@scalar/mock-server 0.12.13 → 0.14.0

package/dist/utils/sandbox.js

@@ -0,0 +1,252 @@
+import { faker } from '@faker-js/faker';
+import { getQuickJS } from 'quickjs-emscripten';
+/**
+ * Maximum memory the sandboxed guest may allocate. Handler and seed code only
+ * shuffles small amounts of mock data around, so this is generous while still
+ * bounding a runaway allocation.
+ */
+const MEMORY_LIMIT_BYTES = 64 * 1024 * 1024;
+/**
+ * Maximum wall-clock time a single handler or seed run may take. This is the
+ * only defence against an infinite loop, since the guest cannot reach anything
+ * else on the host.
+ */
+const EXECUTION_TIMEOUT_MS = 1_000;
+/**
+ * Property names that let code climb from an object onto its prototype chain and
+ * ultimately reach the host `Function` constructor. They are never legitimate
+ * faker module or method names, so the bridge refuses to walk through them.
+ */
+const FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/** Store methods the guest bridge is allowed to call. */
+const STORE_METHODS = new Set(['list', 'get', 'create', 'update', 'delete', 'clear']);
+/**
+ * The QuickJS WebAssembly module is expensive to instantiate, so it is loaded
+ * once and shared. Each run still gets its own isolated context and runtime.
+ */
+let quickJSModule;
+const loadQuickJS = () => (quickJSModule ??= getQuickJS());
+/**
+ * Walk faker with a guest-provided property path and invoke the resolved method.
+ * The faker instance lives on the host; only the path and JSON arguments cross
+ * the boundary, so guest code can never obtain a reference to faker itself.
+ */
+function callFaker(path, args) {
+    const method = path.at(-1);
+    if (method === undefined || FORBIDDEN_KEYS.has(method)) {
+        throw new Error(`faker: "${method}" is not accessible`);
+    }
+    // Resolve everything except the last segment to the faker module owning the method.
+    let receiver = faker;
+    for (const key of path.slice(0, -1)) {
+        if (FORBIDDEN_KEYS.has(key)) {
+            throw new Error(`faker: "${key}" is not accessible`);
+        }
+        receiver = receiver?.[key];
+        if (receiver === undefined || receiver === null) {
+            throw new Error(`faker: "${key}" does not exist`);
+        }
+    }
+    const fn = receiver?.[method];
+    if (typeof fn !== 'function') {
+        throw new Error(`faker: "${path.join('.')}" is not a function`);
+    }
+    // Bind to the resolved module so faker methods keep their expected `this`.
+    return fn.apply(receiver, args);
+}
+/**
+ * Run a store method requested by the guest and return a JSON envelope.
+ */
+function runStoreBridge(store, method, argsJson) {
+    try {
+        if (!STORE_METHODS.has(method)) {
+            throw new Error(`store: "${method}" is not a method`);
+        }
+        const args = JSON.parse(argsJson);
+        const result = store[method](...args);
+        return serializeEnvelope({ ok: true, value: result ?? null });
+    }
+    catch (error) {
+        return serializeEnvelope({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/**
+ * Run a faker call requested by the guest and return a JSON envelope.
+ */
+function runFakerBridge(pathJson, argsJson) {
+    try {
+        const path = JSON.parse(pathJson);
+        const args = JSON.parse(argsJson);
+        return serializeEnvelope({ ok: true, value: callFaker(path, args) ?? null });
+    }
+    catch (error) {
+        return serializeEnvelope({ ok: false, error: error instanceof Error ? error.message : String(error) });
+    }
+}
+/**
+ * Serialize a bridge envelope. Faker occasionally returns values such as `Date`
+ * that JSON cannot represent as-is; those are converted to their JSON form,
+ * which matches what handler code would send over the wire anyway.
+ */
+function serializeEnvelope(envelope) {
+    return JSON.stringify(envelope);
+}
+/**
+ * Guest-side bootstrap. It rebuilds `store` and `faker` on top of the host
+ * bridges so guest code sees the same API as before, but every call is just a
+ * JSON message to the host.
+ */
+const GUEST_PRELUDE = `
+  const __unwrap = (raw) => {
+    const parsed = JSON.parse(raw)
+    if (!parsed.ok) {
+      throw new Error(parsed.error)
+    }
+    return parsed.value
+  }
+
+  const store = {
+    list: (...args) => __unwrap(__store('list', JSON.stringify(args))),
+    get: (...args) => __unwrap(__store('get', JSON.stringify(args))),
+    create: (...args) => __unwrap(__store('create', JSON.stringify(args))),
+    update: (...args) => __unwrap(__store('update', JSON.stringify(args))),
+    delete: (...args) => __unwrap(__store('delete', JSON.stringify(args))),
+    clear: (...args) => __unwrap(__store('clear', JSON.stringify(args))),
+  }
+
+  const __makeFaker = (path) =>
+    new Proxy(function () {}, {
+      get: (_target, prop) => (typeof prop === 'string' ? __makeFaker(path.concat(prop)) : undefined),
+      apply: (_target, _thisArg, args) => __unwrap(__faker(JSON.stringify(path), JSON.stringify(args))),
+    })
+  const faker = __makeFaker([])
+`;
+/**
+ * Guest-side `seed` helper. It mirrors the Laravel-inspired API and runs the
