@scalar/mock-server 0.14.4 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # @scalar/mock-server
 
+## 0.16.0
+
+### Minor Changes
+
+- [#10189](https://github.com/scalar/scalar/pull/10189): Support OpenAPI 3.2 `in: querystring` parameters in request validation and custom handlers. Decode JSON, text, and form content from the entire query string, including inherited parameters and form property encoding.
+
+  Treat only null or undefined as absent validator schemas, preserving boolean `false` whole-query schemas that reject every value. Empty object schemas were already compiled and continue to accept unconstrained values.
+
+- [#10186](https://github.com/scalar/scalar/pull/10186): Support additionalOperations with case-sensitive custom HTTP methods, existing operation middleware, and CORS preflight responses.
+
+  Preserve QUERY in the default CORS method list when adding methods declared by the API description.
+
+## 0.15.0
+
+### Minor Changes
+
+- [#10290](https://github.com/scalar/scalar/pull/10290): Update Hono and its Node.js server, WebSocket, and OpenAPI integration dependencies.
+
+  Replace the deprecated `@hono/node-ws` adapter with Node server v2 WebSocket support. `createAsyncApiMockServer()` now returns `websocket` instead of `injectWebSocket`. Start the server with `serve({ fetch: app.fetch, websocket })` instead of calling `injectWebSocket(server)`.
+
+  AsyncAPI callers must upgrade to `@hono/node-server` v2. Node server v1 ignores the `websocket` option, so WebSocket channels will silently stop accepting connections if the server dependency is not upgraded.
+
+- [#10286](https://github.com/scalar/scalar/pull/10286): Fix JSON and YAML exports for file and URL inputs. Add an origin option to resolve relative references in already loaded documents without fetching the root document again.
+- [#10288](https://github.com/scalar/scalar/pull/10288): Upgrade documents to OpenAPI 3.2 when preparing mock responses, and use OpenAPI 3.2 for the empty-document default.
+- [#10176](https://github.com/scalar/scalar/pull/10176): Generate finite SSE, JSON Lines, NDJSON, and JSON Sequence mock responses from OpenAPI 3.2 itemSchema definitions, including custom handler responses.
+
+  Honor named examples in custom stream handlers and keep media-type recognition consistent with stream serialization.
+
+  Use the same stream serializer as documentation examples. SSE objects without valid fields are omitted with a console warning per serialization call; other records still stream normally. The mock serializes each item separately to retain individual chunk writes.
+
+- [#10191](https://github.com/scalar/scalar/pull/10191): Support OpenAPI 3.2 OAuth device authorization with verification codes, cancellable token polling, stored credentials, and OAuth metadata discovery. Add mock device authorization and approval endpoints with pending, denial, expiry, and polling backoff responses.
+
+  Use consistent form-encoded Basic credentials and environment substitution across OAuth token and refresh flows. Allow HTTP metadata and verification links on local development hosts and reserved test domains, coerce discovery fields consistently, and report device-code expiry clearly.
+
+### Patch Changes
+
+- [#10211](https://github.com/scalar/scalar/pull/10211): Preserve literal data and tag groups when upgrading to OpenAPI 3.2, migrate XML metadata only in schemas, and remove incompatible legacy XML flags. Make 3.2 upgrades leave the input unchanged, match the complete source version, prevent previously inactive parameter settings from changing serialization, and report path-specific errors for detected compatibility issues that require an author's decision.
+
+  Tag `kind` values may change: navigation groups are classified from actual operation-tag usage instead of name substrings. Malformed 3.1 versions now report explicit errors, and successful 3.2 upgrades clone the input only once.
+
+  Expose `UpgradeIncompatibilityError` so Markdown generation can retain OpenAPI 3.1 for descriptions requiring author decisions instead of failing or silently changing semantics. Clone safety and malformed-version errors still propagate.
+
+  The mock server also retains OpenAPI 3.1 when the strict 3.2 migration reports compatibility diagnostics. Existing inline XML descriptions continue loading without inventing element names.
+
+  Read only own data properties during migration so inherited parameter lists, XML metadata, and reference targets cannot modify prototype-owned objects.
+
+  Add `upgrade(input, '3.2', { onIncompatible: 'collect' })` to return a complete document and compatibility diagnostics. Compatible descriptions upgrade to 3.2; incompatible descriptions retain 3.1 without partial transformations. Strict mode remains the default, and malformed-version and clone-safety errors still propagate. The Markdown converter and mock server now use the shared collect mode.
+
+- [#10203](https://github.com/scalar/scalar/pull/10203): Add a picker for generated response examples with anyOf or oneOf schema variants.
+
+  Apply union selections to primitive and array examples in the shared generator without reusing the selection for nested unions.
+
+  The shared generator change also affects request examples, snippets, mock responses, and AsyncAPI payloads: root primitive/array unions now generate their chosen branch before type inference from sibling properties or items. For example, a string schema with `oneOf: [{ const: "first" }, { const: "second" }]` now generates `"first"` by default, and selecting the second branch generates `"second"`. Keywords for unrelated types do not force object/array generation. Root selections are consumed once; nested unions retain their own default or path-specific choice.
+
+  Do not show a response variant picker for an empty enum, which permits no valid alternatives.
+
+  Preserve the generated branch shape in mock HTTP responses instead of re-wrapping selected primitive values as arrays based on root sibling `items`. Explicit authored examples retain the existing array normalization.
+
+- [#10206](https://github.com/scalar/scalar/pull/10206): Add generic document identity hooks for bundling and an explicit root URI option for reference proxies. Honor OpenAPI 3.2 `$self` through an OpenAPI plugin in workspace-store, including external documents and partial bundles, and enable it in OpenAPI bundling callers.
+
+  URI resolution now honors root-relative and protocol-relative URLs, query/fragment references, and trailing-slash directory bases for all bundler consumers. Absolute non-HTTP identifiers remain unchanged instead of becoming filesystem paths; loader support is unchanged. Relative HTTP references retain query strings and fragments and are emitted only when they round-trip to the original URL.
+
+  Preserve authored reference spellings through serialized partial bundles and editable exports, while keeping older OpenAPI resolution and configured loader restrictions unchanged.
+
+  Keep references matching authored root schema identifiers intact so schema labels and anchors retain their existing behavior.
+
 ## 0.14.4
 
