@scalar/api-client 3.13.2 → 3.13.4

package/CHANGELOG.md

@@ -1,5 +1,18 @@
 # @scalar/api-client
 
+## 3.13.4
+
+### Patch Changes
+
+- [#9618](https://github.com/scalar/scalar/pull/9618): Name the actual document type in the "security scheme is missing a type" warning. When a scheme has no recognizable type, the auth selector previously always told users to check their "OpenAPI document", even for AsyncAPI documents. The warning now reflects the document it belongs to (e.g. "AsyncAPI") via a new optional `documentType` prop on the auth selector block, defaulting to `openapi`. Schemes that carry a valid but unsupported type (such as AsyncAPI broker types like `userPassword` or `scramSha256`) now show a dedicated "not supported yet" message naming the type, instead of the misleading "missing a type" warning.
+
+## 3.13.3
+
+### Patch Changes
+
+- [#9671](https://github.com/scalar/scalar/pull/9671): Add a `canDeleteSchemes` prop to the auth selector so the delete (trash) affordance can be hidden. It defaults to `true` (unchanged for the API client, where schemes are editable) and the API reference now passes `false`, since its schemes come from the rendered document and cannot be removed there.
+- [#9670](https://github.com/scalar/scalar/pull/9670): Persist cookies set by a response into the document cookie jar so values like a Django CSRF token survive a page reload and are replayed on later requests
+
 ## 3.13.2
 
 ## 3.13.1

package/README.md

@@ -11,6 +11,20 @@ The Scalar API Client is a powerful tool designed to simplify API testing and in
 - embeddable component in various frontend environments
 - customizable module that can be integrated into existing projects
 
+---
+
+Scalar is an open-source API platform for teams who want beautiful developer interfaces without vendor lock-in.
+
+- **[API References](https://scalar.com/products/api-references/getting-started)** — Interactive API documentation from OpenAPI and AsyncAPI specs.
+- **[Docs](https://scalar.com/products/docs/getting-started)** — Write in Markdown/MDX, generate API references, sync with two-way Git.
+- **[SDKs](https://scalar.com/products/sdks/getting-started)** — Type-safe client libraries in TypeScript, Python, Go, PHP, Java, and Ruby.
+- **[MCP Servers](https://scalar.com/products/agent/getting-started)** — Generate secure MCP servers from your API spec.
+- **[API Client](https://scalar.com/products/api-client/getting-started)** — Open-source, offline-first Postman alternative built on OpenAPI.
+
+20M+ monthly npm installs · 15,500+ GitHub stars · MIT licensed · [scalar.com](https://scalar.com)
+
+---
+
 ## ⚠️ Breaking Changes
 
 We have removed the old version of the clients so you must update your imports as seen below. We will keep the v2 exports for a while then remove them.

package/dist/style.css

@@ -3056,6 +3056,11 @@
   translate: var(--tw-translate-x) var(--tw-translate-y);
 }
 
+.scalar-app .translate-x-1\.25 {
+  --tw-translate-x: calc(4px * 1.25);
+  translate: var(--tw-translate-x) var(--tw-translate-y);
+}
+
 .scalar-app .translate-x-2\.5 {
   --tw-translate-x: calc(4px * 2.5);
   translate: var(--tw-translate-x) var(--tw-translate-y);
@@ -3641,6 +3646,10 @@
   background-color: currentColor;
 }
 
+.scalar-app .bg-green {
+  background-color: var(--scalar-color-green);
+}
+
 .scalar-app .bg-inherit {
   background-color: inherit;
 }

package/dist/v2/blocks/operation-block/OperationBlock.vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OperationBlock.vue.d.ts","sourceRoot":"","sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"names":[],"mappings":"AA8lBA,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAA;AACrF,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AACnF,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAML,KAAK,qBAAqB,EAE1B,KAAK,0BAA0B,EAChC,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qEAAqE,CAAA;AACxG,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACb,MAAM,8DAA8D,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAA;AAoB5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;;;GAYG;wBACkB,OAAO,YAAY;AAAxC,wBAAyC;AAMzC,MAAM,MAAM,mBAAmB,GAAG;IAChC,gBAAgB;IAChB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,uBAAuB;IACvB,QAAQ,EAAE,eAAe,CAAA;IACzB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB;IACxB,gBAAgB,EAAE,aAAa,EAAE,CAAA;IACjC,uBAAuB;IACvB,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,mBAAmB;IACnB,WAAW,EAAE,gBAAgB,CAAA;IAC7B,oCAAoC;IACpC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,oBAAoB;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,gCAAgC;IAChC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,gCAAgC;IAChC,cAAc,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC,yBAAyB,CAAC,CAAA;IACtE,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;IACtB,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oBAAoB;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,CAAA;IACpC,uBAAuB;IACvB,SAAS,EAAE,eAAe,CAAA;IAC1B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,wCAAwC;IACxC,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB;IACrB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8CAA8C;IAC9C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,0CAA0C;IAC1C,uBAAuB,EAAE,0BAA0B,EAAE,CAAA;IACrD,4BAA4B;IAC5B,oBAAoB,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACjD,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,sEAAsE;IACtE,+BAA+B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxD,6CAA6C;IAC7C,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CAChC,CAAA;AACD,QAAA,MAAM,YAAY,kTAglBd,CAAC"}
+{"version":3,"file":"OperationBlock.vue.d.ts","sourceRoot":"","sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"names":[],"mappings":"AA0oBA,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,MAAM,mCAAmC,CAAA;AACrF,OAAO,EAAe,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC1E,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAA;AAG/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAC7E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iDAAiD,CAAA;AACnF,OAAO,KAAK,EACV,QAAQ,EACR,UAAU,EACV,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAML,KAAK,qBAAqB,EAE1B,KAAK,0BAA0B,EAChC,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qEAAqE,CAAA;AACxG,OAAO,KAAK,EACV,eAAe,EACf,YAAY,EACb,MAAM,8DAA8D,CAAA;AACrE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAA;AAwB5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD;;;;;;;;;;;;GAYG;wBACkB,OAAO,YAAY;AAAxC,wBAAyC;AAMzC,MAAM,MAAM,mBAAmB,GAAG;IAChC,gBAAgB;IAChB,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,0BAA0B;IAC1B,UAAU,EAAE,MAAM,CAAA;IAClB,uBAAuB;IACvB,QAAQ,EAAE,eAAe,CAAA;IACzB,4BAA4B;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,wBAAwB;IACxB,gBAAgB,EAAE,aAAa,EAAE,CAAA;IACjC,uBAAuB;IACvB,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,2BAA2B;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,6BAA6B;IAC7B,MAAM,EAAE,cAAc,CAAA;IACtB,mBAAmB;IACnB,WAAW,EAAE,gBAAgB,CAAA;IAC7B,oCAAoC;IACpC,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,oBAAoB;IACpB,MAAM,EAAE,YAAY,CAAA;IACpB,gCAAgC;IAChC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,gCAAgC;IAChC,cAAc,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC,yBAAyB,CAAC,CAAA;IACtE,mDAAmD;IACnD,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,sCAAsC;IACtC,UAAU,EAAE,UAAU,CAAA;IACtB,4CAA4C;IAC5C,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,0BAA0B;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oBAAoB;IACpB,MAAM,CAAC,EAAE,SAAS,GAAG,eAAe,CAAA;IACpC,uBAAuB;IACvB,SAAS,EAAE,eAAe,CAAA;IAC1B,+DAA+D;IAC/D,UAAU,EAAE,MAAM,CAAA;IAClB,2CAA2C;IAC3C,QAAQ,EAAE,QAAQ,CAAA;IAClB,wCAAwC;IACxC,eAAe,EAAE,qBAAqB,CAAA;IACtC,qBAAqB;IACrB,OAAO,EAAE,YAAY,EAAE,CAAA;IACvB,uBAAuB;IACvB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,qCAAqC;IACrC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,8CAA8C;IAC9C,WAAW,EAAE,kBAAkB,CAAA;IAC/B,yCAAyC;IACzC,QAAQ,EAAE,MAAM,CAAA;IAChB,kCAAkC;IAClC,gBAAgB,EAAE,gBAAgB,CAAA;IAClC,0CAA0C;IAC1C,uBAAuB,EAAE,0BAA0B,EAAE,CAAA;IACrD,4BAA4B;IAC5B,oBAAoB,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACjD,sBAAsB;IACtB,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,sEAAsE;IACtE,+BAA+B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACxD,6CAA6C;IAC7C,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAA;CAChC,CAAA;AACD,QAAA,MAAM,YAAY,kTAwnBd,CAAC"}

