Parse the Microsoft Graph spec with the lean OpenAPI parser to fit the Workers memory limit (#1080)

The full Graph OpenAPI document (37MB, ~16.5k operations) parsed through the
bespoke eemeli/yaml `YAML.parse` builds a full CST that peaks ~720MB heap and
OOMs the 128MB Cloudflare Workers isolate (measured on a real isolate: HTTP
503, outcome=exceededMemory).

Delegate the parse to the OpenAPI SDK's `parse`, which uses js-yaml's `load`
and does not inline `$ref`s. It peaks ~315MB heap and returns HTTP 200 in-band
on the same isolate. `parse` already validates an OpenAPI 3.x object, so the
redundant object/version checks are dropped.

Serialize the small filtered preset spec as JSON (a YAML subset the OpenAPI
parser reads back) instead of `YAML.stringify`, so the plugin no longer needs
its own YAML library at all. The eemeli/yaml dependency is removed; the only
remaining YAML parser in this path is the SDK's js-yaml.

Author: RhysSullivan

bun.lock

@@ -55,8 +55,7 @@
   "dependencies": {
     "@executor-js/plugin-openapi": "workspace:*",
     "@executor-js/sdk": "workspace:*",
-    "lucide-react": "^1.7.0",
-    "yaml": "^2.7.1"
+    "lucide-react": "^1.7.0"
   },
   "devDependencies": {
     "@effect/atom-react": "catalog:",

packages/plugins/microsoft/package.json

@@ -1,6 +1,5 @@
 import { describe, expect, it } from "@effect/vitest";
-import { Effect } from "effect";
-import * as YAML from "yaml";
+import { Effect, Schema } from "effect";
 
 import { MICROSOFT_AUTH_TEMPLATE_SLUG, MICROSOFT_GRAPH_CLIENT_CREDENTIALS_SCOPES } from "./presets";
 import {
@@ -9,6 +8,10 @@ import {
   parseMicrosoftGraphDelegatedScopes,
 } from "./graph";
 
+// The filtered preset spec is emitted as JSON, so re-read it with Effect Schema
+// rather than a YAML parser.
+const decodeJson = Schema.decodeUnknownSync(Schema.fromJsonString(Schema.Unknown));
+
 const graphFixture = `
 openapi: 3.0.4
 info:
@@ -127,7 +130,7 @@ describe("Microsoft Graph OpenAPI filtering", () => {
         pathPrefixes: ["/me/messages"],
         tagPrefixes: [],
       });
-      const doc = YAML.parse(filtered) as {
+      const doc = decodeJson(filtered) as {
         readonly paths: Record<string, unknown>;
         readonly components: {
           readonly securitySchemes: Record<string, unknown>;
@@ -153,7 +156,7 @@ describe("Microsoft Graph OpenAPI filtering", () => {
         pathPrefixes: ["/me/messages"],
         tagPrefixes: [],
       });
-      const doc = YAML.parse(filtered) as {
+      const doc = decodeJson(filtered) as {
         readonly components: {
           readonly schemas?: Record<string, unknown>;
           readonly securitySchemes: Record<string, unknown>;
@@ -177,7 +180,7 @@ describe("Microsoft Graph OpenAPI filtering", () => {
         pathPrefixes: [],
         tagPrefixes: [],
       });
-      const doc = YAML.parse(filtered) as {
+      const doc = decodeJson(filtered) as {
         readonly paths: Record<string, unknown>;
       };
 
@@ -196,7 +199,7 @@ describe("Microsoft Graph OpenAPI filtering", () => {
         pathPrefixes: [],
         tagPrefixes: ["teams."],
       });
-      const doc = YAML.parse(filtered) as {
+      const doc = decodeJson(filtered) as {
         readonly paths: Record<string, unknown>;
       };
 
