@sdk-it/typescript 0.46.3 → 0.46.5

package/dist/index.js

@@ -14,7 +14,6 @@ import {
   cleanFiles,
   readWriteMetadata,
   sanitizeTag as sanitizeTag4,
-  security,
   toIR
 } from "@sdk-it/spec";
 
@@ -121,319 +120,14 @@ var utils_default = "function coerceContext(context?: any) {\n  if (!context) {\
 
 // packages/typescript/src/lib/client.ts
 import { toLitObject } from "@sdk-it/core";
-
-// packages/typescript/src/lib/emitters/zod.ts
-import { followRef, isEmpty, isRef, parseRef, pascalcase } from "@sdk-it/core";
-import { isPrimitiveSchema, sanitizeTag } from "@sdk-it/spec";
-var ZodEmitter = class {
-  #generatedRefs = /* @__PURE__ */ new Set();
-  #spec;
-  #onRef;
-  constructor(spec, onRef) {
-    this.#spec = spec;
-    this.#onRef = onRef;
-  }
-  #object(schema) {
-    const properties = schema.properties || {};
-    const propEntries = Object.entries(properties).map(([key, propSchema]) => {
-      const isRequired = (schema.required ?? []).includes(key);
-      return `'${key}': ${this.handle(propSchema, isRequired)}`;
-    });
-    let additionalProps = "";
-    if (schema.additionalProperties) {
-      if (typeof schema.additionalProperties === "object") {
-        const addPropZod = this.handle(schema.additionalProperties, true);
-        additionalProps = `.catchall(${addPropZod})`;
-      } else if (schema.additionalProperties === true) {
-        additionalProps = `.catchall(z.unknown())`;
-      }
-    }
-    return `z.object({${propEntries.join(", ")}})${additionalProps}`;
-  }
-  #array(schema, required = false) {
-    const { items } = schema;
-    if (!items) {
-      return `z.array(z.unknown())${appendOptional(required)}`;
-    }
-    if (Array.isArray(items)) {
-      const tupleItems = items.map((sub) => this.handle(sub, true));
-      const base = `z.tuple([${tupleItems.join(", ")}])`;
-      return `${base}${appendOptional(required)}`;
-    }
-    const itemsSchema = this.handle(items, true);
-    return `z.array(${itemsSchema})${this.#suffixes(JSON.stringify(schema.default), required, false)}`;
-  }
-  #suffixes = (defaultValue, required, nullable) => {
-    return `${nullable ? ".nullable()" : ""}${appendOptional(required)}${appendDefault(defaultValue)}`;
-  };
-  /**
-   * Convert a basic type (string | number | boolean | object | array, etc.) to Zod.
-   * We'll also handle .optional() if needed.
-   */
-  normal(type, schema, required = false, nullable = false) {
-    switch (type) {
-      case "string": {
-        const defaultVal = (schema["x-zod-type"] === "date" || schema["x-zod-type"] === "coerce-date") && schema.default ? `new Date(${JSON.stringify(schema.default)})` : JSON.stringify(schema.default);
-        return `${this.string(schema)}${this.#suffixes(defaultVal, required, nullable)}`;
-      }
-      case "number":
-      case "integer": {
-        const { base, defaultValue } = this.#number(schema);
-        return `${base}${this.#suffixes(defaultValue, required, nullable)}`;
-      }
-      case "boolean":
-        return `${schema["x-zod-type"] === "coerce-boolean" ? "z.union([z.boolean(), z.stringbool()])" : "z.boolean()"}${this.#suffixes(schema.default, required, nullable)}`;
-      case "object":
-        return `${this.#object(schema)}${this.#suffixes(JSON.stringify(schema.default), required, nullable)}`;
-      // required always
-      case "array":
-        return this.#array(schema, required);
-      case "null":
-        return `z.null()${appendOptional(required)}`;
-      default:
-        return `z.unknown()${appendOptional(required)}`;
-    }
-  }
-  #ref($ref, required) {
-    const schemaName = pascalcase(sanitizeTag(parseRef($ref).model));
-    const schema = followRef(this.#spec, $ref);
-    if (isPrimitiveSchema(schema)) {
-      const result = this.handle(schema, required);
-      this.#onRef?.(schemaName, result);
-      return result;
-    }
-    if (this.#generatedRefs.has(schemaName)) {
-      return schemaName;
-    }
-    this.#generatedRefs.add(schemaName);
-    this.#onRef?.(schemaName, this.handle(schema, required));
-    return schemaName;
-  }
-  #toIntersection(schemas) {
-    const [left, ...right] = schemas;
-    if (!right.length) {
-      return left;
-    }
-    return `z.intersection(${left}, ${this.#toIntersection(right)})`;
-  }
-  allOf(schemas, required) {
-    const allOfSchemas = schemas.map((sub) => this.handle(sub, true));
-    if (allOfSchemas.length === 0) {
-      return `z.unknown()`;
-    }
-    if (allOfSchemas.length === 1) {
-      return `${allOfSchemas[0]}${appendOptional(required)}`;
-    }
-    return `${this.#toIntersection(allOfSchemas)}${appendOptional(required)}`;
-  }
-  anyOf(schemas, required) {
-    const anyOfSchemas = schemas.map((sub) => this.handle(sub, true));
-    if (anyOfSchemas.length === 1) {
-      return `${anyOfSchemas[0]}${appendOptional(required)}`;
-    }
-    return `z.union([${anyOfSchemas.join(", ")}])${appendOptional(required)}`;
-  }
-  oneOf(schemas, required) {
-    const oneOfSchemas = schemas.map((sub) => this.handle(sub, true));
-    if (oneOfSchemas.length === 1) {
-      return `${oneOfSchemas[0]}${appendOptional(required)}`;
-    }
-    return `z.xor([${oneOfSchemas.join(", ")}])${appendOptional(required)}`;
-  }
-  enum(type, values) {
-    if (values.length === 1) {
-      return `z.literal(${values.join(", ")})`;
-    }
-    if (values.every((value) => String(value).startsWith('"'))) {
-      return `z.enum([${values.join(", ")}])`;
-    }
-    return `z.literal([${values.join(", ")}])`;
-  }
-  /**
-   * Handle a `string` schema with possible format keywords (JSON Schema).
-   */
-  string(schema) {
-    let base = schema["x-zod-type"] === "coerce-string" ? "z.coerce.string()" : "z.string()";
-    if (schema.contentEncoding === "binary") {
-      base = "z.custom<Blob>()";
-      return base;
-    }
-    const coerced = schema["x-zod-type"] === "coerce-string";
-    const withFormat = (format) => coerced ? `${base}.pipe(${format})` : format;
-    switch (schema.format) {
-      case "date-time":
-      case "datetime":
-        if (schema["x-zod-type"] === "coerce-date") {
-          base = "z.coerce.date()";
-        } else if (schema["x-zod-type"] === "date") {
-          base = "z.date()";
-        } else {
-          base = withFormat("z.iso.datetime({ offset: true })");
-        }
-        break;
-      case "date":
-        base = withFormat("z.iso.date()");
-        break;
-      case "time":
-        base = withFormat(
-          "z.string().regex(/^([01]\\d|2[0-3]):[0-5]\\d(:[0-5]\\d(\\.\\d+)?)?(Z|[+-]([01]\\d|2[0-3]):[0-5]\\d)?$/)"
