@scalar/workspace-store 0.59.0 → 0.61.0

package/dist/request-example/builder/security/secret-types.d.ts

@@ -1,7 +1,7 @@
 import type { EncryptionSchemeType, SaslSchemeType } from '../../../request-example/builder/security/broker-scheme-types.js';
 import type { XScalarAuthUrl, XScalarCredentialsLocation, XScalarSecretClientCertificate, XScalarSecretClientId, XScalarSecretClientSecret, XScalarSecretHTTP, XScalarSecretPrivateKey, XScalarSecretRedirectUri, XScalarSecretRefreshToken, XScalarSecretServiceName, XScalarSecretToken, XScalarTokenUrl } from '../../../schemas/extensions/security/index.js';
-import type { OAuthFlowAuthorizationCode, OAuthFlowClientCredentials, OAuthFlowImplicit, OAuthFlowPassword } from '../../../schemas/v3.1/strict/oauth-flow.js';
-import type { ApiKeyObject, HttpObject, OAuth2Object, OpenIdConnectObject } from '../../../schemas/v3.1/strict/security-scheme.js';
+import type { OAuthFlowAuthorizationCode, OAuthFlowClientCredentials, OAuthFlowImplicit, OAuthFlowPassword } from '../../../schemas/v3.2/strict/oauth-flow.js';
+import type { ApiKeyObject, HttpObject, MutualTlsObject, OAuth2Object, OpenIdConnectObject } from '../../../schemas/v3.2/strict/security-scheme.js';
 type OAuthFlowCommonSecret = XScalarSecretClientId & XScalarSecretToken & XScalarSecretRefreshToken & XScalarAuthUrl & XScalarTokenUrl;
 export type OAuthFlowImplicitSecret = OAuthFlowImplicit & OAuthFlowCommonSecret & XScalarSecretRedirectUri;
 export type OAuthFlowPasswordSecret = OAuthFlowPassword & OAuthFlowCommonSecret & XScalarSecretHTTP & XScalarSecretClientSecret & XScalarCredentialsLocation;
@@ -13,8 +13,17 @@ export type OAuthFlowsObjectSecret = {
     clientCredentials?: OAuthFlowClientCredentialsSecret;
     authorizationCode?: OAuthFlowAuthorizationCodeSecret;
 };
-export type ApiKeyObjectSecret = ApiKeyObject & XScalarSecretToken;
+/** AsyncAPI API keys occupy broker credentials instead of an HTTP parameter. */
+export type BrokerApiKeyObject = {
+    type: 'apiKey';
+    in: 'user' | 'password';
+    name?: string;
+    description?: string;
+};
+export type ApiKeyObjectSecret = (ApiKeyObject | BrokerApiKeyObject) & XScalarSecretToken;
 export type HttpObjectSecret = HttpObject & XScalarSecretHTTP & XScalarSecretToken;
+/** Mutual TLS: the client certificate is presented at the TLS layer, so there is no secret to enter. */
+export type MutualTlsObjectSecret = MutualTlsObject;
 export type OAuth2ObjectSecret = Omit<OAuth2Object, 'flows'> & {
     flows: OAuthFlowsObjectSecret;
 };
@@ -37,6 +46,6 @@ export type X509ObjectSecret = AsyncApiBrokerScheme<'X509'> & XScalarSecretClien
 export type EncryptionObjectSecret = AsyncApiBrokerScheme<EncryptionSchemeType> & XScalarSecretToken;
 /** AsyncAPI GSSAPI (Kerberos) scheme: the service name the client authenticates against. */
 export type GssapiObjectSecret = AsyncApiBrokerScheme<'gssapi'> & XScalarSecretServiceName;
-export type SecuritySchemeObjectSecret = ApiKeyObjectSecret | HttpObjectSecret | OpenIdConnectObjectSecret | OAuth2ObjectSecret | SaslObjectSecret | X509ObjectSecret | EncryptionObjectSecret | GssapiObjectSecret;
+export type SecuritySchemeObjectSecret = ApiKeyObjectSecret | HttpObjectSecret | MutualTlsObjectSecret | OpenIdConnectObjectSecret | OAuth2ObjectSecret | SaslObjectSecret | X509ObjectSecret | EncryptionObjectSecret | GssapiObjectSecret;
 export {};
 //# sourceMappingURL=secret-types.d.ts.map

