@scalar/workspace-store 0.68.2 → 0.68.4

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # @scalar/workspace-store
 
+## 0.68.4
+
+### Patch Changes
+
+- [#10530](https://github.com/scalar/scalar/pull/10530): Render AsyncAPI external documentation on servers, channels, operations, messages, tags, and schemas, with referenced objects and descriptions, using the existing OpenAPI link presentation.
+
+  Keep AsyncAPI messages searchable when navigation renders them beneath operations.
+
+- [#10599](https://github.com/scalar/scalar/pull/10599): Preserve recursive schemas when generating request bodies, code samples, and response examples instead of replacing recursion points with null or empty arrays.
+- [#10607](https://github.com/scalar/scalar/pull/10607): Block private-network document requests by default and require an explicit documentLoading.basePath for local files. Apply the same permissions to external references, with an opt-in for trusted private-network inputs.
+- [#10365](https://github.com/scalar/scalar/pull/10365): Preserve document-backed API key name edits for export, allow clearing configured names, and release configured overrides when their default name is restored.
+- [#10588](https://github.com/scalar/scalar/pull/10588): Ignore sibling properties on AsyncAPI Reference Objects when rendering content, navigation, search, and schemas.
+- [#10614](https://github.com/scalar/scalar/pull/10614): Clean up lint warnings while preserving runtime behavior, and document intentional schema and type syntax.
+- [#10638](https://github.com/scalar/scalar/pull/10638): Give the untagged webhooks sidebar section the id `{document}/webhooks` instead of `{document}/webhook/undefined/`.
+
+## 0.68.3
+
+### Patch Changes
+
+- [#10554](https://github.com/scalar/scalar/pull/10554): Render AsyncAPI boolean schemas with explanations in message payloads, headers, and reusable models.
+- [#10551](https://github.com/scalar/scalar/pull/10551): Show **Reset to default** on authentication fields only when the field has a default that differs from its current value (the document or configured value, or the current page URL for the OAuth2 redirect URL). A cleared OAuth2 access token keeps the action so you can get back to the Authorize form. The show password toggle only appears once a field has a value, and an emptied field goes back to masked.
+- [#10527](https://github.com/scalar/scalar/pull/10527): Document every visible AsyncAPI channel message in a channel catalog while preserving operation-specific message subsets, links, and server/protocol filtering.
+- [#10565](https://github.com/scalar/scalar/pull/10565): Inherit AsyncAPI operation metadata and replies from traits using recursive merge rules, and use inherited titles in navigation.
+- [#10559](https://github.com/scalar/scalar/pull/10559): Clean up Biome warnings in package code and tests. Handle rejected debounced callbacks and await streaming writes.
+- [#10544](https://github.com/scalar/scalar/pull/10544): Match cookie paths with the RFC 6265 path-match algorithm so a cookie restricted to `/api` is not sent with requests to `/apiv2`.
+- [#10505](https://github.com/scalar/scalar/pull/10505): Apply formatting and lint compatibility changes for Biome 2.5.15.
+- [#10555](https://github.com/scalar/scalar/pull/10555): Keep expanded query parameter checkboxes independent and preserve disabled field values while excluding them from requests.
+- [#10529](https://github.com/scalar/scalar/pull/10529): Align import and export ordering with the Biome checks.
+- [#10524](https://github.com/scalar/scalar/pull/10524): Keep optional enum parameters disabled until explicitly enabled when no default or example is declared. Prefer declared schema examples over enum suggestions.
+- [#10562](https://github.com/scalar/scalar/pull/10562): Resolve escaped channel and message identifiers in AsyncAPI navigation.
+- [#10520](https://github.com/scalar/scalar/pull/10520): Sort imports and exports to satisfy the Biome checks.
+- [#10566](https://github.com/scalar/scalar/pull/10566): Render inline AsyncAPI security schemes and scopes, keeping server authentication separate from operation security.
+- [#10528](https://github.com/scalar/scalar/pull/10528): Render AsyncAPI channels and their messages when no operations reference them, including server and protocol filtering.
+- [#10561](https://github.com/scalar/scalar/pull/10561): Clarify AsyncAPI operation and message sections, align message card spacing, and keep schema controls inside lighter expanded cards.
+
+  Show channel messages only when they are not used by an operation, and keep the sidebar in sync.
+
+- [#10526](https://github.com/scalar/scalar/pull/10526): Align import and export ordering with the repository CI checks.
+
 ## 0.68.2
 
 ### Patch Changes

package/README.md

@@ -19,6 +19,26 @@ Scalar is an open-source API platform for teams who want beautiful developer int
 
 Server side data store which enables document chunking to reduce initial loading time specially when working with large openapi documents
 
+### Document loading permissions
+
+Server document URLs and external references block private, loopback, and link-local addresses
+by default. Protected requests also reject redirects. File access requires an explicit
+`documentLoading.basePath`, which confines both direct reads and external references, including
+symlinks, to an approved directory. These permissions apply to initial documents and `addDocument`.
+
+```ts
+const store = await createServerWorkspaceStore({
+  mode: 'ssr',
+  baseUrl: '/docs',
+  documents: [{ name: 'api', path: './descriptions/openapi.yaml' }],
+  documentLoading: { basePath: './descriptions' },
+})
+```
+
+For trusted local development inputs, `documentLoading.allowPrivateNetworks: true` permits private
+network URLs and redirects. Configure these permissions in the application, never from untrusted
+request parameters. The approved directory also applies to references in remote documents.
+
 #### Usage
 