-        );
-        break;
-      case "email":
-        base = withFormat("z.email()");
-        break;
-      case "uuid":
-        base = withFormat("z.guid()");
-        break;
-      case "url":
-      case "uri":
-        base = withFormat("z.url()");
-        break;
-      case "ipv4":
-        base = withFormat("z.ipv4()");
-        break;
-      case "ipv6":
-        base = withFormat("z.ipv6()");
-        break;
-      case "cidrv4":
-        base = withFormat("z.cidrv4()");
-        break;
-      case "cidrv6":
-        base = withFormat("z.cidrv6()");
-        break;
-      case "phone":
-        base += " /* or add .regex(...) for phone formats */";
-        break;
-      case "byte":
-      case "binary":
-        base = "z.custom<Blob>()";
-        break;
-      default:
-        break;
-    }
-    return base;
-  }
-  /**
-   * Handle number/integer constraints from OpenAPI/JSON Schema.
-   * In 3.1, exclusiveMinimum/Maximum hold the actual numeric threshold,
-   * rather than a boolean toggling `minimum`/`maximum`.
-   */
-  #number(schema) {
-    let base = schema["x-zod-type"] === "coerce-number" ? "z.coerce.number()" : "z.number()";
-    if (schema.type === "integer") {
-      base += ".int()";
-    }
-    if (typeof schema.exclusiveMinimum === "number") {
-      base += `.gt(${schema.exclusiveMinimum})`;
-    }
-    if (typeof schema.exclusiveMaximum === "number") {
-      base += `.lt(${schema.exclusiveMaximum})`;
-    }
-    if (typeof schema.minimum === "number") {
-      base += `.min(${schema.minimum})`;
-    }
-    if (typeof schema.maximum === "number") {
-      base += `.max(${schema.maximum})`;
-    }
-    if (typeof schema.multipleOf === "number") {
-      base += `.refine((val) => Number.isInteger(val / ${schema.multipleOf}), "Must be a multiple of ${schema.multipleOf}")`;
-    }
-    return { base, defaultValue: schema.default };
-  }
-  handle(schema, required) {
-    if (isRef(schema)) {
-      return `${this.#ref(schema.$ref, true)}${appendOptional(required)}`;
-    }
-    if (schema.not && isEmpty(schema.not)) {
-      return `z.never()${appendOptional(required)}`;
-    }
-    if (schema.allOf && Array.isArray(schema.allOf)) {
-      return this.allOf(schema.allOf ?? [], required);
-    }
-    if (schema.anyOf && Array.isArray(schema.anyOf)) {
-      return this.anyOf(schema.anyOf ?? [], required);
-    }
-    if (schema.oneOf && Array.isArray(schema.oneOf) && schema.oneOf.length) {
-      return this.oneOf(schema.oneOf ?? [], required);
-    }
-    if (schema.const !== void 0) {
-      return `z.literal(${JSON.stringify(schema.const)})${this.#suffixes(JSON.stringify(schema.default), required, false)}`;
-    }
-    if (schema.enum && Array.isArray(schema.enum)) {
-      const enumVals = schema.enum.map((val) => JSON.stringify(val));
-      const defaultValue = enumVals.includes(JSON.stringify(schema.default)) ? JSON.stringify(schema.default) : void 0;
-      return `${this.enum(schema.type, enumVals)}${this.#suffixes(defaultValue, required, false)}`;
-    }
-    const types = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
-    if (!types.length) {
-      return `z.unknown()${appendOptional(required)}`;
-    }
-    if ("nullable" in schema && schema.nullable) {
-      types.push("null");
-    } else if (schema.default === null) {
-      types.push("null");
-    }
-    if (types.length > 1) {
-      const realTypes = types.filter((t) => t !== "null");
-      if (realTypes.length === 1 && types.includes("null")) {
-        return this.normal(realTypes[0], schema, required, true);
-      }
-      const subSchemas = types.map((t) => this.normal(t, schema, false));
-      return `z.union([${subSchemas.join(", ")}])${appendOptional(required)}`;
-    }
-    return this.normal(types[0], schema, required, false);
-  }
-};
-function appendOptional(isRequired) {
-  return isRequired ? "" : ".optional()";
-}
-function appendDefault(defaultValue) {
-  return defaultValue !== void 0 || typeof defaultValue !== "undefined" ? `.default(${defaultValue})` : "";
-}
-function toZod(schema, required) {
-  const emitter = new ZodEmitter({});
-  const schemaStr = emitter.handle(schema, required ?? false);
-  if (schema["x-prefix"]) {
-    const prefix = schema["x-prefix"];
-    if (required === false) {
-      return schemaStr + `.transform((val) => (val ? \`${prefix}\${val}\` : undefined))`;
-    } else {
-      return schemaStr + `.transform((val) => \`${prefix}\${val}\`)`;
-    }
-  }
-  return schemaStr;
-}
-
-// packages/typescript/src/lib/client.ts
 var client_default = (spec) => {
   const callableString = `z.custom<() => string | Promise<string>>((value) => typeof value === 'function')`;
-  const baseUrlSchema = `z.union([z.string(),${callableString},])${spec.servers.length ? ".default(servers[0])" : ""}`;
-  const defaultHeaders = `{${spec.options.filter((value) => value.in === "header").map(
-    (value) => `'${value.name}': options['${value["x-optionName"] ?? value.name}']`
-  ).join(",\n")}}`;
-  const defaultInputs = `{${spec.options.filter((value) => value.in === "input").map(
-    (value) => `'${value.name}': options['${value["x-optionName"] ?? value.name}']`
-  ).join(",\n")}}`;
-  const globalOptions = Object.fromEntries(
-    spec.options.map((value) => [
-      `'${value["x-optionName"] ?? value.name}'`,
-      { schema: toZod(value.schema, value.required) }
-    ])
-  );
+  const baseUrlSchema = `z.union([z.string(),${callableString},])${spec.servers.length === 1 ? ".default(servers[0])" : ""}`;
+  const securitySchemeNames = Object.keys(spec.securitySchemes);
   const specOptions = {
-    ...globalOptions,
-    ...globalOptions["'token'"] ? {
-      "'token'": {
-        schema: `z.union([z.string(),${callableString},]).optional()
-    .transform(async (token, ctx) => {
-      if (!token) return undefined;
-      const value = typeof token === 'function' ? await token() : token;
-      if (typeof value !== 'string') {
-        ctx.addIssue({ code: 'custom', message: 'token must resolve to a string' });
-        return z.NEVER;
-      }
-      return \`Bearer \${value}\`;
-    }).describe('Bearer token for authentication. Can be a string or a function that returns a string.')`
+    ...securitySchemeNames.length ? {
+      credentials: {
+        schema: `credentialsSchema.optional().describe('Credentials keyed by OpenAPI security scheme name.')`
       }
     } : {},
     fetch: {
@@ -467,7 +161,14 @@ import {
   createHeadersInterceptor,
 } from './http/${spec.makeImport("interceptors")}';
 
