@scalar/api-client 3.18.0 → 3.19.1

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-openid-connect-discovery.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { type Static, Type } from '@scalar/typebox'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n/**\n * OpenID Connect Discovery Document (subset)\n * Represents the metadata fields consumed by the auth selector flow conversion.\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html\n */\nconst OpenIDConnectDiscoverySchema = Type.Object({\n  /** URL of the OAuth 2.0 Authorization Endpoint */\n  authorization_endpoint: Type.Optional(Type.String()),\n  /** URL of the OAuth 2.0 Token Endpoint */\n  token_endpoint: Type.Optional(Type.String()),\n  /** List of OAuth 2.0 scope values that this server supports */\n  scopes_supported: Type.Optional(Type.Array(Type.String())),\n  /** List of OAuth 2.0 grant type values that this server supports */\n  grant_types_supported: Type.Optional(Type.Array(Type.String())),\n  /** Supported PKCE code challenge methods (RFC 7636) */\n  code_challenge_methods_supported: Type.Optional(Type.Array(Type.String())),\n})\n\nexport type OpenIDConnectDiscovery = Static<typeof OpenIDConnectDiscoverySchema>\n\n/**\n * The required scope for OpenID Connect requests.\n * If this scope is present, the request is an OIDC request; otherwise, it is a standard OAuth 2.0 request.\n */\nexport const OPENID_SCOPE = 'openid'\n\n/**\n * Fetches the OpenID Connect discovery document from the specified URL.\n * Supports both full discovery URLs and issuer URLs.\n *\n * @param url - The OpenID Connect discovery URL or issuer URL\n * @param proxyUrl - Optional CORS proxy to route the request through\n * @param customFetch - Fetch used for the discovery request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack.\n * @returns The discovery document or an error\n */\nexport const fetchOpenIDConnectDiscovery = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OpenIDConnectDiscovery>> => {\n  try {\n    // If the URL does not end with the well-known path, append it\n    let discoveryUrl = url.trim()\n\n    if (!discoveryUrl) {\n      return [new Error('URL cannot be empty'), null]\n    }\n\n    // Remove trailing slash if present\n    if (discoveryUrl.endsWith('/')) {\n      discoveryUrl = discoveryUrl.slice(0, -1)\n    }\n\n    // If the URL does not already include the well-known path, append it\n    if (!discoveryUrl.includes('/.well-known/openid-configuration')) {\n      discoveryUrl = `${discoveryUrl}/.well-known/openid-configuration`\n    }\n\n    const proxiedUrl = redirectToProxy(proxyUrl, discoveryUrl)\n    const response = await customFetch(proxiedUrl)\n\n    if (!response.ok) {\n      return [\n        new Error(`Failed to fetch OpenID Connect discovery document: ${response.status} ${response.statusText}`),\n        null,\n      ]\n    }\n\n    const data = coerceValue(OpenIDConnectDiscoverySchema, await response.json())\n\n    // Validate that we have the essential fields\n    if (!data.authorization_endpoint && !data.token_endpoint) {\n      return [new Error('Invalid OpenID Connect discovery document: missing required endpoints'), null]\n    }\n\n    return [null, data]\n  } catch (error) {\n    if (error instanceof Error) {\n      return [error, null]\n    }\n    return [new Error('Failed to fetch OpenID Connect discovery document'), null]\n  }\n}\n"],"mappings":";;;;;;;;;;AAaA,IAAM,+BAA+B,KAAK,OAAO;;CAE/C,wBAAwB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAEnD,gBAAgB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAE3C,kBAAkB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAEzD,uBAAuB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAE9D,kCAAkC,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;;;;;;;;;;AAmBD,IAAa,8BAA8B,OACzC,KACA,UACA,cAA2B,UACwB;CACnD,IAAI;EAEF,IAAI,eAAe,IAAI,KAAK;EAE5B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,qBAAqB,GAAG,IAAI;EAIhD,IAAI,aAAa,SAAS,GAAG,GAC3B,eAAe,aAAa,MAAM,GAAG,EAAE;EAIzC,IAAI,CAAC,aAAa,SAAS,mCAAmC,GAC5D,eAAe,GAAG,aAAa;EAIjC,MAAM,WAAW,MAAM,YADJ,gBAAgB,UAAU,YACV,CAAU;EAE7C,IAAI,CAAC,SAAS,IACZ,OAAO,iBACL,IAAI,MAAM,sDAAsD,SAAS,OAAO,GAAG,SAAS,YAAY,GACxG,IACF;EAGF,MAAM,OAAO,YAAY,8BAA8B,MAAM,SAAS,KAAK,CAAC;EAG5E,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBACxC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAGlG,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,OAAO,CAAC,OAAO,IAAI;EAErB,OAAO,iBAAC,IAAI,MAAM,mDAAmD,GAAG,IAAI;CAC9E;AACF"}
+{"version":3,"file":"fetch-openid-connect-discovery.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { type Static, Type } from '@scalar/typebox'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n/**\n * OpenID Connect Discovery Document (subset)\n * Represents the metadata fields consumed by the auth selector flow conversion.\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html\n */\nexport const OpenIDConnectDiscoverySchema = Type.Object({\n  /** URL of the OAuth 2.0 Authorization Endpoint */\n  authorization_endpoint: Type.Optional(Type.String()),\n  /** URL of the OAuth 2.0 Token Endpoint */\n  token_endpoint: Type.Optional(Type.String()),\n  /** List of OAuth 2.0 scope values that this server supports */\n  scopes_supported: Type.Optional(Type.Array(Type.String())),\n  /** List of OAuth 2.0 grant type values that this server supports */\n  grant_types_supported: Type.Optional(Type.Array(Type.String())),\n  /** Supported PKCE code challenge methods (RFC 7636) */\n  code_challenge_methods_supported: Type.Optional(Type.Array(Type.String())),\n})\n\nexport type OpenIDConnectDiscovery = Static<typeof OpenIDConnectDiscoverySchema>\n\n/**\n * The required scope for OpenID Connect requests.\n * If this scope is present, the request is an OIDC request; otherwise, it is a standard OAuth 2.0 request.\n */\nexport const OPENID_SCOPE = 'openid'\n\n/**\n * Fetches the OpenID Connect discovery document from the specified URL.\n * Supports both full discovery URLs and issuer URLs.\n *\n * @param url - The OpenID Connect discovery URL or issuer URL\n * @param proxyUrl - Optional CORS proxy to route the request through\n * @param customFetch - Fetch used for the discovery request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack.\n * @returns The discovery document or an error\n */\nexport const fetchOpenIDConnectDiscovery = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OpenIDConnectDiscovery>> => {\n  try {\n    // If the URL does not end with the well-known path, append it\n    let discoveryUrl = url.trim()\n\n    if (!discoveryUrl) {\n      return [new Error('URL cannot be empty'), null]\n    }\n\n    // Remove trailing slash if present\n    if (discoveryUrl.endsWith('/')) {\n      discoveryUrl = discoveryUrl.slice(0, -1)\n    }\n\n    // If the URL does not already include the well-known path, append it\n    if (!discoveryUrl.includes('/.well-known/openid-configuration')) {\n      discoveryUrl = `${discoveryUrl}/.well-known/openid-configuration`\n    }\n\n    const proxiedUrl = redirectToProxy(proxyUrl, discoveryUrl)\n    const response = await customFetch(proxiedUrl)\n\n    if (!response.ok) {\n      return [\n        new Error(`Failed to fetch OpenID Connect discovery document: ${response.status} ${response.statusText}`),\n        null,\n      ]\n    }\n\n    const data = coerceValue(OpenIDConnectDiscoverySchema, await response.json())\n\n    // Validate that we have the essential fields\n    if (!data.authorization_endpoint && !data.token_endpoint) {\n      return [new Error('Invalid OpenID Connect discovery document: missing required endpoints'), null]\n    }\n\n    return [null, data]\n  } catch (error) {\n    if (error instanceof Error) {\n      return [error, null]\n    }\n    return [new Error('Failed to fetch OpenID Connect discovery document'), null]\n  }\n}\n"],"mappings":";;;;;;;;;;AAaA,IAAa,+BAA+B,KAAK,OAAO;;CAEtD,wBAAwB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAEnD,gBAAgB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAE3C,kBAAkB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAEzD,uBAAuB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAE9D,kCAAkC,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;;;;;;;;;;AAmBD,IAAa,8BAA8B,OACzC,KACA,UACA,cAA2B,UACwB;CACnD,IAAI;EAEF,IAAI,eAAe,IAAI,KAAK;EAE5B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,qBAAqB,GAAG,IAAI;EAIhD,IAAI,aAAa,SAAS,GAAG,GAC3B,eAAe,aAAa,MAAM,GAAG,EAAE;EAIzC,IAAI,CAAC,aAAa,SAAS,mCAAmC,GAC5D,eAAe,GAAG,aAAa;EAIjC,MAAM,WAAW,MAAM,YADJ,gBAAgB,UAAU,YACV,CAAU;EAE7C,IAAI,CAAC,SAAS,IACZ,OAAO,iBACL,IAAI,MAAM,sDAAsD,SAAS,OAAO,GAAG,SAAS,YAAY,GACxG,IACF;EAGF,MAAM,OAAO,YAAY,8BAA8B,MAAM,SAAS,KAAK,CAAC;EAG5E,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBACxC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAGlG,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,OAAO,CAAC,OAAO,IAAI;EAErB,OAAO,iBAAC,IAAI,MAAM,mDAAmD,GAAG,IAAI;CAC9E;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts

@@ -1,6 +1,6 @@
 import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
-import type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
 type ActiveServerBase = {
     basePath: string;

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAanF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;CACzB,KAAK,OAAO,CACX,aAAa,CAAC;IACZ,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CACH,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW;AACzB;;;;GAIG;AACH,kBAAkB,qBAAqB,KACtC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA6NrC,CAAA;AA+ID;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAqFrC,CAAA"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAanF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;CACzB,KAAK,OAAO,CACX,aAAa,CAAC;IACZ,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CACH,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW;AACzB;;;;GAIG;AACH,kBAAkB,qBAAqB,KACtC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA6NrC,CAAA;AAkJD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAwFrC,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js

@@ -92,7 +92,7 @@ var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl
 			if (!value) return;
 			url.searchParams.set(key, value);
 		});
-		url.searchParams.set("client_id", flow["x-scalar-secret-client-id"]);
+		url.searchParams.set("client_id", flow["x-scalar-secret-client-id"].trim());
 		url.searchParams.set("state", state);
 		if (scopes) url.searchParams.set("scope", scopes);
 		if (captureCallback) {
@@ -168,15 +168,17 @@ var authorizeServers = async (flows, type, scopes, { code, pkce, proxyUrl, custo
 	if (!flow) return [/* @__PURE__ */ new Error("OAuth2 flow was not defined"), null];
 	const formData = new URLSearchParams();
 	if (scopes && (type === "clientCredentials" || type === "password")) formData.set("scope", scopes);
+	const clientId = flow["x-scalar-secret-client-id"].trim();
+	const clientSecret = flow["x-scalar-secret-client-secret"].trim();
 	/** Where to add the credentials */
 	const addCredentialsToBody = flow["x-scalar-credentials-location"] === "body";
 	/**
 	* PKCE and client authentication are independent: a confidential client may use both.
 	* We send the client_secret whenever one is set, regardless of PKCE (see RFC 9700 Section 2.1.1).
 	*/
-	const hasClientSecret = Boolean(flow["x-scalar-secret-client-secret"]);
-	if (addCredentialsToBody || type === "authorizationCode" && !hasClientSecret) formData.set("client_id", flow["x-scalar-secret-client-id"]);
-	if (addCredentialsToBody && hasClientSecret) formData.set("client_secret", flow["x-scalar-secret-client-secret"]);
+	const hasClientSecret = Boolean(clientSecret);
+	if (addCredentialsToBody || type === "authorizationCode" && !hasClientSecret) formData.set("client_id", clientId);
+	if (addCredentialsToBody && hasClientSecret) formData.set("client_secret", clientSecret);
 	if (redirectUri) formData.set("redirect_uri", redirectUri);
 	else if ("x-scalar-secret-redirect-uri" in flow && flow["x-scalar-secret-redirect-uri"]) formData.set("redirect_uri", flow["x-scalar-secret-redirect-uri"]);
 	if (code) {
@@ -194,7 +196,7 @@ var authorizeServers = async (flows, type, scopes, { code, pkce, proxyUrl, custo
 	});
 	try {
 		const headers = { "Content-Type": "application/x-www-form-urlencoded" };
-		if (!addCredentialsToBody && hasClientSecret) headers.Authorization = `Basic ${encode(`${flow["x-scalar-secret-client-id"]}:${flow["x-scalar-secret-client-secret"]}`)}`;
+		if (!addCredentialsToBody && hasClientSecret) headers.Authorization = `Basic ${encode(`${clientId}:${clientSecret}`)}`;
 		const tokenUrl = makeUrlAbsolute(flow["x-scalar-secret-token-url"] ?? flow.tokenUrl, getActiveServerBase(activeServer, environmentVariables));
 		const responseData = await (await customFetch(shouldUseProxy(proxyUrl, tokenUrl) ? `${proxyUrl}?${new URLSearchParams([["scalar_url", tokenUrl]]).toString()}` : tokenUrl, {
 			method: "POST",
@@ -226,17 +228,19 @@ var refreshOauth2Token = async (flows, type, proxyUrl, activeServer, environment
 	const formData = new URLSearchParams();
 	formData.set("grant_type", "refresh_token");
 	formData.set("refresh_token", refreshToken);
+	const clientId = flow["x-scalar-secret-client-id"].trim();
+	const clientSecret = flow["x-scalar-secret-client-secret"].trim();
 	const addCredentialsToBody = flow["x-scalar-credentials-location"] === "body";
 	/** A confidential client keeps using its secret on refresh, even when PKCE is enabled. */
-	const hasClientSecret = Boolean(flow["x-scalar-secret-client-secret"]);
-	if (addCredentialsToBody || type === "authorizationCode" && !hasClientSecret) formData.set("client_id", flow["x-scalar-secret-client-id"]);
-	if (addCredentialsToBody && hasClientSecret) formData.set("client_secret", flow["x-scalar-secret-client-secret"]);
+	const hasClientSecret = Boolean(clientSecret);
+	if (addCredentialsToBody || type === "authorizationCode" && !hasClientSecret) formData.set("client_id", clientId);
+	if (addCredentialsToBody && hasClientSecret) formData.set("client_secret", clientSecret);
 	if (flow["x-scalar-security-body"]) Object.entries(flow["x-scalar-security-body"]).forEach(([key, value]) => {
 		if (value !== void 0 && value !== null) formData.set(key, String(value));
 	});
 	try {
 		const headers = { "Content-Type": "application/x-www-form-urlencoded" };
-		if (!addCredentialsToBody && hasClientSecret) headers.Authorization = `Basic ${encode(`${flow["x-scalar-secret-client-id"]}:${flow["x-scalar-secret-client-secret"]}`)}`;
+		if (!addCredentialsToBody && hasClientSecret) headers.Authorization = `Basic ${encode(`${clientId}:${clientSecret}`)}`;
 		const absoluteRefreshUrl = makeUrlAbsolute(flow.refreshUrl || flow["x-scalar-secret-token-url"] || flow.tokenUrl, getActiveServerBase(activeServer, environmentVariables));
 		const responseData = await (await customFetch(shouldUseProxy(proxyUrl, absoluteRefreshUrl) ? `${proxyUrl}?${new URLSearchParams([["scalar_url", absoluteRefreshUrl]]).toString()}` : absoluteRefreshUrl, {
 			method: "POST",

