@scalar/snippetz 0.9.32 → 0.10.0

package/README.md

@@ -102,3 +102,15 @@ We are API nerds. You too? Let's chat on Discord: <https://discord.gg/scalar>
 ## License
 
 The source code in this repository is licensed under [MIT](https://github.com/scalar/scalar/blob/main/LICENSE).
+
+## Cookies in browser examples
+
+XHR and jQuery examples use `document.cookie` and enable `withCredentials` whenever the HAR contains cookie values, including an explicit `Cookie` header without OpenAPI cookie-style parameters. This intentionally changes those legacy examples: browsers forbid setting the `Cookie` request header directly. Requests without cookies remain uncredentialed.
+
+The setup writes cookies for the page's domain and cannot set cookies for an unrelated API domain or create HttpOnly cookies. For a cross-origin API, obtain cookies through that API's authentication flow instead. Cookie domain, path, Secure, SameSite, and browser third-party-cookie policies still apply.
+
+[Credentialed cross-origin responses](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CORS#requests_with_credentials) must permit credentials and the specific calling origin through CORS (`Access-Control-Allow-Credentials: true` and a non-wildcard `Access-Control-Allow-Origin`). Enabling credentials does not itself require preflight; if the request otherwise requires preflight, that check must also succeed.
+
+Cookie-style values remain serialized as authored, while legacy structured HAR cookies are percent-encoded. Do not decode and re-encode a combined Cookie header uniformly. Other generators retain their existing environment-specific header behavior.
+
+For OpenAPI 3.2 `in: cookie, style: cookie` parameters, omit `explode` or set it to `true`. `explode: false` is invalid for cookies because comma-separated values violate cookie syntax. Scalar tolerates that invalid combination by expanding arrays and objects into separate cookie entries; it emits a developer-console warning once per parameter name. Values are passed through unchanged, so provide any required escaping in the API description.

package/dist/libs/browser-request.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browser-request.d.ts","sourceRoot":"","sources":["../../src/libs/browser-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAK7E,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,GAChC,UAAS,OAAO,CAAC,UAAU,CAAM,EACjC,gBAAgB,mBAAmB,KAClC;IACD,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,EAAE,OAAO,CAAA;CA8DzB,CAAA"}
+{"version":3,"file":"browser-request.d.ts","sourceRoot":"","sources":["../../src/libs/browser-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAA;AAK7E,wFAAwF;AACxF,eAAO,MAAM,qBAAqB,GAChC,UAAS,OAAO,CAAC,UAAU,CAAM,EACjC,gBAAgB,mBAAmB,KAClC;IACD,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;IAC1C,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,eAAe,EAAE,OAAO,CAAA;CAuEzB,CAAA"}

package/dist/libs/browser-request.js

@@ -2,7 +2,16 @@ import { Base64 } from 'js-base64';
 import { joinUrlAndQuery, normalizeMethod } from './http.js';
 /** Builds browser request values without collapsing repeated headers or form fields. */
 export const prepareBrowserRequest = (request = {}, configuration) => {
-    const headers = [...(request.headers ?? [])];
+    // Browsers forbid setting Cookie directly. Header values are already serialized,
+    // so preserve their escaping when transferring them to the browser cookie store.
+    const cookieValues = [
+        ...(request.cookies ?? []).map(({ name, value }) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`),
+        ...(request.headers ?? [])
+            .filter(({ name }) => name.toLowerCase() === 'cookie')
+            .flatMap(({ value }) => (value ?? '').split(';').map((cookie) => cookie.trim()))
+            .filter((cookie) => cookie.includes('=')),
+    ];
+    const headers = (request.headers ?? []).filter(({ name }) => name.toLowerCase() !== 'cookie');
     if (configuration?.auth?.username && configuration.auth.password) {
         headers.push({
             name: 'Authorization',
@@ -10,10 +19,10 @@ export const prepareBrowserRequest = (request = {}, configuration) => {
         });
     }
     const setup = [];
-    if (request.cookies?.length) {
-        setup.push('// Run on the request origin to set these cookies in the browser.');
-        for (const { name, value } of request.cookies) {
-            setup.push(`document.cookie = ${JSON.stringify(`${encodeURIComponent(name)}=${encodeURIComponent(value)}; path=/`)};`);
+    if (cookieValues.length) {
+        setup.push("// Run on the request origin; document.cookie writes cookies for the current page's domain.");
+        for (const cookie of cookieValues) {
+            setup.push(`document.cookie = ${JSON.stringify(`${cookie}; path=/`)};`);
         }
     }
     const postData = request.postData;
@@ -58,7 +67,9 @@ export const prepareBrowserRequest = (request = {}, configuration) => {
         // The browser must supply the boundary matching its FormData serialization.
         headers: multipart ? headers.filter(({ name }) => name.toLowerCase() !== 'content-type') : headers,
         setup,
-        withCredentials: Boolean(request.cookies?.length),
+        // This intentionally includes explicit Cookie headers, even without cookie-style parameters.
+        // Cross-origin use additionally requires credentialed CORS and eligible stored cookies.
+        withCredentials: Boolean(cookieValues.length),
         body: multipart ? 'body' : formBody,
     };
 };