-import { type ParseError, parseInput } from './http/${spec.makeImport("parser")}';
+import { type ParseError, parseInput } from './http/${spec.makeImport("parser")}';${securitySchemeNames.length ? `
+import { credentialsSchema, createSecurityInterceptor } from './http/${spec.makeImport("security")}';
+export type {
+  SecurityContext,
+  SecurityCredential,
+  SecurityCredentialProvider,
+  SecurityCredentialValue,
+} from './http/${spec.makeImport("security")}';` : ""}
 
 ${spec.servers.length ? `export const servers = ${JSON.stringify(spec.servers, null, 2)} as const` : ""}
 const optionsSchema = z.object(${toLitObject(specOptions, (x) => x.schema)});
@@ -508,15 +209,7 @@ export class ${spec.name} {
 
   async defaultHeaders() {
     const options = await optionsSchema.parseAsync(this.options);
-    return {
-      ...${defaultHeaders},
-      ...options.headers,
-    };
-  }
-
-  async defaultInputs() {
-    const options = await optionsSchema.parseAsync(this.options);
-    return ${defaultInputs}
+    return { ...options.headers };
   }
 
   setOptions(options: Partial<${spec.name}Options>) {
@@ -530,7 +223,7 @@ export class ${spec.name} {
 
 /**
  * Sends a validated request using the client's configuration and returns the parsed response.
- * Merges the client's default inputs and headers before sending.
+ * Applies the client's default headers before sending.
  * Throws \`APIError\` on non-ok responses.
  *
  * @example
@@ -546,20 +239,15 @@ export async function request<const E extends keyof typeof schemas>(
 ): Promise<Awaited<ReturnType<(typeof schemas)[E]['dispatch']>>> {
   const route = schemas[endpoint];
   const options = await optionsSchema.parseAsync(client.options);
-  const withDefaultInputs = Object.assign(
-    {},
-    ${defaultInputs},
-    input,
-  );
-  const parsedInput = options.skipValidation ? withDefaultInputs : parseInput(route.schema, withDefaultInputs);
+  const parsedInput = options.skipValidation ? input : parseInput(route.schema, input);
   const result = await route.dispatch(parsedInput as never, {
     fetch: options.fetch,
     interceptors: [
       createHeadersInterceptor(
-        { ...${defaultHeaders}, ...options.headers },
+        { ...options.headers },
         requestOptions?.headers ?? {},
       ),
-      createBaseUrlInterceptor(options.baseUrl),
+${securitySchemeNames.length ? "      createSecurityInterceptor(route.security, options.credentials),\n" : ""}      createBaseUrlInterceptor(options.baseUrl),
     ],
     signal: requestOptions?.signal,
   });
@@ -588,18 +276,13 @@ export async function prepare<const E extends keyof typeof schemas>(
 }> {
   const route = schemas[endpoint];
   const options = await optionsSchema.parseAsync(client.options);
-  const withDefaultInputs = Object.assign(
-    {},
-    ${defaultInputs},
-    input,
-  );
-  const parsedInput = options.skipValidation ? withDefaultInputs : parseInput(route.schema, withDefaultInputs);
+  const parsedInput = options.skipValidation ? input : parseInput(route.schema, input);
   const interceptors = [
     createHeadersInterceptor(
-      { ...${defaultHeaders}, ...options.headers },
+      { ...options.headers },
       requestOptions?.headers ?? {},
     ),
-    createBaseUrlInterceptor(options.baseUrl),
+${securitySchemeNames.length ? "    createSecurityInterceptor(route.security, options.credentials),\n" : ""}    createBaseUrlInterceptor(options.baseUrl),
   ];
 
   let config = route.toRequest(parsedInput as never);
@@ -626,14 +309,14 @@ export async function prepare<const E extends keyof typeof schemas>(
 
