@temporary-name/server 1.9.3-alpha.ec3bfb9dce56198911349c322c970208b21b50db → 1.9.3-alpha.fb7b7d19964e1b2def7056f4345b63d6fcacce10

package/dist/openapi/index.mjs

@@ -1,4 +1,5 @@
-import { isObject, stringifyJSON, findDeepMatches, toArray, clone, value, fallbackContractConfig, toHttpPath, isORPCErrorStatus } from '@temporary-name/shared';
+import { ZodToJsonSchemaConverter } from '@temporary-name/json-schema';
+import { isObject, stringifyJSON, findDeepMatches, clone, value, fallbackContractConfig, toHttpPath, assertNever, isORPCErrorStatus } from '@temporary-name/shared';
 import { j as jsonSerialize } from '../shared/server.CQIFwyhc.mjs';
 import '@temporary-name/standard-server';
 import { g as getEventIteratorSchemaDetails } from '../shared/server.YUvuxHty.mjs';
@@ -355,330 +356,371 @@ function resolveOpenAPIJsonSchemaRef(doc, schema) {
   return resolved ?? schema;
 }
 
-class CompositeSchemaConverter {
-  converters;
-  constructor(converters) {
-    this.converters = converters;
-  }
-  async convert(schema, options) {
-    for (const converter of this.converters) {
-      if (await converter.condition(schema, options)) {
-        return converter.convert(schema, options);
+class OpenAPIGeneratorError extends Error {
+}
+async function generateOpenApiSpec(router, options = {}) {
+  const converter = typeof options.schemaConverter === "function" ? options.schemaConverter : new ZodToJsonSchemaConverter(options.schemaConverter ?? {}).convert;
+  const filter = options.filter ?? (({ contract, path }) => {
+    return !(options.exclude?.(contract, path) ?? false);
+  });
+  const doc = {
+    ...clone(options.spec),
+    info: options.spec?.info ?? { title: "API Reference", version: "0.0.0" },
+    openapi: "3.1.1"
+  };
+  const { baseSchemaConvertOptions } = await resolveCommonSchemas(doc, options.commonSchemas, converter);
+  const contracts = [];
+  await resolveContractProcedures({ path: [], router }, (traverseOptions) => {
+    if (!value(filter, traverseOptions)) {
+      return;
+    }
+    contracts.push(traverseOptions);
+  });
+  const namesByAuthConfig = /* @__PURE__ */ new Map();
+  const authConfigNames = /* @__PURE__ */ new Set();
+  for (const { contract } of contracts) {
+    for (const authConfig of contract["~orpc"].authConfigs) {
+      if (authConfig.type === "none" || namesByAuthConfig.has(authConfig)) {
+        continue;
       }
+      const oasNameBase = authConfig.oasName ?? `${authConfig.type}Auth`;
+      let oasName = oasNameBase;
+      for (let i = 2; authConfigNames.has(oasName); i++) {
+        oasName = `${oasNameBase}${i}`;
+      }
+      namesByAuthConfig.set(authConfig, oasName);
+      authConfigNames.add(oasName);
     }
-    return [false, {}];
   }
-}
-
-class OpenAPIGeneratorError extends Error {
-}
-class OpenAPIGenerator {
-  converter;
-  constructor(options = {}) {
-    this.converter = new CompositeSchemaConverter(toArray(options.schemaConverters));
+  if (namesByAuthConfig.size > 0) {
+    doc.components ??= {};
+    const schemes = doc.components.securitySchemes ??= {};
+    for (const [authConfig, name] of namesByAuthConfig) {
+      schemes[name] ??= authConfigToSecurityScheme(authConfig);
+    }
   }
-  /**
-   * Generates OpenAPI specifications from oRPC routers/contracts.