 ### Patch Changes

package/dist/create-asyncapi-mock-server.d.ts

@@ -1,4 +1,4 @@
-import { createNodeWebSocket } from '@hono/node-ws';
+import { type WebSocketServerLike } from '@hono/node-server';
 import { Hono } from 'hono';
 import type { MessageDirection, MockTransport } from './transports/types.js';
 import type { MockServerLogger } from './types.js';
@@ -33,11 +33,10 @@ export type AsyncApiMockServerOptions = {
 export type AsyncApiMockServer = {
     /** The Hono app serving SSE channels and WebSocket upgrade routes. */
     app: Hono;
-    /**
-     * Attaches WebSocket handling to the running Node HTTP server returned by `@hono/node-server`'s
-     * `serve()`. Must be called for WebSocket channels to accept connections.
-     */
-    injectWebSocket: ReturnType<typeof createNodeWebSocket>['injectWebSocket'];
+    /** Pass this option to `@hono/node-server`'s `serve()` to enable WebSocket channels. */
+    websocket: {
+        server: WebSocketServerLike;
+    };
 };
 /**
  * Create a mock server for an AsyncAPI 3.1 document — the event-driven counterpart of
@@ -45,12 +44,11 @@ export type AsyncApiMockServer = {
  * default) that emits realistic mock messages generated from the channel's message payload
  * schemas, the same way the REST mocker generates HTTP response bodies.
  *
- * WebSocket support requires attaching to the HTTP server after `serve()`:
+ * Pass the returned WebSocket option to `serve()`:
  *
  * ```ts
- * const { app, injectWebSocket } = await createAsyncApiMockServer({ document })
- * const server = serve({ fetch: app.fetch, port: 3000 })
- * injectWebSocket(server)
+ * const { app, websocket } = await createAsyncApiMockServer({ document })
+ * serve({ fetch: app.fetch, port: 3000, websocket })
  * ```
  */
 export declare function createAsyncApiMockServer(options: AsyncApiMockServerOptions): Promise<AsyncApiMockServer>;

package/dist/create-asyncapi-mock-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-asyncapi-mock-server.d.ts","sourceRoot":"","sources":["../src/create-asyncapi-mock-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAA;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAM/C,oDAAoD;AACpD,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAE5B,yFAAyF;IACzF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAA;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAA;CACpC,CAAA;AAED,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sEAAsE;IACtE,GAAG,EAAE,IAAI,CAAA;IACT;;;OAGG;IACH,eAAe,EAAE,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC,iBAAiB,CAAC,CAAA;CAC3E,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA0C9G"}
+{"version":3,"file":"create-asyncapi-mock-server.d.ts","sourceRoot":"","sources":["../src/create-asyncapi-mock-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,mBAAmB,EAAoB,MAAM,mBAAmB,CAAA;AAC9E,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAK3B,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAoB,MAAM,oBAAoB,CAAA;AAC3F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAM/C,oDAAoD;AACpD,MAAM,MAAM,yBAAyB,GAAG;IACtC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEvC;;;;OAIG;IACH,UAAU,CAAC,EAAE,aAAa,EAAE,CAAA;IAE5B,yFAAyF;IACzF,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,gBAAgB,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAA;IAE/F;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAA;CACpC,CAAA;AAED,sDAAsD;AACtD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,sEAAsE;IACtE,GAAG,EAAE,IAAI,CAAA;IACT,wFAAwF;IACxF,SAAS,EAAE;QAAE,MAAM,EAAE,mBAAmB,CAAA;KAAE,CAAA;CAC3C,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,yBAAyB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAqC9G"}

