@scalar/workspace-store 0.68.2 → 0.68.4

package/dist/request-example/builder/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAClF,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,KAAK,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAA;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,wBAAwB,GACzB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AACxE,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,kCAAkC,EAClC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAC9F,OAAO,EAAE,0BAA0B,EAAE,MAAM,uCAAuC,CAAA;AAClF,OAAO,EACL,6BAA6B,EAC7B,2BAA2B,EAC3B,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,KAAK,sBAAsB,EAAE,iCAAiC,EAAE,MAAM,gCAAgC,CAAA;AAC/G,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAA;AAC1E,OAAO,EACL,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,YAAY,EACZ,2BAA2B,GAC5B,MAAM,iBAAiB,CAAA;AACxB,OAAO,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AAC9F,OAAO,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAC5D,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EACL,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,wBAAwB,GACzB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAA;AACzF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAA;AACxE,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,kCAAkC,EAClC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,yBAAyB,CAAA"}

package/dist/request-example/builder/index.js

@@ -5,6 +5,7 @@ export { serializeFormPropertyWithEncoding } from './body/serialize-form-propert
 export { serializeMultipartArray } from './body/serialize-multipart-array.js';
 export { BUILD_REQUEST_FAILED, buildRequest, resolveExecutableRequestUrl, } from './build-request.js';
 export { deSerializeParameter, deSerializeSchemaValue } from './header/de-serialize-parameter.js';
+export { filterDisabledProperties } from './header/filter-disabled-properties.js';
 export { filterGlobalCookie } from './header/filter-global-cookies.js';
 export { isParamDisabled } from './header/is-param-disabled.js';
 export { serializeContentValue, serializeCookieStyle, serializeDeepObjectStyle, serializeFormStyle, serializeFormStyleForCookies, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './header/serialize-parameter.js';

package/dist/request-example/builder/resolve-request-factory-url.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-request-factory-url.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/resolve-request-factory-url.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,8BAA8B,CAAA;AAWnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAA;AAE/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF,MAAM,MAAM,6BAA6B,GAAG,OAAO,2BAA2B,GAAG,OAAO,2BAA2B,CAAA;AAEnH,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAK1F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,cAAc,EACvB,SAAS;IACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;IACzE,mBAAmB,EAAE,eAAe,CAAA;IACpC;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACxC,KACA,8BAuFF,CAAA"}
+{"version":3,"file":"resolve-request-factory-url.d.ts","sourceRoot":"","sources":["../../../src/request-example/builder/resolve-request-factory-url.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,MAAM,EAAW,MAAM,8BAA8B,CAAA;AAWnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAA;AAE/E;;;GAGG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAG,6BAAsC,CAAA;AAEjF,MAAM,MAAM,6BAA6B,GAAG,OAAO,2BAA2B,GAAG,OAAO,2BAA2B,CAAA;AAEnH,MAAM,MAAM,8BAA8B,GAAG,MAAM,CAAC,MAAM,EAAE,6BAA6B,CAAC,CAAA;AAK1F;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,SAAS,cAAc,EACvB,SAAS;IACP,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC,CAAA;IACzE,mBAAmB,EAAE,eAAe,CAAA;IACpC;;;OAGG;IACH,6BAA6B,CAAC,EAAE,OAAO,CAAA;CACxC,KACA,8BAwFF,CAAA"}

package/dist/request-example/builder/resolve-request-factory-url.js

@@ -27,14 +27,15 @@ export const resolveRequestFactoryUrl = (request, options) => {
         const reserved = request.path.reservedParameters && Object.hasOwn(request.path.reservedParameters, key)
             ? request.path.reservedParameters[key]
             : undefined;
-        const encoded = request.path.serializedParameters?.has(key)
-            ? replace(value)
-            : reserved
-                ? serializeReservedPathParameter(key, {
-                    ...reserved,
-                    value: value === reserved.originalValue ? reserved.value : value,
-                }, replace)
-                : encodePathParameter(replace(value));
+        if (request.path.serializedParameters?.has(key)) {
+            return [key, replace(value)];
+        }
+        const encoded = reserved
+            ? serializeReservedPathParameter(key, {
+                ...reserved,
+                value: value === reserved.originalValue ? reserved.value : value,
+            }, replace)
+            : encodePathParameter(replace(value));
         return [key, encoded];
     })));
     if (!pathVariablesEncoded.ok) {

