\n  constructor(config: ResolveConfig, limits: RefAccessLimits) {\n    super(config);\n    this.#limits = limits;\n    this.#nodeLimit = new RemoteNodeLimit(limits.maxRemoteNodes);\n  }\n\n  /** The first document that was refused, if any. */\n  get firstRefusal(): OpenAPITypesafeError | undefined {\n    return this.#refusals[0];\n  }\n\n  /**\n   * A scheme is the same in any case (RFC 3986, section 3.1), but Redocly takes only `http://` and\n   * `https://` as URLs: it read `HTTP://host/x.yaml` as a file path, and its \"not found\" message\n   * showed the user info and the query of the URL, which no longer looked like one. The scheme\n   * is written in lowercase first, so the `$ref` loads as the URL it is, within the same limits.\n   */\n  override resolveExternalRef(base: string | null, ref: string): string {\n    const normalized = ref.replace(REMOTE_SCHEME_RE, (scheme) => scheme.toLowerCase());\n    return super.resolveExternalRef(base, normalized);\n  }\n\n  override resolveDocument(\n    base: string | null,\n    ref: string,\n    isRoot = false,\n  ): ReturnType<BaseResolver[\"resolveDocument\"]> {\n    if (isRoot) {\n      this.#rootRef = this.resolveExternalRef(base, ref);\n    }\n    const refusal =\n      base === null ? undefined : localFromRemoteRefusal(base, this.resolveExternalRef(base, ref));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      return Promise.reject(refusal);\n    }\n    return super.resolveDocument(base, ref, isRoot);\n  }\n\n  /**\n   * Refuse a YAML alias bomb before Redocly walks it (pre-beta test plan 10.2). A document a\n   * `$ref` loads has its own `components.schemas`, so its mapping names point at those schemas\n   * before Redocly resolves them, as the root's do (`pointMappingNamesAtSchemas`).\n   */\n  override parseDocument(source: Source, isRoot = false): Document {\n    const document = this.#parsed(source, isRoot);\n    const failure = aliasExpansionFailure(document.parsed);\n    if (failure !== undefined) {\n      throw new YamlParseError(failure, source);\n    }\n    pointMappingNamesAtSchemas(document.parsed);\n    return document;\n  }\n\n  /**\n   * A remote document is parsed within the node limit; a local one as Redocly parses it. Whether\n   * a remote one is parsed at all is decided here (`isParsedSource`), since Redocly read the\n   * extension of a URL with its query.\n   */\n  #parsed(source: Source, isRoot: boolean): Document {\n    if (!isRemoteRef(source.absoluteRef)) {\n      return super.parseDocument(source, isRoot);\n    }\n    if (!isParsedSource(source, isRoot)) {\n      return { source, parsed: source.body };\n    }\n    try {\n      return this.#nodeLimit.parse(source);\n    } catch (error) {\n      if (isRefusal(error)) {\n        this.#refusals.push(error);\n      }\n      throw new YamlParseError(error as Error, source);\n    }\n  }\n\n  override async loadExternalRef(absoluteRef: string): Promise<Source> {\n    const refusal = this.#countRefusal(absoluteRef) ?? (await this.#accessRefusal(absoluteRef));\n    if (refusal !== undefined) {\n      this.#refusals.push(refusal);\n      throw refusal;\n    }\n    try {\n      return this.#atFinalUrl(await super.loadExternalRef(absoluteRef));\n    } catch (error) {\n      // A refused redirect throws inside the fetch, and Redocly wraps it in a ResolveError.\n      const cause = (error as { originalError?: unknown }).originalError;\n      if (isRefusal(cause)) {\n        this.#refusals.push(cause);\n      }\n      throw error;\n    }\n  }\n\n  /**\n   * A redirected document is named by the URL it came from, so its relative `$ref`s, its\n   * component names and its problems use that URL. Redocly still finds it by the requested one.\n   */\n  #atFinalUrl(source: Source): Source {\n    const finalUrl = this.#limits.redirects.finalUrlOf(source.absoluteRef);\n    return finalUrl === source.absoluteRef\n      ? source\n      : new Source(finalUrl, source.body, source.mimeType);\n  }\n\n  #accessRefusal(absoluteRef: string): Promise<OpenAPITypesafeError | undefined> {\n    return absoluteRef === this.#rootRef\n      ? Promise.resolve(undefined)\n      : refusalOf(absoluteRef, this.#limits.access);\n  }\n\n  /**\n   * A document that changes all its URLs can fan out without end: 150 `$ref`s per document, three\n   * levels deep, made 16,212 requests and exhausted the local ports (audit B2, F4).\n   */\n  #countRefusal(absoluteRef: string): OpenAPITypesafeError | undefined {\n    if (!isRemoteRef(absoluteRef)) {\n      return undefined;\n    }\n    this.#remoteDocumentCount += 1;\n    const { maxRemoteDocuments } = this.#limits;\n    return this.