 Create a new store in SSR mode

package/dist/channel-example/build-connection-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-connection-url.d.ts","sourceRoot":"","sources":["../../src/channel-example/build-connection-url.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AAInC,2FAA2F;AAC3F,eAAO,MAAM,4BAA4B,wBAAyB,CAAA;AAElE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAA;AAErF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,qBAAqB,CAAA;IAC9B,SAAS,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;CACjF,CAAA;AAQD;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,QAAQ,oBAAoB,GAAG,IAAI,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYrG,CAAA;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAGzE,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,GAAI,UAAU,MAAM,KAAG,MAAuC,CAAA;AAEnG,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,KAAG,QAAQ,IAAI,yBACsB,CAAA;AAEzF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GACrC,QAAQ,oBAAoB,EAC5B,uBAAuB,uBAAuB,CAAC,sBAAsB,CAAC,KACrE,MAYF,CAAA;AAaD,0FAA0F;AAC1F,eAAO,MAAM,eAAe,GAC1B,SAAS,qBAAqB,EAC9B,YAAY,uBAAuB,GAAG,IAAI,KACzC,uBAAuB,GAAG,SAa5B,CAAA;AA0FD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,uBAAuB,GAAG,SAAS,EAC9C,kBAAkB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACvC,eAoBF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,wFAOhC,uBAAuB,KAAG,MAkB5B,CAAA"}
+{"version":3,"file":"build-connection-url.d.ts","sourceRoot":"","sources":["../../src/channel-example/build-connection-url.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AAInC,2FAA2F;AAC3F,eAAO,MAAM,4BAA4B,wBAAyB,CAAA;AAElE,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAA;AAErF,MAAM,MAAM,uBAAuB,GAAG;IACpC,MAAM,EAAE,oBAAoB,CAAA;IAC5B,OAAO,EAAE,qBAAqB,CAAA;IAC9B,SAAS,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAA;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxC,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;CACjF,CAAA;AAQD;;GAEG;AACH,eAAO,MAAM,0BAA0B,GAAI,QAAQ,oBAAoB,GAAG,IAAI,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAYrG,CAAA;AAoBD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAGzE,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,wBAAwB,GAAI,UAAU,MAAM,KAAG,MAAuC,CAAA;AAEnG,eAAO,MAAM,mBAAmB,GAAI,UAAU,MAAM,KAAG,QAAQ,IAAI,yBACsB,CAAA;AAEzF;;GAEG;AACH,eAAO,MAAM,0BAA0B,GACrC,QAAQ,oBAAoB,EAC5B,uBAAuB,uBAAuB,CAAC,sBAAsB,CAAC,KACrE,MAYF,CAAA;AAaD,0FAA0F;AAC1F,eAAO,MAAM,eAAe,GAC1B,SAAS,qBAAqB,EAC9B,YAAY,uBAAuB,GAAG,IAAI,KACzC,uBAAuB,GAAG,SAa5B,CAAA;AA2FD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,uBAAuB,GAAG,SAAS,EAC9C,kBAAkB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KACvC,eAoBF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,GAAI,wFAOhC,uBAAuB,KAAG,MAkB5B,CAAA"}

package/dist/channel-example/build-connection-url.js

@@ -2,7 +2,7 @@ import { isObject } from '@scalar/helpers/object/is-object';
 import { objectEntries } from '@scalar/helpers/object/object-entries';
 import { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables';
 import { combineUrlAndPath, mergeUrls } from '@scalar/helpers/url/merge-urls';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 /** AsyncAPI server protocols supported for WebSocket connections in the API client MVP. */
 export const ASYNCAPI_WEBSOCKET_PROTOCOLS = ['ws', 'wss'];
 /**
@@ -13,7 +13,7 @@ export const getAsyncApiServerVariables = (server) => {
         return {};
     }
     return objectEntries(server.variables).reduce((acc, [name, variable]) => {
-        const resolved = getResolvedRef(variable);
+        const resolved = getResolvedAsyncApiRef(variable);
         if (resolved?.default != null) {
             acc[String(name)] = String(resolved.default);
         }
@@ -64,7 +64,7 @@ const resolveWsBinding = (bindings) => {
     if (!bindings) {
         return undefined;
     }
-    const resolved = getResolvedRef(bindings);
+    const resolved = getResolvedAsyncApiRef(bindings);
     return resolved?.ws;
 };
 /** Merges channel and operation WebSocket bindings; operation fields override channel. */
@@ -84,7 +84,7 @@ const resolveWsQuerySchema = (query) => {
     if (!query) {
         return undefined;
     }
-    const resolved = getResolvedRef(query);
+    const resolved = getResolvedAsyncApiRef(query);
     if (resolved === true || resolved === false || !isObject(resolved)) {
         return undefined;
     }
@@ -115,7 +115,8 @@ const mergeWsQuerySchemas = (channelQuery, operationQuery) => {
         },
     });
 };
-const getDefaultValueFromPropertySchema = (propertySchema) => {
+const getDefaultValueFromPropertySchema = (source) => {
+    const propertySchema = getResolvedAsyncApiRef(source);
     if (propertySchema === true || propertySchema === false || !isObject(propertySchema)) {
         return undefined;
     }