-   *
-   * @see {@link https://orpc.unnoq.com/docs/openapi/openapi-specification OpenAPI Specification Docs}
-   */
-  async generate(router, options = {}) {
-    const filter = options.filter ?? (({ contract, path }) => {
-      return !(options.exclude?.(contract, path) ?? false);
-    });
-    const doc = {
-      ...clone(options),
-      info: options.info ?? { title: "API Reference", version: "0.0.0" },
-      openapi: "3.1.1",
-      exclude: void 0,
-      filter: void 0,
-      commonSchemas: void 0
-    };
-    const { baseSchemaConvertOptions } = await this.#resolveCommonSchemas(doc, options.commonSchemas);
-    const contracts = [];
-    await resolveContractProcedures({ path: [], router }, (traverseOptions) => {
-      if (!value(filter, traverseOptions)) {
-        return;
-      }
-      contracts.push(traverseOptions);
-    });
-    const errors = [];
-    for (const { contract, path } of contracts) {
-      const stringPath = path.join(".");
-      try {
-        const def = contract["~orpc"];
-        const method = toOpenAPIMethod(fallbackContractConfig("defaultMethod", def.route.method));
-        const httpPath = toOpenAPIPath(def.route.path ?? toHttpPath(path));
-        let operationObjectRef;
-        if (def.route.spec !== void 0 && typeof def.route.spec !== "function") {
-          operationObjectRef = def.route.spec;
-        } else {
-          operationObjectRef = {
-            operationId: def.route.operationId ?? stringPath,
-            summary: def.route.summary,
-            description: def.route.description,
-            deprecated: def.route.deprecated,
-            tags: def.route.tags?.map((tag) => tag)
-          };
-          await this.#request(doc, operationObjectRef, def, baseSchemaConvertOptions);
-          await this.#successResponse(doc, operationObjectRef, def, baseSchemaConvertOptions);
-        }
-        if (typeof def.route.spec === "function") {
-          operationObjectRef = def.route.spec(operationObjectRef);
-        }
-        doc.paths ??= {};
-        doc.paths[httpPath] ??= {};
-        doc.paths[httpPath][method] = applyCustomOpenAPIOperation(operationObjectRef, contract);
-      } catch (e) {
-        if (!(e instanceof OpenAPIGeneratorError)) {
-          throw e;
-        }
-        errors.push(
-          `[OpenAPIGenerator] Error occurred while generating OpenAPI for procedure at path: ${stringPath}
-${e.message}`
+  const errors = [];
+  for (const { contract, path } of contracts) {
+    const stringPath = path.join(".");
+    try {
+      const def = contract["~orpc"];
+      const method = toOpenAPIMethod(fallbackContractConfig("defaultMethod", def.route.method));
+      const httpPath = toOpenAPIPath(def.route.path ?? toHttpPath(path));
+      let operationObjectRef;
+      if (def.route.spec !== void 0 && typeof def.route.spec !== "function") {
+        operationObjectRef = def.route.spec;
+      } else {
+        operationObjectRef = {
+          operationId: def.route.operationId ?? stringPath,
+          summary: def.route.summary,
+          description: def.route.description,
+          deprecated: def.route.deprecated,
+          tags: def.route.tags?.map((tag) => tag)
+        };
+        const security = def.authConfigs.map(
+          (authConfig) => authConfig.type === "none" ? {} : { [namesByAuthConfig.get(authConfig)]: [] }
         );
+        if (security.length > 0) {
+          operationObjectRef.security = security;
+        }
+        await handleRequest(doc, operationObjectRef, def, baseSchemaConvertOptions, converter);
+        await handleSuccessResponse(doc, operationObjectRef, def, baseSchemaConvertOptions, converter);
+      }
+      if (typeof def.route.spec === "function") {
+        operationObjectRef = def.route.spec(operationObjectRef);
+      }
+      doc.paths ??= {};
+      doc.paths[httpPath] ??= {};
+      doc.paths[httpPath][method] = applyCustomOpenAPIOperation(operationObjectRef, contract);
+    } catch (e) {
+      if (!(e instanceof OpenAPIGeneratorError)) {
+        throw e;
       }
+      errors.push(