package/dist/v2/blocks/operation-block/OperationBlock.vue.js.map

@@ -1 +1 @@
-{"version":3,"file":"OperationBlock.vue.js","names":[],"sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"sourcesContent":["<script lang=\"ts\">\n/**\n * OperationBlock\n *\n * Orchestrates the operation view by wiring together the Header, OperationBlock,\n * and ResponseBlock. Forwards user interactions to the workspace event bus and\n * passes through configuration such as auth, servers, plugins, and environment.\n * This component keeps the Operation page lean by centralizing event emission\n * and prop wiring between the blocks.\n *\n * Notable behavior:\n * - Uses operation['x-scalar-method'] and operation['x-scalar-path'] to provide\n *   draft overrides for the UI when present.\n */\nexport default {\n  name: 'OperationBlock',\n}\n\nexport type OperationBlockProps = {\n  /** Event bus */\n  eventBus: WorkspaceEventBus\n  /** Application version */\n  appVersion: string\n  /** Openapi document */\n  document: OpenApiDocument\n  /** Openapi document slug */\n  documentSlug: string\n  /** Workspace cookies */\n  workspaceCookies: XScalarCookie[]\n  /** Document cookies */\n  documentCookies: XScalarCookie[]\n  /** Current request path */\n  path: string\n  /** Current request method */\n  method: HttpMethodType\n  /** HTTP clients */\n  httpClients: AvailableClients\n  /** The history for the operation */\n  history?: HistoryEntry[]\n  /** Client layout */\n  layout: ClientLayout\n  /** Currently selected server */\n  server: ServerObject | null\n  /** Currently selected client */\n  selectedClient: WorkspaceStore['workspace']['x-scalar-default-client']\n  /** Server list available for operation/document */\n  servers: ServerObject[]\n  /** Meta information for the server */\n  serverMeta: ServerMeta\n  /** Hides the client button on the header */\n  hideClientButton?: boolean\n  /** Client integration  */\n  integration?: string | null\n  /** Openapi document url for `modal` mode to open the client app */\n  documentUrl?: string\n  /** Client source */\n  source?: 'gitbook' | 'api-reference'\n  /** Operation object */\n  operation: OperationObject\n  /** Currently selected example key for the current operation */\n  exampleKey: string\n  /** Meta information for the auth update */\n  authMeta: AuthMeta\n  /** Document defined security schemes */\n  securitySchemes: MergedSecuritySchemes\n  /** Client plugins */\n  plugins: ClientPlugin[]\n  /** Environment list */\n  environments?: string[]\n  /** Currently selected environment */\n  activeEnvironment?: string\n  /** For environment variables in the inputs */\n  environment: XScalarEnvironment\n  /** The proxy URL for sending requests */\n  proxyUrl: string\n  /** Currently selected security */\n  selectedSecurity: SelectedSecurity\n  /** Currently selected security schemes */\n  selectedSecuritySchemes: SecuritySchemeObjectSecret[]\n  /** Security requirements */\n  securityRequirements: OpenApiDocument['security']\n  /** Default headers */\n  defaultHeaders: Record<string, string>\n  /** Selected anyOf/oneOf request-body variants keyed by schema path */\n  requestBodyCompositionSelection?: Record<string, number>\n  /** Subset of config options for the modal */\n  options?: ModalProps['options']\n}\n</script>\n<script setup lang=\"ts\">\nimport { generateClientOptions } from '@scalar/blocks/code-example'\nimport { ERRORS } from '@scalar/helpers/errors/normalize-error'\nimport { isElectron } from '@scalar/helpers/general/is-electron'\nimport { buildSafeBodyRequest } from '@scalar/helpers/http/can-method-have-body'\nimport type { HttpMethod as HttpMethodType } from '@scalar/helpers/http/http-methods'\nimport { executeHook, type ClientPlugin } from '@scalar/oas-utils/helpers'\nimport {\n  AVAILABLE_CLIENTS,\n  type AvailableClients,\n} from '@scalar/types/snippetz'\nimport { useClipboard } from '@scalar/use-hooks/useClipboard'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { WorkspaceStore } from '@scalar/workspace-store/client'\nimport type { SelectedSecurity } from '@scalar/workspace-store/entities/auth'\nimport type { HistoryEntry } from '@scalar/workspace-store/entities/history/schema'\nimport type {\n  AuthMeta,\n  ServerMeta,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  buildRequest,\n  createVariablesStoreForRequest,\n  getEnvironmentVariables,\n  requestFactory,\n  resolveExecutableRequestUrl,\n  type MergedSecuritySchemes,\n  type RequestPayload,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies'\nimport type {\n  OpenApiDocument,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation'\nimport { computed, onBeforeUnmount, onMounted, ref, toValue, watch } from 'vue'\n\nimport ViewLayout from '@/components/ViewLayout/ViewLayout.vue'\nimport ViewLayoutContent from '@/components/ViewLayout/ViewLayoutContent.vue'\nimport { harToFetchRequest } from '@/v2/blocks/operation-block/helpers/har-to-fetch-request'\nimport { harToFetchResponse } from '@/v2/blocks/operation-block/helpers/har-to-fetch-response'\nimport {\n  getOperationExampleKey,\n  isStreamingResponse,\n  responseCache,\n} from '@/v2/blocks/operation-block/helpers/response-cache'\nimport {\n  sendRequest,\n  type ResponseInstance,\n} from '@/v2/blocks/operation-block/helpers/send-request'\nimport { validatePathParameters } from '@/v2/blocks/operation-block/helpers/validate-path-parameters'\nimport { RequestBlock } from '@/v2/blocks/request-block'\nimport { ResponseBlock } from '@/v2/blocks/response-block'\nimport { type History } from '@/v2/blocks/scalar-address-bar-block'\nimport type { ModalProps } from '@/v2/features/modal/Modal.vue'\nimport type { ClientLayout } from '@/v2/types/layout'\n\nimport Header from './components/Header.vue'\n\nconst {\n  authMeta,\n  environment,\n  eventBus,\n  exampleKey,\n  document,\n  documentSlug,\n  workspaceCookies = [],\n  documentCookies = [],\n  hideClientButton,\n  httpClients = AVAILABLE_CLIENTS,\n  history = [],\n  layout,\n  method,\n  operation,\n  path,\n  plugins = [],\n  proxyUrl,\n  requestBodyCompositionSelection,\n  securitySchemes,\n  selectedClient,\n  server,\n  environments,\n  options,\n  activeEnvironment,\n  serverMeta,\n  selectedSecurity,\n  selectedSecuritySchemes,\n  securityRequirements,\n  defaultHeaders,\n} = defineProps<OperationBlockProps>()\n\n/** Hoist up client generation so it doesn't get re-generated on every operation */\nconst clientOptions = computed(() => generateClientOptions(httpClients))\n\nconst { toast } = useToasts()\nconst { copyToClipboard } = useClipboard()\n\n// Refs\nconst abortController = ref<AbortController | null>(null)\nconst response = ref<ResponseInstance | null>(null)\nconst requestPayload = ref<RequestPayload | null>(null)\n\n/** Cancel the request */\nconst cancelRequest = () => abortController.value?.abort(ERRORS.REQUEST_ABORTED)\n\n/**\n * Copy the executable URL — same pipeline as Send (`requestFactory` +\n * `resolveExecutableRequestUrl`), including security query params.\n */\nconst copyAddressBarUrl = async (): Promise<void> => {\n  const { request } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies: [...workspaceCookies, ...documentCookies],\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  await copyToClipboard(\n    resolveExecutableRequestUrl(request, getEnvironmentVariables(environment)),\n  )\n}\n\n/** Execute the current operation example */\nconst handleExecute = async () => {\n  eventBus.flushDebouncedEmits?.()\n\n  const pathValidation = validatePathParameters(\n    operation.parameters ?? [],\n    exampleKey,\n  )\n  if (pathValidation.ok === false) {\n    toast('Path parameters must have values.', 'error')\n    return\n  }\n\n  const globalCookies = [...workspaceCookies, ...documentCookies]\n\n  const { request: requestBuilder } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies,\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  // Stop any previous streaming response\n  if (response.value && 'reader' in response.value) {\n    response.value.reader.cancel()\n  }\n\n  const variablesStore = createVariablesStoreForRequest()\n\n  // Execute the beforeRequest hook (plugins receive RequestFactory, not fetch Request)\n  await executeHook(\n    {\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'beforeRequest',\n    plugins,\n  )\n\n  const envVariables = {\n    ...getEnvironmentVariables(environment),\n    ...variablesStore.getVariables(),\n  }\n\n  // Build the fetch Request after hooks may have mutated the factory\n  const built = buildRequest(requestBuilder, {\n    envVariables,\n    allowMissingRequestServerBase: layout === 'modal',\n  })\n  if (!built.ok) {\n    toast(built.message ?? built.error, 'error')\n    return\n  }\n\n  // Store the abort controller for cancellation\n  abortController.value = built.data.controller\n\n  // Build the fetch Request once so the requestBuilt hook observes the exact bytes that are\n  // sent. Rebuilding it later would generate a different multipart boundary, which breaks\n  // plugins that hash the body (for example, request signing).\n  const request = buildSafeBodyRequest(...built.data.requestPayload)\n\n  // Execute the requestBuilt hook (plugins receive the exact fetch Request that will be sent)\n  await executeHook(\n    {\n      request,\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'requestBuilt',\n    plugins,\n  )\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:sent', {\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  /** Execute the request */\n  const [sendError, sendResult] = await sendRequest({\n    isUsingProxy: built.data.isUsingProxy,\n    requestPayload: built.data.requestPayload,\n    request,\n    plugins,\n    customFetch: toValue(options)?.customFetch,\n  })\n\n  if (sendResult) {\n    // Execute the responseReceived hook\n    await executeHook(\n      {\n        response: sendResult.originalResponse.clone(),\n        requestBuilder,\n        request: buildSafeBodyRequest(...sendResult.requestPayload),\n        document,\n        operation,\n        variablesStore,\n      },\n      'responseReceived',\n      plugins,\n    )\n  }\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:complete', {\n    payload: sendResult\n      ? {\n          response: sendResult.originalResponse.clone(),\n          requestPayload: sendResult.requestPayload,\n          duration: sendResult.response.duration,\n          timestamp: sendResult.timestamp,\n        }\n      : undefined,\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  if (sendError) {\n    // clean up the response and request\n    response.value = null\n    requestPayload.value = null\n    abortController.value = null\n\n    toast(sendError.message, 'error')\n    return\n  }\n\n  // Store the response\n  response.value = sendResult.response\n  requestPayload.value = sendResult.requestPayload\n\n  // Cache non-streaming responses so they can be restored when navigating back\n  if (!isStreamingResponse(sendResult.response)) {\n    responseCache.set(getOperationExampleKey(method, path, exampleKey), {\n      response: sendResult.response,\n      requestPayload: sendResult.requestPayload,\n    })\n  }\n}\n\nonMounted(() => {\n  eventBus.on('operation:send:request:hotkey', handleExecute)\n  eventBus.on('operation:cancel:request', cancelRequest)\n  eventBus.on('copy-url:address-bar', copyAddressBarUrl)\n\n  // Let plugins warm up per-operation resources (e.g. the scripts sandbox) so the first request\n  // does not pay their cold-start cost.\n  void executeHook({ document, operation }, 'onRequestMount', plugins)\n})\nonBeforeUnmount(() => {\n  eventBus.off('operation:send:request:hotkey', handleExecute)\n  eventBus.off('operation:cancel:request', cancelRequest)\n  eventBus.off('copy-url:address-bar', copyAddressBarUrl)\n})\n\nconst operationHistory = computed<History[]>(() =>\n  history\n    .map((entry) => ({\n      method: entry.request.method as HttpMethodType,\n      path: entry.request.url,\n      duration: entry.time,\n      status: entry.response.status,\n    }))\n    .reverse(),\n)\n\nconst handleSelectHistoryItem = ({ index }: { index: number }) => {\n  const transformedIndex = (history.length ?? 0) - index - 1\n  const historyItem = history[transformedIndex]\n  if (!historyItem) {\n    return\n  }\n\n  const navigate = () =>\n    eventBus.emit('ui:navigate', {\n      page: 'example',\n      method,\n      path,\n      exampleName: 'draft',\n      callback: (status) => {\n        // Do not replace the response if the navigation was not successful\n        if (status !== 'success') {\n          return\n        }\n        // Reconstruct the response\n        const fetchResponse = harToFetchResponse({\n          harResponse: historyItem.response,\n          url: historyItem.request.url,\n          method,\n          path,\n          duration: historyItem.time,\n        })\n\n        // Reconstruct the request\n        const fetchRequest = harToFetchRequest({\n          harRequest: historyItem.request,\n        })\n\n        // Update the response and request\n        response.value = fetchResponse\n        requestPayload.value = fetchRequest\n      },\n    })\n\n  eventBus.emit('operation:reload:history', {\n    meta: {\n      path,\n      method,\n    },\n    index: transformedIndex,\n    callback: navigate,\n  })\n}\n\nconst handleNavigateSettings = () => {\n  eventBus.emit('ui:navigate', {\n    page: 'operation',\n    path: 'overview',\n    operationPath: path,\n    method,\n  })\n}\n\n/**\n * When the path, method, or example key changes, restore the response panel\n * for the new operation from the best available source:\n *\n *   1. `responseCache` — in-memory, populated on every successful send.\n *      Has the live response object (including streams) so it wins.\n *   2. `history` — persisted in the workspace store. Used as a fallback when\n *      the in-memory cache is empty (page reload, fresh app session, etc.)\n *      so navigating to an operation that has been called before shows the\n *      last response instead of an empty panel.\n *   3. Otherwise clear.\n *\n * Only the response is restored from history — the user's request inputs are\n * left alone, so we never silently overwrite an in-progress draft.\n */\nwatch(\n  [() => path, () => method, () => exampleKey],\n  ([newPath, newMethod, newExampleKey]) => {\n    const cached = responseCache.get(\n      getOperationExampleKey(newMethod, newPath, newExampleKey),\n    )\n\n    if (cached) {\n      response.value = cached.response\n      requestPayload.value = cached.requestPayload\n    } else {\n      // History is keyed only by document/path/method but each entry carries\n      // the example it came from, so we walk from the end and pick the most\n      // recent entry that matches the active example. Otherwise a cache miss\n      // on example B would restore example A's response. Only runs on a\n      // cache miss — the common case (in-session navigation) skips it.\n      const latest = (() => {\n        for (let i = history.length - 1; i >= 0; i--) {\n          const entry = history[i]\n          if (entry?.meta.example === newExampleKey) {\n            return entry\n          }\n        }\n        return undefined\n      })()\n\n      if (latest) {\n        response.value = harToFetchResponse({\n          harResponse: latest.response,\n          url: latest.request.url,\n          method: newMethod,\n          path: newPath,\n          duration: latest.time,\n        })\n        requestPayload.value = null\n      } else {\n        response.value = null\n        requestPayload.value = null\n      }\n    }\n\n    // Cancel any in-flight request\n    cancelRequest()\n  },\n  { immediate: true },\n)\n\nonBeforeUnmount(() => {\n  // We cancel the request if the component is unmounted\n  cancelRequest()\n})\n</script>\n<template>\n  <div class=\"bg-b-1 flex h-full flex-col\">\n    <div\n      class=\"lg:min-h-header flex w-full flex-wrap items-center justify-center p-2 lg:p-0\">\n      <!-- Address Bar -->\n      <Header\n        :activeEnvironment\n        :documentSlug\n        :documentUrl\n        :environment\n        :environments\n        :eventBus\n        :exampleKey\n        :hideClientButton\n        :history=\"operationHistory\"\n        :integration\n        :layout\n        :method\n        :path\n        :server\n        :serverMeta\n        :servers\n        :source\n        @execute=\"handleExecute\"\n        @navigate:settings=\"handleNavigateSettings\"\n        @select:history:item=\"handleSelectHistoryItem\" />\n    </div>\n\n    <ViewLayout class=\"border-t\">\n      <ViewLayoutContent class=\"flex-1\">\n        <!-- Request Section -->\n        <RequestBlock\n          :authMeta\n          :clientOptions\n          :defaultHeaders\n          :documentCookies\n          :environment\n          :eventBus\n          :exampleKey\n          :layout\n          :method\n          :operation\n          :options=\"toValue(options)\"\n          :path\n          :plugins\n          :proxyUrl\n          :requestBodyCompositionSelection\n          :securityRequirements\n          :securitySchemes\n          :selectedClient\n          :selectedSecurity\n          :selectedSecuritySchemes\n          :server\n          :workspaceCookies />\n\n        <!-- Response Section -->\n        <ResponseBlock\n          :appVersion\n          :eventBus\n          :layout\n          :plugins\n          :requestPayload\n          :response\n          :totalPerformedRequests=\"operationHistory.length\" />\n      </ViewLayoutContent>\n    </ViewLayout>\n  </div>\n</template>\n"],"mappings":""}
+{"version":3,"file":"OperationBlock.vue.js","names":[],"sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"sourcesContent":["<script lang=\"ts\">\n/**\n * OperationBlock\n *\n * Orchestrates the operation view by wiring together the Header, OperationBlock,\n * and ResponseBlock. Forwards user interactions to the workspace event bus and\n * passes through configuration such as auth, servers, plugins, and environment.\n * This component keeps the Operation page lean by centralizing event emission\n * and prop wiring between the blocks.\n *\n * Notable behavior:\n * - Uses operation['x-scalar-method'] and operation['x-scalar-path'] to provide\n *   draft overrides for the UI when present.\n */\nexport default {\n  name: 'OperationBlock',\n}\n\nexport type OperationBlockProps = {\n  /** Event bus */\n  eventBus: WorkspaceEventBus\n  /** Application version */\n  appVersion: string\n  /** Openapi document */\n  document: OpenApiDocument\n  /** Openapi document slug */\n  documentSlug: string\n  /** Workspace cookies */\n  workspaceCookies: XScalarCookie[]\n  /** Document cookies */\n  documentCookies: XScalarCookie[]\n  /** Current request path */\n  path: string\n  /** Current request method */\n  method: HttpMethodType\n  /** HTTP clients */\n  httpClients: AvailableClients\n  /** The history for the operation */\n  history?: HistoryEntry[]\n  /** Client layout */\n  layout: ClientLayout\n  /** Currently selected server */\n  server: ServerObject | null\n  /** Currently selected client */\n  selectedClient: WorkspaceStore['workspace']['x-scalar-default-client']\n  /** Server list available for operation/document */\n  servers: ServerObject[]\n  /** Meta information for the server */\n  serverMeta: ServerMeta\n  /** Hides the client button on the header */\n  hideClientButton?: boolean\n  /** Client integration  */\n  integration?: string | null\n  /** Openapi document url for `modal` mode to open the client app */\n  documentUrl?: string\n  /** Client source */\n  source?: 'gitbook' | 'api-reference'\n  /** Operation object */\n  operation: OperationObject\n  /** Currently selected example key for the current operation */\n  exampleKey: string\n  /** Meta information for the auth update */\n  authMeta: AuthMeta\n  /** Document defined security schemes */\n  securitySchemes: MergedSecuritySchemes\n  /** Client plugins */\n  plugins: ClientPlugin[]\n  /** Environment list */\n  environments?: string[]\n  /** Currently selected environment */\n  activeEnvironment?: string\n  /** For environment variables in the inputs */\n  environment: XScalarEnvironment\n  /** The proxy URL for sending requests */\n  proxyUrl: string\n  /** Currently selected security */\n  selectedSecurity: SelectedSecurity\n  /** Currently selected security schemes */\n  selectedSecuritySchemes: SecuritySchemeObjectSecret[]\n  /** Security requirements */\n  securityRequirements: OpenApiDocument['security']\n  /** Default headers */\n  defaultHeaders: Record<string, string>\n  /** Selected anyOf/oneOf request-body variants keyed by schema path */\n  requestBodyCompositionSelection?: Record<string, number>\n  /** Subset of config options for the modal */\n  options?: ModalProps['options']\n}\n</script>\n<script setup lang=\"ts\">\nimport { generateClientOptions } from '@scalar/blocks/code-example'\nimport { ERRORS } from '@scalar/helpers/errors/normalize-error'\nimport { isElectron } from '@scalar/helpers/general/is-electron'\nimport { buildSafeBodyRequest } from '@scalar/helpers/http/can-method-have-body'\nimport type { HttpMethod as HttpMethodType } from '@scalar/helpers/http/http-methods'\nimport { executeHook, type ClientPlugin } from '@scalar/oas-utils/helpers'\nimport {\n  AVAILABLE_CLIENTS,\n  type AvailableClients,\n} from '@scalar/types/snippetz'\nimport { useClipboard } from '@scalar/use-hooks/useClipboard'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { WorkspaceStore } from '@scalar/workspace-store/client'\nimport type { SelectedSecurity } from '@scalar/workspace-store/entities/auth'\nimport type { HistoryEntry } from '@scalar/workspace-store/entities/history/schema'\nimport type {\n  AuthMeta,\n  ServerMeta,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  buildRequest,\n  createVariablesStoreForRequest,\n  getEnvironmentVariables,\n  requestFactory,\n  resolveExecutableRequestUrl,\n  type MergedSecuritySchemes,\n  type RequestPayload,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies'\nimport type {\n  OpenApiDocument,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation'\nimport { computed, onBeforeUnmount, onMounted, ref, toValue, watch } from 'vue'\n\nimport ViewLayout from '@/components/ViewLayout/ViewLayout.vue'\nimport ViewLayoutContent from '@/components/ViewLayout/ViewLayoutContent.vue'\nimport { harToFetchRequest } from '@/v2/blocks/operation-block/helpers/har-to-fetch-request'\nimport { harToFetchResponse } from '@/v2/blocks/operation-block/helpers/har-to-fetch-response'\nimport {\n  getCookieRequestUrl,\n  getResponseCookieActions,\n} from '@/v2/blocks/operation-block/helpers/persist-response-cookies'\nimport {\n  getOperationExampleKey,\n  isStreamingResponse,\n  responseCache,\n} from '@/v2/blocks/operation-block/helpers/response-cache'\nimport {\n  sendRequest,\n  type ResponseInstance,\n} from '@/v2/blocks/operation-block/helpers/send-request'\nimport { validatePathParameters } from '@/v2/blocks/operation-block/helpers/validate-path-parameters'\nimport { RequestBlock } from '@/v2/blocks/request-block'\nimport { ResponseBlock } from '@/v2/blocks/response-block'\nimport { type History } from '@/v2/blocks/scalar-address-bar-block'\nimport type { ModalProps } from '@/v2/features/modal/Modal.vue'\nimport type { ClientLayout } from '@/v2/types/layout'\n\nimport Header from './components/Header.vue'\n\nconst {\n  authMeta,\n  environment,\n  eventBus,\n  exampleKey,\n  document,\n  documentSlug,\n  workspaceCookies = [],\n  documentCookies = [],\n  hideClientButton,\n  httpClients = AVAILABLE_CLIENTS,\n  history = [],\n  layout,\n  method,\n  operation,\n  path,\n  plugins = [],\n  proxyUrl,\n  requestBodyCompositionSelection,\n  securitySchemes,\n  selectedClient,\n  server,\n  environments,\n  options,\n  activeEnvironment,\n  serverMeta,\n  selectedSecurity,\n  selectedSecuritySchemes,\n  securityRequirements,\n  defaultHeaders,\n} = defineProps<OperationBlockProps>()\n\n/** Hoist up client generation so it doesn't get re-generated on every operation */\nconst clientOptions = computed(() => generateClientOptions(httpClients))\n\nconst { toast } = useToasts()\nconst { copyToClipboard } = useClipboard()\n\n// Refs\nconst abortController = ref<AbortController | null>(null)\nconst response = ref<ResponseInstance | null>(null)\nconst requestPayload = ref<RequestPayload | null>(null)\n\n/** Cancel the request */\nconst cancelRequest = () => abortController.value?.abort(ERRORS.REQUEST_ABORTED)\n\n/**\n * Persist server-set cookies from a response into the document cookie jar.\n *\n * Scalar keeps its own cookie jar because browsers hide `Set-Cookie` from `fetch`.\n * Mirroring browser behavior, cookies are stored scoped to the request host and\n * path and removed when the server expires them, so a value like a Django CSRF\n * token stays available for later PUT/PATCH requests after a page reload.\n */\nconst persistResponseCookies = (sendResult: {\n  response: ResponseInstance\n  requestPayload: RequestPayload\n}) => {\n  const actions = getResponseCookieActions({\n    cookieHeaderKeys: sendResult.response.cookieHeaderKeys ?? [],\n    documentCookies,\n    requestUrl: getCookieRequestUrl(String(sendResult.requestPayload[0])),\n  })\n\n  for (const action of actions) {\n    if (action.type === 'delete') {\n      eventBus.emit('cookie:delete:cookie', {\n        collectionType: 'document',\n        cookieName: action.cookieName,\n        index: action.index,\n      })\n      continue\n    }\n\n    eventBus.emit('cookie:upsert:cookie', {\n      collectionType: 'document',\n      payload: action.cookie,\n      ...(action.index === undefined ? {} : { index: action.index }),\n    })\n  }\n}\n\n/**\n * Copy the executable URL — same pipeline as Send (`requestFactory` +\n * `resolveExecutableRequestUrl`), including security query params.\n */\nconst copyAddressBarUrl = async (): Promise<void> => {\n  const { request } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies: [...workspaceCookies, ...documentCookies],\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  await copyToClipboard(\n    resolveExecutableRequestUrl(request, getEnvironmentVariables(environment)),\n  )\n}\n\n/** Execute the current operation example */\nconst handleExecute = async () => {\n  eventBus.flushDebouncedEmits?.()\n\n  const pathValidation = validatePathParameters(\n    operation.parameters ?? [],\n    exampleKey,\n  )\n  if (pathValidation.ok === false) {\n    toast('Path parameters must have values.', 'error')\n    return\n  }\n\n  const globalCookies = [...workspaceCookies, ...documentCookies]\n\n  const { request: requestBuilder } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies,\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  // Stop any previous streaming response\n  if (response.value && 'reader' in response.value) {\n    response.value.reader.cancel()\n  }\n\n  const variablesStore = createVariablesStoreForRequest()\n\n  // Execute the beforeRequest hook (plugins receive RequestFactory, not fetch Request)\n  await executeHook(\n    {\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'beforeRequest',\n    plugins,\n  )\n\n  const envVariables = {\n    ...getEnvironmentVariables(environment),\n    ...variablesStore.getVariables(),\n  }\n\n  // Build the fetch Request after hooks may have mutated the factory\n  const built = buildRequest(requestBuilder, {\n    envVariables,\n    allowMissingRequestServerBase: layout === 'modal',\n  })\n  if (!built.ok) {\n    toast(built.message ?? built.error, 'error')\n    return\n  }\n\n  // Store the abort controller for cancellation\n  abortController.value = built.data.controller\n\n  // Build the fetch Request once so the requestBuilt hook observes the exact bytes that are\n  // sent. Rebuilding it later would generate a different multipart boundary, which breaks\n  // plugins that hash the body (for example, request signing).\n  const request = buildSafeBodyRequest(...built.data.requestPayload)\n\n  // Execute the requestBuilt hook (plugins receive the exact fetch Request that will be sent)\n  await executeHook(\n    {\n      request,\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'requestBuilt',\n    plugins,\n  )\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:sent', {\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  /** Execute the request */\n  const [sendError, sendResult] = await sendRequest({\n    isUsingProxy: built.data.isUsingProxy,\n    requestPayload: built.data.requestPayload,\n    request,\n    plugins,\n    customFetch: toValue(options)?.customFetch,\n  })\n\n  if (sendResult) {\n    // Execute the responseReceived hook\n    await executeHook(\n      {\n        response: sendResult.originalResponse.clone(),\n        requestBuilder,\n        request: buildSafeBodyRequest(...sendResult.requestPayload),\n        document,\n        operation,\n        variablesStore,\n      },\n      'responseReceived',\n      plugins,\n    )\n  }\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:complete', {\n    payload: sendResult\n      ? {\n          response: sendResult.originalResponse.clone(),\n          requestPayload: sendResult.requestPayload,\n          duration: sendResult.response.duration,\n          timestamp: sendResult.timestamp,\n        }\n      : undefined,\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  if (sendError) {\n    // clean up the response and request\n    response.value = null\n    requestPayload.value = null\n    abortController.value = null\n\n    toast(sendError.message, 'error')\n    return\n  }\n\n  // Store the response\n  response.value = sendResult.response\n  requestPayload.value = sendResult.requestPayload\n\n  // Persist server-set cookies into the document jar so values like a CSRF token\n  // survive a page reload and get replayed on the next request, like a browser would.\n  persistResponseCookies(sendResult)\n\n  // Cache non-streaming responses so they can be restored when navigating back\n  if (!isStreamingResponse(sendResult.response)) {\n    responseCache.set(getOperationExampleKey(method, path, exampleKey), {\n      response: sendResult.response,\n      requestPayload: sendResult.requestPayload,\n    })\n  }\n}\n\nonMounted(() => {\n  eventBus.on('operation:send:request:hotkey', handleExecute)\n  eventBus.on('operation:cancel:request', cancelRequest)\n  eventBus.on('copy-url:address-bar', copyAddressBarUrl)\n\n  // Let plugins warm up per-operation resources (e.g. the scripts sandbox) so the first request\n  // does not pay their cold-start cost.\n  void executeHook({ document, operation }, 'onRequestMount', plugins)\n})\nonBeforeUnmount(() => {\n  eventBus.off('operation:send:request:hotkey', handleExecute)\n  eventBus.off('operation:cancel:request', cancelRequest)\n  eventBus.off('copy-url:address-bar', copyAddressBarUrl)\n})\n\nconst operationHistory = computed<History[]>(() =>\n  history\n    .map((entry) => ({\n      method: entry.request.method as HttpMethodType,\n      path: entry.request.url,\n      duration: entry.time,\n      status: entry.response.status,\n    }))\n    .reverse(),\n)\n\nconst handleSelectHistoryItem = ({ index }: { index: number }) => {\n  const transformedIndex = (history.length ?? 0) - index - 1\n  const historyItem = history[transformedIndex]\n  if (!historyItem) {\n    return\n  }\n\n  const navigate = () =>\n    eventBus.emit('ui:navigate', {\n      page: 'example',\n      method,\n      path,\n      exampleName: 'draft',\n      callback: (status) => {\n        // Do not replace the response if the navigation was not successful\n        if (status !== 'success') {\n          return\n        }\n        // Reconstruct the response\n        const fetchResponse = harToFetchResponse({\n          harResponse: historyItem.response,\n          url: historyItem.request.url,\n          method,\n          path,\n          duration: historyItem.time,\n        })\n\n        // Reconstruct the request\n        const fetchRequest = harToFetchRequest({\n          harRequest: historyItem.request,\n        })\n\n        // Update the response and request\n        response.value = fetchResponse\n        requestPayload.value = fetchRequest\n      },\n    })\n\n  eventBus.emit('operation:reload:history', {\n    meta: {\n      path,\n      method,\n    },\n    index: transformedIndex,\n    callback: navigate,\n  })\n}\n\nconst handleNavigateSettings = () => {\n  eventBus.emit('ui:navigate', {\n    page: 'operation',\n    path: 'overview',\n    operationPath: path,\n    method,\n  })\n}\n\n/**\n * When the path, method, or example key changes, restore the response panel\n * for the new operation from the best available source:\n *\n *   1. `responseCache` — in-memory, populated on every successful send.\n *      Has the live response object (including streams) so it wins.\n *   2. `history` — persisted in the workspace store. Used as a fallback when\n *      the in-memory cache is empty (page reload, fresh app session, etc.)\n *      so navigating to an operation that has been called before shows the\n *      last response instead of an empty panel.\n *   3. Otherwise clear.\n *\n * Only the response is restored from history — the user's request inputs are\n * left alone, so we never silently overwrite an in-progress draft.\n */\nwatch(\n  [() => path, () => method, () => exampleKey],\n  ([newPath, newMethod, newExampleKey]) => {\n    const cached = responseCache.get(\n      getOperationExampleKey(newMethod, newPath, newExampleKey),\n    )\n\n    if (cached) {\n      response.value = cached.response\n      requestPayload.value = cached.requestPayload\n    } else {\n      // History is keyed only by document/path/method but each entry carries\n      // the example it came from, so we walk from the end and pick the most\n      // recent entry that matches the active example. Otherwise a cache miss\n      // on example B would restore example A's response. Only runs on a\n      // cache miss — the common case (in-session navigation) skips it.\n      const latest = (() => {\n        for (let i = history.length - 1; i >= 0; i--) {\n          const entry = history[i]\n          if (entry?.meta.example === newExampleKey) {\n            return entry\n          }\n        }\n        return undefined\n      })()\n\n      if (latest) {\n        response.value = harToFetchResponse({\n          harResponse: latest.response,\n          url: latest.request.url,\n          method: newMethod,\n          path: newPath,\n          duration: latest.time,\n        })\n        requestPayload.value = null\n      } else {\n        response.value = null\n        requestPayload.value = null\n      }\n    }\n\n    // Cancel any in-flight request\n    cancelRequest()\n  },\n  { immediate: true },\n)\n\nonBeforeUnmount(() => {\n  // We cancel the request if the component is unmounted\n  cancelRequest()\n})\n</script>\n<template>\n  <div class=\"bg-b-1 flex h-full flex-col\">\n    <div\n      class=\"lg:min-h-header flex w-full flex-wrap items-center justify-center p-2 lg:p-0\">\n      <!-- Address Bar -->\n      <Header\n        :activeEnvironment\n        :documentSlug\n        :documentUrl\n        :environment\n        :environments\n        :eventBus\n        :exampleKey\n        :hideClientButton\n        :history=\"operationHistory\"\n        :integration\n        :layout\n        :method\n        :path\n        :server\n        :serverMeta\n        :servers\n        :source\n        @execute=\"handleExecute\"\n        @navigate:settings=\"handleNavigateSettings\"\n        @select:history:item=\"handleSelectHistoryItem\" />\n    </div>\n\n    <ViewLayout class=\"border-t\">\n      <ViewLayoutContent class=\"flex-1\">\n        <!-- Request Section -->\n        <RequestBlock\n          :authMeta\n          :clientOptions\n          :defaultHeaders\n          :documentCookies\n          :environment\n          :eventBus\n          :exampleKey\n          :layout\n          :method\n          :operation\n          :options=\"toValue(options)\"\n          :path\n          :plugins\n          :proxyUrl\n          :requestBodyCompositionSelection\n          :securityRequirements\n          :securitySchemes\n          :selectedClient\n          :selectedSecurity\n          :selectedSecuritySchemes\n          :server\n          :workspaceCookies />\n\n        <!-- Response Section -->\n        <ResponseBlock\n          :appVersion\n          :eventBus\n          :layout\n          :plugins\n          :requestPayload\n          :response\n          :totalPerformedRequests=\"operationHistory.length\" />\n      </ViewLayoutContent>\n    </ViewLayout>\n  </div>\n</template>\n"],"mappings":""}