package/dist/channel-example/get-all-channel-messages.js

@@ -1,5 +1,5 @@
 import { objectEntries } from '@scalar/helpers/object/object-entries';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 /**
  * Resolves every message defined on a channel (AsyncAPI data store for payloads).
  */
@@ -9,7 +9,7 @@ export const getAllChannelMessages = (_document, channel) => {
     }
     return objectEntries(channel.messages)
         .map(([name, messageRef]) => {
-        const message = getResolvedRef(messageRef);
+        const message = getResolvedAsyncApiRef(messageRef);
         return { name, message };
     })
         .filter((entry) => entry.message != null);

package/dist/channel-example/get-async-api-protocols.d.ts

@@ -1,4 +1,4 @@
-import type { AsyncApiDocument, AsyncApiOperationObject } from '@scalar/types/asyncapi/3.1';
+import type { AsyncApiChannelObject, AsyncApiDocument, AsyncApiOperationObject } from '@scalar/types/asyncapi/3.1';
 /** Sentinel used by the protocol and server pickers to mean "don't filter". */
 export declare const ALL: "all";
 /** A single protocol option for the picker (e.g. `{ id: 'mqtt', label: 'MQTT' }`). */
@@ -61,6 +61,8 @@ export type OperationReachability = {
  * one is created when called standalone.
  */
 export declare const getOperationReachability: (document: AsyncApiDocument, operation: AsyncApiOperationObject, context?: AsyncApiReachabilityContext) => OperationReachability;
+/** Returns the servers and protocols available to a channel without requiring an operation. */
+export declare const getChannelReachability: (document: AsyncApiDocument, channel: AsyncApiChannelObject | null, context?: AsyncApiReachabilityContext) => OperationReachability;
 /**
  * Returns the set of protocols an operation is reachable over.
  */

package/dist/channel-example/get-async-api-protocols.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-async-api-protocols.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-async-api-protocols.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAQ3F,+EAA+E;AAC/E,eAAO,MAAM,GAAG,EAAG,KAAc,CAAA;AAEjC,sFAAsF;AACtF,MAAM,MAAM,sBAAsB,GAAG;IACnC,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAmBD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,gBAAgB,KAAG,sBAAsB,EAQvF,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAA;IACV,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GAAI,UAAU,gBAAgB,KAAG,oBAAoB,EAOzF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,uEAAuE;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,kDAAkD;IAClD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC5B,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,GAAI,UAAU,gBAAgB,KAAG,2BAGrE,CAAA;AAEF,0FAA0F;AAC1F,MAAM,MAAM,qBAAqB,GAAG;IAClC,mEAAmE;IACnE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACvB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAS,2BAAiE,KACzE,qBAiBF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,2BAA2B,KACpC,GAAG,CAAC,MAAM,CAAqE,CAAA;AAElF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAClC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,2BAA2B,KACpC,GAAG,CAAC,MAAM,CAAuE,CAAA;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,MAAM,GAAG,SAAS,EAC5B,UAAU,2BAA2B,KACpC,OAMF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,YAAY,MAAM,GAAG,SAAS,EAC9B,UAAU,2BAA2B,KACpC,OAMF,CAAA"}
+{"version":3,"file":"get-async-api-protocols.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-async-api-protocols.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAQlH,+EAA+E;AAC/E,eAAO,MAAM,GAAG,EAAG,KAAc,CAAA;AAEjC,sFAAsF;AACtF,MAAM,MAAM,sBAAsB,GAAG;IACnC,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAmBD;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,gBAAgB,KAAG,sBAAsB,EAQvF,CAAA;AAED,qGAAqG;AACrG,MAAM,MAAM,oBAAoB,GAAG;IACjC,uEAAuE;IACvE,EAAE,EAAE,MAAM,CAAA;IACV,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GAAI,UAAU,gBAAgB,KAAG,oBAAoB,EAOzF,CAAA;AAED;;;;;GAKG;AACH,MAAM,MAAM,2BAA2B,GAAG;IACxC,uEAAuE;IACvE,eAAe,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACpC,kDAAkD;IAClD,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAC5B,CAAA;AAED,0FAA0F;AAC1F,eAAO,MAAM,yBAAyB,GAAI,UAAU,gBAAgB,KAAG,2BAGrE,CAAA;AAEF,0FAA0F;AAC1F,MAAM,MAAM,qBAAqB,GAAG;IAClC,mEAAmE;IACnE,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IACxB,mCAAmC;IACnC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CACvB,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAS,2BAAiE,KACzE,qBAGF,CAAA;AAED,+FAA+F;AAC/F,eAAO,MAAM,sBAAsB,GACjC,UAAU,gBAAgB,EAC1B,SAAS,qBAAqB,GAAG,IAAI,EACrC,UAAS,2BAAiE,KACzE,qBAeF,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,qBAAqB,GAChC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,2BAA2B,KACpC,GAAG,CAAC,MAAM,CAAqE,CAAA;AAElF;;GAEG;AACH,eAAO,MAAM,uBAAuB,GAClC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,2BAA2B,KACpC,GAAG,CAAC,MAAM,CAAuE,CAAA;AAEpF;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,UAAU,MAAM,GAAG,SAAS,EAC5B,UAAU,2BAA2B,KACpC,OAMF,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GACjC,UAAU,gBAAgB,EAC1B,WAAW,uBAAuB,EAClC,YAAY,MAAM,GAAG,SAAS,EAC9B,UAAU,2BAA2B,KACpC,OAMF,CAAA"}