package/dist/request-example/builder/security/secret-types.d.ts

@@ -1,8 +1,18 @@
+import type { AuthSecretField } from '../../../helpers/auth-secret-fields.js';
 import type { EncryptionSchemeType, SaslSchemeType } from '../../../request-example/builder/security/broker-scheme-types.js';
 import type { XScalarAuthUrl, XScalarCredentialsLocation, XScalarSecretClientCertificate, XScalarSecretClientId, XScalarSecretClientSecret, XScalarSecretHTTP, XScalarSecretPrivateKey, XScalarSecretRedirectUri, XScalarSecretRefreshToken, XScalarSecretServiceName, XScalarSecretToken, XScalarTokenUrl } from '../../../schemas/extensions/security/index.js';
 import type { OAuthFlowAuthorizationCode, OAuthFlowClientCredentials, OAuthFlowDeviceAuthorization, OAuthFlowImplicit, OAuthFlowPassword } from '../../../schemas/v3.2/strict/oauth-flow.js';
 import type { ApiKeyObject, HttpObject, MutualTlsObject, OAuth2Object, OpenIdConnectObject } from '../../../schemas/v3.2/strict/security-scheme.js';
-type OAuthFlowCommonSecret = XScalarSecretClientId & XScalarSecretToken & XScalarSecretRefreshToken & XScalarAuthUrl & XScalarTokenUrl & {
+/**
+ * Derived while merging the auth store with the document and configuration: the value each field
+ * returns to when its stored override is reset. Fields without a non-empty default are left out.
+ * It is never persisted and never sent with a request; it only tells the auth UI whether Reset
+ * would restore anything.
+ */
+export type XScalarSecretDefaults = {
+    'x-scalar-secret-defaults'?: Partial<Record<AuthSecretField, string>>;
+};
+type OAuthFlowCommonSecret = XScalarSecretClientId & XScalarSecretToken & XScalarSecretRefreshToken & XScalarAuthUrl & XScalarTokenUrl & XScalarSecretDefaults & {
     /** Explicit clears are carried to the auth UI to prevent default prefill after remount. */
     'x-scalar-secret-cleared-fields'?: string[];
 };
@@ -26,8 +36,8 @@ export type BrokerApiKeyObject = {
     name?: string;
     description?: string;
 };
-export type ApiKeyObjectSecret = (ApiKeyObject | BrokerApiKeyObject) & XScalarSecretToken;
-export type HttpObjectSecret = HttpObject & XScalarSecretHTTP & XScalarSecretToken;
+export type ApiKeyObjectSecret = (ApiKeyObject | BrokerApiKeyObject) & XScalarSecretToken & XScalarSecretDefaults;
+export type HttpObjectSecret = HttpObject & XScalarSecretHTTP & XScalarSecretToken & XScalarSecretDefaults;
 /** Mutual TLS: the client certificate is presented at the TLS layer, so there is no secret to enter. */
 export type MutualTlsObjectSecret = MutualTlsObject;
 export type OAuth2ObjectSecret = Omit<OAuth2Object, 'flows'> & {

package/dist/request-example/builder/security/secret-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAE9C,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,GAAG;IAChB,2FAA2F;IAC3F,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5C,CAAA;AAEH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,6FAA6F;AAC7F,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,GAC3E,qBAAqB,GACrB,yBAAyB,CAAA;AAE3B,MAAM,MAAM,sBAAsB,GAAG;IACnC,mBAAmB,CAAC,EAAE,kCAAkC,CAAA;IACxD,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,QAAQ,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,GAAG,kBAAkB,CAAA;AACzF,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,CAAA;AAClF,wGAAwG;AACxG,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAA;AACnD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}
+{"version":3,"file":"secret-types.d.ts","sourceRoot":"","sources":["../../../../src/request-example/builder/security/secret-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAA;AACnE,OAAO,KAAK,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,wDAAwD,CAAA;AAClH,OAAO,KAAK,EACV,cAAc,EACd,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,yBAAyB,EACzB,iBAAiB,EACjB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,kBAAkB,EAClB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AACtC,OAAO,KAAK,EACV,0BAA0B,EAC1B,0BAA0B,EAC1B,4BAA4B,EAC5B,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,kCAAkC,CAAA;AACzC,OAAO,KAAK,EACV,YAAY,EACZ,UAAU,EACV,eAAe,EACf,YAAY,EACZ,mBAAmB,EACpB,MAAM,uCAAuC,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,0BAA0B,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAA;CACtE,CAAA;AAED,KAAK,qBAAqB,GAAG,qBAAqB,GAChD,kBAAkB,GAClB,yBAAyB,GACzB,cAAc,GACd,eAAe,GACf,qBAAqB,GAAG;IACtB,2FAA2F;IAC3F,gCAAgC,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5C,CAAA;AAEH,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GAAG,qBAAqB,GAAG,wBAAwB,CAAA;AAE1G,MAAM,MAAM,uBAAuB,GAAG,iBAAiB,GACrD,qBAAqB,GACrB,iBAAiB,GACjB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,0BAA0B,CAAA;AAE5B,MAAM,MAAM,gCAAgC,GAAG,0BAA0B,GACvE,qBAAqB,GACrB,yBAAyB,GACzB,wBAAwB,GACxB,0BAA0B,CAAA;AAE5B,6FAA6F;AAC7F,MAAM,MAAM,kCAAkC,GAAG,4BAA4B,GAC3E,qBAAqB,GACrB,yBAAyB,CAAA;AAE3B,MAAM,MAAM,sBAAsB,GAAG;IACnC,mBAAmB,CAAC,EAAE,kCAAkC,CAAA;IACxD,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;IAClC,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;IACpD,iBAAiB,CAAC,EAAE,gCAAgC,CAAA;CACrD,CAAA;AAED,gFAAgF;AAChF,MAAM,MAAM,kBAAkB,GAAG;IAC/B,IAAI,EAAE,QAAQ,CAAA;IACd,EAAE,EAAE,MAAM,GAAG,UAAU,CAAA;IACvB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,kBAAkB,GAAG,CAAC,YAAY,GAAG,kBAAkB,CAAC,GAAG,kBAAkB,GAAG,qBAAqB,CAAA;AACjH,MAAM,MAAM,gBAAgB,GAAG,UAAU,GAAG,iBAAiB,GAAG,kBAAkB,GAAG,qBAAqB,CAAA;AAC1G,wGAAwG;AACxG,MAAM,MAAM,qBAAqB,GAAG,eAAe,CAAA;AACnD,MAAM,MAAM,kBAAkB,GAAG,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAChG,MAAM,MAAM,yBAAyB,GAAG,mBAAmB,GAAG;IAAE,KAAK,CAAC,EAAE,sBAAsB,CAAA;CAAE,CAAA;AAEhG;;;GAGG;AACH,KAAK,oBAAoB,CAAC,CAAC,SAAS,MAAM,IAAI;IAC5C,IAAI,EAAE,CAAC,CAAA;IACP,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,wFAAwF;AACxF,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,cAAc,CAAC,GAAG,iBAAiB,CAAA;AAEvF,2EAA2E;AAC3E,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,CAAC,GAAG,8BAA8B,GAAG,uBAAuB,CAAA;AAEtH,wFAAwF;AACxF,MAAM,MAAM,sBAAsB,GAAG,oBAAoB,CAAC,oBAAoB,CAAC,GAAG,kBAAkB,CAAA;AAEpG,4FAA4F;AAC5F,MAAM,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,QAAQ,CAAC,GAAG,wBAAwB,CAAA;AAE1F,MAAM,MAAM,0BAA0B,GAClC,kBAAkB,GAClB,gBAAgB,GAChB,qBAAqB,GACrB,yBAAyB,GACzB,kBAAkB,GAClB,gBAAgB,GAChB,gBAAgB,GAChB,sBAAsB,GACtB,kBAAkB,CAAA"}

