@scalar/mock-server 0.12.13 → 0.14.0

package/dist/utils/build-seed-context.js

@@ -1,60 +1,12 @@
-import { faker } from '@faker-js/faker';
 import { store } from '../libs/store.js';
 import { createStoreWrapper } from './store-wrapper.js';
 /**
- * Build the seed context with a seed helper function.
- * The seed helper automatically uses the schema key as the collection name.
+ * Build the seed context for a schema.
  */
 export function buildSeedContext(schemaKey) {
     const { wrappedStore } = createStoreWrapper(store);
-    /**
-     * Seed helper function that provides a Laravel-inspired API.
-     */
-    const seedHelper = ((arg1, arg2) => {
-        // Case 1: seed.count(n, factory)
-        if (typeof arg1 === 'number' && typeof arg2 === 'function') {
-            const count = arg1;
-            const factory = arg2;
-            const items = [];
-            for (let i = 0; i < count; i++) {
-                const item = factory();
-                const created = wrappedStore.create(schemaKey, item);
-                items.push(created);
-            }
-            return items;
-        }
-        // Case 2: seed(array)
-        if (Array.isArray(arg1)) {
-            const items = [];
-            for (const item of arg1) {
-                const created = wrappedStore.create(schemaKey, item);
-                items.push(created);
-            }
-            return items;
-        }
-        // Case 3: seed(factory) - single item
-        if (typeof arg1 === 'function') {
-            const factory = arg1;
-            const item = factory();
-            const created = wrappedStore.create(schemaKey, item);
-            return created;
-        }
-        throw new Error('Invalid seed() usage. Use seed.count(n, factory), seed(array), or seed(factory)');
-    });
-    // Add count method to the function
-    seedHelper.count = (n, factory) => {
-        const items = [];
-        for (let i = 0; i < n; i++) {
-            const item = factory();
-            const created = wrappedStore.create(schemaKey, item);
-            items.push(created);
-        }
-        return items;
-    };
     return {
         store: wrappedStore,
-        faker,
-        seed: seedHelper,
         schema: schemaKey,
     };
 }

package/dist/utils/collect-sse-events.d.ts

@@ -0,0 +1,30 @@
+import type { OpenAPIV3_1 } from '@scalar/openapi-types';
+/** One event of a mocked Server-Sent Events response. */
+type SseEvent = {
+    /** Already-framed event text when `framed` is true, otherwise the `data` payload of one event. */
+    text: string;
+    /** Whether `text` is SSE framing of its own, to be written as is rather than wrapped in a `data:` line. */
+    framed: boolean;
+};
+/**
+ * The events a `text/event-stream` response emits, in order.
+ *
+ * Examples win over the schema, mirroring `selectResponseExample`, but a stream reads them as a
+ * sequence rather than a single body:
+ * 1. A named example requested via `Prefer: example=<name>`.
+ * 2. The singular `example` keyword.
+ * 3. Every entry of the `examples` map, in declaration order — an event stream that documents a
+ *    `summary` and a `row` example is documenting the two events it sends. A map of nothing but
+ *    complete framing is the exception: those are alternative streams, so only the first is served.
+ * 4. Nothing declared: a schema-generated payload, repeated so the stream has more than one event.
+ *
+ * `generate` is a callback so the schema is only turned into an example when no example is declared.
+ */
+export declare const collectSseEvents: (mediaType: OpenAPIV3_1.MediaTypeObject | undefined, { exampleName, generate }: {
+    exampleName?: string;
+    generate: () => unknown;
+}) => SseEvent[];
+/** Whether a media type is Server-Sent Events, ignoring parameters such as `; charset=utf-8`. */
+export declare const isEventStreamContentType: (contentType: string | undefined) => boolean;
+export {};
+//# sourceMappingURL=collect-sse-events.d.ts.map