package/dist/request-example/builder/security/secret-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,uCAAuC,CAAA;AAExH,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,CAAA;AAEjB,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,kBAAkB,CAAA;AAClE,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAClF,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}
+{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAE9C,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,CAAA;AAEjB,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,QAAQ,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;AACzF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAClF,wGAAwG;AACxG,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAA;AACnD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}

package/dist/request-example/context/get-request-example-context.d.ts

@@ -8,9 +8,9 @@ import { type MergedSecuritySchemes } from '../../request-example/context/securi
 import type { RequestExampleMeta, Result } from '../../request-example/types.js';
 import type { XScalarEnvironment } from '../../schemas/extensions/document/x-scalar-environments.js';
 import type { XScalarCookie } from '../../schemas/extensions/general/x-scalar-cookies.js';
-import type { OperationObject } from '../../schemas/v3.1/strict/operation.js';
-import type { SecurityRequirementObject } from '../../schemas/v3.1/strict/security-requirement.js';
-import type { ServerObject } from '../../schemas/v3.1/strict/server.js';
+import type { OperationObject } from '../../schemas/v3.2/strict/operation.js';
+import type { SecurityRequirementObject } from '../../schemas/v3.2/strict/security-requirement.js';
+import type { ServerObject } from '../../schemas/v3.2/strict/server.js';
 import type { WorkspaceDocument } from '../../schemas/workspace.js';
 export type BuildRequestExampleContext = {
     operation: OperationObject;

package/dist/request-example/context/get-request-example-context.js

@@ -79,7 +79,7 @@ export const getRequestExampleContext = (workspaceStore, documentName, requestEx
     const selectedSecurity = getSelectedSecurity(documentSelectedSecurity, operationSelectedSecurity, securityRequirements, securitySchemes, options.authentication?.preferredSecurityScheme);
     /** The above selected requirements in scheme form */
     const selectedSecuritySchemes = getSecuritySchemes(securitySchemes, selectedSecurity.selectedSchemes[selectedSecurity.selectedIndex] ?? {});
-    const serverMeta = !isWebhook && operation.servers != null
+    const serverMeta = !isWebhook && options.servers == null && operation.servers != null
         ? { type: 'operation', path: path ?? '', method: method ?? 'get' }
         : { type: 'document' };
     const authMeta = operationSelectedSecurity !== undefined

package/dist/request-example/context/headers.d.ts

@@ -1,5 +1,5 @@
 import type { HttpMethod } from '@scalar/helpers/http/http-methods';
-import type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { OperationObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 /**
  * Restores conventional casing for well-known default headers.
  *

package/dist/request-example/context/headers.js

@@ -28,7 +28,7 @@ const getEnabledOperationHeaderParameterNames = (operation, exampleName) => {
     const names = new Set();
     for (const ref of operation.parameters ?? []) {
         const param = getResolvedRef(ref);
-        if (param.in !== 'header') {
+        if (!param || param.in !== 'header') {
             continue;
         }
         const rawExample = 'examples' in param && param.examples?.[exampleName] ? param.examples[exampleName] : undefined;

package/dist/request-example/context/helpers/combine-params.d.ts

@@ -1,4 +1,4 @@
-import type { OperationObject, PathItemObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { OperationObject, PathItemObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 /** Combine pathItem and operation parameters into a single, dereferenced parameter array */
 export declare const combineParams: (pathParams?: PathItemObject["parameters"], operationParams?: OperationObject["parameters"]) => OperationObject["parameters"];
 //# sourceMappingURL=combine-params.d.ts.map

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts

@@ -1,10 +1,23 @@
 import type { SecurityScheme } from '@scalar/types/entities';
 import type { AuthStore } from '@scalar/workspace-store/entities/auth';
 import type { DeepPartial } from '@scalar/workspace-store/helpers/overrides-proxy';
-import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
-import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
+import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
+import type { BrokerApiKeyObject, EncryptionObjectSecret, SaslObjectSecret, SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
 /** A combined scheme that includes both the auth store secrets and a deep partial of the config auth */
 export type ConfigAuthScheme = SecuritySchemeObject & DeepPartial<SecurityScheme>;
+type BrokerSchemeType = SaslObjectSecret['type'] | EncryptionObjectSecret['type'] | 'X509' | 'gssapi';
+type BrokerAuthScheme = {
+    [T in BrokerSchemeType]: {
+        type: T;
+        description?: string;
+        username?: string;
+        password?: string;
+        token?: string;
+    };
+}[BrokerSchemeType];
 /** Extract the secrets from the config and the auth store */
-export declare const extractSecuritySchemeSecrets: (scheme: SecuritySchemeObject & DeepPartial<SecurityScheme>, authStore: AuthStore, name: string, documentSlug: string, oauth2RedirectUri?: string) => SecuritySchemeObjectSecret;
+export declare const extractSecuritySchemeSecrets: (scheme: ConfigAuthScheme | BrokerAuthScheme | (BrokerApiKeyObject & {
+    value?: string;
+}), authStore: AuthStore, name: string, documentSlug: string, oauth2RedirectUri?: string) => SecuritySchemeObjectSecret;
+export {};
 //# sourceMappingURL=extract-security-scheme-secrets.d.ts.map

