schema-components 1.20.0 → 1.21.0

package/dist/{normalise-CMMEl4cd.mjs → normalise-DaSrnr8g.mjs}

@@ -117,6 +117,260 @@ function normaliseOpenApi30Discriminator(node) {
 	return node;
 }
 /**
+* Returns the schema name a `$ref` points at when it targets
+* `#/components/schemas/<Name>`, or `undefined` otherwise.
+*
+* The walker only resolves intra-document refs and other allOf-base
+* patterns; refs into `definitions` (Swagger 2.0) are already rewritten
+* before this stage.
+*/
+function componentSchemaName(ref) {
+	if (typeof ref !== "string") return void 0;
+	if (!ref.startsWith("#/components/schemas/")) return void 0;
+	const name = ref.slice(21);
+	return name.length > 0 ? name : void 0;
+}
+/**
+* Find every immediate `$ref` that an `allOf` array contains pointing
+* back at a `components/schemas/<Name>` entry. Used to discover
+* "Cat extends Pet"-style inheritance — the subtype's `allOf` lists
+* the base by `$ref` alongside its own local fields.
+*/
+function listAllOfBaseRefs(schema) {
+	const allOf = schema.allOf;
+	if (!Array.isArray(allOf)) return [];
+	const result = [];
+	for (const entry of allOf) {
+		if (!isObject(entry)) continue;
+		const name = componentSchemaName(entry.$ref);
+		if (name !== void 0) result.push(name);
+	}
+	return result;
+}
+/**
+* Collect discriminator subtypes for a base schema. Entries come from:
+*
+* 1. The base's `discriminator.mapping` (explicit author intent — the
+*    mapping key supplies the `const` value, the ref names the subtype).
+* 2. Component schemas whose `allOf` lists this base by `$ref` and
+*    were not already named in the mapping. The `const` value defaults
+*    to the subtype's component name.
+*
+* Returned in deterministic order: mapping entries first (preserving
+* authored order), then implicit subtypes alphabetically.
+*/
+function collectDiscriminatorSubtypes(baseName, discriminator, componentSchemas) {
+	const result = [];
+	const seen = /* @__PURE__ */ new Set();
+	const mapping = isObject(discriminator.mapping) ? discriminator.mapping : void 0;
+	if (mapping !== void 0) for (const [constValue, ref] of Object.entries(mapping)) {
+		const name = componentSchemaName(ref);
+		if (name === void 0) continue;
+		if (!isObject(componentSchemas[name])) continue;
+		if (seen.has(name)) continue;
+		seen.add(name);
+		result.push({
+			name,
+			constValue
+		});
+	}
+	const implicitNames = [];
+	for (const [name, schema] of Object.entries(componentSchemas)) {
+		if (!isObject(schema)) continue;
+		if (seen.has(name)) continue;
+		if (!listAllOfBaseRefs(schema).includes(baseName)) continue;
+		implicitNames.push(name);
+	}
+	implicitNames.sort();
+	for (const name of implicitNames) {
+		result.push({
+			name,
+			constValue: name
+		});
+		seen.add(name);
+	}
+	return result;
+}
+/**
+* Inject the discriminator `const` on a subtype schema in-place.
+*
+* When the subtype already declares a matching const we leave it
+* alone. Otherwise the const is added in whichever location the walker
+* will actually observe:
+*
+* - Subtype declares `allOf`: append a new `allOf` entry carrying just
+*   `{ properties: { [propertyName]: { const } } }`. The walker's
+*   `mergeAllOf` merges every entry's `properties` into the resolved
+*   schema, so the const propagates through to the merged result. A
+*   top-level `properties` sibling of `allOf` would be ignored by the
+*   merge.
+* - Subtype does not declare `allOf`: extend the top-level `properties`
+*   block — the walker reads this directly.