 // packages/typescript/src/lib/emitters/interface.ts
 import {
-  followRef as followRef2,
-  isEmpty as isEmpty2,
-  isRef as isRef2,
-  parseRef as parseRef2,
-  pascalcase as pascalcase2,
+  followRef,
+  isEmpty,
+  isRef,
+  parseRef,
+  pascalcase,
   resolveRef
 } from "@sdk-it/core";
-import { isPrimitiveSchema as isPrimitiveSchema2, sanitizeTag as sanitizeTag2 } from "@sdk-it/spec";
+import { isPrimitiveSchema, sanitizeTag } from "@sdk-it/spec";
 var TypeScriptEmitter = class {
   #spec;
   constructor(spec) {
@@ -685,7 +368,7 @@ var TypeScriptEmitter = class {
       case "integer":
         return this.number(schema, required);
       case "boolean":
-        return appendOptional2("boolean", required);
+        return appendOptional("boolean", required);
       case "object":
         return this.object(schema, required);
       case "array":
@@ -694,16 +377,16 @@ var TypeScriptEmitter = class {
         return "null";
       default:
         console.warn(`Unknown type: ${type}`);
-        return appendOptional2("any", required);
+        return appendOptional("any", required);
     }
   }
   #ref($ref, required) {
-    const schemaName = pascalcase2(sanitizeTag2(parseRef2($ref).model));
-    const schema = followRef2(this.#spec, $ref);
-    if (isPrimitiveSchema2(schema)) {
+    const schemaName = pascalcase(sanitizeTag(parseRef($ref).model));
+    const schema = followRef(this.#spec, $ref);
+    if (isPrimitiveSchema(schema)) {
       return this.handle(schema, required);
     }
-    return `models.${appendOptional2(schemaName, required)}`;
+    return `models.${appendOptional(schemaName, required)}`;
   }
   allOf(schemas) {
     const allOfTypes = schemas.map((sub) => this.handle(sub, true));
@@ -727,104 +410,395 @@ var TypeScriptEmitter = class {
       seen.add(part);
       oneOfTypes.push(part);
     }
-    return appendOptional2(
-      oneOfTypes.length > 1 ? `${oneOfTypes.join(" | ")}` : oneOfTypes[0],
-      required
-    );
+    return appendOptional(
+      oneOfTypes.length > 1 ? `${oneOfTypes.join(" | ")}` : oneOfTypes[0],
+      required
+    );
+  }
+  anyOf(schemas, required) {
+    return this.oneOf(schemas, required);
+  }
+  enum(values, required) {
+    const enumValues = values.map((val) => typeof val === "string" ? `'${val}'` : `${val}`).join(" | ");
+    return appendOptional(enumValues, required);
+  }
+  /**
+   * Handle string type with formats
+   */
+  string(schema, required) {
+    let type;
+    if (schema.contentEncoding === "binary") {
+      return appendOptional("Blob", required);
+    }
+    switch (schema.format) {
+      case "date-time":
+      case "datetime":
+      case "date":
+        type = "string";
+        break;
+      case "binary":
+      case "byte":
+        type = "Blob";
+        break;
+      default:
+        type = "string";
+    }
+    return appendOptional(type, required);
+  }
+  /**
+   * Handle number/integer types with formats
+   */
+  number(_schema, required) {
+    return appendOptional("number", required);
+  }
+  handle(schema, required) {
+    if (isRef(schema)) {
+      return this.#ref(schema.$ref, required);
+    }
+    if (schema.not && isEmpty(schema.not)) {
+      return appendOptional("never", required);
+    }
+    if (schema.allOf && Array.isArray(schema.allOf)) {
+      return this.allOf(schema.allOf);
+    }
+    if (schema.anyOf && Array.isArray(schema.anyOf)) {
+      return this.anyOf(schema.anyOf, required);
+    }
+    if (schema.oneOf && Array.isArray(schema.oneOf)) {
+      return this.oneOf(schema.oneOf, required);
+    }
+    if (schema.enum && Array.isArray(schema.enum)) {
+      return this.enum(schema.enum, required);
+    }
+    if (schema.const) {
+      return this.enum([schema.const], true);
+    }
+    const types = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
+    if (!types.length) {
+      if ("properties" in schema) {
+        return this.object(schema, required);
+      }
+      return appendOptional("any", required);
+    }
+    if (types.length > 1) {
+      const realTypes = types.filter((t) => t !== "null");
+      if (realTypes.length === 1 && types.includes("null")) {
+        const tsType = this.normal(realTypes[0], schema, true);
+        return appendOptional(`${tsType} | null`, required);
+      }
+      const typeResults = types.map((t) => this.normal(t, schema, true));
+      return appendOptional(typeResults.join(" | "), required);
+    }
+    return this.normal(types[0], schema, required);
+  }
+};
+function appendOptional(type, isRequired) {
+  return isRequired ? type : `${type} | undefined`;
+}
+
+// packages/typescript/src/lib/generator.ts
+import { merge, template } from "lodash-es";
+import { join } from "node:path";
+import { camelcase as camelcase4, spinalcase as spinalcase2 } from "stringcase";
+import {
+  followRef as followRef3,
+  isEmpty as isEmpty4,
+  isRef as isRef3,
+  resolveRef as resolveRef2,
+  sortArray
+} from "@sdk-it/core";
+import {
+  forEachOperation as forEachOperation3
+} from "@sdk-it/spec";
+
+// packages/typescript/src/lib/emitters/zod.ts
+import {
+  followRef as followRef2,
+  isEmpty as isEmpty2,
+  isRef as isRef2,
+  parseRef as parseRef2,
+  pascalcase as pascalcase2
+} from "@sdk-it/core";
+import { isPrimitiveSchema as isPrimitiveSchema2, sanitizeTag as sanitizeTag2 } from "@sdk-it/spec";
+var ZodEmitter = class {
+  #generatedRefs = /* @__PURE__ */ new Set();
+  #spec;
+  #onRef;
+  constructor(spec, onRef) {
+    this.#spec = spec;
+    this.#onRef = onRef;
+  }
+  #object(schema) {
+    const properties = schema.properties || {};
+    const propEntries = Object.entries(properties).map(([key, propSchema]) => {
+      const isRequired = (schema.required ?? []).includes(key);
+      return `'${key}': ${this.handle(propSchema, isRequired)}`;
+    });
+    let additionalProps = "";
+    if (schema.additionalProperties) {
+      if (typeof schema.additionalProperties === "object") {
+        const addPropZod = this.handle(schema.additionalProperties, true);
+        additionalProps = `.catchall(${addPropZod})`;
+      } else if (schema.additionalProperties === true) {
+        additionalProps = `.catchall(z.unknown())`;
+      }
+    }
+    return `z.object({${propEntries.join(", ")}})${additionalProps}`;
+  }
+  #array(schema, required = false) {
+    const { items } = schema;
+    if (!items) {
+      return `z.array(z.unknown())${appendOptional2(required)}`;
+    }
+    if (Array.isArray(items)) {
+      const tupleItems = items.map((sub) => this.handle(sub, true));
+      const base = `z.tuple([${tupleItems.join(", ")}])`;
+      return `${base}${appendOptional2(required)}`;
+    }
+    const itemsSchema = this.handle(items, true);
+    return `z.array(${itemsSchema})${this.#suffixes(JSON.stringify(schema.default), required, false)}`;
+  }
+  #suffixes = (defaultValue, required, nullable) => {
+    return `${nullable ? ".nullable()" : ""}${appendOptional2(required)}${appendDefault(defaultValue)}`;
+  };
+  /**
+   * Convert a basic type (string | number | boolean | object | array, etc.) to Zod.
+   * We'll also handle .optional() if needed.
+   */
+  normal(type, schema, required = false, nullable = false) {
+    switch (type) {
+      case "string": {
+        const defaultVal = (schema["x-zod-type"] === "date" || schema["x-zod-type"] === "coerce-date") && schema.default ? `new Date(${JSON.stringify(schema.default)})` : JSON.stringify(schema.default);
+        return `${this.string(schema)}${this.#suffixes(defaultVal, required, nullable)}`;
+      }
+      case "number":
+      case "integer": {
+        const { base, defaultValue } = this.#number(schema);
+        return `${base}${this.#suffixes(defaultValue, required, nullable)}`;
+      }
+      case "boolean":
+        return `${schema["x-zod-type"] === "coerce-boolean" ? "z.union([z.boolean(), z.stringbool()])" : "z.boolean()"}${this.#suffixes(schema.default, required, nullable)}`;
+      case "object":
+        return `${this.#object(schema)}${this.#suffixes(JSON.stringify(schema.default), required, nullable)}`;
+      // required always
+      case "array":
+        return this.#array(schema, required);
+      case "null":
+        return `z.null()${appendOptional2(required)}`;
+      default:
+        return `z.unknown()${appendOptional2(required)}`;
+    }
+  }
+  #ref($ref, required) {
+    const schemaName = pascalcase2(sanitizeTag2(parseRef2($ref).model));
+    const schema = followRef2(this.#spec, $ref);
+    if (isPrimitiveSchema2(schema)) {
+      const result = this.handle(schema, required);
+      this.#onRef?.(schemaName, result);
+      return result;
+    }
+    if (this.#generatedRefs.has(schemaName)) {
+      return schemaName;
+    }
+    this.#generatedRefs.add(schemaName);
+    this.#onRef?.(schemaName, this.handle(schema, required));