package/dist/create-asyncapi-mock-server.js

@@ -1,6 +1,7 @@
-import { createNodeWebSocket } from '@hono/node-ws';
+import { upgradeWebSocket } from '@hono/node-server';
 import { Hono } from 'hono';
 import { cors } from 'hono/cors';
+import { WebSocketServer } from 'ws';
 import { defaultTransports } from './transports/index.js';
 import { generateMessage } from './utils/generate-message.js';
 import { processAsyncApiDocument } from './utils/process-asyncapi-document.js';
@@ -12,20 +13,15 @@ import { resolveLogger } from './utils/resolve-logger.js';
  * default) that emits realistic mock messages generated from the channel's message payload
  * schemas, the same way the REST mocker generates HTTP response bodies.
  *
- * WebSocket support requires attaching to the HTTP server after `serve()`:
+ * Pass the returned WebSocket option to `serve()`:
  *
  * ```ts
- * const { app, injectWebSocket } = await createAsyncApiMockServer({ document })
- * const server = serve({ fetch: app.fetch, port: 3000 })
- * injectWebSocket(server)
+ * const { app, websocket } = await createAsyncApiMockServer({ document })
+ * serve({ fetch: app.fetch, port: 3000, websocket })
  * ```
  */
 export async function createAsyncApiMockServer(options) {
     const app = new Hono();
-    // The Node WebSocket adapter must be created against the app before routes are registered so the
-    // `upgradeWebSocket` helper shares this app's lifecycle. `injectWebSocket` is wired to the
-    // HTTP server by the caller after `serve()`.
-    const { injectWebSocket, upgradeWebSocket } = createNodeWebSocket({ app });
     const document = await processAsyncApiDocument(options.document);
     const channels = resolveChannels(document);
     const transports = [...defaultTransports, ...(options.transports ?? [])];
@@ -50,5 +46,5 @@ export async function createAsyncApiMockServer(options) {
         transport.register(channel, context);
         log(`[asyncapi] ${transport.name} -> ${channel.route} (channel "${channel.id}")`);
     }
-    return { app, injectWebSocket };
+    return { app, websocket: { server: new WebSocketServer({ noServer: true }) } };
 }

package/dist/create-mock-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create-mock-server.d.ts","sourceRoot":"","sources":["../src/create-mock-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,IAAI,EAA0B,MAAM,MAAM,CAAA;AAIjE,OAAO,KAAK,EAAc,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAwD5D;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2NtF"}
+{"version":3,"file":"create-mock-server.d.ts","sourceRoot":"","sources":["../src/create-mock-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,IAAI,EAA0B,MAAM,MAAM,CAAA;AAIjE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAwDhD;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,aAAa,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAwOtF"}