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EACV,SAAS,EAOV,MAAM,uCAAuC,CAAA;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAGxG,OAAO,KAAK,EAaV,0BAA0B,EAE3B,MAAM,iDAAiD,CAAA;AAExD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAgMjF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,EAC1D,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BA6HF,CAAA"}
+{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAEV,kBAAkB,EAClB,sBAAsB,EAStB,gBAAgB,EAChB,0BAA0B,EAE3B,MAAM,iDAAiD,CAAA;AAExD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAEjF,KAAK,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrG,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,gBAAgB,GAAG;QACvB,IAAI,EAAE,CAAC,CAAA;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf;CACF,CAAC,gBAAgB,CAAC,CAAA;AAgMnB,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,kBAAkB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BA4HF,CAAA"}

package/dist/request-example/context/security/extract-security-scheme-secrets.js

@@ -1,6 +1,5 @@
 import { isObject } from '@scalar/helpers/object/is-object';
 import { objectEntries } from '@scalar/helpers/object/object-entries';
-import { isEncryptionSchemeType, isSaslSchemeType } from '../../../request-example/builder/security/broker-scheme-types.js';
 /**
  * Maps x-scalar-secret fields to their corresponding input field names.
  * This allows us to fall back to config values when auth store secrets are not available.
@@ -35,7 +34,7 @@ const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}, oaut
 }));
 /** Secret extensions are not part of the strict scheme types, so they are read the same way the OAuth flows read theirs */
 const documentSecret = (scheme, property) => {
-    const value = scheme[property];
+    const value = property in scheme ? Reflect.get(scheme, property) : undefined;
     return typeof value === 'string' ? value : '';
 };
 const extractRefreshTokenSecret = (authStoreSecrets = {}) => {
@@ -133,10 +132,6 @@ export const extractSecuritySchemeSecrets = (
 // Include the config fields
 scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
     const secrets = authStore.getAuthSecrets(documentSlug, name);
-    // AsyncAPI broker schemes live outside the OpenAPI `SecuritySchemeObject` union, so their type
-    // (and any config credential fields) are read through this alias. Captured before the OpenAPI
-    // branches below, where `scheme` gets narrowed to `never` once all four OpenAPI types are handled.
-    const brokerScheme = scheme;
     // Handle API Key security schemes
     if (scheme.type === 'apiKey') {
         const storeSecrets = secrets?.type === 'apiKey' ? secrets : undefined;
@@ -197,36 +192,43 @@ scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
     }
     // SASL-style schemes (userPassword, plain, scramSha256, scramSha512): username + password,
     // with the same config fallbacks as HTTP basic.
-    if (isSaslSchemeType(brokerScheme.type)) {
-        const storeSecrets = secrets?.type === brokerScheme.type ? secrets : undefined;
+    if (scheme.type === 'userPassword' ||
+        scheme.type === 'plain' ||
+        scheme.type === 'scramSha256' ||
+        scheme.type === 'scramSha512') {
+        const storeSecrets = secrets?.type === scheme.type ? secrets : undefined;
         return {
-            ...brokerScheme,
-            'x-scalar-secret-username': storeSecrets?.['x-scalar-secret-username'] || brokerScheme.username || '',
-            'x-scalar-secret-password': storeSecrets?.['x-scalar-secret-password'] || brokerScheme.password || '',
+            ...scheme,
+            type: scheme.type,
+            'x-scalar-secret-username': storeSecrets?.['x-scalar-secret-username'] || scheme.username || '',
+            'x-scalar-secret-password': storeSecrets?.['x-scalar-secret-password'] || scheme.password || '',
         };
     }
     // X509: a client certificate + private key pair (PEM), stored in the auth store only.
-    if (brokerScheme.type === 'X509') {
+    if (scheme.type === 'X509') {
         const storeSecrets = secrets?.type === 'X509' ? secrets : undefined;
         return {
-            ...brokerScheme,
+            ...scheme,
+            type: scheme.type,
             'x-scalar-secret-client-certificate': storeSecrets?.['x-scalar-secret-client-certificate'] || '',
             'x-scalar-secret-private-key': storeSecrets?.['x-scalar-secret-private-key'] || '',
         };
     }
     // Encryption schemes (symmetricEncryption, asymmetricEncryption): a single key value in the token slot.
-    if (isEncryptionSchemeType(brokerScheme.type)) {
-        const storeSecrets = secrets?.type === brokerScheme.type ? secrets : undefined;
+    if (scheme.type === 'symmetricEncryption' || scheme.type === 'asymmetricEncryption') {
+        const storeSecrets = secrets?.type === scheme.type ? secrets : undefined;
         return {
-            ...brokerScheme,
-            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] || brokerScheme.token || '',
+            ...scheme,
+            type: scheme.type,
+            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] || scheme.token || '',
         };
     }
     // GSSAPI (Kerberos): the service name the client authenticates against.
-    if (brokerScheme.type === 'gssapi') {
+    if (scheme.type === 'gssapi') {
         const storeSecrets = secrets?.type === 'gssapi' ? secrets : undefined;
         return {
-            ...brokerScheme,
+            ...scheme,
+            type: scheme.type,
             'x-scalar-secret-service-name': storeSecrets?.['x-scalar-secret-service-name'] || '',
         };
     }