package/dist/channel-example/get-async-api-protocols.js

@@ -1,6 +1,6 @@
 import { objectEntries } from '@scalar/helpers/object/object-entries';
 import { objectKeys } from '@scalar/helpers/object/object-keys';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 import { normalizeProtocol } from './build-connection-url.js';
 import { resolveOperationChannel } from './resolve-operation-channel.js';
 import { getChannelServerNames } from './servers.js';
@@ -13,7 +13,7 @@ export const ALL = 'all';
 const getServerProtocols = (document) => {
     const protocols = new Map();
     for (const [name, serverNode] of objectEntries(document.servers ?? {})) {
-        const protocol = normalizeProtocol(getResolvedRef(serverNode)?.protocol);
+        const protocol = normalizeProtocol(getResolvedAsyncApiRef(serverNode)?.protocol);
         if (protocol) {
             protocols.set(name, protocol);
         }
@@ -43,7 +43,7 @@ export const getAsyncApiProtocols = (document) => {
  */
 export const getAsyncApiServerOptions = (document) => {
     const options = objectEntries(document.servers ?? {}).map(([name, serverNode]) => {
-        const protocol = normalizeProtocol(getResolvedRef(serverNode)?.protocol);
+        const protocol = normalizeProtocol(getResolvedAsyncApiRef(serverNode)?.protocol);
         return { id: name, label: protocol ? `${name} (${protocol})` : name };
     });
     return [{ id: ALL, label: 'All servers' }, ...options];
@@ -63,8 +63,12 @@ export const createReachabilityContext = (document) => ({
  */
 export const getOperationReachability = (document, operation, context = createReachabilityContext(document)) => {
     const channel = resolveOperationChannel(document, operation)?.channel ?? null;
-    const channelServerNames = getChannelServerNames(document, channel);
-    // A channel without declared servers is reachable on every server.
+    return getChannelReachability(document, channel, context);
+};
+/** Returns the servers and protocols available to a channel without requiring an operation. */
+export const getChannelReachability = (document, channel, context = createReachabilityContext(document)) => {
+    // AsyncAPI makes channels with absent or empty server lists available on every server.
+    const channelServerNames = channel?.servers?.length ? getChannelServerNames(document, channel) : undefined;
     const serverNames = channelServerNames
         ? new Set([...channelServerNames].filter((name) => context.allServerNames.has(name)))
         : new Set(context.allServerNames);

package/dist/channel-example/get-asyncapi-security-requirements.d.ts

@@ -1,9 +1,21 @@
-import type { AsyncApiDocument, AsyncApiOperationObject, AsyncApiServerObject } from '@scalar/types/asyncapi/3.1';
+import type { AsyncApiDocument, AsyncApiOperationObject, AsyncApiSecuritySchemeObject, AsyncApiServerObject } from '@scalar/types/asyncapi/3.1';
 import type { SecurityRequirementObject } from '../schemas/v3.2/strict/security-requirement.js';
+/**
+ * Collect inline definitions without changing the API description. Location-based names keep
+ * credentials for unrelated declarations separate, even when their definitions are identical.
+ * Component names remain unchanged for existing auth configuration and persisted credentials.
+ */
+export declare const getAsyncApiSecuritySchemes: (document: AsyncApiDocument, owners?: {
+    servers?: Record<string, AsyncApiServerObject>;
+    operations?: Record<string, AsyncApiOperationObject>;
+}) => Record<string, AsyncApiSecuritySchemeObject>;
 /**
  * Converts AsyncAPI security arrays (operation, traits, server) into OpenAPI-style requirement objects.
  */
-export declare const getAsyncApiSecurityRequirements: (document: AsyncApiDocument, operation?: AsyncApiOperationObject | null, server?: AsyncApiServerObject | null) => SecurityRequirementObject[];
+export declare const getAsyncApiSecurityRequirements: (document: AsyncApiDocument, operation?: AsyncApiOperationObject | null, server?: AsyncApiServerObject | null, locations?: {
+    operationName?: string;
+    serverName?: string;
+}) => SecurityRequirementObject[];
 /**
  * Document-wide security requirements for an AsyncAPI document.
  *

package/dist/channel-example/get-asyncapi-security-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-asyncapi-security-requirements.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-asyncapi-security-requirements.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AAInC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AA+E3F;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC1C,UAAU,gBAAgB,EAC1B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,SAAS,oBAAoB,GAAG,IAAI,KACnC,yBAAyB,EAY3B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GAAI,UAAU,gBAAgB,KAAG,yBAAyB,EAwB7G,CAAA"}
+{"version":3,"file":"get-asyncapi-security-requirements.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-asyncapi-security-requirements.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AAInC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAyB3F;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,GACrC,UAAU,gBAAgB,EAC1B,SAAQ;IACN,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAA;IAC9C,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;CAChD,KACL,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAsC7C,CAAA;AAwED;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC1C,UAAU,gBAAgB,EAC1B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,SAAS,oBAAoB,GAAG,IAAI,EACpC,YAAW;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO,KAC9D,yBAAyB,EAoC3B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GAAI,UAAU,gBAAgB,KAAG,yBAAyB,EA6B7G,CAAA"}