package/dist/create-mock-server.js

@@ -1,3 +1,5 @@
+import { normalize } from '@scalar/json-magic/helpers/normalize';
+import { getRaw } from '@scalar/json-magic/magic-proxy';
 import { getResolvedRef, mergeSiblingReferences } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { Hono } from 'hono';
 import { every } from 'hono/combine';
@@ -66,8 +68,14 @@ export async function createMockServer(configuration) {
             ...(operation ? { operation } : {}),
         }, 500);
     });
-    /** Dereferenced OpenAPI document */
-    const schema = await processOpenApiDocument(configuration?.document ?? configuration?.specification);
+    const input = configuration?.document ?? configuration?.specification;
+    const schema = await processOpenApiDocument(input, configuration?.origin);
+    const sourceDocument = typeof input === 'string' ? normalize(input) : input;
+    // Source locations need a bundled export so relative references remain usable outside the server.
+    const exportDocument = configuration?.origin ||
+        (typeof input === 'string' && (sourceDocument === null || typeof sourceDocument !== 'object'))
+        ? getRaw(schema)
+        : input;
     // Seed data from schemas with x-seed extension
     // This happens before routes are set up so data is available immediately
     const schemas = schema?.components?.schemas;
@@ -95,7 +103,13 @@ export async function createMockServer(configuration) {
         }
     }
     // CORS headers
-    app.use(cors());
+    const allowedMethods = new Set(['GET', 'HEAD', 'PUT', 'POST', 'DELETE', 'PATCH', 'QUERY']);
+    for (const pathItem of Object.values(schema?.paths ?? {})) {
+        for (const method of Object.keys(getOperations(getResolvedRef(pathItem)))) {
+            allowedMethods.add(method);
+        }
+    }
+    app.use(cors({ origin: '*', allowMethods: [...allowedMethods] }));
     /** Authentication methods defined in the OpenAPI document */
     setUpAuthenticationRoutes(app, schema);
     // Only the instructions honor `logger` (on by default); the util still prints warnings and errors
@@ -128,19 +142,17 @@ export async function createMockServer(configuration) {
     orderedPathKeys.forEach(({ path, query }) => {
         // A path item may itself be a `$ref`, so resolve it before reading its operations.
         const pathItem = getResolvedRef(paths[path]);
-        const methods = Object.keys(getOperations(pathItem));
+        const operations = getOperations(pathItem);
         /** Keys for all operations of a specified path */
-        methods.forEach((method) => {
+        Object.entries(operations).forEach(([method, operation]) => {
             const route = honoRouteFromPath(path);
-            const operation = pathItem?.[method];
             // Remember which operation this route mocks, so the error handler can name it when something
             // fails downstream. Recorded on the context rather than mapped back from the request path,
             // which would not survive the app being mounted under a base path. Registered before the rest
             // of the route so a failure in request validation is named too. The OpenAPI path key is kept
             // (rather than the Hono route) because that is what the document author reads.
             const mockedOperation = {
-                // `toUpperCase` widens to `string`, so restate the narrower type the method union guarantees.
-                method: method.toUpperCase(),
+                method,
                 path,
                 ...(operation?.operationId ? { operationId: operation.operationId } : {}),
             };
@@ -180,21 +192,28 @@ export async function createMockServer(configuration) {
             const hasHandler = handlerCode && typeof handlerCode === 'string' && handlerCode.trim().length > 0;
             // Route to appropriate handler
             if (hasHandler) {
-                handlers.push(async (c) => await mockHandlerResponse(c, operation));
+                handlers.push(async (c) => await mockHandlerResponse(c, operation, pathItem?.parameters));
             }
             else {
                 handlers.push(async (c) => await mockAnyResponse(c, operation));
             }
-            if (query.length === 0) {
-                handlers.forEach((handler) => app[method](route, handler));
-                return;
-            }
             // The pinned query parameters are not part of the route, so they are checked here. A request
             // that does not carry them is handed on to the next matching route — usually the sibling path
             // key without the query string.
             const operationChain = every(...handlers);
-            app[method](route, async (c, next) => {
-                if (!requestMatchesPinnedQuery(c, query)) {
+            // Hono uppercases methods during registration. Match the original method ourselves so
+            // additional operations such as COPY and copy remain distinct.
+            const register = (handler) => {
+                if (method === method.toUpperCase()) {
+                    app.on(method, route, handler);
+                }
+                else {
+                    app.all(route, handler);
+                }
+            };
+            register(async (c, next) => {
+                if ((c.req.method !== method && !(method === 'GET' && c.req.method === 'HEAD')) ||
+                    !requestMatchesPinnedQuery(c, query)) {
                     await next();
                     return;
                 }
@@ -203,8 +222,8 @@ export async function createMockServer(configuration) {
         });
     });
     // OpenAPI JSON file
-    app.get('/openapi.json', (c) => respondWithOpenApiDocument(c, configuration?.document ?? configuration?.specification, 'json'));
+    app.get('/openapi.json', (c) => respondWithOpenApiDocument(c, exportDocument, 'json'));
     // OpenAPI YAML file
-    app.get('/openapi.yaml', (c) => respondWithOpenApiDocument(c, configuration?.document ?? configuration?.specification, 'yaml'));
+    app.get('/openapi.yaml', (c) => respondWithOpenApiDocument(c, exportDocument, 'yaml'));
     return app;
 }

package/dist/routes/mock-any-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-any-response.d.ts","sourceRoot":"","sources":["../../src/routes/mock-any-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAcnC;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,eAAe,YA4HjF"}
+{"version":3,"file":"mock-any-response.d.ts","sourceRoot":"","sources":["../../src/routes/mock-any-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAenC;;GAEG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,eAAe,YA6IjF"}

