@scalar/workspace-store 0.60.0 → 0.62.0

package/dist/schemas/v3.2/strict/response.d.ts

@@ -16,7 +16,7 @@ export declare const ResponseObjectSchemaDefinition: import("@scalar/typebox").T
         $status: import("@scalar/typebox").TOptional<import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"loading">, import("@scalar/typebox").TLiteral<"error">]>>;
         $global: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
     }>]>, import("@scalar/typebox").TObject<{
-        '$ref-value': import("@scalar/typebox").TRef<"HeaderObject">;
+        '$ref-value': import("@scalar/typebox").TOptional<import("@scalar/typebox").TRef<"HeaderObject">>;
     }>]>]>>>;
     /** A map containing descriptions of potential response payloads. The key is a media type or media type range and the value describes it. For responses that match multiple keys, only the most specific key is applicable. e.g. "text/plain" overrides "text/*"  */
     content: import("@scalar/typebox").TOptional<import("@scalar/typebox").TRecord<import("@scalar/typebox").TString, import("@scalar/typebox").TRef<"MediaTypeObject">>>;
@@ -29,7 +29,7 @@ export declare const ResponseObjectSchemaDefinition: import("@scalar/typebox").T
         $status: import("@scalar/typebox").TOptional<import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"loading">, import("@scalar/typebox").TLiteral<"error">]>>;
         $global: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
     }>]>, import("@scalar/typebox").TObject<{
-        '$ref-value': import("@scalar/typebox").TRef<"LinkObject">;
+        '$ref-value': import("@scalar/typebox").TOptional<import("@scalar/typebox").TRef<"LinkObject">>;
     }>]>]>>>;
 }>;
 /**

package/dist/schemas/v3.2/strict/responses.d.ts

@@ -17,7 +17,7 @@ export declare const ResponsesObjectSchemaDefinition: import("@scalar/typebox").
     $status: import("@scalar/typebox").TOptional<import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"loading">, import("@scalar/typebox").TLiteral<"error">]>>;
     $global: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
 }>]>, import("@scalar/typebox").TObject<{
-    '$ref-value': import("@scalar/typebox").TRef<"ResponseObject">;
+    '$ref-value': import("@scalar/typebox").TOptional<import("@scalar/typebox").TRef<"ResponseObject">>;
 }>]>]>>;
 /**
  * A container for the expected responses of an operation. The container maps a HTTP response code to the expected response.