package/dist/utils/collect-sse-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collect-sse-events.d.ts","sourceRoot":"","sources":["../../src/utils/collect-sse-events.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAcxD,yDAAyD;AACzD,KAAK,QAAQ,GAAG;IACd,kGAAkG;IAClG,IAAI,EAAE,MAAM,CAAA;IACZ,2GAA2G;IAC3G,MAAM,EAAE,OAAO,CAAA;CAChB,CAAA;AAgFD;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,gBAAgB,GAC3B,WAAW,WAAW,CAAC,eAAe,GAAG,SAAS,EAClD,2BAA2B;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,OAAO,CAAA;CAAE,KAC3E,QAAQ,EAoDV,CAAA;AAED,iGAAiG;AACjG,eAAO,MAAM,wBAAwB,GAAI,aAAa,MAAM,GAAG,SAAS,KAAG,OACf,CAAA"}

package/dist/utils/collect-sse-events.js

@@ -0,0 +1,137 @@
+import { parseMimeType } from '@scalar/helpers/http/mime-type';
+import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
+/**
+ * How many events a schema-generated `text/event-stream` response emits.
+ *
+ * A single event barely exercises a client's read loop, and an endless stream would never let a
+ * request finish, so the mock sends a short, finite burst and closes.
+ */
+const GENERATED_EVENT_COUNT = 3;
+/** The field prefixes an SSE line may start with (`data`, `event`, `id`, `retry`). */
+const SSE_FIELD = /^(?:data|event|id|retry):/;
+/**
+ * Whether text is already Server-Sent Events framing, so it goes to the wire as its own framing.
+ *
+ * Some documents spell the wire format out in their example (`data: {"type":"edit"}`) instead of
+ * describing a single event payload. Wrapping that in another `data:` line would hand the client the
+ * framing as its payload, so it is written as is, with only its terminating blank line normalized.
+ *
+ * The test is deliberately narrow: real framing opens with an SSE field or a `:` comment on its first
+ * line and carries at least one `data:` line. Prose that merely happens to contain a colon
+ * (`user created\nid: 42`) is not framing — passing it through would make a compliant client dispatch
+ * nothing at all.
+ */
+const isFramed = (text) => {
+    const lines = text.split(/\r\n|\r|\n/).filter((line) => line.trim() !== '');
+    const [firstLine] = lines;
+    if (firstLine === undefined) {
+        return false;
+    }
+    // Text made only of `:` comments is the keep-alive form nothing but a stream writes, so it is
+    // framing even though it carries no event of its own.
+    if (lines.every((line) => line.startsWith(':'))) {
+        return true;
+    }
+    return (firstLine.startsWith(':') || SSE_FIELD.test(firstLine)) && lines.some((line) => line.startsWith('data:'));
+};
+/**
+ * Closes framed text with the blank line that ends an SSE event.
+ *
+ * Documents terminate their framing inconsistently — a YAML block scalar drops all but one newline,
+ * and a Windows-authored document uses CRLF — so the tail is normalized to exactly one blank line in
+ * the document's own line ending instead of being appended to blindly.
+ */
+const terminate = (text) => {
+    const lineEnding = text.includes('\r\n') ? '\r\n' : '\n';
+    // Walk back over the trailing blank lines, taking the indentation a block scalar left on them.
+    // Spaces are only dropped once a line break is found past them, so spaces inside the last field's
+    // value survive. A scan rather than a regex: the pattern for this needs nested quantifiers, which
+    // backtrack quadratically on a long run of spaces.
+    let cursor = text.length;
+    let end = text.length;
+    while (cursor > 0) {
+        const character = text[cursor - 1];
+        if (character === '\n' || character === '\r') {
+            cursor -= 1;
+            end = cursor;
+        }
+        else if (character === ' ' || character === '\t') {
+            cursor -= 1;
+        }
+        else {
+            break;
+        }
+    }
+    return `${text.slice(0, end)}${lineEnding}${lineEnding}`;
+};
+/** Turns one payload into an event, serializing anything that is not already text. */