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\nimport { encode, fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/**\n * Captures the OAuth2 redirect for environments where the browser-popup polling\n * approach cannot work (notably the Electron desktop app, where the renderer\n * runs on `file://` and providers reject `file://` redirect URIs).\n *\n * The implementation opens the authorization URL in the system browser and\n * resolves once the provider redirects back. Because the redirect target (for\n * example an ephemeral loopback port) is only known to the host environment, the\n * implementation appends the `redirect_uri` itself and reports back the exact\n * value it used so the token exchange can send the matching `redirect_uri`.\n */\nexport type CaptureOAuth2Callback = (params: {\n  /** The fully built authorization URL, without a `redirect_uri` parameter. */\n  authorizationUrl: string\n}) => Promise<\n  ErrorResponse<{\n    /** The full callback URL the provider redirected to, including query and/or hash params. */\n    callbackUrl: string\n    /** The `redirect_uri` the host environment used, so the token exchange can match it. */\n    redirectUri: string\n  }>\n>\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n  /**\n   * Optional redirect capture for interactive flows (authorization code and implicit).\n   * When provided, the system browser plus a host-owned redirect target replaces the\n   * default popup-polling approach. Required for the Electron desktop app.\n   */\n  captureCallback?: CaptureOAuth2Callback,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authorizationUrl = makeUrlAbsolute(\n      flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n\n    const url = new URL(authorizationUrl)\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // The capture path appends its own `redirect_uri` (it owns the target, for\n    // example an ephemeral loopback port), so we only set it here for the popup path.\n    if (!captureCallback) {\n      // Handle relative redirect uris\n      if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n        const baseUrl =\n          getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n        const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n        url.searchParams.set('redirect_uri', redirectUri)\n      } else {\n        url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n      }\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set('client_id', flow['x-scalar-secret-client-id'])\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    // Capture path: open the system browser and let the host environment catch\n    // the redirect (used by the desktop app, where popup polling cannot work).\n    if (captureCallback) {\n      const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() })\n\n      if (captureError || !capture) {\n        return [captureError ?? new Error('Failed to capture the OAuth2 redirect'), null]\n      }\n\n      const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n        getOAuthCallbackData(() => capture.callbackUrl, flow['x-tokenName'] || 'access_token')\n\n      if (error) {\n        return [new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null]\n      }\n\n      // Implicit Flow\n      if (accessToken) {\n        if ((accessTokenParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return [null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }]\n      }\n\n      // Authorization Code Server Flow\n      if (code && type === 'authorizationCode') {\n        if ((codeParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return authorizeServers(\n          flows,\n          type,\n          scopes,\n          {\n            code,\n            pkce,\n            proxyUrl,\n            customFetch,\n            // The token request must echo the exact redirect_uri used in the authorization request.\n            redirectUri: capture.redirectUri,\n          },\n          activeServer,\n          environmentVariables,\n        )\n      }\n\n      return [new Error('No authorization code or access token was returned'), null]\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n    redirectUri,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n    /** Overrides the stored redirect_uri (the capture path owns the real target). */\n    redirectUri?: string\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /**\n   * PKCE and client authentication are independent: a confidential client may use both.\n   * We send the client_secret whenever one is set, regardless of PKCE (see RFC 9700 Section 2.1.1).\n   */\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret'])\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n  if (redirectUri) {\n    formData.set('redirect_uri', redirectUri)\n  } else if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    // Check if we should use the proxy\n    const tokenUrl = makeUrlAbsolute(\n      flow['x-scalar-secret-token-url'] ?? flow.tokenUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /** A confidential client keeps using its secret on refresh, even when PKCE is enabled. */\n  const hasClientSecret = Boolean(flow['x-scalar-secret-client-secret'])\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', flow['x-scalar-secret-client-id'])\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', flow['x-scalar-secret-client-secret'])\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${flow['x-scalar-secret-client-id']}:${flow['x-scalar-secret-client-secret']}`)}`\n    }\n\n    const refreshUrl = flow.refreshUrl || flow['x-scalar-secret-token-url'] || flow.tokenUrl\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA4DA,IAAa,gBACX,cACA,uBAA+C,CAAC,MAEhD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,YAAY,CAAC,GAC9E,oBACF;;;;;;;AAQF,IAAa,uBACX,cACA,uBAA+C,CAAC,MAC3B;CACrB,MAAM,YAAY,aAAa,cAAc,oBAAoB;CACjE,IAAI,CAAC,WACH,OAAO,CAAC;CAGV,IAAI,eAAe,SAAS,GAC1B,OAAO,OAAO,WAAW,cAAc,CAAC,IAAI,EAAE,UAAU,UAAU;CAGpE,OAAO,EAAE,SAAS,UAAU;AAC9B;;;;;;AAOA,IAAM,6BAAqC;CAEzC,MAAM,yBAAS,IAAI,WAAW,EAAE;CAChC,OAAO,gBAAgB,MAAM;CAG7B,OAAO,eAAe,QAAQ,IAAI;AACpC;;;;AAKA,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;CACxG,IAAI,aAAa,SACf,OAAO;CAIT,IAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;EAChD,QAAQ,KAAK,wFAAwF;EACrG,OAAO;CACT;CAIA,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAGzD,OAAO,eAAe,IAAI,WAAW,MAAM,GAAG,IAAI;AACpD;;;;;;AAOA,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,CAAC,GAEhD,aAMA,oBACyC;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI;EACF,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAG3C,MAAM,SAAS,eAAe,KAAK,GAAG;EAGtC,IAAI,SAAS,uBAAuB,SAAS,YAC3C,OAAO,iBACL,OACA,MACA,QACA;GACE;GACA;EACF,GACA,cACA,oBACF;EAIF,MAAM,SAAS,KAAK,OAAO,IAAI,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,EAAE;EAE9D,MAAM,mBAAmB,gBACvB,MAAM,KAAK,CAAE,+BAA+B,MAAM,KAAK,CAAE,kBACzD,oBAAoB,cAAc,oBAAoB,CACxD;EAEA,MAAM,MAAM,IAAI,IAAI,gBAAgB;;EAGpC,IAAI,OAAyB;EAG7B,IAAI,SAAS,YACX,IAAI,aAAa,IAAI,iBAAiB,OAAO;OACxC,IAAI,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;GAExB,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAG5C,IAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,qBAAqB;IAC1C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,YAAY;IAGtF,OAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;IACvE;IAGA,IAAI,aAAa,IAAI,kBAAkB,aAAa;IACpD,IAAI,aAAa,IAAI,yBAAyB,KAAK,mBAAmB;GACxE;EACF;EAEA,MAAM,YAAY,MAAM;EAIxB,IAAI,CAAC,iBAEH,IAAI,UAAU,+BAA+B,CAAC,WAAW,GAAG,GAAG;GAC7D,MAAM,UACJ,aAAa,cAAc,oBAAoB,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;GAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,OAAO,CAAC,CAAC,SAAS;GAEzF,IAAI,aAAa,IAAI,gBAAgB,WAAW;EAClD,OACE,IAAI,aAAa,IAAI,gBAAgB,UAAU,+BAA+B;EAIlF,IAAI,KAAK,4BACP,OAAO,KAAK,KAAK,0BAA0B,CAAC,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,0BAA0B,GAAG;GAChD,IAAI,CAAC,OACH;GAEF,IAAI,aAAa,IAAI,KAAK,KAAK;EACjC,CAAC;EAIH,IAAI,aAAa,IAAI,aAAa,KAAK,4BAA4B;EACnE,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,QACF,IAAI,aAAa,IAAI,SAAS,MAAM;EAKtC,IAAI,iBAAiB;GACnB,MAAM,CAAC,cAAc,WAAW,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,SAAS,EAAE,CAAC;GAE1F,IAAI,gBAAgB,CAAC,SACnB,OAAO,CAAC,gCAAgB,IAAI,MAAM,uCAAuC,GAAG,IAAI;GAGlF,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,QAAQ,aAAa,KAAK,kBAAkB,cAAc;GAEvF,IAAI,OACF,OAAO,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI;GAIrG,IAAI,aAAa;IACf,KAAK,mBAAmB,IAAI,OAAO,KAAK,UAAU,OAChD,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,CAAC,MAAM;KAAE;KAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IAAG,CAAC;GAC1E;GAGA,IAAI,QAAQ,SAAS,qBAAqB;IACxC,KAAK,YAAY,IAAI,OAAO,KAAK,UAAU,OACzC,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,iBACL,OACA,MACA,QACA;KACE;KACA;KACA;KACA;KAEA,aAAa,QAAQ;IACvB,GACA,cACA,oBACF;GACF;GAEA,OAAO,iBAAC,IAAI,MAAM,oDAAoD,GAAG,IAAI;EAC/E;EAGA,MAAM,aAAa,OAAO,KAAK,KAAK,mBAAmB,uCAAc;EAGrE,IAAI,YAEF,OAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,cAAc;IAG5F,IAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;KACrD,cAAc,iBAAiB;KAC/B,WAAW,MAAM;KAEjB,IAAI,OAAO;MACT,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;MACrG;KACF;KAGA,IAAI,aAAa;MAGf,KAFe,mBAAmB,IAAI,OAAO,KAAK,UAEnC,OACb,QAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;MAAG,CAAC,CAAC;WAE1E,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,IAAI,QAAQ,SAAS,qBAAqB;MAGxC,KAFe,YAAY,IAAI,OAAO,KAAK,UAE5B,OACb,iBACE,OACA,MACA,QACA;OACE;OACA;OACA;OACA;MACF,GACA,cACA,oBACF,CAAC,CACE,KAAK,OAAO,CAAC,CACb,OAAO,UAAmB;OACzB,QAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC,GAC5F,IACF,CAAC;MACH,CAAC;WAEH,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,QAAQ,iBAAC,IAAI,MAAM,kDAAkD,GAAG,IAAI,CAAC;IAC/E;GACF,GAAG,GAAG;EACR,CAAC;EAEH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CACvD,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,MAAM,CAAC,GAAG,IAAI;CAC/G;AACF;;;;;AAMA,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,OACd,gBAQE,CAAC,GACL,cACA,uBAA+C,CAAC,MACP;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,WAAW,IAAI,gBAAgB;CAGrC,IAAI,WAAW,SAAS,uBAAuB,SAAS,aACtD,SAAS,IAAI,SAAS,MAAM;;CAI9B,MAAM,uBAAuB,KAAK,qCAAqC;;;;;CAKvE,MAAM,kBAAkB,QAAQ,KAAK,gCAAgC;CAOrE,IAFiC,wBAAyB,SAAS,uBAAuB,CAAC,iBAGzF,SAAS,IAAI,aAAa,KAAK,4BAA4B;CAE7D,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,KAAK,gCAAgC;CAErE,IAAI,aACF,SAAS,IAAI,gBAAgB,WAAW;MACnC,IAAI,kCAAkC,QAAQ,KAAK,iCACxD,SAAS,IAAI,gBAAgB,KAAK,+BAA+B;CAInE,IAAI,MAAM;EACR,SAAS,IAAI,QAAQ,IAAI;EACzB,SAAS,IAAI,cAAc,oBAAoB;EAG/C,IAAI,MACF,SAAS,IAAI,iBAAiB,KAAK,YAAY;CAEnD,OAEK,IAAI,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;EACxB,SAAS,IAAI,cAAc,UAAU;EACrC,SAAS,IAAI,YAAY,UAAU,2BAA2B;EAC9D,SAAS,IAAI,YAAY,UAAU,2BAA2B;CAChE,OAGE,SAAS,IAAI,cAAc,oBAAoB;CAIjD,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAGA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,kCAAkC;EAIzH,MAAM,WAAW,gBACf,KAAK,gCAAgC,KAAK,UAC1C,oBAAoB,cAAc,oBAAoB,CACxD;EAWA,MAAM,eAAe,OAAM,MALR,YALP,eAAe,UAAU,QAAQ,IACzC,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,MACxE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAIrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;EAElC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,+BAA+B,GAAG,IAAI;EAGlH,OAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,aAAa,IAAI,CAAC;EAAG,CAAC;CAC9F,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,MAAM,CAAC,GAC/F,IACF;CACF;AACF;;;;;;;AAQA,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,CAAC,GAEhD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,eAAe,KAAK;CAC1B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CAGvD,MAAM,WAAW,IAAI,gBAAgB;CACrC,SAAS,IAAI,cAAc,eAAe;CAC1C,SAAS,IAAI,iBAAiB,YAAY;CAE1C,MAAM,uBAAuB,KAAK,qCAAqC;;CAEvE,MAAM,kBAAkB,QAAQ,KAAK,gCAAgC;CAOrE,IAFiC,wBAAyB,SAAS,uBAAuB,CAAC,iBAGzF,SAAS,IAAI,aAAa,KAAK,4BAA4B;CAE7D,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,KAAK,gCAAgC;CAGrE,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAEA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,SAAS,OAAO,GAAG,KAAK,6BAA6B,GAAG,KAAK,kCAAkC;EAIzH,MAAM,qBAAqB,gBADR,KAAK,cAAc,KAAK,gCAAgC,KAAK,UACzB,oBAAoB,cAAc,oBAAoB,CAAC;EAU9G,MAAM,eAAe,OAAM,MALR,YAJP,eAAe,UAAU,kBAAkB,IACnD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,MAClF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAGrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;EAErC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,sBAAsB,GAAG,IAAI;EAGzG,OAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,gBAAgB,IAAI,EAAE,aAAa;EAC/F,CACF;CACF,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,MAAM,CAAC,GAC1F,IACF;CACF;AACF"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { encode, fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/**\n * Captures the OAuth2 redirect for environments where the browser-popup polling\n * approach cannot work (notably the Electron desktop app, where the renderer\n * runs on `file://` and providers reject `file://` redirect URIs).