+*/
+function injectSubtypeConst(subtype, propertyName, constValue) {
+	if (subtypeAlreadyDeclaresConst(subtype, propertyName)) return;
+	const constEntry = { properties: { [propertyName]: { const: constValue } } };
+	if (Array.isArray(subtype.allOf)) {
+		subtype.allOf = [...subtype.allOf, constEntry];
+		return;
+	}
+	const existingProps = isObject(subtype.properties) ? { ...subtype.properties } : {};
+	const existingDisc = existingProps[propertyName];
+	existingProps[propertyName] = {
+		...isObject(existingDisc) ? existingDisc : {},
+		const: constValue
+	};
+	subtype.properties = existingProps;
+}
+/**
+* Check whether a subtype (or any of its `allOf` entries) already
+* carries a `const` for the discriminator property. Used to avoid
+* overwriting an author-supplied const.
+*/
+function subtypeAlreadyDeclaresConst(subtype, propertyName) {
+	if (hasConstProp(subtype.properties, propertyName)) return true;
+	if (Array.isArray(subtype.allOf)) for (const entry of subtype.allOf) {
+		if (!isObject(entry)) continue;
+		if (hasConstProp(entry.properties, propertyName)) return true;
+	}
+	return false;
+}
+function hasConstProp(properties, propertyName) {
+	if (!isObject(properties)) return false;
+	const prop = properties[propertyName];
+	return isObject(prop) && "const" in prop;
+}
+/**
+* Strip every `$ref` entry in a subtype's `allOf` that targets the
+* discriminator base. The base's own schema content (properties,
+* required, type) is replicated into a synthesised `allOf` entry so
+* the subtype remains structurally complete — without this the base's
+* synthesised `oneOf` would cycle through the subtype's `$ref`s on
+* every walk (Dog → Pet.oneOf → Dog → ...).
+*/
+function rewriteSubtypeAllOf(subtype, baseName, baseInherited) {
+	const allOf = subtype.allOf;
+	if (!Array.isArray(allOf)) return;
+	const baseRefPrefix = `#/components/schemas/${baseName}`;
+	const rewritten = [];
+	let removedBaseRef = false;
+	for (const entry of allOf) {
+		if (isObject(entry) && typeof entry.$ref === "string" && entry.$ref === baseRefPrefix) {
+			removedBaseRef = true;
+			continue;
+		}
+		rewritten.push(entry);
+	}
+	if (!removedBaseRef) return;
+	subtype.allOf = [baseInherited, ...rewritten];
+}
+/**
+* Capture the "inheritable" portion of a base schema before rewriting:
+* `properties`, `required`, `type`, and any other constraint that
+* subtypes used to inherit through `$ref`. The discriminator keyword
+* and the synthesised `oneOf` are intentionally excluded — subtypes
+* never inherited those and including them would re-introduce the
+* Pet → Dog → Pet cycle.
+*/
+function captureBaseInherited(base) {
+	const inherited = {};
+	for (const [key, value] of Object.entries(base)) {
+		if (key === "discriminator") continue;
+		if (key === "oneOf") continue;
+		if (key === "anyOf") continue;
+		inherited[key] = value;
+	}
+	return inherited;
+}
+/**
+* Build an inline `oneOf` option that targets a subtype via `$ref` and
+* carries the discriminator property's `const` at the option's top
+* level. The const sibling is what makes `detectDiscriminated` classify
+* the parent `oneOf` as a discriminated union — it inspects each
+* option's literal `properties`, not the resolved schema.
+*/
+function buildDiscriminatorOption(subtype, propertyName) {
+	return {
+		$ref: `#/components/schemas/${subtype.name}`,
+		properties: { [propertyName]: { const: subtype.constValue } }
+	};
+}
+/**
+* Document-level pre-pass for OpenAPI discriminators that are declared
+* on a base schema and inherited by subtypes via `allOf`.
+*
+* The per-node {@link normaliseOpenApi30Discriminator} only handles
+* discriminators that already sit alongside `oneOf`/`anyOf`. For the
+* canonical "Cat extends Pet" pattern — where `Pet` carries the
+* discriminator and `Cat`/`Dog` reference `Pet` via `allOf` — the
+* discriminator is silently lost. This pre-pass:
+*
+* 1. Injects the discriminator `const` on each subtype's local
+*    `properties` (so a direct render of the subtype validates the
+*    discriminator value correctly).