package/dist/channel-example/get-asyncapi-security-requirements.js

@@ -1,11 +1,12 @@
 import { isObjectEqual } from '@scalar/helpers/object/is-object-equal';
 import { getNameFromRef } from '../helpers/get-name-from-ref.js';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 import { dedupeRequirements } from './dedupe-requirements.js';
+import { resolveOperationWithTraits } from './resolve-operation-with-traits.js';
 const getSecuritySchemeNameFromRef = (ref) => getNameFromRef(ref, ['components', 'securitySchemes']);
 /** Strips requirement-only `scopes` so inline entries can match component scheme definitions. */
 const getSecuritySchemeDefinition = (entry) => {
-    const resolved = getResolvedRef(entry);
+    const resolved = getResolvedAsyncApiRef(entry);
     if (resolved == null) {
         return undefined;
     }
@@ -15,56 +16,109 @@ const getSecuritySchemeDefinition = (entry) => {
     const { scopes: _scopes, ...scheme } = resolved;
     return scheme;
 };
-const getSecuritySchemeName = (document, entry) => {
-    if ('$ref' in entry) {
-        const nameFromRef = getSecuritySchemeNameFromRef(entry.$ref);
-        if (nameFromRef) {
-            return nameFromRef;
+/**
+ * Collect inline definitions without changing the API description. Location-based names keep
+ * credentials for unrelated declarations separate, even when their definitions are identical.
+ * Component names remain unchanged for existing auth configuration and persisted credentials.
+ */
+export const getAsyncApiSecuritySchemes = (document, owners = {}) => {
+    const components = document.components ? getResolvedAsyncApiRef(document.components) : undefined;
+    const schemes = {};
+    for (const [name, reference] of Object.entries(components?.securitySchemes ?? {})) {
+        const scheme = getResolvedAsyncApiRef(reference);
+        if (scheme) {
+            schemes[name] = scheme;
         }
     }
-    const resolvedDefinition = getSecuritySchemeDefinition(entry);
-    if (resolvedDefinition == null) {
-        return undefined;
-    }
-    const components = document.components ? getResolvedRef(document.components) : undefined;
-    if (components?.securitySchemes) {
-        for (const [name, schemeRef] of Object.entries(components.securitySchemes)) {
-            const scheme = getResolvedRef(schemeRef);
-            if (scheme === resolvedDefinition || isObjectEqual(scheme, resolvedDefinition)) {
-                return name;
+    const register = (security, location) => {
+        for (const [index, entry] of (security ?? []).entries()) {
+            const scheme = getResolvedAsyncApiRef(entry);
+            if (!scheme || !('type' in scheme)) {
+                continue;
             }
+            const componentName = getComponentSecuritySchemeName(document, entry);
+            if (componentName !== undefined) {
+                continue;
+            }
+            schemes[getInlineSecuritySchemeName(document, scheme, location, index)] = scheme;
+        }
+    };
+    const servers = owners.servers ?? (document.servers ? getResolvedAsyncApiRef(document.servers) : undefined);
+    for (const [name, reference] of Object.entries(servers ?? {})) {
+        register(getResolvedAsyncApiRef(reference)?.security, `Server ${name}`);
+    }
+    const operations = owners.operations ?? (document.operations ? getResolvedAsyncApiRef(document.operations) : undefined);
+    for (const [name, reference] of Object.entries(operations ?? {})) {
+        const operation = getResolvedAsyncApiRef(reference);
+        if (operation) {
+            register(resolveOperationWithTraits(operation).security, `Operation ${name}`);
+        }
+    }
+    return schemes;
+};
+const getComponentSecuritySchemeName = (document, entry) => {
+    if ('$ref' in entry) {
+        const name = getSecuritySchemeNameFromRef(entry.$ref);
+        if (name !== undefined) {
+            return name;
         }
     }
-    return undefined;
+    const definition = getSecuritySchemeDefinition(entry);
+    if (!definition) {
+        return undefined;
+    }
+    const components = document.components ? getResolvedAsyncApiRef(document.components) : undefined;
+    return Object.entries(components?.securitySchemes ?? {}).find(([, scheme]) => isObjectEqual(getSecuritySchemeDefinition(scheme), definition))?.[0];
 };
-const securityEntryToRequirement = (document, entry) => {
-    const schemeName = getSecuritySchemeName(document, entry);
-    if (!schemeName) {
+/** Use declaration locations rather than object identity: traits can share the same object. */
+const getInlineSecuritySchemeName = (document, scheme, location, index) => {
+    const components = document.components ? getResolvedAsyncApiRef(document.components) : undefined;
+    const availableName = (name) => Object.hasOwn(components?.securitySchemes ?? {}, name) ? availableName(`${name} (inline)`) : name;
+    return availableName(`${location} · ${scheme.type} ${index + 1}`);
+};
+const securityEntryToRequirement = (document, entry, index, location, schemes) => {
+    const resolved = getResolvedAsyncApiRef(entry);
