@scalar/openapi-types 0.1.9 → 0.2.1

package/dist/schemas/3.1/processed/runtime-expression.js

@@ -0,0 +1,98 @@
+import { z } from 'zod';
+
+// Helper for validating the expression syntax
+const isValidRuntimeExpression = (value) => {
+    // Handle pure runtime expressions starting with $
+    if (value.startsWith('$')) {
+        return validatePureExpression(value);
+    }
+    // Handle embedded expressions in strings
+    if (value.includes('{')) {
+        // Extract all expressions within curly braces
+        const expressions = value.match(/\{([^}]+)\}/g);
+        if (!expressions) {
+            return false;
+        }
+        // Validate each embedded expression
+        return expressions.every((expr) => {
+            // Remove curly braces and validate the inner expression
+            const innerExpr = expr.slice(1, -1);
+            return validatePureExpression(innerExpr);
+        });
+    }
+    return false;
+};
+// Helper to validate a pure runtime expression (without curly braces)
+const validatePureExpression = (value) => {
+    // Remove $ prefix if present
+    const expression = value.startsWith('$') ? value.slice(1) : value;
+    // Basic expressions without references
+    if (['method', 'url', 'statusCode'].includes(expression)) {
+        return true;
+    }
+    // First split on # to separate the JSON pointer if it exists
+    const [mainPart, jsonPointer] = expression.split('#');
+    // Request and response references
+    const [source, type, ...rest] = mainPart.split('.');
+    if (!['request', 'response'].includes(source)) {
+        return false;
+    }
+    if (!['header', 'query', 'path', 'body'].includes(type)) {
+        return false;
+    }
+    // For body references, validate JSON pointer syntax
+    if (type === 'body') {
+        if (jsonPointer === undefined) {
+            return false;
+        }
+        // Empty pointer ('') and root pointer ('/') are valid
+        if (jsonPointer === '' || jsonPointer === '/') {
+            return true;
+        }
+        // For other pointers, validate the path
+        if (!jsonPointer.startsWith('/')) {
+            return false;
+        }
+        // Split on / and validate each segment
+        const segments = jsonPointer.slice(1).split('/');
+        return segments.every((segment) => {
+            // Decode any JSON Pointer escape sequences
+            const decoded = segment.replace(/~1/g, '/').replace(/~0/g, '~');
+            // Segment must not be empty unless it's the last one
+            return decoded.length > 0;
+        });
+    }
+    // For header references, validate header name
+    if (type === 'header') {
+        // Header names cannot contain spaces
+        const headerName = rest.join('.');
+        return !headerName.includes(' ');
+    }
+    // For other types (query, path), ensure there's a field name
+    return rest.length === 1;
+};
+/**
+ * Runtime Expression Schema
+ *
+ * Runtime expressions allow defining values based on information that will only be available within the HTTP message in
+ * an actual API call. This mechanism is used by Link Objects and Callback Objects.
+ *
+ * Expressions can be:
+ * 1. Pure runtime expressions starting with $ (e.g. $method, $request.path.id)
+ * 2. Embedded expressions in strings using curly braces (e.g. "Hello {$request.body#/name}!")
+ *
+ * @see https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.1.1.md#runtime-expressions
+ */
+const RuntimeExpressionSchema = z.string().refine(isValidRuntimeExpression, (value) => ({
+    message: `Invalid runtime expression: "${value}". Runtime expressions must:
+  - Start with $ or contain expressions in curly braces {}
+  - Use one of: $method, $url, $statusCode
+  - Or follow pattern: $request|response.(header|query|path|body)
+  - For body refs, include valid JSON pointer (e.g. #/user/id)
+  - For headers, use valid header names without spaces
+  Example valid expressions:
+  - Pure: $method, $request.path.id, $response.body#/status
+  - Embedded: "Hello {$request.body#/name}!", "Status: {$statusCode}"`,
+}));
+
+export { RuntimeExpressionSchema };