package/dist/request-example/context/headers.js

@@ -28,7 +28,7 @@ const getEnabledOperationHeaderParameterNames = (operation, exampleName) => {
     const names = new Set();
     for (const ref of operation.parameters ?? []) {
         const param = getResolvedRef(ref);
-        if (!param || param.in !== 'header') {
+        if (param?.in !== 'header') {
             continue;
         }
         const example = getExample(param, exampleName, undefined);

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAE/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAEV,kBAAkB,EAClB,sBAAsB,EAUtB,gBAAgB,EAChB,0BAA0B,EAE3B,MAAM,iDAAiD,CAAA;AAGxD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAEjF,KAAK,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrG,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,gBAAgB,GAAG;QACvB,IAAI,EAAE,CAAC,CAAA;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf;CACF,CAAC,gBAAgB,CAAC,CAAA;AAyNnB,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,kBAAkB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BAqHF,CAAA"}
+{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAE/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAEV,kBAAkB,EAClB,sBAAsB,EAUtB,gBAAgB,EAChB,0BAA0B,EAG3B,MAAM,iDAAiD,CAAA;AAGxD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAEjF,KAAK,gBAAgB,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,sBAAsB,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,QAAQ,CAAA;AACrG,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,gBAAgB,GAAG;QACvB,IAAI,EAAE,CAAC,CAAA;QACP,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,KAAK,CAAC,EAAE,MAAM,CAAA;KACf;CACF,CAAC,gBAAgB,CAAC,CAAA;AAuQnB,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,gBAAgB,GAAG,gBAAgB,GAAG,CAAC,kBAAkB,GAAG;IAAE,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,EACvF,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,0BA6HF,CAAA"}