\n *\n * The implementation opens the authorization URL in the system browser and\n * resolves once the provider redirects back. Because the redirect target (for\n * example an ephemeral loopback port) is only known to the host environment, the\n * implementation appends the `redirect_uri` itself and reports back the exact\n * value it used so the token exchange can send the matching `redirect_uri`.\n */\nexport type CaptureOAuth2Callback = (params: {\n  /** The fully built authorization URL, without a `redirect_uri` parameter. */\n  authorizationUrl: string\n}) => Promise<\n  ErrorResponse<{\n    /** The full callback URL the provider redirected to, including query and/or hash params. */\n    callbackUrl: string\n    /** The `redirect_uri` the host environment used, so the token exchange can match it. */\n    redirectUri: string\n  }>\n>\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n  /**\n   * Optional redirect capture for interactive flows (authorization code and implicit).\n   * When provided, the system browser plus a host-owned redirect target replaces the\n   * default popup-polling approach. Required for the Electron desktop app.\n   */\n  captureCallback?: CaptureOAuth2Callback,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authorizationUrl = makeUrlAbsolute(\n      flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n\n    const url = new URL(authorizationUrl)\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // The capture path appends its own `redirect_uri` (it owns the target, for\n    // example an ephemeral loopback port), so we only set it here for the popup path.\n    if (!captureCallback) {\n      // Handle relative redirect uris\n      if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n        const baseUrl =\n          getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n        const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n        url.searchParams.set('redirect_uri', redirectUri)\n      } else {\n        url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n      }\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set('client_id', flow['x-scalar-secret-client-id'].trim())\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    // Capture path: open the system browser and let the host environment catch\n    // the redirect (used by the desktop app, where popup polling cannot work).\n    if (captureCallback) {\n      const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() })\n\n      if (captureError || !capture) {\n        return [captureError ?? new Error('Failed to capture the OAuth2 redirect'), null]\n      }\n\n      const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n        getOAuthCallbackData(() => capture.callbackUrl, flow['x-tokenName'] || 'access_token')\n\n      if (error) {\n        return [new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null]\n      }\n\n      // Implicit Flow\n      if (accessToken) {\n        if ((accessTokenParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return [null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }]\n      }\n\n      // Authorization Code Server Flow\n      if (code && type === 'authorizationCode') {\n        if ((codeParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return authorizeServers(\n          flows,\n          type,\n          scopes,\n          {\n            code,\n            pkce,\n            proxyUrl,\n            customFetch,\n            // The token request must echo the exact redirect_uri used in the authorization request.\n            redirectUri: capture.redirectUri,\n          },\n          activeServer,\n          environmentVariables,\n        )\n      }\n\n      return [new Error('No authorization code or access token was returned'), null]\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n    redirectUri,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n    /** Overrides the stored redirect_uri (the capture path owns the real target). */\n    redirectUri?: string\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = flow['x-scalar-secret-client-id'].trim()\n  const clientSecret = flow['x-scalar-secret-client-secret'].trim()\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /**\n   * PKCE and client authentication are independent: a confidential client may use both.\n   * We send the client_secret whenever one is set, regardless of PKCE (see RFC 9700 Section 2.1.1).\n   */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n  if (redirectUri) {\n    formData.set('redirect_uri', redirectUri)\n  } else if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${clientId}:${clientSecret}`)}`\n    }\n\n    // Check if we should use the proxy\n    const tokenUrl = makeUrlAbsolute(\n      flow['x-scalar-secret-token-url'] ?? flow.tokenUrl,\n      getActiveServerBase(activeServer, environmentVariables),\n    )\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = flow['x-scalar-secret-client-id'].trim()\n  const clientSecret = flow['x-scalar-secret-client-secret'].trim()\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /** A confidential client keeps using its secret on refresh, even when PKCE is enabled. */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody = addCredentialsToBody || (type === 'authorizationCode' && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = `Basic ${encode(`${clientId}:${clientSecret}`)}`\n    }\n\n    const refreshUrl = flow.refreshUrl || flow['x-scalar-secret-token-url'] || flow.tokenUrl\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA4DA,IAAa,gBACX,cACA,uBAA+C,CAAC,MAEhD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,YAAY,CAAC,GAC9E,oBACF;;;;;;;AAQF,IAAa,uBACX,cACA,uBAA+C,CAAC,MAC3B;CACrB,MAAM,YAAY,aAAa,cAAc,oBAAoB;CACjE,IAAI,CAAC,WACH,OAAO,CAAC;CAGV,IAAI,eAAe,SAAS,GAC1B,OAAO,OAAO,WAAW,cAAc,CAAC,IAAI,EAAE,UAAU,UAAU;CAGpE,OAAO,EAAE,SAAS,UAAU;AAC9B;;;;;;AAOA,IAAM,6BAAqC;CAEzC,MAAM,yBAAS,IAAI,WAAW,EAAE;CAChC,OAAO,gBAAgB,MAAM;CAG7B,OAAO,eAAe,QAAQ,IAAI;AACpC;;;;AAKA,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;CACxG,IAAI,aAAa,SACf,OAAO;CAIT,IAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;EAChD,QAAQ,KAAK,wFAAwF;EACrG,OAAO;CACT;CAIA,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAGzD,OAAO,eAAe,IAAI,WAAW,MAAM,GAAG,IAAI;AACpD;;;;;;AAOA,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,CAAC,GAEhD,aAMA,oBACyC;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI;EACF,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAG3C,MAAM,SAAS,eAAe,KAAK,GAAG;EAGtC,IAAI,SAAS,uBAAuB,SAAS,YAC3C,OAAO,iBACL,OACA,MACA,QACA;GACE;GACA;EACF,GACA,cACA,oBACF;EAIF,MAAM,SAAS,KAAK,OAAO,IAAI,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,EAAE;EAE9D,MAAM,mBAAmB,gBACvB,MAAM,KAAK,CAAE,+BAA+B,MAAM,KAAK,CAAE,kBACzD,oBAAoB,cAAc,oBAAoB,CACxD;EAEA,MAAM,MAAM,IAAI,IAAI,gBAAgB;;EAGpC,IAAI,OAAyB;EAG7B,IAAI,SAAS,YACX,IAAI,aAAa,IAAI,iBAAiB,OAAO;OACxC,IAAI,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;GAExB,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAG5C,IAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,qBAAqB;IAC1C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,YAAY;IAGtF,OAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;IACvE;IAGA,IAAI,aAAa,IAAI,kBAAkB,aAAa;IACpD,IAAI,aAAa,IAAI,yBAAyB,KAAK,mBAAmB;GACxE;EACF;EAEA,MAAM,YAAY,MAAM;EAIxB,IAAI,CAAC,iBAEH,IAAI,UAAU,+BAA+B,CAAC,WAAW,GAAG,GAAG;GAC7D,MAAM,UACJ,aAAa,cAAc,oBAAoB,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;GAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,OAAO,CAAC,CAAC,SAAS;GAEzF,IAAI,aAAa,IAAI,gBAAgB,WAAW;EAClD,OACE,IAAI,aAAa,IAAI,gBAAgB,UAAU,+BAA+B;EAIlF,IAAI,KAAK,4BACP,OAAO,KAAK,KAAK,0BAA0B,CAAC,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,0BAA0B,GAAG;GAChD,IAAI,CAAC,OACH;GAEF,IAAI,aAAa,IAAI,KAAK,KAAK;EACjC,CAAC;EAIH,IAAI,aAAa,IAAI,aAAa,KAAK,4BAA4B,CAAC,KAAK,CAAC;EAC1E,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,QACF,IAAI,aAAa,IAAI,SAAS,MAAM;EAKtC,IAAI,iBAAiB;GACnB,MAAM,CAAC,cAAc,WAAW,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,SAAS,EAAE,CAAC;GAE1F,IAAI,gBAAgB,CAAC,SACnB,OAAO,CAAC,gCAAgB,IAAI,MAAM,uCAAuC,GAAG,IAAI;GAGlF,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,QAAQ,aAAa,KAAK,kBAAkB,cAAc;GAEvF,IAAI,OACF,OAAO,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI;GAIrG,IAAI,aAAa;IACf,KAAK,mBAAmB,IAAI,OAAO,KAAK,UAAU,OAChD,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,CAAC,MAAM;KAAE;KAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IAAG,CAAC;GAC1E;GAGA,IAAI,QAAQ,SAAS,qBAAqB;IACxC,KAAK,YAAY,IAAI,OAAO,KAAK,UAAU,OACzC,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,iBACL,OACA,MACA,QACA;KACE;KACA;KACA;KACA;KAEA,aAAa,QAAQ;IACvB,GACA,cACA,oBACF;GACF;GAEA,OAAO,iBAAC,IAAI,MAAM,oDAAoD,GAAG,IAAI;EAC/E;EAGA,MAAM,aAAa,OAAO,KAAK,KAAK,mBAAmB,uCAAc;EAGrE,IAAI,YAEF,OAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,cAAc;IAG5F,IAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;KACrD,cAAc,iBAAiB;KAC/B,WAAW,MAAM;KAEjB,IAAI,OAAO;MACT,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;MACrG;KACF;KAGA,IAAI,aAAa;MAGf,KAFe,mBAAmB,IAAI,OAAO,KAAK,UAEnC,OACb,QAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;MAAG,CAAC,CAAC;WAE1E,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,IAAI,QAAQ,SAAS,qBAAqB;MAGxC,KAFe,YAAY,IAAI,OAAO,KAAK,UAE5B,OACb,iBACE,OACA,MACA,QACA;OACE;OACA;OACA;OACA;MACF,GACA,cACA,oBACF,CAAC,CACE,KAAK,OAAO,CAAC,CACb,OAAO,UAAmB;OACzB,QAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC,GAC5F,IACF,CAAC;MACH,CAAC;WAEH,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,QAAQ,iBAAC,IAAI,MAAM,kDAAkD,GAAG,IAAI,CAAC;IAC/E;GACF,GAAG,GAAG;EACR,CAAC;EAEH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CACvD,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,MAAM,CAAC,GAAG,IAAI;CAC/G;AACF;;;;;AAMA,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,OACd,gBAQE,CAAC,GACL,cACA,uBAA+C,CAAC,MACP;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,WAAW,IAAI,gBAAgB;CAGrC,IAAI,WAAW,SAAS,uBAAuB,SAAS,aACtD,SAAS,IAAI,SAAS,MAAM;CAI9B,MAAM,WAAW,KAAK,4BAA4B,CAAC,KAAK;CACxD,MAAM,eAAe,KAAK,gCAAgC,CAAC,KAAK;;CAEhE,MAAM,uBAAuB,KAAK,qCAAqC;;;;;CAKvE,MAAM,kBAAkB,QAAQ,YAAY;CAO5C,IAFiC,wBAAyB,SAAS,uBAAuB,CAAC,iBAGzF,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAE5C,IAAI,aACF,SAAS,IAAI,gBAAgB,WAAW;MACnC,IAAI,kCAAkC,QAAQ,KAAK,iCACxD,SAAS,IAAI,gBAAgB,KAAK,+BAA+B;CAInE,IAAI,MAAM;EACR,SAAS,IAAI,QAAQ,IAAI;EACzB,SAAS,IAAI,cAAc,oBAAoB;EAG/C,IAAI,MACF,SAAS,IAAI,iBAAiB,KAAK,YAAY;CAEnD,OAEK,IAAI,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;EACxB,SAAS,IAAI,cAAc,UAAU;EACrC,SAAS,IAAI,YAAY,UAAU,2BAA2B;EAC9D,SAAS,IAAI,YAAY,UAAU,2BAA2B;CAChE,OAGE,SAAS,IAAI,cAAc,oBAAoB;CAIjD,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAGA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,SAAS,OAAO,GAAG,SAAS,GAAG,cAAc;EAIvE,MAAM,WAAW,gBACf,KAAK,gCAAgC,KAAK,UAC1C,oBAAoB,cAAc,oBAAoB,CACxD;EAWA,MAAM,eAAe,OAAM,MALR,YALP,eAAe,UAAU,QAAQ,IACzC,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,MACxE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAIrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;EAElC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,+BAA+B,GAAG,IAAI;EAGlH,OAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,aAAa,IAAI,CAAC;EAAG,CAAC;CAC9F,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,MAAM,CAAC,GAC/F,IACF;CACF;AACF;;;;;;;AAQA,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,CAAC,GAEhD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,eAAe,KAAK;CAC1B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CAGvD,MAAM,WAAW,IAAI,gBAAgB;CACrC,SAAS,IAAI,cAAc,eAAe;CAC1C,SAAS,IAAI,iBAAiB,YAAY;CAG1C,MAAM,WAAW,KAAK,4BAA4B,CAAC,KAAK;CACxD,MAAM,eAAe,KAAK,gCAAgC,CAAC,KAAK;CAChE,MAAM,uBAAuB,KAAK,qCAAqC;;CAEvE,MAAM,kBAAkB,QAAQ,YAAY;CAO5C,IAFiC,wBAAyB,SAAS,uBAAuB,CAAC,iBAGzF,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAG5C,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAEA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,SAAS,OAAO,GAAG,SAAS,GAAG,cAAc;EAIvE,MAAM,qBAAqB,gBADR,KAAK,cAAc,KAAK,gCAAgC,KAAK,UACzB,oBAAoB,cAAc,oBAAoB,CAAC;EAU9G,MAAM,eAAe,OAAM,MALR,YAJP,eAAe,UAAU,kBAAkB,IACnD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,MAClF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAGrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;EAErC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,sBAAsB,GAAG,IAAI;EAGzG,OAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,gBAAgB,IAAI,EAAE,aAAa;EAC/F,CACF;CACF,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,MAAM,CAAC,GAC1F,IACF;CACF;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.d.ts