package/dist/schemas/3.1/processed/schema-object.d.ts

@@ -0,0 +1,8 @@
+import { z } from 'zod';
+/**
+ * The Schema Object allows the definition of input and output data types.
+ * These types can be objects, but also primitives and arrays.
+ */
+export declare const SchemaObjectSchema: z.ZodType<Record<string, any>>;
+export type SchemaObject = z.infer<typeof SchemaObjectSchema>;
+//# sourceMappingURL=schema-object.d.ts.map

package/dist/schemas/3.1/processed/schema-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-object.d.ts","sourceRoot":"","sources":["../../../../src/schemas/3.1/processed/schema-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAKvB;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CA8F5D,CAAA;AAEF,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAA"}

package/dist/schemas/3.1/processed/schema-object.js

@@ -0,0 +1,91 @@
+import { z } from 'zod';
+import { DiscriminatorObjectSchema } from './discriminator-object.js';
+import { ExternalDocumentationObjectSchema } from './external-documentation-object.js';
+import { XmlObjectSchema } from './xml-object.js';
+
+/**
+ * The Schema Object allows the definition of input and output data types.
+ * These types can be objects, but also primitives and arrays.
+ */
+const SchemaObjectSchema = z.object({
+    // Standard JSON Schema fields
+    title: z.string().optional(),
+    description: z.string().optional(),
+    default: z.any().optional(),
+    examples: z.array(z.any()).optional(),
+    multipleOf: z.number().optional(),
+    maximum: z.number().optional(),
+    exclusiveMaximum: z.union([z.boolean(), z.number()]).optional(),
+    minimum: z.number().optional(),
+    exclusiveMinimum: z.union([z.boolean(), z.number()]).optional(),
+    maxLength: z.number().int().optional(),
+    minLength: z.number().int().optional(),
+    pattern: z.string().optional(),
+    maxItems: z.number().int().optional(),
+    minItems: z.number().int().optional(),
+    uniqueItems: z.boolean().optional(),
+    maxProperties: z.number().int().optional(),
+    minProperties: z.number().int().optional(),
+    required: z.array(z.string()).optional(),
+    enum: z.array(z.any()).optional(),
+    type: z
+        .union([
+        z.literal('array'),
+        z.literal('boolean'),
+        z.literal('integer'),
+        z.literal('number'),
+        z.literal('object'),
+        z.literal('string'),
+        z.literal('null'),
+        z.array(z.union([
+            z.literal('array'),
+            z.literal('boolean'),
+            z.literal('integer'),
+            z.literal('number'),
+            z.literal('object'),
+            z.literal('string'),
+            z.literal('null'),
+        ])),
+    ])
+        .optional(),
+    // JSON Schema fields
+    $ref: z.string().optional(),
+    $id: z.string().optional(),
+    $schema: z.string().optional(),
+    $defs: z.record(z.lazy(() => SchemaObjectSchema)).optional(),
+    const: z.any().optional(),
+    $dynamicRef: z.string().optional(),
+    $dynamicAnchor: z.string().optional(),
+    // OpenAPI specific fields
+    format: z.string().optional(),
+    contentMediaType: z.string().optional(),
+    contentEncoding: z.string().optional(),
+    contentSchema: z.lazy(() => SchemaObjectSchema).optional(),
+    deprecated: z.boolean().optional(),
+    readOnly: z.boolean().optional(),
+    writeOnly: z.boolean().optional(),
+    example: z.any().optional(),
+    // Object-related fields
+    properties: z
+        .record(z.string(), z.lazy(() => SchemaObjectSchema))
+        .optional(),
+    additionalProperties: z.union([z.boolean(), z.lazy(() => SchemaObjectSchema)]).optional(),
+    patternProperties: z
+        .record(z.string(), z.lazy(() => SchemaObjectSchema))
+        .optional(),
+    // Array-related fields
+    items: z.lazy(() => SchemaObjectSchema).optional(),
+    prefixItems: z.array(z.lazy(() => SchemaObjectSchema)).optional(),
+    // Composition-related fields
+    allOf: z.array(z.lazy(() => SchemaObjectSchema)).optional(),
+    oneOf: z.array(z.lazy(() => SchemaObjectSchema)).optional(),
+    anyOf: z.array(z.lazy(() => SchemaObjectSchema)).optional(),
+    not: z.lazy(() => SchemaObjectSchema).optional(),
+    // Discriminator (only valid with oneOf, anyOf, or allOf)
+    discriminator: DiscriminatorObjectSchema.optional(),
+    // Additional metadata
+    externalDocs: ExternalDocumentationObjectSchema.optional(),
+    xml: XmlObjectSchema.optional(),
+});
+
+export { SchemaObjectSchema };