+    return schemaName;
+  }
+  #toIntersection(schemas) {
+    const [left, ...right] = schemas;
+    if (!right.length) {
+      return left;
+    }
+    return `z.intersection(${left}, ${this.#toIntersection(right)})`;
+  }
+  allOf(schemas, required) {
+    const allOfSchemas = schemas.map((sub) => this.handle(sub, true));
+    if (allOfSchemas.length === 0) {
+      return `z.unknown()`;
+    }
+    if (allOfSchemas.length === 1) {
+      return `${allOfSchemas[0]}${appendOptional2(required)}`;
+    }
+    return `${this.#toIntersection(allOfSchemas)}${appendOptional2(required)}`;
   }
   anyOf(schemas, required) {
-    return this.oneOf(schemas, required);
+    const anyOfSchemas = schemas.map((sub) => this.handle(sub, true));
+    if (anyOfSchemas.length === 1) {
+      return `${anyOfSchemas[0]}${appendOptional2(required)}`;
+    }
+    return `z.union([${anyOfSchemas.join(", ")}])${appendOptional2(required)}`;
   }
-  enum(values, required) {
-    const enumValues = values.map((val) => typeof val === "string" ? `'${val}'` : `${val}`).join(" | ");
-    return appendOptional2(enumValues, required);
+  oneOf(schemas, required) {
+    const oneOfSchemas = schemas.map((sub) => this.handle(sub, true));
+    if (oneOfSchemas.length === 1) {
+      return `${oneOfSchemas[0]}${appendOptional2(required)}`;
+    }
+    return `z.xor([${oneOfSchemas.join(", ")}])${appendOptional2(required)}`;
+  }
+  enum(type, values) {
+    if (values.length === 1) {
+      return `z.literal(${values.join(", ")})`;
+    }
+    if (values.every((value) => String(value).startsWith('"'))) {
+      return `z.enum([${values.join(", ")}])`;
+    }
+    return `z.literal([${values.join(", ")}])`;
   }
   /**
-   * Handle string type with formats
+   * Handle a `string` schema with possible format keywords (JSON Schema).
    */
-  string(schema, required) {
-    let type;
+  string(schema) {
+    let base = schema["x-zod-type"] === "coerce-string" ? "z.coerce.string()" : "z.string()";
     if (schema.contentEncoding === "binary") {
-      return appendOptional2("Blob", required);
+      base = "z.custom<Blob>()";
+      return base;
     }
+    const coerced = schema["x-zod-type"] === "coerce-string";
+    const withFormat = (format) => coerced ? `${base}.pipe(${format})` : format;
     switch (schema.format) {
       case "date-time":
       case "datetime":
+        if (schema["x-zod-type"] === "coerce-date") {
+          base = "z.coerce.date()";
+        } else if (schema["x-zod-type"] === "date") {
+          base = "z.date()";
+        } else {
+          base = withFormat("z.iso.datetime({ offset: true })");
+        }
+        break;
       case "date":
-        type = "string";
+        base = withFormat("z.iso.date()");
+        break;
+      case "time":
+        base = withFormat(
+          "z.string().regex(/^([01]\\d|2[0-3]):[0-5]\\d(:[0-5]\\d(\\.\\d+)?)?(Z|[+-]([01]\\d|2[0-3]):[0-5]\\d)?$/)"
+        );
+        break;
+      case "email":
+        base = withFormat("z.email()");
+        break;
+      case "uuid":
+        base = withFormat("z.guid()");
+        break;
+      case "url":
+      case "uri":
+        base = withFormat("z.url()");
+        break;
+      case "ipv4":
+        base = withFormat("z.ipv4()");
+        break;
+      case "ipv6":
+        base = withFormat("z.ipv6()");
+        break;
+      case "cidrv4":
+        base = withFormat("z.cidrv4()");
+        break;
+      case "cidrv6":
+        base = withFormat("z.cidrv6()");
+        break;
+      case "phone":
+        base += " /* or add .regex(...) for phone formats */";
         break;
-      case "binary":
       case "byte":
-        type = "Blob";
+      case "binary":
+        base = "z.custom<Blob>()";
         break;
       default:
-        type = "string";
+        break;
     }
-    return appendOptional2(type, required);
+    return base;
   }
   /**
-   * Handle number/integer types with formats
+   * Handle number/integer constraints from OpenAPI/JSON Schema.
+   * In 3.1, exclusiveMinimum/Maximum hold the actual numeric threshold,
+   * rather than a boolean toggling `minimum`/`maximum`.
    */
-  number(_schema, required) {
-    return appendOptional2("number", required);
+  #number(schema) {
+    let base = schema["x-zod-type"] === "coerce-number" ? "z.coerce.number()" : "z.number()";
+    if (schema.type === "integer") {
+      base += ".int()";
+    }
+    if (typeof schema.exclusiveMinimum === "number") {
+      base += `.gt(${schema.exclusiveMinimum})`;
+    }
+    if (typeof schema.exclusiveMaximum === "number") {
+      base += `.lt(${schema.exclusiveMaximum})`;
+    }
+    if (typeof schema.minimum === "number") {
+      base += `.min(${schema.minimum})`;
+    }
+    if (typeof schema.maximum === "number") {
+      base += `.max(${schema.maximum})`;
+    }
+    if (typeof schema.multipleOf === "number") {
+      base += `.refine((val) => Number.isInteger(val / ${schema.multipleOf}), "Must be a multiple of ${schema.multipleOf}")`;
+    }
+    return { base, defaultValue: schema.default };
   }
   handle(schema, required) {
     if (isRef2(schema)) {
-      return this.#ref(schema.$ref, required);
+      return `${this.#ref(schema.$ref, true)}${appendOptional2(required)}`;
     }
     if (schema.not && isEmpty2(schema.not)) {
-      return appendOptional2("never", required);
+      return `z.never()${appendOptional2(required)}`;
     }
     if (schema.allOf && Array.isArray(schema.allOf)) {
-      return this.allOf(schema.allOf);
+      return this.allOf(schema.allOf ?? [], required);
     }
     if (schema.anyOf && Array.isArray(schema.anyOf)) {
-      return this.anyOf(schema.anyOf, required);
+      return this.anyOf(schema.anyOf ?? [], required);
     }
-    if (schema.oneOf && Array.isArray(schema.oneOf)) {
-      return this.oneOf(schema.oneOf, required);
+    if (schema.oneOf && Array.isArray(schema.oneOf) && schema.oneOf.length) {
+      return this.oneOf(schema.oneOf ?? [], required);
     }
-    if (schema.enum && Array.isArray(schema.enum)) {
-      return this.enum(schema.enum, required);
+    if (schema.const !== void 0) {
+      return `z.literal(${JSON.stringify(schema.const)})${this.#suffixes(JSON.stringify(schema.default), required, false)}`;
     }
-    if (schema.const) {
-      return this.enum([schema.const], true);
+    if (schema.enum && Array.isArray(schema.enum)) {
+      const enumVals = schema.enum.map((val) => JSON.stringify(val));
+      const defaultValue = enumVals.includes(JSON.stringify(schema.default)) ? JSON.stringify(schema.default) : void 0;
+      return `${this.enum(schema.type, enumVals)}${this.#suffixes(defaultValue, required, false)}`;
     }
     const types = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
     if (!types.length) {
-      if ("properties" in schema) {
-        return this.object(schema, required);
-      }
-      return appendOptional2("any", required);
+      return `z.unknown()${appendOptional2(required)}`;
+    }
+    if ("nullable" in schema && schema.nullable) {
+      types.push("null");
+    } else if (schema.default === null) {
+      types.push("null");
     }
     if (types.length > 1) {
       const realTypes = types.filter((t) => t !== "null");
       if (realTypes.length === 1 && types.includes("null")) {
-        const tsType = this.normal(realTypes[0], schema, false);
-        return appendOptional2(`${tsType} | null`, required);
+        return this.normal(
+          realTypes[0],
+          { ...schema, type: realTypes[0] },
+          required,
+          true
+        );
       }
-      const typeResults = types.map((t) => this.normal(t, schema, false));
-      return appendOptional2(typeResults.join(" | "), required);
+      const subSchemas = types.map(
+        (t) => this.normal(t, { ...schema, type: t }, true)
+      );
+      return `z.union([${subSchemas.join(", ")}])${appendOptional2(required)}`;
     }
-    return this.normal(types[0], schema, required);
+    return this.normal(types[0], schema, required, false);
   }
 };
-function appendOptional2(type, isRequired) {
-  return isRequired ? type : `${type} | undefined`;
+function appendOptional2(isRequired) {
+  return isRequired ? "" : ".optional()";
+}
+function appendDefault(defaultValue) {
+  return defaultValue !== void 0 || typeof defaultValue !== "undefined" ? `.default(${defaultValue})` : "";
 }
-
-// packages/typescript/src/lib/generator.ts
-import { merge, template } from "lodash-es";
-import { join } from "node:path";
-import { camelcase as camelcase4, spinalcase as spinalcase2 } from "stringcase";
-import { followRef as followRef3, isEmpty as isEmpty4, isRef as isRef3, resolveRef as resolveRef2, sortArray } from "@sdk-it/core";
-import {
-  forEachOperation as forEachOperation3
-} from "@sdk-it/spec";
 