package/dist/routes/mock-any-response.js

@@ -1,16 +1,17 @@
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { getResolvedRefDeep } from '@scalar/workspace-store/helpers/get-resolved-ref-deep';
 import { getExampleFromSchema } from '@scalar/workspace-store/request-example';
-import { accepts } from 'hono/accepts';
 import { streamSSE } from 'hono/streaming';
 import { collectSseEvents, isEventStreamContentType } from '../utils/collect-sse-events.js';
 import { findPreferredResponseKey } from '../utils/find-preferred-response-key.js';
 import { generateResponseExample } from '../utils/generate-response-example.js';
+import { negotiateContentType } from '../utils/negotiate-content-type.js';
 import { normalizeResponseBody } from '../utils/normalize-response-body.js';
 import { parsePreferHeader } from '../utils/parse-prefer-header.js';
 import { pathParameters } from '../utils/path-parameters.js';
 import { selectResponseExample } from '../utils/select-response-example.js';
 import { serializeResponseBody } from '../utils/serialize-response-body.js';
+import { getStreamingResponse, sendStreamingResponse } from '../utils/streaming-response.js';
 /**
  * Mock any response
  */
@@ -61,15 +62,17 @@ export function mockAnyResponse(c, operation) {
         return c.body(null);
     }
     // Content-Type
-    const acceptedContentType = accepts(c, {
-        header: 'Accept',
-        supports: supportedContentTypes,
-        default: supportedContentTypes.includes('application/json')
-            ? 'application/json'
-            : (supportedContentTypes[0] ?? 'text/plain;charset=UTF-8'),
-    });
+    const acceptedContentType = negotiateContentType(c, selectedResponse.content);
     c.header('Content-Type', acceptedContentType);
     const acceptedResponse = selectedResponse?.content?.[acceptedContentType];
+    const streamingResponse = getStreamingResponse(acceptedResponse, acceptedContentType, {
+        exampleName: prefer.example,
+        variables: pathParameters(c),
+    });
+    if (streamingResponse) {
+        c.status(statusCode);
+        return sendStreamingResponse(c, streamingResponse);
+    }
     const responseSchema = acceptedResponse?.schema ? getResolvedRefDeep(acceptedResponse.schema) : undefined;
     /** Generates the response body from the schema, or returns `undefined` when there is no schema. */
     const generateFromSchema = () => responseSchema ? generateResponseExample(responseSchema, pathParameters(c)) : undefined;
@@ -99,11 +102,23 @@ export function mockAnyResponse(c, operation) {
     // Body: a named/singular/first example if one is defined, otherwise generate
     // a value from the schema. `Prefer: example=<name>` picks a named example.
     const selectedExample = selectResponseExample(acceptedResponse, prefer.example);
-    const body = selectedExample
-        ? normalizeResponseBody(selectedExample.value, responseSchema)
-        : responseSchema
-            ? normalizeResponseBody(generateFromSchema(), responseSchema)
-            : null;
+    const body = (() => {
+        if (selectedExample) {
+            return normalizeResponseBody(selectedExample.value, responseSchema);
+        }
+        if (!responseSchema) {
+            return null;
+        }
+        const generated = generateFromSchema();
+        // Schema-level examples are authored values too, so retain their array normalization.
+        if (responseSchema.example !== undefined ||
+            (Array.isArray(responseSchema.examples) && responseSchema.examples.length)) {
+            return normalizeResponseBody(generated, responseSchema);
+        }
+        // The generator already chooses the value shape, including root union branches.
+        // Re-inferring it from sibling items would wrap a selected primitive in an array.
+        return generated;
+    })();
     c.status(statusCode);
     const serializedBody = serializeResponseBody(body, acceptedContentType, responseSchema);
     // `JSON.stringify` returns `undefined` for an `undefined` body, which is an empty response.

package/dist/routes/mock-handler-response.d.ts

@@ -1,9 +1,8 @@
 import type { OpenAPIV3_1 } from '@scalar/openapi-types';
 import type { Context } from 'hono';
-import type { StatusCode } from 'hono/utils/http-status';
 /**
  * Mock response using x-handler code.
  * Executes the handler and returns its result as the response.
  */
-export declare function mockHandlerResponse(c: Context, operation: OpenAPIV3_1.OperationObject): Promise<(Response & import("hono").TypedResponse<null, StatusCode, "body">) | (Response & import("hono").TypedResponse<any, import("hono/utils/http-status").ContentfulStatusCode, "json">)>;
+export declare function mockHandlerResponse(c: Context, operation: OpenAPIV3_1.OperationObject, pathItemParameters?: OpenAPIV3_1.PathItemObject['parameters']): Promise<Response>;
 //# sourceMappingURL=mock-handler-response.d.ts.map

package/dist/routes/mock-handler-response.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mock-handler-response.d.ts","sourceRoot":"","sources":["../../src/routes/mock-handler-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AA+HxD;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,eAAe,gMAyD3F"}
+{"version":3,"file":"mock-handler-response.d.ts","sourceRoot":"","sources":["../../src/routes/mock-handler-response.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AA4HnC;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,SAAS,EAAE,WAAW,CAAC,eAAe,EACtC,kBAAkB,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,qBAqE9D"}