+ * factory callbacks inside the sandbox, persisting through the `store` bridge.
+ */
+const SEED_PRELUDE = `
+  const seed = (() => {
+    const create = (item) => store.create(schema, item)
+    const helper = (arg1, arg2) => {
+      if (typeof arg1 === 'number' && typeof arg2 === 'function') {
+        const items = []
+        for (let index = 0; index < arg1; index++) {
+          items.push(create(arg2()))
+        }
+        return items
+      }
+      if (Array.isArray(arg1)) {
+        return arg1.map(create)
+      }
+      if (typeof arg1 === 'function') {
+        return create(arg1())
+      }
+      throw new Error('Invalid seed() usage. Use seed.count(n, factory), seed(array), or seed(factory)')
+    }
+    helper.count = (n, factory) => {
+      const items = []
+      for (let index = 0; index < n; index++) {
+        items.push(create(factory()))
+      }
+      return items
+    }
+    return helper
+  })()
+`;
+/**
+ * Assemble the full guest program: bridges, injected JSON globals, the optional
+ * seed helper, and the user code wrapped in an async IIFE whose result becomes
+ * the completion value QuickJS hands back.
+ */
+function buildGuestSource(code, jsonGlobalNames, includeSeed) {
+    const jsonGlobals = jsonGlobalNames.map((name) => `const ${name} = JSON.parse(__json_${name})`).join('\n');
+    return `
+    ${GUEST_PRELUDE}
+    ${jsonGlobals}
+    ${includeSeed ? SEED_PRELUDE : ''}
+    ;(async () => {
+      ${code}
+    })()
+  `;
+}
+/**
+ * Rebuild a host error from a dumped QuickJS error so callers see a normal
+ * `Error` instead of an opaque value.
+ */
+function toError(dumped) {
+    if (dumped instanceof Error) {
+        return dumped;
+    }
+    if (dumped && typeof dumped === 'object' && 'message' in dumped) {
+        const error = new Error(String(dumped.message));
+        const name = dumped.name;
+        if (typeof name === 'string') {
+            error.name = name;
+        }
+        return error;
+    }
+    return new Error(typeof dumped === 'string' ? dumped : 'Sandbox execution failed');
+}
+/**
+ * Execute untrusted handler or seed code inside a QuickJS WebAssembly sandbox.
+ *
+ * The guest has no access to the host runtime (`process`, `require`, `fetch`,
+ * the `Function` constructor, and so on). It can only talk to the `store` and
+ * `faker` bridges and read the injected JSON globals. Memory and time limits
+ * bound the remaining denial-of-service risk.
+ */
+export async function runInSandbox(options) {
+    const { code, store, jsonGlobals = {}, includeSeed = false } = options;
+    const quickJS = await loadQuickJS();
+    const context = quickJS.newContext();
+    try {
+        const { runtime } = context;
+        runtime.setMemoryLimit(MEMORY_LIMIT_BYTES);
+        const deadline = Date.now() + EXECUTION_TIMEOUT_MS;
+        runtime.setInterruptHandler(() => Date.now() > deadline);
+        // Host bridge: store operations run the real (tracked) store and return JSON.
+        const storeBridge = context.newFunction('__store', (methodHandle, argsHandle) => context.newString(runStoreBridge(store, context.getString(methodHandle), context.getString(argsHandle))));
+        context.setProp(context.global, '__store', storeBridge);
+        storeBridge.dispose();
+        // Host bridge: faker. Only a property path and JSON arguments cross the boundary.
+        const fakerBridge = context.newFunction('__faker', (pathHandle, argsHandle) => context.newString(runFakerBridge(context.getString(pathHandle), context.getString(argsHandle))));
+        context.setProp(context.global, '__faker', fakerBridge);
+        fakerBridge.dispose();
+        // Inject read-only inputs (req/res/schema) as JSON strings the guest parses.
+        for (const [name, value] of Object.entries(jsonGlobals)) {
+            const handle = context.newString(JSON.stringify(value ?? null));
+            context.setProp(context.global, `__json_${name}`, handle);
+            handle.dispose();
+        }
+        const evalResult = context.evalCode(buildGuestSource(code, Object.keys(jsonGlobals), includeSeed));
+        if (evalResult.error) {
+            const error = context.dump(evalResult.error);
+            evalResult.error.dispose();
+            throw toError(error);
+        }
+        // The completion value is the async IIFE's promise. Resolve it, then drain the
+        // job queue; every host bridge is synchronous, so one pass settles the promise.
+        const promiseHandle = evalResult.value;
+        const resolved = context.resolvePromise(promiseHandle);
+        promiseHandle.dispose();
+        const jobs = runtime.executePendingJobs();
+        if (jobs.error) {
+            const error = context.dump(jobs.error);
+            jobs.error.dispose();
+            throw toError(error);
+        }
+        const settled = await resolved;
+        if (settled.error) {
+            const error = context.dump(settled.error);
+            settled.error.dispose();
+            throw toError(error);
+        }
+        const value = context.dump(settled.value);
+        settled.value.dispose();
+        return value;
+    }
+    finally {
+        context.dispose();
+    }
+}