package/dist/schemas/v3.2/strict/security-scheme.d.ts

@@ -1,3 +1,4 @@
+import { type XScalarIgnore } from '../../../schemas/extensions/document/x-scalar-ignore.js';
 import { type XDefaultScopes } from '../../../schemas/extensions/security/x-default-scopes.js';
 import type { OAuthFlowsObject } from '../../../schemas/v3.2/strict/oauthflows.js';
 type Description = {
@@ -5,7 +6,7 @@ type Description = {
     description?: string;
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated?: boolean;
-};
+} & XScalarIgnore;
 export type ApiKeyObject = Description & {
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: 'apiKey';
@@ -22,12 +23,16 @@ export type HttpObject = Description & {
     /** A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes. */
     bearerFormat?: string;
 };
+export type MutualTlsObject = Description & {
+    /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
+    type: 'mutualTLS';
+};
 export type OAuth2Object = Description & {
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: 'oauth2';
     /** REQUIRED. An object containing configuration information for the flow types supported. */
     flows: OAuthFlowsObject;
-    /** URL to the OAuth2 authorization server metadata (RFC8414). TLS is required. Added in OpenAPI 3.2. */
+    /** URL to the OAuth2 authorization server metadata (RFC8414). Use HTTPS, or HTTP for local development URLs. Added in OpenAPI 3.2. */
     oauth2MetadataUrl?: string;
 } & XDefaultScopes;
 export type OpenIdConnectObject = Description & {
@@ -41,55 +46,73 @@ export type OpenIdConnectObject = Description & {
  *
  * Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), mutual TLS (use of a client certificate), OAuth2's common flows (implicit, password, client credentials and authorization code) as defined in RFC6749, and [[OpenID-Connect-Core]]. Please note that as of 2020, the implicit flow is about to be deprecated by OAuth 2.0 Security Best Current Practice. Recommended for most use cases is Authorization Code Grant flow with PKCE.
  */
-export declare const SecuritySchemeObjectSchemaDefinition: import("@scalar/typebox").TUnion<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
+export declare const SecuritySchemeObjectSchemaDefinition: import("@scalar/typebox").TUnion<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
     /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
     description: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
 }>, import("@scalar/typebox").TObject<{
+    'x-scalar-ignore': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>]>, import("@scalar/typebox").TObject<{
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: import("@scalar/typebox").TLiteral<"apiKey">;
     /** REQUIRED. The name of the header, query or cookie parameter to be used. */
     name: import("@scalar/typebox").TString;
     /** REQUIRED. The location of the API key. Valid values are "query", "header", or "cookie". */
     in: import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"query">, import("@scalar/typebox").TLiteral<"header">, import("@scalar/typebox").TLiteral<"cookie">]>;
-}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
+}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
     /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
     description: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
 }>, import("@scalar/typebox").TObject<{
+    'x-scalar-ignore': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>]>, import("@scalar/typebox").TObject<{
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: import("@scalar/typebox").TLiteral<"http">;
     /** REQUIRED. The name of the HTTP Authentication scheme to be used in the Authorization header as defined in RFC7235. The values used SHOULD be registered in the IANA Authentication Scheme registry. The value is case-insensitive, as defined in RFC7235. */
     scheme: import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"basic">, import("@scalar/typebox").TLiteral<"bearer">]>;
     /** A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes. */
     bearerFormat: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
-}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
+}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
+    /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
+    description: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
+    /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
+    deprecated: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>, import("@scalar/typebox").TObject<{
+    'x-scalar-ignore': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>]>, import("@scalar/typebox").TObject<{
+    /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
+    type: import("@scalar/typebox").TLiteral<"mutualTLS">;
+}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
     /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
     description: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
 }>, import("@scalar/typebox").TObject<{
+    'x-scalar-ignore': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>]>, import("@scalar/typebox").TObject<{
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: import("@scalar/typebox").TLiteral<"oauth2">;
     /** REQUIRED. An object containing configuration information for the flow types supported. */
     flows: import("@scalar/typebox").TRef<"OAuthFlowsObject">;
-    /** URL to the OAuth2 authorization server metadata (RFC8414). TLS is required. Added in OpenAPI 3.2. */
+    /** URL to the OAuth2 authorization server metadata (RFC8414). Use HTTPS, or HTTP for local development URLs. Added in OpenAPI 3.2. */
     oauth2MetadataUrl: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
 }>, import("@scalar/typebox").TObject<{
     'x-default-scopes': import("@scalar/typebox").TOptional<import("@scalar/typebox").TArray<import("@scalar/typebox").TString>>;
-}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
+}>]>, import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{
     /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
     description: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated: import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
 }>, import("@scalar/typebox").TObject<{
+    'x-scalar-ignore': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+}>]>, import("@scalar/typebox").TObject<{
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: import("@scalar/typebox").TLiteral<"openIdConnect">;
     /** REQUIRED. Well-known URL to discover the [[OpenID-Connect-Discovery]] provider metadata. */
     openIdConnectUrl: import("@scalar/typebox").TString;
 }>]>]>;
-export type SecuritySchemeObject = ApiKeyObject | HttpObject | OAuth2Object | OpenIdConnectObject;
+export type SecuritySchemeObject = ApiKeyObject | HttpObject | MutualTlsObject | OAuth2Object | OpenIdConnectObject;
 export {};
 //# sourceMappingURL=security-scheme.d.ts.map

