@scalar/workspace-store 0.68.0 → 0.68.2

package/dist/request-example/builder/header/build-request-parameters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-request-parameters.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/header/build-request-parameters.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,qEAAqE,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAA;AAqBlH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;AACjC,qBAAqB;AACrB,aAAY,aAAa,CAAC,eAAe,CAAC,EAAO;AACjD,qCAAqC;AACrC,cAAa,MAAkB,KAC9B;IACD,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,SAAS,EAAE,eAAe,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CA8IvC,CAAA"}
+{"version":3,"file":"build-request-parameters.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/header/build-request-parameters.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,KAAK,aAAa,EAEnB,MAAM,qEAAqE,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAA;AAElH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAoB5E;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB;AACjC,qBAAqB;AACrB,aAAY,aAAa,CAAC,eAAe,CAAC,EAAO;AACjD,qCAAqC;AACrC,cAAa,MAAkB;AAC/B,6DAA6D;AAC7D,iBAAiB,MAAM,KACtB;IACD,OAAO,EAAE,aAAa,EAAE,CAAA;IACxB,0EAA0E;IAC1E,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACrC,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;IAC9D,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,SAAS,EAAE,eAAe,CAAA;IAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,wBAAwB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CA+JvC,CAAA"}

package/dist/request-example/builder/header/build-request-parameters.js

@@ -1,4 +1,5 @@
 import { isDefined } from '@scalar/helpers/array/is-defined';
+import { getCookieSerializationError } from '@scalar/helpers/http/get-cookie-serialization-error';
 import { isObject } from '@scalar/helpers/object/is-object';
 import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
 import { xScalarCookieSchema, } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies';
@@ -23,7 +24,9 @@ export const buildRequestParameters = (
 /** All parameters */
 parameters = [], 
 /** The key of the current example */
-exampleName = 'default') => {
+exampleName = 'default', 
+/** Reserved path expansion was introduced in OpenAPI 3.2. */
+openapiVersion) => {
     const result = {
         cookies: [],
         headers: {},
@@ -123,6 +126,15 @@ exampleName = 'default') => {
                 // Path parameters use simple style by default
                 const serialized = serializeSimpleStyle(deSerializedValue, getExplode(param, false));
                 result.pathVariables[paramName] = String(serialized);
+                if (openapiVersion?.startsWith('3.2.') && 'schema' in param && param.allowReserved === true) {
+                    ;
+                    (result.reservedPathParameters ??= {})[paramName] = {
+                        value: deSerializedValue,
+                        originalValue: String(serialized),
+                        style: param.style ?? 'simple',
+                        explode: getExplode(param, false),
+                    };
+                }
                 break;
             }
             case 'query': {
@@ -130,6 +142,15 @@ exampleName = 'default') => {
                 break;
             }
             case 'cookie': {
+                const [major, minor] = (openapiVersion ?? '').split('.');
+                const error = major === '3' && minor === '2' && !('content' in param)
+                    ? getCookieSerializationError(param, deSerializedValue)
+                    : undefined;
+                if (error) {
+                    ;
+                    (result.cookieErrors ??= []).push(error);
+                    break;
+                }
                 if ('style' in param && param.style === 'cookie') {
                     result.cookies.push(...serializeCookieStyle(paramName, deSerializedValue, getExplode(param, true)).map((cookie) => coerceValue(xScalarCookieSchema, { ...cookie, path: '/' })));
                     break;

package/dist/request-example/builder/helpers/get-example-from-schema.d.ts

@@ -7,6 +7,8 @@ export declare const selectExampleComposition: (schema: SchemaObject, schemaPath
 export type GetExampleFromSchemaOptions = {
     /** Internal provenance capture, excluded from persistent result caches. */
     [EXAMPLE_EVALUATION]?: ExampleEvaluationState;
+    /** Preserve binary filename examples as File objects for multipart serializers. */
+    binaryAsFile?: boolean;
     /** Fallback string for empty string values. */
     emptyString?: string;
     /** @deprecated Use getXmlExampleFromSchema for schema-aware XML serialization. */

package/dist/request-example/builder/helpers/get-example-from-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-example-from-schema.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/helpers/get-example-from-schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,YAAY,EAAqD,MAAM,uBAAuB,CAAA;AAG5G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAoZ9G,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,GACnC,QAAQ,YAAY,EACpB,YAAY,MAAM,EAAE,EACpB,UAAU,2BAA2B,EACrC,mBAAiB,EACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,YAAY,GAAG,SAmBjB,CAAA;AAuZD,sEAAsE;AACtE,MAAM,MAAM,2BAA2B,GAAG;IACxC,2EAA2E;IAC3E,CAAC,kBAAkB,CAAC,CAAC,EAAE,sBAAsB,CAAA;IAC7C,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kFAAkF;IAClF,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACvB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,qDAAqD;IACrD,8BAA8B,CAAC,EAAE,OAAO,CAAA;IACxC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,0DAA0D;IAC1D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9C,CAAA;AAuPD;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,yBAAyB,GAC7B,QAAQ,YAAY,EACpB,UAAU,2BAA2B,EACrC,iEAOG,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACrB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,qGAAqG;IACrG,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAM,KACN,OA8OF,CAAA;AAED,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,YAAY,EACpB,UAAU,2BAA2B,EACrC,UAAS,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAM,KAC5D,OA0BF,CAAA"}