package/dist/utils/serialize-response-body.d.ts

@@ -0,0 +1,11 @@
+import type { OpenAPIV3_1 } from '@scalar/openapi-types';
+type Schema = NonNullable<OpenAPIV3_1.ComponentsObject['schemas']>[string];
+/**
+ * Serializes a mocked response body for the negotiated media type.
+ *
+ * Returns `undefined` for an `undefined` body, mirroring `JSON.stringify`, so the caller can send an
+ * empty body rather than the characters `undefined`.
+ */
+export declare const serializeResponseBody: (body: unknown, contentType: string | undefined, schema?: Schema) => string | undefined;
+export {};
+//# sourceMappingURL=serialize-response-body.d.ts.map

package/dist/utils/serialize-response-body.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-response-body.d.ts","sourceRoot":"","sources":["../../src/utils/serialize-response-body.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,KAAK,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;AAkE1E;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GAChC,MAAM,OAAO,EACb,aAAa,MAAM,GAAG,SAAS,EAC/B,SAAS,MAAM,KACd,MAAM,GAAG,SAgCX,CAAA"}

package/dist/utils/serialize-response-body.js

@@ -0,0 +1,88 @@
+import { json2xml } from '@scalar/helpers/file/json2xml';
+import { parseMimeType } from '@scalar/helpers/http/mime-type';
+/**
+ * Whether a media type carries a single JSON document.
+ *
+ * Matched on the parsed subtype, so suffixed types (`application/problem+json`) and parameterized ones
+ * (`application/json; charset=utf-8`) count, while a type that merely mentions JSON in a parameter does
+ * not. Line-delimited relatives (`application/jsonl`, `application/x-ndjson`) are deliberately excluded:
+ * their payload is a sequence of documents, so a string body already carries the framing. A missing
+ * media type parses as `text/plain`, which is the safe answer here: the body is written as it is.
+ */
+const isJsonDocumentContentType = (contentType) => {
+    const { subtype } = parseMimeType(contentType);
+    return subtype === 'json' || subtype.endsWith('+json');
+};
+/** Whether a media type carries XML, including suffixed types such as `application/xhtml+xml`. */
+const isXmlContentType = (contentType) => {
+    const { subtype } = parseMimeType(contentType);
+    return subtype === 'xml' || subtype.endsWith('+xml');
+};
+/**
+ * How the resolved response schema describes the body: as a string, as something else, or not at all.
+ *
+ * Composite schemas (`allOf`, an `enum` without a type) land on `unknown`, which is the honest answer:
+ * they say nothing this decision can act on.
+ */
+const declaredBodyKind = (schema) => {
+    if (!schema || typeof schema !== 'object' || !('type' in schema) || schema.type === undefined) {
+        return 'unknown';
+    }
+    const { type } = schema;
+    if (Array.isArray(type)) {
+        if (type.length === 0) {
+            return 'unknown';
+        }
+        return type.includes('string') ? 'string' : 'other';
+    }
+    return type === 'string' ? 'string' : 'other';
+};
+/** Whether a string holds serialized JSON of any shape, a bare scalar included. */
+const isSerializedJson = (value) => {
+    try {
+        JSON.parse(value);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+/** Whether a string holds a serialized JSON object or array. */
+const isSerializedJsonDocument = (value) => {
+    const trimmed = value.trim();
+    return (trimmed.startsWith('{') || trimmed.startsWith('[')) && isSerializedJson(trimmed);
+};
+/**
+ * Serializes a mocked response body for the negotiated media type.
+ *
+ * Returns `undefined` for an `undefined` body, mirroring `JSON.stringify`, so the caller can send an
+ * empty body rather than the characters `undefined`.
+ */