package/dist/schemas/v3.2/strict/security-scheme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/schemas/v3.2/strict/security-scheme.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,gDAAgD,CAAA;AAC1G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAUxE,KAAK,WAAW,GAAG;IACjB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wIAAwI;IACxI,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,CAAA;AAcD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACvC,4HAA4H;IAC5H,IAAI,EAAE,QAAQ,CAAA;IACd,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAA;IACZ,8FAA8F;IAC9F,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAClC,CAAA;AAcD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IACrC,4HAA4H;IAC5H,IAAI,EAAE,MAAM,CAAA;IACZ,gQAAgQ;IAChQ,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC1B,uMAAuM;IACvM,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAeD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACvC,4HAA4H;IAC5H,IAAI,EAAE,QAAQ,CAAA;IACd,6FAA6F;IAC7F,KAAK,EAAE,gBAAgB,CAAA;IACvB,wGAAwG;IACxG,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,cAAc,CAAA;AAYlB,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG;IAC9C,4HAA4H;IAC5H,IAAI,EAAE,eAAe,CAAA;IACrB,+FAA+F;IAC/F,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oCAAoC;IAnG/C,qGAAqG;;IAErG,wIAAwI;;;IActI,4HAA4H;;IAE5H,8EAA8E;;IAE9E,8FAA8F;;;IApBhG,qGAAqG;;IAErG,wIAAwI;;;IAmCtI,4HAA4H;;IAE5H,gQAAgQ;;IAEhQ,uMAAuM;;;IAzCzM,qGAAqG;;IAErG,wIAAwI;;;IAwDtI,4HAA4H;;IAE5H,6FAA6F;;IAE7F,wGAAwG;;;;;IA9D1G,qGAAqG;;IAErG,wIAAwI;;;IA8EtI,4HAA4H;;IAE5H,+FAA+F;;MAiBc,CAAA;AAEjH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,UAAU,GAAG,YAAY,GAAG,mBAAmB,CAAA"}
+{"version":3,"file":"security-scheme.d.ts","sourceRoot":"","sources":["../../../../src/schemas/v3.2/strict/security-scheme.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,aAAa,EAAuB,MAAM,+CAA+C,CAAA;AACvG,OAAO,EAAE,KAAK,cAAc,EAAwB,MAAM,gDAAgD,CAAA;AAC1G,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAA;AAexE,KAAK,WAAW,GAAG;IACjB,qGAAqG;IACrG,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,wIAAwI;IACxI,UAAU,CAAC,EAAE,OAAO,CAAA;CACrB,GAAG,aAAa,CAAA;AAcjB,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACvC,4HAA4H;IAC5H,IAAI,EAAE,QAAQ,CAAA;IACd,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAA;IACZ,8FAA8F;IAC9F,EAAE,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAClC,CAAA;AAcD,MAAM,MAAM,UAAU,GAAG,WAAW,GAAG;IACrC,4HAA4H;IAC5H,IAAI,EAAE,MAAM,CAAA;IACZ,gQAAgQ;IAChQ,MAAM,EAAE,OAAO,GAAG,QAAQ,CAAA;IAC1B,uMAAuM;IACvM,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAUD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG;IAC1C,4HAA4H;IAC5H,IAAI,EAAE,WAAW,CAAA;CAClB,CAAA;AAeD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACvC,4HAA4H;IAC5H,IAAI,EAAE,QAAQ,CAAA;IACd,6FAA6F;IAC7F,KAAK,EAAE,gBAAgB,CAAA;IACvB,sIAAsI;IACtI,iBAAiB,CAAC,EAAE,MAAM,CAAA;CAC3B,GAAG,cAAc,CAAA;AAYlB,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG;IAC9C,4HAA4H;IAC5H,IAAI,EAAE,eAAe,CAAA;IACrB,+FAA+F;IAC/F,gBAAgB,EAAE,MAAM,CAAA;CACzB,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,oCAAoC;IAlH7C,qGAAqG;;IAErG,wIAAwI;;;;;IAgBxI,4HAA4H;;IAE5H,8EAA8E;;IAE9E,8FAA8F;;;IAtB9F,qGAAqG;;IAErG,wIAAwI;;;;;IAqCxI,4HAA4H;;IAE5H,gQAAgQ;;IAEhQ,uMAAuM;;;IA3CvM,qGAAqG;;IAErG,wIAAwI;;;;;IA0DxI,4HAA4H;;;IA5D5H,qGAAqG;;IAErG,wIAAwI;;;;;IAuExI,4HAA4H;;IAE5H,6FAA6F;;IAE7F,sIAAsI;;;;;IA7EtI,qGAAqG;;IAErG,wIAAwI;;;;;IA6FxI,4HAA4H;;IAE5H,+FAA+F;;MAuBjG,CAAA;AAEF,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,YAAY,GAAG,mBAAmB,CAAA"}