+{"version":3,"file":"get-example-from-schema.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/helpers/get-example-from-schema.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,YAAY,EAAqD,MAAM,uBAAuB,CAAA;AAG5G,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wCAAwC,CAAA;AAE1E,OAAO,EAAE,kBAAkB,EAA0B,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAwZ9G,gGAAgG;AAChG,eAAO,MAAM,wBAAwB,GACnC,QAAQ,YAAY,EACpB,YAAY,MAAM,EAAE,EACpB,UAAU,2BAA2B,EACrC,mBAAiB,EACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,YAAY,GAAG,SAmBjB,CAAA;AAuZD,sEAAsE;AACtE,MAAM,MAAM,2BAA2B,GAAG;IACxC,2EAA2E;IAC3E,CAAC,kBAAkB,CAAC,CAAC,EAAE,sBAAsB,CAAA;IAC7C,mFAAmF;IACnF,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,+CAA+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,kFAAkF;IAClF,GAAG,CAAC,EAAE,OAAO,CAAA;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IACvB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,qDAAqD;IACrD,8BAA8B,CAAC,EAAE,OAAO,CAAA;IACxC;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,0DAA0D;IAC1D,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9C,CAAA;AAwPD;;;;;;;;;;;;;;GAcG;AACH,QAAA,MAAM,yBAAyB,GAC7B,QAAQ,YAAY,EACpB,UAAU,2BAA2B,EACrC,iEAOG,OAAO,CAAC;IACT,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,YAAY,CAAA;IAC1B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACrB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAA;IACpB,qGAAqG;IACrG,YAAY,EAAE,YAAY,CAAA;CAC3B,CAAM,KACN,OA8OF,CAAA;AAoBD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,GAC/B,QAAQ,YAAY,EACpB,UAAU,2BAA2B,EACrC,UAAS,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAM,KAC5D,OA2BF,CAAA"}

package/dist/request-example/builder/helpers/get-example-from-schema.js

@@ -63,10 +63,10 @@ const getPropertyNamesEnumValues = (schema) => {
 };
 /**
  * Generate example values for string types based on their format.
- * Special handling for binary format which returns a File object.
+ * Binary examples use filename placeholders unless the caller requests File objects.
  */
 const guessFromFormat = (schema, makeUpRandomData = false, fallback = '') => {
-    // Handle binary format specially - return a File object
+    // Binary filename placeholders are converted to File objects only for multipart callers.
     if ('type' in schema && schema.type === 'string' && 'format' in schema && schema.format === 'binary') {
         return '@filename';
     }
@@ -197,6 +197,10 @@ const mergeExamples = (baseValue, newValue) => {
     if (Array.isArray(baseValue) && Array.isArray(newValue)) {
         return [...baseValue, ...newValue];
     }
+    // Files are scalar payloads; spreading them would erase their filename and bytes.
+    if (baseValue instanceof File || newValue instanceof File) {
+        return newValue;
+    }
     if (baseValue && typeof baseValue === 'object' && newValue && typeof newValue === 'object') {
         return { ...baseValue, ...newValue };
     }
@@ -667,6 +671,7 @@ const getUnionPrimitiveValue = (schema, makeUpRandomData, emptyString) => {
 };
 /** Create stable cache key from the options object */
 const createOptionsCacheKey = (options) => JSON.stringify({
+    binaryAsFile: options?.binaryAsFile,
     emptyString: options?.emptyString,
     xml: options?.xml,
     mode: options?.mode,
@@ -1092,11 +1097,27 @@ const generateExampleFromSchema = (schema, options, { level = 0, parentSchema, n
     seen.delete(targetValue);
     return cache(_schema, null, cacheKey, skipCache);
 };
+/** Keep binary provenance for multipart callers without resolving schemas on the default data path. */
+const asBinaryFile = (schema, value, enabled = false) => {
+    if (!enabled || typeof value !== 'string' || !value.startsWith('@')) {
+        return value;
+    }
+    const resolved = resolve.schema(schema);
+    if (resolved &&
+        'type' in resolved &&
+        resolved.type === 'string' &&
+        'format' in resolved &&
+        resolved.format === 'binary') {
+        return new File([], value.slice(1), { lastModified: 0 });
+    }
+    return value;
+};
 /** Generate data, optionally retaining the exact schema decisions for another output format. */
 export const getExampleFromSchema = (schema, options, context = {}) => {
     const capture = options?.[EXAMPLE_EVALUATION];
     if (!capture) {
-        return generateExampleFromSchema(schema, options, context);
+        const value = generateExampleFromSchema(schema, options, context);
+        return asBinaryFile(schema, value, options?.binaryAsFile);
     }
     const node = {
         schema,
@@ -1115,7 +1136,7 @@ export const getExampleFromSchema = (schema, options, context = {}) => {
     }
     capture.stack.push(node);
     try {
-        node.value = generateExampleFromSchema(schema, options, context);
+        node.value = asBinaryFile(schema, generateExampleFromSchema(schema, options, context), options?.binaryAsFile);
         return node.value;
     }
     finally {

package/dist/request-example/builder/request-factory.d.ts

@@ -2,6 +2,7 @@ import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensi
 import type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { OperationObject } from '@scalar/workspace-store/schemas/v3.2/strict/operation';
+import type { ReservedPathParameter } from '../../helpers/encode-path-parameter.js';
 import { type QuerystringParameter } from '../../helpers/querystring-parameter.js';
 import { type BuildRequestSecurityResult } from '../../request-example/builder/security/build-request-security.js';
 import type { SecuritySchemeObjectSecret } from '../../request-example/builder/security/secret-types.js';
@@ -74,6 +75,8 @@ import { type RequestBody } from './body/build-request-body.js';
  * ```
  */
 export type RequestFactory = {
+    /** Invalid active cookie declarations, retained for previews and reported before sending. */
+    cookieErrors?: string[];
     /**
      * The base API server URL prior to environment or server variable substitution.