#remoteDocumentCount > maxRemoteDocuments\n      ? refForbiddenError(absoluteRef, {\n          reason: \"too-many-remote-documents\",\n          maxDocuments: maxRemoteDocuments,\n        })\n      : undefined;\n  }\n}\n\nfunction isRefusal(value: unknown): value is OpenAPITypesafeError {\n  return (value as { code?: unknown } | null)?.code === ERROR_CODES.SCHEMA_REF_FORBIDDEN;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AA4BA,SAAS,YAAY,WAAA,EAA8B;AACjD,EAAA,OAAO,YAAY,UAAA,CAAW,SAAS,CAAA,IAAK,WAAA,CAAY,WAAW,UAAU,CAAA;AAC/E;AAGO,SAAS,iBAAA,CAAkB,QAAgB,IAAA,EAAuB;AACvE,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,QAAA,CAAS,IAAA,EAAM,MAAM,CAAA;AAE3C,EAAA,MAAM,QAAA,GAAW,aAAa,IAAA,IAAQ,QAAA,CAAS,WAAW,CAAA,EAAA,EAAK,IAAA,CAAK,GAAG,CAAA,CAAE,CAAA;AACzE,EAAA,OAAO,CAAC,QAAA,IAAY,CAAC,IAAA,CAAK,WAAW,QAAQ,CAAA;AAC/C;AAGA,eAAe,eAAe,IAAA,EAA+B;AAC3D,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAClC,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,QAAQ,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AAId,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AACpC,IAAA,IAAK,KAAA,CAAgC,IAAA,KAAS,QAAA,IAAY,MAAA,KAAW,QAAA,EAAU;AAC7E,MAAA,OAAO,IAAA,CAAK,KAAK,MAAM,cAAA,CAAe,MAAM,CAAA,EAAG,IAAA,CAAK,QAAA,CAAS,QAAQ,CAAC,CAAA;AAAA,IACxE;AACA,IAAA,MAAM,KAAA;AAAA,EACR;AACF;AAEA,eAAe,YAAA,CACb,aACA,SAAA,EAC2C;AAC3C,EAAA,MAAM,IAAA,GAAO,MAAM,cAAA,CAAe,aAAA,CAAc,SAAS,CAAC,CAAA;AAC1D,EAAA,IAAI,kBAAkB,MAAM,cAAA,CAAe,WAAW,CAAA,EAAG,IAAI,CAAA,EAAG;AAC9D,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,oBAAA,EAAsB,SAAA,EAAW,MAAM,CAAA;AACzF;AAGA,eAAsB,SAAA,CACpB,aACA,MAAA,EAC2C;AAC3C,EAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,IAAA,OAAO,OAAO,SAAA,KAAc,MAAA,GAAY,SAAY,YAAA,CAAa,WAAA,EAAa,OAAO,SAAS,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,MAAA,CAAO,WAAA,KAAgB,MAAA,IAAa,aAAA,CAAc,IAAI,IAAI,WAAW,CAAA,EAAG,MAAA,CAAO,WAAW,CAAA,EAAG;AAC/F,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,kBAAkB,WAAA,EAAa;AAAA,IACpC,MAAA,EAAQ,kBAAA;AAAA,IACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,WAAW;AAAA,GACrC,CAAA;AACH;AAOA,SAAS,sBAAA,CACP,MACA,WAAA,EACkC;AAClC,EAAA,IAAI,CAAC,WAAA,CAAY,IAAI,CAAA,IAAK,WAAA,CAAY,WAAW,CAAA,EAAG;AAClD,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,SAAA,GAAY,iBAAiB,IAAI,CAAA;AACvC,EAAA,OAAO,kBAAkB,WAAA,EAAa,EAAE,QAAQ,uBAAA,EAAyB,IAAA,EAAM,WAAW,CAAA;AAC5F;AAGA,MAAM,gBAAA,GAAmB,mBAAA;AAkBlB,MAAM,0BAA0B,YAAA,CAAa;AAAA,EACzC,OAAA;AAAA,EACA,UAAA;AAAA,EACA,YAAoC,EAAC;AAAA;AAAA,EAE9C,QAAA;AAAA;AAAA,EAEA,oBAAA,GAAuB,CAAA;AAAA,EAEvB,WAAA,CAAY,QAAuB,MAAA,EAAyB;AAC1D,IAAA,KAAA,CAAM,MAAM,CAAA;AACZ,IAAA,IAAA,CAAK,OAAA,GAAU,MAAA;AACf,IAAA,IAAA,CAAK,UAAA,GAAa,IAAI,eAAA,CAAgB,MAAA,CAAO,cAAc,CAAA;AAAA,EAC7D;AAAA;AAAA,EAGA,IAAI,YAAA,GAAiD;AACnD,IAAA,OAAO,IAAA,CAAK,UAAU,CAAC,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQS,kBAAA,CAAmB,MAAqB,GAAA,EAAqB;AACpE,IAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,gBAAA,EAAkB,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,CAAA;AACjF,IAAA,OAAO,KAAA,CAAM,kBAAA,CAAmB,IAAA,EAAM,UAAU,CAAA;AAAA,EAClD;AAAA,EAES,eAAA,CACP,IAAA,EACA,GAAA,EACA,MAAA,GAAS,KAAA,EACoC;AAC7C,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,IAAA,CAAK,QAAA,GAAW,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAA;AAAA,IACnD;AACA,IAAA,MAAM,OAAA,GACJ,IAAA,KAAS,IAAA,GAAO,MAAA,GAAY,sBAAA,CAAuB,MAAM,IAAA,CAAK,kBAAA,CAAmB,IAAA,EAAM,GAAG,CAAC,CAAA;AAC7F,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,OAAO,OAAA,CAAQ,OAAO,OAAO,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,KAAA,CAAM,eAAA,CAAgB,IAAA,EAAM,GAAA,EAAK,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOS,aAAA,CAAc,MAAA,EAAgB,MAAA,GAAS,KAAA,EAAiB;AAC/D,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,MAAA,EAAQ,MAAM,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,qBAAA,CAAsB,QAAA,CAAS,MAAM,CAAA;AACrD,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,MAAM,CAAA;AAAA,IAC1C;AACA,IAAA,0BAAA,CAA2B,SAAS,MAAM,CAAA;AAC1C,IAAA,OAAO,QAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAA,CAAQ,QAAgB,MAAA,EAA2B;AACjD,IAAA,IAAI,CAAC,WAAA,CAAY,MAAA,CAAO,WAAW,CAAA,EAAG;AACpC,MAAA,OAAO,KAAA,CAAM,aAAA,CAAc,MAAA,EAAQ,MAAM,CAAA;AAAA,IAC3C;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,MAAA,EAAQ,MAAM,CAAA,EAAG;AACnC,MAAA,OAAO,EAAE,MAAA,EAAQ,MAAA,EAAQ,MAAA,CAAO,IAAA,EAAK;AAAA,IACvC;AACA,IAAA,IAAI;AACF,MAAA,OAAO,IAAA,CAAK,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA;AAAA,IACrC,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,IAAI,cAAA,CAAe,KAAA,EAAgB,MAAM,CAAA;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAe,gBAAgB,WAAA,EAAsC;AACnE,IAAA,MAAM,OAAA,GAAU,KAAK,aAAA,CAAc,WAAW,KAAM,MAAM,IAAA,CAAK,eAAe,WAAW,CAAA;AACzF,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,OAAO,CAAA;AAC3B,MAAA,MAAM,OAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAA,OAAO,KAAK,WAAA,CAAY,MAAM,KAAA,CAAM,eAAA,CAAgB,WAAW,CAAC,CAAA;AAAA,IAClE,SAAS,KAAA,EAAO;AAEd,MAAA,MAAM,QAAS,KAAA,CAAsC,aAAA;AACrD,MAAA,IAAI,SAAA,CAAU,KAAK,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,KAAK,CAAA;AAAA,MAC3B;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,YAAY,MAAA,EAAwB;AAClC,IAAA,MAAM,WAAW,IAAA,CAAK,OAAA,CAAQ,SAAA,CAAU,UAAA,CAAW,OAAO,WAAW,CAAA;AACrE,IAAA,OAAO,QAAA,KAAa,MAAA,CAAO,WAAA,GACvB,MAAA,GACA,IAAI,OAAO,QAAA,EAAU,MAAA,CAAO,IAAA,EAAM,MAAA,CAAO,QAAQ,CAAA;AAAA,EACvD;AAAA,EAEA,eAAe,WAAA,EAAgE;AAC7E,IAAA,OAAO,WAAA,KAAgB,IAAA,CAAK,QAAA,GACxB,OAAA,CAAQ,OAAA,CAAQ,MAAS,CAAA,GACzB,SAAA,CAAU,WAAA,EAAa,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,cAAc,WAAA,EAAuD;AACnE,IAAA,IAAI,CAAC,WAAA,CAAY,WAAW,CAAA,EAAG;AAC7B,MAAA,OAAO,MAAA;AAAA,IACT;AACA,IAAA,IAAA,CAAK,oBAAA,IAAwB,CAAA;AAC7B,IAAA,MAAM,EAAE,kBAAA,EAAmB,GAAI,IAAA,CAAK,OAAA;AACpC,IAAA,OAAO,IAAA,CAAK,oBAAA,GAAuB,kBAAA,GAC/B,iBAAA,CAAkB,WAAA,EAAa;AAAA,MAC7B,MAAA,EAAQ,2BAAA;AAAA,MACR,YAAA,EAAc;AAAA,KACf,CAAA,GACD,MAAA;AAAA,EACN;AACF;AAEA,SAAS,UAAU,KAAA,EAA+C;AAChE,EAAA,OAAQ,KAAA,EAAqC,SAAS,WAAA,CAAY,oBAAA;AACpE;;"}