 // packages/typescript/src/lib/sdk.ts
 import { camelcase as camelcase3 } from "stringcase";
-import { isEmpty as isEmpty3, pascalcase as pascalcase3 } from "@sdk-it/core";
+import {
+  isEmpty as isEmpty3,
+  pascalcase as pascalcase3
+} from "@sdk-it/core";
 import {
   isBinaryContentType,
   isSseContentType,
@@ -949,6 +923,7 @@ function toEndpoint(groupName, spec, specOperation, operation) {
     const endpoint = `${typePrefix}${operation.method.toUpperCase()} ${operation.path}`;
     schemas.push(
       `"${endpoint}": {
+          security: ${JSON.stringify(specOperation.security ?? [])} as readonly Record<string, readonly string[]>[],
           schema: ${schemaRef}${addTypeParser ? `.${type}` : ""},
           output:[${outputs.join(",")}],
           toRequest(input: z.input<typeof ${schemaRef}${addTypeParser ? `.${type}` : ""}>) {
@@ -1754,6 +1729,198 @@ ${l}`));
   return markdown.join("\n\n");
 }
 
+// packages/typescript/src/lib/security.ts
+var security_default = (spec) => {
+  const securitySchemes = JSON.stringify(spec.securitySchemes, null, 2);
+  const credentialProperties = Object.entries(spec.securitySchemes).map(([name, scheme]) => {
+    const schema = scheme.type === "mutualTLS" ? "mutualTlsCredentialSchema" : scheme.type === "http" && scheme.scheme?.toLowerCase() === "basic" ? "basicCredentialSchema" : "stringCredentialSchema";
+    return `${JSON.stringify(name)}: ${schema}.optional()`;
+  }).join(",\n");
+  return `import z from 'zod';
+import type { Interceptor } from './${spec.makeImport("interceptors")}';
+import type { RequestConfig } from './${spec.makeImport("request")}';
+
+export type SecurityContext = {
+  scheme: string;
+  scopes: readonly string[];
+  roles: readonly string[];
+};
+export type SecurityCredentialValue = string | true | {
+  username: string;
+  password: string;
+};
+export type SecurityCredentialProvider<T extends SecurityCredentialValue> = (
+  context: SecurityContext
+) => T | Promise<T>;
+export type SecurityCredential<
+  T extends SecurityCredentialValue = SecurityCredentialValue,
+> = T | SecurityCredentialProvider<T>;
+
+const providerSchema = <T extends SecurityCredentialValue>() =>
+  z.custom<SecurityCredentialProvider<T>>((value) => typeof value === 'function');
+const stringCredentialSchema = z.union([
+  z.string(),
+  providerSchema<string>(),
+]);
+const basicCredentialValueSchema = z.object({
+  username: z.string(),
+  password: z.string(),
+});
+const basicCredentialSchema = z.union([
+  basicCredentialValueSchema,
+  providerSchema<{ username: string; password: string }>(),
+]);
+const mutualTlsCredentialSchema = z.union([
+  z.literal(true),
+  providerSchema<true>(),
+]);
+export const credentialsSchema = z.object({${credentialProperties}});
+
+type RuntimeSecurityScheme =
+  | { type: 'apiKey'; in: 'header' | 'query' | 'cookie'; name: string }
+  | { type: 'http'; scheme: string }
+  | { type: 'oauth2' }
+  | { type: 'openIdConnect' }
+  | { type: 'mutualTLS' };
+const securitySchemes = ${securitySchemes} as const;
+
+export function createSecurityInterceptor(
+  requirements: readonly Record<string, readonly string[]>[],
+  credentials: Record<string, SecurityCredential | undefined> | undefined,
+): Interceptor {
+  return {
+    async before(config) {
+      if (requirements.length === 0) return config;
+      const secured = requirements.filter(
+        (requirement) => Object.keys(requirement).length > 0,
+      );
+      const selected = secured.find((requirement) =>
+        Object.keys(requirement).every(
+          (name) => credentials?.[name] !== undefined,
+        ),
+      );
+      if (!selected) {
+        if (requirements.some(
+          (requirement) => Object.keys(requirement).length === 0,
+        )) return config;
+        throw new Error(
+          \`Missing credentials for security requirements: \${secured
+            .map((requirement) => Object.keys(requirement).join(' + '))
+            .join(' or ')}\`,
+        );
+      }
+      for (const [name, values] of Object.entries(selected)) {
+        const scheme = securitySchemes[
+          name as keyof typeof securitySchemes
+        ] as RuntimeSecurityScheme | undefined;
+        if (!scheme) {
+          throw new Error(\`Unsupported external security scheme: \${name}\`);
+        }
+        const configured = credentials?.[name];
+        const isOAuth = scheme.type === 'oauth2' || scheme.type === 'openIdConnect';
+        const credential = typeof configured === 'function'
+          ? await configured({
+              scheme: name,
+              scopes: isOAuth ? values : [],
+              roles: isOAuth ? [] : values,
+            })
+          : configured;
+        applyCredential(config, scheme, credential);
+      }
+      return config;
+    },
+  };
+}
+
+function applyCredential(
+  config: RequestConfig,
+  scheme: RuntimeSecurityScheme,
+  credential: SecurityCredentialValue | undefined,
+) {
+  if (credential === undefined) {
+    throw new Error('Security credential provider returned no credential');
+  }
+  if (scheme.type === 'apiKey') {
+    if (typeof credential !== 'string') {
+      throw new TypeError('API key credentials must be strings');
+    }
+    if (scheme.in === 'header') {
+      if (!config.init.headers.has(scheme.name)) {
+        config.init.headers.set(scheme.name, credential);
+      }
+    } else if (scheme.in === 'query') {
+      if (!config.url.searchParams.has(scheme.name)) {
+        config.url.searchParams.set(scheme.name, credential);
+      }
+    } else if (scheme.in === 'cookie') {
+      if ('document' in globalThis) {
+        throw new Error(
+          \`Cannot send the \${scheme.name} cookie credential: browsers forbid setting the Cookie header. Let the browser send the cookie and pass a fetch that sets credentials: 'include'.\`,
+        );
+      }
+      const cookie = \`\${scheme.name}=\${encodeURIComponent(credential)}\`;
+      const existing = config.init.headers.get('Cookie');
+      if (!existing?.split(';').some((part) => part.trim().startsWith(\`\${scheme.name}=\`))) {
+        config.init.headers.set('Cookie', existing ? \`\${existing}; \${cookie}\` : cookie);
+      }
+    } else {
+      throw new TypeError(\`Unsupported apiKey location: \${String(scheme.in)}\`);
+    }
+    return;
+  }
+  if (scheme.type === 'mutualTLS') {
+    if (credential !== true) {
+      throw new TypeError('mutualTLS credentials must be true when the custom fetch owns the client certificate');
+    }
+    return;
+  }
+  if (scheme.type === 'http' && scheme.scheme.toLowerCase() === 'basic') {
+    if (
+      typeof credential !== 'object' ||
+      !('username' in credential) ||
+      !('password' in credential)
+    ) {
+      throw new TypeError('Basic credentials require username and password');
+    }
+    const bytes = new TextEncoder().encode(
+      \`\${credential.username}:\${credential.password}\`,
+    );
+    let binary = '';
+    for (const byte of bytes) binary += String.fromCharCode(byte);
+    if (!config.init.headers.has('Authorization')) {
+      config.init.headers.set('Authorization', \`Basic \${btoa(binary)}\`);
+    }
+    return;
+  }
+  if (typeof credential !== 'string') {
+    throw new TypeError(\`\${scheme.type} credentials must be strings\`);
+  }
+  const prefix = scheme.type === 'http' ? authorizationScheme(scheme.scheme) : 'Bearer';
+  if (!config.init.headers.has('Authorization')) {
+    config.init.headers.set('Authorization', \`\${prefix} \${credential}\`);
+  }
+}
+
+// OpenAPI carries the lowercase registry name, while servers routinely match the
+// Authorization prefix case-sensitively (\`header.startsWith('Bearer ')\`).
+const authorizationSchemes: Record<string, string> = {
+  basic: 'Basic',
+  bearer: 'Bearer',
+  digest: 'Digest',
+  hoba: 'HOBA',
+  mutual: 'Mutual',
+  negotiate: 'Negotiate',
+  oauth: 'OAuth',
+  'scram-sha-1': 'SCRAM-SHA-1',
+  'scram-sha-256': 'SCRAM-SHA-256',
+};
+
+function authorizationScheme(scheme: string) {
+  return authorizationSchemes[scheme.toLowerCase()] ?? scheme;
+}
+`;
+};
+
 // packages/typescript/src/lib/server-urls.ts
 function expandServerUrls(servers) {
   return servers.flatMap((server) => {
@@ -1782,12 +1949,15 @@ function expandServerUrls(servers) {
 