package/dist/request-example/context/security/extract-security-scheme-secrets.js

@@ -15,25 +15,55 @@ const SECRET_TO_INPUT_FIELD_MAP = {
     'x-scalar-secret-auth-url': 'authorizationUrl',
     'x-scalar-secret-token-url': 'tokenUrl',
 };
-const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}, oauth2RedirectUri) => {
+/**
+ * Keep only the defaults that would restore something. An empty default means Reset could only
+ * clear the field, which the clear action already does, so the key is left off entirely.
+ */
+const withSecretDefaults = (defaults) => {
+    const nonEmpty = Object.fromEntries(Object.entries(defaults).filter(([, value]) => typeof value === 'string' && value !== ''));
+    return Object.keys(nonEmpty).length ? { 'x-scalar-secret-defaults': nonEmpty } : {};
+};
+/** Only string values count; anything else falls through to the next source. */
+const readString = (source, key) => {
+    const value = source[key];
+    return typeof value === 'string' ? value : undefined;
+};
+const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}, oauth2RedirectUri, 
+/**
+ * OpenID Connect passes the stored flow as both the config and the auth store, so its
+ * `x-scalar-secret-*` values are the user's own overrides and must not count as defaults.
+ */
+includeConfigSecretValues = true) => {
     const clearedFields = properties.filter((property) => isSecretFieldCleared(authStoreSecrets, property));
+    const defaults = {};
     const values = Object.fromEntries(properties.map((property) => {
         // Preserve explicit clears, while legacy schema-filled empties still inherit defaults.
-        const authStoreValue = typeof authStoreSecrets[property] === 'string' ? authStoreSecrets[property] : undefined;
-        const configValue = typeof configSecrets[property] === 'string' ? configSecrets[property] : undefined;
-        const configInputValue = typeof configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]] === 'string'
-            ? configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]]
-            : undefined;
+        const authStoreValue = readString(authStoreSecrets, property);
+        const configValue = includeConfigSecretValues ? readString(configSecrets, property) : undefined;
+        const configInputValue = readString(configSecrets, SECRET_TO_INPUT_FIELD_MAP[property]);
         // oauth2RedirectUri (top-level config option) is used as a global fallback for the redirect URI,
         // applied only when neither the auth store nor per-scheme config have a value. This ensures
         // the configured redirect URI persists when switching between documents with the same OAuth config,
         // because each document starts with no stored redirect URI (authStoreValue === undefined).
-        const value = property === 'x-scalar-secret-redirect-uri' || isSecretFieldCleared(authStoreSecrets, property)
+        const isRedirect = property === 'x-scalar-secret-redirect-uri';
+        // The value and its reset target share one fallback, so Reset always restores exactly what the
+        // field shows once the stored override is released.
+        const fallback = isRedirect
+            ? (configValue ?? configInputValue ?? oauth2RedirectUri ?? '')
+            : configValue || configInputValue || '';
+        // The redirect URI and explicitly cleared fields keep an empty stored value instead of falling
+        // back. For the redirect URI this is the stored value ahead of the same fallback as above.
+        const value = isRedirect || isSecretFieldCleared(authStoreSecrets, property)
             ? (authStoreValue ?? configValue ?? configInputValue ?? oauth2RedirectUri ?? '')
-            : authStoreValue || configValue || configInputValue || '';
+            : authStoreValue || fallback;
+        defaults[property] = fallback;
         return [property, value];
     }));
-    return { ...values, ...(clearedFields.length ? { 'x-scalar-secret-cleared-fields': clearedFields } : {}) };
+    return {
+        ...values,
+        ...(clearedFields.length ? { 'x-scalar-secret-cleared-fields': clearedFields } : {}),
+        ...withSecretDefaults(defaults),
+    };
 };
 const storedSecret = (secrets, field) => {
     const value = secrets && Reflect.get(secrets, field);
@@ -60,7 +90,7 @@ const extractCredentialsLocation = (configSecrets, authStoreSecrets = {}) => {
  * Extract flow secrets and selected scopes for OAuth-like flows.
  * Reused by both oauth2 and openIdConnect security schemes.
  */
-const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
+const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri, includeConfigSecretValues = true) => {
     const selectedScopes = new Set();
     const extractedFlows = objectEntries(flows ?? {}).reduce((acc, [key, flow]) => {
         if (!isObject(flow)) {
@@ -80,7 +110,7 @@ const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
                     'x-scalar-secret-redirect-uri',
                     'x-scalar-secret-token',
                     'x-scalar-secret-auth-url',
-                ], flow, storeSecrets?.implicit, oauth2RedirectUri),
+                ], flow, storeSecrets?.implicit, oauth2RedirectUri, includeConfigSecretValues),
                 ...extractRefreshTokenSecret(storeSecrets?.implicit),
             };
         }
@@ -95,7 +125,7 @@ const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
                     'x-scalar-secret-password',
                     'x-scalar-secret-token',
                     'x-scalar-secret-token-url',
-                ], flow, storeSecrets?.password),
+                ], flow, storeSecrets?.password, undefined, includeConfigSecretValues),
                 ...extractCredentialsLocation(flow, storeSecrets?.password),
                 ...extractRefreshTokenSecret(storeSecrets?.password),
             };
@@ -109,7 +139,7 @@ const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
                     'x-scalar-secret-client-secret',
                     'x-scalar-secret-token',
                     'x-scalar-secret-token-url',
-                ], flow, storeSecrets?.clientCredentials),
+                ], flow, storeSecrets?.clientCredentials, undefined, includeConfigSecretValues),
                 ...extractCredentialsLocation(flow, storeSecrets?.clientCredentials),
                 ...extractRefreshTokenSecret(storeSecrets?.clientCredentials),
             };
@@ -123,7 +153,7 @@ const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
                     'x-scalar-secret-client-secret',
                     'x-scalar-secret-token',
                     'x-scalar-secret-token-url',
-                ], flow, storeSecrets?.deviceAuthorization),
+                ], flow, storeSecrets?.deviceAuthorization, undefined, includeConfigSecretValues),
                 ...extractCredentialsLocation(flow, storeSecrets?.deviceAuthorization),
                 ...extractRefreshTokenSecret(storeSecrets?.deviceAuthorization),
             };
@@ -139,7 +169,7 @@ const extractOAuthFlowSecrets = (flows, storeSecrets, oauth2RedirectUri) => {
                     'x-scalar-secret-token',
                     'x-scalar-secret-auth-url',
                     'x-scalar-secret-token-url',
-                ], flow, storeSecrets?.authorizationCode, oauth2RedirectUri),
+                ], flow, storeSecrets?.authorizationCode, oauth2RedirectUri, includeConfigSecretValues),
                 ...extractCredentialsLocation(flow, storeSecrets?.authorizationCode),
                 ...extractRefreshTokenSecret(storeSecrets?.authorizationCode),
             };
@@ -156,29 +186,37 @@ scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
     // Handle API Key security schemes
     if (scheme.type === 'apiKey') {
         const storeSecrets = secrets?.type === 'apiKey' ? secrets : undefined;
+        const defaults = {
+            'x-scalar-secret-token': documentSecret(scheme, 'x-scalar-secret-token') || scheme.value || '',
+        };
         return {
             ...scheme,
-            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ??
-                (documentSecret(scheme, 'x-scalar-secret-token') || scheme.value || ''),
+            // User edits take precedence over document and configuration defaults, even when cleared.
+            ...(storeSecrets?.name === undefined ? {} : { name: storeSecrets.name }),
+            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ?? defaults['x-scalar-secret-token'],
+            ...withSecretDefaults(defaults),
         };
     }
     // Handle HTTP Auth security schemes (e.g., Basic, Bearer)
     if (scheme.type === 'http') {
         const storeSecrets = secrets?.type === 'http' ? secrets : undefined;
+        const defaults = {
+            'x-scalar-secret-token': documentSecret(scheme, 'x-scalar-secret-token') || scheme.token || '',
+            'x-scalar-secret-username': documentSecret(scheme, 'x-scalar-secret-username') || scheme.username || '',
+            'x-scalar-secret-password': documentSecret(scheme, 'x-scalar-secret-password') || scheme.password || '',
+        };
         return {
             ...scheme,
-            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ??
-                (documentSecret(scheme, 'x-scalar-secret-token') || scheme.token || ''),
-            'x-scalar-secret-username': storedSecret(storeSecrets, 'x-scalar-secret-username') ??
-                (documentSecret(scheme, 'x-scalar-secret-username') || scheme.username || ''),
-            'x-scalar-secret-password': storedSecret(storeSecrets, 'x-scalar-secret-password') ??
-                (documentSecret(scheme, 'x-scalar-secret-password') || scheme.password || ''),
+            'x-scalar-secret-token': storedSecret(storeSecrets, 'x-scalar-secret-token') ?? defaults['x-scalar-secret-token'],
+            'x-scalar-secret-username': storedSecret(storeSecrets, 'x-scalar-secret-username') ?? defaults['x-scalar-secret-username'],
+            'x-scalar-secret-password': storedSecret(storeSecrets, 'x-scalar-secret-password') ?? defaults['x-scalar-secret-password'],
+            ...withSecretDefaults(defaults),
         };
     }
     // Handle OAuth2 security schemes and all supported flows
     if (scheme.type === 'oauth2') {
         const storeSecrets = secrets?.type === 'oauth2' ? secrets : undefined;
-        const extracted = extractOAuthFlowSecrets(scheme.flows, storeSecrets, oauth2RedirectUri);
+        const extracted = extractOAuthFlowSecrets(scheme.flows, storeSecrets, oauth2RedirectUri, true);
         const configuredDefaultScopes = Array.isArray(scheme['x-default-scopes'])
             ? scheme['x-default-scopes'].filter((scope) => typeof scope === 'string')
             : [];
@@ -198,7 +236,9 @@ scheme, authStore, name, documentSlug, oauth2RedirectUri) => {
             clientCredentials: storeSecrets?.clientCredentials,
             authorizationCode: storeSecrets?.authorizationCode,
             deviceAuthorization: storeSecrets?.deviceAuthorization,
-        }, storeSecrets, oauth2RedirectUri);
+        }, storeSecrets, oauth2RedirectUri, 
+        // The flows above are the stored flows themselves, so only discovered or input keys are defaults
+        false);
         return {
             ...scheme,
             ...(objectEntries(extracted.flows).length ? { flows: extracted.flows } : {}),