package/dist/adapters/redocly-loader/ref-holders.cjs

@@ -2,30 +2,72 @@
 
 const jsonPointer = require('../../domain/openapi/json-pointer.cjs');
 
-function hasStringRef(value) {
-  return !Array.isArray(value) && typeof value.$ref === "string";
+const DATA_KEYWORDS = /* @__PURE__ */ new Set(["example", "examples", "default", "const", "enum"]);
+const EXTENSION_PREFIX = "x-";
+const NAME_MAPS = /* @__PURE__ */ new Set([
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+  "schemas",
+  "responses",
+  "parameters",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems",
+  "mediaTypes",
+  "content",
+  "encoding",
+  "paths",
+  "webhooks"
+]);
+function isDataKey(key) {
+  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);
 }
-function findRefHolders(document) {
+function openApiNodes(document) {
   const found = [];
   const visited = /* @__PURE__ */ new WeakSet();
   const pending = [];
-  const enqueue = (value, pointer) => {
+  const enqueue = (value, pointer, hasNameKeys) => {
     if (typeof value === "object" && value !== null && !visited.has(value)) {
       visited.add(value);
-      pending.push({ value, pointer });
+      pending.push({ value, pointer, hasNameKeys });
     }
   };
-  enqueue(document, jsonPointer.ROOT_POINTER);
+  enqueue(document, jsonPointer.ROOT_POINTER, false);
   for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
-    if (hasStringRef(next.value)) {
-      found.push({ node: next.value, pointer: next.pointer });
-    }
+    found.push(next);
     for (const [key, child] of Object.entries(next.value)) {
-      enqueue(child, jsonPointer.childPointer(next.pointer, key));
+      if (next.hasNameKeys || !isDataKey(key)) {
+        enqueue(child, jsonPointer.childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));
+      }
     }
   }
   return found;
 }
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  return openApiNodes(document).flatMap(
+    ({ value, pointer, hasNameKeys }) => !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : []
+  );
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findMappings(document) {
+  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {
+    const { discriminator } = value;
+    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : void 0;
+    return isMapping(mapping) ? [mapping] : [];
+  });
+}
 
+exports.findMappings = findMappings;
 exports.findRefHolders = findRefHolders;
 //# sourceMappingURL=ref-holders.cjs.map

package/dist/adapters/redocly-loader/ref-holders.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-holders.cjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, ROOT_POINTER);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, childPointer(next.pointer, key));\n    }\n  }\n  return found;\n}\n"],"names":["ROOT_POINTER","childPointer"],"mappings":";;;;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAUA,wBAAY,CAAA;AAC9B,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAOC,wBAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAC,CAAA;AAAA,IAChD;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}
+{"version":3,"file":"ref-holders.cjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\n/**\n * Keywords whose value is data, not OpenAPI: a `$ref` or a `discriminator` in an example, a\n * default, a `const` or an `enum` value, or an extension is part of the data and stays as written.\n */\nconst DATA_KEYWORDS = new Set([\"example\", \"examples\", \"default\", \"const\", \"enum\"]);\nconst EXTENSION_PREFIX = \"x-\";\n\n/**\n * Keywords whose value maps names to objects: a property, a schema or a response may be named\n * `default` or `example`, and is OpenAPI all the same.\n */\nconst NAME_MAPS = new Set([\n  \"properties\",\n  \"patternProperties\",\n  \"dependentSchemas\",\n  \"$defs\",\n  \"definitions\",\n  \"schemas\",\n  \"responses\",\n  \"parameters\",\n  \"requestBodies\",\n  \"headers\",\n  \"securitySchemes\",\n  \"links\",\n  \"callbacks\",\n  \"pathItems\",\n  \"mediaTypes\",\n  \"content\",\n  \"encoding\",\n  \"paths\",\n  \"webhooks\",\n]);\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n  /** Whether the keys of `value` are names (of properties, schemas, responses), not keywords. */\n  readonly hasNameKeys: boolean;\n}\n\nfunction isDataKey(key: string): boolean {\n  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);\n}\n\n/**\n * Every object of a parsed document that is OpenAPI, not data (`DATA_KEYWORDS`), with its JSON\n * Pointer, in no particular order. The walk uses its own stack, so a deeply nested document does\n * not run out of call stack, and a node shared by YAML aliases (or a cycle of them) is visited\n * once.\n */\nfunction openApiNodes(document: unknown): PendingNode[] {\n  const found: PendingNode[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string, hasNameKeys: boolean): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer, hasNameKeys });\n    }\n  };\n  enqueue(document, ROOT_POINTER, false);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    found.push(next);\n    // One push per child: spreading an array of millions of children overflows the stack.\n    for (const [key, child] of Object.entries(next.value)) {\n      if (next.hasNameKeys || !isDataKey(key)) {\n        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));\n      }\n    }\n  }\n  return found;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/** Every object with a string `$ref` in a parsed document, outside data, in no particular order. */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  return openApiNodes(document).flatMap(({ value, pointer, hasNameKeys }) =>\n    !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : [],\n  );\n}\n\nfunction isMapping(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Every `discriminator.mapping` object of a parsed document, outside data. */\nexport function findMappings(document: unknown): Record<string, unknown>[] {\n  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {\n    const { discriminator } = value as { discriminator?: unknown };\n    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : undefined;\n    return isMapping(mapping) ? [mapping] : [];\n  });\n}\n"],"names":["ROOT_POINTER","childPointer"],"mappings":";;;;AAYA,MAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,WAAW,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,MAAM,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,IAAA;AAMzB,MAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,UAAU,GAAA,EAAsB;AACvC,EAAA,OAAO,cAAc,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,CAAI,WAAW,gBAAgB,CAAA;AAClE;AAQA,SAAS,aAAa,QAAA,EAAkC;AACtD,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,EAAiB,WAAA,KAA+B;AAC/E,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,aAAa,CAAA;AAAA,IAC9C;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,QAAA,EAAUA,0BAAc,KAAK,CAAA;AACrC,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAEf,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,IAAI,IAAA,CAAK,WAAA,IAAe,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AACvC,QAAA,OAAA,CAAQ,KAAA,EAAOC,wBAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA,EAAG,CAAC,IAAA,CAAK,WAAA,IAAe,SAAA,CAAU,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAGO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA;AAAA,IAAQ,CAAC,EAAE,KAAA,EAAO,SAAS,WAAA,EAAY,KACnE,CAAC,WAAA,IAAe,YAAA,CAAa,KAAK,CAAA,GAAI,CAAC,EAAE,IAAA,EAAM,OAAO,OAAA,EAAS,IAAI;AAAC,GACtE;AACF;AAEA,SAAS,UAAU,KAAA,EAAkD;AACnE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGO,SAAS,aAAa,QAAA,EAA8C;AACzE,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAO,aAAY,KAAM;AAChE,IAAA,MAAM,EAAE,eAAc,GAAI,KAAA;AAC1B,IAAA,MAAM,UAAU,CAAC,WAAA,IAAe,UAAU,aAAa,CAAA,GAAI,cAAc,OAAA,GAAU,MAAA;AACnF,IAAA,OAAO,UAAU,OAAO,CAAA,GAAI,CAAC,OAAO,IAAI,EAAC;AAAA,EAC3C,CAAC,CAAA;AACH;;;"}

package/dist/adapters/redocly-loader/ref-holders.mjs

@@ -1,29 +1,70 @@
 import { childPointer, ROOT_POINTER } from '../../domain/openapi/json-pointer.mjs';
 