package/dist/plugins/csharp/restsharp/restsharp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"restsharp.d.ts","sourceRoot":"","sources":["../../../../src/plugins/csharp/restsharp/restsharp.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAmDpD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAkH7B,CAAA"}
+{"version":3,"file":"restsharp.d.ts","sourceRoot":"","sources":["../../../../src/plugins/csharp/restsharp/restsharp.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAsCpD;;GAEG;AACH,eAAO,MAAM,eAAe,EAAE,MAkH7B,CAAA"}

package/dist/plugins/csharp/restsharp/restsharp.js

@@ -1,18 +1,7 @@
+import { isJsonMediaType } from '@scalar/helpers/http/is-json-media-type';
 import { parseMimeType } from '@scalar/helpers/http/mime-type';
 import { encode } from 'js-base64';
 import { joinUrlAndQuery } from '../../../libs/http.js';
-/**
- * True for `application/json`, any RFC 6839 `+json` structured-syntax suffix
- * (e.g. `application/vnd.api+json`), and parameterized variants
- * (e.g. `application/json;charset=utf-8`). Case-insensitive.
- */
-const isJsonContentType = (value) => {
-    if (!value) {
-        return false;
-    }
-    const { subtype } = parseMimeType(value);
-    return subtype === 'json' || subtype.endsWith('+json');
-};
 /**
  * Maps an HTTP method to a RestSharp `Method` enum member. The enum uses
  * PascalCase members (`Method.Get`, `Method.Post`, ...), so we title-case the
@@ -97,7 +86,7 @@ export const csharpRestsharp = {
             // Compare against the essence so parameterized values (e.g. a `boundary` or
             // `charset`) still match the form, multipart, and octet-stream branches.
             const essence = mimeType ? parseMimeType(mimeType).essence : undefined;
-            if (isJsonContentType(mimeType)) {
+            if (isJsonMediaType(mimeType)) {
                 if (text) {
                     let body = text;
                     try {

package/dist/plugins/shell/curl/curl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"curl.d.ts","sourceRoot":"","sources":["../../../../src/plugins/shell/curl/curl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAiBpD;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MA6JvB,CAAA"}
+{"version":3,"file":"curl.d.ts","sourceRoot":"","sources":["../../../../src/plugins/shell/curl/curl.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAIpD;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MAiKvB,CAAA"}