package/dist/routes/mock-handler-response.js

@@ -1,12 +1,13 @@
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
-import { accepts } from 'hono/accepts';
 import { buildHandlerContext } from '../utils/build-handler-context.js';
 import { executeHandler } from '../utils/execute-handler.js';
 import { generateResponseExample } from '../utils/generate-response-example.js';
+import { negotiateContentType } from '../utils/negotiate-content-type.js';
 import { normalizeResponseBody } from '../utils/normalize-response-body.js';
 import { parsePreferHeader } from '../utils/parse-prefer-header.js';
 import { pathParameters } from '../utils/path-parameters.js';
 import { selectResponseExample } from '../utils/select-response-example.js';
+import { getStreamingResponse, sendStreamingResponse } from '../utils/streaming-response.js';
 /**
  * Get example response from OpenAPI spec for a given status code.
  * Returns the example value if found, or null if not available.
@@ -30,13 +31,7 @@ function getExampleFromResponse(c, statusCode, responses, exampleName) {
         return null;
     }
     // Content-Type negotiation
-    const acceptedContentType = accepts(c, {
-        header: 'Accept',
-        supports: supportedContentTypes,
-        default: supportedContentTypes.includes('application/json')
-            ? 'application/json'
-            : (supportedContentTypes[0] ?? 'text/plain;charset=UTF-8'),
-    });
+    const acceptedContentType = negotiateContentType(c, response.content);
     const acceptedResponse = response.content?.[acceptedContentType];
     if (!acceptedResponse) {
         return null;
@@ -103,7 +98,7 @@ function determineStatusCode(tracking) {
  * Mock response using x-handler code.
  * Executes the handler and returns its result as the response.
  */
-export async function mockHandlerResponse(c, operation) {
+export async function mockHandlerResponse(c, operation, pathItemParameters) {
     // Note: the `onRequest` callback runs as middleware (see `create-mock-server`) so it also fires
     // for requests rejected before reaching this handler.
     // Get x-handler code from operation
@@ -114,7 +109,7 @@ export async function mockHandlerResponse(c, operation) {
     }
     try {
         // Build handler context with tracking
-        const { context, tracking } = await buildHandlerContext(c, operation);
+        const { context, tracking } = await buildHandlerContext(c, operation, pathItemParameters);
         // Execute handler
         const { result } = await executeHandler(handlerCode, context);
         // Determine status code based on all store operations, prioritizing semantically meaningful ones
@@ -125,6 +120,16 @@ export async function mockHandlerResponse(c, operation) {
         if (statusCode === 204) {
             return c.body(null);
         }
+        const response = getResolvedRef(operation.responses?.[String(statusCode)] ?? operation.responses?.default);
+        const contentType = negotiateContentType(c, response?.content);
+        const streamingResponse = getStreamingResponse(response?.content?.[contentType], contentType, {
+            body: result ?? undefined,
+            exampleName: parsePreferHeader(c.req.header('Prefer')).example,
+            variables: pathParameters(c),
+        });
+        if (streamingResponse) {
+            return sendStreamingResponse(c, streamingResponse);
+        }
         // Set Content-Type header for other responses
         c.header('Content-Type', 'application/json');
         // Return the handler result as JSON

package/dist/types.d.ts

@@ -2,8 +2,6 @@ import type { OpenAPIV3_1 } from '@scalar/openapi-types';
 import type { Context } from 'hono';
 /** Available HTTP methods for Hono routes */
 export declare const httpMethods: readonly ["get", "put", "post", "delete", "options", "patch"];
-/** Valid HTTP method */
-export type HttpMethod = (typeof httpMethods)[number];
 /**
  * Represents a partial object where at least one of the given properties is required.
  */
@@ -13,6 +11,8 @@ type RequireAtLeastOne<T, Keys extends keyof T = keyof T> = Pick<T, Exclude<keyo
 /** A sink for the informational log lines the mock servers print while starting up. */
 export type MockServerLogger = (line: string) => void;
 type BaseMockServerOptions = {
+    /** Source file path or URL used to resolve relative references in an already loaded document. */
+    origin?: string;
     /**
      * The OpenAPI document to use for mocking.
      * Can be a string (URL or file path) or an object.

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,6CAA6C;AAC7C,eAAO,MAAM,WAAW,+DAAgE,CAAA;AAExF,wBAAwB;AACxB,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAErD;;GAEG;AACH,KAAK,iBAAiB,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GACzF;KACG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;CACzE,CAAC,IAAI,CAAC,CAAA;AAET,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AAErD,KAAK,qBAAqB,GAAG;IAC3B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE5C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEvC;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAA;KAAE,KAAK,IAAI,CAAA;IAExF;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,eAAe,GAAG,UAAU,CAAC,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,6CAA6C;AAC7C,eAAO,MAAM,WAAW,+DAAgE,CAAA;AAExF;;GAEG;AACH,KAAK,iBAAiB,CAAC,CAAC,EAAE,IAAI,SAAS,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,GACzF;KACG,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;CACzE,CAAC,IAAI,CAAC,CAAA;AAET,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AAErD,KAAK,qBAAqB,GAAG;IAC3B,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAE5C;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;IAEvC;;OAEG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,WAAW,CAAC,eAAe,CAAA;KAAE,KAAK,IAAI,CAAA;IAExF;;;;;;;;;;;OAWG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IAEzB;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,EAAE,OAAO,GAAG,gBAAgB,CAAA;CACpC,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,qBAAqB,EAAE,eAAe,GAAG,UAAU,CAAC,CAAA"}