      * May still contain placeholders such as `{version}` or `{region}`.
@@ -94,6 +97,8 @@ export type RequestFactory = {
         variables: Record<string, string>;
         /** Names whose example is already URI-encoded. */
         serializedParameters?: Set<string>;
+        /** Schema-based values using OpenAPI 3.2 reserved expansion. */
+        reservedParameters?: Record<string, ReservedPathParameter>;
         /**
          * The raw request path string, as entered by the user or read from the OpenAPI schema.
          * Placeholders are not yet substituted.
@@ -198,7 +203,7 @@ export declare const requestFactory: ({ exampleName, globalCookies, method, oper
     /** The selected security schemes for the current operation */
     selectedSecuritySchemes: SecuritySchemeObjectSecret[];
     /** Selected anyOf/oneOf request-body variants keyed by schema path */
-    /** Originating OpenAPI version, used for XML mapping rules. */
+    /** Originating OpenAPI version, used for version-specific serialization. */
     openapiVersion?: string;
     requestBodyCompositionSelection?: Record<string, number>;
 }) => {

package/dist/request-example/builder/request-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-factory.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/request-factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qEAAqE,CAAA;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAA;AAE5F,OAAO,EAAE,KAAK,oBAAoB,EAA2B,MAAM,iCAAiC,CAAA;AAEpG,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,2DAA2D,CAAA;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAGjE,OAAO,EAAE,KAAK,WAAW,EAAoB,MAAM,2BAA2B,CAAA;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,IAAI,EAAE;QACJ;;;;;WAKG;QACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjC,kDAAkD;QAClD,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC;;;;;WAKG;QACH,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;IAED;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,KAAK,EAAE,eAAe,CAAA;IAEtB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B,oFAAoF;IACpF,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAElC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;;;OAIG;IACH,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IAExB;;;;OAIG;IACH,OAAO,EAAE,aAAa,EAAE,CAAA;IAExB;;;OAGG;IACH,KAAK,EAAE,YAAY,CAAA;IAEnB;;;;OAIG;IACH,QAAQ,EAAE,0BAA0B,EAAE,CAAA;IAEtC;;;OAGG;IACH,8BAA8B,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAE5C;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;QACf;;;WAGG;QACH,UAAU,EAAE,OAAO,CAAA;QACnB;;;WAGG;QACH,eAAe,EAAE,OAAO,CAAA;KACzB,CAAC,CAAA;CACH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,kLAa5B,kBAAkB,GAAG;IACtB,2BAA2B;IAC3B,SAAS,EAAE,eAAe,CAAA;IAC1B,8CAA8C;IAC9C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,mCAAmC;IACnC,aAAa,EAAE,aAAa,EAAE,CAAA;IAC9B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,wBAAwB;IACxB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAA;IACnB,8DAA8D;IAC9D,uBAAuB,EAAE,0BAA0B,EAAE,CAAA;IACrD,sEAAsE;IACtE,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,+BAA+B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzD,KAAG;IACF,OAAO,EAAE,cAAc,CAAA;CA4ExB,CAAA"}
+{"version":3,"file":"request-factory.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/request-factory.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qEAAqE,CAAA;AACxG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAChG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAA;AAE5F,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAA;AAC5E,OAAO,EAAE,KAAK,oBAAoB,EAA2B,MAAM,iCAAiC,CAAA;AAEpG,OAAO,EACL,KAAK,0BAA0B,EAEhC,MAAM,2DAA2D,CAAA;AAClE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAGjE,OAAO,EAAE,KAAK,WAAW,EAAoB,MAAM,2BAA2B,CAAA;AAG9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,6FAA6F;IAC7F,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;OAEG;IACH,IAAI,EAAE;QACJ;;;;;WAKG;QACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;QACjC,kDAAkD;QAClD,oBAAoB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;QAClC,gEAAgE;QAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,qBAAqB,CAAC,CAAA;QAC1D;;;;;WAKG;QACH,GAAG,EAAE,MAAM,CAAA;KACZ,CAAA;IAED;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAA;IAEd;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IAEjB;;;OAGG;IACH,KAAK,EAAE,eAAe,CAAA;IAEtB,wEAAwE;IACxE,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAE1B,oFAAoF;IACpF,WAAW,CAAC,EAAE,oBAAoB,CAAA;IAElC;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAA;IAEhB;;;;OAIG;IACH,IAAI,EAAE,WAAW,GAAG,IAAI,CAAA;IAExB;;;;OAIG;IACH,OAAO,EAAE,aAAa,EAAE,CAAA;IAExB;;;OAGG;IACH,KAAK,EAAE,YAAY,CAAA;IAEnB;;;;OAIG;IACH,QAAQ,EAAE,0BAA0B,EAAE,CAAA;IAEtC;;;OAGG;IACH,8BAA8B,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAE5C;;;OAGG;IACH,OAAO,EAAE,OAAO,CAAC;QACf;;;WAGG;QACH,UAAU,EAAE,OAAO,CAAA;QACnB;;;WAGG;QACH,eAAe,EAAE,OAAO,CAAA;KACzB,CAAC,CAAA;CACH,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,kLAa5B,kBAAkB,GAAG;IACtB,2BAA2B;IAC3B,SAAS,EAAE,eAAe,CAAA;IAC1B,8CAA8C;IAC9C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,mCAAmC;IACnC,aAAa,EAAE,aAAa,EAAE,CAAA;IAC9B,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAA;IAChB,wBAAwB;IACxB,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,qEAAqE;IACrE,UAAU,EAAE,OAAO,CAAA;IACnB,8DAA8D;IAC9D,uBAAuB,EAAE,0BAA0B,EAAE,CAAA;IACrD,sEAAsE;IACtE,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,+BAA+B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACzD,KAAG;IACF,OAAO,EAAE,cAAc,CAAA;CA8ExB,CAAA"}