package/dist/request-example/context/security/get-selected-security.js

@@ -2,7 +2,7 @@ import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref
 import { isAuthOptional } from './is-auth-optional.js';
 /** Extracts the default scopes for a security scheme (only OAuth2 schemes support this) */
 const getDefaultScopes = (scheme) => {
-    if (!scheme || scheme.type !== 'oauth2') {
+    if (scheme?.type !== 'oauth2') {
         return [];
     }
     return scheme['x-default-scopes'] ?? [];

package/dist/request-example/context/security/merge-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAgC,MAAM,4BAA4B,CAAA;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAGrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AA0E9E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,yBACI,gBAAgB,CAAC,iBAAiB,CAAC,GACnC,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBA4DF,CAAA"}
+{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAgC,MAAM,4BAA4B,CAAA;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAGrE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAKjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AA4E9E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,yBACI,gBAAgB,CAAC,iBAAiB,CAAC,GACnC,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBAoEF,CAAA"}

package/dist/request-example/context/security/merge-security.js

@@ -8,6 +8,7 @@ import { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce';
 import { SecuritySchemeObjectSchema, } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import { isEncryptionSchemeType, isSaslSchemeType } from '../../../request-example/builder/security/broker-scheme-types.js';
 import { extractSecuritySchemeSecrets } from './extract-security-scheme-secrets.js';
+import { usesApiKeyNameOverride } from './uses-api-key-name-override.js';
 const hasAvailableScopes = (flow) => {
     const resolved = getResolvedRef(flow);
     return resolved !== null && typeof resolved === 'object' && 'availableScopes' in resolved;
@@ -35,8 +36,9 @@ const normalizeAsyncApiOAuthFlows = (flows) => {
         }
         // Prefer an OpenAPI-native `scopes` map if one is somehow already present, so we never drop it.
         const resolved = getResolvedRef(flowValue);
-        if (!isObjectLike(resolved))
+        if (!isObjectLike(resolved)) {
             return [flowKey, flowValue];
+        }
         const { availableScopes, scopes: existingScopes, ...rest } = resolved;
         return [flowKey, { ...rest, scopes: existingScopes ?? availableScopes ?? {} }];
     }));
@@ -118,7 +120,15 @@ export const mergeSecurity = (documentSecuritySchemes = {}, configSecurityScheme
         // We coerce in case the scheme is missing any key fields like type.
         const coerced = coerceValue(SecuritySchemeObjectSchema, scheme);
         const merged = { ...(isObjectLike(scheme) ? scheme : {}), ...coerced };
-        acc[name] = extractSecuritySchemeSecrets(merged, authStore, name, documentName, oauth2RedirectUri);
+        const extracted = extractSecuritySchemeSecrets(merged, authStore, name, documentName, oauth2RedirectUri);
+        const configured = Object.hasOwn(configSecuritySchemes, name) ? configSecuritySchemes[name] : undefined;
+        // A name override left behind after the configuration changed must not hide the document name.
+        acc[name] =
+            extracted.type === 'apiKey' &&
+                merged.type === 'apiKey' &&
+                !usesApiKeyNameOverride(configured, resolvedDocumentSecuritySchemes[name])
+                ? { ...extracted, name: merged.name }
+                : extracted;
         return acc;
     }, {});
 };

package/dist/request-example/context/security/uses-api-key-name-override.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Whether API key name edits for a scheme live in the auth store instead of the document.
+ *
+ * The document owns the name unless the configuration supplies one, or the scheme only exists in the
+ * configuration. The mutator and the merge share this rule, so an override left behind after the
+ * configuration changes cannot hide the document name.
+ */
+export declare const usesApiKeyNameOverride: (configuredScheme: unknown, documentScheme: unknown) => boolean;
+//# sourceMappingURL=uses-api-key-name-override.d.ts.map