package/dist/utils/build-handler-context.d.ts

@@ -9,7 +9,8 @@ export type HandlerContext = {
     req: {
         body: any;
         params: Record<string, string>;
-        query: Record<string, string>;
+        /** Named query values, or the decoded content of an `in: querystring` parameter. */
+        query: unknown;
         headers: Record<string, string>;
     };
     res: Record<string, any>;
@@ -24,6 +25,6 @@ type HandlerContextResult = {
 /**
  * Build the handler context from a Hono context.
  */
-export declare function buildHandlerContext(c: Context, operation?: OpenAPIV3_1.OperationObject): Promise<HandlerContextResult>;
+export declare function buildHandlerContext(c: Context, operation?: OpenAPIV3_1.OperationObject, pathItemParameters?: OpenAPIV3_1.PathItemObject['parameters']): Promise<HandlerContextResult>;
 export {};
 //# sourceMappingURL=build-handler-context.d.ts.map

package/dist/utils/build-handler-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-handler-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-handler-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAOnC,OAAO,EAAE,KAAK,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEjF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,CAAA;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CAAA;AAqDD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,SAAS,CAAC,EAAE,WAAW,CAAC,eAAe,GACtC,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}
+{"version":3,"file":"build-handler-context.d.ts","sourceRoot":"","sources":["../../src/utils/build-handler-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAGxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AASnC,OAAO,EAAE,KAAK,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAGjF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC,cAAc,CAAC,CAAA;IAC5D,GAAG,EAAE;QACH,IAAI,EAAE,GAAG,CAAA;QACT,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QAC9B,oFAAoF;QACpF,KAAK,EAAE,OAAO,CAAA;QACd,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAChC,CAAA;IACD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CACzB,CAAA;AAED;;GAEG;AACH,KAAK,oBAAoB,GAAG;IAC1B,OAAO,EAAE,cAAc,CAAA;IACvB,QAAQ,EAAE,sBAAsB,CAAA;CACjC,CAAA;AA6DD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,CAAC,EAAE,OAAO,EACV,SAAS,CAAC,EAAE,WAAW,CAAC,eAAe,EACvC,kBAAkB,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,YAAY,CAAC,GAC5D,OAAO,CAAC,oBAAoB,CAAC,CAuD/B"}

package/dist/utils/build-handler-context.js

@@ -4,8 +4,11 @@ import { accepts } from 'hono/accepts';
 import { store } from '../libs/store.js';
 import { generateResponseExample } from './generate-response-example.js';
 import { normalizeResponseBody } from './normalize-response-body.js';
+import { parsePreferHeader } from './parse-prefer-header.js';
 import { pathParameters } from './path-parameters.js';
+import { findQuerystringParameter, parseQuerystringParameter } from './querystring-parameter.js';
 import { createStoreWrapper } from './store-wrapper.js';
+import { getStreamingResponse } from './streaming-response.js';
 /**
  * Get example response from OpenAPI spec for a given status code.
  * Returns the example value if found, or null if not available.
@@ -35,6 +38,13 @@ function getExampleFromResponse(c, statusCode, responses) {
     if (!acceptedResponse) {
         return null;
     }
+    const streamingResponse = getStreamingResponse(acceptedResponse, acceptedContentType, {
+        exampleName: parsePreferHeader(c.req.header('Prefer')).example,
+        variables: pathParameters(c),
+    });
+    if (streamingResponse) {
+        return streamingResponse.body;
+    }
     const responseSchema = acceptedResponse.schema ? getResolvedRefDeep(acceptedResponse.schema) : undefined;
     // Extract example from example property or generate from schema
     return acceptedResponse.example !== undefined
@@ -46,7 +56,7 @@ function getExampleFromResponse(c, statusCode, responses) {
 /**
  * Build the handler context from a Hono context.
  */
-export async function buildHandlerContext(c, operation) {
+export async function buildHandlerContext(c, operation, pathItemParameters) {
     let body = undefined;
     try {
         // Compare case-insensitively, since media types are case-insensitive and request validation
@@ -68,6 +78,17 @@ export async function buildHandlerContext(c, operation) {
     catch {
         // Ignore parsing errors, body remains undefined
     }
+    const parameter = findQuerystringParameter(operation, pathItemParameters);
+    let query = Object.fromEntries(new URL(c.req.url).searchParams.entries());
+    if (parameter) {
+        try {
+            query = parseQuerystringParameter(c.req.url, parameter);
+        }
+        catch {
+            // With validation disabled, malformed content remains unavailable just like an invalid body.
+            query = undefined;
+        }
+    }
     const { wrappedStore, tracking } = createStoreWrapper(store);
     // Build res object with examples for all response status codes
     const res = {};
@@ -82,7 +103,7 @@ export async function buildHandlerContext(c, operation) {
             req: {
                 body,
                 params: pathParameters(c),
-                query: Object.fromEntries(new URL(c.req.url).searchParams.entries()),
+                query,
                 headers: Object.fromEntries(Object.entries(c.req.header()).map(([key, value]) => [key, value ?? ''])),
             },
             res,