-function hasStringRef(value) {
-  return !Array.isArray(value) && typeof value.$ref === "string";
+const DATA_KEYWORDS = /* @__PURE__ */ new Set(["example", "examples", "default", "const", "enum"]);
+const EXTENSION_PREFIX = "x-";
+const NAME_MAPS = /* @__PURE__ */ new Set([
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+  "schemas",
+  "responses",
+  "parameters",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems",
+  "mediaTypes",
+  "content",
+  "encoding",
+  "paths",
+  "webhooks"
+]);
+function isDataKey(key) {
+  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);
 }
-function findRefHolders(document) {
+function openApiNodes(document) {
   const found = [];
   const visited = /* @__PURE__ */ new WeakSet();
   const pending = [];
-  const enqueue = (value, pointer) => {
+  const enqueue = (value, pointer, hasNameKeys) => {
     if (typeof value === "object" && value !== null && !visited.has(value)) {
       visited.add(value);
-      pending.push({ value, pointer });
+      pending.push({ value, pointer, hasNameKeys });
     }
   };
-  enqueue(document, ROOT_POINTER);
+  enqueue(document, ROOT_POINTER, false);
   for (let next = pending.pop(); next !== void 0; next = pending.pop()) {
-    if (hasStringRef(next.value)) {
-      found.push({ node: next.value, pointer: next.pointer });
-    }
+    found.push(next);
     for (const [key, child] of Object.entries(next.value)) {
-      enqueue(child, childPointer(next.pointer, key));
+      if (next.hasNameKeys || !isDataKey(key)) {
+        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));
+      }
     }
   }
   return found;
 }
+function hasStringRef(value) {
+  return !Array.isArray(value) && typeof value.$ref === "string";
+}
+function findRefHolders(document) {
+  return openApiNodes(document).flatMap(
+    ({ value, pointer, hasNameKeys }) => !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : []
+  );
+}
+function isMapping(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function findMappings(document) {
+  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {
+    const { discriminator } = value;
+    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : void 0;
+    return isMapping(mapping) ? [mapping] : [];
+  });
+}
 
-export { findRefHolders };
+export { findMappings, findRefHolders };
 //# sourceMappingURL=ref-holders.mjs.map

package/dist/adapters/redocly-loader/ref-holders.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"ref-holders.mjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/**\n * Every object with a string `$ref` in a parsed document, in no particular order. The walk uses\n * its own stack, so a deeply nested document does not run out of call stack, and a node shared by\n * YAML aliases (or a cycle of them) is visited once.\n */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  const found: RefHolder[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer });\n    }\n  };\n  enqueue(document, ROOT_POINTER);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    if (hasStringRef(next.value)) {\n      found.push({ node: next.value, pointer: next.pointer });\n    }\n    for (const [key, child] of Object.entries(next.value)) {\n      enqueue(child, childPointer(next.pointer, key));\n    }\n  }\n  return found;\n}\n"],"names":[],"mappings":";;AAaA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAOO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,MAAM,QAAqB,EAAC;AAC5B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,KAA0B;AACzD,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,CAAA;AAAA,IACjC;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,UAAU,YAAY,CAAA;AAC9B,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,IAAI,YAAA,CAAa,IAAA,CAAK,KAAK,CAAA,EAAG;AAC5B,MAAA,KAAA,CAAM,IAAA,CAAK,EAAE,IAAA,EAAM,IAAA,CAAK,OAAO,OAAA,EAAS,IAAA,CAAK,SAAS,CAAA;AAAA,IACxD;AACA,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,OAAA,CAAQ,KAAA,EAAO,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAC,CAAA;AAAA,IAChD;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;;"}
+{"version":3,"file":"ref-holders.mjs","sources":["../../../src/adapters/redocly-loader/ref-holders.ts"],"sourcesContent":["import { childPointer, ROOT_POINTER } from \"../../domain/openapi/json-pointer.js\";\n\n/** An object with a string `$ref`, and its JSON Pointer in the document. */\nexport interface RefHolder {\n  readonly node: { $ref: string };\n  readonly pointer: string;\n}\n\n/**\n * Keywords whose value is data, not OpenAPI: a `$ref` or a `discriminator` in an example, a\n * default, a `const` or an `enum` value, or an extension is part of the data and stays as written.\n */\nconst DATA_KEYWORDS = new Set([\"example\", \"examples\", \"default\", \"const\", \"enum\"]);\nconst EXTENSION_PREFIX = \"x-\";\n\n/**\n * Keywords whose value maps names to objects: a property, a schema or a response may be named\n * `default` or `example`, and is OpenAPI all the same.\n */\nconst NAME_MAPS = new Set([\n  \"properties\",\n  \"patternProperties\",\n  \"dependentSchemas\",\n  \"$defs\",\n  \"definitions\",\n  \"schemas\",\n  \"responses\",\n  \"parameters\",\n  \"requestBodies\",\n  \"headers\",\n  \"securitySchemes\",\n  \"links\",\n  \"callbacks\",\n  \"pathItems\",\n  \"mediaTypes\",\n  \"content\",\n  \"encoding\",\n  \"paths\",\n  \"webhooks\",\n]);\n\ninterface PendingNode {\n  readonly value: object;\n  readonly pointer: string;\n  /** Whether the keys of `value` are names (of properties, schemas, responses), not keywords. */\n  readonly hasNameKeys: boolean;\n}\n\nfunction isDataKey(key: string): boolean {\n  return DATA_KEYWORDS.has(key) || key.startsWith(EXTENSION_PREFIX);\n}\n\n/**\n * Every object of a parsed document that is OpenAPI, not data (`DATA_KEYWORDS`), with its JSON\n * Pointer, in no particular order. The walk uses its own stack, so a deeply nested document does\n * not run out of call stack, and a node shared by YAML aliases (or a cycle of them) is visited\n * once.\n */\nfunction openApiNodes(document: unknown): PendingNode[] {\n  const found: PendingNode[] = [];\n  const visited = new WeakSet<object>();\n  const pending: PendingNode[] = [];\n  const enqueue = (value: unknown, pointer: string, hasNameKeys: boolean): void => {\n    if (typeof value === \"object\" && value !== null && !visited.has(value)) {\n      visited.add(value);\n      pending.push({ value, pointer, hasNameKeys });\n    }\n  };\n  enqueue(document, ROOT_POINTER, false);\n  for (let next = pending.pop(); next !== undefined; next = pending.pop()) {\n    found.push(next);\n    // One push per child: spreading an array of millions of children overflows the stack.\n    for (const [key, child] of Object.entries(next.value)) {\n      if (next.hasNameKeys || !isDataKey(key)) {\n        enqueue(child, childPointer(next.pointer, key), !next.hasNameKeys && NAME_MAPS.has(key));\n      }\n    }\n  }\n  return found;\n}\n\nfunction hasStringRef(value: object): value is { $ref: string } {\n  return !Array.isArray(value) && typeof (value as { $ref?: unknown }).$ref === \"string\";\n}\n\n/** Every object with a string `$ref` in a parsed document, outside data, in no particular order. */\nexport function findRefHolders(document: unknown): RefHolder[] {\n  return openApiNodes(document).flatMap(({ value, pointer, hasNameKeys }) =>\n    !hasNameKeys && hasStringRef(value) ? [{ node: value, pointer }] : [],\n  );\n}\n\nfunction isMapping(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n/** Every `discriminator.mapping` object of a parsed document, outside data. */\nexport function findMappings(document: unknown): Record<string, unknown>[] {\n  return openApiNodes(document).flatMap(({ value, hasNameKeys }) => {\n    const { discriminator } = value as { discriminator?: unknown };\n    const mapping = !hasNameKeys && isMapping(discriminator) ? discriminator.mapping : undefined;\n    return isMapping(mapping) ? [mapping] : [];\n  });\n}\n"],"names":[],"mappings":";;AAYA,MAAM,aAAA,uBAAoB,GAAA,CAAI,CAAC,WAAW,UAAA,EAAY,SAAA,EAAW,OAAA,EAAS,MAAM,CAAC,CAAA;AACjF,MAAM,gBAAA,GAAmB,IAAA;AAMzB,MAAM,SAAA,uBAAgB,GAAA,CAAI;AAAA,EACxB,YAAA;AAAA,EACA,mBAAA;AAAA,EACA,kBAAA;AAAA,EACA,OAAA;AAAA,EACA,aAAA;AAAA,EACA,SAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,eAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,WAAA;AAAA,EACA,YAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AASD,SAAS,UAAU,GAAA,EAAsB;AACvC,EAAA,OAAO,cAAc,GAAA,CAAI,GAAG,CAAA,IAAK,GAAA,CAAI,WAAW,gBAAgB,CAAA;AAClE;AAQA,SAAS,aAAa,QAAA,EAAkC;AACtD,EAAA,MAAM,QAAuB,EAAC;AAC9B,EAAA,MAAM,OAAA,uBAAc,OAAA,EAAgB;AACpC,EAAA,MAAM,UAAyB,EAAC;AAChC,EAAA,MAAM,OAAA,GAAU,CAAC,KAAA,EAAgB,OAAA,EAAiB,WAAA,KAA+B;AAC/E,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,EAAG;AACtE,MAAA,OAAA,CAAQ,IAAI,KAAK,CAAA;AACjB,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,KAAA,EAAO,OAAA,EAAS,aAAa,CAAA;AAAA,IAC9C;AAAA,EACF,CAAA;AACA,EAAA,OAAA,CAAQ,QAAA,EAAU,cAAc,KAAK,CAAA;AACrC,EAAA,KAAA,IAAS,IAAA,GAAO,QAAQ,GAAA,EAAI,EAAG,SAAS,MAAA,EAAW,IAAA,GAAO,OAAA,CAAQ,GAAA,EAAI,EAAG;AACvE,IAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AAEf,IAAA,KAAA,MAAW,CAAC,KAAK,KAAK,CAAA,IAAK,OAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,EAAG;AACrD,MAAA,IAAI,IAAA,CAAK,WAAA,IAAe,CAAC,SAAA,CAAU,GAAG,CAAA,EAAG;AACvC,QAAA,OAAA,CAAQ,KAAA,EAAO,YAAA,CAAa,IAAA,CAAK,OAAA,EAAS,GAAG,CAAA,EAAG,CAAC,IAAA,CAAK,WAAA,IAAe,SAAA,CAAU,GAAA,CAAI,GAAG,CAAC,CAAA;AAAA,MACzF;AAAA,IACF;AAAA,EACF;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,aAAa,KAAA,EAA0C;AAC9D,EAAA,OAAO,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAQ,MAA6B,IAAA,KAAS,QAAA;AAChF;AAGO,SAAS,eAAe,QAAA,EAAgC;AAC7D,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA;AAAA,IAAQ,CAAC,EAAE,KAAA,EAAO,SAAS,WAAA,EAAY,KACnE,CAAC,WAAA,IAAe,YAAA,CAAa,KAAK,CAAA,GAAI,CAAC,EAAE,IAAA,EAAM,OAAO,OAAA,EAAS,IAAI;AAAC,GACtE;AACF;AAEA,SAAS,UAAU,KAAA,EAAkD;AACnE,EAAA,OAAO,OAAO,UAAU,QAAA,IAAY,KAAA,KAAU,QAAQ,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E;AAGO,SAAS,aAAa,QAAA,EAA8C;AACzE,EAAA,OAAO,YAAA,CAAa,QAAQ,CAAA,CAAE,OAAA,CAAQ,CAAC,EAAE,KAAA,EAAO,aAAY,KAAM;AAChE,IAAA,MAAM,EAAE,eAAc,GAAI,KAAA;AAC1B,IAAA,MAAM,UAAU,CAAC,WAAA,IAAe,UAAU,aAAa,CAAA,GAAI,cAAc,OAAA,GAAU,MAAA;AACnF,IAAA,OAAO,UAAU,OAAO,CAAA,GAAI,CAAC,OAAO,IAAI,EAAC;AAAA,EAC3C,CAAC,CAAA;AACH;;"}