package/dist/v2/blocks/operation-block/OperationBlock.vue.script.js

@@ -3,6 +3,7 @@ import ViewLayoutContent_default from "../../../components/ViewLayout/ViewLayout
 import { sendRequest } from "./helpers/send-request.js";
 import { harToFetchRequest } from "./helpers/har-to-fetch-request.js";
 import { harToFetchResponse } from "./helpers/har-to-fetch-response.js";
+import { getCookieRequestUrl, getResponseCookieActions } from "./helpers/persist-response-cookies.js";
 import { getOperationExampleKey, isStreamingResponse, responseCache } from "./helpers/response-cache.js";
 import { validatePathParameters } from "./helpers/validate-path-parameters.js";
 import RequestBlock_default from "../request-block/RequestBlock.vue.js";
@@ -70,6 +71,36 @@ var OperationBlock_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */
 		/** Cancel the request */
 		const cancelRequest = () => abortController.value?.abort(ERRORS.REQUEST_ABORTED);
 		/**
+		* Persist server-set cookies from a response into the document cookie jar.
+		*
+		* Scalar keeps its own cookie jar because browsers hide `Set-Cookie` from `fetch`.
+		* Mirroring browser behavior, cookies are stored scoped to the request host and
+		* path and removed when the server expires them, so a value like a Django CSRF
+		* token stays available for later PUT/PATCH requests after a page reload.
+		*/
+		const persistResponseCookies = (sendResult) => {
+			const actions = getResponseCookieActions({
+				cookieHeaderKeys: sendResult.response.cookieHeaderKeys ?? [],
+				documentCookies: __props.documentCookies,
+				requestUrl: getCookieRequestUrl(String(sendResult.requestPayload[0]))
+			});
+			for (const action of actions) {
+				if (action.type === "delete") {
+					__props.eventBus.emit("cookie:delete:cookie", {
+						collectionType: "document",
+						cookieName: action.cookieName,
+						index: action.index
+					});
+					continue;
+				}
+				__props.eventBus.emit("cookie:upsert:cookie", {
+					collectionType: "document",
+					payload: action.cookie,
+					...action.index === void 0 ? {} : { index: action.index }
+				});
+			}
+		};
+		/**
 		* Copy the executable URL — same pipeline as Send (`requestFactory` +
 		* `resolveExecutableRequestUrl`), including security query params.
 		*/
@@ -183,6 +214,7 @@ var OperationBlock_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */
 			}
 			response.value = sendResult.response;
 			requestPayload.value = sendResult.requestPayload;
+			persistResponseCookies(sendResult);
 			if (!isStreamingResponse(sendResult.response)) responseCache.set(getOperationExampleKey(__props.method, __props.path, __props.exampleKey), {
 				response: sendResult.response,
 				requestPayload: sendResult.requestPayload