+        `[OpenAPIGenerator] Error occurred while generating OpenAPI for procedure at path: ${stringPath}
+${e.message}`
+      );
     }
-    if (errors.length) {
-      throw new OpenAPIGeneratorError(
-        `Some error occurred during OpenAPI generation:
+  }
+  if (errors.length) {
+    throw new OpenAPIGeneratorError(
+      `Some error occurred during OpenAPI generation:
 
 ${errors.join("\n\n")}`
-      );
-    }
-    return jsonSerialize(doc)[0];
+    );
   }
-  async #resolveCommonSchemas(doc, commonSchemas) {
-    let undefinedErrorJsonSchema = {
-      type: "object",
-      properties: {
-        defined: { const: false },
-        code: { type: "string" },
-        status: { type: "number" },
-        message: { type: "string" },
-        data: {}
-      },
-      required: ["defined", "code", "status", "message"]
-    };
-    const baseSchemaConvertOptions = {};
-    if (commonSchemas) {
-      baseSchemaConvertOptions.components = [];
-      for (const key in commonSchemas) {
-        const options = commonSchemas[key];
-        if (options.schema === void 0) {
-          continue;
+  return jsonSerialize(doc)[0];
+}
+async function resolveCommonSchemas(doc, commonSchemas, converter) {
+  let undefinedErrorJsonSchema = {
+    type: "object",
+    properties: {
+      defined: { const: false },
+      code: { type: "string" },
+      status: { type: "number" },
+      message: { type: "string" },
+      data: {}
+    },
+    required: ["defined", "code", "status", "message"]
+  };
+  const baseSchemaConvertOptions = {};
+  if (commonSchemas) {
+    baseSchemaConvertOptions.components = [];
+    for (const key in commonSchemas) {
+      const options = commonSchemas[key];
+      if (options.schema === void 0) {
+        continue;
+      }
+      const { schema, strategy = "input" } = options;
+      const [required, json] = await converter(schema, { strategy });
+      const allowedStrategies = [strategy];
+      if (strategy === "input") {
+        const [outputRequired, outputJson] = await converter(schema, { strategy: "output" });
+        if (outputRequired === required && stringifyJSON(outputJson) === stringifyJSON(json)) {
+          allowedStrategies.push("output");
         }
-        const { schema, strategy = "input" } = options;
-        const [required, json] = await this.converter.convert(schema, { strategy });
-        const allowedStrategies = [strategy];
-        if (strategy === "input") {
-          const [outputRequired, outputJson] = await this.converter.convert(schema, { strategy: "output" });
-          if (outputRequired === required && stringifyJSON(outputJson) === stringifyJSON(json)) {
-            allowedStrategies.push("output");
-          }
-        } else if (strategy === "output") {
-          const [inputRequired, inputJson] = await this.converter.convert(schema, { strategy: "input" });
-          if (inputRequired === required && stringifyJSON(inputJson) === stringifyJSON(json)) {
-            allowedStrategies.push("input");
-          }
+      } else if (strategy === "output") {
+        const [inputRequired, inputJson] = await converter(schema, { strategy: "input" });
+        if (inputRequired === required && stringifyJSON(inputJson) === stringifyJSON(json)) {
+          allowedStrategies.push("input");
         }
-        baseSchemaConvertOptions.components.push({
-          schema,
-          required,
-          ref: `#/components/schemas/${key}`,
-          allowedStrategies
-        });
       }
-      doc.components ??= {};
-      doc.components.schemas ??= {};
-      for (const key in commonSchemas) {
-        const options = commonSchemas[key];
-        if (options.schema === void 0) {
-          if (options.error === "UndefinedError") {
-            doc.components.schemas[key] = toOpenAPISchema(undefinedErrorJsonSchema);
-            undefinedErrorJsonSchema = { $ref: `#/components/schemas/${key}` };
-          }
-          continue;
+      baseSchemaConvertOptions.components.push({
+        schema,
+        required,
+        ref: `#/components/schemas/${key}`,
+        allowedStrategies
+      });
+    }