package/dist/schemas/v3.2/strict/security-scheme.js

@@ -1,13 +1,16 @@
 import { Type } from '@scalar/typebox';
 import { compose } from '../../../schemas/compose.js';
+import { XScalarIgnoreSchema } from '../../../schemas/extensions/document/x-scalar-ignore.js';
 import { XDefaultScopesSchema } from '../../../schemas/extensions/security/x-default-scopes.js';
 import { OAuthFlowsObjectRef } from '../../../schemas/v3.2/strict/ref-definitions.js';
-const DescriptionSchema = Type.Object({
+// Shared base for every security scheme: a description plus the ignore extension, so any
+// scheme can be hidden from the auth UI with `x-scalar-ignore`. See documentation/openapi.md.
+const DescriptionSchema = compose(Type.Object({
     /** A description for security scheme. CommonMark syntax MAY be used for rich text representation. */
     description: Type.Optional(Type.String()),
     /** Declares this security scheme to be deprecated. Consumers SHOULD refrain from usage of the declared scheme. Added in OpenAPI 3.2. */
     deprecated: Type.Optional(Type.Boolean()),
-});
+}), XScalarIgnoreSchema);
 const ApiKeySchema = compose(DescriptionSchema, Type.Object({
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: Type.Literal('apiKey'),
@@ -24,12 +27,16 @@ const HttpSchema = compose(DescriptionSchema, Type.Object({
     /** A hint to the client to identify how the bearer token is formatted. Bearer tokens are usually generated by an authorization server, so this information is primarily for documentation purposes. */
     bearerFormat: Type.Optional(Type.String()),
 }));
+const MutualTlsSchema = compose(DescriptionSchema, Type.Object({
+    /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
+    type: Type.Literal('mutualTLS'),
+}));
 const OAuth2 = compose(DescriptionSchema, Type.Object({
     /** REQUIRED. The type of the security scheme. Valid values are "apiKey", "http", "mutualTLS", "oauth2", "openIdConnect". */
     type: Type.Literal('oauth2'),
     /** REQUIRED. An object containing configuration information for the flow types supported. */
     flows: OAuthFlowsObjectRef,
-    /** URL to the OAuth2 authorization server metadata (RFC8414). TLS is required. Added in OpenAPI 3.2. */
+    /** URL to the OAuth2 authorization server metadata (RFC8414). Use HTTPS, or HTTP for local development URLs. Added in OpenAPI 3.2. */
     oauth2MetadataUrl: Type.Optional(Type.String()),
 }), XDefaultScopesSchema);
 const OpenIdConnect = compose(DescriptionSchema, Type.Object({
@@ -43,4 +50,10 @@ const OpenIdConnect = compose(DescriptionSchema, Type.Object({
  *
  * Supported schemes are HTTP authentication, an API key (either as a header, a cookie parameter or as a query parameter), mutual TLS (use of a client certificate), OAuth2's common flows (implicit, password, client credentials and authorization code) as defined in RFC6749, and [[OpenID-Connect-Core]]. Please note that as of 2020, the implicit flow is about to be deprecated by OAuth 2.0 Security Best Current Practice. Recommended for most use cases is Authorization Code Grant flow with PKCE.
  */
-export const SecuritySchemeObjectSchemaDefinition = Type.Union([ApiKeySchema, HttpSchema, OAuth2, OpenIdConnect]);
+export const SecuritySchemeObjectSchemaDefinition = Type.Union([
+    ApiKeySchema,
+    HttpSchema,
+    MutualTlsSchema,
+    OAuth2,
+    OpenIdConnect,
+]);