+    const schemeName = getComponentSecuritySchemeName(document, entry) ??
+        (resolved && 'type' in resolved && location !== undefined
+            ? getInlineSecuritySchemeName(document, resolved, location, index)
+            : Object.entries(schemes).find(([, scheme]) => scheme === resolved)?.[0]);
+    if (schemeName === undefined) {
         return undefined;
     }
-    const resolved = getResolvedRef(entry);
     const scopes = resolved != null && 'scopes' in resolved && Array.isArray(resolved.scopes) ? [...resolved.scopes] : [];
     return { [schemeName]: scopes };
 };
-const collectSecurityRequirements = (document, security) => {
+const collectSecurityRequirements = (document, security, location, schemes) => {
     if (!security?.length) {
         return [];
     }
     return security
-        .map((entry) => securityEntryToRequirement(document, entry))
+        .map((entry, index) => securityEntryToRequirement(document, entry, index, location, schemes))
         .filter((requirement) => requirement != null);
 };
 /**
  * Converts AsyncAPI security arrays (operation, traits, server) into OpenAPI-style requirement objects.
  */
-export const getAsyncApiSecurityRequirements = (document, operation, server) => {
-    const operationRequirements = collectSecurityRequirements(document, operation?.security);
-    const serverRequirements = collectSecurityRequirements(document, server?.security);
-    const combined = operationRequirements.length === 0
-        ? serverRequirements
-        : serverRequirements.length === 0
-            ? operationRequirements
-            : [...operationRequirements, ...serverRequirements];
+export const getAsyncApiSecurityRequirements = (document, operation, server, locations = {}) => {
+    // Existing callers can omit locations. Build their fallback registry once, not once per entry.
+    const needsRegistry = (operation?.security?.length && locations.operationName === undefined) ||
+        (server?.security?.length && locations.serverName === undefined);
+    const schemes = needsRegistry ? getAsyncApiSecuritySchemes(document) : {};
+    const operationRequirements = collectSecurityRequirements(document, operation?.security, locations.operationName === undefined ? undefined : `Operation ${locations.operationName}`, schemes);
+    const serverRequirements = collectSecurityRequirements(document, server?.security, locations.serverName === undefined ? undefined : `Server ${locations.serverName}`, schemes);
+    if (operationRequirements.length === 0) {
+        return dedupeRequirements(serverRequirements);
+    }
+    if (serverRequirements.length === 0) {
+        return dedupeRequirements(operationRequirements);
+    }
+    const combined = operationRequirements.flatMap((operationRequirement) => serverRequirements.map((serverRequirement) => {
+        const combined = { ...serverRequirement };
+        for (const [name, scopes] of Object.entries(operationRequirement)) {
+            combined[name] = [...new Set([...(combined[name] ?? []), ...(scopes ?? [])])];
+        }
+        return combined;
+    }));
     return dedupeRequirements(combined);
 };
 /**
@@ -75,12 +129,15 @@ export const getAsyncApiSecurityRequirements = (document, operation, server) =>
  * intentionally excluded here — that is per-channel and handled separately.
  */
 export const getAsyncApiDocumentSecurityRequirements = (document) => {
-    const servers = document.servers ? getResolvedRef(document.servers) : undefined;
+    const servers = document.servers ? getResolvedAsyncApiRef(document.servers) : undefined;
     if (!servers) {
         return [];
     }
-    const resolvedServers = Object.values(servers).map((serverRef) => getResolvedRef(serverRef));
-    const perServerRequirements = resolvedServers.map((server) => getAsyncApiSecurityRequirements(document, null, server));
+    const resolvedServers = Object.entries(servers).map(([name, serverRef]) => ({
+        name,
+        server: getResolvedAsyncApiRef(serverRef),
+    }));
+    const perServerRequirements = resolvedServers.map(({ name, server }) => getAsyncApiSecurityRequirements(document, null, server, { serverName: name }));
     const combined = perServerRequirements.flat();
     // When some servers require auth while others accept unauthenticated connections, surface the
     // no-auth path as an optional `{}` requirement so those servers stay selectable. "No auth" is
@@ -88,7 +145,7 @@ export const getAsyncApiDocumentSecurityRequirements = (document) => {
     // security failed to resolve to a scheme — that server still requires auth. If no server
     // requires auth at all, we return `[]` and let the selector treat every scheme as optional.
     const someRequireAuth = perServerRequirements.some((requirements) => requirements.length > 0);
-    const someDeclareNoAuth = resolvedServers.some((server) => !server?.security?.length);
+    const someDeclareNoAuth = resolvedServers.some(({ server }) => !server?.security?.length);
     if (someRequireAuth && someDeclareNoAuth) {
         combined.push({});
     }