package/dist/request-example/context/security/get-security-requirements.d.ts

@@ -1,5 +1,5 @@
-import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
-import type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation';
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
+import type { OperationObject } from '@scalar/workspace-store/schemas/v3.2/strict/operation';
 /**
  * Compute what the security requirements should be for a request
  *

package/dist/request-example/context/security/get-security-schemes.d.ts

@@ -1,6 +1,6 @@
 import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
 import type { MergedSecuritySchemes } from '../../../request-example/context/security/merge-security.js';
-import type { SecurityRequirementObject } from '../../../schemas/v3.1/strict/security-requirement.js';
+import type { SecurityRequirementObject } from '../../../schemas/v3.2/strict/security-requirement.js';
 /**
  * Get the selected security schemes from security requirements.
  * Takes security requirement objects and resolves them to actual security scheme objects.

package/dist/request-example/context/security/get-selected-security.d.ts

@@ -1,6 +1,6 @@
 import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
 import type { SelectedSecurity } from '@scalar/workspace-store/entities/auth';
-import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 type DefaultScopeScheme = {
     type?: string;
     'x-default-scopes'?: string[];

package/dist/request-example/context/security/is-auth-optional.d.ts

@@ -1,4 +1,4 @@
-import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 /** Determines if the authentication is optional */
 export declare const isAuthOptional: (securityRequirements: NonNullable<OpenApiDocument["security"]>) => boolean;
 //# sourceMappingURL=is-auth-optional.d.ts.map

package/dist/request-example/context/security/merge-security.d.ts

@@ -1,7 +1,7 @@
 import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
 import type { AsyncApiComponentsObject } from '@scalar/types/asyncapi/3.1';
 import type { AuthStore } from '@scalar/workspace-store/entities/auth';
-import { type ComponentsObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import { type ComponentsObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
 /** Document security merged with the config security schemes */
 export type MergedSecuritySchemes = Record<string, SecuritySchemeObjectSecret>;
@@ -10,8 +10,8 @@ export type MergedSecuritySchemes = Record<string, SecuritySchemeObjectSecret>;
  *
  * AsyncAPI keeps its security schemes in the same `components.securitySchemes` slot and shares the
  * `http`/`apiKey`/`oauth2`/`openIdConnect` shapes with OpenAPI, so we accept either spec's schemes
- * here. Every value is coerced into the OpenAPI `SecuritySchemeObject` shape below, so broker-specific
- * AsyncAPI types still flow through and degrade gracefully downstream.
+ * here. HTTP schemes are coerced into the OpenAPI shape, while broker credentials retain their
+ * AsyncAPI type and location.
  */
 export declare const mergeSecurity: (documentSecuritySchemes: ComponentsObject["securitySchemes"] | NonNullable<AsyncApiComponentsObject["securitySchemes"]>, configSecuritySchemes: AuthenticationConfiguration["securitySchemes"], authStore: AuthStore, documentName: string, oauth2RedirectUri?: string) => MergedSecuritySchemes;
 //# sourceMappingURL=merge-security.d.ts.map