+const toEvent = (payload) => {
+    if (typeof payload !== 'string') {
+        // `undefined` has no JSON representation, so fall back to `null` rather than an empty event.
+        return { text: JSON.stringify(payload) ?? 'null', framed: false };
+    }
+    return isFramed(payload) ? { text: terminate(payload), framed: true } : { text: payload, framed: false };
+};
+/**
+ * Expands one payload into the events it stands for. An array is read as the sequence of events the
+ * endpoint emits, not as a single event carrying a JSON array — that is the shape a stream describes.
+ */
+const expand = (payload) => (Array.isArray(payload) ? payload.map(toEvent) : [toEvent(payload)]);
+/**
+ * The events a `text/event-stream` response emits, in order.
+ *
+ * Examples win over the schema, mirroring `selectResponseExample`, but a stream reads them as a
+ * sequence rather than a single body:
+ * 1. A named example requested via `Prefer: example=<name>`.
+ * 2. The singular `example` keyword.
+ * 3. Every entry of the `examples` map, in declaration order — an event stream that documents a
+ *    `summary` and a `row` example is documenting the two events it sends. A map of nothing but
+ *    complete framing is the exception: those are alternative streams, so only the first is served.
+ * 4. Nothing declared: a schema-generated payload, repeated so the stream has more than one event.
+ *
+ * `generate` is a callback so the schema is only turned into an example when no example is declared.
+ */
+export const collectSseEvents = (mediaType, { exampleName, generate }) => {
+    const { example, examples } = mediaType ?? {};
+    if (exampleName && examples && exampleName in examples) {
+        const value = getResolvedRef(examples[exampleName])?.value;
+        if (value !== undefined) {
+            return expand(value);
+        }
+    }
+    if (example !== undefined) {
+        return expand(example);
+    }
+    if (examples) {
+        // An Example Object that only carries an `externalValue` has no value to send, so it is skipped
+        // rather than turned into a `data: null` event.
+        const values = Object.values(examples)
+            .map((entry) => getResolvedRef(entry)?.value)
+            .filter((value) => value !== undefined);
+        const [firstValue] = values;
+        if (values.length > 0) {
+            const events = values.flatMap(expand);
+            // An example that is framing already describes a whole stream, so a map of nothing but those
+            // lists alternative streams rather than consecutive events. Sending them back to back would
+            // replay a terminal event such as `[DONE]`, so only the first is served —
+            // `Prefer: example=<name>` picks another one. A map that mixes framing with payloads is still
+            // one sequence: there the framing is a single chunk of it, such as a documented `[DONE]`.
+            return events.every((event) => event.framed) ? expand(firstValue) : events;
+        }
+    }
+    const generated = generate();
+    // Without a schema there is nothing to send, so the stream opens and closes without an event.
+    if (generated === undefined) {
+        return [];
+    }
+    const events = expand(generated);
+    const [firstEvent] = events;
+    // Only a lone generated payload is repeated. Framing generated from the schema already spells the
+    // whole stream out (repeating it would replay a terminal event such as `[DONE]`), and a generated
+    // sequence of several events is a sequence already.
+    return events.length === 1 && firstEvent && !firstEvent.framed
+        ? Array.from({ length: GENERATED_EVENT_COUNT }, () => firstEvent)
+        : events;
+};
+/** Whether a media type is Server-Sent Events, ignoring parameters such as `; charset=utf-8`. */
+export const isEventStreamContentType = (contentType) => parseMimeType(contentType).essence === 'text/event-stream';