package/dist/v2/blocks/operation-block/OperationBlock.vue.script.js.map

@@ -1 +1 @@
-{"version":3,"file":"OperationBlock.vue.script.js","names":[],"sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"sourcesContent":["<script lang=\"ts\">\n/**\n * OperationBlock\n *\n * Orchestrates the operation view by wiring together the Header, OperationBlock,\n * and ResponseBlock. Forwards user interactions to the workspace event bus and\n * passes through configuration such as auth, servers, plugins, and environment.\n * This component keeps the Operation page lean by centralizing event emission\n * and prop wiring between the blocks.\n *\n * Notable behavior:\n * - Uses operation['x-scalar-method'] and operation['x-scalar-path'] to provide\n *   draft overrides for the UI when present.\n */\nexport default {\n  name: 'OperationBlock',\n}\n\nexport type OperationBlockProps = {\n  /** Event bus */\n  eventBus: WorkspaceEventBus\n  /** Application version */\n  appVersion: string\n  /** Openapi document */\n  document: OpenApiDocument\n  /** Openapi document slug */\n  documentSlug: string\n  /** Workspace cookies */\n  workspaceCookies: XScalarCookie[]\n  /** Document cookies */\n  documentCookies: XScalarCookie[]\n  /** Current request path */\n  path: string\n  /** Current request method */\n  method: HttpMethodType\n  /** HTTP clients */\n  httpClients: AvailableClients\n  /** The history for the operation */\n  history?: HistoryEntry[]\n  /** Client layout */\n  layout: ClientLayout\n  /** Currently selected server */\n  server: ServerObject | null\n  /** Currently selected client */\n  selectedClient: WorkspaceStore['workspace']['x-scalar-default-client']\n  /** Server list available for operation/document */\n  servers: ServerObject[]\n  /** Meta information for the server */\n  serverMeta: ServerMeta\n  /** Hides the client button on the header */\n  hideClientButton?: boolean\n  /** Client integration  */\n  integration?: string | null\n  /** Openapi document url for `modal` mode to open the client app */\n  documentUrl?: string\n  /** Client source */\n  source?: 'gitbook' | 'api-reference'\n  /** Operation object */\n  operation: OperationObject\n  /** Currently selected example key for the current operation */\n  exampleKey: string\n  /** Meta information for the auth update */\n  authMeta: AuthMeta\n  /** Document defined security schemes */\n  securitySchemes: MergedSecuritySchemes\n  /** Client plugins */\n  plugins: ClientPlugin[]\n  /** Environment list */\n  environments?: string[]\n  /** Currently selected environment */\n  activeEnvironment?: string\n  /** For environment variables in the inputs */\n  environment: XScalarEnvironment\n  /** The proxy URL for sending requests */\n  proxyUrl: string\n  /** Currently selected security */\n  selectedSecurity: SelectedSecurity\n  /** Currently selected security schemes */\n  selectedSecuritySchemes: SecuritySchemeObjectSecret[]\n  /** Security requirements */\n  securityRequirements: OpenApiDocument['security']\n  /** Default headers */\n  defaultHeaders: Record<string, string>\n  /** Selected anyOf/oneOf request-body variants keyed by schema path */\n  requestBodyCompositionSelection?: Record<string, number>\n  /** Subset of config options for the modal */\n  options?: ModalProps['options']\n}\n</script>\n<script setup lang=\"ts\">\nimport { generateClientOptions } from '@scalar/blocks/code-example'\nimport { ERRORS } from '@scalar/helpers/errors/normalize-error'\nimport { isElectron } from '@scalar/helpers/general/is-electron'\nimport { buildSafeBodyRequest } from '@scalar/helpers/http/can-method-have-body'\nimport type { HttpMethod as HttpMethodType } from '@scalar/helpers/http/http-methods'\nimport { executeHook, type ClientPlugin } from '@scalar/oas-utils/helpers'\nimport {\n  AVAILABLE_CLIENTS,\n  type AvailableClients,\n} from '@scalar/types/snippetz'\nimport { useClipboard } from '@scalar/use-hooks/useClipboard'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { WorkspaceStore } from '@scalar/workspace-store/client'\nimport type { SelectedSecurity } from '@scalar/workspace-store/entities/auth'\nimport type { HistoryEntry } from '@scalar/workspace-store/entities/history/schema'\nimport type {\n  AuthMeta,\n  ServerMeta,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  buildRequest,\n  createVariablesStoreForRequest,\n  getEnvironmentVariables,\n  requestFactory,\n  resolveExecutableRequestUrl,\n  type MergedSecuritySchemes,\n  type RequestPayload,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies'\nimport type {\n  OpenApiDocument,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation'\nimport { computed, onBeforeUnmount, onMounted, ref, toValue, watch } from 'vue'\n\nimport ViewLayout from '@/components/ViewLayout/ViewLayout.vue'\nimport ViewLayoutContent from '@/components/ViewLayout/ViewLayoutContent.vue'\nimport { harToFetchRequest } from '@/v2/blocks/operation-block/helpers/har-to-fetch-request'\nimport { harToFetchResponse } from '@/v2/blocks/operation-block/helpers/har-to-fetch-response'\nimport {\n  getOperationExampleKey,\n  isStreamingResponse,\n  responseCache,\n} from '@/v2/blocks/operation-block/helpers/response-cache'\nimport {\n  sendRequest,\n  type ResponseInstance,\n} from '@/v2/blocks/operation-block/helpers/send-request'\nimport { validatePathParameters } from '@/v2/blocks/operation-block/helpers/validate-path-parameters'\nimport { RequestBlock } from '@/v2/blocks/request-block'\nimport { ResponseBlock } from '@/v2/blocks/response-block'\nimport { type History } from '@/v2/blocks/scalar-address-bar-block'\nimport type { ModalProps } from '@/v2/features/modal/Modal.vue'\nimport type { ClientLayout } from '@/v2/types/layout'\n\nimport Header from './components/Header.vue'\n\nconst {\n  authMeta,\n  environment,\n  eventBus,\n  exampleKey,\n  document,\n  documentSlug,\n  workspaceCookies = [],\n  documentCookies = [],\n  hideClientButton,\n  httpClients = AVAILABLE_CLIENTS,\n  history = [],\n  layout,\n  method,\n  operation,\n  path,\n  plugins = [],\n  proxyUrl,\n  requestBodyCompositionSelection,\n  securitySchemes,\n  selectedClient,\n  server,\n  environments,\n  options,\n  activeEnvironment,\n  serverMeta,\n  selectedSecurity,\n  selectedSecuritySchemes,\n  securityRequirements,\n  defaultHeaders,\n} = defineProps<OperationBlockProps>()\n\n/** Hoist up client generation so it doesn't get re-generated on every operation */\nconst clientOptions = computed(() => generateClientOptions(httpClients))\n\nconst { toast } = useToasts()\nconst { copyToClipboard } = useClipboard()\n\n// Refs\nconst abortController = ref<AbortController | null>(null)\nconst response = ref<ResponseInstance | null>(null)\nconst requestPayload = ref<RequestPayload | null>(null)\n\n/** Cancel the request */\nconst cancelRequest = () => abortController.value?.abort(ERRORS.REQUEST_ABORTED)\n\n/**\n * Copy the executable URL — same pipeline as Send (`requestFactory` +\n * `resolveExecutableRequestUrl`), including security query params.\n */\nconst copyAddressBarUrl = async (): Promise<void> => {\n  const { request } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies: [...workspaceCookies, ...documentCookies],\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  await copyToClipboard(\n    resolveExecutableRequestUrl(request, getEnvironmentVariables(environment)),\n  )\n}\n\n/** Execute the current operation example */\nconst handleExecute = async () => {\n  eventBus.flushDebouncedEmits?.()\n\n  const pathValidation = validatePathParameters(\n    operation.parameters ?? [],\n    exampleKey,\n  )\n  if (pathValidation.ok === false) {\n    toast('Path parameters must have values.', 'error')\n    return\n  }\n\n  const globalCookies = [...workspaceCookies, ...documentCookies]\n\n  const { request: requestBuilder } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies,\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  // Stop any previous streaming response\n  if (response.value && 'reader' in response.value) {\n    response.value.reader.cancel()\n  }\n\n  const variablesStore = createVariablesStoreForRequest()\n\n  // Execute the beforeRequest hook (plugins receive RequestFactory, not fetch Request)\n  await executeHook(\n    {\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'beforeRequest',\n    plugins,\n  )\n\n  const envVariables = {\n    ...getEnvironmentVariables(environment),\n    ...variablesStore.getVariables(),\n  }\n\n  // Build the fetch Request after hooks may have mutated the factory\n  const built = buildRequest(requestBuilder, {\n    envVariables,\n    allowMissingRequestServerBase: layout === 'modal',\n  })\n  if (!built.ok) {\n    toast(built.message ?? built.error, 'error')\n    return\n  }\n\n  // Store the abort controller for cancellation\n  abortController.value = built.data.controller\n\n  // Build the fetch Request once so the requestBuilt hook observes the exact bytes that are\n  // sent. Rebuilding it later would generate a different multipart boundary, which breaks\n  // plugins that hash the body (for example, request signing).\n  const request = buildSafeBodyRequest(...built.data.requestPayload)\n\n  // Execute the requestBuilt hook (plugins receive the exact fetch Request that will be sent)\n  await executeHook(\n    {\n      request,\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'requestBuilt',\n    plugins,\n  )\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:sent', {\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  /** Execute the request */\n  const [sendError, sendResult] = await sendRequest({\n    isUsingProxy: built.data.isUsingProxy,\n    requestPayload: built.data.requestPayload,\n    request,\n    plugins,\n    customFetch: toValue(options)?.customFetch,\n  })\n\n  if (sendResult) {\n    // Execute the responseReceived hook\n    await executeHook(\n      {\n        response: sendResult.originalResponse.clone(),\n        requestBuilder,\n        request: buildSafeBodyRequest(...sendResult.requestPayload),\n        document,\n        operation,\n        variablesStore,\n      },\n      'responseReceived',\n      plugins,\n    )\n  }\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:complete', {\n    payload: sendResult\n      ? {\n          response: sendResult.originalResponse.clone(),\n          requestPayload: sendResult.requestPayload,\n          duration: sendResult.response.duration,\n          timestamp: sendResult.timestamp,\n        }\n      : undefined,\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  if (sendError) {\n    // clean up the response and request\n    response.value = null\n    requestPayload.value = null\n    abortController.value = null\n\n    toast(sendError.message, 'error')\n    return\n  }\n\n  // Store the response\n  response.value = sendResult.response\n  requestPayload.value = sendResult.requestPayload\n\n  // Cache non-streaming responses so they can be restored when navigating back\n  if (!isStreamingResponse(sendResult.response)) {\n    responseCache.set(getOperationExampleKey(method, path, exampleKey), {\n      response: sendResult.response,\n      requestPayload: sendResult.requestPayload,\n    })\n  }\n}\n\nonMounted(() => {\n  eventBus.on('operation:send:request:hotkey', handleExecute)\n  eventBus.on('operation:cancel:request', cancelRequest)\n  eventBus.on('copy-url:address-bar', copyAddressBarUrl)\n\n  // Let plugins warm up per-operation resources (e.g. the scripts sandbox) so the first request\n  // does not pay their cold-start cost.\n  void executeHook({ document, operation }, 'onRequestMount', plugins)\n})\nonBeforeUnmount(() => {\n  eventBus.off('operation:send:request:hotkey', handleExecute)\n  eventBus.off('operation:cancel:request', cancelRequest)\n  eventBus.off('copy-url:address-bar', copyAddressBarUrl)\n})\n\nconst operationHistory = computed<History[]>(() =>\n  history\n    .map((entry) => ({\n      method: entry.request.method as HttpMethodType,\n      path: entry.request.url,\n      duration: entry.time,\n      status: entry.response.status,\n    }))\n    .reverse(),\n)\n\nconst handleSelectHistoryItem = ({ index }: { index: number }) => {\n  const transformedIndex = (history.length ?? 0) - index - 1\n  const historyItem = history[transformedIndex]\n  if (!historyItem) {\n    return\n  }\n\n  const navigate = () =>\n    eventBus.emit('ui:navigate', {\n      page: 'example',\n      method,\n      path,\n      exampleName: 'draft',\n      callback: (status) => {\n        // Do not replace the response if the navigation was not successful\n        if (status !== 'success') {\n          return\n        }\n        // Reconstruct the response\n        const fetchResponse = harToFetchResponse({\n          harResponse: historyItem.response,\n          url: historyItem.request.url,\n          method,\n          path,\n          duration: historyItem.time,\n        })\n\n        // Reconstruct the request\n        const fetchRequest = harToFetchRequest({\n          harRequest: historyItem.request,\n        })\n\n        // Update the response and request\n        response.value = fetchResponse\n        requestPayload.value = fetchRequest\n      },\n    })\n\n  eventBus.emit('operation:reload:history', {\n    meta: {\n      path,\n      method,\n    },\n    index: transformedIndex,\n    callback: navigate,\n  })\n}\n\nconst handleNavigateSettings = () => {\n  eventBus.emit('ui:navigate', {\n    page: 'operation',\n    path: 'overview',\n    operationPath: path,\n    method,\n  })\n}\n\n/**\n * When the path, method, or example key changes, restore the response panel\n * for the new operation from the best available source:\n *\n *   1. `responseCache` — in-memory, populated on every successful send.\n *      Has the live response object (including streams) so it wins.\n *   2. `history` — persisted in the workspace store. Used as a fallback when\n *      the in-memory cache is empty (page reload, fresh app session, etc.)\n *      so navigating to an operation that has been called before shows the\n *      last response instead of an empty panel.\n *   3. Otherwise clear.\n *\n * Only the response is restored from history — the user's request inputs are\n * left alone, so we never silently overwrite an in-progress draft.\n */\nwatch(\n  [() => path, () => method, () => exampleKey],\n  ([newPath, newMethod, newExampleKey]) => {\n    const cached = responseCache.get(\n      getOperationExampleKey(newMethod, newPath, newExampleKey),\n    )\n\n    if (cached) {\n      response.value = cached.response\n      requestPayload.value = cached.requestPayload\n    } else {\n      // History is keyed only by document/path/method but each entry carries\n      // the example it came from, so we walk from the end and pick the most\n      // recent entry that matches the active example. Otherwise a cache miss\n      // on example B would restore example A's response. Only runs on a\n      // cache miss — the common case (in-session navigation) skips it.\n      const latest = (() => {\n        for (let i = history.length - 1; i >= 0; i--) {\n          const entry = history[i]\n          if (entry?.meta.example === newExampleKey) {\n            return entry\n          }\n        }\n        return undefined\n      })()\n\n      if (latest) {\n        response.value = harToFetchResponse({\n          harResponse: latest.response,\n          url: latest.request.url,\n          method: newMethod,\n          path: newPath,\n          duration: latest.time,\n        })\n        requestPayload.value = null\n      } else {\n        response.value = null\n        requestPayload.value = null\n      }\n    }\n\n    // Cancel any in-flight request\n    cancelRequest()\n  },\n  { immediate: true },\n)\n\nonBeforeUnmount(() => {\n  // We cancel the request if the component is unmounted\n  cancelRequest()\n})\n</script>\n<template>\n  <div class=\"bg-b-1 flex h-full flex-col\">\n    <div\n      class=\"lg:min-h-header flex w-full flex-wrap items-center justify-center p-2 lg:p-0\">\n      <!