+    doc.components ??= {};
+    doc.components.schemas ??= {};
+    for (const key in commonSchemas) {
+      const options = commonSchemas[key];
+      if (options.schema === void 0) {
+        if (options.error === "UndefinedError") {
+          doc.components.schemas[key] = toOpenAPISchema(undefinedErrorJsonSchema);
+          undefinedErrorJsonSchema = { $ref: `#/components/schemas/${key}` };
         }
-        const { schema, strategy = "input" } = options;
-        const [, json] = await this.converter.convert(schema, {
-          ...baseSchemaConvertOptions,
-          strategy,
-          minStructureDepthForRef: 1
-          // not allow use $ref for root schemas
-        });
-        doc.components.schemas[key] = toOpenAPISchema(json);
+        continue;
       }
+      const { schema, strategy = "input" } = options;
+      const [, json] = await converter(schema, {
+        ...baseSchemaConvertOptions,
+        strategy,
+        minStructureDepthForRef: 1
+        // not allow use $ref for root schemas
+      });
+      doc.components.schemas[key] = toOpenAPISchema(json);
     }
-    return { baseSchemaConvertOptions, undefinedErrorJsonSchema };
   }
-  async #request(doc, ref, def, baseSchemaConvertOptions) {
-    const method = fallbackContractConfig("defaultMethod", def.route.method);
-    const dynamicParams = getDynamicParams(def.route.path)?.map((v) => v.name);
-    const [_pathRequired, pathSchema] = await this.converter.convert(def.schemas.pathSchema, {
-      ...baseSchemaConvertOptions,
-      strategy: "input",
-      minStructureDepthForRef: 1
-    });
-    if (dynamicParams?.length) {
-      const error = new OpenAPIGeneratorError(
-        // TODO: fix this error
-        'When input structure is "compact", and path has dynamic params, input schema must be an object with all dynamic params as required.'
-      );
-      if (!isObjectSchema(pathSchema)) {
-        throw error;
-      }
-      if (!checkParamsSchema(pathSchema, dynamicParams)) {
-        throw error;
-      }
-      ref.parameters ??= [];
-      ref.parameters.push(...toOpenAPIParameters(pathSchema, "path"));
-    } else {
-      const error = new OpenAPIGeneratorError("Params set via path do not match those on the route");
-      if (!isObjectSchema(pathSchema)) {
-        console.log("FOO", pathSchema);
-        throw error;
-      }
-      if (!checkParamsSchema(pathSchema, [])) {
-        console.log("BAR", pathSchema);
-        throw error;
-      }
+  return { baseSchemaConvertOptions, undefinedErrorJsonSchema };
+}
+async function handleRequest(doc, ref, def, baseSchemaConvertOptions, converter) {
+  const method = fallbackContractConfig("defaultMethod", def.route.method);
+  const dynamicParams = getDynamicParams(def.route.path)?.map((v) => v.name);
+  const [_pathRequired, pathSchema] = await converter(def.schemas.pathSchema, {
+    ...baseSchemaConvertOptions,
+    strategy: "input",
+    minStructureDepthForRef: 1
+  });
+  if (dynamicParams?.length) {
+    const error = new OpenAPIGeneratorError(
+      // TODO: fix this error
+      'When input structure is "compact", and path has dynamic params, input schema must be an object with all dynamic params as required.'
+    );
+    if (!isObjectSchema(pathSchema)) {
+      throw error;
     }
-    const [_queryRequired, querySchema] = await this.converter.convert(def.schemas.querySchema, {
-      ...baseSchemaConvertOptions,
-      strategy: "input",
-      minStructureDepthForRef: 0
-    });
-    if (!isAnySchema(querySchema)) {
-      const resolvedSchema = resolveOpenAPIJsonSchemaRef(doc, querySchema);
-      if (!isObjectSchema(resolvedSchema)) {
-        throw new OpenAPIGeneratorError("Query param schema must satisfy: object | any | unknown");
-      }
-      ref.parameters ??= [];
-      ref.parameters.push(...toOpenAPIParameters(resolvedSchema, "query"));
+    if (!checkParamsSchema(pathSchema, dynamicParams)) {
+      throw error;
     }
-    if (method !== "GET") {
-      const details = getEventIteratorSchemaDetails(def.schemas.bodySchema);
-      if (details) {
-        ref.requestBody = {