package/dist/request-example/builder/request-factory.js

@@ -15,7 +15,7 @@ import { buildRequestParameters } from './header/build-request-parameters.js';
 export const requestFactory = ({ exampleName, globalCookies, method, operation, path, proxyUrl, server, defaultHeaders, isElectron, selectedSecuritySchemes, openapiVersion, requestBodyCompositionSelection, }) => {
     const requestBody = getResolvedRef(operation.requestBody);
     /** Build out the request parameters */
-    const params = buildRequestParameters(operation.parameters ?? [], exampleName);
+    const params = buildRequestParameters(operation.parameters ?? [], exampleName, openapiVersion);
     const querystringParameter = operation.parameters
         ?.map((parameter) => getResolvedRef(parameter))
         .find((parameter) => parameter?.in === 'querystring');
@@ -52,11 +52,13 @@ export const requestFactory = ({ exampleName, globalCookies, method, operation,
         headers.set('Pragma', 'no-cache');
     }
     const request = {
+        ...(params.cookieErrors ? { cookieErrors: params.cookieErrors } : {}),
         baseUrl,
         proxyUrl,
         path: {
             variables: params.pathVariables,
             ...(params.serializedPathParameters ? { serializedParameters: params.serializedPathParameters } : {}),
+            ...(params.reservedPathParameters ? { reservedParameters: params.reservedPathParameters } : {}),
             raw: path,
         },
         query: params.urlParams,

package/dist/request-example/builder/resolve-request-factory-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-factory-url.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/resolve-request-factory-url.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,8BAA8B,CAAA;AAMnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAA;AAE/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF,MAAM,MAAM,6BAA6B,GAAG,OAAO,2BAA2B,GAAG,OAAO,2BAA2B,CAAA;AAEnH,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAK1F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,cAAc,EACvB,SAAS;IACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;IACzE,mBAAmB,EAAE,eAAe,CAAA;IACpC;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACxC,KACA,8BAoEF,CAAA"}
+{"version":3,"file":"resolve-request-factory-url.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/resolve-request-factory-url.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,8BAA8B,CAAA;AAWnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAA;AAE/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF,MAAM,MAAM,6BAA6B,GAAG,OAAO,2BAA2B,GAAG,OAAO,2BAA2B,CAAA;AAEnH,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAK1F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,cAAc,EACvB,SAAS;IACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;IACzE,mBAAmB,EAAE,eAAe,CAAA;IACpC;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACxC,KACA,8BAuFF,CAAA"}

package/dist/request-example/builder/resolve-request-factory-url.js

@@ -3,6 +3,7 @@ import { err, ok } from '@scalar/helpers/types/result';
 import { safeRun } from '@scalar/helpers/types/safe-run';
 import { isRelativePath } from '@scalar/helpers/url/is-relative-path';
 import { mergeSearchParams, mergeUrls } from '@scalar/helpers/url/merge-urls';
+import { assertReservedPathUrl, encodePathParameter, serializeReservedPathParameter, } from '../../helpers/encode-path-parameter.js';
 import { serializeQuerystringParameter } from '../../helpers/querystring-parameter.js';
 /**
  * Discriminated error code when the merged request URL is not a complete absolute target
@@ -21,12 +22,21 @@ const INCOMPLETE_MERGED_URL_MESSAGE = 'No server URL is configured for this requ
  */
 export const resolveRequestFactoryUrl = (request, options) => {
     const variables = options.envVariables;
-    const pathVariablesEncoded = safeRun(() => Object.fromEntries(Object.entries(request.path.variables).map(([key, value]) => [
-        key,
-        request.path.serializedParameters?.has(key)
-            ? replaceEnvVariables(value, variables)
-            : encodeURIComponent(replaceEnvVariables(value, variables)),
-    ])));
+    const pathVariablesEncoded = safeRun(() => Object.fromEntries(Object.entries(request.path.variables).map(([key, value]) => {
+        const replace = (text) => replaceEnvVariables(text, variables);
+        const reserved = request.path.reservedParameters && Object.hasOwn(request.path.reservedParameters, key)
+            ? request.path.reservedParameters[key]
+            : undefined;
+        const encoded = request.path.serializedParameters?.has(key)
+            ? replace(value)
+            : reserved
+                ? serializeReservedPathParameter(key, {
+                    ...reserved,
+                    value: value === reserved.originalValue ? reserved.value : value,
+                }, replace)
+                : encodePathParameter(replace(value));
+        return [key, encoded];
+    })));
     if (!pathVariablesEncoded.ok) {
         return err(INVALID_REQUEST_FACTORY_URL, 'The request URL contains invalid characters in path parameters.');
     }
@@ -44,7 +54,12 @@ export const resolveRequestFactoryUrl = (request, options) => {