package/dist/adapters/redocly-loader/remote-fetch.cjs

@@ -55,20 +55,34 @@ function fetchWithTimeout(timeoutMs, bodyLimit) {
 function fetchWithBodyLimit(fetchImpl, bodyLimit) {
   return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
 }
+class RedirectedUrls {
+  #finalUrls = /* @__PURE__ */ new Map();
+  record(requested, final) {
+    if (requested !== final) {
+      this.#finalUrls.set(requested, final);
+    }
+  }
+  /** The URL the document of `requested` came from; `requested` when it was not redirected. */
+  finalUrlOf(requested) {
+    return this.#finalUrls.get(requested) ?? requested;
+  }
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
+    const hosts = input === policy.rootUrl ? void 0 : policy.hosts;
     let url = new URL(input);
     for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-      if (hop > 0 && policy.hosts !== void 0 && !allowedHosts.isHostAllowed(url, policy.hosts)) {
+      if (hop > 0 && hosts !== void 0 && !allowedHosts.isHostAllowed(url, hosts)) {
         throw schemaLoadErrors.refForbiddenError(url.href, {
           reason: "host-not-allowed",
-          allowedHosts: [...policy.hosts]
+          allowedHosts: [...hosts]
         });
       }
       const headers = await configuredHeaders.headersFor(url, policy.headers);
       const response = await fetchImpl(url.href, { ...init, headers, redirect: "manual" });
       const location = response.headers.get("location");
       if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+        policy.redirects.record(input, url.href);
         return response;
       }
       url = new URL(location, url);
@@ -103,13 +117,16 @@ function resolveConfigWithAccess(resolve, options) {
   const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
-    hosts: options.access.remoteHosts
+    hosts: options.access.remoteHosts,
+    rootUrl: options.rootUrl,
+    redirects: options.redirects
   });
   const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);
   return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };
 }
 
 exports.MAX_REDIRECTS = MAX_REDIRECTS;
+exports.RedirectedUrls = RedirectedUrls;
 exports.fetchWithCheckedRedirects = fetchWithCheckedRedirects;
 exports.fetchWithConcurrencyLimit = fetchWithConcurrencyLimit;
 exports.resolveConfigWithAccess = resolveConfigWithAccess;