package/dist/schemas/3.1/processed/security-requirement-object.d.ts

@@ -0,0 +1,21 @@
+import { z } from 'zod';
+/**
+ * Security Requirement Object
+ *
+ * Lists the required security schemes to execute this operation. The name used for each property MUST correspond to a
+ * security scheme declared in the Security Schemes under the Components Object.
+ *
+ * A Security Requirement Object MAY refer to multiple security schemes in which case all schemes MUST be satisfied for
+ * a request to be authorized. This enables support for scenarios where multiple query parameters or HTTP headers are
+ * required to convey security information.
+ *
+ * When the security field is defined on the OpenAPI Object or Operation Object and contains multiple Security
+ * Requirement Objects, only one of the entries in the list needs to be satisfied to authorize the request. This
+ * enables support for scenarios where the API allows multiple, independent security schemes.
+ *
+ * An empty Security Requirement Object ({}) indicates anonymous access is supported.
+ *
+ * @see https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.1.1.md#security-requirement-object
+ */
+export declare const SecurityRequirementObjectSchema: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString, "many">>;
+//# sourceMappingURL=security-requirement-object.d.ts.map

package/dist/schemas/3.1/processed/security-requirement-object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-requirement-object.d.ts","sourceRoot":"","sources":["../../../../src/schemas/3.1/processed/security-requirement-object.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,+BAA+B,2DAe3C,CAAA"}

package/dist/schemas/3.1/processed/security-requirement-object.js

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+
+/**
+ * Security Requirement Object
+ *
+ * Lists the required security schemes to execute this operation. The name used for each property MUST correspond to a
+ * security scheme declared in the Security Schemes under the Components Object.
+ *
+ * A Security Requirement Object MAY refer to multiple security schemes in which case all schemes MUST be satisfied for
+ * a request to be authorized. This enables support for scenarios where multiple query parameters or HTTP headers are
+ * required to convey security information.
+ *
+ * When the security field is defined on the OpenAPI Object or Operation Object and contains multiple Security
+ * Requirement Objects, only one of the entries in the list needs to be satisfied to authorize the request. This
+ * enables support for scenarios where the API allows multiple, independent security schemes.
+ *
+ * An empty Security Requirement Object ({}) indicates anonymous access is supported.
+ *
+ * @see https://github.com/OAI/OpenAPI-Specification/blob/main/versions/3.1.1.md#security-requirement-object
+ */
+const SecurityRequirementObjectSchema = z.record(
+/**
+ * Each name MUST correspond to a security scheme which is declared in the Security Schemes under the Components
+ * Object. If the security scheme is of type "oauth2" or "openIdConnect", then the value is a list of scope names
+ * required for the execution, and the list MAY be empty if authorization does not require a specified scope.
+ *
+ * For other security scheme types, the array MAY contain a list of role names which are required for the execution,
+ * but are not otherwise defined or exchanged in-band.
+ **/
+z.string(), 
+/**
+ * A list of scope names required for the execution, and the list MAY be empty if authorization does not require a
+ * specified scope.
+ */
+z.array(z.string()));
+
+export { SecurityRequirementObjectSchema };