@@ -0,0 +1,9 @@
+import type { OAuthFlowsObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
+import type { OpenIDConnectDiscovery } from './fetch-openid-connect-discovery.js';
+type FlowUpdates = {
+    [Key in keyof OAuthFlowsObject]?: Partial<NonNullable<OAuthFlowsObject[Key]>>;
+};
+/** Supplements endpoints in declared flows. Explicit scopes, including an empty scope set, remain authoritative. */
+export declare const oauth2MetadataToFlows: (metadata: OpenIDConnectDiscovery, flows: OAuthFlowsObject) => FlowUpdates;
+export {};
+//# sourceMappingURL=oauth2-metadata-to-flows.d.ts.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-metadata-to-flows.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8DAA8D,CAAA;AAEpG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAE9E,KAAK,WAAW,GAAG;KAAG,GAAG,IAAI,MAAM,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;CAAE,CAAA;AAEpG,oHAAoH;AACpH,eAAO,MAAM,qBAAqB,GAAI,UAAU,sBAAsB,EAAE,OAAO,gBAAgB,KAAG,WA6BjG,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.js

@@ -0,0 +1,36 @@
+//#region src/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.ts
+/** Supplements endpoints in declared flows. Explicit scopes, including an empty scope set, remain authoritative. */
+var oauth2MetadataToFlows = (metadata, flows) => {
+	const scopes = Object.fromEntries((metadata.scopes_supported ?? []).map((scope) => [scope, ""]));
+	const grants = new Set(metadata.grant_types_supported ?? ["authorization_code", "implicit"]);
+	const authorizationUrl = metadata.authorization_endpoint;
+	const tokenUrl = metadata.token_endpoint;
+	const discovered = {
+		...grants.has("implicit") && authorizationUrl ? { implicit: {
+			authorizationUrl,
+			scopes
+		} } : {},
+		...grants.has("password") && tokenUrl ? { password: {
+			tokenUrl,
+			scopes
+		} } : {},
+		...grants.has("client_credentials") && tokenUrl ? { clientCredentials: {
+			tokenUrl,
+			scopes
+		} } : {},
+		...grants.has("authorization_code") && authorizationUrl && tokenUrl ? { authorizationCode: {
+			authorizationUrl,
+			tokenUrl,
+			scopes
+		} } : {}
+	};
+	if (!Object.keys(flows).length) return discovered;
+	return Object.fromEntries(Object.entries(flows).filter(([, flow]) => flow).map(([key, flow]) => [key, {
+		..."authorizationUrl" in flow && !flow.authorizationUrl && authorizationUrl ? { authorizationUrl } : {},
+		..."tokenUrl" in flow && !flow.tokenUrl && tokenUrl ? { tokenUrl } : {}
+	}]).filter(([, update]) => Object.keys(update).length > 0));
+};
+//#endregion
+export { oauth2MetadataToFlows };
+
+//# sourceMappingURL=oauth2-metadata-to-flows.js.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth2-metadata-to-flows.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth2-metadata-to-flows.ts"],"sourcesContent":["import type { OAuthFlowsObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { OpenIDConnectDiscovery } from './fetch-openid-connect-discovery'\n\ntype FlowUpdates = { [Key in keyof OAuthFlowsObject]?: Partial<NonNullable<OAuthFlowsObject[Key]>> }\n\n/** Supplements endpoints in declared flows. Explicit scopes, including an empty scope set, remain authoritative. */\nexport const oauth2MetadataToFlows = (metadata: OpenIDConnectDiscovery, flows: OAuthFlowsObject): FlowUpdates => {\n  const scopes = Object.fromEntries((metadata.scopes_supported ?? []).map((scope) => [scope, '']))\n  const grants = new Set(metadata.grant_types_supported ?? ['authorization_code', 'implicit'])\n  const authorizationUrl = metadata.authorization_endpoint\n  const tokenUrl = metadata.token_endpoint\n  const discovered: FlowUpdates = {\n    ...(grants.has('implicit') && authorizationUrl ? { implicit: { authorizationUrl, scopes } } : {}),\n    ...(grants.has('password') && tokenUrl ? { password: { tokenUrl, scopes } } : {}),\n    ...(grants.has('client_credentials') && tokenUrl ? { clientCredentials: { tokenUrl, scopes } } : {}),\n    ...(grants.has('authorization_code') && authorizationUrl && tokenUrl\n      ? { authorizationCode: { authorizationUrl, tokenUrl, scopes } }\n      : {}),\n  }\n  // An empty Flows Object can discover supported grants. Otherwise the API description controls the allowed flows.\n  if (!Object.keys(flows).length) {\n    return discovered\n  }\n  return Object.fromEntries(\n    Object.entries(flows)\n      .filter(([, flow]) => flow)\n      .map(([key, flow]): [string, Record<string, string>] => [\n        key,\n        {\n          ...('authorizationUrl' in flow && !flow.authorizationUrl && authorizationUrl ? { authorizationUrl } : {}),\n          ...('tokenUrl' in flow && !flow.tokenUrl && tokenUrl ? { tokenUrl } : {}),\n        },\n      ])\n      .filter(([, update]) => Object.keys(update).length > 0),\n  )\n}\n"],"mappings":";;AAOA,IAAa,yBAAyB,UAAkC,UAAyC;CAC/G,MAAM,SAAS,OAAO,aAAa,SAAS,oBAAoB,CAAC,EAAA,CAAG,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;CAC/F,MAAM,SAAS,IAAI,IAAI,SAAS,yBAAyB,CAAC,sBAAsB,UAAU,CAAC;CAC3F,MAAM,mBAAmB,SAAS;CAClC,MAAM,WAAW,SAAS;CAC1B,MAAM,aAA0B;EAC9B,GAAI,OAAO,IAAI,UAAU,KAAK,mBAAmB,EAAE,UAAU;GAAE;GAAkB;EAAO,EAAE,IAAI,CAAC;EAC/F,GAAI,OAAO,IAAI,UAAU,KAAK,WAAW,EAAE,UAAU;GAAE;GAAU;EAAO,EAAE,IAAI,CAAC;EAC/E,GAAI,OAAO,IAAI,oBAAoB,KAAK,WAAW,EAAE,mBAAmB;GAAE;GAAU;EAAO,EAAE,IAAI,CAAC;EAClG,GAAI,OAAO,IAAI,oBAAoB,KAAK,oBAAoB,WACxD,EAAE,mBAAmB;GAAE;GAAkB;GAAU;EAAO,EAAE,IAC5D,CAAC;CACP;CAEA,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,QACtB,OAAO;CAET,OAAO,OAAO,YACZ,OAAO,QAAQ,KAAK,CAAC,CAClB,QAAQ,GAAG,UAAU,IAAI,CAAC,CAC1B,KAAK,CAAC,KAAK,UAA4C,CACtD,KACA;EACE,GAAI,sBAAsB,QAAQ,CAAC,KAAK,oBAAoB,mBAAmB,EAAE,iBAAiB,IAAI,CAAC;EACvG,GAAI,cAAc,QAAQ,CAAC,KAAK,YAAY,WAAW,EAAE,SAAS,IAAI,CAAC;CACzE,CACF,CAAC,CAAC,CACD,QAAQ,GAAG,YAAY,OAAO,KAAK,MAAM,CAAC,CAAC,SAAS,CAAC,CAC1D;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/openid-discovery-to-flows.js.map

@@ -1 +1 @@
-{"version":3,"file":"openid-discovery-to-flows.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/openid-discovery-to-flows.ts"],"sourcesContent":["import { OpenIDConnectSchema, type SecretsOpenIdConnect } from '@scalar/workspace-store/entities/auth'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\nimport type { OAuthFlowsObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\n\nimport type { OpenIDConnectDiscovery } from './fetch-openid-connect-discovery'\n\n/** Takes in an open ID Connect discovery response and converts it into an oauth flow to be used for authorization */\nexport const openIDDiscoveryToFlows = (discovery: OpenIDConnectDiscovery): SecretsOpenIdConnect => {\n  const scopes = Object.fromEntries((discovery.scopes_supported ?? []).map((scope) => [scope, '']))\n  const grantTypes = new Set(discovery.grant_types_supported ?? ['authorization_code', 'implicit'])\n  const authorizationUrl = discovery.authorization_endpoint\n  const tokenUrl = discovery.token_endpoint\n\n  const usePkce = discovery.code_challenge_methods_supported?.includes('S256')\n    ? 'SHA-256'\n    : discovery.code_challenge_methods_supported?.includes('plain')\n      ? 'plain'\n      : 'no'\n\n  const flows: OAuthFlowsObject = {}\n\n  // Implicit\n  if (grantTypes.has('implicit') && authorizationUrl) {\n    flows.implicit = {\n      authorizationUrl,\n      refreshUrl: authorizationUrl,\n      scopes,\n    }\n  }\n\n  // Password\n  if (grantTypes.has('password') && tokenUrl) {\n    flows.password = {\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      scopes,\n    }\n  }\n\n  // Client Credentials\n  if (grantTypes.has('client_credentials') && tokenUrl) {\n    flows.clientCredentials = {\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      scopes,\n    }\n  }\n\n  // Authorization Code\n  if (grantTypes.has('authorization_code') && authorizationUrl && tokenUrl) {\n    flows.authorizationCode = {\n      authorizationUrl,\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      'x-usePkce': usePkce,\n      scopes,\n    }\n  }\n\n  return coerceValue(OpenIDConnectSchema, flows)\n}\n"],"mappings":";;;;AAOA,IAAa,0BAA0B,cAA4D;CACjG,MAAM,SAAS,OAAO,aAAa,UAAU,oBAAoB,CAAC,EAAA,CAAG,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;CAChG,MAAM,aAAa,IAAI,IAAI,UAAU,yBAAyB,CAAC,sBAAsB,UAAU,CAAC;CAChG,MAAM,mBAAmB,UAAU;CACnC,MAAM,WAAW,UAAU;CAE3B,MAAM,UAAU,UAAU,kCAAkC,SAAS,MAAM,IACvE,YACA,UAAU,kCAAkC,SAAS,OAAO,IAC1D,UACA;CAEN,MAAM,QAA0B,CAAC;CAGjC,IAAI,WAAW,IAAI,UAAU,KAAK,kBAChC,MAAM,WAAW;EACf;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,UAAU,KAAK,UAChC,MAAM,WAAW;EACf;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,oBAAoB,KAAK,UAC1C,MAAM,oBAAoB;EACxB;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,oBAAoB,KAAK,oBAAoB,UAC9D,MAAM,oBAAoB;EACxB;EACA;EACA,YAAY;EACZ,aAAa;EACb;CACF;CAGF,OAAO,YAAY,qBAAqB,KAAK;AAC/C"}
+{"version":3,"file":"openid-discovery-to-flows.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/openid-discovery-to-flows.ts"],"sourcesContent":["import { OpenIDConnectSchema, type SecretsOpenIdConnect } from '@scalar/workspace-store/entities/auth'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\nimport type { OAuthFlowsObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { OpenIDConnectDiscovery } from './fetch-openid-connect-discovery'\n\n/** Takes in an open ID Connect discovery response and converts it into an oauth flow to be used for authorization */\nexport const openIDDiscoveryToFlows = (discovery: OpenIDConnectDiscovery): SecretsOpenIdConnect => {\n  const scopes = Object.fromEntries((discovery.scopes_supported ?? []).map((scope) => [scope, '']))\n  const grantTypes = new Set(discovery.grant_types_supported ?? ['authorization_code', 'implicit'])\n  const authorizationUrl = discovery.authorization_endpoint\n  const tokenUrl = discovery.token_endpoint\n\n  const usePkce = discovery.code_challenge_methods_supported?.includes('S256')\n    ? 'SHA-256'\n    : discovery.code_challenge_methods_supported?.includes('plain')\n      ? 'plain'\n      : 'no'\n\n  const flows: OAuthFlowsObject = {}\n\n  // Implicit\n  if (grantTypes.has('implicit') && authorizationUrl) {\n    flows.implicit = {\n      authorizationUrl,\n      refreshUrl: authorizationUrl,\n      scopes,\n    }\n  }\n\n  // Password\n  if (grantTypes.has('password') && tokenUrl) {\n    flows.password = {\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      scopes,\n    }\n  }\n\n  // Client Credentials\n  if (grantTypes.has('client_credentials') && tokenUrl) {\n    flows.clientCredentials = {\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      scopes,\n    }\n  }\n\n  // Authorization Code\n  if (grantTypes.has('authorization_code') && authorizationUrl && tokenUrl) {\n    flows.authorizationCode = {\n      authorizationUrl,\n      tokenUrl,\n      refreshUrl: tokenUrl,\n      'x-usePkce': usePkce,\n      scopes,\n    }\n  }\n\n  return coerceValue(OpenIDConnectSchema, flows)\n}\n"],"mappings":";;;;AAOA,IAAa,0BAA0B,cAA4D;CACjG,MAAM,SAAS,OAAO,aAAa,UAAU,oBAAoB,CAAC,EAAA,CAAG,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;CAChG,MAAM,aAAa,IAAI,IAAI,UAAU,yBAAyB,CAAC,sBAAsB,UAAU,CAAC;CAChG,MAAM,mBAAmB,UAAU;CACnC,MAAM,WAAW,UAAU;CAE3B,MAAM,UAAU,UAAU,kCAAkC,SAAS,MAAM,IACvE,YACA,UAAU,kCAAkC,SAAS,OAAO,IAC1D,UACA;CAEN,MAAM,QAA0B,CAAC;CAGjC,IAAI,WAAW,IAAI,UAAU,KAAK,kBAChC,MAAM,WAAW;EACf;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,UAAU,KAAK,UAChC,MAAM,WAAW;EACf;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,oBAAoB,KAAK,UAC1C,MAAM,oBAAoB;EACxB;EACA,YAAY;EACZ;CACF;CAIF,IAAI,WAAW,IAAI,oBAAoB,KAAK,oBAAoB,UAC9D,MAAM,oBAAoB;EACxB;EACA;EACA,YAAY;EACZ,aAAa;EACb;CACF;CAGF,OAAO,YAAY,qBAAqB,KAAK;AAC/C"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.d.ts