+* 2. Synthesises a `oneOf` on the base whenever it lacks one, listing
+*    each subtype as `{ $ref, properties: { propertyName: { const } } }`.
+*    The per-node discriminator transform then sees `oneOf` and clears
+*    the `discriminator` keyword, and the walker's
+*    `detectDiscriminated` finds the per-option `const`s.
+*
+* Mutates a shallow clone of `components/schemas` — the input document
+* is never modified.
+*/
+function applyDiscriminatorAllOfPrepass(doc) {
+	const components = doc.components;
+	if (!isObject(components)) return doc;
+	const schemas = components.schemas;
+	if (!isObject(schemas)) return doc;
+	const plans = [];
+	for (const [baseName, base] of Object.entries(schemas)) {
+		if (!isObject(base)) continue;
+		const discriminator = base.discriminator;
+		if (!isObject(discriminator)) continue;
+		const propertyName = discriminator.propertyName;
+		if (typeof propertyName !== "string") continue;
+		const subtypes = collectDiscriminatorSubtypes(baseName, discriminator, schemas);
+		if (subtypes.length === 0) continue;
+		plans.push({
+			baseName,
+			propertyName,
+			subtypes,
+			baseHasOneOfOrAnyOf: Array.isArray(base.oneOf) || Array.isArray(base.anyOf),
+			baseInherited: captureBaseInherited(base)
+		});
+	}
+	if (plans.length === 0) return doc;
+	const newSchemas = { ...schemas };
+	const cloneSchema = (name) => {
+		const existing = newSchemas[name];
+		if (!isObject(existing)) throw new Error(`applyDiscriminatorAllOfPrepass: schema "${name}" disappeared between planning and rewrite`);
+		const clone = { ...existing };
+		newSchemas[name] = clone;
+		return clone;
+	};
+	for (const plan of plans) {
+		for (const subtype of plan.subtypes) {
+			const clone = cloneSchema(subtype.name);
+			rewriteSubtypeAllOf(clone, plan.baseName, plan.baseInherited);
+			injectSubtypeConst(clone, plan.propertyName, subtype.constValue);
+		}
+		if (!plan.baseHasOneOfOrAnyOf) {
+			const baseClone = cloneSchema(plan.baseName);
+			baseClone.oneOf = plan.subtypes.map((subtype) => buildDiscriminatorOption(subtype, plan.propertyName));
+			delete baseClone.properties;
+			delete baseClone.required;
+			delete baseClone.type;
+		}
+	}
+	return {
+		...doc,
+		components: {
+			...components,
+			schemas: newSchemas
+		}
+	};
+}
+/**
 * Combined OpenAPI 3.0.x node transform: Draft 04 + nullable + discriminator.
 * Applied to every schema node in an OpenAPI 3.0 document.
 *
@@ -779,35 +1033,43 @@ const SINGLE_SUBSCHEMA_KEYS = new Set([
 * Normalise each element of an unknown array by applying deepNormalise
 * to object elements and passing others through unchanged.
 */
-function normaliseArray(items, transform) {
+function normaliseArray(items, transform, visited) {
 	const result = [];
-	for (const item of items) result.push(isObject(item) ? deepNormalise(item, transform) : item);
+	for (const item of items) result.push(isObject(item) ? deepNormalise(item, transform, visited) : item);
 	return result;
 }
 /**
 * Normalise each value of a sub-schema map (e.g. properties, $defs).
 */
-function normaliseSubSchemaMap(map, transform) {
+function normaliseSubSchemaMap(map, transform, visited) {
 	const result = {};
-	for (const [k, v] of Object.entries(map)) result[k] = isObject(v) ? deepNormalise(v, transform) : v;
+	for (const [k, v] of Object.entries(map)) result[k] = isObject(v) ? deepNormalise(v, transform, visited) : v;
 	return result;
 }
 /**
 * Deep-normalise a JSON Schema object by applying a per-node transform
 * and recursing into every sub-schema location.