+export const serializeResponseBody = (body, contentType, schema) => {
+    // XML: only an object tree can be turned into a document. `null` is `typeof 'object'` too, but it is
+    // not a valid XML root, so it falls through to `JSON.stringify` below rather than into `json2xml`.
+    if (body !== null && typeof body === 'object' && isXmlContentType(contentType)) {
+        return json2xml(body);
+    }
+    if (typeof body === 'string') {
+        // Anywhere but a single JSON document, the characters are the payload: `text/plain`, `text/html`,
+        // XML, `text/event-stream`, line-delimited JSON, and anything else the mock does not recognize.
+        if (!isJsonDocumentContentType(contentType)) {
+            return body;
+        }
+        // Under a JSON media type a string has to be encoded, or a `type: string` response arrives as the
+        // bare characters `string`, which no JSON client can parse. What survives unencoded is text that is
+        // already the body the document describes: whatever parses when the schema declares a non-string
+        // type, and an object or array when the schema says nothing, both of which are documents the author
+        // serialized by hand. A quoted scalar without a schema behind it stays a string, since the author
+        // quoting `'123'` is the only signal available about what they meant.
+        const kind = declaredBodyKind(schema);
+        if (kind === 'other' && isSerializedJson(body)) {
+            return body;
+        }
+        if (kind === 'unknown' && isSerializedJsonDocument(body)) {
+            return body;
+        }
+    }
+    return JSON.stringify(body);
+};

package/dist/utils/split-path-key.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Matches a `{parameterName}` template inside a path key.
+ *
+ * A template has to be balanced and non-empty, so a stray brace counts as literal path text.
+ */
+export declare const PATH_KEY_TEMPLATE: RegExp;
+/** A query parameter that an OpenAPI path key pins, for example `beta=true` in `/v1/messages?beta=true`. */
+export type PinnedQueryParameter = {
+    /** Decoded name of the query parameter. */
+    name: string;
+    /** Decoded value the request has to send, or `undefined` when the path key only pins the name. */
+    value: string | undefined;
+};
+/** An OpenAPI path key taken apart into the portion Hono can route and the query it pins. */
+type SplitPathKey = {
+    /** The path portion of the key, without the query string. */
+    path: string;
+    /** Query parameters the key pins. Empty for a regular path key. */
+    query: PinnedQueryParameter[];
+};
+/**
+ * Split an OpenAPI path key into its path and its pinned query parameters.
+ *
+ * Some documents carry a literal query string in the path key to describe a variant of an operation,
+ * for example `/v1/messages?beta=true` next to `/v1/messages`. That is not a routable path, so the
+ * query has to be peeled off and matched against the incoming request separately.
+ */
+export declare const splitPathKey: (pathKey: string) => SplitPathKey;
+export {};
+//# sourceMappingURL=split-path-key.d.ts.map

package/dist/utils/split-path-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"split-path-key.d.ts","sourceRoot":"","sources":["../../src/utils/split-path-key.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,QAAkB,CAAA;AAKhD,4GAA4G;AAC5G,MAAM,MAAM,oBAAoB,GAAG;IACjC,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAA;IACZ,kGAAkG;IAClG,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAC1B,CAAA;AAED,6FAA6F;AAC7F,KAAK,YAAY,GAAG;IAClB,6DAA6D;IAC7D,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,KAAK,EAAE,oBAAoB,EAAE,CAAA;CAC9B,CAAA;AAyCD;;;;;;GAMG;AACH,eAAO,MAAM,YAAY,GAAI,SAAS,MAAM,KAAG,YA+B9C,CAAA"}