package/dist/schemas/workspace-specification/index.d.ts

@@ -1,5 +1,5 @@
 import type { PartialDeep } from 'type-fest';
-import type { OpenApiDocument } from '../../schemas/v3.1/strict/openapi-document.js';
+import type { OpenApiDocument } from '../../schemas/v3.2/strict/openapi-document.js';
 import { type WorkspaceMeta } from '../../schemas/workspace.js';
 import { type Info } from '../../schemas/workspace-specification/info.js';
 export declare const WorkspaceSpecificationSchema: import("@scalar/typebox").TIntersect<[import("@scalar/typebox").TObject<{

package/dist/schemas/workspace.d.ts

@@ -6,7 +6,7 @@ import { type XScalarCookies } from '../schemas/extensions/general/x-scalar-cook
 import { type XScalarOrder } from '../schemas/extensions/general/x-scalar-order.js';
 import { type XScalarActiveProxy } from '../schemas/extensions/workspace/x-scalar-active-proxy.js';
 import { type XScalarTabs } from '../schemas/extensions/workspace/x-scalar-tabs.js';
-import type { OpenAPIExtensions, OpenApiDocument } from './v3.1/strict/openapi-document.js';
+import type { OpenAPIExtensions, OpenApiDocument } from './v3.2/strict/openapi-document.js';
 export type WorkspaceDocumentMeta = Omit<OpenAPIExtensions, 'x-original-oas-version' | 'x-scalar-original-source-url' | 'x-scalar-original-document-hash'>;
 export type WorkspaceDocument = OpenApiDocument | AsyncApiDocument;
 export declare const ColorModeSchema: import("@scalar/typebox").TUnion<[import("@scalar/typebox").TLiteral<"system">, import("@scalar/typebox").TLiteral<"light">, import("@scalar/typebox").TLiteral<"dark">]>;

package/dist/server.d.ts

@@ -1,5 +1,5 @@
 import type { NavigationOptions } from './navigation/get-navigation-options.js';
-import { type OpenApiDocument, type OperationObject, type PathsObject } from './schemas/v3.1/strict/openapi-document.js';
+import { type OpenApiDocument, type OperationObject, type PathsObject } from './schemas/v3.2/strict/openapi-document.js';
 import type { Workspace, WorkspaceDocumentMeta, WorkspaceMeta } from './schemas/workspace.js';
 export declare const WORKSPACE_FILE_NAME = "scalar-workspace.json";
 type WorkspaceDocumentMetaInput = {
@@ -178,6 +178,33 @@ export type ServerWorkspaceStore = {
      * @returns The resolved chunk, or `undefined` when not found
      */
     get: (pointer: string) => unknown;
+    /**
+     * Returns a document whole, with local references resolving, for rendering on the server.
+     *
+     * `getWorkspace()` hands back the sparse document: every component and operation is a reference
+     * to a chunk, which is what the browser wants so it can load only what a page needs. A server
+     * render wants the opposite — the complete document, read through one reference, with `$ref-value`
+     * resolving locally and nothing fetched. That is the document the store built its navigation and
+     * chunks from, so this is that object rather than a second copy: it shares the components and
+     * operations the chunks are written from, and carries the same metadata and navigation as the
+     * sparse document.
+     *
+     * It is a magic proxy, never reactive, so reading it costs a property lookup and a pointer
+     * resolution. Use `getRaw` to serialize it: `$ref-value` is enumerable on the proxy and would
+     * inline every referenced value beside its `$ref`.
+     *
+     * @example
+     * ```ts
+     * const document = store.getResolvedDocument('petstore')
+     *
+     * // A real operation, not a chunk reference
+     * document?.paths?.['/pets']?.get
+     * ```
+     *
+     * @param name - The document name it was added under
+     * @returns The resolved document, or `undefined` when no document has that name
+     */
+    getResolvedDocument: (name: string) => ServerWorkspace['documents'][string] | undefined;
 };
 /**
  * Create server state workspace store