+*
+* The optional `visited` set guards against shared object references and
+* cycles introduced upstream (e.g. by the OpenAPI bundler's
+* `structuredClone`-based inlining of external refs). The walk skips
+* already-seen nodes by returning the original reference rather than
+* recursing forever.
 */
-function deepNormalise(schema, transform) {
+function deepNormalise(schema, transform, visited = /* @__PURE__ */ new WeakSet()) {
+	if (visited.has(schema)) return schema;
+	visited.add(schema);
 	const node = transform({ ...schema });
 	const result = {};
-	for (const [key, value] of Object.entries(node)) if (isObject(value) && OBJECT_SUBSCHEMA_KEYS.has(key)) result[key] = normaliseSubSchemaMap(value, transform);
-	else if (Array.isArray(value) && ARRAY_SUBSCHEMA_KEYS.has(key)) result[key] = normaliseArray(value, transform);
-	else if (isObject(value) && SINGLE_SUBSCHEMA_KEYS.has(key)) result[key] = deepNormalise(value, transform);
-	else if (key === "items") if (Array.isArray(value)) result[key] = normaliseArray(value, transform);
-	else if (isObject(value)) result[key] = deepNormalise(value, transform);
+	for (const [key, value] of Object.entries(node)) if (isObject(value) && OBJECT_SUBSCHEMA_KEYS.has(key)) result[key] = normaliseSubSchemaMap(value, transform, visited);
+	else if (Array.isArray(value) && ARRAY_SUBSCHEMA_KEYS.has(key)) result[key] = normaliseArray(value, transform, visited);
+	else if (isObject(value) && SINGLE_SUBSCHEMA_KEYS.has(key)) result[key] = deepNormalise(value, transform, visited);
+	else if (key === "items") if (Array.isArray(value)) result[key] = normaliseArray(value, transform, visited);
+	else if (isObject(value)) result[key] = deepNormalise(value, transform, visited);
 	else result[key] = value;
 	else if (key === "dependencies" && isObject(value)) {
 		const normalised = {};
-		for (const [dk, dv] of Object.entries(value)) if (isObject(dv)) normalised[dk] = deepNormalise(dv, transform);
+		for (const [dk, dv] of Object.entries(value)) if (isObject(dv)) normalised[dk] = deepNormalise(dv, transform, visited);
 		else normalised[dk] = dv;
 		result[key] = normalised;
 	} else result[key] = value;
@@ -976,6 +1238,26 @@ function validateDependentRequired(node, ctx) {
 	}
 }
 /**
+* Translate the legacy tuple-form `items: [Schema, Schema]` keyword to
+* Draft 2020-12's `prefixItems`. `additionalItems` becomes the rest-element
+* schema and is rewritten to `items`.
+*
+* Applies to Drafts 04, 06, and 07 — all of which used the tuple form
+* before Draft 2020-12 split positional schemas into `prefixItems`.
+*
+* No-op when `items` is already a single sub-schema, or when `prefixItems`
+* is already present (do not overwrite an explicit author choice).
+*/
+function translateTupleItems(node) {
+	if (!Array.isArray(node.items) || "prefixItems" in node) return;
+	node.prefixItems = node.items;
+	delete node.items;
+	if ("additionalItems" in node) {
+		node.items = node.additionalItems;
+		delete node.additionalItems;
+	}
+}
+/**
 * Apply the version-agnostic Draft 04 keyword translations to a single
 * node: boolean exclusive-min/max → number form, bare `id` → `$id`, and
 * tuple-form `items` → `prefixItems`.
@@ -1036,14 +1318,7 @@ function applyDraft04Translations(node, ctx) {
 		node.$id = node.id;
 		delete node.id;
 	}
-	if (Array.isArray(node.items) && !("prefixItems" in node)) {
-		node.prefixItems = node.items;
-		delete node.items;
-		if ("additionalItems" in node) {
-			node.items = node.additionalItems;
-			delete node.additionalItems;
-		}
-	}
+	translateTupleItems(node);
 	splitDependencies(node, ctx, false);
 	validateDependentRequired(node, ctx);
 }
@@ -1089,8 +1364,14 @@ function normaliseDraft04NodeWithContext(node, ctx) {
 * (already in final form) and `const`/`examples`, but still use the
 * legacy `dependencies` keyword. Split it into `dependentRequired` /
 * `dependentSchemas` so the walker can process them uniformly.