package/dist/utils/split-path-key.js

@@ -0,0 +1,77 @@
+/**
+ * Matches a `{parameterName}` template inside a path key.
+ *
+ * A template has to be balanced and non-empty, so a stray brace counts as literal path text.
+ */
+export const PATH_KEY_TEMPLATE = /\{([^{}]+)\}/g;
+/** Matches a query value that is nothing but a template, as in `?status={status}`. */
+const TEMPLATE_VALUE = /^\{[^{}]+\}$/;
+/**
+ * Decode one part of a query string the way `URLSearchParams` does.
+ *
+ * A malformed escape sequence is kept verbatim instead of throwing, so a single odd path key cannot
+ * take the whole server down.
+ */
+const decodeQueryPart = (value) => {
+    try {
+        return decodeURIComponent(value.replace(/\+/g, ' '));
+    }
+    catch {
+        return value;
+    }
+};
+/**
+ * Find the `?` that starts the query string of a path key.
+ *
+ * Only a `?` outside a `{…}` template counts, so a path parameter whose name contains a `?` does not
+ * accidentally cut the key in half. An unbalanced brace is literal path text rather than an open
+ * template, so it cannot hide the query string of the rest of the key. Returns `-1` when the key
+ * carries no query string.
+ */
+const findQueryStart = (pathKey) => {
+    // A fresh instance, because `matchAll` reads the `lastIndex` of the regular expression it is
+    // given and `PATH_KEY_TEMPLATE` is shared with other modules.
+    const templates = [...pathKey.matchAll(new RegExp(PATH_KEY_TEMPLATE))].map((match) => ({
+        start: match.index,
+        end: match.index + match[0].length,
+    }));
+    for (let index = pathKey.indexOf('?'); index !== -1; index = pathKey.indexOf('?', index + 1)) {
+        if (!templates.some(({ start, end }) => index > start && index < end)) {
+            return index;
+        }
+    }
+    return -1;
+};
+/**
+ * Split an OpenAPI path key into its path and its pinned query parameters.
+ *
+ * Some documents carry a literal query string in the path key to describe a variant of an operation,
+ * for example `/v1/messages?beta=true` next to `/v1/messages`. That is not a routable path, so the
+ * query has to be peeled off and matched against the incoming request separately.
+ */
+export const splitPathKey = (pathKey) => {
+    const queryStart = findQueryStart(pathKey);
+    if (queryStart === -1) {
+        return { path: pathKey, query: [] };
+    }
+    const query = pathKey
+        .slice(queryStart + 1)
+        .split('&')
+        .filter((pair) => pair !== '')
+        .map((pair) => {
+        const separator = pair.indexOf('=');
+        // `?beta` pins the name only, `?beta=true` pins the name and the value.
+        if (separator === -1) {
+            return { name: decodeQueryPart(pair), value: undefined };
+        }
+        const value = pair.slice(separator + 1);
+        return {
+            name: decodeQueryPart(pair.slice(0, separator)),
+            // A value that is nothing but a template (`?status={status}`) names the parameter rather
+            // than fixing it, so any value the request sends satisfies it.
+            value: TEMPLATE_VALUE.test(value) ? undefined : decodeQueryPart(value),
+        };
+    })
+        .filter(({ name }) => name !== '');
+    return { path: pathKey.slice(0, queryStart), query };
+};

package/dist/utils/store-wrapper.d.ts

@@ -2,7 +2,7 @@ import type { Store } from '../libs/store.js';
 /**
  * Public interface of the Store class (methods only, no private properties).
  */
-type StoreInterface = Pick<Store, 'list' | 'get' | 'create' | 'update' | 'delete' | 'clear'>;
+export type StoreInterface = Pick<Store, 'list' | 'get' | 'create' | 'update' | 'delete' | 'clear'>;
 /**
  * Represents a single store operation with its result.
  */