package/dist/request-example/context/security/merge-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAgC,MAAM,4BAA4B,CAAA;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAErE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AAqE9E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,yBACI,gBAAgB,CAAC,iBAAiB,CAAC,GACnC,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBAmCF,CAAA"}
+{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAgC,MAAM,4BAA4B,CAAA;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAGrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AA0E9E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,yBACI,gBAAgB,CAAC,iBAAiB,CAAC,GACnC,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBA4DF,CAAA"}

package/dist/request-example/context/security/merge-security.js

@@ -1,13 +1,16 @@
+import { isObjectLike } from '@scalar/helpers/object/is-object';
 import { objectEntries } from '@scalar/helpers/object/object-entries';
+import { Type } from '@scalar/typebox';
 import { deepClone } from '@scalar/workspace-store/helpers/deep-clone';
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { mergeObjects } from '@scalar/workspace-store/helpers/merge-object';
 import { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce';
-import { SecuritySchemeObjectSchema, } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import { SecuritySchemeObjectSchema, } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
+import { isEncryptionSchemeType, isSaslSchemeType } from '../../../request-example/builder/security/broker-scheme-types.js';
 import { extractSecuritySchemeSecrets } from './extract-security-scheme-secrets.js';
 const hasAvailableScopes = (flow) => {
     const resolved = getResolvedRef(flow);
-    return Boolean(resolved) && typeof resolved === 'object' && 'availableScopes' in resolved;
+    return resolved !== null && typeof resolved === 'object' && 'availableScopes' in resolved;
 };
 /**
  * Rename each AsyncAPI OAuth2 flow's `availableScopes` map onto OpenAPI's `scopes`.
@@ -31,7 +34,10 @@ const normalizeAsyncApiOAuthFlows = (flows) => {
             return [flowKey, flowValue];
         }
         // Prefer an OpenAPI-native `scopes` map if one is somehow already present, so we never drop it.
-        const { availableScopes, scopes: existingScopes, ...rest } = getResolvedRef(flowValue);
+        const resolved = getResolvedRef(flowValue);
+        if (!isObjectLike(resolved))
+            return [flowKey, flowValue];
+        const { availableScopes, scopes: existingScopes, ...rest } = resolved;
         return [flowKey, { ...rest, scopes: existingScopes ?? availableScopes ?? {} }];
     }));
 };
@@ -48,6 +54,10 @@ const normalizeAsyncApiSecurityScheme = (scheme) => {
     if (!(scheme && typeof scheme === 'object' && 'type' in scheme)) {
         return scheme;
     }
+    // HTTP authentication scheme names are case-insensitive, but the strict schema uses lowercase literals.
+    if (scheme.type === 'http' && 'scheme' in scheme && typeof scheme.scheme === 'string') {
+        return { ...scheme, scheme: scheme.scheme.toLowerCase() };
+    }
     if (scheme.type === 'httpApiKey') {
         return { ...scheme, type: 'apiKey' };
     }
@@ -64,8 +74,8 @@ const normalizeAsyncApiSecurityScheme = (scheme) => {
  *
  * AsyncAPI keeps its security schemes in the same `components.securitySchemes` slot and shares the
  * `http`/`apiKey`/`oauth2`/`openIdConnect` shapes with OpenAPI, so we accept either spec's schemes
- * here. Every value is coerced into the OpenAPI `SecuritySchemeObject` shape below, so broker-specific
- * AsyncAPI types still flow through and degrade gracefully downstream.
+ * here. HTTP schemes are coerced into the OpenAPI shape, while broker credentials retain their
+ * AsyncAPI type and location.
  */
 export const mergeSecurity = (documentSecuritySchemes = {}, configSecuritySchemes = {}, authStore, documentName, oauth2RedirectUri) => {
     /** Resolve any refs in the document security schemes */
@@ -77,18 +87,37 @@ export const mergeSecurity = (documentSecuritySchemes = {}, configSecurityScheme
         return acc;
     }, {});
     /** Merge the config security schemes into the document security schemes */
-    const mergedSchemes = mergeObjects(resolvedDocumentSecuritySchemes, configSecuritySchemes) ?? {};
+    const mergedSchemes = mergeObjects(resolvedDocumentSecuritySchemes, configSecuritySchemes);
     /** Convert the config secrets to the new secret extensions */
     return objectEntries(mergedSchemes).reduce((acc, [name, value]) => {
         // Fold AsyncAPI-only types (e.g. `httpApiKey`) onto their OpenAPI equivalents before coercing,
         // so the downstream apiKey/http/oauth2 machinery recognises them instead of rejecting the type.
         const scheme = normalizeAsyncApiSecurityScheme(value);
-        // We coerce in case the scheme is missing any key fields like type
+        // Broker schemes have no OpenAPI equivalent. Validate their shared fields separately so
+        // coercion cannot turn a broker credential into an HTTP authentication scheme.
+        const type = isObjectLike(scheme) && typeof scheme.type === 'string' ? scheme.type : undefined;
+        if (isSaslSchemeType(type) || isEncryptionSchemeType(type) || type === 'X509' || type === 'gssapi') {
+            const broker = coerceValue(Type.Object({
+                description: Type.Optional(Type.String()),
+                username: Type.Optional(Type.String()),
+                password: Type.Optional(Type.String()),
+                token: Type.Optional(Type.String()),
+            }), scheme);
+            acc[name] = extractSecuritySchemeSecrets({ ...broker, type }, authStore, name, documentName, oauth2RedirectUri);
+            return acc;
+        }
+        if (isObjectLike(scheme) && scheme.type === 'apiKey' && (scheme.in === 'user' || scheme.in === 'password')) {
+            const broker = coerceValue(Type.Object({
+                description: Type.Optional(Type.String()),
+                name: Type.Optional(Type.String()),
+                value: Type.Optional(Type.String()),
+            }), scheme);
+            acc[name] = extractSecuritySchemeSecrets({ ...broker, type: 'apiKey', in: scheme.in }, authStore, name, documentName, oauth2RedirectUri);
+            return acc;
+        }
+        // We coerce in case the scheme is missing any key fields like type.
         const coerced = coerceValue(SecuritySchemeObjectSchema, scheme);
-        // We then overwrite it back with the original value to keep any other fields like description, etc.
-        // `coerced` has already laundered the value into the OpenAPI shape (including any AsyncAPI scheme),
-        // so we narrow here to restore the extra fields without re-widening the type.
-        const merged = { ...coerced, ...scheme };
+        const merged = { ...(isObjectLike(scheme) ? scheme : {}), ...coerced };
         acc[name] = extractSecuritySchemeSecrets(merged, authStore, name, documentName, oauth2RedirectUri);
         return acc;
     }, {});