+*
+* Drafts 06 and 07 also use the tuple form
+* `items: [Schema, Schema], additionalItems: Schema` — translate that to
+* Draft 2020-12's `prefixItems` + rest-`items` so the walker produces a
+* `TupleField` rather than silently dropping the positional schemas.
 */
 function normaliseDraft06Or07NodeWithContext(node, ctx) {
+	translateTupleItems(node);
 	splitDependencies(node, ctx, false);
 	validateDependentRequired(node, ctx);
 	return node;
@@ -1219,9 +1500,21 @@ function resolveRelativeRefs(schema, diagnostics) {
 	const docBaseUrl = parseAbsoluteUri(schema.$id);
 	if (docBaseUrl === void 0) return schema;
 	const docBase = stripFragment(docBaseUrl);
-	return rewriteRelativeRefsNode(schema, docBase, docBase, "", diagnostics);
+	return rewriteRelativeRefsNode(schema, docBase, docBase, "", diagnostics, /* @__PURE__ */ new WeakSet());
 }
-function rewriteRelativeRefsNode(node, currentBase, docBase, pointer, diagnostics) {
+/**
+* Rewrite relative `$ref`s in a single node, recursing into sub-schemas.
+*
+* The `visited` set guards against shared object references and cycles
+* introduced upstream (e.g. by the OpenAPI bundler's `structuredClone`
+* inlining of external refs). When a node is re-encountered the rewrite
+* is short-circuited — returning the original reference unchanged is
+* sound because every relative `$ref` in the subtree was already
+* rewritten on the first visit.
+*/
+function rewriteRelativeRefsNode(node, currentBase, docBase, pointer, diagnostics, visited) {
+	if (visited.has(node)) return node;
+	visited.add(node);
 	let nextBase = currentBase;
 	const nodeId = node.$id;
 	if (typeof nodeId === "string" && nodeId.length > 0) {
@@ -1234,13 +1527,17 @@ function rewriteRelativeRefsNode(node, currentBase, docBase, pointer, diagnostic
 			result[key] = rewriteRef(value, nextBase, docBase, appendPointer(pointer, key), diagnostics);
 			continue;
 		}
-		result[key] = rewriteRelativeRefsValue(value, key, nextBase, docBase, appendPointer(pointer, key), diagnostics);
+		result[key] = rewriteRelativeRefsValue(value, nextBase, docBase, appendPointer(pointer, key), diagnostics, visited);
 	}
 	return result;
 }
-function rewriteRelativeRefsValue(value, parentKey, currentBase, docBase, pointer, diagnostics) {
-	if (Array.isArray(value)) return value.map((item, i) => rewriteRelativeRefsValue(item, parentKey, currentBase, docBase, appendPointer(pointer, String(i)), diagnostics));
-	if (isObject(value)) return rewriteRelativeRefsNode(value, currentBase, docBase, pointer, diagnostics);
+function rewriteRelativeRefsValue(value, currentBase, docBase, pointer, diagnostics, visited) {
+	if (Array.isArray(value)) {
+		if (visited.has(value)) return value;
+		visited.add(value);
+		return value.map((item, i) => rewriteRelativeRefsValue(item, currentBase, docBase, appendPointer(pointer, String(i)), diagnostics, visited));
+	}
+	if (isObject(value)) return rewriteRelativeRefsNode(value, currentBase, docBase, pointer, diagnostics, visited);