package/dist/request-example/context/security/uses-api-key-name-override.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uses-api-key-name-override.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/uses-api-key-name-override.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,GAAI,kBAAkB,OAAO,EAAE,gBAAgB,OAAO,KAAG,OACc,CAAA"}

package/dist/request-example/context/security/uses-api-key-name-override.js

@@ -0,0 +1,9 @@
+import { isObjectLike } from '@scalar/helpers/object/is-object';
+/**
+ * Whether API key name edits for a scheme live in the auth store instead of the document.
+ *
+ * The document owns the name unless the configuration supplies one, or the scheme only exists in the
+ * configuration. The mutator and the merge share this rule, so an override left behind after the
+ * configuration changes cannot hide the document name.
+ */
+export const usesApiKeyNameOverride = (configuredScheme, documentScheme) => isObjectLike(configuredScheme) && (configuredScheme.name !== undefined || !isObjectLike(documentScheme));

package/dist/request-example/index.d.ts

@@ -1,5 +1,5 @@
 export type { ApiKeyObjectSecret, BuildRequestData, BuildRequestFailureCode, BuildRequestResult, EncryptionObjectSecret, GssapiObjectSecret, HttpObjectSecret, OAuth2ObjectSecret, OAuthFlowAuthorizationCodeSecret, OAuthFlowClientCredentialsSecret, OAuthFlowDeviceAuthorizationSecret, OAuthFlowImplicitSecret, OAuthFlowPasswordSecret, OAuthFlowsObjectSecret, OpenIdConnectObjectSecret, RequestPayload, ResolveRequestFactoryUrlError, ResolveRequestFactoryUrlResult, SaslObjectSecret, SecuritySchemeObjectSecret, X509ObjectSecret, } from './builder/index.js';
-export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, type RequestFactory, type SerializedFormProperty, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeCookieStyle, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
+export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, type RequestFactory, type SerializedFormProperty, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterDisabledProperties, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeCookieStyle, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
 export { needsMultipartEncoding } from './builder/body/build-multipart.js';
 export { buildRequestBody } from './builder/body/build-request-body.js';
 export { serializeMultipartBody } from './builder/body/encode-multipart-body.js';

package/dist/request-example/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,kCAAkC,EAClC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,iCAAiC,EACjC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EACL,KAAK,0BAA0B,EAC/B,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,KAAK,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,EACvB,kBAAkB,EAClB,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,gCAAgC,EAChC,gCAAgC,EAChC,kCAAkC,EAClC,uBAAuB,EACvB,uBAAuB,EACvB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,6BAA6B,EAC7B,8BAA8B,EAC9B,gBAAgB,EAChB,0BAA0B,EAC1B,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,6BAA6B,EAC7B,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,oBAAoB,EACpB,sBAAsB,EACtB,wBAAwB,EACxB,kBAAkB,EAClB,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,0BAA0B,EAC1B,kBAAkB,EAClB,sBAAsB,EACtB,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,2BAA2B,EAC3B,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,EACxB,iCAAiC,EACjC,kBAAkB,EAClB,4BAA4B,EAC5B,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,WAAW,CAAA;AAClB,OAAO,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAA;AACvE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAA;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sCAAsC,CAAA;AAC7E,YAAY,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAA;AACtD,OAAO,EACL,KAAK,0BAA0B,EAC/B,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,iBAAiB,EACjB,iBAAiB,EACjB,wBAAwB,EACxB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,aAAa,EACb,qCAAqC,EACrC,6BAA6B,GAC9B,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,sBAAsB,EACtB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,gBAAgB,EAChB,yBAAyB,EACzB,qBAAqB,GACtB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAA;AACjE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC3E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,KAAK,iBAAiB,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC5G,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/request-example/index.js

@@ -1,4 +1,4 @@
-export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeCookieStyle, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
+export { BUILD_REQUEST_FAILED, INVALID_REQUEST_FACTORY_URL, MISSING_REQUEST_SERVER_BASE, buildDottedNestedRowPredicate, buildRequest, buildRequestSecurity, coerceLeafValueToSchemaType, coerceUntypedValue, deSerializeParameter, deSerializeSchemaValue, filterDisabledProperties, filterGlobalCookie, getEnvironmentVariables, getExample, getExampleFromBody, getExampleFromSchema, getResolvedUrl, getSchemaExampleFromBody, getSelectedBodyContentType, getServerVariables, isEncryptionSchemeType, isParamDisabled, isSaslSchemeType, requestFactory, resolveExecutableRequestUrl, resolveLeafSchema, resolveRequestFactoryUrl, serializeContentValue, serializeCookieStyle, serializeDeepObjectStyle, serializeFormPropertyWithEncoding, serializeFormStyle, serializeFormStyleForCookies, serializeMultipartArray, serializePipeDelimitedStyle, serializeSimpleStyle, serializeSpaceDelimitedStyle, } from './builder/index.js';
 export { needsMultipartEncoding } from './builder/body/build-multipart.js';
 export { buildRequestBody } from './builder/body/build-request-body.js';
 export { serializeMultipartBody } from './builder/body/encode-multipart-body.js';