package/dist/channel-example/get-channel-connection-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-connection-context.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAS9E,OAAO,KAAK,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAQ9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAK5D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,uBAAuB,qBAAqB,EAC5C,UAAS,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,cAAc,EAAE,2BAA2B,CAAA;IAC3C,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,6BAA6B,CAwItC,CAAA"}
+{"version":3,"file":"get-channel-connection-context.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAU9E,OAAO,KAAK,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAO9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAK5D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,uBAAuB,qBAAqB,EAC5C,UAAS,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,cAAc,EAAE,2BAA2B,CAAA;IAC3C,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,6BAA6B,CAuItC,CAAA"}

package/dist/channel-example/get-channel-connection-context.js

@@ -1,11 +1,11 @@
 import { buildConnectionUrl } from '../channel-example/build-connection-url.js';
 import { getAllChannelMessages } from '../channel-example/get-all-channel-messages.js';
+import { getAsyncApiSecuritySchemes } from '../channel-example/get-asyncapi-security-requirements.js';
 import { getChannelConnectionSecurityRequirements } from '../channel-example/get-channel-connection-security.js';
 import { getChannelOperations } from '../channel-example/get-channel-operations.js';
 import { getChannelParameters } from '../channel-example/get-channel-parameters.js';
 import { resolveChannel } from '../channel-example/resolve-channel.js';
 import { getAsyncApiServers, getSelectedAsyncApiServer } from '../channel-example/servers.js';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
 import { getEnvironmentVariables } from '../request-example/builder/helpers/get-environment-variables.js';
 import { getActiveEnvironment } from '../request-example/context/environment.js';
 import { getSecuritySchemes } from '../request-example/context/security/get-security-schemes.js';
@@ -84,9 +84,8 @@ export const getChannelConnectionContext = (workspaceStore, documentName, channe
         path: channelName,
         method: ASYNCAPI_CHANNEL_AUTH_METHOD,
     });
-    const components = document.components ? getResolvedRef(document.components) : undefined;
-    const securitySchemes = mergeSecurity(components?.securitySchemes ?? {}, options.authentication?.securitySchemes ?? {}, workspaceStore.auth, documentName);
-    const securityRequirements = getChannelConnectionSecurityRequirements(document, channel, selectedServer?.server ?? null, channelOperations);
+    const securitySchemes = mergeSecurity(getAsyncApiSecuritySchemes(document, { operations: {} }), options.authentication?.securitySchemes ?? {}, workspaceStore.auth, documentName);
+    const securityRequirements = getChannelConnectionSecurityRequirements(document, channel, selectedServer?.server ?? null, channelOperations, selectedServer?.name);
     const selectedSecurity = getSelectedSecurity(documentSelectedSecurity, channelSelectedSecurity, securityRequirements, securitySchemes, options.authentication?.preferredSecurityScheme);
     const selectedSecuritySchemes = getSecuritySchemes(securitySchemes, selectedSecurity.selectedSchemes[selectedSecurity.selectedIndex] ?? {});
     const authMeta = channelSelectedSecurity

package/dist/channel-example/get-channel-connection-security.d.ts

@@ -2,7 +2,8 @@ import type { AsyncApiChannelObject, AsyncApiDocument, AsyncApiServerObject } fr
 import type { SecurityRequirementObject } from '../schemas/v3.2/strict/security-requirement.js';
 import type { ChannelOperationSummary } from './get-channel-operations.js';
 /**
- * Merges security requirements from the selected server and all operations on a channel.
+ * Connection authentication belongs to the selected server; operation security is documented separately.
+ * Keep the channel arguments for compatibility with existing consumers of this public helper.
  */
-export declare const getChannelConnectionSecurityRequirements: (document: AsyncApiDocument, _channel: AsyncApiChannelObject, server: AsyncApiServerObject | null, channelOperations: ChannelOperationSummary[]) => SecurityRequirementObject[];
+export declare const getChannelConnectionSecurityRequirements: (document: AsyncApiDocument, _channel: AsyncApiChannelObject, server: AsyncApiServerObject | null, _channelOperations: ChannelOperationSummary[], serverName?: string) => SecurityRequirementObject[];
 //# sourceMappingURL=get-channel-connection-security.d.ts.map

package/dist/channel-example/get-channel-connection-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-connection-security.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAG/G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAG3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAEvE;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACnD,UAAU,gBAAgB,EAC1B,UAAU,qBAAqB,EAC/B,QAAQ,oBAAoB,GAAG,IAAI,EACnC,mBAAmB,uBAAuB,EAAE,KAC3C,yBAAyB,EAQ3B,CAAA"}
+{"version":3,"file":"get-channel-connection-security.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAG/G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAEvE;;;GAGG;AACH,eAAO,MAAM,wCAAwC,GACnD,UAAU,gBAAgB,EAC1B,UAAU,qBAAqB,EAC/B,QAAQ,oBAAoB,GAAG,IAAI,EACnC,oBAAoB,uBAAuB,EAAE,EAC7C,aAAa,MAAM,KAClB,yBAAyB,EAE3B,CAAA"}

package/dist/channel-example/get-channel-connection-security.js

@@ -1,10 +1,8 @@
 import { getAsyncApiSecurityRequirements } from '../channel-example/get-asyncapi-security-requirements.js';
-import { dedupeRequirements } from './dedupe-requirements.js';
 /**
- * Merges security requirements from the selected server and all operations on a channel.
+ * Connection authentication belongs to the selected server; operation security is documented separately.
+ * Keep the channel arguments for compatibility with existing consumers of this public helper.
  */
-export const getChannelConnectionSecurityRequirements = (document, _channel, server, channelOperations) => {
-    const serverRequirements = getAsyncApiSecurityRequirements(document, null, server);
-    const operationRequirements = channelOperations.flatMap(({ operation }) => getAsyncApiSecurityRequirements(document, operation, null));
-    return dedupeRequirements([...serverRequirements, ...operationRequirements]);
+export const getChannelConnectionSecurityRequirements = (document, _channel, server, _channelOperations, serverName) => {
+    return getAsyncApiSecurityRequirements(document, null, server, { serverName });
 };

package/dist/channel-example/get-channel-operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-operations.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAO3F,MAAM,MAAM,uBAAuB,GAAG;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,uBAAuB,CAAA;IAClC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,gBAAgB,EAAE,aAAa,MAAM,KAAG,uBAAuB,EAkB7G,CAAA"}
+{"version":3,"file":"get-channel-operations.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,4BAA4B,CAAA;AAO3F,MAAM,MAAM,uBAAuB,GAAG;IACpC,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,uBAAuB,CAAA;IAClC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAA;CAC3B,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,UAAU,gBAAgB,EAAE,aAAa,MAAM,KAAG,uBAAuB,EAoB7G,CAAA"}