 	return value;
 }
 /**
@@ -1290,7 +1587,7 @@ function rewriteRef(ref, currentBase, docBase, pointer, diagnostics) {
 */
 function normaliseOpenApiSchemas(doc, version, diagnostics) {
 	if (isSwagger2(version)) return normaliseSwagger2Document(doc, deepNormalise, normaliseDraft04Node, diagnostics);
-	if (isOpenApi30(version)) return deepNormaliseOpenApi30Doc(doc, deepNormalise);
+	if (isOpenApi30(version)) return deepNormaliseOpenApi30Doc(applyDiscriminatorAllOfPrepass(doc), deepNormalise);
 	if (isOpenApi31(version)) {
 		const dialect = readJsonSchemaDialect(doc);
 		if (dialect.kind === "unknown") emitDiagnostic(diagnostics, {
@@ -1300,7 +1597,7 @@ function normaliseOpenApiSchemas(doc, version, diagnostics) {
 			detail: { uri: dialect.uri }
 		});
 	}
-	return deepNormaliseOpenApiDoc(doc, (schema) => deepNormalise(schema, normaliseOpenApi30Discriminator));
+	return deepNormaliseOpenApiDoc(applyDiscriminatorAllOfPrepass(doc), (schema) => resolveRelativeRefs(deepNormalise(schema, normaliseOpenApi30Discriminator), diagnostics));
 }
 //#endregion
-export { normaliseOpenApiSchemas as a, deepNormaliseOpenApiDoc as c, normaliseOpenApi30Node as d, normaliseJsonSchema as i, normaliseOpenApi30Combined as l, deepNormaliseWithContext as n, normaliseSwagger2Document as o, normaliseDraft04Node as r, deepNormaliseOpenApi30Doc as s, deepNormalise as t, normaliseOpenApi30Discriminator as u };
+export { normaliseOpenApiSchemas as a, deepNormaliseOpenApi30Doc as c, normaliseOpenApi30Discriminator as d, normaliseOpenApi30Node as f, normaliseJsonSchema as i, deepNormaliseOpenApiDoc as l, deepNormaliseWithContext as n, normaliseSwagger2Document as o, normaliseDraft04Node as r, applyDiscriminatorAllOfPrepass as s, deepNormalise as t, normaliseOpenApi30Combined as u };

package/dist/openapi/ApiCallbacks.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { T as SchemaMeta } from "../types-BnxPEElk.mjs";
 import { CallbackInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiLinks.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { T as SchemaMeta } from "../types-BnxPEElk.mjs";
 import { LinkInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiResponseHeaders.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { T as SchemaMeta } from "../types-BnxPEElk.mjs";
 import { HeaderInfo } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiSecurity.d.mts

@@ -1,4 +1,4 @@
-import { T as SchemaMeta } from "../types-C9zw9wbX.mjs";
+import { T as SchemaMeta } from "../types-BnxPEElk.mjs";
 import { SecurityRequirement, SecurityScheme } from "./parser.mjs";
 import { ReactNode } from "react";
 

package/dist/openapi/ApiSecurity.mjs

@@ -1,5 +1,46 @@
+import { isObject } from "../core/guards.mjs";
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 //#region src/openapi/ApiSecurity.tsx
+/**
+* The four OAuth 2 flow keys defined by OpenAPI 3.x. Listed in the
+* canonical specification order so renders are deterministic.