package/dist/utils/get-oauth2-metadata.d.ts

@@ -3,6 +3,7 @@ import type { OpenAPIV3_2 } from '@scalar/openapi-types';
 type OAuth2Metadata = {
     issuer: string;
     authorization_endpoint?: string;
+    device_authorization_endpoint?: string;
     token_endpoint?: string;
     response_types_supported: string[];
     grant_types_supported: string[];

package/dist/utils/get-oauth2-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-oauth2-metadata.d.ts","sourceRoot":"","sources":["../../src/utils/get-oauth2-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,mEAAmE;AACnE,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,GAAI,OAAO,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,QAAQ,MAAM,KAAG,cAqBpG,CAAA"}
+{"version":3,"file":"get-oauth2-metadata.d.ts","sourceRoot":"","sources":["../../src/utils/get-oauth2-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAA;AAIxD,mEAAmE;AACnE,KAAK,cAAc,GAAG;IACpB,MAAM,EAAE,MAAM,CAAA;IACd,sBAAsB,CAAC,EAAE,MAAM,CAAA;IAC/B,6BAA6B,CAAC,EAAE,MAAM,CAAA;IACtC,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,wBAAwB,EAAE,MAAM,EAAE,CAAA;IAClC,qBAAqB,EAAE,MAAM,EAAE,CAAA;IAC/B,gBAAgB,EAAE,MAAM,EAAE,CAAA;CAC3B,CAAA;AAED,mGAAmG;AACnG,eAAO,MAAM,iBAAiB,GAAI,OAAO,WAAW,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,QAAQ,MAAM,KAAG,cA0BpG,CAAA"}

package/dist/utils/get-oauth2-metadata.js

@@ -2,16 +2,20 @@ import { getPathFromUrl } from './get-open-auth-token-urls.js';
 /** Advertises local mock endpoints instead of sending clients to the real authorization server. */
 export const getOAuth2Metadata = (flows, origin) => {
     const authorizationFlow = flows?.authorizationCode ?? flows?.implicit;
-    const tokenFlow = flows?.authorizationCode ?? flows?.clientCredentials ?? flows?.password;
+    const tokenFlow = flows?.authorizationCode ?? flows?.clientCredentials ?? flows?.password ?? flows?.deviceAuthorization;
     const localUrl = (url) => new URL(getPathFromUrl(url), origin).href;
     const supportedFlows = [
         { flow: flows?.authorizationCode, grant: 'authorization_code', response: 'code' },
         { flow: flows?.implicit, grant: 'implicit', response: 'token' },
         { flow: flows?.clientCredentials, grant: 'client_credentials' },
         { flow: flows?.password, grant: 'password' },
+        { flow: flows?.deviceAuthorization, grant: 'urn:ietf:params:oauth:grant-type:device_code' },
     ].filter(({ flow }) => flow);
     return {
         issuer: origin,
+        ...(flows?.deviceAuthorization
+            ? { device_authorization_endpoint: localUrl(flows.deviceAuthorization.deviceAuthorizationUrl || '/oauth/device') }
+            : {}),
         ...(authorizationFlow
             ? { authorization_endpoint: localUrl(authorizationFlow.authorizationUrl ?? '/oauth/authorize') }
             : {}),

package/dist/utils/get-open-auth-token-urls.d.ts

@@ -1,7 +1,7 @@
 import type { OpenAPI } from '@scalar/openapi-types';
 /**
- * Extract path from URL. Metadata is fetched at its exact declared URL, so its routes
- * preserve trailing slashes instead of using the token-route normalization.
+ * Extract path from URL. Metadata routes preserve trailing slashes because discovery
+ * fetches the exact declared URL, unlike normalized token routes.
  */
 export declare function getPathFromUrl(url: string, { preserveTrailingSlash }?: {
     preserveTrailingSlash?: boolean;

package/dist/utils/get-open-auth-token-urls.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-open-auth-token-urls.d.ts","sourceRoot":"","sources":["../../src/utils/get-open-auth-token-urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,MAAM,uBAAuB,CAAA;AAG5E;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,EAAE,qBAA6B,EAAE,GAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1E,MAAM,CAYR;AAiBD,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,GAAG,MAAM,EAAE,CAuCxE"}
+{"version":3,"file":"get-open-auth-token-urls.d.ts","sourceRoot":"","sources":["../../src/utils/get-open-auth-token-urls.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAuC,MAAM,uBAAuB,CAAA;AAGzF;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,EAAE,qBAA6B,EAAE,GAAE;IAAE,qBAAqB,CAAC,EAAE,OAAO,CAAA;CAAO,GAC1E,MAAM,CAYR;AAiBD,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,QAAQ,GAAG,MAAM,EAAE,CAyCxE"}