package/dist/request-example/context/servers.d.ts

@@ -1,6 +1,6 @@
-import type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { WorkspaceDocument } from '../../schemas.js';
-import type { OperationObject } from '../../schemas/v3.1/strict/operation.js';
+import type { OperationObject } from '../../schemas/v3.2/strict/operation.js';
 /**
  * Server processing options containing base URLs for resolving relative server URLs.
  */

package/dist/request-example/functions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/request-example/functions.ts"],"names":[],"mappings":"AAsJA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAnCN,MAAM;;;;kBAMR,MAAM;;;;kBAMJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAihBoC,CAAA;AAEjE,kHAAkH;AAClH,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,gBAAgB,CAAA;AAE/D,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,MACiB,CAAA;AAEvF,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,EAAE,SAAS,mBAAmB,EASvE,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAoC,mBAAmB,EAAE,CAAA;AAC5F,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,mBACtB,CAAA"}
+{"version":3,"file":"functions.d.ts","sourceRoot":"","sources":["../../src/request-example/functions.ts"],"names":[],"mappings":"AAsJA,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAnCN,MAAM;;;;kBAMR,MAAM;;;;kBAMJ,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAihBoC,CAAA;AAEjE,kHAAkH;AAClH,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG,MAAM,OAAO,gBAAgB,CAAA;AAE/D,eAAO,MAAM,yBAAyB,GAAI,MAAM,mBAAmB,KAAG,MAAwC,CAAA;AAE9G,qFAAqF;AACrF,eAAO,MAAM,6BAA6B,EAAE,SAAS,mBAAmB,EASvE,CAAA;AAED,eAAO,MAAM,sBAAsB,EAAoC,mBAAmB,EAAE,CAAA;AAC5F,eAAO,MAAM,qBAAqB,GAAI,MAAM,MAAM,KAAG,IAAI,IAAI,mBACtB,CAAA"}