     const origin = globalThis.window?.location?.origin;
     const urlBase = origin && origin !== 'null' ? origin : 'http://localhost:3000';
     // Fallback for modal layout without a base server url (it should use the current origin)
-    const urlParsed = safeRun(() => new URL(mergedUrl, urlBase));
+    const urlParsed = safeRun(() => {
+        if (request.path.reservedParameters && Object.keys(request.path.reservedParameters).length) {
+            assertReservedPathUrl(mergedUrl);
+        }
+        return new URL(mergedUrl, urlBase);
+    });
     if (!urlParsed.ok) {
         return err(INVALID_REQUEST_FACTORY_URL, 'The request URL could not be parsed. Check the server URL and path for invalid characters.');
     }

package/dist/request-example/builder/security/secret-types.d.ts

@@ -2,7 +2,10 @@ import type { EncryptionSchemeType, SaslSchemeType } from '../../../request-exam
 import type { XScalarAuthUrl, XScalarCredentialsLocation, XScalarSecretClientCertificate, XScalarSecretClientId, XScalarSecretClientSecret, XScalarSecretHTTP, XScalarSecretPrivateKey, XScalarSecretRedirectUri, XScalarSecretRefreshToken, XScalarSecretServiceName, XScalarSecretToken, XScalarTokenUrl } from '../../../schemas/extensions/security/index.js';
 import type { OAuthFlowAuthorizationCode, OAuthFlowClientCredentials, OAuthFlowDeviceAuthorization, OAuthFlowImplicit, OAuthFlowPassword } from '../../../schemas/v3.2/strict/oauth-flow.js';
 import type { ApiKeyObject, HttpObject, MutualTlsObject, OAuth2Object, OpenIdConnectObject } from '../../../schemas/v3.2/strict/security-scheme.js';
-type OAuthFlowCommonSecret = XScalarSecretClientId & XScalarSecretToken & XScalarSecretRefreshToken & XScalarAuthUrl & XScalarTokenUrl;
+type OAuthFlowCommonSecret = XScalarSecretClientId & XScalarSecretToken & XScalarSecretRefreshToken & XScalarAuthUrl & XScalarTokenUrl & {
+    /** Explicit clears are carried to the auth UI to prevent default prefill after remount. */
+    'x-scalar-secret-cleared-fields'?: string[];
+};
 export type OAuthFlowImplicitSecret = OAuthFlowImplicit & OAuthFlowCommonSecret & XScalarSecretRedirectUri;
 export type OAuthFlowPasswordSecret = OAuthFlowPassword & OAuthFlowCommonSecret & XScalarSecretHTTP & XScalarSecretClientSecret & XScalarCredentialsLocation;
 export type OAuthFlowClientCredentialsSecret = OAuthFlowClientCredentials & OAuthFlowCommonSecret & XScalarSecretClientSecret & XScalarCredentialsLocation;

package/dist/request-example/builder/security/secret-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAE9C,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,CAAA;AAEjB,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,6FAA6F;AAC7F,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,GAC3E,qBAAqB,GACrB,yBAAyB,CAAA;AAE3B,MAAM,MAAM,sBAAsB,GAAG;IACnC,mBAAmB,CAAC,EAAE,kCAAkC,CAAA;IACxD,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,QAAQ,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;AACzF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAClF,wGAAwG;AACxG,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAA;AACnD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}
+{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAE9C,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,GAAG;IAChB,2FAA2F;IAC3F,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5C,CAAA;AAEH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,6FAA6F;AAC7F,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,GAC3E,qBAAqB,GACrB,yBAAyB,CAAA;AAE3B,MAAM,MAAM,sBAAsB,GAAG;IACnC,mBAAmB,CAAC,EAAE,kCAAkC,CAAA;IACxD,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,QAAQ,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;AACzF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAClF,wGAAwG;AACxG,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAA;AACnD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAEV,kBAAkB,EAClB,sBAAsB,EAUtB,gBAAgB,EAChB,0BAA0B,EAE3B,MAAM,iDAAiD,CAAA;AAGxD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAEjF,KAAK,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrG,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,gBAAgB,GAAG;QACvB,IAAI,EAAE,CAAC,CAAA;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf;CACF,CAAC,gBAAgB,CAAC,CAAA;AAmNnB,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,kBAAkB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BA6HF,CAAA"}
+{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAE/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAEV,kBAAkB,EAClB,sBAAsB,EAUtB,gBAAgB,EAChB,0BAA0B,EAE3B,MAAM,iDAAiD,CAAA;AAGxD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAEjF,KAAK,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrG,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,gBAAgB,GAAG;QACvB,IAAI,EAAE,CAAC,CAAA;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf;CACF,CAAC,gBAAgB,CAAC,CAAA;AAyNnB,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,kBAAkB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BAqHF,CAAA"}

package/dist/request-example/context/security/extract-security-scheme-secrets.js

@@ -1,5 +1,6 @@
 import { isObject } from '@scalar/helpers/object/is-object';
 import { objectEntries } from '@scalar/helpers/object/object-entries';
+import { isSecretFieldCleared } from '@scalar/workspace-store/helpers/auth-secret-fields';
 /**
  * Maps x-scalar-secret fields to their corresponding input field names.