@@ -213,7 +216,7 @@ describe("Microsoft Graph OpenAPI filtering", () => {
         tagPrefixes: [],
         fullGraphScopes: ["User.Read", "Mail.ReadWrite", "Notes.ReadWrite"],
       });
-      const doc = YAML.parse(filtered.specText) as {
+      const doc = decodeJson(filtered.specText) as {
         readonly paths: Record<string, unknown>;
         readonly security: readonly Record<string, readonly string[]>[];
       };
@@ -281,7 +284,7 @@ components:
           tagPrefixes: [],
         },
       );
-      const doc = YAML.parse(filtered) as {
+      const doc = decodeJson(filtered) as {
         readonly servers: readonly { readonly url: string }[];
         readonly paths: Record<string, unknown>;
         readonly components: {

packages/plugins/microsoft/src/sdk/graph.test.ts

@@ -1,12 +1,12 @@
 import { Effect, Option, Schema } from "effect";
 import type { Layer } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/unstable/http";
-import * as YAML from "yaml";
 
 import { AuthTemplateSlug } from "@executor-js/sdk/core";
 import {
   AuthenticationSchema,
   OpenApiParseError,
+  parse as parseOpenApiDocument,
   type Authentication,
   type OpenApiIntegrationConfig,
   type ParsedDocument,
@@ -174,6 +174,10 @@ const microsoftOAuthTemplate = (
 const isRecord = (value: unknown): value is Record<string, unknown> =>
   value !== null && typeof value === "object" && !Array.isArray(value);
 
+// Hoisted so the compiled encoder is built once, not per call. Emits the small
+// filtered preset spec as JSON, which the OpenAPI SDK's `parse` reads back.
+const encodeOpenApiDocumentToJson = Schema.encodeSync(Schema.fromJsonString(Schema.Unknown));
+
 const HTTP_METHODS = new Set(["delete", "get", "patch", "post", "put"]);
 const BASE_OAUTH_SCOPES = new Set(["offline_access", "openid", "profile", "email"]);
 
@@ -538,26 +542,21 @@ export const fetchMicrosoftGraphPermissionsReference = Effect.fn(
 const parseMicrosoftGraphOpenApiDocument = (
   specText: string,
 ): Effect.Effect<MicrosoftGraphOpenApiDocument, OpenApiParseError> =>
-  Effect.gen(function* () {
-    const parsed = yield* Effect.try({
-      try: () => YAML.parse(specText) as unknown,
-      catch: () =>
+  // Delegate to the OpenAPI SDK's lean js-yaml parser. The bespoke eemeli/yaml
+  // parser this replaced built a full CST that peaks ~720MB heap on the 37MB
+  // Graph spec and OOMs the 128MB Cloudflare Workers isolate (measured: HTTP
+  // 503, outcome=exceededMemory). The SDK parser peaks ~315MB and runs in-band
+  // on Workers. `parse` already validates an OpenAPI 3.x object and does not
+  // inline `$ref`s, so peak memory stays bounded for big specs.
+  parseOpenApiDocument(specText).pipe(
+    Effect.mapError(
+      () =>
         new OpenApiParseError({
           message: "Failed to parse Microsoft Graph OpenAPI document",
         }),
-    });
-    if (!isRecord(parsed)) {
-      return yield* new OpenApiParseError({
-        message: "Microsoft Graph OpenAPI document must be an object",
-      });
-    }
-    if (typeof parsed.openapi !== "string" || !parsed.openapi.startsWith("3.")) {
-      return yield* new OpenApiParseError({
-        message: "Microsoft Graph OpenAPI document must be OpenAPI 3.x",
-      });
-    }
-    return parsed as MicrosoftGraphOpenApiDocument;
-  });
+    ),
+    Effect.map((doc) => doc as MicrosoftGraphOpenApiDocument),
+  );
 
 export const buildFilteredMicrosoftGraphOpenApiSpecFromDocument = (
   parsed: MicrosoftGraphOpenApiDocument,
@@ -632,8 +631,12 @@ export const buildFilteredMicrosoftGraphOpenApiSpecFromDocument = (
       security: [{ [MICROSOFT_AUTH_TEMPLATE_SLUG]: [...scopes] }],
     };
 
+    // Serialize as JSON, not YAML. The OpenAPI SDK's `parse` reads JSON (a YAML
+    // subset) on the way back in, so the filtered preset spec round-trips without
+    // pulling in a second YAML library. This is the small filtered spec, never
+    // the 37MB source document.
     const filteredSpecText = yield* Effect.try({
-      try: () => YAML.stringify(next),
+      try: () => encodeOpenApiDocumentToJson(next),
       catch: () =>
         new OpenApiParseError({
           message: "Failed to serialize Microsoft Graph OpenAPI document",