package/dist/utils/store-wrapper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store-wrapper.d.ts","sourceRoot":"","sources":["../../src/utils/store-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAE1C;;GAEG;AACH,KAAK,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAA;AAE5F;;GAEG;AACH,KAAK,cAAc,GAAG;IACpB,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1D,mCAAmC;IACnC,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,0CAA0C;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG;IAChD,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CA2CA"}
+{"version":3,"file":"store-wrapper.d.ts","sourceRoot":"","sources":["../../src/utils/store-wrapper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAE1C;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAA;AAEnG;;GAEG;AACH,KAAK,cAAc,GAAG;IACpB,iDAAiD;IACjD,SAAS,EAAE,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,MAAM,CAAA;IAC1D,mCAAmC;IACnC,MAAM,EAAE,GAAG,CAAA;CACZ,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,0CAA0C;IAC1C,UAAU,EAAE,cAAc,EAAE,CAAA;CAC7B,CAAA;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG;IAChD,YAAY,EAAE,cAAc,CAAA;IAC5B,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CA2CA"}

package/dist/utils/validate-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validate-request.d.ts","sourceRoot":"","sources":["../../src/utils/validate-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAMxD,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAuRtD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,WAAW,WAAW,CAAC,eAAe,EACtC,qBAAqB,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,KAC5D,iBAkKF,CAAA"}
+{"version":3,"file":"validate-request.d.ts","sourceRoot":"","sources":["../../src/utils/validate-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAMxD,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAA;AAoStD;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe,GAC1B,WAAW,WAAW,CAAC,eAAe,EACtC,qBAAqB,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,KAC5D,iBAkKF,CAAA"}

package/dist/utils/validate-request.js

@@ -4,6 +4,17 @@ import Ajv2020 from 'ajv/dist/2020.js';
 import addFormats from 'ajv-formats';
 import { getCookie } from 'hono/cookie';
 import { deserializeArrayParameter, deserializeObjectParameter, getObjectPropertyNames, isArraySchema, isObjectSchema, resolveSerialization, } from './deserialize-parameter.js';
+import { replaceCircularMarkers } from './replace-circular-markers.js';
+/**
+ * Prepare a resolved schema for Ajv by replacing the `'[circular]'` markers a recursive schema leaves
+ * behind. Ajv refuses to compile a schema that still carries one, which makes the body — or the whole
+ * parameter location built around it — fail open.
+ *
+ * Only Ajv sees this copy. Everything that reads the *shape* of a schema keeps reading the resolved
+ * one, because the rewrite may drop a keyword (a `oneOf` the cycle ran through, say) that the shape
+ * still depends on.
+ */
+const asCompilableSchema = (resolved) => replaceCircularMarkers(resolved);
 /**
  * Header parameters named `Accept`, `Content-Type`, or `Authorization` are defined elsewhere in
  * OpenAPI (through `content` and `security`), so the spec says such parameter definitions SHALL be
@@ -61,7 +72,7 @@ const buildParameterSchema = (parameters, location) => {
             propertyNames,
         });
         if (resolvedSchema) {
-            properties[parameter.name] = resolvedSchema;
+            properties[parameter.name] = asCompilableSchema(resolvedSchema);
         }
         if (parameter.required) {
             required.push(parameter.name);
@@ -134,7 +145,7 @@ const compileValidators = (operation, pathItemParameters) => {
     let bodySchema = null;
     try {
         const jsonSchema = getResolvedRef(requestBody?.content?.['application/json'])?.schema;
-        bodySchema = jsonSchema ? getResolvedRefDeep(jsonSchema) : null;
+        bodySchema = jsonSchema ? asCompilableSchema(getResolvedRefDeep(jsonSchema)) : null;
     }
     catch (error) {
         console.error('Error resolving request body schema, skipping body validation:', error);

package/package.json

@@ -16,7 +16,7 @@
     "swagger",
     "cli"
   ],
-  "version": "0.12.13",
+  "version": "0.14.0",
   "engines": {
     "node": ">=22"
   },
@@ -53,16 +53,17 @@
   "dependencies": {
     "@faker-js/faker": "10.4.0",
     "@hono/node-ws": "^1.2.0",
-    "ajv": "^8.18.0",
+    "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "hono": "^4.12.7",
+    "quickjs-emscripten": "0.32.0",
     "yaml": "^2.9.0",
-    "@scalar/helpers": "0.11.1",
+    "@scalar/helpers": "0.11.3",
+    "@scalar/json-magic": "0.13.4",
     "@scalar/openapi-types": "0.9.5",
     "@scalar/openapi-upgrader": "0.2.15",
-    "@scalar/types": "0.18.2",
-    "@scalar/json-magic": "0.13.2",
-    "@scalar/workspace-store": "0.58.1"
+    "@scalar/types": "0.19.0",
+    "@scalar/workspace-store": "0.60.0"
   },
   "devDependencies": {
     "@types/node": "^24.1.0",