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAK5E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,wCAAwC,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAG1F,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,KAAK,0BAA0B,GAAG;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC1D,KAAK,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC5D,KAAK,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAEnF,KAAK,sBAAsB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;AAE1D,KAAK,8BAA8B,GAAG;IACpC,SAAS,EAAE,sBAAsB,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC,CAAA;AACD,KAAK,+BAA+B,GAChC,CAAC;IACC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,8BAA8B,CAAC,GACnC,CAAC;IACC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,KAAK,CAAA;CACZ,GAAG,8BAA8B,CAAC,CAAA;AA4DvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAwBzG;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAUjD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBA4B3G;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBAyC3G;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAuCxD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,EAAE,MAAM,eAAe,CAAA;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;CAClC,CAAA;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CAyR/B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAI5E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,wCAAwC,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAG1F,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,KAAK,0BAA0B,GAAG;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC1D,KAAK,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC5D,KAAK,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAEnF,KAAK,sBAAsB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;AAE1D,KAAK,8BAA8B,GAAG;IACpC,SAAS,EAAE,sBAAsB,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC,CAAA;AACD,KAAK,+BAA+B,GAChC,CAAC;IACC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,8BAA8B,CAAC,GACnC,CAAC;IACC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,KAAK,CAAA;CACZ,GAAG,8BAA8B,CAAC,CAAA;AA0DvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CA4BzG;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAUjD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBAyB3G;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBAyC3G;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAuCxD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,EAAE,MAAM,eAAe,CAAA;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;CACxF,CAAA;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CA2S/B"}