package/dist/plugins/shell/curl/curl.js

@@ -1,17 +1,6 @@
-import { parseMimeType } from '@scalar/helpers/http/mime-type';
+import { isJsonMediaType } from '@scalar/helpers/http/is-json-media-type';
+import { isStreamingContentType } from '@scalar/helpers/http/is-streaming-content-type';
 import { escapeSingleQuotes } from '../../../libs/shell.js';
-/**
- * True for `application/json`, any RFC 6839 `+json` structured-syntax suffix
- * (e.g. `application/vnd.api+json`), and parameterized variants
- * (e.g. `application/json;charset=utf-8`). Case-insensitive.
- */
-const isJsonContentType = (value) => {
-    if (!value) {
-        return false;
-    }
-    const { subtype } = parseMimeType(value);
-    return subtype === 'json' || subtype.endsWith('+json');
-};
 /**
  * shell/curl
  */
@@ -93,7 +82,7 @@ export const shellCurl = {
         }
         // Body
         if (normalizedRequest.postData) {
-            if (isJsonContentType(normalizedRequest.postData.mimeType)) {
+            if (isJsonMediaType(normalizedRequest.postData.mimeType)) {
                 // Pretty print JSON data
                 if (normalizedRequest.postData.text) {
                     try {
@@ -109,6 +98,11 @@ export const shellCurl = {
                     }
                 }
             }
+            else if (isStreamingContentType(normalizedRequest.postData.mimeType ?? '')) {
+                // Use the explicit binary mode consistently for framed streaming media types.
+                const escapedText = escapeSingleQuotes(normalizedRequest.postData.text ?? '');
+                parts.push(`--data-binary '${escapedText}'`);
+            }
             else if (normalizedRequest.postData.mimeType === 'application/octet-stream') {
                 const escapedText = escapeSingleQuotes(normalizedRequest.postData.text ?? '');
                 parts.push(`--data-binary '${escapedText}'`);
@@ -136,7 +130,7 @@ export const shellCurl = {
                         const rawValue = param.value ?? '';
                         // Pretty-print parts whose contentType is JSON so the snippet stays readable,
                         // mirroring what we already do for `--data` JSON bodies above.
-                        const isJsonPart = isJsonContentType(param.contentType);
+                        const isJsonPart = isJsonMediaType(param.contentType);
                         let displayValue = rawValue;
                         if (isJsonPart && rawValue) {
                             try {

package/dist/plugins/shell/wget/wget.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wget.d.ts","sourceRoot":"","sources":["../../../../src/plugins/shell/wget/wget.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AA6BpD;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MAsFvB,CAAA"}
+{"version":3,"file":"wget.d.ts","sourceRoot":"","sources":["../../../../src/plugins/shell/wget/wget.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAgBpD;;GAEG;AACH,eAAO,MAAM,SAAS,EAAE,MAsFvB,CAAA"}

package/dist/plugins/shell/wget/wget.js

@@ -1,17 +1,5 @@
-import { parseMimeType } from '@scalar/helpers/http/mime-type';
+import { isJsonMediaType } from '@scalar/helpers/http/is-json-media-type';
 import { escapeSingleQuotes } from '../../../libs/shell.js';
-/**
- * True for `application/json`, any RFC 6839 `+json` structured-syntax suffix
- * (e.g. `application/vnd.api+json`), and parameterized variants
- * (e.g. `application/json;charset=utf-8`). Case-insensitive.
- */
-const isJsonContentType = (value) => {
-    if (!value) {
-        return false;
-    }
-    const { subtype } = parseMimeType(value);
-    return subtype === 'json' || subtype.endsWith('+json');
-};
 /**
  * Pretty-prints a JSON string and falls back to the original value when it
  * cannot be parsed. Keeps the generated snippet readable, mirroring curl.
@@ -72,7 +60,7 @@ export const shellWget = {
         // Body
         if (normalizedRequest.postData) {
             const { mimeType, text, params } = normalizedRequest.postData;
-            if (isJsonContentType(mimeType)) {
+            if (isJsonMediaType(mimeType)) {
                 if (text) {
                     parts.push(`--body-data '${escapeSingleQuotes(prettyPrintJson(text))}'`);
                 }
@@ -96,7 +84,7 @@ export const shellWget = {
                     }
                     else {
                         const rawValue = param.value ?? '';
-                        const displayValue = isJsonContentType(param.contentType) && rawValue ? prettyPrintJson(rawValue) : rawValue;
+                        const displayValue = isJsonMediaType(param.contentType) && rawValue ? prettyPrintJson(rawValue) : rawValue;
                         parts.push(`--body-data '${escapeSingleQuotes(`${param.name}=${displayValue}`)}'`);
                     }
                 });

package/package.json

@@ -9,7 +9,7 @@
     "url": "git+https://github.com/scalar/scalar.git",
     "directory": "packages/snippetz"
   },
-  "version": "0.9.32",
+  "version": "0.10.0",
   "engines": {
     "node": ">=22"
   },
@@ -238,8 +238,8 @@
     "CHANGELOG"
   ],
   "dependencies": {
-    "@scalar/helpers": "0.12.0",
-    "@scalar/types": "0.20.1",
+    "@scalar/helpers": "0.13.0",
+    "@scalar/types": "0.21.0",
     "js-base64": "^3.9.2"
   },
   "devDependencies": {