 // packages/typescript/src/lib/typescript-snippet.ts
 import { camelcase as camelcase5, spinalcase as spinalcase3 } from "stringcase";
-import { isEmpty as isEmpty6, pascalcase as pascalcase4, resolveRef as resolveRef4 } from "@sdk-it/core";
+import {
+  isEmpty as isEmpty6,
+  pascalcase as pascalcase4,
+  resolveRef as resolveRef4
+} from "@sdk-it/core";
 import "@sdk-it/readme";
 import {
   forEachOperation as forEachOperation5,
-  patchParameters,
-  securityToOptions
+  patchParameters
 } from "@sdk-it/spec";
 
 // packages/typescript/src/lib/emitters/snippet.ts
@@ -2014,12 +2184,7 @@ var TypeScriptSnippet = class {
       payload = examplePayload;
     } else {
       const requestBody = { type: "object", properties: {} };
-      patchParameters(
-        this.#spec,
-        requestBody,
-        operation.parameters,
-        operation.security ?? []
-      );
+      patchParameters(this.#spec, requestBody, operation.parameters);
       const examplePayload = this.#snippetEmitter.handle(requestBody);
       Object.assign(
         examplePayload,
@@ -2128,21 +2293,48 @@ const result = await ${camelcase5(this.#clientName)}.request('${entry.method.toU
     return content.join("\n");
   }
   #authentication() {
-    return securityToOptions(
-      this.#spec,
-      this.#spec.security ?? [],
-      this.#spec.components?.securitySchemes ?? {}
-    );
+    const names = /* @__PURE__ */ new Set();
+    for (const requirement of this.#spec.security ?? []) {
+      for (const name of Object.keys(requirement)) names.add(name);
+    }
+    forEachOperation5(this.#spec, (_entry, operation) => {
+      for (const requirement of operation.security ?? []) {
+        for (const name of Object.keys(requirement)) names.add(name);
+      }
+    });
+    return [...names].flatMap((name) => {
+      const scheme = this.#spec.components.securitySchemes[name];
+      return scheme ? [
+        {
+          name,
+          scheme: resolveRef4(
+            this.#spec,
+            scheme
+          )
+        }
+      ] : [];
+    });
+  }
+  #credentialExample(scheme) {
+    if (scheme.type === "mutualTLS") return true;
+    if (scheme.type === "http" && scheme.scheme?.toLowerCase() === "basic") {
+      return { username: "user", password: "password" };
+    }
+    if (scheme.type === "apiKey") return "test_api_key_1234567890abcdef";
+    return "test_access_token_1234567890abcdef";
   }
   client() {
-    const options = {
-      baseUrl: expandServerUrls(this.#spec.servers ?? [])[0] ?? "http://localhost:3000"
-    };
+    const servers = expandServerUrls(this.#spec.servers ?? []);
+    const options = {};
+    if (servers.length !== 1) {
+      options.baseUrl = servers[0] ?? "http://localhost:3000";
+    }
     const authOptions = this.#authentication();
     if (!isEmpty6(authOptions)) {
       const [firstAuth] = authOptions;
-      const optionName = firstAuth["x-optionName"] ?? firstAuth.name;
-      options[optionName] = firstAuth.example;
+      options.credentials = {
+        [firstAuth.name]: this.#credentialExample(firstAuth.scheme)
+      };
     }
     const client = this.#constructClient(options);
     return `${client.import}
@@ -2192,10 +2384,10 @@ ${client.use}`;
         "| `baseUrl` | `string | (() => string | Promise<string>)` | No | API base URL (default: `" + baseUrl + "`) |"
       );
     }
-    for (const authOption of authOptions) {
-      const optionName = authOption["x-optionName"] ?? authOption.name;
-      const description = authOption.in === "header" && authOption.name === "authorization" ? "Bearer token for authentication" : `API key for authentication (${authOption.in}: ${authOption.name})`;
-      sections.push(`| \`${optionName}\` | \`string\` | No | ${description} |`);
+    if (hasApiKey) {
+      sections.push(
+        "| `credentials` | `Record<string, SecurityCredential>` | No | Credentials keyed by the exact OpenAPI security scheme name |"
+      );
     }
     return { sections, hasServers, baseUrl, hasApiKey };
   }
@@ -2567,66 +2759,27 @@ ${client.use}`;
     if (isEmpty6(authOptions)) {
       return "";
     }
-    const sections = [];
-    sections.push("## Authentication");
-    sections.push("");
-    if (authOptions.length === 1) {
-      sections.push(
-        "The SDK requires authentication to access the API. Configure your client with the required credentials:"
-      );
-    } else {
-      sections.push("The SDK supports the following authentication methods:");
-    }
-    sections.push("");
-    for (const authOption of authOptions) {
-      const optionName = authOption["x-optionName"] ?? authOption.name;
-      const isBearer = authOption.in === "header" && authOption.name === "authorization";
-      const isApiKey = authOption.in === "header" && authOption.name !== "authorization";
-      const isQueryParam = authOption.in === "query";
-      const headingLevel = authOptions.length === 1 ? "###" : "###";
-      if (isBearer) {
-        const authenticationHeading = authOptions.length === 1 ? "Bearer Token" : "Bearer Token Authentication";
-        sections.push(`${headingLevel} ${authenticationHeading}`);
-        sections.push("");
+    const only = authOptions.length === 1;
+    const sections = [
+      "## Authentication",
+      "",
+      only ? "The SDK requires authentication to access the API. Configure your client with the required credentials:" : "The SDK supports the following authentication methods:",
+      ""
+    ];
+    for (const { name, scheme } of authOptions) {
+      sections.push(`### ${authenticationHeading(name, scheme, only)}`);
+      sections.push("");
+      if (isBearer(scheme)) {
         sections.push(