package/dist/adapters/redocly-loader/remote-fetch.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && policy.hosts !== undefined && !isHostAllowed(url, policy.hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...policy.hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor","RemoteBodyLimit"],"mappings":";;;;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAkBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,CAAA,IAAK,MAAA,CAAO,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA,EAAG;AAC9E,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,MAAA,CAAO,KAAK;AAAA,SAC/B,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAiBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAIC,+BAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,GACvB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;"}
+{"version":3,"file":"remote-fetch.cjs","sources":["../../../src/adapters/redocly-loader/remote-fetch.ts"],"sourcesContent":["import type { Config as RedoclyConfig } from \"@redocly/openapi-core\";\nimport type { RefAccess } from \"../../application/ports/schema-loader.js\";\nimport { isHostAllowed } from \"./allowed-hosts.js\";\nimport { type ConfiguredHeader, headersFor } from \"./configured-headers.js\";\nimport { RemoteBodyLimit, type RemoteBodyLimits } from \"./remote-body-limit.js\";\nimport { refForbiddenError } from \"./schema-load-errors.js\";\n\n/**\n * How the loader fetches remote documents: a time limit, size limits, the host limit and the\n * configured headers checked on every redirect.\n */\n\ntype ResolveConfig = RedoclyConfig[\"resolve\"];\n\n/** The fetch Redocly calls for a remote document (`resolve.http.customFetch`). */\nexport type RemoteFetch = (input: string, init?: RequestInit) => Promise<Response>;\n\n/**\n * Redirects followed for one remote document. The loader follows them itself, so that each hop is\n * checked; 20 is the limit of the Fetch standard, which fetch applied before.\n */\nexport const MAX_REDIRECTS = 20;\n\nconst REDIRECT_STATUSES = new Set([301, 302, 303, 307, 308]);\n\n/** Statuses whose responses have no body; `new Response()` refuses a body for them. */\nconst NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);\n\n/**\n * A response whose body is already read within the size limits, so that reading it again cannot\n * wait, fail or take more memory.\n */\nasync function bufferedResponse(\n  response: Response,\n  url: string,\n  bodyLimit: RemoteBodyLimit,\n): Promise<Response> {\n  const body = await bodyLimit.read(response, url);\n  const { status, statusText, headers } = response;\n  return new Response(NULL_BODY_STATUSES.has(status) ? null : body, {\n    status,\n    statusText,\n    headers,\n  });\n}\n\n/**\n * Codes of a connection that closed before any response came. The server can close a kept-alive\n * connection while the process is busy (parsing a large document, generating another API) and\n * has not read the close yet; the next request on that connection then fails with one of these.\n */\nconst CLOSED_CONNECTION_CODES: ReadonlySet<string> = new Set([\n  \"ECONNRESET\",\n  \"EPIPE\",\n  \"UND_ERR_SOCKET\",\n]);\n\n/** Methods that may be sent again without a second effect (RFC 9110 §9.2.2). */\nconst IDEMPOTENT_METHODS: ReadonlySet<string> = new Set([\"GET\", \"HEAD\"]);\nconst DEFAULT_METHOD = \"GET\";\n\n/** Whether fetch failed because its connection closed before any response came. */\nfunction isClosedConnection(error: unknown): boolean {\n  const cause = error instanceof TypeError ? error.cause : undefined;\n  const code = cause instanceof Error && \"code\" in cause ? cause.code : undefined;\n  return typeof code === \"string\" && CLOSED_CONNECTION_CODES.has(code);\n}\n\n/**\n * Fetch, and send the request once more when its connection closed before any response came, as\n * RFC 9112 §9.3.1 allows for an idempotent request. Fetch drops a connection that failed, so the\n * second attempt goes out on another one; a second failure is the server's answer and is thrown.\n */\nasync function fetchOnOpenConnection(input: string, init: RequestInit): Promise<Response> {\n  try {\n    return await fetch(input, init);\n  } catch (error) {\n    const method = (init.method ?? DEFAULT_METHOD).toUpperCase();\n    if (!(IDEMPOTENT_METHODS.has(method) && isClosedConnection(error))) {\n      throw error;\n    }\n    return fetch(input, init);\n  }\n}\n\n/**\n * Fetch with a time limit for the whole response, body included: Node's own fetch waits five\n * minutes for a server that never answers, and a server that sends its body one byte at a time\n * never finishes. The body is read here, inside the limit; when Redocly read it, the abort\n * surfaced as a `DOMException` whose read-only `message` Redocly tried to change, which gave\n * \"Cannot set property message of  which has only a getter\" instead of the time limit.\n */\nfunction fetchWithTimeout(timeoutMs: number, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init = {}) => {\n    try {\n      // One signal for both attempts, so that a request sent again stays within the same limit.\n      const signal = AbortSignal.timeout(timeoutMs);\n      const response = await fetchOnOpenConnection(input, { ...init, signal });\n      return await bufferedResponse(response, input, bodyLimit);\n    } catch (cause) {\n      const isTimeout = cause instanceof Error && cause.name === \"TimeoutError\";\n      throw isTimeout ? new Error(`Timed out after ${timeoutMs} ms loading ${input}`) : cause;\n    }\n  };\n}\n\n/** A configured `customFetch` with its bodies read within the size limits. */\nfunction fetchWithBodyLimit(fetchImpl: RemoteFetch, bodyLimit: RemoteBodyLimit): RemoteFetch {\n  return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);\n}\n\n/**\n * The URL each remote document was read from in the end, when redirects moved it. A relative\n * `$ref` resolves against the URL the document was retrieved from (RFC 3986, section 5.1.3), so\n * `/latest` that redirects to `/static/v1/root.yaml` loads `./pet.yaml` from `/static/v1/`.\n * Redocly reads only the body of the response, so the fetch records the URL here.\n */\nexport class RedirectedUrls {\n  readonly #finalUrls = new Map<string, string>();\n\n  record(requested: string, final: string): void {\n    if (requested !== final) {\n      this.#finalUrls.set(requested, final);\n    }\n  }\n\n  /** The URL the document of `requested` came from; `requested` when it was not redirected. */\n  finalUrlOf(requested: string): string {\n    return this.#finalUrls.get(requested) ?? requested;\n  }\n}\n\n/** What every hop of a remote fetch is checked against. */\nexport interface RedirectPolicy {\n  /** `resolve.http.headers` of the Redocly config; chosen again for the URL of every hop. */\n  readonly headers: readonly ConfiguredHeader[];\n  /** `--remote-ref-hosts`; undefined allows every host. */\n  readonly hosts: readonly string[] | undefined;\n  /**\n   * The URL of the root document, if it is remote. The developer chose it, so neither it nor its\n   * redirects are limited to the hosts (ADR-017): a spec URL that redirects to a CDN loads.\n   */\n  readonly rootUrl: string | undefined;\n  /** Where the final URL of each redirected document is recorded. */\n  readonly redirects: RedirectedUrls;\n}\n\n/**\n * Follow redirects one by one. Fetch drops only `Authorization`, `Cookie` and\n * `Proxy-Authorization` on a redirect to another origin and keeps every other header (an\n * `X-Api-Key`), so the configured headers are chosen for each hop's own URL instead, and a hop to\n * a host that is not listed is refused before it is fetched. The first URL was checked by the\n * resolver (or is the root document). Redocly passes only the configured headers in `init`, and\n * it gets an empty list of them (`resolveConfigWithAccess`), so `init.headers` is replaced.\n */\nexport function fetchWithCheckedRedirects(\n  fetchImpl: RemoteFetch,\n  policy: RedirectPolicy,\n): RemoteFetch {\n  return async (input, init = {}) => {\n    const hosts = input === policy.rootUrl ? undefined : policy.hosts;\n    let url = new URL(input);\n    for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {\n      if (hop > 0 && hosts !