+*/
+const OAUTH_FLOW_KEYS = [
+	"implicit",
+	"password",
+	"clientCredentials",
+	"authorizationCode"
+];
+function readString(source, key) {
+	const value = source[key];
+	return typeof value === "string" ? value : void 0;
+}
+function readScopes(source) {
+	const scopes = source.scopes;
+	const result = /* @__PURE__ */ new Map();
+	if (!isObject(scopes)) return result;
+	for (const [name, description] of Object.entries(scopes)) {
+		if (typeof description !== "string") continue;
+		result.set(name, description);
+	}
+	return result;
+}
+function extractFlows(flows) {
+	if (flows === void 0) return [];
+	const result = [];
+	for (const name of OAUTH_FLOW_KEYS) {
+		const flow = flows[name];
+		if (!isObject(flow)) continue;
+		result.push({
+			name,
+			authorizationUrl: readString(flow, "authorizationUrl"),
+			tokenUrl: readString(flow, "tokenUrl"),
+			refreshUrl: readString(flow, "refreshUrl"),
+			scopes: readScopes(flow)
+		});
+	}
+	return result;
+}
 function ApiSecurity({ requirements, schemes }) {
 	if (requirements.length === 0) return null;
 	return /* @__PURE__ */ jsxs("section", {
@@ -13,13 +54,7 @@ function ApiSecurity({ requirements, schemes }) {
 						"data-security-name": true,
 						children: req.name
 					}),
-					scheme !== void 0 && /* @__PURE__ */ jsxs(Fragment, { children: [scheme.type !== void 0 && /* @__PURE__ */ jsx("span", {
-						"data-security-type": true,
-						children: scheme.type
-					}), scheme.description && /* @__PURE__ */ jsx("span", {
-						"data-security-description": true,
-						children: scheme.description
-					})] }),
+					scheme !== void 0 && /* @__PURE__ */ jsx(SchemeDetails, { scheme }),
 					req.scopes.length > 0 && /* @__PURE__ */ jsx("span", {
 						"data-security-scopes": true,
 						children: req.scopes.join(", ")
@@ -29,5 +64,76 @@ function ApiSecurity({ requirements, schemes }) {
 		})]
 	});
 }
+function SchemeDetails({ scheme }) {
+	const flows = extractFlows(scheme.flows);
+	return /* @__PURE__ */ jsxs(Fragment, { children: [
+		scheme.type !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-type": true,
+			children: scheme.type
+		}),
+		scheme.description !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-description": true,
+			children: scheme.description
+		}),
+		scheme.scheme !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-http-scheme": true,
+			children: scheme.scheme
+		}),
+		scheme.bearerFormat !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-bearer-format": true,
+			children: scheme.bearerFormat
+		}),
+		scheme.name !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-apikey-name": true,
+			children: scheme.name
+		}),
+		scheme.location !== void 0 && /* @__PURE__ */ jsx("span", {
+			"data-security-apikey-in": true,
+			children: scheme.location
+		}),
+		scheme.openIdConnectUrl !== void 0 && /* @__PURE__ */ jsx("a", {
+			"data-security-openid-url": true,
+			href: scheme.openIdConnectUrl,
+			children: scheme.openIdConnectUrl
+		}),
+		flows.length > 0 && /* @__PURE__ */ jsx("section", {
+			"data-security-flows": true,
+			children: flows.map((flow) => /* @__PURE__ */ jsx(FlowDetails, { flow }, flow.name))
+		})
+	] });
+}
+function FlowDetails({ flow }) {
+	return /* @__PURE__ */ jsxs("div", {
+		"data-security-flow": flow.name,
+		children: [
+			/* @__PURE__ */ jsx("span", {
+				"data-security-flow-name": true,
+				children: flow.name
+			}),
+			flow.authorizationUrl !== void 0 && /* @__PURE__ */ jsx("a", {
+				"data-security-flow-authorization-url": true,
+				href: flow.authorizationUrl,
+				children: flow.authorizationUrl
+			}),
+			flow.tokenUrl !== void 0 && /* @__PURE__ */ jsx("a", {
+				"data-security-flow-token-url": true,
+				href: flow.tokenUrl,
+				children: flow.tokenUrl
+			}),
+			flow.refreshUrl !== void 0 && /* @__PURE__ */ jsx("a", {
+				"data-security-flow-refresh-url": true,
+				href: flow.refreshUrl,
+				children: flow.refreshUrl
+			}),
+			flow.scopes.size > 0 && /* @__PURE__ */ jsx("dl", {
+				"data-security-flow-scopes": true,
+				children: [...flow.scopes.entries()].map(([name, description]) => /* @__PURE__ */ jsxs("div", {
+					"data-security-flow-scope": name,
+					children: [/* @__PURE__ */ jsx("dt", { children: name }), /* @__PURE__ */ jsx("dd", { children: description })]
+				}, name))
+			})
+		]
+	});
+}
 //#endregion
 export { ApiSecurity };

package/dist/openapi/components.d.mts

@@ -1,10 +1,24 @@
-import { T as SchemaMeta, u as FieldOverride } from "../types-C9zw9wbX.mjs";
-import { a as InferResponseFields, i as InferRequestBodyFields, m as UnsafeFields, r as InferParameterOverrides } from "../typeInference-CDoD_LZ_.mjs";
+import { T as SchemaMeta, u as FieldOverride } from "../types-BnxPEElk.mjs";
+import { r as DiagnosticSink } from "../diagnostics-CbBPsxSt.mjs";
+import { a as InferResponseFields, i as InferRequestBodyFields, m as UnsafeFields, r as InferParameterOverrides } from "../typeInference-Bxw3NOG1.mjs";
 import { WidgetMap } from "../react/SchemaComponent.mjs";
 import { ReactNode } from "react";
 
 //#region src/openapi/components.d.ts
-interface ApiOperationProps<Doc = unknown, Path extends string = string, Method extends string = string> {
+/**
+ * Diagnostics props accepted by every top-level OpenAPI component.