  * This allows us to fall back to config values when auth store secrets are not available.
@@ -14,24 +15,30 @@ const SECRET_TO_INPUT_FIELD_MAP = {
     'x-scalar-secret-auth-url': 'authorizationUrl',
     'x-scalar-secret-token-url': 'tokenUrl',
 };
-const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}, oauth2RedirectUri) => Object.fromEntries(properties.map((property) => {
-    // Redirect URI is the only OAuth secret where an explicit empty value from
-    // store must be preserved. Other secrets use falsy fallback behavior for backwards-compatibility
-    // with config defaults when the casted auth store value is an empty string.
-    const authStoreValue = typeof authStoreSecrets[property] === 'string' ? authStoreSecrets[property] : undefined;
-    const configValue = typeof configSecrets[property] === 'string' ? configSecrets[property] : undefined;
-    const configInputValue = typeof configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]] === 'string'
-        ? configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]]
-        : undefined;
-    // oauth2RedirectUri (top-level config option) is used as a global fallback for the redirect URI,
-    // applied only when neither the auth store nor per-scheme config have a value. This ensures
-    // the configured redirect URI persists when switching between documents with the same OAuth config,
-    // because each document starts with no stored redirect URI (authStoreValue === undefined).
-    const value = property === 'x-scalar-secret-redirect-uri'
-        ? (authStoreValue ?? configValue ?? configInputValue ?? oauth2RedirectUri ?? '')
-        : authStoreValue || configValue || configInputValue || '';
-    return [property, value];
-}));
+const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}, oauth2RedirectUri) => {
+    const clearedFields = properties.filter((property) => isSecretFieldCleared(authStoreSecrets, property));
+    const values = Object.fromEntries(properties.map((property) => {
+        // Preserve explicit clears, while legacy schema-filled empties still inherit defaults.
+        const authStoreValue = typeof authStoreSecrets[property] === 'string' ? authStoreSecrets[property] : undefined;
+        const configValue = typeof configSecrets[property] === 'string' ? configSecrets[property] : undefined;
+        const configInputValue = typeof configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]] === 'string'
+            ? configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]]
+            : undefined;
+        // oauth2RedirectUri (top-level config option) is used as a global fallback for the redirect URI,
+        // applied only when neither the auth store nor per-scheme config have a value. This ensures
+        // the configured redirect URI persists when switching between documents with the same OAuth config,
+        // because each document starts with no stored redirect URI (authStoreValue === undefined).
+        const value = property === 'x-scalar-secret-redirect-uri' || isSecretFieldCleared(authStoreSecrets, property)
+            ? (authStoreValue ?? configValue ?? configInputValue ?? oauth2RedirectUri ?? '')
+            : authStoreValue || configValue || configInputValue || '';
+        return [property, value];
+    }));
+    return { ...values, ...(clearedFields.length ? { 'x-scalar-secret-cleared-fields': clearedFields } : {}) };
+};
+const storedSecret = (secrets, field) => {
+    const value = secrets && Reflect.get(secrets, field);
+    return typeof value === 'string' && (value || isSecretFieldCleared(secrets ?? {}, field)) ? value : undefined;
+};
 /** Secret extensions are not part of the strict scheme types, so they are read the same way the OAuth flows read theirs */
 const documentSecret = (scheme, property) => {
     const value = property in scheme ? Reflect.get(scheme, property) : undefined;
@@ -151,10 +158,8 @@ scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
         const storeSecrets = secrets?.type === 'apiKey' ? secrets : undefined;
         return {
             ...scheme,
-            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] ||
-                documentSecret(scheme, 'x-scalar-secret-token') ||
-                scheme.value ||
-                '',
+            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ??
+                (documentSecret(scheme, 'x-scalar-secret-token') || scheme.value || ''),
         };
     }
     // Handle HTTP Auth security schemes (e.g., Basic, Bearer)
@@ -162,18 +167,12 @@ scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
         const storeSecrets = secrets?.type === 'http' ? secrets : undefined;
         return {
             ...scheme,
-            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] ||
-                documentSecret(scheme, 'x-scalar-secret-token') ||
-                scheme.token ||
-                '',
-            'x-scalar-secret-username': storeSecrets?.['x-scalar-secret-username'] ||
-                documentSecret(scheme, 'x-scalar-secret-username') ||
-                scheme.username ||
-                '',
-            'x-scalar-secret-password': storeSecrets?.['x-scalar-secret-password'] ||
-                documentSecret(scheme, 'x-scalar-secret-password') ||
-                scheme.password ||
-                '',
+            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ??