== undefined && !isHostAllowed(url, hosts)) {\n        throw refForbiddenError(url.href, {\n          reason: \"host-not-allowed\",\n          allowedHosts: [...hosts],\n        });\n      }\n      const headers = await headersFor(url, policy.headers);\n      const response = await fetchImpl(url.href, { ...init, headers, redirect: \"manual\" });\n      const location = response.headers.get(\"location\");\n      if (!REDIRECT_STATUSES.has(response.status) || location === null) {\n        policy.redirects.record(input, url.href);\n        return response;\n      }\n      url = new URL(location, url);\n    }\n    throw new Error(`More than ${MAX_REDIRECTS} redirects loading ${input}`);\n  };\n}\n\n/** Bounds on the remote documents of one load (threat model T2, ADR-033). */\nexport interface RemoteDocumentLimits extends RemoteBodyLimits {\n  /** Remote documents one load may fetch, the root included; one more is refused. */\n  readonly maxDocuments: number;\n  /** Remote documents fetched at the same time; the others wait for a free slot. */\n  readonly maxParallelFetches: number;\n  /** Nodes (keys and values) the remote documents of one load may parse into together. */\n  readonly maxNodes: number;\n}\n\n/**\n * At most `limit` calls of the fetch run at once; the others wait in order. A finished call hands\n * its slot to the next waiting one.\n */\nexport function fetchWithConcurrencyLimit(fetchImpl: RemoteFetch, limit: number): RemoteFetch {\n  let running = 0;\n  const waiting: (() => void)[] = [];\n  return async (input, init) => {\n    if (running < limit) {\n      running += 1;\n    } else {\n      await new Promise<void>((resolve) => waiting.push(resolve));\n    }\n    try {\n      return await fetchImpl(input, init);\n    } finally {\n      const next = waiting.shift();\n      if (next === undefined) {\n        running -= 1;\n      } else {\n        next();\n      }\n    }\n  };\n}\n\nexport interface RemoteFetchOptions {\n  /** Time limit of one fetch and its body, unless the Redocly config has its own `customFetch`. */\n  readonly timeoutMs: number;\n  readonly access: RefAccess;\n  /** The root document's URL, whose redirects are not limited to the hosts. */\n  readonly rootUrl: string | undefined;\n  readonly maxParallelFetches: number;\n  readonly bodyLimits: RemoteBodyLimits;\n  readonly redirects: RedirectedUrls;\n}\n\n/**\n * The resolve config with the fetch the loader uses. A `customFetch` of the Redocly config is\n * kept and wrapped, so that each redirect is checked, each body is read within the size limits\n * and only a few documents load at once. The\n * configured headers move into that wrapper: Redocly would match them against the raw URL and\n * send them on through redirects.\n */\nexport function resolveConfigWithAccess(\n  resolve: ResolveConfig,\n  options: RemoteFetchOptions,\n): ResolveConfig {\n  // Redocly types `customFetch` as `Function`; it is called as fetch is.\n  const configured = resolve.http.customFetch as RemoteFetch | undefined;\n  // One limit per load, so that the total covers every document this resolver fetches.\n  const bodyLimit = new RemoteBodyLimit(options.bodyLimits);\n  const base =\n    configured === undefined\n      ? fetchWithTimeout(options.timeoutMs, bodyLimit)\n      : fetchWithBodyLimit(configured, bodyLimit);\n  const checked = fetchWithCheckedRedirects(base, {\n    headers: resolve.http.headers,\n    hosts: options.access.remoteHosts,\n    rootUrl: options.rootUrl,\n    redirects: options.redirects,\n  });\n  // The limit is outside the redirects, so all hops of one document share one slot.\n  const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);\n  return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };\n}\n"],"names":["isHostAllowed","refForbiddenError","headersFor","RemoteBodyLimit"],"mappings":";;;;;;;AAqBO,MAAM,aAAA,GAAgB;AAE7B,MAAM,iBAAA,uBAAwB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAG3D,MAAM,kBAAA,uBAAyB,GAAA,CAAI,CAAC,KAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAG,CAAC,CAAA;AAM5D,eAAe,gBAAA,CACb,QAAA,EACA,GAAA,EACA,SAAA,EACmB;AACnB,EAAA,MAAM,IAAA,GAAO,MAAM,SAAA,CAAU,IAAA,CAAK,UAAU,GAAG,CAAA;AAC/C,EAAA,MAAM,EAAE,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ,GAAI,QAAA;AACxC,EAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,CAAmB,IAAI,MAAM,CAAA,GAAI,OAAO,IAAA,EAAM;AAAA,IAChE,MAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOA,MAAM,uBAAA,uBAAmD,GAAA,CAAI;AAAA,EAC3D,YAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAC,CAAA;AAGD,MAAM,qCAA0C,IAAI,GAAA,CAAI,CAAC,KAAA,EAAO,MAAM,CAAC,CAAA;AACvE,MAAM,cAAA,GAAiB,KAAA;AAGvB,SAAS,mBAAmB,KAAA,EAAyB;AACnD,EAAA,MAAM,KAAA,GAAQ,KAAA,YAAiB,SAAA,GAAY,KAAA,CAAM,KAAA,GAAQ,MAAA;AACzD,EAAA,MAAM,OAAO,KAAA,YAAiB,KAAA,IAAS,MAAA,IAAU,KAAA,GAAQ,MAAM,IAAA,GAAO,MAAA;AACtE,EAAA,OAAO,OAAO,IAAA,KAAS,QAAA,IAAY,uBAAA,CAAwB,IAAI,IAAI,CAAA;AACrE;AAOA,eAAe,qBAAA,CAAsB,OAAe,IAAA,EAAsC;AACxF,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,KAAA,EAAO,IAAI,CAAA;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAA,CAAU,IAAA,CAAK,MAAA,IAAU,cAAA,EAAgB,WAAA,EAAY;AAC3D,IAAA,IAAI,EAAE,kBAAA,CAAmB,GAAA,CAAI,MAAM,CAAA,IAAK,kBAAA,CAAmB,KAAK,CAAA,CAAA,EAAI;AAClE,MAAA,MAAM,KAAA;AAAA,IACR;AACA,IAAA,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAAA,EAC1B;AACF;AASA,SAAS,gBAAA,CAAiB,WAAmB,SAAA,EAAyC;AACpF,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,IAAI;AAEF,MAAA,MAAM,MAAA,GAAS,WAAA,CAAY,OAAA,CAAQ,SAAS,CAAA;AAC5C,MAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,CAAsB,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AACvE,MAAA,OAAO,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAA,EAAO,SAAS,CAAA;AAAA,IAC1D,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,SAAA,GAAY,KAAA,YAAiB,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,cAAA;AAC3D,MAAA,MAAM,SAAA,GAAY,IAAI,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,YAAA,EAAe,KAAK,EAAE,CAAA,GAAI,KAAA;AAAA,IACpF;AAAA,EACF,CAAA;AACF;AAGA,SAAS,kBAAA,CAAmB,WAAwB,SAAA,EAAyC;AAC3F,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,KAAS,gBAAA,CAAiB,MAAM,UAAU,KAAA,EAAO,IAAI,CAAA,EAAG,KAAA,EAAO,SAAS,CAAA;AAC/F;AAQO,MAAM,cAAA,CAAe;AAAA,EACjB,UAAA,uBAAiB,GAAA,EAAoB;AAAA,EAE9C,MAAA,CAAO,WAAmB,KAAA,EAAqB;AAC7C,IAAA,IAAI,cAAc,KAAA,EAAO;AACvB,MAAA,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,SAAA,EAAW,KAAK,CAAA;AAAA,IACtC;AAAA,EACF;AAAA;AAAA,EAGA,WAAW,SAAA,EAA2B;AACpC,IAAA,OAAO,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,SAAS,CAAA,IAAK,SAAA;AAAA,EAC3C;AACF;AAyBO,SAAS,yBAAA,CACd,WACA,MAAA,EACa;AACb,EAAA,OAAO,OAAO,KAAA,EAAO,IAAA,GAAO,EAAC,KAAM;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAA,KAAU,MAAA,CAAO,OAAA,GAAU,SAAY,MAAA,CAAO,KAAA;AAC5D,IAAA,IAAI,GAAA,GAAM,IAAI,GAAA,CAAI,KAAK,CAAA;AACvB,IAAA,KAAA,IAAS,GAAA,GAAM,CAAA,EAAG,GAAA,IAAO,aAAA,EAAe,OAAO,CAAA,EAAG;AAChD,MAAA,IAAI,GAAA,GAAM,KAAK,KAAA,KAAU,MAAA,IAAa,CAACA,0BAAA,CAAc,GAAA,EAAK,KAAK,CAAA,EAAG;AAChE,QAAA,MAAMC,kCAAA,CAAkB,IAAI,IAAA,EAAM;AAAA,UAChC,MAAA,EAAQ,kBAAA;AAAA,UACR,YAAA,EAAc,CAAC,GAAG,KAAK;AAAA,SACxB,CAAA;AAAA,MACH;AACA,MAAA,MAAM,OAAA,GAAU,MAAMC,4BAAA,CAAW,GAAA,EAAK,OAAO,OAAO,CAAA;AACpD,MAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,GAAA,CAAI,IAAA,EAAM,EAAE,GAAG,IAAA,EAAM,OAAA,EAAS,QAAA,EAAU,QAAA,EAAU,CAAA;AACnF,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA;AAChD,MAAA,IAAI,CAAC,iBAAA,CAAkB,GAAA,CAAI,SAAS,MAAM,CAAA,IAAK,aAAa,IAAA,EAAM;AAChE,QAAA,MAAA,CAAO,SAAA,CAAU,MAAA,CAAO,KAAA,EAAO,GAAA,CAAI,IAAI,CAAA;AACvC,QAAA,OAAO,QAAA;AAAA,MACT;AACA,MAAA,GAAA,GAAM,IAAI,GAAA,CAAI,QAAA,EAAU,GAAG,CAAA;AAAA,IAC7B;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,UAAA,EAAa,aAAa,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EACzE,CAAA;AACF;AAgBO,SAAS,yBAAA,CAA0B,WAAwB,KAAA,EAA4B;AAC5F,EAAA,IAAI,OAAA,GAAU,CAAA;AACd,EAAA,MAAM,UAA0B,EAAC;AACjC,EAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,IAAA,IAAI,UAAU,KAAA,EAAO;AACnB,MAAA,OAAA,IAAW,CAAA;AAAA,IACb,CAAA,MAAO;AACL,MAAA,MAAM,IAAI,OAAA,CAAc,CAAC,YAAY,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAC,CAAA;AAAA,IAC5D;AACA,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,SAAA,CAAU,KAAA,EAAO,IAAI,CAAA;AAAA,IACpC,CAAA,SAAE;AACA,MAAA,MAAM,IAAA,GAAO,QAAQ,KAAA,EAAM;AAC3B,MAAA,IAAI,SAAS,MAAA,EAAW;AACtB,QAAA,OAAA,IAAW,CAAA;AAAA,MACb,CAAA,MAAO;AACL,QAAA,IAAA,EAAK;AAAA,MACP;AAAA,IACF;AAAA,EACF,CAAA;AACF;AAoBO,SAAS,uBAAA,CACd,SACA,OAAA,EACe;AAEf,EAAA,MAAM,UAAA,GAAa,QAAQ,IAAA,CAAK,WAAA;AAEhC,EAAA,MAAM,SAAA,GAAY,IAAIC,+BAAA,CAAgB,OAAA,CAAQ,UAAU,CAAA;AACxD,EAAA,MAAM,IAAA,GACJ,UAAA,KAAe,MAAA,GACX,gBAAA,CAAiB,OAAA,CAAQ,WAAW,SAAS,CAAA,GAC7C,kBAAA,CAAmB,UAAA,EAAY,SAAS,CAAA;AAC9C,EAAA,MAAM,OAAA,GAAU,0BAA0B,IAAA,EAAM;AAAA,IAC9C,OAAA,EAAS,QAAQ,IAAA,CAAK,OAAA;AAAA,IACtB,KAAA,EAAO,QAAQ,MAAA,CAAO,WAAA;AAAA,IACtB,SAAS,OAAA,CAAQ,OAAA;AAAA,IACjB,WAAW,OAAA,CAAQ;AAAA,GACpB,CAAA;AAED,EAAA,MAAM,WAAA,GAAc,yBAAA,CAA0B,OAAA,EAAS,OAAA,CAAQ,kBAAkB,CAAA;AACjF,EAAA,OAAO,EAAE,GAAG,OAAA,EAAS,IAAA,EAAM,EAAE,GAAG,OAAA,CAAQ,IAAA,EAAM,OAAA,EAAS,EAAC,EAAG,WAAA,EAAY,EAAE;AAC3E;;;;;;"}