@@ -2,7 +2,7 @@ import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import type { WorkspaceEventBus } from '@scalar/workspace-store/events';
 import { type OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
 import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments';
-import type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { OAuth2Options } from '../../../../v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.js';
 import { type OAuth2Tokens } from '../../../../v2/blocks/scalar-auth-selector-block/helpers/oauth.js';
 /**

package/dist/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-oauth2-authorize.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport type { WorkspaceEventBus } from '@scalar/workspace-store/events'\nimport { type OAuthFlowsObjectSecret, getEnvironmentVariables } from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\n\nimport type { OAuth2Options } from '@/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue'\nimport { type OAuth2Tokens, authorizeOauth2 } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\n\n/**\n * Persists OAuth2 tokens split across the two schemes that care about them:\n *\n * - The **access token** lands on the consuming HTTP bearer scheme, so it is sent as\n *   `Authorization: Bearer <token>` without the bearer scheme losing focus.\n * - The **refresh token** stays on the oauth2 scheme, which is the only place that knows\n *   how to refresh (token URL, flow, client credentials).\n */\nexport const storeOAuth2Tokens = (\n  eventBus: WorkspaceEventBus,\n  params: {\n    bearerSchemeName: string\n    oauth2Name: string\n    flowType: keyof OAuthFlowsObjectSecret\n    tokens: OAuth2Tokens\n  },\n): void => {\n  const { bearerSchemeName, oauth2Name, flowType, tokens } = params\n\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', 'x-scalar-secret-token': tokens.accessToken },\n    name: bearerSchemeName,\n  })\n\n  if (tokens.refreshToken) {\n    eventBus.emit('auth:update:security-scheme-secrets', {\n      payload: {\n        type: 'oauth2',\n        [flowType]: { 'x-scalar-secret-refresh-token': tokens.refreshToken },\n      },\n      name: oauth2Name,\n    })\n  }\n}\n\n/**\n * Runs the OAuth2 authorization flow and stores the resulting tokens on the bearer scheme\n * (access token) and the oauth2 scheme (refresh token).\n *\n * Used by the bearer scheme's \"Authorize via OAuth2\" shortcut: it defaults the redirect URI\n * (`authorizeOauth2` reads it straight off the flow), kicks off the flow, then routes the\n * tokens through {@link storeOAuth2Tokens}.\n */\nexport const runOAuth2Authorize = async (params: {\n  eventBus: WorkspaceEventBus\n  bearerSchemeName: string\n  oauth2Name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: keyof OAuthFlowsObjectSecret\n  scopes: string[]\n  server: ServerObject | null\n  proxyUrl: string\n  environment: XScalarEnvironment\n  options?: OAuth2Options\n}): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const { eventBus, bearerSchemeName, oauth2Name, flows, flowType, scopes, server, proxyUrl, environment, options } =\n    params\n\n  const flow = flows[flowType]\n\n  // authorizeOauth2 reads the redirect URI directly off interactive flows, so default it\n  // when unset — a scheme merged in from Scalar config can then authorize without first\n  // opening the configuration form.\n  const preparedFlows =\n    flow && (flowType === 'authorizationCode' || flowType === 'implicit')\n      ? {\n          ...flows,\n          [flowType]: {\n            ...flow,\n            'x-scalar-secret-redirect-uri':\n              (flow as unknown as Record<string, string | undefined>)['x-scalar-secret-redirect-uri'] ||\n              resolveDefaultOAuth2RedirectUri(options ?? {}) ||\n              '',\n          },\n        }\n      : flows\n\n  const result = await authorizeOauth2(\n    preparedFlows,\n    flowType,\n    scopes,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n    options?.captureOAuth2Callback,\n  )\n  const tokens = result[1]\n\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, { bearerSchemeName, oauth2Name, flowType, tokens })\n  }\n\n  return result\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAa,qBACX,UACA,WAMS;CACT,MAAM,EAAE,kBAAkB,YAAY,UAAU,WAAW;CAE3D,SAAS,KAAK,uCAAuC;EACnD,SAAS;GAAE,MAAM;GAAQ,yBAAyB,OAAO;EAAY;EACrE,MAAM;CACR,CAAC;CAED,IAAI,OAAO,cACT,SAAS,KAAK,uCAAuC;EACnD,SAAS;GACP,MAAM;IACL,WAAW,EAAE,iCAAiC,OAAO,aAAa;EACrE;EACA,MAAM;CACR,CAAC;AAEL;;;;;;;;;AAUA,IAAa,qBAAqB,OAAO,WAWG;CAC1C,MAAM,EAAE,UAAU,kBAAkB,YAAY,OAAO,UAAU,QAAQ,QAAQ,UAAU,aAAa,YACtG;CAEF,MAAM,OAAO,MAAM;CAmBnB,MAAM,SAAS,MAAM,gBAbnB,SAAS,aAAa,uBAAuB,aAAa,cACtD;EACE,GAAG;GACF,WAAW;GACV,GAAG;GACH,gCACG,KAAuD,mCACxD,gCAAgC,WAAW,CAAC,CAAC,KAC7C;EACJ;CACF,IACA,OAIJ,UACA,QACA,QACA,UACA,wBAAwB,WAAW,GACnC,SAAS,aACT,SAAS,qBACX;CACA,MAAM,SAAS,OAAO;CAEtB,IAAI,QAAQ,aACV,kBAAkB,UAAU;EAAE;EAAkB;EAAY;EAAU;CAAO,CAAC;CAGhF,OAAO;AACT"}
+{"version":3,"file":"run-oauth2-authorize.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport type { WorkspaceEventBus } from '@scalar/workspace-store/events'\nimport { type OAuthFlowsObjectSecret, getEnvironmentVariables } from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { OAuth2Options } from '@/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue'\nimport { type OAuth2Tokens, authorizeOauth2 } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\n\n/**\n * Persists OAuth2 tokens split across the two schemes that care about them:\n *\n * - The **access token** lands on the consuming HTTP bearer scheme, so it is sent as\n *   `Authorization: Bearer <token>` without the bearer scheme losing focus.\n * - The **refresh token** stays on the oauth2 scheme, which is the only place that knows\n *   how to refresh (token URL, flow, client credentials).\n */\nexport const storeOAuth2Tokens = (\n  eventBus: WorkspaceEventBus,\n  params: {\n    bearerSchemeName: string\n    oauth2Name: string\n    flowType: keyof OAuthFlowsObjectSecret\n    tokens: OAuth2Tokens\n  },\n): void => {\n  const { bearerSchemeName, oauth2Name, flowType, tokens } = params\n\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', 'x-scalar-secret-token': tokens.accessToken },\n    name: bearerSchemeName,\n  })\n\n  if (tokens.refreshToken) {\n    eventBus.emit('auth:update:security-scheme-secrets', {\n      payload: {\n        type: 'oauth2',\n        [flowType]: { 'x-scalar-secret-refresh-token': tokens.refreshToken },\n      },\n      name: oauth2Name,\n    })\n  }\n}\n\n/**\n * Runs the OAuth2 authorization flow and stores the resulting tokens on the bearer scheme\n * (access token) and the oauth2 scheme (refresh token).\n *\n * Used by the bearer scheme's \"Authorize via OAuth2\" shortcut: it defaults the redirect URI\n * (`authorizeOauth2` reads it straight off the flow), kicks off the flow, then routes the\n * tokens through {@link storeOAuth2Tokens}.\n */\nexport const runOAuth2Authorize = async (params: {\n  eventBus: WorkspaceEventBus\n  bearerSchemeName: string\n  oauth2Name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: keyof OAuthFlowsObjectSecret\n  scopes: string[]\n  server: ServerObject | null\n  proxyUrl: string\n  environment: XScalarEnvironment\n  options?: OAuth2Options\n}): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const { eventBus, bearerSchemeName, oauth2Name, flows, flowType, scopes, server, proxyUrl, environment, options } =\n    params\n\n  const flow = flows[flowType]\n\n  // authorizeOauth2 reads the redirect URI directly off interactive flows, so default it\n  // when unset — a scheme merged in from Scalar config can then authorize without first\n  // opening the configuration form.\n  const preparedFlows =\n    flow && (flowType === 'authorizationCode' || flowType === 'implicit')\n      ? {\n          ...flows,\n          [flowType]: {\n            ...flow,\n            'x-scalar-secret-redirect-uri':\n              (flow as unknown as Record<string, string | undefined>)['x-scalar-secret-redirect-uri'] ||\n              resolveDefaultOAuth2RedirectUri(options ?? {}) ||\n              '',\n          },\n        }\n      : flows\n\n  const result = await authorizeOauth2(\n    preparedFlows,\n    flowType,\n    scopes,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n    options?.captureOAuth2Callback,\n  )\n  const tokens = result[1]\n\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, { bearerSchemeName, oauth2Name, flowType, tokens })\n  }\n\n  return result\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAa,qBACX,UACA,WAMS;CACT,MAAM,EAAE,kBAAkB,YAAY,UAAU,WAAW;CAE3D,SAAS,KAAK,uCAAuC;EACnD,SAAS;GAAE,MAAM;GAAQ,yBAAyB,OAAO;EAAY;EACrE,MAAM;CACR,CAAC;CAED,IAAI,OAAO,cACT,SAAS,KAAK,uCAAuC;EACnD,SAAS;GACP,MAAM;IACL,WAAW,EAAE,iCAAiC,OAAO,aAAa;EACrE;EACA,MAAM;CACR,CAAC;AAEL;;;;;;;;;AAUA,IAAa,qBAAqB,OAAO,WAWG;CAC1C,MAAM,EAAE,UAAU,kBAAkB,YAAY,OAAO,UAAU,QAAQ,QAAQ,UAAU,aAAa,YACtG;CAEF,MAAM,OAAO,MAAM;CAmBnB,MAAM,SAAS,MAAM,gBAbnB,SAAS,aAAa,uBAAuB,aAAa,cACtD;EACE,GAAG;GACF,WAAW;GACV,GAAG;GACH,gCACG,KAAuD,mCACxD,gCAAgC,WAAW,CAAC,CAAC,KAC7C;EACJ;CACF,IACA,OAIJ,UACA,QACA,QACA,UACA,wBAAwB,WAAW,GACnC,SAAS,aACT,SAAS,qBACX;CACA,MAAM,SAAS,OAAO;CAEtB,IAAI,QAAQ,aACV,kBAAkB,UAAU;EAAE;EAAkB;EAAY;EAAU;CAAO,CAAC;CAGhF,OAAO;AACT"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.d.ts