+                (documentSecret(scheme, 'x-scalar-secret-token') || scheme.token || ''),
+            'x-scalar-secret-username': storedSecret(storeSecrets, 'x-scalar-secret-username') ??
+                (documentSecret(scheme, 'x-scalar-secret-username') || scheme.username || ''),
+            'x-scalar-secret-password': storedSecret(storeSecrets, 'x-scalar-secret-password') ??
+                (documentSecret(scheme, 'x-scalar-secret-password') || scheme.password || ''),
         };
     }
     // Handle OAuth2 security schemes and all supported flows

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAK5E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,wCAAwC,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAG1F,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,KAAK,0BAA0B,GAAG;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC1D,KAAK,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC5D,KAAK,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAEnF,KAAK,sBAAsB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;AAE1D,KAAK,8BAA8B,GAAG;IACpC,SAAS,EAAE,sBAAsB,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AACD,KAAK,+BAA+B,GAChC,CAAC;IACC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,8BAA8B,CAAC,GACnC,CAAC;IACC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,KAAK,CAAA;CACZ,GAAG,8BAA8B,CAAC,CAAA;AA0DvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CA0BzG;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAUjD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAuBpE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBAsD3G;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAuCxD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,EAAE,MAAM,eAAe,CAAA;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;CACxF,CAAA;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CAgb/B"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAK5E,OAAO,EAGL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,WAAW,EACjB,MAAM,wCAAwC,CAAA;AAE/C,OAAO,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAG1F,eAAO,MAAM,mBAAmB,0BAA0B,CAAA;AAE1D,KAAK,0BAA0B,GAAG;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,qBAAqB,CAAA;CAC7B,CAAA;AAED,KAAK,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC1D,KAAK,OAAO,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAC5D,KAAK,SAAS,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,0BAA0B,CAAA;AAEnF,KAAK,sBAAsB,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAA;AAE1D,KAAK,8BAA8B,GAAG;IACpC,SAAS,EAAE,sBAAsB,EAAE,CAAA;IACnC,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;;;;;;;;;;;;OAgBG;IACH,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB,CAAA;AACD,KAAK,+BAA+B,GAChC,CAAC;IACC,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;CACf,GAAG,8BAA8B,CAAC,GACnC,CAAC;IACC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,KAAK,CAAA;CACZ,GAAG,8BAA8B,CAAC,CAAA;AA+DvC;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CA0BzG;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAUjD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACzG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAuBpE;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,eAAe,EACzB,IAAI,EAAE;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,uBAsD3G;AAED,KAAK,eAAe,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;AAuCxD;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,WAAW,EAAE,CAAC,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACpG;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,uBAAuB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC5C;;;;;;;;;;;;;;;;;OAiBG;IACH,YAAY,EAAE,MAAM,eAAe,CAAA;IACnC;;;;;;;;;;;;;;;;;OAiBG;IACH,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAA;IACjC;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,eAAe,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,GAAG,SAAS,CAAA;CACxF,CAAA;AAED;;GAEG;AACH,wBAAsB,0BAA0B,CAC9C,cAAc,EAAE,+BAA+B,GAC9C,OAAO,CAAC,oBAAoB,CAAC,CAwc/B"}

package/dist/server.js

@@ -5,7 +5,7 @@ import { isHttpMethod } from '@scalar/helpers/http/is-http-method';
 import { parseJsonPointerSegments } from '@scalar/helpers/json/parse-json-pointer-segments';
 import { getValueAtPath } from '@scalar/helpers/object/get-value-at-path';
 import { preventPollution } from '@scalar/helpers/object/prevent-pollution';
-import { extensions as bundleExtensions } from '@scalar/json-magic/bundle';
+import { bundle, extensions as bundleExtensions } from '@scalar/json-magic/bundle';
 import { fetchUrls, readFiles } from '@scalar/json-magic/bundle/plugins/node';
 import { escapeJsonPointer } from '@scalar/json-magic/helpers/escape-json-pointer';
 import { unescapeJsonPointer } from '@scalar/json-magic/helpers/unescape-json-pointer';
@@ -14,7 +14,7 @@ import { upgrade } from '@scalar/openapi-upgrader';
 import { asyncApiObjectSchema } from '@scalar/schemas/asyncapi/3.1';
 import { coerce } from '@scalar/validation';
 import { asyncApiChunkGroups } from './helpers/asyncapi-chunk-groups.js';
-import { CHUNK_INDEX_KEY, buildChunkIndex, chunkRefTemplates, chunkReference, fillChunkRef, navigationHeader, } from './helpers/chunk-index.js';
+import { CHUNK_INDEX_KEY, buildChunkIndex, chunkRefTemplates, chunkReference, encodeSsrComponentName, fillChunkRef, navigationHeader, } from './helpers/chunk-index.js';
 import { createChunkWriter } from './helpers/create-chunk-writer.js';
 import { deepClone } from './helpers/deep-clone.js';
 import { encodeChunkName } from './helpers/encode-chunk-name.js';
@@ -23,8 +23,9 @@ import { keyOf } from './helpers/general.js';
 import { getResolvedRef } from './helpers/get-resolved-ref.js';
 import { mergeObjects } from './helpers/merge-object.js';
 import { normalizeBooleanSchemas } from './helpers/normalize-boolean-schemas.js';
+import { resolveSecurityRequirements } from './helpers/resolve-security-requirements.js';
 import { createNavigation, traverseAsyncApiDocument } from './navigation/index.js';
-import { resolveOpenApiDocument } from './plugins/bundler/openapi-document.js';
+import { openApiDocument, resolveOpenApiDocument } from './plugins/bundler/openapi-document.js';
 import { extensions } from './schemas/extensions.js';
 import { isAsyncApiDocument } from './schemas/type-guards.js';
 import { coerceValue } from './schemas/typebox-coerce.js';
@@ -62,7 +63,12 @@ const resolveLocalReferences = (document) => createMagicProxy(document, {
  * because the generated chunks keep their `#/x-ext/…` pointers and the client resolves those against
  * the document root. Only the client's export path (`purgeInternalDocumentKeys`) strips them.