package/dist/request-example/index.d.ts

@@ -1,5 +1,5 @@
 export type { ApiKeyObjectSecret, BuildRequestData, BuildRequestFailureCode, BuildRequestResult, EncryptionObjectSecret, GssapiObjectSecret, HttpObjectSecret, OAuth2ObjectSecret, OAuthFlowAuthorizationCodeSecret, OAuthFlowClientCredentialsSecret, OAuthFlowImplicitSecret, OAuthFlowPasswordSecret, OAuthFlowsObjectSecret, OpenIdConnectObjectSecret, RequestPayload, ResolveRequestFactoryUrlError, ResolveRequestFactoryUrlResult, SaslObjectSecret, SecuritySchemeObjectSecret, X509ObjectSecret, } from './builder/index.js';
-export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, type RequestFactory, type SerializedFormProperty, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
+export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, type RequestFactory, type SerializedFormProperty, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
 export type { MergedSecuritySchemes } from './context/index.js';
 export { type BuildRequestExampleContext, combineParams, filterDisabledDefaultHeaders, getActiveEnvironment, getActiveProxyUrl, getDefaultHeaders, getRequestExampleContext, getSecurityRequirements, getSecuritySchemes, getSelectedSecurity, getSelectedServer, getServers, isAuthOptional, mergeSecurity, restoreConventionalDefaultHeaderNames, restoreConventionalHeaderName, } from './context/index.js';
 export { CONTEXT_FUNCTION_NAMES, type ContextFunctionEntry, type ContextFunctionName, POPULAR_CONTEXT_FUNCTION_KEYS, contextFunctions, getContextFunctionComment, isContextFunctionName, } from './functions.js';

package/dist/request-example/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,iCAAiC,EACjC,kBAAkB,EAClB,4BAA4B,EAC5B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EACL,KAAK,0BAA0B,EAC/B,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,iCAAiC,EACjC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,WAAW,CAAA;AAClB,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EACL,KAAK,0BAA0B,EAC/B,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA"}

package/dist/request-example/index.js

@@ -1,4 +1,4 @@
-export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
+export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
 export { combineParams, filterDisabledDefaultHeaders, getActiveEnvironment, getActiveProxyUrl, getDefaultHeaders, getRequestExampleContext, getSecurityRequirements, getSecuritySchemes, getSelectedSecurity, getSelectedServer, getServers, isAuthOptional, mergeSecurity, restoreConventionalDefaultHeaderNames, restoreConventionalHeaderName, } from './context/index.js';
 export { CONTEXT_FUNCTION_NAMES, POPULAR_CONTEXT_FUNCTION_KEYS, contextFunctions, getContextFunctionComment, isContextFunctionName, } from './functions.js';
 export { createVariablesStoreForRequest } from './variable-store/index.js';

package/dist/resolve.d.ts

@@ -1,4 +1,4 @@
-import type { MaybeRefSchemaObject, SchemaObject } from './schemas/v3.1/strict/schema.js';
+import type { MaybeRefSchemaObject, SchemaObject } from './schemas/v3.2/strict/schema.js';
 type ResolvedSchema<T> = T extends undefined ? undefined : SchemaObject & {
     $ref?: string;
 };

package/dist/resolve.js

@@ -2,7 +2,7 @@ import { Type } from '@scalar/typebox';
 import { getResolvedRef, mergeSiblingReferences } from './helpers/get-resolved-ref.js';
 import { compose } from './schemas/compose.js';
 import { coerceValue } from './schemas/typebox-coerce.js';
-import { SchemaObjectSchema } from './schemas/v3.1/strict/openapi-document.js';
+import { SchemaObjectSchema } from './schemas/v3.2/strict/openapi-document.js';
 export const resolve = {
     schema: (schema) => {
         if (schema === undefined) {