@@ -1,5 +1,5 @@
 import type { MergedSecuritySchemes, OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
-import type { ComponentsObject, OpenApiDocument, SecurityRequirementObject, SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { ComponentsObject, OpenApiDocument, SecurityRequirementObject, SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 /** A single security scheme option used in the auth dropdown */
 export type SecuritySchemeOption = {
     id: string;

package/dist/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-scheme.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAC5G,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,8DAA8D,CAAA;AAWrE,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,yBAAyB,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,oBAAoB,CAAA;CAC/B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,iBAAiB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,yBAAyB,CAAA;CAAE;;;;;CAK9F,CAAA;AAEF,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,QAAQ,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;;;CAIxF,CAAA;AAuCJ;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACrC,iBAAiB,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB,KACxF;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,sBAAsB,CAAA;IAC7B,QAAQ,EAAE,mBAAmB,GAAG,UAAU,CAAA;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,GAAG,IAgCH,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,EAClD,iBAAiB,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB;AACzF,iGAAiG;AACjG,iBAAiB,yBAAyB,EAAE;AAC5C,gEAAgE;AAChE,uBAAqB,KACpB,oBAAoB,EAAE,GAAG,mBAAmB,EAmF9C,CAAA"}
+{"version":3,"file":"security-scheme.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAC5G,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,8DAA8D,CAAA;AAWrE,gEAAgE;AAChE,MAAM,MAAM,oBAAoB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,yBAAyB,CAAA;IAChC,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,OAAO,CAAC,EAAE,oBAAoB,CAAA;CAC/B,CAAA;AAED,mEAAmE;AACnE,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,oBAAoB,EAAE,CAAA;CAChC,CAAA;AAKD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,GAAI,iBAAiB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,yBAAyB,CAAA;CAAE;;;;;CAK9F,CAAA;AAEF,uCAAuC;AACvC,eAAO,MAAM,mBAAmB,GAAI,QAAQ,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC;;;;;CAIxF,CAAA;AAuCJ;;;;;;;;GAQG;AACH,eAAO,MAAM,0BAA0B,GACrC,iBAAiB,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB,KACxF;IACD,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,sBAAsB,CAAA;IAC7B,QAAQ,EAAE,mBAAmB,GAAG,UAAU,CAAA;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB,GAAG,IAgCH,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,GACnC,UAAU,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,EAClD,iBAAiB,WAAW,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,GAAG,qBAAqB;AACzF,iGAAiG;AACjG,iBAAiB,yBAAyB,EAAE;AAC5C,gEAAgE;AAChE,uBAAqB,KACpB,oBAAoB,EAAE,GAAG,mBAAmB,EAuF9C,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-scheme.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.ts"],"sourcesContent":["import { generateHash } from '@scalar/helpers/string/generate-hash'\nimport { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref'\nimport { isHidden } from '@scalar/workspace-store/helpers/is-hidden'\nimport type { MergedSecuritySchemes, OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport type {\n  ComponentsObject,\n  OpenApiDocument,\n  SecurityRequirementObject,\n  SecuritySchemeObject,\n} from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document'\n\nimport { authOptions } from '@/v2/blocks/scalar-auth-selector-block/helpers/auth-options'\n\n/**\n * Minimal shape read by `isHidden`. Some scheme union members (AsyncAPI broker schemes) do not\n * structurally carry the ignore extensions, so we cast to this before the check to satisfy the\n * weak-type check without widening `isHidden` itself.\n */\ntype Hideable = { 'x-internal'?: boolean; 'x-scalar-ignore'?: boolean }\n\n/** A single security scheme option used in the auth dropdown */\nexport type SecuritySchemeOption = {\n  id: string\n  label: string\n  value: SecurityRequirementObject\n  isDeletable?: boolean\n  payload?: SecuritySchemeObject\n}\n\n/** A group of security scheme options used in the auth dropdown */\nexport type SecuritySchemeGroup = {\n  label: string\n  options: SecuritySchemeOption[]\n}\n\nconst requirementSignature = (requirement: SecurityRequirementObject): string =>\n  JSON.stringify(Object.keys(requirement))\n\n/**\n * Format a scheme object into a display object\n *\n * We also add a hash to the id to ensure it is unique across\n * multiple requirements of the same scheme with different scopes\n */\nexport const formatScheme = ({ name, value }: { name: string; value: SecurityRequirementObject }) => ({\n  id: generateHash(JSON.stringify(value)),\n  label: name,\n  value,\n  isDeletable: true,\n})\n\n/** Formats complex security schemes */\nexport const formatComplexScheme = (scheme: NonNullable<OpenApiDocument['security']>[number]) =>\n  formatScheme({\n    name: Object.keys(scheme).join(' & '),\n    value: scheme,\n  })\n\n/**\n * Formats a security requirement into a SecuritySchemeOption.\n * Handles both simple (single key) and complex (multiple keys) auth schemes.\n */\nconst formatSecurityRequirement = (\n  requirement: SecurityRequirementObject,\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n): SecuritySchemeOption | undefined => {\n  const keys = Object.keys(requirement)\n\n  // Complex auth (multiple keys)\n  if (keys.length > 1) {\n    // Drop the whole AND combination if any of its schemes is hidden via x-scalar-ignore — a\n    // partly hidden requirement cannot be configured, so it should not appear as an option.\n    const anyHidden = keys.some((key) => {\n      const scheme = getResolvedRef(securitySchemes[key])\n      return scheme ? isHidden(scheme as Hideable) : false\n    })\n    if (anyHidden) {\n      return undefined\n    }\n    return formatComplexScheme(requirement)\n  }\n\n  // Simple auth (single key)\n  if (keys[0]) {\n    const scheme = getResolvedRef(securitySchemes[keys[0]])\n    // Drop schemes that do not exist or are hidden from the auth UI via x-scalar-ignore.\n    if (!scheme || isHidden(scheme as Hideable)) {\n      return undefined\n    }\n    return formatScheme({ name: keys[0], value: requirement })\n  }\n\n  return undefined\n}\n\n/**\n * Finds the oauth2 scheme best suited to power a bearer scheme's \"Authorize via OAuth2\" shortcut:\n * the first scheme with an interactive grant (authorization code / implicit), the kind that sends\n * a user to an IdP login. Prefers the authorization-code grant (which can refresh) over one\n * offering only implicit, so the more capable flow wins even when it is declared later.\n *\n * This only surfaces a convenience shortcut on the bearer form — it never hides the oauth2 scheme,\n * which stays independently selectable in the auth dropdown.\n */\nexport const getOauth2AcquisitionTarget = (\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n): {\n  name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: 'authorizationCode' | 'implicit'\n  scopes: string[]\n} | null => {\n  let implicitFallback: {\n    name: string\n    flows: OAuthFlowsObjectSecret\n    flowType: 'implicit'\n    scopes: string[]\n  } | null = null\n\n  for (const [name, schemeRef] of Object.entries(securitySchemes)) {\n    const scheme = getResolvedRef(schemeRef)\n    // Skip schemes hidden from the auth UI via x-scalar-ignore, so the shortcut never\n    // targets a flow the user cannot see or configure.\n    if (scheme?.type !== 'oauth2' || isHidden(scheme)) {\n      continue\n    }\n    const flows = scheme.flows as OAuthFlowsObjectSecret | undefined\n    if (!flows) {\n      continue\n    }\n    const scopes = (scheme as { 'x-default-scopes'?: string[] })['x-default-scopes'] ?? []\n\n    // Authorization code can refresh, so it wins outright the moment we find one.\n    if (flows.authorizationCode && !isHidden(flows.authorizationCode)) {\n      return { name, flows, flowType: 'authorizationCode', scopes }\n    }\n    // Otherwise remember the first implicit-only scheme in case no auth-code flow turns up.\n    if (flows.implicit && !isHidden(flows.implicit) && !implicitFallback) {\n      implicitFallback = { name, flows, flowType: 'implicit', scopes }\n    }\n  }\n\n  return implicitFallback\n}\n\n/**\n * Generates the options for the security scheme combobox\n *\n * Contains either a flat list, or different groups of required, available, and add new\n */\nexport const getSecuritySchemeOptions = (\n  security: NonNullable<OpenApiDocument['security']>,\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n  /** We need to add the selected schemes if they do not already exist in the calculated options */\n  selectedSchemes: SecurityRequirementObject[],\n  /** Allows adding authentication which is not in the document */\n  canAddNewAuth = false,\n): SecuritySchemeOption[] | SecuritySchemeGroup[] => {\n  const selectedByRequirement = new Map(\n    selectedSchemes.map((selectedScheme) => [requirementSignature(selectedScheme), selectedScheme]),\n  )\n\n  /**\n   * Build required schemes formatted as options and track scheme names in a single pass.\n   * We use names (not full IDs) because we want to exclude any scheme that is already\n   * required, regardless of its specific scopes or hash.\n   */\n  const { requiredFormatted, requiredSchemeNames, existingIds } = security.reduce(\n    (acc, requirement) => {\n      // If a required requirement is selected with scopes, use that selected value to\n      // keep a single option entry and avoid a phantom duplicate.\n      const requirementValue = selectedByRequirement.get(requirementSignature(requirement)) ?? requirement\n      const formatted = formatSecurityRequirement(requirementValue, securitySchemes)\n      if (formatted) {\n        acc.requiredFormatted.push(formatted)\n        acc.existingIds.add(formatted.id)\n      }\n      for (const name of Object.keys(requirement)) {\n        acc.requiredSchemeNames.add(name)\n      }\n      return acc\n    },\n    {\n      requiredFormatted: [] as SecuritySchemeOption[],\n      requiredSchemeNames: new Set<string>(),\n      existingIds: new Set<string>(),\n    },\n  )\n\n  // Build available schemes (excluding schemes that are in the required list)\n  const availableFormatted: SecuritySchemeOption[] = []\n  for (const [name, schemeRef] of Object.entries(securitySchemes)) {\n    if (requiredSchemeNames.has(name)) {\n      continue\n    }\n\n    const scheme = getResolvedRef(schemeRef)\n    // Skip schemes hidden from the auth UI via x-scalar-ignore.\n    if (scheme && !isHidden(scheme as Hideable)) {\n      const formatted = formatScheme({ name, value: { [name]: [] } })\n      availableFormatted.push(formatted)\n      existingIds.add(formatted.id)\n    }\n  }\n\n  /**\n   * Add selected schemes to available if they do not already exist\n   * This ensures that selected schemes with specific scopes are always available as options\n   */\n  for (const selectedScheme of selectedSchemes) {\n    const formatted = formatSecurityRequirement(selectedScheme, securitySchemes)\n    if (formatted && !existingIds.has(formatted.id)) {\n      availableFormatted.push(formatted)\n      existingIds.add(formatted.id)\n    }\n  }\n\n  const options = [\n    { label: 'Required authentication', options: requiredFormatted },\n    { label: 'Available authentication', options: availableFormatted },\n  ]\n\n  // We don't return the groups if we don't have any required schemes\n  if (!canAddNewAuth) {\n    return requiredFormatted.length ? options : availableFormatted\n  }\n\n  // Add new authentication options (unless explicitly hidden)\n  options.push({\n    label: 'Add new authentication',\n    options: Object.entries(authOptions).map(([key, value]) => ({\n      id: key,\n      label: value.label,\n      value: { [key]: [] },\n      payload: value.payload,\n      isDeletable: false,\n    })),\n  })\n\n  return options\n}\n"],"mappings":";;;;;AAmCA,IAAM,wBAAwB,gBAC5B,KAAK,UAAU,OAAO,KAAK,WAAW,CAAC;;;;;;;AAQzC,IAAa,gBAAgB,EAAE,MAAM,aAAiE;CACpG,IAAI,aAAa,KAAK,UAAU,KAAK,CAAC;CACtC,OAAO;CACP;CACA,aAAa;AACf;;AAGA,IAAa,uBAAuB,WAClC,aAAa;CACX,MAAM,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK;CACpC,OAAO;AACT,CAAC;;;;;AAMH,IAAM,6BACJ,aACA,oBACqC;CACrC,MAAM,OAAO,OAAO,KAAK,WAAW;CAGpC,IAAI,KAAK,SAAS,GAAG;EAOnB,IAJkB,KAAK,MAAM,QAAQ;GACnC,MAAM,SAAS,eAAe,gBAAgB,IAAI;GAClD,OAAO,SAAS,SAAS,MAAkB,IAAI;EACjD,CACI,GACF;EAEF,OAAO,oBAAoB,WAAW;CACxC;CAGA,IAAI,KAAK,IAAI;EACX,MAAM,SAAS,eAAe,gBAAgB,KAAK,GAAG;EAEtD,IAAI,CAAC,UAAU,SAAS,MAAkB,GACxC;EAEF,OAAO,aAAa;GAAE,MAAM,KAAK;GAAI,OAAO;EAAY,CAAC;CAC3D;AAGF;;;;;;;;;;AAWA,IAAa,8BACX,oBAMU;CACV,IAAI,mBAKO;CAEX,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,eAAe,GAAG;EAC/D,MAAM,SAAS,eAAe,SAAS;EAGvC,IAAI,QAAQ,SAAS,YAAY,SAAS,MAAM,GAC9C;EAEF,MAAM,QAAQ,OAAO;EACrB,IAAI,CAAC,OACH;EAEF,MAAM,SAAU,OAA6C,uBAAuB,CAAC;EAGrF,IAAI,MAAM,qBAAqB,CAAC,SAAS,MAAM,iBAAiB,GAC9D,OAAO;GAAE;GAAM;GAAO,UAAU;GAAqB;EAAO;EAG9D,IAAI,MAAM,YAAY,CAAC,SAAS,MAAM,QAAQ,KAAK,CAAC,kBAClD,mBAAmB;GAAE;GAAM;GAAO,UAAU;GAAY;EAAO;CAEnE;CAEA,OAAO;AACT;;;;;;AAOA,IAAa,4BACX,UACA,iBAEA,iBAEA,gBAAgB,UACmC;CACnD,MAAM,wBAAwB,IAAI,IAChC,gBAAgB,KAAK,mBAAmB,CAAC,qBAAqB,cAAc,GAAG,cAAc,CAAC,CAChG;;;;;;CAOA,MAAM,EAAE,mBAAmB,qBAAqB,gBAAgB,SAAS,QACtE,KAAK,gBAAgB;EAIpB,MAAM,YAAY,0BADO,sBAAsB,IAAI,qBAAqB,WAAW,CAAC,KAAK,aAC3B,eAAe;EAC7E,IAAI,WAAW;GACb,IAAI,kBAAkB,KAAK,SAAS;GACpC,IAAI,YAAY,IAAI,UAAU,EAAE;EAClC;EACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GACxC,IAAI,oBAAoB,IAAI,IAAI;EAElC,OAAO;CACT,GACA;EACE,mBAAmB,CAAC;EACpB,qCAAqB,IAAI,IAAY;EACrC,6BAAa,IAAI,IAAY;CAC/B,CACF;CAGA,MAAM,qBAA6C,CAAC;CACpD,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,eAAe,GAAG;EAC/D,IAAI,oBAAoB,IAAI,IAAI,GAC9B;EAGF,MAAM,SAAS,eAAe,SAAS;EAEvC,IAAI,UAAU,CAAC,SAAS,MAAkB,GAAG;GAC3C,MAAM,YAAY,aAAa;IAAE;IAAM,OAAO,GAAG,OAAO,CAAC,EAAE;GAAE,CAAC;GAC9D,mBAAmB,KAAK,SAAS;GACjC,YAAY,IAAI,UAAU,EAAE;EAC9B;CACF;;;;;CAMA,KAAK,MAAM,kBAAkB,iBAAiB;EAC5C,MAAM,YAAY,0BAA0B,gBAAgB,eAAe;EAC3E,IAAI,aAAa,CAAC,YAAY,IAAI,UAAU,EAAE,GAAG;GAC/C,mBAAmB,KAAK,SAAS;GACjC,YAAY,IAAI,UAAU,EAAE;EAC9B;CACF;CAEA,MAAM,UAAU,CACd;EAAE,OAAO;EAA2B,SAAS;CAAkB,GAC/D;EAAE,OAAO;EAA4B,SAAS;CAAmB,CACnE;CAGA,IAAI,CAAC,eACH,OAAO,kBAAkB,SAAS,UAAU;CAI9C,QAAQ,KAAK;EACX,OAAO;EACP,SAAS,OAAO,QAAQ,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY;GAC1D,IAAI;GACJ,OAAO,MAAM;GACb,OAAO,GAAG,MAAM,CAAC,EAAE;GACnB,SAAS,MAAM;GACf,aAAa;EACf,EAAE;CACJ,CAAC;CAED,OAAO;AACT"}