package/dist/request-example/xml/get-xml-example.js

@@ -213,7 +213,8 @@ const buildXmlExample = (value, input, options, evaluation) => {
         }
         const xml = schema.xml ?? {};
         validateXmlMetadata(xml, context.path);
-        const kind = xml.nodeType ?? (xml.attribute ? 'attribute' : Array.isArray(data) && !xml.wrapped ? 'none' : 'element');
+        const elementKind = Array.isArray(data) && !xml.wrapped ? 'none' : 'element';
+        const kind = xml.nodeType ?? (xml.attribute ? 'attribute' : elementKind);
         const selectedComponentName = context.depth === 0 && '$ref' in schema && typeof schema.$ref === 'string'
             ? componentNameFromRef(schema.$ref, context.path)
             : undefined;

package/dist/request-example/xml/write-xml.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"write-xml.d.ts","sourceRoot":"","sources":["../../../src/request-example/xml/write-xml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,gBAAgB,EAAW,OAAO,EAAE,MAAM,YAAY,CAAA;AAUnF,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE5E,uFAAuF;AACvF,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,EAAE,EAAE,UAAS,eAAoB,KAAG,gBA4H1E,CAAA"}
+{"version":3,"file":"write-xml.d.ts","sourceRoot":"","sources":["../../../src/request-example/xml/write-xml.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAiB,gBAAgB,EAAW,OAAO,EAAE,MAAM,YAAY,CAAA;AAWnF,4FAA4F;AAC5F,MAAM,MAAM,eAAe,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,cAAc,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAE5E,uFAAuF;AACvF,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,EAAE,EAAE,UAAS,eAAoB,KAAG,gBA6H1E,CAAA"}

package/dist/request-example/xml/write-xml.js

@@ -3,6 +3,7 @@ const XMLNS_NAMESPACE = 'http://www.w3.org/2000/xmlns/';
 // XML 1.0 (fifth edition) NCName: a QName's prefix and local part cannot contain colons.
 const NAME_START = 'A-Z_a-z\\u00C0-\\u00D6\\u00D8-\\u00F6\\u00F8-\\u02FF\\u0370-\\u037D\\u037F-\\u1FFF\\u200C-\\u200D\\u2070-\\u218F\\u2C00-\\u2FEF\\u3001-\\uD7FF\\uF900-\\uFDCF\\uFDF0-\\uFFFD\\u{10000}-\\u{EFFFF}';
 const namePattern = new RegExp(`^[${NAME_START}][${NAME_START}\\-.0-9\\u00B7\\u0300-\\u036F\\u203F-\\u2040]*$`, 'u');
+// biome-ignore lint/suspicious/noControlCharactersInRegex: Control characters are intentionally matched to validate or sanitize input.
 const invalidCharacter = /[^\u0009\u000A\u000D\u0020-\uD7FF\uE000-\uFFFD\u{10000}-\u{10FFFF}]/u;
 /** Serialize an XML document, validating names, characters, and namespace bindings. */
 export const writeXml = (nodes, options = {}) => {
@@ -10,7 +11,7 @@ export const writeXml = (nodes, options = {}) => {
     const fail = (code, message, path) => {
         diagnostics.push({ severity: 'error', code, message, path });
     };
-    const escape = (value, attribute, path) => {
+    const escapeXml = (value, attribute, path) => {
         if (invalidCharacter.test(value)) {
             fail('invalid-character', 'The value contains a character XML 1.0 cannot represent.', path);
         }
@@ -27,7 +28,7 @@ export const writeXml = (nodes, options = {}) => {
         }
         if (node.type !== 'element') {
             if (node.type === 'text') {
-                return escape(node.value, false, path);
+                return escapeXml(node.value, false, path);
             }
             if (invalidCharacter.test(node.value)) {
                 fail('invalid-character', 'The CDATA contains a character XML 1.0 cannot represent.', path);
@@ -44,7 +45,8 @@ export const writeXml = (nodes, options = {}) => {
                 fail('invalid-name', `Invalid XML name: ${input.prefix ? `${input.prefix}:` : ''}${input.name}`, path);
             }
             let prefix = input.prefix ?? '';
-            const namespace = input.namespace ?? (prefix ? bindings.get(prefix) : attribute ? '' : bindings.get('')) ?? '';
+            const defaultNamespace = attribute ? '' : bindings.get('');
+            const namespace = input.namespace ?? (prefix ? bindings.get(prefix) : defaultNamespace) ?? '';
             if (prefix === 'xmlns' || namespace === XMLNS_NAMESPACE || (attribute && !prefix && input.name === 'xmlns')) {
                 fail('reserved-namespace', 'Namespace declarations must be expressed through XML namespace metadata.', path);
             }
@@ -87,11 +89,11 @@ export const writeXml = (nodes, options = {}) => {
                 fail('duplicate-attribute', `Duplicate XML attribute: ${qualified.name}`, path);
             }
             attributeNames.add(key);
-            return ` ${qualified.name}="${escape(attribute.value, true, path)}"`;
+            return ` ${qualified.name}="${escapeXml(attribute.value, true, path)}"`;
         })
             .join('');
         const namespaces = [...declarations]
-            .map(([prefix, uri]) => ` xmlns${prefix ? `:${prefix}` : ''}="${escape(uri, true, path)}"`)
+            .map(([prefix, uri]) => ` xmlns${prefix ? `:${prefix}` : ''}="${escapeXml(uri, true, path)}"`)
             .join('');
         const opening = `<${element.name}${namespaces}${attributes}`;
         if (node.children.length === 0) {