-          required: true,
-          content: toOpenAPIEventIteratorContent(
-            await this.converter.convert(details.yields, { ...baseSchemaConvertOptions, strategy: "input" }),
-            await this.converter.convert(details.returns, { ...baseSchemaConvertOptions, strategy: "input" })
-          )
-        };
-      } else {
-        const [bodyRequired, bodySchema] = await this.converter.convert(def.schemas.bodySchema, {
-          ...baseSchemaConvertOptions,
-          strategy: "input",
-          minStructureDepthForRef: 0
-        });
-        if (isAnySchema(bodySchema)) {
-          return;
-        }
-        ref.requestBody = {
-          required: bodyRequired,
-          content: toOpenAPIContent(bodySchema)
-        };
-      }
+    ref.parameters ??= [];
+    ref.parameters.push(...toOpenAPIParameters(pathSchema, "path"));
+  } else {
+    const error = new OpenAPIGeneratorError("Params set via path do not match those on the route");
+    if (!isObjectSchema(pathSchema)) {
+      console.log("FOO", pathSchema);
+      throw error;
+    }
+    if (!checkParamsSchema(pathSchema, [])) {
+      console.log("BAR", pathSchema);
+      throw error;
+    }
+  }
+  const [_queryRequired, querySchema] = await converter(def.schemas.querySchema, {
+    ...baseSchemaConvertOptions,
+    strategy: "input",
+    minStructureDepthForRef: 0
+  });
+  if (!isAnySchema(querySchema)) {
+    const resolvedSchema = resolveOpenAPIJsonSchemaRef(doc, querySchema);
+    if (!isObjectSchema(resolvedSchema)) {
+      throw new OpenAPIGeneratorError("Query param schema must satisfy: object | any | unknown");
     }
+    ref.parameters ??= [];
+    ref.parameters.push(...toOpenAPIParameters(resolvedSchema, "query"));
   }
-  async #successResponse(doc, ref, def, baseSchemaConvertOptions) {
-    const outputSchema = def.schemas.outputSchema;
-    const status = fallbackContractConfig("defaultSuccessStatus", def.route.successStatus);
-    const description = fallbackContractConfig("defaultSuccessDescription", def.route?.successDescription);
-    const eventIteratorSchemaDetails = getEventIteratorSchemaDetails(outputSchema);
-    const outputStructure = fallbackContractConfig("defaultOutputStructure", def.route.outputStructure);
-    if (eventIteratorSchemaDetails) {
-      ref.responses ??= {};
-      ref.responses[status] = {
-        description,
+  if (method !== "GET") {
+    const details = getEventIteratorSchemaDetails(def.schemas.bodySchema);
+    if (details) {
+      ref.requestBody = {
+        required: true,
         content: toOpenAPIEventIteratorContent(
-          await this.converter.convert(eventIteratorSchemaDetails.yields, {
-            ...baseSchemaConvertOptions,
-            strategy: "output"
-          }),
-          await this.converter.convert(eventIteratorSchemaDetails.returns, {
-            ...baseSchemaConvertOptions,
-            strategy: "output"
-          })
+          await converter(details.yields, { ...baseSchemaConvertOptions, strategy: "input" }),
+          await converter(details.returns, { ...baseSchemaConvertOptions, strategy: "input" })
         )
       };
-      return;
-    }
-    const [required, json] = await this.converter.convert(outputSchema, {
-      ...baseSchemaConvertOptions,
-      strategy: "output",
-      minStructureDepthForRef: outputStructure === "detailed" ? 1 : 0
-    });
-    if (outputStructure === "compact") {
-      ref.responses ??= {};
-      ref.responses[status] = {
-        description
+    } else {
+      const [bodyRequired, bodySchema] = await converter(def.schemas.bodySchema, {
+        ...baseSchemaConvertOptions,
+        strategy: "input",
+        minStructureDepthForRef: 0
+      });
+      if (isAnySchema(bodySchema)) {
+        return;
+      }
+      ref.requestBody = {
+        required: bodyRequired,
+        content: toOpenAPIContent(bodySchema)
       };
-      ref.responses[status].content = toOpenAPIContent(applySchemaOptionality(required, json));
-      return;
     }
-    const handledStatuses = /* @__PURE__ */ new Set();
-    for (const item of expandUnionSchema(json)) {