+{"version":3,"file":"security-scheme.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/security-scheme.ts"],"sourcesContent":["import { generateHash } from '@scalar/helpers/string/generate-hash'\nimport { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref'\nimport { isHidden } from '@scalar/workspace-store/helpers/is-hidden'\nimport type { MergedSecuritySchemes, OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport type {\n  ComponentsObject,\n  OpenApiDocument,\n  SecurityRequirementObject,\n  SecuritySchemeObject,\n} from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport { authOptions } from '@/v2/blocks/scalar-auth-selector-block/helpers/auth-options'\n\n/**\n * Minimal shape read by `isHidden`. Some scheme union members (AsyncAPI broker schemes) do not\n * structurally carry the ignore extensions, so we cast to this before the check to satisfy the\n * weak-type check without widening `isHidden` itself.\n */\ntype Hideable = { 'x-internal'?: boolean; 'x-scalar-ignore'?: boolean }\n\n/** A single security scheme option used in the auth dropdown */\nexport type SecuritySchemeOption = {\n  id: string\n  label: string\n  value: SecurityRequirementObject\n  isDeletable?: boolean\n  payload?: SecuritySchemeObject\n}\n\n/** A group of security scheme options used in the auth dropdown */\nexport type SecuritySchemeGroup = {\n  label: string\n  options: SecuritySchemeOption[]\n}\n\nconst requirementSignature = (requirement: SecurityRequirementObject): string =>\n  JSON.stringify(Object.keys(requirement))\n\n/**\n * Format a scheme object into a display object\n *\n * We also add a hash to the id to ensure it is unique across\n * multiple requirements of the same scheme with different scopes\n */\nexport const formatScheme = ({ name, value }: { name: string; value: SecurityRequirementObject }) => ({\n  id: generateHash(JSON.stringify(value)),\n  label: name,\n  value,\n  isDeletable: true,\n})\n\n/** Formats complex security schemes */\nexport const formatComplexScheme = (scheme: NonNullable<OpenApiDocument['security']>[number]) =>\n  formatScheme({\n    name: Object.keys(scheme).join(' & '),\n    value: scheme,\n  })\n\n/**\n * Formats a security requirement into a SecuritySchemeOption.\n * Handles both simple (single key) and complex (multiple keys) auth schemes.\n */\nconst formatSecurityRequirement = (\n  requirement: SecurityRequirementObject,\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n): SecuritySchemeOption | undefined => {\n  const keys = Object.keys(requirement)\n\n  // Complex auth (multiple keys)\n  if (keys.length > 1) {\n    // Drop the whole AND combination if any of its schemes is hidden via x-scalar-ignore — a\n    // partly hidden requirement cannot be configured, so it should not appear as an option.\n    const anyHidden = keys.some((key) => {\n      const scheme = getResolvedRef(securitySchemes[key])\n      return scheme ? isHidden(scheme as Hideable) : false\n    })\n    if (anyHidden) {\n      return undefined\n    }\n    return formatComplexScheme(requirement)\n  }\n\n  // Simple auth (single key)\n  if (keys[0]) {\n    const scheme = getResolvedRef(securitySchemes[keys[0]])\n    // Drop schemes that do not exist or are hidden from the auth UI via x-scalar-ignore.\n    if (!scheme || isHidden(scheme as Hideable)) {\n      return undefined\n    }\n    return formatScheme({ name: keys[0], value: requirement })\n  }\n\n  return undefined\n}\n\n/**\n * Finds the oauth2 scheme best suited to power a bearer scheme's \"Authorize via OAuth2\" shortcut:\n * the first scheme with an interactive grant (authorization code / implicit), the kind that sends\n * a user to an IdP login. Prefers the authorization-code grant (which can refresh) over one\n * offering only implicit, so the more capable flow wins even when it is declared later.\n *\n * This only surfaces a convenience shortcut on the bearer form — it never hides the oauth2 scheme,\n * which stays independently selectable in the auth dropdown.\n */\nexport const getOauth2AcquisitionTarget = (\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n): {\n  name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: 'authorizationCode' | 'implicit'\n  scopes: string[]\n} | null => {\n  let implicitFallback: {\n    name: string\n    flows: OAuthFlowsObjectSecret\n    flowType: 'implicit'\n    scopes: string[]\n  } | null = null\n\n  for (const [name, schemeRef] of Object.entries(securitySchemes)) {\n    const scheme = getResolvedRef(schemeRef)\n    // Skip schemes hidden from the auth UI via x-scalar-ignore, so the shortcut never\n    // targets a flow the user cannot see or configure.\n    if (scheme?.type !== 'oauth2' || isHidden(scheme)) {\n      continue\n    }\n    const flows = scheme.flows as OAuthFlowsObjectSecret | undefined\n    if (!flows) {\n      continue\n    }\n    const scopes = (scheme as { 'x-default-scopes'?: string[] })['x-default-scopes'] ?? []\n\n    // Authorization code can refresh, so it wins outright the moment we find one.\n    if (flows.authorizationCode && !isHidden(flows.authorizationCode)) {\n      return { name, flows, flowType: 'authorizationCode', scopes }\n    }\n    // Otherwise remember the first implicit-only scheme in case no auth-code flow turns up.\n    if (flows.implicit && !isHidden(flows.implicit) && !implicitFallback) {\n      implicitFallback = { name, flows, flowType: 'implicit', scopes }\n    }\n  }\n\n  return implicitFallback\n}\n\n/**\n * Generates the options for the security scheme combobox\n *\n * Contains either a flat list, or different groups of required, available, and add new\n */\nexport const getSecuritySchemeOptions = (\n  security: NonNullable<OpenApiDocument['security']>,\n  securitySchemes: NonNullable<ComponentsObject['securitySchemes']> | MergedSecuritySchemes,\n  /** We need to add the selected schemes if they do not already exist in the calculated options */\n  selectedSchemes: SecurityRequirementObject[],\n  /** Allows adding authentication which is not in the document */\n  canAddNewAuth = false,\n): SecuritySchemeOption[] | SecuritySchemeGroup[] => {\n  const selectedByRequirement = new Map(\n    selectedSchemes.map((selectedScheme) => [requirementSignature(selectedScheme), selectedScheme]),\n  )\n\n  /**\n   * Build required schemes formatted as options and track scheme names in a single pass.\n   * We use names (not full IDs) because we want to exclude any scheme that is already\n   * required, regardless of its specific scopes or hash.\n   */\n  const { requiredFormatted, requiredSchemeNames, existingIds } = security.reduce<{\n    requiredFormatted: SecuritySchemeOption[]\n    requiredSchemeNames: Set<string>\n    existingIds: Set<string>\n  }>(\n    (acc, requirement) => {\n      // If a required requirement is selected with scopes, use that selected value to\n      // keep a single option entry and avoid a phantom duplicate.\n      const requirementValue = selectedByRequirement.get(requirementSignature(requirement)) ?? requirement\n      const formatted = formatSecurityRequirement(requirementValue, securitySchemes)\n      if (formatted) {\n        acc.requiredFormatted.push(formatted)\n        acc.existingIds.add(formatted.id)\n      }\n      for (const name of Object.keys(requirement)) {\n        acc.requiredSchemeNames.add(name)\n      }\n      return acc\n    },\n    {\n      requiredFormatted: [],\n      requiredSchemeNames: new Set<string>(),\n      existingIds: new Set<string>(),\n    },\n  )\n\n  // Build available schemes (excluding schemes that are in the required list)\n  const availableFormatted: SecuritySchemeOption[] = []\n  for (const [name, schemeRef] of Object.entries(securitySchemes)) {\n    if (requiredSchemeNames.has(name)) {\n      continue\n    }\n\n    const scheme = getResolvedRef(schemeRef)\n    // Skip schemes hidden from the auth UI via x-scalar-ignore.\n    if (scheme && !isHidden(scheme as Hideable)) {\n      const formatted = formatScheme({ name, value: { [name]: [] } })\n      availableFormatted.push(formatted)\n      existingIds.add(formatted.id)\n    }\n  }\n\n  /**\n   * Add selected schemes to available if they do not already exist\n   * This ensures that selected schemes with specific scopes are always available as options\n   */\n  for (const selectedScheme of selectedSchemes) {\n    const formatted = formatSecurityRequirement(selectedScheme, securitySchemes)\n    if (formatted && !existingIds.has(formatted.id)) {\n      availableFormatted.push(formatted)\n      existingIds.add(formatted.id)\n    }\n  }\n\n  const options = [\n    { label: 'Required authentication', options: requiredFormatted },\n    { label: 'Available authentication', options: availableFormatted },\n  ]\n\n  // We don't return the groups if we don't have any required schemes\n  if (!canAddNewAuth) {\n    return requiredFormatted.length ? options : availableFormatted\n  }\n\n  // Add new authentication options (unless explicitly hidden)\n  options.push({\n    label: 'Add new authentication',\n    options: Object.entries(authOptions).map(([key, value]) => ({\n      id: key,\n      label: value.label,\n      value: { [key]: [] },\n      payload: value.payload,\n      isDeletable: false,\n    })),\n  })\n\n  return options\n}\n"],"mappings":";;;;;AAmCA,IAAM,wBAAwB,gBAC5B,KAAK,UAAU,OAAO,KAAK,WAAW,CAAC;;;;;;;AAQzC,IAAa,gBAAgB,EAAE,MAAM,aAAiE;CACpG,IAAI,aAAa,KAAK,UAAU,KAAK,CAAC;CACtC,OAAO;CACP;CACA,aAAa;AACf;;AAGA,IAAa,uBAAuB,WAClC,aAAa;CACX,MAAM,OAAO,KAAK,MAAM,CAAC,CAAC,KAAK,KAAK;CACpC,OAAO;AACT,CAAC;;;;;AAMH,IAAM,6BACJ,aACA,oBACqC;CACrC,MAAM,OAAO,OAAO,KAAK,WAAW;CAGpC,IAAI,KAAK,SAAS,GAAG;EAOnB,IAJkB,KAAK,MAAM,QAAQ;GACnC,MAAM,SAAS,eAAe,gBAAgB,IAAI;GAClD,OAAO,SAAS,SAAS,MAAkB,IAAI;EACjD,CACI,GACF;EAEF,OAAO,oBAAoB,WAAW;CACxC;CAGA,IAAI,KAAK,IAAI;EACX,MAAM,SAAS,eAAe,gBAAgB,KAAK,GAAG;EAEtD,IAAI,CAAC,UAAU,SAAS,MAAkB,GACxC;EAEF,OAAO,aAAa;GAAE,MAAM,KAAK;GAAI,OAAO;EAAY,CAAC;CAC3D;AAGF;;;;;;;;;;AAWA,IAAa,8BACX,oBAMU;CACV,IAAI,mBAKO;CAEX,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,eAAe,GAAG;EAC/D,MAAM,SAAS,eAAe,SAAS;EAGvC,IAAI,QAAQ,SAAS,YAAY,SAAS,MAAM,GAC9C;EAEF,MAAM,QAAQ,OAAO;EACrB,IAAI,CAAC,OACH;EAEF,MAAM,SAAU,OAA6C,uBAAuB,CAAC;EAGrF,IAAI,MAAM,qBAAqB,CAAC,SAAS,MAAM,iBAAiB,GAC9D,OAAO;GAAE;GAAM;GAAO,UAAU;GAAqB;EAAO;EAG9D,IAAI,MAAM,YAAY,CAAC,SAAS,MAAM,QAAQ,KAAK,CAAC,kBAClD,mBAAmB;GAAE;GAAM;GAAO,UAAU;GAAY;EAAO;CAEnE;CAEA,OAAO;AACT;;;;;;AAOA,IAAa,4BACX,UACA,iBAEA,iBAEA,gBAAgB,UACmC;CACnD,MAAM,wBAAwB,IAAI,IAChC,gBAAgB,KAAK,mBAAmB,CAAC,qBAAqB,cAAc,GAAG,cAAc,CAAC,CAChG;;;;;;CAOA,MAAM,EAAE,mBAAmB,qBAAqB,gBAAgB,SAAS,QAKtE,KAAK,gBAAgB;EAIpB,MAAM,YAAY,0BADO,sBAAsB,IAAI,qBAAqB,WAAW,CAAC,KAAK,aAC3B,eAAe;EAC7E,IAAI,WAAW;GACb,IAAI,kBAAkB,KAAK,SAAS;GACpC,IAAI,YAAY,IAAI,UAAU,EAAE;EAClC;EACA,KAAK,MAAM,QAAQ,OAAO,KAAK,WAAW,GACxC,IAAI,oBAAoB,IAAI,IAAI;EAElC,OAAO;CACT,GACA;EACE,mBAAmB,CAAC;EACpB,qCAAqB,IAAI,IAAY;EACrC,6BAAa,IAAI,IAAY;CAC/B,CACF;CAGA,MAAM,qBAA6C,CAAC;CACpD,KAAK,MAAM,CAAC,MAAM,cAAc,OAAO,QAAQ,eAAe,GAAG;EAC/D,IAAI,oBAAoB,IAAI,IAAI,GAC9B;EAGF,MAAM,SAAS,eAAe,SAAS;EAEvC,IAAI,UAAU,CAAC,SAAS,MAAkB,GAAG;GAC3C,MAAM,YAAY,aAAa;IAAE;IAAM,OAAO,GAAG,OAAO,CAAC,EAAE;GAAE,CAAC;GAC9D,mBAAmB,KAAK,SAAS;GACjC,YAAY,IAAI,UAAU,EAAE;EAC9B;CACF;;;;;CAMA,KAAK,MAAM,kBAAkB,iBAAiB;EAC5C,MAAM,YAAY,0BAA0B,gBAAgB,eAAe;EAC3E,IAAI,aAAa,CAAC,YAAY,IAAI,UAAU,EAAE,GAAG;GAC/C,mBAAmB,KAAK,SAAS;GACjC,YAAY,IAAI,UAAU,EAAE;EAC9B;CACF;CAEA,MAAM,UAAU,CACd;EAAE,OAAO;EAA2B,SAAS;CAAkB,GAC/D;EAAE,OAAO;EAA4B,SAAS;CAAmB,CACnE;CAGA,IAAI,CAAC,eACH,OAAO,kBAAkB,SAAS,UAAU;CAI9C,QAAQ,KAAK;EACX,OAAO;EACP,SAAS,OAAO,QAAQ,WAAW,CAAC,CAAC,KAAK,CAAC,KAAK,YAAY;GAC1D,IAAI;GACJ,OAAO,MAAM;GACb,OAAO,GAAG,MAAM,CAAC,EAAE;GACnB,SAAS,MAAM;GACf,aAAa;EACf,EAAE;CACJ,CAAC;CAED,OAAO;AACT"}