package/dist/server.js

@@ -1,17 +1,20 @@
-import fs from 'node:fs/promises';
 import { cwd } from 'node:process';
 import { upgrade as upgradeAsyncApi } from '@scalar/asyncapi-upgrader';
+import { isHttpMethod } from '@scalar/helpers/http/is-http-method';
 import { parseJsonPointerSegments } from '@scalar/helpers/json/parse-json-pointer-segments';
 import { getValueAtPath } from '@scalar/helpers/object/get-value-at-path';
 import { preventPollution } from '@scalar/helpers/object/prevent-pollution';
 import { extensions as bundleExtensions } from '@scalar/json-magic/bundle';
 import { fetchUrls, readFiles } from '@scalar/json-magic/bundle/plugins/node';
 import { escapeJsonPointer } from '@scalar/json-magic/helpers/escape-json-pointer';
+import { unescapeJsonPointer } from '@scalar/json-magic/helpers/unescape-json-pointer';
 import { createMagicProxy, getRaw } from '@scalar/json-magic/magic-proxy';
 import { upgrade } from '@scalar/openapi-upgrader';
 import { asyncApiObjectSchema } from '@scalar/schemas/asyncapi/3.1';
 import { coerce } from '@scalar/validation';
+import { createChunkWriter } from './helpers/create-chunk-writer.js';
 import { deepClone } from './helpers/deep-clone.js';
+import { encodeChunkName } from './helpers/encode-chunk-name.js';
 import { forEachPathItemOperation, getResolvedPathItem } from './helpers/for-each-path-item-operation.js';
 import { keyOf } from './helpers/general.js';
 import { getResolvedRef } from './helpers/get-resolved-ref.js';
@@ -20,10 +23,9 @@ import { createNavigation, traverseAsyncApiDocument } from './navigation/index.j
 import { extensions } from './schemas/extensions.js';
 import { isAsyncApiDocument } from './schemas/type-guards.js';
 import { coerceValue } from './schemas/typebox-coerce.js';
-import { OpenAPIDocumentSchema, } from './schemas/v3.1/strict/openapi-document.js';
+import { OpenAPIDocumentSchema, } from './schemas/v3.2/strict/openapi-document.js';
 const DEFAULT_ASSETS_FOLDER = 'assets';
 export const WORKSPACE_FILE_NAME = 'scalar-workspace.json';
-const httpMethods = new Set(['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace']);
 /**
  * Wraps a document so local `$ref`s resolve while the store inspects it.
  *
@@ -100,11 +102,14 @@ const preserveBundledExternals = (source, target) => {
  */
 export function filterHttpMethodsOnly(paths) {
     const result = {};
-    // Todo: skip extension properties
     for (const [path, pathItemRef] of Object.entries(paths)) {
+        // Paths Object extensions can contain objects that resemble HTTP operations.
+        if (path.startsWith('x-')) {
+            continue;
+        }
         const filteredMethods = {};
         forEachPathItemOperation(pathItemRef, (method, operation) => {
-            if (httpMethods.has(method.toLowerCase())) {
+            if (isHttpMethod(method)) {
                 // Unwrapped because the caller hands us a resolved document. A magic proxy enumerates a
                 // virtual `$ref-value`, so storing one would inline every referenced component beside its
                 // `$ref` when the chunk is written — and a self-referential schema would never finish
@@ -153,10 +158,7 @@ export function externalizeComponentReferences(document, meta) {
         Object.keys(component).forEach((name) => {
             const ref = meta.mode === 'ssr'
                 ? `${meta.baseUrl}/${meta.name}/components/${type}/${name}#`
-                : // Escape the type and name so the static reference matches the escaped filename written
-                    // by generateWorkspaceChunks, and so a key like `../../evil` cannot point outside the
-                    // chunks directory.
-                    `./chunks/${meta.name}/components/${escapeJsonPointer(type)}/${escapeJsonPointer(name)}.json#`;
+                : `./chunks/${encodeChunkName(meta.name)}/components/${encodeChunkName(type)}/${encodeChunkName(name)}.json#`;
             result[type][name] = { '$ref': ref, $global: true };
         });
     });
@@ -179,10 +181,10 @@ export function externalizePathReferences(document, meta) {
         result[path] = {};
         const escapedPath = escapeJsonPointer(path);
         keyOf(pathItemRecord).forEach((type) => {
-            if (httpMethods.has(type)) {
+            if (isHttpMethod(type)) {
                 const ref = meta.mode === 'ssr'
                     ? `${meta.baseUrl}/${meta.name}/operations/${escapedPath}/${type}#`
-                    : `./chunks/${meta.name}/operations/${escapedPath}/${type}.json#`;
+                    : `./chunks/${encodeChunkName(meta.name)}/operations/${encodeChunkName(path)}/${type}.json#`;
                 result[path][type] = { '$ref': ref, $global: true };
             }
             else if (type !== '$ref' && type !== '$ref-value') {
@@ -256,6 +258,13 @@ export async function createServerWorkspaceStore(workspaceProps) {
      * for that document.
      */
     const assets = {};
+    /**
+     * Each document whole, for `getResolvedDocument`.
+     *
+     * Written at the same point as `workspace.documents`, after everything that can throw, so a failed
+     * add leaves neither map with a half-processed entry.
+     */
+    const resolvedDocuments = {};
     /**
      * Adds an AsyncAPI document to the workspace.
      *
@@ -304,6 +313,9 @@ export async function createServerWorkspaceStore(workspaceProps) {
         // checks OpenAPI first — so leaving `openapi` in place would hand an OpenAPI renderer a
         // navigation tree of channel entries. The document is stored as the type it was read as.
         delete workspace.documents[name]['openapi'];
+        // Nothing was externalized, so the stored document already is the whole document; it only needs
+        // its references resolving to be rendered from.
+        resolvedDocuments[name] = resolveLocalReferences(workspace.documents[name]);
     };
     /**
      * Adds a new document to the workspace.
@@ -362,6 +374,13 @@ export async function createServerWorkspaceStore(workspaceProps) {
             paths,
             [extensions.document.navigation]: navigation,
         };
+        // The same document without the externalization, for server rendering. A shallow spread, so the
+        // components and operations are the objects the chunks are written from rather than copies.
+        resolvedDocuments[meta.name] = resolveLocalReferences({
+            ...documentMeta,
+            ...documentV3,
+            [extensions.document.navigation]: navigation,
+        });
     };
     /**
      * Adds a new document to the workspace asynchronously.
@@ -415,32 +434,26 @@ export async function createServerWorkspaceStore(workspaceProps) {
             }
             // Write the workspace document
             const basePath = `${cwd()}/${workspaceProps.directory ?? DEFAULT_ASSETS_FOLDER}`;
-            await fs.mkdir(basePath, { recursive: true });
-            // Write the workspace contents on the file system
-            await fs.writeFile(`${basePath}/${WORKSPACE_FILE_NAME}`, JSON.stringify(workspace));
-            // Write the chunks
+            const writeChunk = await createChunkWriter(basePath);
+            await writeChunk([WORKSPACE_FILE_NAME], workspace);
             for (const [name, { components, operations }] of Object.entries(assets)) {
-                // Write the components chunks
                 if (components) {
                     for (const [type, component] of Object.entries(components)) {
-                        // Escape the component type and key the same way operation paths are escaped. Component
-                        // keys come from the OpenAPI document, so a key like `../../evil` would otherwise let a
-                        // document write chunk files outside the assets directory. escapeJsonPointer turns every
-                        // `/` into `~1`, collapsing the value into a single safe path segment.
-                        const componentPath = `${basePath}/chunks/${name}/components/${escapeJsonPointer(type)}`;
-                        await fs.mkdir(componentPath, { recursive: true });
                         for (const [key, value] of Object.entries(component)) {
-                            await fs.writeFile(`${componentPath}/${escapeJsonPointer(key)}.json`, JSON.stringify(value));
+                            await writeChunk(['chunks', encodeChunkName(name), 'components', encodeChunkName(type), `${encodeChunkName(key)}.json`], value);
                         }
                     }
                 }
-                // Write the operations chunks
                 if (operations) {
                     for (const [path, methods] of Object.entries(operations)) {
-                        const operationPath = `${basePath}/chunks/${name}/operations/${path}`;
-                        await fs.mkdir(operationPath, { recursive: true });
                         for (const [method, operation] of Object.entries(methods)) {
-                            await fs.writeFile(`${operationPath}/${method}.json`, JSON.stringify(operation));
+                            await writeChunk([
+                                'chunks',
+                                encodeChunkName(name),
+                                'operations',
+                                encodeChunkName(unescapeJsonPointer(path)),
+                                `${encodeChunkName(method)}.json`,
+                            ], operation);
                         }
                     }
                 }
@@ -449,6 +462,7 @@ export async function createServerWorkspaceStore(workspaceProps) {
         getWorkspace: () => {
             return workspace;
         },
+        getResolvedDocument: (name) => resolvedDocuments[name],
         get: (pointer) => {
             const pointerPath = (() => {
                 if (pointer.startsWith('#')) {