-- Address Bar -->\n      <Header\n        :activeEnvironment\n        :documentSlug\n        :documentUrl\n        :environment\n        :environments\n        :eventBus\n        :exampleKey\n        :hideClientButton\n        :history=\"operationHistory\"\n        :integration\n        :layout\n        :method\n        :path\n        :server\n        :serverMeta\n        :servers\n        :source\n        @execute=\"handleExecute\"\n        @navigate:settings=\"handleNavigateSettings\"\n        @select:history:item=\"handleSelectHistoryItem\" />\n    </div>\n\n    <ViewLayout class=\"border-t\">\n      <ViewLayoutContent class=\"flex-1\">\n        <!-- Request Section -->\n        <RequestBlock\n          :authMeta\n          :clientOptions\n          :defaultHeaders\n          :documentCookies\n          :environment\n          :eventBus\n          :exampleKey\n          :layout\n          :method\n          :operation\n          :options=\"toValue(options)\"\n          :path\n          :plugins\n          :proxyUrl\n          :requestBodyCompositionSelection\n          :securityRequirements\n          :securitySchemes\n          :selectedClient\n          :selectedSecurity\n          :selectedSecuritySchemes\n          :server\n          :workspaceCookies />\n\n        <!-- Response Section -->\n        <ResponseBlock\n          :appVersion\n          :eventBus\n          :layout\n          :plugins\n          :requestPayload\n          :response\n          :totalPerformedRequests=\"operationHistory.length\" />\n      </ViewLayoutContent>\n    </ViewLayout>\n  </div>\n</template>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;CAeE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyKR,MAAM,gBAAgB,eAAe,sBAAsB,QAAA,YAAY,CAAA;EAEvE,MAAM,EAAE,UAAU,WAAU;EAC5B,MAAM,EAAE,oBAAoB,cAAa;EAGzC,MAAM,kBAAkB,IAA4B,KAAI;EACxD,MAAM,WAAW,IAA6B,KAAI;EAClD,MAAM,iBAAiB,IAA2B,KAAI;;EAGtD,MAAM,sBAAsB,gBAAgB,OAAO,MAAM,OAAO,gBAAe;;;;;EAM/E,MAAM,oBAAoB,YAA2B;GACnD,MAAM,EAAE,YAAY,eAAe;IACjC,gBAAa,QAAA;IACb,aAAU,QAAA;IACV,aAAa,QAAA;IACb,eAAe,CAAC,GAAG,QAAA,kBAAkB,GAAG,QAAA,gBAAgB;IACxD,QAAK,QAAA;IACL,WAAQ,QAAA;IACR,MAAG,QAAA;IACH,UAAO,QAAA;IACP,QAAK,QAAA;IACL,yBAAsB,QAAA;IACtB,YAAY,YAAY;IACxB,iCAA8B,QAAA;IAC/B,CAAA;AAED,SAAM,gBACJ,4BAA4B,SAAS,wBAAwB,QAAA,YAAY,CAAC,CAC5E;;;EAIF,MAAM,gBAAgB,YAAY;AAChC,WAAA,SAAS,uBAAsB;AAM/B,OAJuB,uBACrB,QAAA,UAAU,cAAc,EAAE,EAC1B,QAAA,WACF,CACmB,OAAO,OAAO;AAC/B,UAAM,qCAAqC,QAAO;AAClD;;GAGF,MAAM,gBAAgB,CAAC,GAAG,QAAA,kBAAkB,GAAG,QAAA,gBAAe;GAE9D,MAAM,EAAE,SAAS,mBAAmB,eAAe;IACjD,gBAAa,QAAA;IACb,aAAU,QAAA;IACV,aAAa,QAAA;IACb;IACA,QAAK,QAAA;IACL,WAAQ,QAAA;IACR,MAAG,QAAA;IACH,UAAO,QAAA;IACP,QAAK,QAAA;IACL,yBAAsB,QAAA;IACtB,YAAY,YAAY;IACxB,iCAA8B,QAAA;IAC/B,CAAA;AAGD,OAAI,SAAS,SAAS,YAAY,SAAS,MACzC,UAAS,MAAM,OAAO,QAAO;GAG/B,MAAM,iBAAiB,gCAA+B;AAGtD,SAAM,YACJ;IACE;IACA,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,iBACA,QAAA,QACF;GAQA,MAAM,QAAQ,aAAa,gBAAgB;IACzC,cAPmB;KACnB,GAAG,wBAAwB,QAAA,YAAY;KACvC,GAAG,eAAe,cAAc;KAClC;IAKE,+BAA+B,QAAA,WAAW;IAC3C,CAAA;AACD,OAAI,CAAC,MAAM,IAAI;AACb,UAAM,MAAM,WAAW,MAAM,OAAO,QAAO;AAC3C;;AAIF,mBAAgB,QAAQ,MAAM,KAAK;GAKnC,MAAM,UAAU,qBAAqB,GAAG,MAAM,KAAK,eAAc;AAGjE,SAAM,YACJ;IACE;IACA;IACA,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,gBACA,QAAA,QACF;AAGA,WAAA,SAAS,KAAK,yBAAyB,EACrC,MAAM;IACJ,QAAK,QAAA;IACL,MAAG,QAAA;IACH,YAAS,QAAA;IACV,EACF,CAAA;;GAGD,MAAM,CAAC,WAAW,cAAc,MAAM,YAAY;IAChD,cAAc,MAAM,KAAK;IACzB,gBAAgB,MAAM,KAAK;IAC3B;IACA,SAAM,QAAA;IACN,aAAa,QAAQ,QAAA,QAAQ,EAAE;IAChC,CAAA;AAED,OAAI,WAEF,OAAM,YACJ;IACE,UAAU,WAAW,iBAAiB,OAAO;IAC7C;IACA,SAAS,qBAAqB,GAAG,WAAW,eAAe;IAC3D,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,oBACA,QAAA,QACF;AAIF,WAAA,SAAS,KAAK,6BAA6B;IACzC,SAAS,aACL;KACE,UAAU,WAAW,iBAAiB,OAAO;KAC7C,gBAAgB,WAAW;KAC3B,UAAU,WAAW,SAAS;KAC9B,WAAW,WAAW;KACxB,GACA,KAAA;IACJ,MAAM;KACJ,QAAK,QAAA;KACL,MAAG,QAAA;KACH,YAAS,QAAA;KACV;IACF,CAAA;AAED,OAAI,WAAW;AAEb,aAAS,QAAQ;AACjB,mBAAe,QAAQ;AACvB,oBAAgB,QAAQ;AAExB,UAAM,UAAU,SAAS,QAAO;AAChC;;AAIF,YAAS,QAAQ,WAAW;AAC5B,kBAAe,QAAQ,WAAW;AAGlC,OAAI,CAAC,oBAAoB,WAAW,SAAS,CAC3C,eAAc,IAAI,uBAAuB,QAAA,QAAQ,QAAA,MAAM,QAAA,WAAW,EAAE;IAClE,UAAU,WAAW;IACrB,gBAAgB,WAAW;IAC5B,CAAA;;AAIL,kBAAgB;AACd,WAAA,SAAS,GAAG,iCAAiC,cAAa;AAC1D,WAAA,SAAS,GAAG,4BAA4B,cAAa;AACrD,WAAA,SAAS,GAAG,wBAAwB,kBAAiB;AAIhD,eAAY;IAAE,UAAO,QAAA;IAAG,WAAQ,QAAA;IAAG,EAAE,kBAAkB,QAAA,QAAO;IACpE;AACD,wBAAsB;AACpB,WAAA,SAAS,IAAI,iCAAiC,cAAa;AAC3D,WAAA,SAAS,IAAI,4BAA4B,cAAa;AACtD,WAAA,SAAS,IAAI,wBAAwB,kBAAiB;IACvD;EAED,MAAM,mBAAmB,eACvB,QAAA,QACG,KAAK,WAAW;GACf,QAAQ,MAAM,QAAQ;GACtB,MAAM,MAAM,QAAQ;GACpB,UAAU,MAAM;GAChB,QAAQ,MAAM,SAAS;GACxB,EAAC,CACD,SAAS,CACd;EAEA,MAAM,2BAA2B,EAAE,YAA+B;GAChE,MAAM,oBAAoB,QAAA,QAAQ,UAAU,KAAK,QAAQ;GACzD,MAAM,cAAc,QAAA,QAAQ;AAC5B,OAAI,CAAC,YACH;GAGF,MAAM,iBACJ,QAAA,SAAS,KAAK,eAAe;IAC3B,MAAM;IACN,QAAK,QAAA;IACL,MAAG,QAAA;IACH,aAAa;IACb,WAAW,WAAW;AAEpB,SAAI,WAAW,UACb;KAGF,MAAM,gBAAgB,mBAAmB;MACvC,aAAa,YAAY;MACzB,KAAK,YAAY,QAAQ;MACzB,QAAK,QAAA;MACL,MAAG,QAAA;MACH,UAAU,YAAY;MACvB,CAAA;KAGD,MAAM,eAAe,kBAAkB,EACrC,YAAY,YAAY,SACzB,CAAA;AAGD,cAAS,QAAQ;AACjB,oBAAe,QAAQ;;IAE1B,CAAA;AAEH,WAAA,SAAS,KAAK,4BAA4B;IACxC,MAAM;KACJ,MAAG,QAAA;KACH,QAAK,QAAA;KACN;IACD,OAAO;IACP,UAAU;IACX,CAAA;;EAGH,MAAM,+BAA+B;AACnC,WAAA,SAAS,KAAK,eAAe;IAC3B,MAAM;IACN,MAAM;IACN,eAAe,QAAA;IACf,QAAK,QAAA;IACN,CAAA;;;;;;;;;;;;;;;;;AAkBH,QACE;SAAO,QAAA;SAAY,QAAA;SAAc,QAAA;GAAW,GAC3C,CAAC,SAAS,WAAW,mBAAmB;GACvC,MAAM,SAAS,cAAc,IAC3B,uBAAuB,WAAW,SAAS,cAAc,CAC3D;AAEA,OAAI,QAAQ;AACV,aAAS,QAAQ,OAAO;AACxB,mBAAe,QAAQ,OAAO;UACzB;IAML,MAAM,gBAAgB;AACpB,UAAK,IAAI,IAAI,QAAA,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;MAC5C,MAAM,QAAQ,QAAA,QAAQ;AACtB,UAAI,OAAO,KAAK,YAAY,cAC1B,QAAO;;QAIV;AAEH,QAAI,QAAQ;AACV,cAAS,QAAQ,mBAAmB;MAClC,aAAa,OAAO;MACpB,KAAK,OAAO,QAAQ;MACpB,QAAQ;MACR,MAAM;MACN,UAAU,OAAO;MAClB,CAAA;AACD,oBAAe,QAAQ;WAClB;AACL,cAAS,QAAQ;AACjB,oBAAe,QAAQ;;;AAK3B,kBAAc;KAEhB,EAAE,WAAW,MAAM,CACrB;AAEA,wBAAsB;AAEpB,kBAAc;IACf;;uBAGC,mBAiEM,OAjEN,YAiEM,CAhEJ,mBAwBM,OAxBN,YAwBM,CArBJ,YAoBmD,gBAAA;IAnBhD,mBAAA,QAAA;IACA,cAAA,QAAA;IACA,aAAA,QAAA;IACA,aAAA,QAAA;IACA,cAAA,QAAA;IACA,UAAA,QAAA;IACA,YAAA,QAAA;IACA,kBAAA,QAAA;IACA,SAAS,iBAAA;IACT,aAAA,QAAA;IACA,QAAA,QAAA;IACA,QAAA,QAAA;IACA,MAAA,QAAA;IACA,QAAA,QAAA;IACA,YAAA,QAAA;IACA,SAAA,QAAA;IACA,QAAA,QAAA;IACA,WAAS;IACT,uBAAmB;IACnB,yBAAqB;;;;;;;;;;;;;;;;;;;SAG1B,YAqCa,oBAAA,EArCD,OAAM,YAAU,EAAA;2BAoCN,CAnCpB,YAmCoB,2BAAA,EAnCD,OAAM,UAAQ,EAAA;4BAwBT,CAtBtB,YAsBsB,MAAA,qBAAA,EAAA;MArBnB,UAAA,QAAA;MACA,eAAA,cAAA;MACA,gBAAA,QAAA;MACA,iBAAA,QAAA;MACA,aAAA,QAAA;MACA,UAAA,QAAA;MACA,YAAA,QAAA;MACA,QAAA,QAAA;MACA,QAAA,QAAA;MACA,WAAA,QAAA;MACA,SAAS,QAAQ,QAAA,QAAO;MACxB,MAAA,QAAA;MACA,SAAA,QAAA;MACA,UAAA,QAAA;MACA,iCAAA,QAAA;MACA,sBAAA,QAAA;MACA,iBAAA,QAAA;MACA,gBAAA,QAAA;MACA,kBAAA,QAAA;MACA,yBAAA,QAAA;MACA,QAAA,QAAA;MACA,kBAAA,QAAA;;;;;;;;;;;;;;;;;;;;;;;;SAGH,YAOsD,MAAA,sBAAA,EAAA;MANnD,YAAA,QAAA;MACA,UAAA,QAAA;MACA,QAAA,QAAA;MACA,SAAA,QAAA;MACA,gBAAA,eAAA;MACA,UAAA,SAAA;MACA,wBAAwB,iBAAA,MAAiB"}
+{"version":3,"file":"OperationBlock.vue.script.js","names":[],"sources":["../../../../src/v2/blocks/operation-block/OperationBlock.vue"],"sourcesContent":["<script lang=\"ts\">\n/**\n * OperationBlock\n *\n * Orchestrates the operation view by wiring together the Header, OperationBlock,\n * and ResponseBlock. Forwards user interactions to the workspace event bus and\n * passes through configuration such as auth, servers, plugins, and environment.\n * This component keeps the Operation page lean by centralizing event emission\n * and prop wiring between the blocks.\n *\n * Notable behavior:\n * - Uses operation['x-scalar-method'] and operation['x-scalar-path'] to provide\n *   draft overrides for the UI when present.\n */\nexport default {\n  name: 'OperationBlock',\n}\n\nexport type OperationBlockProps = {\n  /** Event bus */\n  eventBus: WorkspaceEventBus\n  /** Application version */\n  appVersion: string\n  /** Openapi document */\n  document: OpenApiDocument\n  /** Openapi document slug */\n  documentSlug: string\n  /** Workspace cookies */\n  workspaceCookies: XScalarCookie[]\n  /** Document cookies */\n  documentCookies: XScalarCookie[]\n  /** Current request path */\n  path: string\n  /** Current request method */\n  method: HttpMethodType\n  /** HTTP clients */\n  httpClients: AvailableClients\n  /** The history for the operation */\n  history?: HistoryEntry[]\n  /** Client layout */\n  layout: ClientLayout\n  /** Currently selected server */\n  server: ServerObject | null\n  /** Currently selected client */\n  selectedClient: WorkspaceStore['workspace']['x-scalar-default-client']\n  /** Server list available for operation/document */\n  servers: ServerObject[]\n  /** Meta information for the server */\n  serverMeta: ServerMeta\n  /** Hides the client button on the header */\n  hideClientButton?: boolean\n  /** Client integration  */\n  integration?: string | null\n  /** Openapi document url for `modal` mode to open the client app */\n  documentUrl?: string\n  /** Client source */\n  source?: 'gitbook' | 'api-reference'\n  /** Operation object */\n  operation: OperationObject\n  /** Currently selected example key for the current operation */\n  exampleKey: string\n  /** Meta information for the auth update */\n  authMeta: AuthMeta\n  /** Document defined security schemes */\n  securitySchemes: MergedSecuritySchemes\n  /** Client plugins */\n  plugins: ClientPlugin[]\n  /** Environment list */\n  environments?: string[]\n  /** Currently selected environment */\n  activeEnvironment?: string\n  /** For environment variables in the inputs */\n  environment: XScalarEnvironment\n  /** The proxy URL for sending requests */\n  proxyUrl: string\n  /** Currently selected security */\n  selectedSecurity: SelectedSecurity\n  /** Currently selected security schemes */\n  selectedSecuritySchemes: SecuritySchemeObjectSecret[]\n  /** Security requirements */\n  securityRequirements: OpenApiDocument['security']\n  /** Default headers */\n  defaultHeaders: Record<string, string>\n  /** Selected anyOf/oneOf request-body variants keyed by schema path */\n  requestBodyCompositionSelection?: Record<string, number>\n  /** Subset of config options for the modal */\n  options?: ModalProps['options']\n}\n</script>\n<script setup lang=\"ts\">\nimport { generateClientOptions } from '@scalar/blocks/code-example'\nimport { ERRORS } from '@scalar/helpers/errors/normalize-error'\nimport { isElectron } from '@scalar/helpers/general/is-electron'\nimport { buildSafeBodyRequest } from '@scalar/helpers/http/can-method-have-body'\nimport type { HttpMethod as HttpMethodType } from '@scalar/helpers/http/http-methods'\nimport { executeHook, type ClientPlugin } from '@scalar/oas-utils/helpers'\nimport {\n  AVAILABLE_CLIENTS,\n  type AvailableClients,\n} from '@scalar/types/snippetz'\nimport { useClipboard } from '@scalar/use-hooks/useClipboard'\nimport { useToasts } from '@scalar/use-toasts'\nimport type { WorkspaceStore } from '@scalar/workspace-store/client'\nimport type { SelectedSecurity } from '@scalar/workspace-store/entities/auth'\nimport type { HistoryEntry } from '@scalar/workspace-store/entities/history/schema'\nimport type {\n  AuthMeta,\n  ServerMeta,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport {\n  buildRequest,\n  createVariablesStoreForRequest,\n  getEnvironmentVariables,\n  requestFactory,\n  resolveExecutableRequestUrl,\n  type MergedSecuritySchemes,\n  type RequestPayload,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies'\nimport type {\n  OpenApiDocument,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation'\nimport { computed, onBeforeUnmount, onMounted, ref, toValue, watch } from 'vue'\n\nimport ViewLayout from '@/components/ViewLayout/ViewLayout.vue'\nimport ViewLayoutContent from '@/components/ViewLayout/ViewLayoutContent.vue'\nimport { harToFetchRequest } from '@/v2/blocks/operation-block/helpers/har-to-fetch-request'\nimport { harToFetchResponse } from '@/v2/blocks/operation-block/helpers/har-to-fetch-response'\nimport {\n  getCookieRequestUrl,\n  getResponseCookieActions,\n} from '@/v2/blocks/operation-block/helpers/persist-response-cookies'\nimport {\n  getOperationExampleKey,\n  isStreamingResponse,\n  responseCache,\n} from '@/v2/blocks/operation-block/helpers/response-cache'\nimport {\n  sendRequest,\n  type ResponseInstance,\n} from '@/v2/blocks/operation-block/helpers/send-request'\nimport { validatePathParameters } from '@/v2/blocks/operation-block/helpers/validate-path-parameters'\nimport { RequestBlock } from '@/v2/blocks/request-block'\nimport { ResponseBlock } from '@/v2/blocks/response-block'\nimport { type History } from '@/v2/blocks/scalar-address-bar-block'\nimport type { ModalProps } from '@/v2/features/modal/Modal.vue'\nimport type { ClientLayout } from '@/v2/types/layout'\n\nimport Header from './components/Header.vue'\n\nconst {\n  authMeta,\n  environment,\n  eventBus,\n  exampleKey,\n  document,\n  documentSlug,\n  workspaceCookies = [],\n  documentCookies = [],\n  hideClientButton,\n  httpClients = AVAILABLE_CLIENTS,\n  history = [],\n  layout,\n  method,\n  operation,\n  path,\n  plugins = [],\n  proxyUrl,\n  requestBodyCompositionSelection,\n  securitySchemes,\n  selectedClient,\n  server,\n  environments,\n  options,\n  activeEnvironment,\n  serverMeta,\n  selectedSecurity,\n  selectedSecuritySchemes,\n  securityRequirements,\n  defaultHeaders,\n} = defineProps<OperationBlockProps>()\n\n/** Hoist up client generation so it doesn't get re-generated on every operation */\nconst clientOptions = computed(() => generateClientOptions(httpClients))\n\nconst { toast } = useToasts()\nconst { copyToClipboard } = useClipboard()\n\n// Refs\nconst abortController = ref<AbortController | null>(null)\nconst response = ref<ResponseInstance | null>(null)\nconst requestPayload = ref<RequestPayload | null>(null)\n\n/** Cancel the request */\nconst cancelRequest = () => abortController.value?.abort(ERRORS.REQUEST_ABORTED)\n\n/**\n * Persist server-set cookies from a response into the document cookie jar.\n *\n * Scalar keeps its own cookie jar because browsers hide `Set-Cookie` from `fetch`.\n * Mirroring browser behavior, cookies are stored scoped to the request host and\n * path and removed when the server expires them, so a value like a Django CSRF\n * token stays available for later PUT/PATCH requests after a page reload.\n */\nconst persistResponseCookies = (sendResult: {\n  response: ResponseInstance\n  requestPayload: RequestPayload\n}) => {\n  const actions = getResponseCookieActions({\n    cookieHeaderKeys: sendResult.response.cookieHeaderKeys ?? [],\n    documentCookies,\n    requestUrl: getCookieRequestUrl(String(sendResult.requestPayload[0])),\n  })\n\n  for (const action of actions) {\n    if (action.type === 'delete') {\n      eventBus.emit('cookie:delete:cookie', {\n        collectionType: 'document',\n        cookieName: action.cookieName,\n        index: action.index,\n      })\n      continue\n    }\n\n    eventBus.emit('cookie:upsert:cookie', {\n      collectionType: 'document',\n      payload: action.cookie,\n      ...(action.index === undefined ? {} : { index: action.index }),\n    })\n  }\n}\n\n/**\n * Copy the executable URL — same pipeline as Send (`requestFactory` +\n * `resolveExecutableRequestUrl`), including security query params.\n */\nconst copyAddressBarUrl = async (): Promise<void> => {\n  const { request } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies: [...workspaceCookies, ...documentCookies],\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  await copyToClipboard(\n    resolveExecutableRequestUrl(request, getEnvironmentVariables(environment)),\n  )\n}\n\n/** Execute the current operation example */\nconst handleExecute = async () => {\n  eventBus.flushDebouncedEmits?.