           'Pass your bearer token directly - the "Bearer" prefix is automatically added:'
         );
         sections.push("");
-        const bearerAuthClient = this.#constructClient({
-          [optionName]: "test_51234567890abcdef1234567890abcdef"
-        });
-        sections.push(createCodeBlock("typescript", [bearerAuthClient.use]));
-        sections.push("");
-      } else if (isApiKey) {
-        const apiKeyHeading = authOptions.length === 1 ? "API Key (Header)" : "API Key Authentication (Header)";
-        sections.push(`${headingLevel} ${apiKeyHeading}`);
-        sections.push("");
-        const apiKeyAuthClient = this.#constructClient({
-          [optionName]: "test_api_key_1234567890abcdef1234567890abcdef"
-        });
-        sections.push(createCodeBlock("typescript", [apiKeyAuthClient.use]));
-        sections.push("");
-      } else if (isQueryParam) {
-        const queryParamHeading = authOptions.length === 1 ? "API Key (Query Parameter)" : "API Key Authentication (Query Parameter)";
-        sections.push(`${headingLevel} ${queryParamHeading}`);
-        sections.push("");
-        const queryParamAuthClient = this.#constructClient({
-          [optionName]: "test_qp_key_1234567890abcdef1234567890abcdef"
-        });
-        sections.push(
-          createCodeBlock("typescript", [queryParamAuthClient.use])
-        );
-        sections.push("");
-      } else {
-        const genericAuthHeading = authOptions.length === 1 ? authOption.name : `${authOption.name} Authentication`;
-        sections.push(`${headingLevel} ${genericAuthHeading}`);
-        sections.push("");
-        const genericAuthClient = this.#constructClient({
-          [optionName]: "test_auth_token_1234567890abcdef1234567890abcdef"
-        });
-        sections.push(createCodeBlock("typescript", [genericAuthClient.use]));
-        sections.push("");
       }
+      const client = this.#constructClient({
+        credentials: { [name]: this.#credentialExample(scheme) }
+      });
+      sections.push(createCodeBlock("typescript", [client.use]));
+      sections.push("");
     }
     return sections.join("\n");
   }
@@ -2648,8 +2801,9 @@ ${client.use}`;
     };
     if (!isEmpty6(authOptions)) {
       const [primaryAuth] = authOptions;
-      const authOptionName = primaryAuth["x-optionName"] ?? primaryAuth.name;
-      initialClientOptions[authOptionName] = "YOUR_PRODUCTION_TOKEN";
+      initialClientOptions.credentials = {
+        [primaryAuth.name]: this.#credentialExample(primaryAuth.scheme)
+      };
     }
     const initialClientSetup = this.#constructClient(initialClientOptions);
     const configurationUpdateCode = [
@@ -2662,8 +2816,11 @@ ${client.use}`;
     ];
     if (!isEmpty6(authOptions)) {
       const [primaryAuth] = authOptions;
-      const authOptionName = primaryAuth["x-optionName"] ?? primaryAuth.name;
-      configurationUpdateCode.push(`  ${authOptionName}: 'YOUR_STAGING_TOKEN'`);
+      configurationUpdateCode.push(
+        `  credentials: ${JSON.stringify({
+          [primaryAuth.name]: this.#credentialExample(primaryAuth.scheme)
+        })}`
+      );
     }
     configurationUpdateCode.push("});");
     sections.push(createCodeBlock("typescript", configurationUpdateCode));
@@ -2674,6 +2831,21 @@ ${client.use}`;
     return sections.join("\n");
   }
 };
+function isBearer(scheme) {
+  return scheme.type === "http" && scheme.scheme?.toLowerCase() === "bearer";
+}
+function authenticationHeading(name, scheme, only) {
+  if (isBearer(scheme)) {
+    return only ? "Bearer Token" : "Bearer Token Authentication";
+  }
+  if (scheme.type === "apiKey" && scheme.in === "header") {
+    return only ? "API Key (Header)" : "API Key Authentication (Header)";
+  }
+  if (scheme.type === "apiKey" && scheme.in === "query") {
+    return only ? "API Key (Query Parameter)" : "API Key Authentication (Query Parameter)";
+  }
+  return only ? name : `${name} Authentication`;
+}
 function createCodeBlock(language, content) {
   return ["```" + language, ...content, "```"].join("\n");
 }
@@ -2709,14 +2881,23 @@ function availablePaginationTypes(spec) {
 
 // packages/typescript/src/lib/generate.ts
 async function generate(openapi, settings) {
+  const unresolvedSecuritySchemes = /* @__PURE__ */ new Set();
   const spec = await toIR(
     {
       spec: openapi,
       responses: { flattenErrorResponses: true },
-      pagination: settings.pagination
+      pagination: settings.pagination,
+      onDiagnostic: ({ code, message }) => {
+        if (code === "unresolved-security-scheme") {
+          unresolvedSecuritySchemes.add(message);
+        }
+      }
     },
     false
   );
+  if (unresolvedSecuritySchemes.size) {
+    throw new TypeError([...unresolvedSecuritySchemes].join("\n"));
+  }
   const style = Object.assign({}, { name: "github" }, settings.style ?? {});
   const output = settings.mode === "full" ? join2(settings.output, "src") : settings.output;
   settings.useTsExtension ??= true;
@@ -2767,13 +2948,17 @@ import { APIError, APIResponse, type SuccessfulResponse, type RebindSuccessPaylo
 ${template2(dispatcher_default, {})()}`,
     "interceptors.ts": `
     import type { RequestConfig, HeadersInit } from './${makeImport("request")}';
-    ${interceptors_default}`
+    ${interceptors_default}`,
+    "security.ts": Object.keys(spec.components.securitySchemes).length ? security_default({
+      makeImport,
+      securitySchemes: spec.components.securitySchemes
+    }) : null
   });
   await settings.writer(output, {
     "client.ts": client_default({
       name: clientName,
       servers: expandServerUrls(spec.servers ?? []),
-      options: security(spec),
+      securitySchemes: spec.components.securitySchemes,
       makeImport
     }),
     ...inputs,