package/package.json

@@ -16,7 +16,7 @@
     "openapi",
     "scalar"
   ],
-  "version": "0.60.0",
+  "version": "0.62.0",
   "engines": {
     "node": ">=22"
   },
@@ -143,19 +143,19 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
+    "@scalar/asyncapi-upgrader": "0.1.10",
+    "@scalar/helpers": "0.12.0",
+    "@scalar/json-magic": "0.14.0",
+    "@scalar/openapi-upgrader": "0.2.17",
+    "@scalar/schemas": "0.10.0",
+    "@scalar/snippetz": "0.9.31",
     "@scalar/typebox": "0.1.3",
+    "@scalar/types": "0.20.0",
+    "@scalar/validation": "0.6.3",
     "js-base64": "^3.9.2",
     "type-fest": "^5.8.0",
     "vue": "^3.5.40",
-    "yaml": "^2.9.0",
-    "@scalar/asyncapi-upgrader": "0.1.9",
-    "@scalar/helpers": "0.11.3",
-    "@scalar/json-magic": "0.13.4",
-    "@scalar/openapi-upgrader": "0.2.15",
-    "@scalar/schemas": "0.9.0",
-    "@scalar/snippetz": "0.9.30",
-    "@scalar/validation": "0.6.3",
-    "@scalar/types": "0.19.0"
+    "yaml": "^2.9.0"
   },
   "devDependencies": {
     "@google-cloud/storage": "7.21.0",