()\n\n  const pathValidation = validatePathParameters(\n    operation.parameters ?? [],\n    exampleKey,\n  )\n  if (pathValidation.ok === false) {\n    toast('Path parameters must have values.', 'error')\n    return\n  }\n\n  const globalCookies = [...workspaceCookies, ...documentCookies]\n\n  const { request: requestBuilder } = requestFactory({\n    defaultHeaders,\n    environment,\n    exampleName: exampleKey,\n    globalCookies,\n    method,\n    operation,\n    path,\n    proxyUrl,\n    server,\n    selectedSecuritySchemes,\n    isElectron: isElectron(),\n    requestBodyCompositionSelection,\n  })\n\n  // Stop any previous streaming response\n  if (response.value && 'reader' in response.value) {\n    response.value.reader.cancel()\n  }\n\n  const variablesStore = createVariablesStoreForRequest()\n\n  // Execute the beforeRequest hook (plugins receive RequestFactory, not fetch Request)\n  await executeHook(\n    {\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'beforeRequest',\n    plugins,\n  )\n\n  const envVariables = {\n    ...getEnvironmentVariables(environment),\n    ...variablesStore.getVariables(),\n  }\n\n  // Build the fetch Request after hooks may have mutated the factory\n  const built = buildRequest(requestBuilder, {\n    envVariables,\n    allowMissingRequestServerBase: layout === 'modal',\n  })\n  if (!built.ok) {\n    toast(built.message ?? built.error, 'error')\n    return\n  }\n\n  // Store the abort controller for cancellation\n  abortController.value = built.data.controller\n\n  // Build the fetch Request once so the requestBuilt hook observes the exact bytes that are\n  // sent. Rebuilding it later would generate a different multipart boundary, which breaks\n  // plugins that hash the body (for example, request signing).\n  const request = buildSafeBodyRequest(...built.data.requestPayload)\n\n  // Execute the requestBuilt hook (plugins receive the exact fetch Request that will be sent)\n  await executeHook(\n    {\n      request,\n      requestBuilder,\n      document,\n      operation,\n      variablesStore,\n    },\n    'requestBuilt',\n    plugins,\n  )\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:sent', {\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  /** Execute the request */\n  const [sendError, sendResult] = await sendRequest({\n    isUsingProxy: built.data.isUsingProxy,\n    requestPayload: built.data.requestPayload,\n    request,\n    plugins,\n    customFetch: toValue(options)?.customFetch,\n  })\n\n  if (sendResult) {\n    // Execute the responseReceived hook\n    await executeHook(\n      {\n        response: sendResult.originalResponse.clone(),\n        requestBuilder,\n        request: buildSafeBodyRequest(...sendResult.requestPayload),\n        document,\n        operation,\n        variablesStore,\n      },\n      'responseReceived',\n      plugins,\n    )\n  }\n\n  // Execute the hooks\n  eventBus.emit('hooks:on:request:complete', {\n    payload: sendResult\n      ? {\n          response: sendResult.originalResponse.clone(),\n          requestPayload: sendResult.requestPayload,\n          duration: sendResult.response.duration,\n          timestamp: sendResult.timestamp,\n        }\n      : undefined,\n    meta: {\n      method,\n      path,\n      exampleKey,\n    },\n  })\n\n  if (sendError) {\n    // clean up the response and request\n    response.value = null\n    requestPayload.value = null\n    abortController.value = null\n\n    toast(sendError.message, 'error')\n    return\n  }\n\n  // Store the response\n  response.value = sendResult.response\n  requestPayload.value = sendResult.requestPayload\n\n  // Persist server-set cookies into the document jar so values like a CSRF token\n  // survive a page reload and get replayed on the next request, like a browser would.\n  persistResponseCookies(sendResult)\n\n  // Cache non-streaming responses so they can be restored when navigating back\n  if (!isStreamingResponse(sendResult.response)) {\n    responseCache.set(getOperationExampleKey(method, path, exampleKey), {\n      response: sendResult.response,\n      requestPayload: sendResult.requestPayload,\n    })\n  }\n}\n\nonMounted(() => {\n  eventBus.on('operation:send:request:hotkey', handleExecute)\n  eventBus.on('operation:cancel:request', cancelRequest)\n  eventBus.on('copy-url:address-bar', copyAddressBarUrl)\n\n  // Let plugins warm up per-operation resources (e.g. the scripts sandbox) so the first request\n  // does not pay their cold-start cost.\n  void executeHook({ document, operation }, 'onRequestMount', plugins)\n})\nonBeforeUnmount(() => {\n  eventBus.off('operation:send:request:hotkey', handleExecute)\n  eventBus.off('operation:cancel:request', cancelRequest)\n  eventBus.off('copy-url:address-bar', copyAddressBarUrl)\n})\n\nconst operationHistory = computed<History[]>(() =>\n  history\n    .map((entry) => ({\n      method: entry.request.method as HttpMethodType,\n      path: entry.request.url,\n      duration: entry.time,\n      status: entry.response.status,\n    }))\n    .reverse(),\n)\n\nconst handleSelectHistoryItem = ({ index }: { index: number }) => {\n  const transformedIndex = (history.length ?? 0) - index - 1\n  const historyItem = history[transformedIndex]\n  if (!historyItem) {\n    return\n  }\n\n  const navigate = () =>\n    eventBus.emit('ui:navigate', {\n      page: 'example',\n      method,\n      path,\n      exampleName: 'draft',\n      callback: (status) => {\n        // Do not replace the response if the navigation was not successful\n        if (status !== 'success') {\n          return\n        }\n        // Reconstruct the response\n        const fetchResponse = harToFetchResponse({\n          harResponse: historyItem.response,\n          url: historyItem.request.url,\n          method,\n          path,\n          duration: historyItem.time,\n        })\n\n        // Reconstruct the request\n        const fetchRequest = harToFetchRequest({\n          harRequest: historyItem.request,\n        })\n\n        // Update the response and request\n        response.value = fetchResponse\n        requestPayload.value = fetchRequest\n      },\n    })\n\n  eventBus.emit('operation:reload:history', {\n    meta: {\n      path,\n      method,\n    },\n    index: transformedIndex,\n    callback: navigate,\n  })\n}\n\nconst handleNavigateSettings = () => {\n  eventBus.emit('ui:navigate', {\n    page: 'operation',\n    path: 'overview',\n    operationPath: path,\n    method,\n  })\n}\n\n/**\n * When the path, method, or example key changes, restore the response panel\n * for the new operation from the best available source:\n *\n *   1. `responseCache` — in-memory, populated on every successful send.\n *      Has the live response object (including streams) so it wins.\n *   2. `history` — persisted in the workspace store. Used as a fallback when\n *      the in-memory cache is empty (page reload, fresh app session, etc.)\n *      so navigating to an operation that has been called before shows the\n *      last response instead of an empty panel.\n *   3. Otherwise clear.\n *\n * Only the response is restored from history — the user's request inputs are\n * left alone, so we never silently overwrite an in-progress draft.\n */\nwatch(\n  [() => path, () => method, () => exampleKey],\n  ([newPath, newMethod, newExampleKey]) => {\n    const cached = responseCache.get(\n      getOperationExampleKey(newMethod, newPath, newExampleKey),\n    )\n\n    if (cached) {\n      response.value = cached.response\n      requestPayload.value = cached.requestPayload\n    } else {\n      // History is keyed only by document/path/method but each entry carries\n      // the example it came from, so we walk from the end and pick the most\n      // recent entry that matches the active example. Otherwise a cache miss\n      // on example B would restore example A's response. Only runs on a\n      // cache miss — the common case (in-session navigation) skips it.\n      const latest = (() => {\n        for (let i = history.length - 1; i >= 0; i--) {\n          const entry = history[i]\n          if (entry?.meta.example === newExampleKey) {\n            return entry\n          }\n        }\n        return undefined\n      })()\n\n      if (latest) {\n        response.value = harToFetchResponse({\n          harResponse: latest.response,\n          url: latest.request.url,\n          method: newMethod,\n          path: newPath,\n          duration: latest.time,\n        })\n        requestPayload.value = null\n      } else {\n        response.value = null\n        requestPayload.value = null\n      }\n    }\n\n    // Cancel any in-flight request\n    cancelRequest()\n  },\n  { immediate: true },\n)\n\nonBeforeUnmount(() => {\n  // We cancel the request if the component is unmounted\n  cancelRequest()\n})\n</script>\n<template>\n  <div class=\"bg-b-1 flex h-full flex-col\">\n    <div\n      class=\"lg:min-h-header flex w-full flex-wrap items-center justify-center p-2 lg:p-0\">\n      <!-- Address Bar -->\n      <Header\n        :activeEnvironment\n        :documentSlug\n        :documentUrl\n        :environment\n        :environments\n        :eventBus\n        :exampleKey\n        :hideClientButton\n        :history=\"operationHistory\"\n        :integration\n        :layout\n        :method\n        :path\n        :server\n        :serverMeta\n        :servers\n        :source\n        @execute=\"handleExecute\"\n        @navigate:settings=\"handleNavigateSettings\"\n        @select:history:item=\"handleSelectHistoryItem\" />\n    </div>\n\n    <ViewLayout class=\"border-t\">\n      <ViewLayoutContent class=\"flex-1\">\n        <!-- Request Section -->\n        <RequestBlock\n          :authMeta\n          :clientOptions\n          :defaultHeaders\n          :documentCookies\n          :environment\n          :eventBus\n          :exampleKey\n          :layout\n          :method\n          :operation\n          :options=\"toValue(options)\"\n          :path\n          :plugins\n          :proxyUrl\n          :requestBodyCompositionSelection\n          :securityRequirements\n          :securitySchemes\n          :selectedClient\n          :selectedSecurity\n          :selectedSecuritySchemes\n          :server\n          :workspaceCookies />\n\n        <!-- Response Section -->\n        <ResponseBlock\n          :appVersion\n          :eventBus\n          :layout\n          :plugins\n          :requestPayload\n          :response\n          :totalPerformedRequests=\"operationHistory.length\" />\n      </ViewLayoutContent>\n    </ViewLayout>\n  </div>\n</template>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;CAeE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6KR,MAAM,gBAAgB,eAAe,sBAAsB,QAAA,YAAY,CAAA;EAEvE,MAAM,EAAE,UAAU,WAAU;EAC5B,MAAM,EAAE,oBAAoB,cAAa;EAGzC,MAAM,kBAAkB,IAA4B,KAAI;EACxD,MAAM,WAAW,IAA6B,KAAI;EAClD,MAAM,iBAAiB,IAA2B,KAAI;;EAGtD,MAAM,sBAAsB,gBAAgB,OAAO,MAAM,OAAO,gBAAe;;;;;;;;;EAU/E,MAAM,0BAA0B,eAG1B;GACJ,MAAM,UAAU,yBAAyB;IACvC,kBAAkB,WAAW,SAAS,oBAAoB,EAAE;IAC5D,iBAAc,QAAA;IACd,YAAY,oBAAoB,OAAO,WAAW,eAAe,GAAG,CAAC;IACtE,CAAA;AAED,QAAK,MAAM,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS,UAAU;AAC5B,aAAA,SAAS,KAAK,wBAAwB;MACpC,gBAAgB;MAChB,YAAY,OAAO;MACnB,OAAO,OAAO;MACf,CAAA;AACD;;AAGF,YAAA,SAAS,KAAK,wBAAwB;KACpC,gBAAgB;KAChB,SAAS,OAAO;KAChB,GAAI,OAAO,UAAU,KAAA,IAAY,EAAE,GAAG,EAAE,OAAO,OAAO,OAAO;KAC9D,CAAA;;;;;;;EAQL,MAAM,oBAAoB,YAA2B;GACnD,MAAM,EAAE,YAAY,eAAe;IACjC,gBAAa,QAAA;IACb,aAAU,QAAA;IACV,aAAa,QAAA;IACb,eAAe,CAAC,GAAG,QAAA,kBAAkB,GAAG,QAAA,gBAAgB;IACxD,QAAK,QAAA;IACL,WAAQ,QAAA;IACR,MAAG,QAAA;IACH,UAAO,QAAA;IACP,QAAK,QAAA;IACL,yBAAsB,QAAA;IACtB,YAAY,YAAY;IACxB,iCAA8B,QAAA;IAC/B,CAAA;AAED,SAAM,gBACJ,4BAA4B,SAAS,wBAAwB,QAAA,YAAY,CAAC,CAC5E;;;EAIF,MAAM,gBAAgB,YAAY;AAChC,WAAA,SAAS,uBAAsB;AAM/B,OAJuB,uBACrB,QAAA,UAAU,cAAc,EAAE,EAC1B,QAAA,WACF,CACmB,OAAO,OAAO;AAC/B,UAAM,qCAAqC,QAAO;AAClD;;GAGF,MAAM,gBAAgB,CAAC,GAAG,QAAA,kBAAkB,GAAG,QAAA,gBAAe;GAE9D,MAAM,EAAE,SAAS,mBAAmB,eAAe;IACjD,gBAAa,QAAA;IACb,aAAU,QAAA;IACV,aAAa,QAAA;IACb;IACA,QAAK,QAAA;IACL,WAAQ,QAAA;IACR,MAAG,QAAA;IACH,UAAO,QAAA;IACP,QAAK,QAAA;IACL,yBAAsB,QAAA;IACtB,YAAY,YAAY;IACxB,iCAA8B,QAAA;IAC/B,CAAA;AAGD,OAAI,SAAS,SAAS,YAAY,SAAS,MACzC,UAAS,MAAM,OAAO,QAAO;GAG/B,MAAM,iBAAiB,gCAA+B;AAGtD,SAAM,YACJ;IACE;IACA,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,iBACA,QAAA,QACF;GAQA,MAAM,QAAQ,aAAa,gBAAgB;IACzC,cAPmB;KACnB,GAAG,wBAAwB,QAAA,YAAY;KACvC,GAAG,eAAe,cAAc;KAClC;IAKE,+BAA+B,QAAA,WAAW;IAC3C,CAAA;AACD,OAAI,CAAC,MAAM,IAAI;AACb,UAAM,MAAM,WAAW,MAAM,OAAO,QAAO;AAC3C;;AAIF,mBAAgB,QAAQ,MAAM,KAAK;GAKnC,MAAM,UAAU,qBAAqB,GAAG,MAAM,KAAK,eAAc;AAGjE,SAAM,YACJ;IACE;IACA;IACA,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,gBACA,QAAA,QACF;AAGA,WAAA,SAAS,KAAK,yBAAyB,EACrC,MAAM;IACJ,QAAK,QAAA;IACL,MAAG,QAAA;IACH,YAAS,QAAA;IACV,EACF,CAAA;;GAGD,MAAM,CAAC,WAAW,cAAc,MAAM,YAAY;IAChD,cAAc,MAAM,KAAK;IACzB,gBAAgB,MAAM,KAAK;IAC3B;IACA,SAAM,QAAA;IACN,aAAa,QAAQ,QAAA,QAAQ,EAAE;IAChC,CAAA;AAED,OAAI,WAEF,OAAM,YACJ;IACE,UAAU,WAAW,iBAAiB,OAAO;IAC7C;IACA,SAAS,qBAAqB,GAAG,WAAW,eAAe;IAC3D,UAAO,QAAA;IACP,WAAQ,QAAA;IACR;IACD,EACD,oBACA,QAAA,QACF;AAIF,WAAA,SAAS,KAAK,6BAA6B;IACzC,SAAS,aACL;KACE,UAAU,WAAW,iBAAiB,OAAO;KAC7C,gBAAgB,WAAW;KAC3B,UAAU,WAAW,SAAS;KAC9B,WAAW,WAAW;KACxB,GACA,KAAA;IACJ,MAAM;KACJ,QAAK,QAAA;KACL,MAAG,QAAA;KACH,YAAS,QAAA;KACV;IACF,CAAA;AAED,OAAI,WAAW;AAEb,aAAS,QAAQ;AACjB,mBAAe,QAAQ;AACvB,oBAAgB,QAAQ;AAExB,UAAM,UAAU,SAAS,QAAO;AAChC;;AAIF,YAAS,QAAQ,WAAW;AAC5B,kBAAe,QAAQ,WAAW;AAIlC,0BAAuB,WAAU;AAGjC,OAAI,CAAC,oBAAoB,WAAW,SAAS,CAC3C,eAAc,IAAI,uBAAuB,QAAA,QAAQ,QAAA,MAAM,QAAA,WAAW,EAAE;IAClE,UAAU,WAAW;IACrB,gBAAgB,WAAW;IAC5B,CAAA;;AAIL,kBAAgB;AACd,WAAA,SAAS,GAAG,iCAAiC,cAAa;AAC1D,WAAA,SAAS,GAAG,4BAA4B,cAAa;AACrD,WAAA,SAAS,GAAG,wBAAwB,kBAAiB;AAIhD,eAAY;IAAE,UAAO,QAAA;IAAG,WAAQ,QAAA;IAAG,EAAE,kBAAkB,QAAA,QAAO;IACpE;AACD,wBAAsB;AACpB,WAAA,SAAS,IAAI,iCAAiC,cAAa;AAC3D,WAAA,SAAS,IAAI,4BAA4B,cAAa;AACtD,WAAA,SAAS,IAAI,wBAAwB,kBAAiB;IACvD;EAED,MAAM,mBAAmB,eACvB,QAAA,QACG,KAAK,WAAW;GACf,QAAQ,MAAM,QAAQ;GACtB,MAAM,MAAM,QAAQ;GACpB,UAAU,MAAM;GAChB,QAAQ,MAAM,SAAS;GACxB,EAAC,CACD,SAAS,CACd;EAEA,MAAM,2BAA2B,EAAE,YAA+B;GAChE,MAAM,oBAAoB,QAAA,QAAQ,UAAU,KAAK,QAAQ;GACzD,MAAM,cAAc,QAAA,QAAQ;AAC5B,OAAI,CAAC,YACH;GAGF,MAAM,iBACJ,QAAA,SAAS,KAAK,eAAe;IAC3B,MAAM;IACN,QAAK,QAAA;IACL,MAAG,QAAA;IACH,aAAa;IACb,WAAW,WAAW;AAEpB,SAAI,WAAW,UACb;KAGF,MAAM,gBAAgB,mBAAmB;MACvC,aAAa,YAAY;MACzB,KAAK,YAAY,QAAQ;MACzB,QAAK,QAAA;MACL,MAAG,QAAA;MACH,UAAU,YAAY;MACvB,CAAA;KAGD,MAAM,eAAe,kBAAkB,EACrC,YAAY,YAAY,SACzB,CAAA;AAGD,cAAS,QAAQ;AACjB,oBAAe,QAAQ;;IAE1B,CAAA;AAEH,WAAA,SAAS,KAAK,4BAA4B;IACxC,MAAM;KACJ,MAAG,QAAA;KACH,QAAK,QAAA;KACN;IACD,OAAO;IACP,UAAU;IACX,CAAA;;EAGH,MAAM,+BAA+B;AACnC,WAAA,SAAS,KAAK,eAAe;IAC3B,MAAM;IACN,MAAM;IACN,eAAe,QAAA;IACf,QAAK,QAAA;IACN,CAAA;;;;;;;;;;;;;;;;;AAkBH,QACE;SAAO,QAAA;SAAY,QAAA;SAAc,QAAA;GAAW,GAC3C,CAAC,SAAS,WAAW,mBAAmB;GACvC,MAAM,SAAS,cAAc,IAC3B,uBAAuB,WAAW,SAAS,cAAc,CAC3D;AAEA,OAAI,QAAQ;AACV,aAAS,QAAQ,OAAO;AACxB,mBAAe,QAAQ,OAAO;UACzB;IAML,MAAM,gBAAgB;AACpB,UAAK,IAAI,IAAI,QAAA,QAAQ,SAAS,GAAG,KAAK,GAAG,KAAK;MAC5C,MAAM,QAAQ,QAAA,QAAQ;AACtB,UAAI,OAAO,KAAK,YAAY,cAC1B,QAAO;;QAIV;AAEH,QAAI,QAAQ;AACV,cAAS,QAAQ,mBAAmB;MAClC,aAAa,OAAO;MACpB,KAAK,OAAO,QAAQ;MACpB,QAAQ;MACR,MAAM;MACN,UAAU,OAAO;MAClB,CAAA;AACD,oBAAe,QAAQ;WAClB;AACL,cAAS,QAAQ;AACjB,oBAAe,QAAQ;;;AAK3B,kBAAc;KAEhB,EAAE,WAAW,MAAM,CACrB;AAEA,wBAAsB;AAEpB,kBAAc;IACf;;uBAGC,mBAiEM,OAjEN,YAiEM,CAhEJ,mBAwBM,OAxBN,YAwBM,CArBJ,YAoBmD,gBAAA;IAnBhD,mBAAA,QAAA;IACA,cAAA,QAAA;IACA,aAAA,QAAA;IACA,aAAA,QAAA;IACA,cAAA,QAAA;IACA,UAAA,QAAA;IACA,YAAA,QAAA;IACA,kBAAA,QAAA;IACA,SAAS,iBAAA;IACT,aAAA,QAAA;IACA,QAAA,QAAA;IACA,QAAA,QAAA;IACA,MAAA,QAAA;IACA,QAAA,QAAA;IACA,YAAA,QAAA;IACA,SAAA,QAAA;IACA,QAAA,QAAA;IACA,WAAS;IACT,uBAAmB;IACnB,yBAAqB;;;;;;;;;;;;;;;;;;;SAG1B,YAqCa,oBAAA,EArCD,OAAM,YAAU,EAAA;2BAoCN,CAnCpB,YAmCoB,2BAAA,EAnCD,OAAM,UAAQ,EAAA;4BAwBT,CAtBtB,YAsBsB,MAAA,qBAAA,EAAA;MArBnB,UAAA,QAAA;MACA,eAAA,cAAA;MACA,gBAAA,QAAA;MACA,iBAAA,QAAA;MACA,aAAA,QAAA;MACA,UAAA,QAAA;MACA,YAAA,QAAA;MACA,QAAA,QAAA;MACA,QAAA,QAAA;MACA,WAAA,QAAA;MACA,SAAS,QAAQ,QAAA,QAAO;MACxB,MAAA,QAAA;MACA,SAAA,QAAA;MACA,UAAA,QAAA;MACA,iCAAA,QAAA;MACA,sBAAA,QAAA;MACA,iBAAA,QAAA;MACA,gBAAA,QAAA;MACA,kBAAA,QAAA;MACA,yBAAA,QAAA;MACA,QAAA,QAAA;MACA,kBAAA,QAAA;;;;;;;;;;;;;;;;;;;;;;;;SAGH,YAOsD,MAAA,sBAAA,EAAA;MANnD,YAAA,QAAA;MACA,UAAA,QAAA;MACA,QAAA,QAAA;MACA,SAAA,QAAA;MACA,gBAAA,eAAA;MACA,UAAA,SAAA;MACA,wBAAwB,iBAAA,MAAiB"}