  */
-const BUNDLED_EXTERNAL_KEYS = [bundleExtensions.externalDocuments, bundleExtensions.externalDocumentsMappings];
+const BUNDLED_EXTERNAL_KEYS = [
+    bundleExtensions.externalDocuments,
+    bundleExtensions.externalDocumentsMappings,
+    'x-scalar-security-uri-aliases',
+    'x-scalar-original-security-keys',
+];
 /**
  * Copies the buckets bundling parks external documents in onto the coerced document.
  *
@@ -157,7 +163,7 @@ export function externalizeComponentReferences(document, meta) {
         type,
         Object.fromEntries(Object.keys(component).map((name) => {
             const ref = meta.mode === 'ssr'
-                ? `${meta.baseUrl}/${meta.name}/components/${type}/${name}#`
+                ? `${meta.baseUrl}/${meta.name}/components/${type}/${encodeSsrComponentName(name)}#`
                 : `./chunks/${encodeChunkName(meta.name)}/components/${encodeChunkName(type)}/${encodeChunkName(name)}.json#`;
             return [name, { '$ref': ref, $global: true }];
         })),
@@ -502,7 +508,17 @@ export async function createServerWorkspaceStore(workspaceProps) {
                 console.warn(`Failed to load document "${input.name}"`);
                 return;
             }
-            addDocumentSync(document.data, { name: input.name, ...input.meta }, navigationOptions);
+            const loaded = document.data;
+            const isThreeTwo = typeof loaded.openapi === 'string' && /^3\.2\.\d+$/.test(loaded.openapi);
+            // URI resolution adds working aliases; keep the caller's authored object unchanged.
+            const data = isThreeTwo ? JSON.parse(document.raw) : loaded;
+            const origin = 'url' in input ? input.url : 'path' in input ? input.path : undefined;
+            const loaders = [fetchUrls(), readFiles()];
+            if (isThreeTwo) {
+                await bundle(data, { origin, treeShake: false, urlMap: true, plugins: [openApiDocument(), ...loaders] });
+                await resolveSecurityRequirements(data, { origin, loaders });
+            }
+            addDocumentSync(data, { name: input.name, ...input.meta }, navigationOptions);
         }
         catch (error) {
             // Honours the contract above: a document that cannot be processed is skipped rather than
@@ -592,7 +608,18 @@ export async function createServerWorkspaceStore(workspaceProps) {
             const segments = pointerPath.split('/').slice(1);
             const path = segments[1] === 'asyncapi'
                 ? segments.map((segment) => escapeJsonPointer(decodeURIComponent(segment).replaceAll('~1', '/').replaceAll('~0', '~')))
-                : parseJsonPointerSegments(pointerPath).map(escapeJsonPointer);
+                : parseJsonPointerSegments(segments[1] === 'components' && !pointer.startsWith('#')
+                    ? `/${segments
+                        .map((segment) => {
+                        try {
+                            return decodeURIComponent(segment);
+                        }
+                        catch {
+                            return segment;
+                        }
+                    })
+                        .join('/')}`
+                    : pointerPath).map((segment, index) => segments[1] === 'components' && index >= 3 ? segment : escapeJsonPointer(segment));
             return getValueAtPath(assets, path);
         },
         addDocument,

package/package.json

@@ -16,7 +16,7 @@
     "openapi",
     "scalar"
   ],
-  "version": "0.68.0",
+  "version": "0.68.2",
   "engines": {
     "node": ">=22"
   },
@@ -153,14 +153,14 @@
     "CHANGELOG.md"
   ],
   "dependencies": {
-    "@scalar/asyncapi-upgrader": "0.1.14",
-    "@scalar/helpers": "0.16.0",
-    "@scalar/json-magic": "0.15.4",
-    "@scalar/openapi-upgrader": "0.4.1",
-    "@scalar/schemas": "0.12.3",
-    "@scalar/snippetz": "0.10.5",
+    "@scalar/asyncapi-upgrader": "0.1.16",
+    "@scalar/helpers": "0.16.2",
+    "@scalar/json-magic": "0.15.6",
+    "@scalar/openapi-upgrader": "0.4.3",
+    "@scalar/schemas": "0.13.1",
+    "@scalar/snippetz": "0.10.7",
     "@scalar/typebox": "0.1.3",
-    "@scalar/types": "0.22.4",
+    "@scalar/types": "0.23.1",
     "@scalar/validation": "0.6.6",
     "js-base64": "^3.9.2",
     "type-fest": "^5.8.0",