package/dist/utils/execute-handler.d.ts

@@ -6,8 +6,11 @@ type HandlerExecutionResult = {
     result: any;
 };
 /**
- * Execute handler code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, req, res).
+ * Execute handler code inside the QuickJS sandbox.
+ *
+ * The handler can only reach the `store` and `faker` bridges and the injected
+ * `req`/`res` inputs. It cannot touch the host runtime, so even untrusted code
+ * from a remote or `$ref`-loaded document is safe to run.
  */
 export declare function executeHandler(code: string, context: HandlerContext): Promise<HandlerExecutionResult>;
 export {};

package/dist/utils/execute-handler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-handler.d.ts","sourceRoot":"","sources":["../../src/utils/execute-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAE7D;;GAEG;AACH,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAqB3G"}
+{"version":3,"file":"execute-handler.d.ts","sourceRoot":"","sources":["../../src/utils/execute-handler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAG7D;;GAEG;AACH,KAAK,sBAAsB,GAAG;IAC5B,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAQ3G"}

package/dist/utils/execute-handler.js

@@ -1,18 +1,16 @@
+import { runInSandbox } from './sandbox.js';
 /**
- * Execute handler code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, req, res).
+ * Execute handler code inside the QuickJS sandbox.
+ *
+ * The handler can only reach the `store` and `faker` bridges and the injected
+ * `req`/`res` inputs. It cannot touch the host runtime, so even untrusted code
+ * from a remote or `$ref`-loaded document is safe to run.
  */
 export async function executeHandler(code, context) {
-    // Create a function that executes the handler code with the context
-    // Using Function constructor to create a sandboxed environment
-    // The code is wrapped in a function body that returns the result
-    const handlerFunction = new Function('store', 'faker', 'req', 'res', `
-    ${code}
-  `);
-    const result = handlerFunction(context.store, context.faker, context.req, context.res);
-    // If the result is a Promise, await it
-    if (result instanceof Promise) {
-        return { result: await result };
-    }
+    const result = await runInSandbox({
+        code,
+        store: context.store,
+        jsonGlobals: { req: context.req, res: context.res },
+    });
     return { result };
 }

package/dist/utils/execute-seed.d.ts

@@ -6,8 +6,11 @@ type SeedExecutionResult = {
     result: any;
 };
 /**
- * Execute seed code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, seed, schema).
+ * Execute seed code inside the QuickJS sandbox.
+ *
+ * The seed code can only reach the `store` and `faker` bridges and the `seed`
+ * helper, which persists generated items through the store. It cannot touch the
+ * host runtime.
  */
 export declare function executeSeed(code: string, context: SeedContext): Promise<SeedExecutionResult>;
 export {};

package/dist/utils/execute-seed.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"execute-seed.d.ts","sourceRoot":"","sources":["../../src/utils/execute-seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAEvD;;GAEG;AACH,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4BlG"}
+{"version":3,"file":"execute-seed.d.ts","sourceRoot":"","sources":["../../src/utils/execute-seed.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAGvD;;GAEG;AACH,KAAK,mBAAmB,GAAG;IACzB,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC,CASlG"}

package/dist/utils/execute-seed.js

@@ -1,25 +1,17 @@
+import { runInSandbox } from './sandbox.js';
 /**
- * Execute seed code in a sandboxed environment.
- * The code has access only to the provided context (store, faker, seed, schema).
+ * Execute seed code inside the QuickJS sandbox.
+ *
+ * The seed code can only reach the `store` and `faker` bridges and the `seed`
+ * helper, which persists generated items through the store. It cannot touch the
+ * host runtime.
  */
 export async function executeSeed(code, context) {
-    // Create a function that executes the seed code with the context
-    // Using Function constructor to create a sandboxed environment
-    // The code is wrapped in a function body that returns the result
-    const seedFunction = new Function('store', 'faker', 'seed', 'schema', `
-    ${code}
-  `);
-    // Execute the seed function with the context
-    try {
-        const result = seedFunction(context.store, context.faker, context.seed, context.schema);
-        // If the result is a Promise, await it
-        if (result instanceof Promise) {
-            return { result: await result };
-        }
-        return { result };
-    }
-    catch (error) {
-        // Re-throw to be caught by the caller
-        throw error;
-    }
+    const result = await runInSandbox({
+        code,
+        store: context.store,
+        jsonGlobals: { schema: context.schema },
+        includeSeed: true,
+    });
+    return { result };
 }

package/dist/utils/hono-route-from-path.d.ts

@@ -1,6 +1,19 @@
+/** Prefix for the parameters we synthesize to match a literal path segment verbatim. */
+export declare const LITERAL_PARAMETER_PREFIX = "__scalar_literal_";
 /**
- * Convert path to route
- * Example: /posts/{id} -> /posts/:id
+ * Convert an OpenAPI path key into a Hono route.
+ *
+ * Example: `/posts/{id}` → `/posts/:id`
+ *
+ * A segment whose literal text would be read as routing syntax is registered as a single parameter
+ * with an explicit pattern instead, because Hono allows only one parameter per segment and that is
+ * the only way to make it match such a segment verbatim. The request then routes to the right
+ * operation, but the path parameters of that one segment are no longer bound by name: they surface
+ * as the synthesized parameter, and a required path parameter in it reads as missing to request
+ * validation. Hono cannot express both at once, and matching the wrong operation is worse.
+ *
+ * A query string in the key (`/v1/messages?beta=true`) is dropped here — it is matched against the
+ * incoming request separately, see `splitPathKey`.
  */
-export declare function honoRouteFromPath(path: string): string;
+export declare const honoRouteFromPath: (path: string) => string;
 //# sourceMappingURL=hono-route-from-path.d.ts.map