package/dist/v2/blocks/operation-block/helpers/persist-response-cookies.d.ts

@@ -0,0 +1,53 @@
+import type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies';
+/**
+ * A single change to apply to the persisted document cookie jar in response to a
+ * server's `Set-Cookie` headers. This mirrors how a browser stores server-set
+ * cookies so that values like a Django CSRF token survive a page reload and get
+ * replayed on the next request.
+ */
+type ResponseCookieAction = {
+    type: 'upsert';
+    /** The cookie fields to store. Merged over the existing cookie when `index` is set. */
+    cookie: Pick<XScalarCookie, 'name' | 'value' | 'domain' | 'path'>;
+    /** Index of the existing cookie to update, or undefined to add a new one. */
+    index?: number;
+} | {
+    type: 'delete';
+    cookieName: string;
+    /** Index of the existing cookie to remove. */
+    index: number;
+};
+/**
+ * Resolve the real target URL a request was sent to, so cookies are scoped to
+ * the API host rather than the proxy. When a request is proxied, the target URL
+ * is carried in the `scalar_url` query parameter; otherwise the URL is used as-is.
+ */
+export declare const getCookieRequestUrl: (payloadUrl: string) => string;
+/**
+ * Translate a response's `Set-Cookie` headers into a list of changes for the
+ * document cookie jar.
+ *
+ * Scalar sends requests through a proxy and reads `Set-Cookie` from a custom
+ * header because browsers hide it from `fetch`, so it has to maintain its own
+ * cookie jar instead of relying on the browser. This function is that jar's
+ * write path: it decides which cookies to add, update, or remove.
+ *
+ * Cookies are scoped like a browser would scope them — using the `Set-Cookie`
+ * `Domain`/`Path` attributes, or falling back to the request host and default
+ * path — so they are only replayed on matching requests. Expired cookies (an
+ * `Expires` in the past or a non-positive `Max-Age`) remove the matching cookie,
+ * matching how a server deletes a cookie.
+ *
+ * @param cookieHeaderKeys - Serialized `Set-Cookie` values from the response
+ * @param documentCookies - The current persisted document cookies (order matches the store)
+ * @param requestUrl - The request URL, used to derive the default domain and path
+ * @param now - Current time in ms, injectable for testing
+ */
+export declare const getResponseCookieActions: ({ cookieHeaderKeys, documentCookies, requestUrl, now, }: {
+    cookieHeaderKeys: string[];
+    documentCookies: XScalarCookie[];
+    requestUrl: string;
+    now?: number;
+}) => ResponseCookieAction[];
+export {};
+//# sourceMappingURL=persist-response-cookies.d.ts.map

package/dist/v2/blocks/operation-block/helpers/persist-response-cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-response-cookies.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/operation-block/helpers/persist-response-cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qEAAqE,CAAA;AAGxG;;;;;GAKG;AACH,KAAK,oBAAoB,GACrB;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,uFAAuF;IACvF,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,CAAA;IACjE,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAA;CACf,GACD;IACE,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAA;CACd,CAAA;AAEL;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,YAAY,MAAM,KAAG,MAQxD,CAAA;AAqCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,wBAAwB,GAAI,yDAKtC;IACD,gBAAgB,EAAE,MAAM,EAAE,CAAA;IAC1B,eAAe,EAAE,aAAa,EAAE,CAAA;IAChC,UAAU,EAAE,MAAM,CAAA;IAClB,GAAG,CAAC,EAAE,MAAM,CAAA;CACb,KAAG,oBAAoB,EAqEvB,CAAA"}

package/dist/v2/blocks/operation-block/helpers/persist-response-cookies.js

@@ -0,0 +1,123 @@
+import { parseSetCookie } from "set-cookie-parser";
+//#region src/v2/blocks/operation-block/helpers/persist-response-cookies.ts
+/**
+* Resolve the real target URL a request was sent to, so cookies are scoped to
+* the API host rather than the proxy. When a request is proxied, the target URL
+* is carried in the `scalar_url` query parameter; otherwise the URL is used as-is.
+*/
+var getCookieRequestUrl = (payloadUrl) => {
+	try {
+		return new URL(payloadUrl).searchParams.get("scalar_url") || payloadUrl;
+	} catch {
+		return payloadUrl;
+	}
+};
+/**
+* Compute the default cookie path from a request pathname, following the browser
+* default-path algorithm (RFC 6265, section 5.1.4): the request path up to, but
+* not including, its rightmost slash — or "/" when there is nothing before it.
+*/
+var getDefaultPath = (pathname) => {
+	if (!pathname.startsWith("/")) return "/";
+	const lastSlash = pathname.lastIndexOf("/");
+	return lastSlash <= 0 ? "/" : pathname.slice(0, lastSlash);
+};
+/**
+* Derive the host and default path a cookie should be scoped to from the request
+* URL. The URL is parsed defensively: `getCookieRequestUrl` may hand back a value
+* that is not a valid URL (for example a malformed `scalar_url`), and a throw here
+* would otherwise abort persistence after an otherwise successful request.
+*/
+var getRequestScope = (requestUrl) => {
+	try {
+		const { hostname, pathname } = new URL(requestUrl, "https://example.com");
+		return {
+			hostname,
+			defaultPath: getDefaultPath(pathname)
+		};
+	} catch {
+		return {
+			hostname: "",
+			defaultPath: "/"
+		};
+	}
+};
+/** Two stored cookies share an identity when name, domain, and path all match. */
+var isSameCookie = (a, b) => a.name === b.name && (a.domain ?? "") === (b.domain ?? "") && (a.path ?? "") === (b.path ?? "");
+/**
+* Translate a response's `Set-Cookie` headers into a list of changes for the
+* document cookie jar.
+*
+* Scalar sends requests through a proxy and reads `Set-Cookie` from a custom
+* header because browsers hide it from `fetch`, so it has to maintain its own
+* cookie jar instead of relying on the browser. This function is that jar's
+* write path: it decides which cookies to add, update, or remove.
+*
+* Cookies are scoped like a browser would scope them — using the `Set-Cookie`
+* `Domain`/`Path` attributes, or falling back to the request host and default
+* path — so they are only replayed on matching requests. Expired cookies (an
+* `Expires` in the past or a non-positive `Max-Age`) remove the matching cookie,
+* matching how a server deletes a cookie.
+*
+* @param cookieHeaderKeys - Serialized `Set-Cookie` values from the response
+* @param documentCookies - The current persisted document cookies (order matches the store)
+* @param requestUrl - The request URL, used to derive the default domain and path
+* @param now - Current time in ms, injectable for testing
+*/
+var getResponseCookieActions = ({ cookieHeaderKeys, documentCookies, requestUrl, now = Date.now() }) => {
+	const { hostname, defaultPath } = getRequestScope(requestUrl);
+	/**
+	* Collapse the response's `Set-Cookie` headers into one final state per cookie
+	* identity. A browser applies them in order, so a later header for the same
+	* name/domain/path wins — whether it sets a new value or expires the cookie.
+	* Resolving this first also keeps a single action per identity, so the same
+	* stored cookie never gets a conflicting upsert and delete on the same index.
+	*/
+	const resolved = /* @__PURE__ */ new Map();
+	for (const header of cookieHeaderKeys) {
+		const [parsed] = parseSetCookie(header);
+		if (!parsed?.name) continue;
+		const domain = parsed.domain || hostname;
+		const path = parsed.path || defaultPath;
+		const expired = parsed.maxAge !== void 0 && parsed.maxAge <= 0 || parsed.expires instanceof Date && parsed.expires.getTime() <= now;
+		resolved.set(`${parsed.name}\n${domain}\n${path}`, {
+			cookie: {
+				name: parsed.name,
+				value: parsed.value,
+				domain,
+				path
+			},
+			expired
+		});
+	}
+	const upserts = [];
+	const deletes = [];
+	for (const { cookie, expired } of resolved.values()) {
+		const index = documentCookies.findIndex((existing) => isSameCookie(cookie, existing));
+		if (expired) {
+			if (index !== -1) deletes.push({
+				type: "delete",
+				cookieName: cookie.name,
+				index
+			});
+			continue;
+		}
+		upserts.push({
+			type: "upsert",
+			cookie,
+			...index === -1 ? {} : { index }
+		});
+	}
+	/**
+	* Apply index-based changes (updates and deletes) before appends, and process
+	* deletes from the highest index down, so earlier indices stay valid as the
+	* underlying array shrinks.
+	*/
+	const indexed = [...upserts.filter((action) => action.index !== void 0), ...deletes].sort((a, b) => (b.index ?? 0) - (a.index ?? 0));
+	const appends = upserts.filter((action) => action.index === void 0);
+	return [...indexed, ...appends];
+};
+//#endregion
+export { getCookieRequestUrl, getResponseCookieActions };
+
+//# sourceMappingURL=persist-response-cookies.js.map

