import { i as DiagnosticsOptions } from "./diagnostics-mftUZI7c.mjs";

//#region src/core/ref.d.ts
/**
 * The canonical recursive `$anchor` name synthesised by the Draft
 * 2019-09 `$recursiveAnchor: true` rewrite. Re-exported here so the
 * collision check in {@link findAnchor} stays aligned with the
 * rewriter in `core/normalise.ts`.
 */
declare const RECURSIVE_ANCHOR_SENTINEL = "__recursive__";
/**
 * Resolver function for external $ref URIs.
 * Called with the URI portion (everything before `#`) of an external ref.
 * Returns the parsed document (JSON object) or undefined.
 *
 * ### Security warning — SSRF and local-file disclosure
 *
 * Consumers MUST validate the URI before fetching the target document.
 * schema-components hands the resolver the raw `$ref` URI from the
 * document — which is typically user-controlled — and any network or
 * filesystem access the resolver performs runs with the host
 * application's full privileges. An attacker-crafted schema that
 * references an internal endpoint or a local filesystem path will
 * happily exfiltrate or expose data the application never intended to
 * surface.
 *
 * At a minimum the resolver should:
 *
 * - Refuse non-`https:` schemes by default. Permit `http:` only on an
 *   explicit allow-list. Refuse `file:`, `data:`, `javascript:`,
 *   `ftp:`, `gopher:`, and every other scheme outright.
 * - Resolve the URI's hostname and refuse loopback addresses
 *   (`127.0.0.0/8`, `::1`), link-local addresses (`169.254.0.0/16`,
 *   `fe80::/10`), private ranges (`10.0.0.0/8`, `172.16.0.0/12`,
 *   `192.168.0.0/16`, `fc00::/7`), and cloud-metadata IPs
 *   (`169.254.169.254`, `fd00:ec2::254`).
 * - Apply a strict allow-list of permitted hosts where possible.
 * - Set request timeouts and a maximum response size.
 * - Disable HTTP redirects, or re-validate the redirected URL against
 *   the same denylist before following.
 * - Reject responses that are not `application/json` or
 *   `application/yaml`.
 *
 * schema-components performs no validation itself — that responsibility
 * sits exclusively with the resolver implementation supplied by the
 * caller.
 */
type ExternalResolver = (uri: string) => unknown;
/**
 * Options for $ref resolution.
 */
interface RefOptions {
  diagnostics?: DiagnosticsOptions;
  externalResolver?: ExternalResolver;
}
/**
 * Count all distinct `$ref` strings reachable from a root document.
 * A chain longer than the number of distinct refs is necessarily cyclic.
 * Returns at least 1 so that single-ref schemas have a usable bound.
 */
declare function countDistinctRefs(root: Record<string, unknown>): number;
/**
 * Resolve a `$ref` in a schema against a root document.
 * Returns the original schema if no `$ref` is present.
 * Returns an unknown-schema placeholder on cycle or depth exceeded.
 *
 * The depth bound is derived from the number of distinct `$ref` strings
 * in the root document — a chain longer than that count is necessarily
 * cyclic. When `maxDepth` is not provided, a reasonable default is used.
 */
declare function resolveRef(schema: Record<string, unknown>, rootDocument: Record<string, unknown>, visited: Set<string>, diagnostics?: DiagnosticsOptions, maxDepth?: number, externalResolver?: ExternalResolver): Record<string, unknown>;
/**
 * Dereference a JSON Pointer fragment (`#/path/to/schema`) or an
 * `$anchor` (`#SomeName`) against a root document.
 *
 * Returns the resolved sub-schema, which may be a JSON object or — per
 * Draft 06+ — a boolean (`true` for the always-valid schema, `false`
 * for the never-valid schema). Returns `undefined` when the pointer or
 * anchor cannot be resolved.
 *
 * JSON Pointer segments are percent-decoded per RFC 6901 §6 before the
 * `~1`/`~0` token expansion; this allows pointers such as
 * `#/paths/~1pets%20store` to resolve a path containing a literal space.
 */
declare function dereference(ref: string, root: Record<string, unknown>): Record<string, unknown> | boolean | undefined;
/**
 * Recursively scan a schema document for a `$anchor` matching the given name.
 * Returns the schema object containing the anchor, or undefined.
 *
 * Per JSON Schema 2020-12 §8.2, `$anchor` is scoped to the resource
 * defined by the nearest enclosing `$id`. A bare DFS would happily
 * cross resource boundaries and resolve to an anchor declared in an
 * unrelated sub-resource — that violates the spec and produces wrong
 * walker input when two sub-schemas use the same anchor name within
 * their own `$id` scope.
 *
 * The walk skips into any sub-tree that introduces a new `$id` value:
 * such a sub-tree is a separate resource and its `$anchor`s belong to
 * that resource, not the caller's. Anchors declared at the same `$id`
 * scope (or in nested sub-schemas without their own `$id`) remain
 * reachable.
 *
 * The optional `visited` set guards against shared object references and
 * cycles introduced by the OpenAPI bundler's `structuredClone`-based
 * inlining of external refs. Without it a recursive document would stack
 * overflow before reaching the matching anchor.
 *
 * When `crossResourceBoundary` is `true` the walker is currently
 * recursing into a sub-tree that introduced its own `$id`; we still
 * recurse so a nested `$anchor` declared inside that same sub-resource
 * is reachable from the caller that owns that resource, but we skip
 * further nested resources for the same reason as above.
 */
declare function findAnchor(node: unknown, anchorName: string, visited?: WeakSet<object>): Record<string, unknown> | undefined;
//#endregion
export { dereference as a, countDistinctRefs as i, RECURSIVE_ANCHOR_SENTINEL as n, findAnchor as o, RefOptions as r, resolveRef as s, ExternalResolver as t };