package/dist/channel-example/get-channel-operations.js

@@ -1,4 +1,4 @@
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 import { resolveOperationChannel } from './resolve-operation-channel.js';
 import { resolveOperationWithTraits } from './resolve-operation-with-traits.js';
 /**
@@ -8,9 +8,10 @@ export const getChannelOperations = (document, channelName) => {
     const operations = document.operations ?? {};
     return Object.entries(operations)
         .map(([operationName, operationRef]) => {
-        const resolvedOperation = getResolvedRef(operationRef);
-        if (!resolvedOperation)
+        const resolvedOperation = getResolvedAsyncApiRef(operationRef);
+        if (!resolvedOperation) {
             return undefined;
+        }
         const operation = resolveOperationWithTraits(resolvedOperation);
         const resolved = resolveOperationChannel(document, operation);
         if (resolved?.channelName !== channelName) {

package/dist/channel-example/get-channel-parameters.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-parameters.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-parameters.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AAKnC,MAAM,MAAM,wBAAwB,GAAG;IACrC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACpD,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B,CAAA;AA+BD;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,qBAAqB,EAC9B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,YAAW,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAM,KACxE,wBAiCF,CAAA"}
+{"version":3,"file":"get-channel-parameters.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-parameters.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACxB,MAAM,4BAA4B,CAAA;AAKnC,MAAM,MAAM,wBAAwB,GAAG;IACrC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAA;IACpD,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,oEAAoE;IACpE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC9B,CAAA;AA+BD;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,qBAAqB,EAC9B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,YAAW,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,GAAG,OAAO,CAAC,CAAM,KACxE,wBAmCF,CAAA"}

package/dist/channel-example/get-channel-parameters.js

@@ -1,7 +1,7 @@
 import { objectEntries } from '@scalar/helpers/object/object-entries';
 import { findVariables } from '@scalar/helpers/regex/find-variables';
 import { buildWsQueryParams, mergeWsBindings } from '../channel-example/build-connection-url.js';
-import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { getResolvedAsyncApiRef } from '../helpers/get-resolved-async-api-ref.js';
 const getPathParameterNames = (address) => {
     if (address == null || address === '') {
         return [];
@@ -33,9 +33,10 @@ export const getChannelParameters = (channel, operation, overrides = {}) => {
     const definitions = {};
     if (channel.parameters) {
         for (const [name, parameterRef] of objectEntries(channel.parameters)) {
-            const parameter = getResolvedRef(parameterRef);
-            if (parameter)
+            const parameter = getResolvedAsyncApiRef(parameterRef);
+            if (parameter) {
                 definitions[name] = parameter;
+            }
         }
     }
     const path = { ...overrides.path };

package/dist/channel-example/index.d.ts

@@ -3,8 +3,8 @@ export { ASYNCAPI_WEBSOCKET_PROTOCOLS, buildAsyncApiServerBaseUrl, buildConnecti
 export type { ChannelMessageEntry } from './get-all-channel-messages.js';
 export { getAllChannelMessages } from './get-all-channel-messages.js';
 export type { AsyncApiProtocolOption, AsyncApiReachabilityContext, AsyncApiServerOption, OperationReachability, } from './get-async-api-protocols.js';
-export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
-export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, } from './get-asyncapi-security-requirements.js';
+export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getChannelReachability, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
+export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, getAsyncApiSecuritySchemes, } from './get-asyncapi-security-requirements.js';
 export { getChannelConnectionContext } from './get-channel-connection-context.js';
 export { getChannelConnectionSecurityRequirements } from './get-channel-connection-security.js';
 export type { ChannelOperationSummary } from './get-channel-operations.js';

package/dist/channel-example/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channel-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChG,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,GAAG,EACH,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uCAAuC,EACvC,+BAA+B,GAChC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACzE,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channel-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChG,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,GAAG,EACH,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,sBAAsB,EACtB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uCAAuC,EACvC,+BAA+B,EAC/B,0BAA0B,GAC3B,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACzE,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/channel-example/index.js

@@ -1,7 +1,7 @@
 export { ASYNCAPI_WEBSOCKET_PROTOCOLS, buildAsyncApiServerBaseUrl, buildConnectionUrl, buildWsQueryParams, getAsyncApiServerVariables, getUrlSchemeFromProtocol, isWebSocketProtocol, mergeWsBindings, } from './build-connection-url.js';
 export { getAllChannelMessages } from './get-all-channel-messages.js';
-export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
-export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, } from './get-asyncapi-security-requirements.js';
+export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getChannelReachability, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
+export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, getAsyncApiSecuritySchemes, } from './get-asyncapi-security-requirements.js';
 export { getChannelConnectionContext } from './get-channel-connection-context.js';
 export { getChannelConnectionSecurityRequirements } from './get-channel-connection-security.js';
 export { getChannelOperations } from './get-channel-operations.js';

package/dist/channel-example/resolve-channel.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-channel.d.ts","sourceRoot":"","sources":["../../src/channel-example/resolve-channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAIzF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,qBAAqB,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,gBAAgB,EAAE,aAAa,MAAM,KAAG,eAAe,GAAG,SAYlG,CAAA"}
+{"version":3,"file":"resolve-channel.d.ts","sourceRoot":"","sources":["../../src/channel-example/resolve-channel.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAIzF,MAAM,MAAM,eAAe,GAAG;IAC5B,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,qBAAqB,CAAA;IAC9B,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED;;GAEG;AACH,eAAO,MAAM,cAAc,GAAI,UAAU,gBAAgB,EAAE,aAAa,MAAM,KAAG,eAAe,GAAG,SAclG,CAAA"}