+ *
+ * `onDiagnostic` is the sink invoked for each event surfaced by the
+ * normalisation pipeline (duplicate body parameter, dropped Swagger
+ * feature, divisible-by conflict, unknown JSON Schema dialect,
+ * relative-ref resolved, etc.). `strict` converts every emitted
+ * diagnostic into a thrown `SchemaNormalisationError`.
+ */
+interface ApiDiagnosticsProps {
+  onDiagnostic?: DiagnosticSink;
+  strict?: boolean;
+}
+interface ApiOperationProps<Doc = unknown, Path extends string = string, Method extends string = string> extends ApiDiagnosticsProps {
   schema: Doc;
   path: Path;
   method: Method;
@@ -30,9 +44,11 @@ declare function ApiOperation<Doc = unknown, Path extends string = string, Metho
   responseValue,
   meta,
   requestBodyFields,
-  widgets
+  widgets,
+  onDiagnostic,
+  strict
 }: ApiOperationProps<Doc, Path, Method>): ReactNode;
-interface ApiParametersProps<Doc = unknown, Path extends string = string, Method extends string = string> {
+interface ApiParametersProps<Doc = unknown, Path extends string = string, Method extends string = string> extends ApiDiagnosticsProps {
   schema: Doc;
   path: Path;
   method: Method;
@@ -47,9 +63,11 @@ declare function ApiParameters<Doc = unknown, Path extends string = string, Meth
   method,
   meta,
   overrides,
-  widgets
+  widgets,
+  onDiagnostic,
+  strict
 }: ApiParametersProps<Doc, Path, Method>): ReactNode;
-interface ApiRequestBodyProps<Doc = unknown, Path extends string = string, Method extends string = string> {
+interface ApiRequestBodyProps<Doc = unknown, Path extends string = string, Method extends string = string> extends ApiDiagnosticsProps {
   schema: Doc;
   path: Path;
   method: Method;
@@ -68,9 +86,11 @@ declare function ApiRequestBody<Doc = unknown, Path extends string = string, Met
   onChange,
   meta,
   fields,
-  widgets
+  widgets,
+  onDiagnostic,
+  strict
 }: ApiRequestBodyProps<Doc, Path, Method>): ReactNode;
-interface ApiResponseProps<Doc = unknown, Path extends string = string, Method extends string = string, Status extends string = string> {
+interface ApiResponseProps<Doc = unknown, Path extends string = string, Method extends string = string, Status extends string = string> extends ApiDiagnosticsProps {
   schema: Doc;
   path: Path;
   method: Method;
@@ -89,7 +109,9 @@ declare function ApiResponse<Doc = unknown, Path extends string = string, Method
   value,
   meta,
   fields,
-  widgets
+  widgets,
+  onDiagnostic,
+  strict
 }: ApiResponseProps<Doc, Path, Method, Status>): ReactNode;
 //#endregion
 export { ApiOperation, ApiOperationProps, ApiParameters, ApiParametersProps, ApiRequestBody, ApiRequestBodyProps, ApiResponse, ApiResponseProps };