-      const error = new OpenAPIGeneratorError(`
-        When output structure is "detailed", output schema must satisfy:
-        {
-          status?: number, // must be a literal number and in the range of 200-399
-          headers?: Record<string, unknown>,
-          body?: unknown
-        }
+  }
+}
+async function handleSuccessResponse(doc, ref, def, baseSchemaConvertOptions, converter) {
+  const outputSchema = def.schemas.outputSchema;
+  const status = fallbackContractConfig("defaultSuccessStatus", def.route.successStatus);
+  const description = fallbackContractConfig("defaultSuccessDescription", def.route?.successDescription);
+  const eventIteratorSchemaDetails = getEventIteratorSchemaDetails(outputSchema);
+  const outputStructure = fallbackContractConfig("defaultOutputStructure", def.route.outputStructure);
+  if (eventIteratorSchemaDetails) {
+    ref.responses ??= {};
+    ref.responses[status] = {
+      description,
+      content: toOpenAPIEventIteratorContent(
+        await converter(eventIteratorSchemaDetails.yields, {
+          ...baseSchemaConvertOptions,
+          strategy: "output"
+        }),
+        await converter(eventIteratorSchemaDetails.returns, {
+          ...baseSchemaConvertOptions,
+          strategy: "output"
+        })
+      )
+    };
+    return;
+  }
+  const [required, json] = await converter(outputSchema, {
+    ...baseSchemaConvertOptions,
+    strategy: "output",
+    minStructureDepthForRef: outputStructure === "detailed" ? 1 : 0
+  });
+  if (outputStructure === "compact") {
+    ref.responses ??= {};
+    ref.responses[status] = {
+      description
+    };
+    ref.responses[status].content = toOpenAPIContent(applySchemaOptionality(required, json));
+    return;
+  }
+  const handledStatuses = /* @__PURE__ */ new Set();
+  for (const item of expandUnionSchema(json)) {
+    const error = new OpenAPIGeneratorError(`
+      When output structure is "detailed", output schema must satisfy:
+      {
+        status?: number, // must be a literal number and in the range of 200-399
+        headers?: Record<string, unknown>,
+        body?: unknown
+      }
 
-        But got: ${stringifyJSON(item)}
-      `);
-      if (!isObjectSchema(item)) {
+      But got: ${stringifyJSON(item)}
+    `);
+    if (!isObjectSchema(item)) {
+      throw error;
+    }
+    let schemaStatus;
+    let schemaDescription;
+    if (item.properties?.status !== void 0) {
+      const statusSchema = resolveOpenAPIJsonSchemaRef(doc, item.properties.status);
+      if (typeof statusSchema !== "object" || statusSchema.const === void 0 || typeof statusSchema.const !== "number" || !Number.isInteger(statusSchema.const) || isORPCErrorStatus(statusSchema.const)) {
         throw error;
       }
-      let schemaStatus;
-      let schemaDescription;
-      if (item.properties?.status !== void 0) {
-        const statusSchema = resolveOpenAPIJsonSchemaRef(doc, item.properties.status);
-        if (typeof statusSchema !== "object" || statusSchema.const === void 0 || typeof statusSchema.const !== "number" || !Number.isInteger(statusSchema.const) || isORPCErrorStatus(statusSchema.const)) {
-          throw error;
-        }
-        schemaStatus = statusSchema.const;
-        schemaDescription = statusSchema.description;
-      }
-      const itemStatus = schemaStatus ?? status;
-      const itemDescription = schemaDescription ?? description;
-      if (handledStatuses.has(itemStatus)) {
-        throw new OpenAPIGeneratorError(`
-          When output structure is "detailed", each success status must be unique.
-          But got status: ${itemStatus} used more than once.
-        `);
+      schemaStatus = statusSchema.const;
+      schemaDescription = statusSchema.description;
+    }
+    const itemStatus = schemaStatus ?? status;
+    const itemDescription = schemaDescription ?? description;
+    if (handledStatuses.has(itemStatus)) {
+      throw new OpenAPIGeneratorError(`
+        When output structure is "detailed", each success status must be unique.
+        But got status: ${itemStatus} used more than once.