package/dist/v2/blocks/operation-block/helpers/persist-response-cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-response-cookies.js","names":[],"sources":["../../../../../src/v2/blocks/operation-block/helpers/persist-response-cookies.ts"],"sourcesContent":["import type { XScalarCookie } from '@scalar/workspace-store/schemas/extensions/general/x-scalar-cookies'\nimport { parseSetCookie } from 'set-cookie-parser'\n\n/**\n * A single change to apply to the persisted document cookie jar in response to a\n * server's `Set-Cookie` headers. This mirrors how a browser stores server-set\n * cookies so that values like a Django CSRF token survive a page reload and get\n * replayed on the next request.\n */\ntype ResponseCookieAction =\n  | {\n      type: 'upsert'\n      /** The cookie fields to store. Merged over the existing cookie when `index` is set. */\n      cookie: Pick<XScalarCookie, 'name' | 'value' | 'domain' | 'path'>\n      /** Index of the existing cookie to update, or undefined to add a new one. */\n      index?: number\n    }\n  | {\n      type: 'delete'\n      cookieName: string\n      /** Index of the existing cookie to remove. */\n      index: number\n    }\n\n/**\n * Resolve the real target URL a request was sent to, so cookies are scoped to\n * the API host rather than the proxy. When a request is proxied, the target URL\n * is carried in the `scalar_url` query parameter; otherwise the URL is used as-is.\n */\nexport const getCookieRequestUrl = (payloadUrl: string): string => {\n  try {\n    // Fall back to the proxied URL when `scalar_url` is missing or empty, so an\n    // empty query value never scopes cookies against a placeholder host.\n    return new URL(payloadUrl).searchParams.get('scalar_url') || payloadUrl\n  } catch {\n    return payloadUrl\n  }\n}\n\n/**\n * Compute the default cookie path from a request pathname, following the browser\n * default-path algorithm (RFC 6265, section 5.1.4): the request path up to, but\n * not including, its rightmost slash — or \"/\" when there is nothing before it.\n */\nconst getDefaultPath = (pathname: string): string => {\n  if (!pathname.startsWith('/')) {\n    return '/'\n  }\n\n  const lastSlash = pathname.lastIndexOf('/')\n\n  return lastSlash <= 0 ? '/' : pathname.slice(0, lastSlash)\n}\n\n/**\n * Derive the host and default path a cookie should be scoped to from the request\n * URL. The URL is parsed defensively: `getCookieRequestUrl` may hand back a value\n * that is not a valid URL (for example a malformed `scalar_url`), and a throw here\n * would otherwise abort persistence after an otherwise successful request.\n */\nconst getRequestScope = (requestUrl: string): { hostname: string; defaultPath: string } => {\n  try {\n    const { hostname, pathname } = new URL(requestUrl, 'https://example.com')\n\n    return { hostname, defaultPath: getDefaultPath(pathname) }\n  } catch {\n    return { hostname: '', defaultPath: '/' }\n  }\n}\n\n/** Two stored cookies share an identity when name, domain, and path all match. */\nconst isSameCookie = (a: Pick<XScalarCookie, 'name' | 'domain' | 'path'>, b: XScalarCookie): boolean =>\n  a.name === b.name && (a.domain ?? '') === (b.domain ?? '') && (a.path ?? '') === (b.path ?? '')\n\n/**\n * Translate a response's `Set-Cookie` headers into a list of changes for the\n * document cookie jar.\n *\n * Scalar sends requests through a proxy and reads `Set-Cookie` from a custom\n * header because browsers hide it from `fetch`, so it has to maintain its own\n * cookie jar instead of relying on the browser. This function is that jar's\n * write path: it decides which cookies to add, update, or remove.\n *\n * Cookies are scoped like a browser would scope them — using the `Set-Cookie`\n * `Domain`/`Path` attributes, or falling back to the request host and default\n * path — so they are only replayed on matching requests. Expired cookies (an\n * `Expires` in the past or a non-positive `Max-Age`) remove the matching cookie,\n * matching how a server deletes a cookie.\n *\n * @param cookieHeaderKeys - Serialized `Set-Cookie` values from the response\n * @param documentCookies - The current persisted document cookies (order matches the store)\n * @param requestUrl - The request URL, used to derive the default domain and path\n * @param now - Current time in ms, injectable for testing\n */\nexport const getResponseCookieActions = ({\n  cookieHeaderKeys,\n  documentCookies,\n  requestUrl,\n  now = Date.now(),\n}: {\n  cookieHeaderKeys: string[]\n  documentCookies: XScalarCookie[]\n  requestUrl: string\n  now?: number\n}): ResponseCookieAction[] => {\n  const { hostname, defaultPath } = getRequestScope(requestUrl)\n\n  /**\n   * Collapse the response's `Set-Cookie` headers into one final state per cookie\n   * identity. A browser applies them in order, so a later header for the same\n   * name/domain/path wins — whether it sets a new value or expires the cookie.\n   * Resolving this first also keeps a single action per identity, so the same\n   * stored cookie never gets a conflicting upsert and delete on the same index.\n   */\n  const resolved = new Map<\n    string,\n    { cookie: Pick<XScalarCookie, 'name' | 'value' | 'domain' | 'path'>; expired: boolean }\n  >()\n\n  for (const header of cookieHeaderKeys) {\n    // Each header holds a single Set-Cookie value, so take the first parsed cookie.\n    const [parsed] = parseSetCookie(header)\n\n    if (!parsed?.name) {\n      continue\n    }\n\n    // Scope the cookie the way a browser would, so it is only replayed on matching requests.\n    const domain = parsed.domain || hostname\n    const path = parsed.path || defaultPath\n\n    // A cookie is deleted when it is already expired via Expires or Max-Age.\n    const expired =\n      (parsed.maxAge !== undefined && parsed.maxAge <= 0) ||\n      (parsed.expires instanceof Date && parsed.expires.getTime() <= now)\n\n    resolved.set(`${parsed.name}\\n${domain}\\n${path}`, {\n      cookie: { name: parsed.name, value: parsed.value, domain, path },\n      expired,\n    })\n  }\n\n  const upserts: ResponseCookieAction[] = []\n  const deletes: ResponseCookieAction[] = []\n\n  for (const { cookie, expired } of resolved.values()) {\n    const index = documentCookies.findIndex((existing) => isSameCookie(cookie, existing))\n\n    if (expired) {\n      if (index !== -1) {\n        deletes.push({ type: 'delete', cookieName: cookie.name, index })\n      }\n      continue\n    }\n\n    upserts.push({\n      type: 'upsert',\n      cookie,\n      ...(index === -1 ? {} : { index }),\n    })\n  }\n\n  /**\n   * Apply index-based changes (updates and deletes) before appends, and process\n   * deletes from the highest index down, so earlier indices stay valid as the\n   * underlying array shrinks.\n   */\n  const indexed = [...upserts.filter((action) => action.index !== undefined), ...deletes].sort(\n    (a, b) => (b.index ?? 0) - (a.index ?? 0),\n  )\n  const appends = upserts.filter((action) => action.index === undefined)\n\n  return [...indexed, ...appends]\n}\n"],"mappings":";;;;;;;AA6BA,IAAa,uBAAuB,eAA+B;AACjE,KAAI;AAGF,SAAO,IAAI,IAAI,WAAW,CAAC,aAAa,IAAI,aAAa,IAAI;SACvD;AACN,SAAO;;;;;;;;AASX,IAAM,kBAAkB,aAA6B;AACnD,KAAI,CAAC,SAAS,WAAW,IAAI,CAC3B,QAAO;CAGT,MAAM,YAAY,SAAS,YAAY,IAAI;AAE3C,QAAO,aAAa,IAAI,MAAM,SAAS,MAAM,GAAG,UAAU;;;;;;;;AAS5D,IAAM,mBAAmB,eAAkE;AACzF,KAAI;EACF,MAAM,EAAE,UAAU,aAAa,IAAI,IAAI,YAAY,sBAAsB;AAEzE,SAAO;GAAE;GAAU,aAAa,eAAe,SAAS;GAAE;SACpD;AACN,SAAO;GAAE,UAAU;GAAI,aAAa;GAAK;;;;AAK7C,IAAM,gBAAgB,GAAoD,MACxE,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,SAAS,EAAE,UAAU,QAAQ,EAAE,QAAQ,SAAS,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;AAsB9F,IAAa,4BAA4B,EACvC,kBACA,iBACA,YACA,MAAM,KAAK,KAAK,OAMY;CAC5B,MAAM,EAAE,UAAU,gBAAgB,gBAAgB,WAAW;;;;;;;;CAS7D,MAAM,2BAAW,IAAI,KAGlB;AAEH,MAAK,MAAM,UAAU,kBAAkB;EAErC,MAAM,CAAC,UAAU,eAAe,OAAO;AAEvC,MAAI,CAAC,QAAQ,KACX;EAIF,MAAM,SAAS,OAAO,UAAU;EAChC,MAAM,OAAO,OAAO,QAAQ;EAG5B,MAAM,UACH,OAAO,WAAW,KAAA,KAAa,OAAO,UAAU,KAChD,OAAO,mBAAmB,QAAQ,OAAO,QAAQ,SAAS,IAAI;AAEjE,WAAS,IAAI,GAAG,OAAO,KAAK,IAAI,OAAO,IAAI,QAAQ;GACjD,QAAQ;IAAE,MAAM,OAAO;IAAM,OAAO,OAAO;IAAO;IAAQ;IAAM;GAChE;GACD,CAAC;;CAGJ,MAAM,UAAkC,EAAE;CAC1C,MAAM,UAAkC,EAAE;AAE1C,MAAK,MAAM,EAAE,QAAQ,aAAa,SAAS,QAAQ,EAAE;EACnD,MAAM,QAAQ,gBAAgB,WAAW,aAAa,aAAa,QAAQ,SAAS,CAAC;AAErF,MAAI,SAAS;AACX,OAAI,UAAU,GACZ,SAAQ,KAAK;IAAE,MAAM;IAAU,YAAY,OAAO;IAAM;IAAO,CAAC;AAElE;;AAGF,UAAQ,KAAK;GACX,MAAM;GACN;GACA,GAAI,UAAU,KAAK,EAAE,GAAG,EAAE,OAAO;GAClC,CAAC;;;;;;;CAQJ,MAAM,UAAU,CAAC,GAAG,QAAQ,QAAQ,WAAW,OAAO,UAAU,KAAA,EAAU,EAAE,GAAG,QAAQ,CAAC,MACrF,GAAG,OAAO,EAAE,SAAS,MAAM,EAAE,SAAS,GACxC;CACD,MAAM,UAAU,QAAQ,QAAQ,WAAW,OAAO,UAAU,KAAA,EAAU;AAEtE,QAAO,CAAC,GAAG,SAAS,GAAG,QAAQ"}

package/dist/v2/blocks/scalar-auth-selector-block/components/AuthSelector.vue.d.ts

@@ -11,6 +11,11 @@ type __VLS_Props = {
     eventBus: WorkspaceEventBus;
     /** Allows adding authentication which is not in the document */
     createAnySecurityScheme?: boolean;
+    /**
+     * Whether schemes can be deleted from the selector. Enabled for the editable client, disabled in
+     * the read-only reference where the schemes come from the document and cannot be removed.
+     */
+    canDeleteSchemes?: boolean;
     /** Whether the authentication disclosure should start expanded */
     defaultOpen?: boolean;
     /** Creates a static disclosure that cannot be collapsed */
@@ -24,6 +29,8 @@ type __VLS_Props = {
     title: string;
     /**  Any config options required for the OAuth2 flow */
     options?: OAuth2Options;
+    /** Type of the document the schemes belong to, used to label the missing-type warning */
+    documentType?: 'openapi' | 'asyncapi';
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {
     authIndicator: import("vue").ComputedRef<{

package/dist/v2/blocks/scalar-auth-selector-block/components/AuthSelector.vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthSelector.vue.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/AuthSelector.vue"],"names":[],"mappings":"AAuUA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAKnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAC7E,OAAO,KAAK,EACV,QAAQ,EACR,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EACV,eAAe,EAEf,YAAY,EACb,MAAM,8DAA8D,CAAA;AAIrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAA;AACjG,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gEAAgE,CAAA;AAKvE,KAAK,WAAW,GAAG;IACjB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACjD,eAAe,EAAE,qBAAqB,CAAA;IACtC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAC9C,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAA;CACxB,CAAC;AAkfF,QAAA,MAAM,YAAY;;cAhdqB,IAAI;cAAQ,MAAM;;;;oPAmdvD,CAAC;wBACkB,OAAO,YAAY;AAAxC,wBAAyC"}
+{"version":3,"file":"AuthSelector.vue.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/AuthSelector.vue"],"names":[],"mappings":"AAiVA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAA;AAKnD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAC7E,OAAO,KAAK,EACV,QAAQ,EACR,iBAAiB,EAClB,MAAM,gCAAgC,CAAA;AAGvC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,yCAAyC,CAAA;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AACnH,OAAO,KAAK,EACV,eAAe,EAEf,YAAY,EACb,MAAM,8DAA8D,CAAA;AAIrE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8DAA8D,CAAA;AACjG,OAAO,EAIL,KAAK,oBAAoB,EAC1B,MAAM,gEAAgE,CAAA;AAKvE,KAAK,WAAW,GAAG;IACjB,WAAW,EAAE,kBAAkB,CAAA;IAC/B,QAAQ,EAAE,iBAAiB,CAAA;IAC3B,gEAAgE;IAChE,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAA;IAC1B,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,EAAE,QAAQ,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,oBAAoB,EAAE,eAAe,CAAC,UAAU,CAAC,CAAA;IACjD,eAAe,EAAE,qBAAqB,CAAA;IACtC,gBAAgB,EAAE,gBAAgB,GAAG,SAAS,CAAA;IAC9C,MAAM,EAAE,YAAY,GAAG,IAAI,CAAA;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,uDAAuD;IACvD,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB,yFAAyF;IACzF,YAAY,CAAC,EAAE,SAAS,GAAG,UAAU,CAAA;CACtC,CAAC;AAsfF,QAAA,MAAM,YAAY;;cAldqB,IAAI;cAAQ,MAAM;;;;oPAqdvD,CAAC;wBACkB,OAAO,YAAY;AAAxC,wBAAyC"}