package/dist/utils/hono-route-from-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hono-route-from-path.d.ts","sourceRoot":"","sources":["../../src/utils/hono-route-from-path.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,UAE7C"}
+{"version":3,"file":"hono-route-from-path.d.ts","sourceRoot":"","sources":["../../src/utils/hono-route-from-path.ts"],"names":[],"mappings":"AAaA,wFAAwF;AACxF,eAAO,MAAM,wBAAwB,sBAAsB,CAAA;AA2D3D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,KAAG,MAiChD,CAAA"}

package/dist/utils/hono-route-from-path.js

@@ -1,7 +1,100 @@
+import { PATH_KEY_TEMPLATE, splitPathKey } from '../utils/split-path-key.js';
 /**
- * Convert path to route
- * Example: /posts/{id} -> /posts/:id
+ * Characters Hono reads as routing syntax instead of as literal path text.
+ *
+ * `:` starts a path parameter and `*` is a wildcard. The remaining ones end up verbatim in the
+ * regular expression that Hono's `RegExpRouter` compiles, where they act as quantifier (`?`),
+ * alternation (`|`) and pattern delimiters (`{`, `}`) — a path key containing them either routes
+ * the wrong requests or makes the router throw. Hono escapes the other regular expression
+ * metacharacters (`.`, `+`, `(`, `[`, …) itself.
  */
-export function honoRouteFromPath(path) {
-    return path.replace(/{/g, ':').replace(/}/g, '');
-}
+const HONO_ROUTING_CHARACTERS = /[:*?|{}]/;
+/** Prefix for the parameters we synthesize to match a literal path segment verbatim. */
+export const LITERAL_PARAMETER_PREFIX = '__scalar_literal_';
+/**
+ * Escape a literal for use inside the regular expression of a Hono `:name{pattern}` parameter.
+ *
+ * Every non-alphanumeric ASCII character becomes a `\xHH` escape. That keeps regular expression
+ * metacharacters inert and — just as importantly — keeps `{` and `}` out of the pattern, which Hono
+ * uses to delimit it. Non-ASCII characters carry no regular expression meaning and are left alone,
+ * because `\xHH` cannot express them.
+ */
+const escapeRegExpLiteral = (value) => value.replace(/[^A-Za-z0-9]/g, (character) => {
+    const code = character.charCodeAt(0);
+    return code < 128 ? `\\x${code.toString(16).padStart(2, '0')}` : character;
+});
+/**
+ * Build a regular expression that matches a path segment verbatim.
+ *
+ * Literal text is escaped and a template matches anything but a slash. Every template except the
+ * last one also excludes the character the literal behind it starts with, so its match has exactly
+ * one possible end and the engine never has to search: an OpenAPI document is untrusted input, and a
+ * segment made of several plain `[^/]+` groups backtracks exponentially on a crafted request, which
+ * would block the event loop of the whole server. The last template stays greedy, so the common
+ * `{name}:cancel` shape still accepts a value that contains the delimiter.
+ */
+const patternFromSegment = (segment) => {
+    // Splitting on a regular expression with a capturing group interleaves literals and parameter
+    // names, so every odd entry is a template and the list always begins and ends with a literal.
+    const parts = segment.split(PATH_KEY_TEMPLATE);
+    // The split always yields `2n + 1` entries for `n` templates, so the last template sits two
+    // entries from the end — and at `-1` when the segment carries no template at all.
+    const lastTemplate = parts.length - 2;
+    let pattern = '';
+    for (let index = 0; index < parts.length; index++) {
+        if (index % 2 === 0) {
+            pattern += escapeRegExpLiteral(parts[index] ?? '');
+            continue;
+        }
+        const followingLiteral = parts[index + 1] ?? '';
+        // Templates with nothing between them cannot be told apart, so they match as a single group.
+        if (followingLiteral === '' && index !== lastTemplate) {
+            continue;
+        }
+        const delimiter = index === lastTemplate ? '' : escapeRegExpLiteral(followingLiteral.slice(0, 1));
+        pattern += `[^/${delimiter}]+`;
+    }
+    return pattern;
+};
+/**
+ * Convert an OpenAPI path key into a Hono route.
+ *
+ * Example: `/posts/{id}` → `/posts/:id`
+ *
+ * A segment whose literal text would be read as routing syntax is registered as a single parameter
+ * with an explicit pattern instead, because Hono allows only one parameter per segment and that is
+ * the only way to make it match such a segment verbatim. The request then routes to the right
+ * operation, but the path parameters of that one segment are no longer bound by name: they surface
+ * as the synthesized parameter, and a required path parameter in it reads as missing to request
+ * validation. Hono cannot express both at once, and matching the wrong operation is worse.
+ *
+ * A query string in the key (`/v1/messages?beta=true`) is dropped here — it is matched against the
+ * incoming request separately, see `splitPathKey`.
+ */
+export const honoRouteFromPath = (path) => {
+    const { path: pathname } = splitPathKey(path);
+    const route = [];
+    let literalIndex = 0;
+    let previousIsPattern = false;
+    for (const segment of pathname.split('/')) {
+        // Check the literal text and the parameter names, but not the braces around them — the `:` we
+        // generate for a template is meant to be routing syntax, a `?` in a parameter name is not.
+        const routeText = segment.replace(PATH_KEY_TEMPLATE, '$1');
+        const plainSegment = segment.replace(PATH_KEY_TEMPLATE, ':$1');
+        // Hono splices the segment that follows a pattern into a lookahead without escaping it, unless
+        // that segment is a parameter itself. So once one segment is a pattern, every segment behind it
+        // has to be one too — otherwise a regular expression metacharacter further down the path makes
+        // the router throw on every request. An empty segment (a trailing slash, or `//`) is exempt:
+        // Hono skips the lookahead for it, and it has no literal text to turn into a pattern.
+        const needsPattern = HONO_ROUTING_CHARACTERS.test(routeText) ||
+            (previousIsPattern && plainSegment !== '' && !plainSegment.startsWith(':'));
+        if (needsPattern) {
+            route.push(`:${LITERAL_PARAMETER_PREFIX}${literalIndex++}{${patternFromSegment(segment)}}`);
+        }
+        else {
+            route.push(plainSegment);
+        }
+        previousIsPattern = needsPattern;
+    }
+    return route.join('/');
+};