+      `);
+    }
+    handledStatuses.add(itemStatus);
+    ref.responses ??= {};
+    ref.responses[itemStatus] = {
+      description: itemDescription
+    };
+    if (item.properties?.headers !== void 0) {
+      const headersSchema = resolveOpenAPIJsonSchemaRef(doc, item.properties.headers);
+      if (!isObjectSchema(headersSchema)) {
+        throw error;
       }
-      handledStatuses.add(itemStatus);
-      ref.responses ??= {};
-      ref.responses[itemStatus] = {
-        description: itemDescription
-      };
-      if (item.properties?.headers !== void 0) {
-        const headersSchema = resolveOpenAPIJsonSchemaRef(doc, item.properties.headers);
-        if (!isObjectSchema(headersSchema)) {
-          throw error;
-        }
-        for (const key in headersSchema.properties) {
-          const headerSchema = headersSchema.properties[key];
-          if (headerSchema !== void 0) {
-            ref.responses[itemStatus].headers ??= {};
-            ref.responses[itemStatus].headers[key] = {
-              schema: toOpenAPISchema(headerSchema),
-              required: item.required?.includes("headers") && headersSchema.required?.includes(key)
-            };
-          }
+      for (const key in headersSchema.properties) {
+        const headerSchema = headersSchema.properties[key];
+        if (headerSchema !== void 0) {
+          ref.responses[itemStatus].headers ??= {};
+          ref.responses[itemStatus].headers[key] = {
+            schema: toOpenAPISchema(headerSchema),
+            required: item.required?.includes("headers") && headersSchema.required?.includes(key)
+          };
         }
       }
-      if (item.properties?.body !== void 0) {
-        ref.responses[itemStatus].content = toOpenAPIContent(
-          applySchemaOptionality(item.required?.includes("body") ?? false, item.properties.body)
-        );
-      }
     }
+    if (item.properties?.body !== void 0) {
+      ref.responses[itemStatus].content = toOpenAPIContent(
+        applySchemaOptionality(item.required?.includes("body") ?? false, item.properties.body)
+      );
+    }
+  }
+}
+function authConfigToSecurityScheme(authConfig) {
+  switch (authConfig.type) {
+    case "basic":
+      return {
+        type: "http",
+        scheme: "basic",
+        description: authConfig.oasDescription
+      };
+    case "bearer":
+      return {
+        type: "http",
+        scheme: "bearer",
+        description: authConfig.oasDescription,
+        bearerFormat: authConfig.oasBearerFormat
+      };
+    case "header":
+      return {
+        type: "apiKey",
+        in: "header",
+        name: authConfig.name,
+        description: authConfig.oasDescription
+      };
+    case "query":
+      return {
+        type: "apiKey",
+        in: "query",
+        name: authConfig.name,
+        description: authConfig.oasDescription
+      };
+    case "cookie":
+      return {
+        type: "apiKey",
+        in: "cookie",
+        name: authConfig.name,
+        description: authConfig.oasDescription
+      };
+    default:
+      assertNever(authConfig, `Unsupported auth config type: ${authConfig.type}`);
   }
 }
 
@@ -686,4 +728,4 @@ const oo = {
   spec: customOpenAPIOperation
 };
 
-export { CompositeSchemaConverter, LOGIC_KEYWORDS, OpenAPIGenerator, applyCustomOpenAPIOperation, applySchemaOptionality, checkParamsSchema, customOpenAPIOperation, expandArrayableSchema, expandUnionSchema, filterSchemaBranches, getCustomOpenAPIOperation, isAnySchema, isFileSchema, isObjectSchema, isPrimitiveSchema, oo, resolveOpenAPIJsonSchemaRef, separateObjectSchema, toOpenAPIContent, toOpenAPIEventIteratorContent, toOpenAPIMethod, toOpenAPIParameters, toOpenAPIPath, toOpenAPISchema };
+export { LOGIC_KEYWORDS, applyCustomOpenAPIOperation, applySchemaOptionality, checkParamsSchema, customOpenAPIOperation, expandArrayableSchema, expandUnionSchema, filterSchemaBranches, generateOpenApiSpec, getCustomOpenAPIOperation, isAnySchema, isFileSchema, isObjectSchema, isPrimitiveSchema, oo, resolveOpenAPIJsonSchemaRef, separateObjectSchema, toOpenAPIContent, toOpenAPIEventIteratorContent, toOpenAPIMethod, toOpenAPIParameters, toOpenAPIPath, toOpenAPISchema };