package/dist/adapters/redocly-loader/remote-fetch.mjs

@@ -53,20 +53,34 @@ function fetchWithTimeout(timeoutMs, bodyLimit) {
 function fetchWithBodyLimit(fetchImpl, bodyLimit) {
   return async (input, init) => bufferedResponse(await fetchImpl(input, init), input, bodyLimit);
 }
+class RedirectedUrls {
+  #finalUrls = /* @__PURE__ */ new Map();
+  record(requested, final) {
+    if (requested !== final) {
+      this.#finalUrls.set(requested, final);
+    }
+  }
+  /** The URL the document of `requested` came from; `requested` when it was not redirected. */
+  finalUrlOf(requested) {
+    return this.#finalUrls.get(requested) ?? requested;
+  }
+}
 function fetchWithCheckedRedirects(fetchImpl, policy) {
   return async (input, init = {}) => {
+    const hosts = input === policy.rootUrl ? void 0 : policy.hosts;
     let url = new URL(input);
     for (let hop = 0; hop <= MAX_REDIRECTS; hop += 1) {
-      if (hop > 0 && policy.hosts !== void 0 && !isHostAllowed(url, policy.hosts)) {
+      if (hop > 0 && hosts !== void 0 && !isHostAllowed(url, hosts)) {
         throw refForbiddenError(url.href, {
           reason: "host-not-allowed",
-          allowedHosts: [...policy.hosts]
+          allowedHosts: [...hosts]
         });
       }
       const headers = await headersFor(url, policy.headers);
       const response = await fetchImpl(url.href, { ...init, headers, redirect: "manual" });
       const location = response.headers.get("location");
       if (!REDIRECT_STATUSES.has(response.status) || location === null) {
+        policy.redirects.record(input, url.href);
         return response;
       }
       url = new URL(location, url);
@@ -101,11 +115,13 @@ function resolveConfigWithAccess(resolve, options) {
   const base = configured === void 0 ? fetchWithTimeout(options.timeoutMs, bodyLimit) : fetchWithBodyLimit(configured, bodyLimit);
   const checked = fetchWithCheckedRedirects(base, {
     headers: resolve.http.headers,
-    hosts: options.access.remoteHosts
+    hosts: options.access.remoteHosts,
+    rootUrl: options.rootUrl,
+    redirects: options.redirects
   });
   const customFetch = fetchWithConcurrencyLimit(checked, options.maxParallelFetches);
   return { ...resolve, http: { ...resolve.http, headers: [], customFetch } };
 }
 
-export { MAX_REDIRECTS, fetchWithCheckedRedirects, fetchWithConcurrencyLimit, resolveConfigWithAccess };
+export { MAX_REDIRECTS, RedirectedUrls, fetchWithCheckedRedirects, fetchWithConcurrencyLimit, resolveConfigWithAccess };
 //# sourceMappingURL=remote-fetch.mjs.map