package/dist/schemas/extensions/document/x-scalar-default-request-body-view.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Schema for the x-scalar-default-request-body-view extension on an OpenAPI document.
+ *
+ * Sets the initial view of the request body editor for structured (JSON/YAML) bodies.
+ * Use `form` to open the schema-driven form view by default, or `raw` for the code editor.
+ * When the body cannot be shown as a form, Scalar falls back to `raw` automatically.
+ *
+ * @example
+ * ```yaml
+ * x-scalar-default-request-body-view: form
+ * ```
+ */
+export declare const XScalarDefaultRequestBodyViewSchema: import("@scalar/typebox").TObject<{
+    'x-scalar-default-request-body-view': import("@scalar/typebox").TOptional<import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"form">, import("@scalar/typebox").TLiteral<"raw">]>>;
+}>;
+export type XScalarDefaultRequestBodyView = {
+    /** Initial request body editor view for structured bodies. Defaults to `raw`. */
+    'x-scalar-default-request-body-view'?: 'form' | 'raw';
+};
+export declare const XScalarDefaultRequestBodyView: import("@scalar/validation").ObjectSchema<{
+    'x-scalar-default-request-body-view': import("@scalar/validation").OptionalSchema<import("@scalar/validation").UnionSchema<readonly [import("@scalar/validation").LiteralSchema<"form">, import("@scalar/validation").LiteralSchema<"raw">]>>;
+}>;
+//# sourceMappingURL=x-scalar-default-request-body-view.d.ts.map

package/dist/schemas/extensions/document/x-scalar-default-request-body-view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x-scalar-default-request-body-view.d.ts","sourceRoot":"","sources":["../../../../src/schemas/extensions/document/x-scalar-default-request-body-view.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mCAAmC;;EAE9C,CAAA;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,iFAAiF;IACjF,oCAAoC,CAAC,EAAE,MAAM,GAAG,KAAK,CAAA;CACtD,CAAA;AAED,eAAO,MAAM,6BAA6B;;EAQzC,CAAA"}

package/dist/schemas/extensions/document/x-scalar-default-request-body-view.js

@@ -0,0 +1,23 @@
+import { Type } from '@scalar/typebox';
+import { literal, object, optional, union } from '@scalar/validation';
+/**
+ * Schema for the x-scalar-default-request-body-view extension on an OpenAPI document.
+ *
+ * Sets the initial view of the request body editor for structured (JSON/YAML) bodies.
+ * Use `form` to open the schema-driven form view by default, or `raw` for the code editor.
+ * When the body cannot be shown as a form, Scalar falls back to `raw` automatically.
+ *
+ * @example
+ * ```yaml
+ * x-scalar-default-request-body-view: form
+ * ```
+ */
+export const XScalarDefaultRequestBodyViewSchema = Type.Object({
+    'x-scalar-default-request-body-view': Type.Optional(Type.Union([Type.Literal('form'), Type.Literal('raw')])),
+});
+export const XScalarDefaultRequestBodyView = object({
+    'x-scalar-default-request-body-view': optional(union([literal('form'), literal('raw')])),
+}, {
+    typeName: 'XScalarDefaultRequestBodyView',
+    typeComment: 'Initial request body editor view for structured bodies (form or raw)',
+});

package/dist/schemas/navigation.d.ts

@@ -1,10 +1,10 @@
 import { type HttpMethod } from '@scalar/helpers/http/http-methods';
 import { type TLiteral } from '@scalar/typebox';
 import type { AsyncApiInfoObject } from '@scalar/types/asyncapi/3.1';
-import type { InfoObject } from '../schemas/v3.1/strict/info.js';
-import type { OperationObject } from '../schemas/v3.1/strict/operation.js';
-import type { SchemaObject } from '../schemas/v3.1/strict/schema.js';
-import type { TagObject } from '../schemas/v3.1/strict/tag.js';
+import type { InfoObject } from '../schemas/v3.2/strict/info.js';
+import type { OperationObject } from '../schemas/v3.2/strict/operation.js';
+import type { SchemaObject } from '../schemas/v3.2/strict/schema.js';
+import type { TagObject } from '../schemas/v3.2/strict/tag.js';
 export declare const NavigationBaseSchemaDefinition: import("@scalar/typebox").TObject<{
     id: import("@scalar/typebox").TString;
     title: import("@scalar/typebox").TString;

package/dist/schemas/navigation.js

@@ -1,7 +1,7 @@
 import { HTTP_METHODS } from '@scalar/helpers/http/http-methods';
 import { Type } from '@scalar/typebox';
 import { compose } from '../schemas/compose.js';
-import { TraversedEntryObjectRef } from '../schemas/v3.1/strict/ref-definitions.js';
+import { TraversedEntryObjectRef } from '../schemas/v3.2/strict/ref-definitions.js';
 export const NavigationBaseSchemaDefinition = Type.Object({
     id: Type.String(),
     title: Type.String(),