package/dist/resolve.d.ts

@@ -11,7 +11,7 @@ type ResolvedSchema<T> = T extends undefined ? undefined : Readonly<SchemaObject
     $ref?: string;
 }>;
 export declare const resolve: {
-    schema: <T extends MaybeRefSchemaObject | undefined>(schema: T) => ResolvedSchema<T>;
+    schema: <T extends MaybeRefSchemaObject | boolean | undefined>(schema: T) => ResolvedSchema<T>;
 };
 export {};
 //# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEtF;;;;;;;GAOG;AACH,KAAK,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAWrG,eAAO,MAAM,OAAO;aACT,CAAC,SAAS,oBAAoB,GAAG,SAAS,UAAU,CAAC,KAAG,cAAc,CAAC,CAAC,CAAC;CAQnF,CAAA"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAEtF;;;;;;;GAOG;AACH,KAAK,cAAc,CAAC,CAAC,IAAI,CAAC,SAAS,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,YAAY,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAA;AAoBrG,eAAO,MAAM,OAAO;aACT,CAAC,SAAS,oBAAoB,GAAG,OAAO,GAAG,SAAS,UAAU,CAAC,KAAG,cAAc,CAAC,CAAC,CAAC;CAc7F,CAAA"}

package/dist/resolve.js

@@ -1,4 +1,5 @@
 import { Type } from '@scalar/typebox';
+import { getBooleanSchema } from './helpers/get-boolean-schema.js';
 import { getResolvedRef, mergeSiblingReferences } from './helpers/get-resolved-ref.js';
 import { compose } from './schemas/compose.js';
 import { coerceValue } from './schemas/typebox-coerce.js';
@@ -10,12 +11,26 @@ import { SchemaObjectSchema } from './schemas/v3.2/strict/openapi-document.js';
  * scope. `resolve.schema` runs once per property of every schema a render walks, and rebuilding the
  * composite per call dominated that walk.
  */
-const resolvedSchemaSchema = compose(SchemaObjectSchema, Type.Object({ $ref: Type.Optional(Type.String()) }));
+// Rendering also consumes AsyncAPI schemas. Keep boolean children intact until their own rows
+// resolve them, without widening the object-based OpenAPI document validation types.
+const displaySchemaObject = {
+    ...SchemaObjectSchema,
+    $defs: {
+        ...SchemaObjectSchema.$defs,
+        SchemaObject: Type.Union([SchemaObjectSchema.$defs.SchemaObject, Type.Boolean()]),
+    },
+};
+const resolvedSchemaSchema = compose(displaySchemaObject, Type.Object({ $ref: Type.Optional(Type.String()) }));
 export const resolve = {
     schema: (schema) => {
         if (schema === undefined) {
             return undefined;
         }
+        // Resolve boolean targets before merging siblings, which assumes an object target.
+        const target = getResolvedRef(schema);
+        if (typeof target === 'boolean') {
+            return getBooleanSchema(target);
+        }
         const resoled = getResolvedRef(schema, mergeSiblingReferences);
         return coerceValue(resolvedSchemaSchema, resoled);
     },

package/dist/schemas/extensions/example/x-disabled.d.ts

@@ -14,11 +14,15 @@
  */
 export declare const XDisabledSchema: import("@scalar/typebox").TObject<{
     'x-disabled': import("@scalar/typebox").TOptional<import("@scalar/typebox").TBoolean>;
+    'x-scalar-disabled-properties': import("@scalar/typebox").TOptional<import("@scalar/typebox").TRecord<import("@scalar/typebox").TString, import("@scalar/typebox").TBoolean>>;
 }>;
 export type XDisabled = {
     'x-disabled'?: boolean;
+    /** Per-property overrides keyed by JSON-encoded paths. The empty path stores the inherited default. */
+    'x-scalar-disabled-properties'?: Record<string, boolean>;
 };
 export declare const XDisabled: import("@scalar/validation").ObjectSchema<{
     'x-disabled': import("@scalar/validation").OptionalSchema<import("@scalar/validation").BooleanSchema>;
+    'x-scalar-disabled-properties': import("@scalar/validation").OptionalSchema<import("@scalar/validation").RecordSchema<import("@scalar/validation").StringSchema, import("@scalar/validation").BooleanSchema>>;
 }>;
 //# sourceMappingURL=x-disabled.d.ts.map

package/dist/schemas/extensions/example/x-disabled.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x-disabled.d.ts","sourceRoot":"","sources":["../../../../src/schemas/extensions/example/x-disabled.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe;;EAE1B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB,CAAA;AAED,eAAO,MAAM,SAAS;;EAQrB,CAAA"}
+{"version":3,"file":"x-disabled.d.ts","sourceRoot":"","sources":["../../../../src/schemas/extensions/example/x-disabled.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,eAAe;;;EAG1B,CAAA;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,uGAAuG;IACvG,8BAA8B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACzD,CAAA;AAED,eAAO,MAAM,SAAS;;;EASrB,CAAA"}

package/dist/schemas/extensions/example/x-disabled.js

@@ -1,5 +1,5 @@
 import { Type } from '@scalar/typebox';
-import { boolean, object, optional } from '@scalar/validation';
+import { boolean, object, optional, record, string } from '@scalar/validation';
 /**
  * OpenAPI extension to control whether a parameter example is enabled (checkbox on) or disabled (checkbox off).
  *
@@ -16,9 +16,11 @@ import { boolean, object, optional } from '@scalar/validation';
  */
 export const XDisabledSchema = Type.Object({
     'x-disabled': Type.Optional(Type.Boolean()),
+    'x-scalar-disabled-properties': Type.Optional(Type.Record(Type.String(), Type.Boolean())),
 });
 export const XDisabled = object({
     'x-disabled': optional(boolean()),
+    'x-scalar-disabled-properties': optional(record(string(), boolean())),
 }, {
     typeName: 'XDisabled',
     typeComment: 'Whether a parameter example is disabled in the API client',