package/dist/utils/log-authentication-instructions.d.ts

@@ -1,6 +1,11 @@
 import type { OpenAPIV3_1 } from '@scalar/openapi-types';
+import type { MockServerLogger } from '../types.js';
 /**
- * Log authentication instructions for different security schemes
+ * Log authentication instructions for different security schemes.
+ *
+ * Only the informational lines go through the provided `log` sink. Warnings and errors about
+ * security schemes the mock server cannot handle are printed unconditionally, so a silenced startup
+ * still surfaces schemes that will not work.
  */
-export declare function logAuthenticationInstructions(securitySchemes: Record<string, OpenAPIV3_1.SecuritySchemeObject>): void;
+export declare function logAuthenticationInstructions(securitySchemes: Record<string, OpenAPIV3_1.SecuritySchemeObject>, log?: MockServerLogger): void;
 //# sourceMappingURL=log-authentication-instructions.d.ts.map

package/dist/utils/log-authentication-instructions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"log-authentication-instructions.d.ts","sourceRoot":"","sources":["../../src/utils/log-authentication-instructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAKxD;;GAEG;AACH,wBAAgB,6BAA6B,CAAC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,oBAAoB,CAAC,QA0H9G"}
+{"version":3,"file":"log-authentication-instructions.d.ts","sourceRoot":"","sources":["../../src/utils/log-authentication-instructions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAI/C;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAC3C,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,oBAAoB,CAAC,EACjE,GAAG,GAAE,gBAA8C,QAwHpD"}