package/dist/v2/components/code-input/CodeInput.vue.d.ts

@@ -1,4 +1,4 @@
-import { type CodeMirrorLanguage, type Extension } from '@scalar/use-codemirror';
+import { EditorView, type CodeMirrorLanguage, type Extension } from '@scalar/use-codemirror';
 import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments';
 import { type Ref } from 'vue';
 import type { ClientLayout } from '../../../v2/types/layout';
@@ -98,7 +98,7 @@ declare const __VLS_export: __VLS_WithSlots<import("vue").DefineComponent<{
     handleSubmit: (value: string, event: KeyboardEvent | FocusEvent) => void;
     handleBlur: (value: string, event: FocusEvent) => void;
     booleanOptions: import("vue").ComputedRef<string[]>;
-    codeMirror: Ref<import("@codemirror/view").EditorView | null, import("@codemirror/view").EditorView | null>;
+    codeMirror: Ref<EditorView | null, EditorView | null>;
     codeMirrorRef: Ref<HTMLDivElement | null, HTMLDivElement | null>;
     modelValue: CodeInputModelValue;
     setCodeMirrorContent: (content?: string) => void;

package/dist/v2/components/code-input/CodeInput.vue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"CodeInput.vue.d.ts","sourceRoot":"","sources":["../../../../src/v2/components/code-input/CodeInput.vue"],"names":[],"mappings":"AAwsBA,OAAO,EAIL,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAA;AAM/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AAEnH,OAAO,EAAyC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,OAAO,GACP,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;wBACkB,OAAO,YAAY;AAAxC,wBAAyC;AAKzC,QAAA,MAAM,YAAY;gBAEJ,mBAAmB;IAC/B,6FAA6F;iBAChF,kBAAkB,GAAG,SAAS;IAC3C,mEAAmE;WAC5D,MAAM,GAAG,MAAM,EAAE;IACxB,sCAAsC;eAC3B,OAAO;IAClB,yBAAyB;YACjB,OAAO;IACf,kDAAkD;aACzC,YAAY;IACrB,mDAAmD;WAC5C,MAAM,EAAE;IACf,2CAA2C;eAChC,MAAM,EAAE;IACnB,2CAA2C;;IAE3C,2CAA2C;eAChC,OAAO;IAClB,uCAAuC;kBACzB,MAAM;IACpB,8BAA8B;eACnB,OAAO;IAClB,oCAAoC;kBACtB,OAAO;IACrB,kCAAkC;kBACpB,OAAO;IACrB,qBAAqB;WACd,OAAO;IACd,2BAA2B;mBACZ,OAAO;IACtB,+BAA+B;eACpB,kBAAkB;IAC7B,uCAAuC;iBAC1B,SAAS,EAAE;IACxB,sCAAsC;uBACnB,OAAO;IAC1B,wBAAwB;mBACT,OAAO;IACtB,wCAAwC;2BACjB,OAAO;IAC9B,gCAAgC;iBACnB,OAAO;IACpB,wCAAwC;oBACxB,OAAO;IACvB,yHAAyH;mBAC1G,OAAO;IACtB,sDAAsD;uBACnC,OAAO;IAC1B,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,0CAA0C;kBAC5B,OAAO;;IAwRrB;;;;OAIG;uBACgB,OAAO,GAAG,KAAK,GAAG,MAAM;;0BAtMhB,MAAM,KAAG,IAAI;0BAiBjC,MAAM,SACN,aAAa,GAAG,UAAU,KAChC,IAAI;wBAWoB,MAAM,SAAS,UAAU,KAAG,IAAI;;;;;;;4BAiE5B,mBAAmB,KAAG,MAAM;;;;;;cAhJ7B,UAAU;cAAQ,aAAa;;;gBA5F/C,mBAAmB;IAC/B,6FAA6F;iBAChF,kBAAkB,GAAG,SAAS;IAC3C,mEAAmE;WAC5D,MAAM,GAAG,MAAM,EAAE;IACxB,sCAAsC;eAC3B,OAAO;IAClB,yBAAyB;YACjB,OAAO;IACf,kDAAkD;aACzC,YAAY;IACrB,mDAAmD;WAC5C,MAAM,EAAE;IACf,2CAA2C;eAChC,MAAM,EAAE;IACnB,2CAA2C;;IAE3C,2CAA2C;eAChC,OAAO;IAClB,uCAAuC;kBACzB,MAAM;IACpB,8BAA8B;eACnB,OAAO;IAClB,oCAAoC;kBACtB,OAAO;IACrB,kCAAkC;kBACpB,OAAO;IACrB,qBAAqB;WACd,OAAO;IACd,2BAA2B;mBACZ,OAAO;IACtB,+BAA+B;eACpB,kBAAkB;IAC7B,uCAAuC;iBAC1B,SAAS,EAAE;IACxB,sCAAsC;uBACnB,OAAO;IAC1B,wBAAwB;mBACT,OAAO;IACtB,wCAAwC;2BACjB,OAAO;IAC9B,gCAAgC;iBACnB,OAAO;IACpB,wCAAwC;oBACxB,OAAO;IACvB,yHAAyH;mBAC1G,OAAO;IACtB,sDAAsD;uBACnC,OAAO;IAC1B,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,0CAA0C;kBAC5B,OAAO;;;;;;cAsCO,UAAU;cAAQ,aAAa;;;cAyoB/C,CAAC,KAAK,IAAiB,KAAK,GAAG;;WAClC,CAAC,KAAK,IAAiB,KAAK,GAAG;EAYtC,CAAC;AACL,KAAK,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG;IAChC,QAAO;QACN,MAAM,EAAE,CAAC,CAAC;KACV,CAAA;CACD,CAAC"}
+{"version":3,"file":"CodeInput.vue.d.ts","sourceRoot":"","sources":["../../../../src/v2/components/code-input/CodeInput.vue"],"names":[],"mappings":"AAwvBA,OAAO,EAEL,UAAU,EAGV,KAAK,kBAAkB,EACvB,KAAK,SAAS,EACf,MAAM,wBAAwB,CAAA;AAM/B,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2EAA2E,CAAA;AAEnH,OAAO,EAAyC,KAAK,GAAG,EAAE,MAAM,KAAK,CAAA;AAIrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAKrD,MAAM,MAAM,mBAAmB,GAC3B,MAAM,GACN,MAAM,GACN,OAAO,GACP,KAAK,CAAC,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAChC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAE3B;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;wBACkB,OAAO,YAAY;AAAxC,wBAAyC;AAKzC,QAAA,MAAM,YAAY;gBAEJ,mBAAmB;IAC/B,6FAA6F;iBAChF,kBAAkB,GAAG,SAAS;IAC3C,mEAAmE;WAC5D,MAAM,GAAG,MAAM,EAAE;IACxB,sCAAsC;eAC3B,OAAO;IAClB,yBAAyB;YACjB,OAAO;IACf,kDAAkD;aACzC,YAAY;IACrB,mDAAmD;WAC5C,MAAM,EAAE;IACf,2CAA2C;eAChC,MAAM,EAAE;IACnB,2CAA2C;;IAE3C,2CAA2C;eAChC,OAAO;IAClB,uCAAuC;kBACzB,MAAM;IACpB,8BAA8B;eACnB,OAAO;IAClB,oCAAoC;kBACtB,OAAO;IACrB,kCAAkC;kBACpB,OAAO;IACrB,qBAAqB;WACd,OAAO;IACd,2BAA2B;mBACZ,OAAO;IACtB,+BAA+B;eACpB,kBAAkB;IAC7B,uCAAuC;iBAC1B,SAAS,EAAE;IACxB,sCAAsC;uBACnB,OAAO;IAC1B,wBAAwB;mBACT,OAAO;IACtB,wCAAwC;2BACjB,OAAO;IAC9B,gCAAgC;iBACnB,OAAO;IACpB,wCAAwC;oBACxB,OAAO;IACvB,yHAAyH;mBAC1G,OAAO;IACtB,sDAAsD;uBACnC,OAAO;IAC1B,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,0CAA0C;kBAC5B,OAAO;;IA2SrB;;;;OAIG;uBACgB,OAAO,GAAG,KAAK,GAAG,MAAM;;0BAxNhB,MAAM,KAAG,IAAI;0BAiBjC,MAAM,SACN,aAAa,GAAG,UAAU,KAChC,IAAI;wBAWoB,MAAM,SAAS,UAAU,KAAG,IAAI;;;;;;;4BAmF5B,mBAAmB,KAAG,MAAM;;;;;;cAnK7B,UAAU;cAAQ,aAAa;;;gBA5F/C,mBAAmB;IAC/B,6FAA6F;iBAChF,kBAAkB,GAAG,SAAS;IAC3C,mEAAmE;WAC5D,MAAM,GAAG,MAAM,EAAE;IACxB,sCAAsC;eAC3B,OAAO;IAClB,yBAAyB;YACjB,OAAO;IACf,kDAAkD;aACzC,YAAY;IACrB,mDAAmD;WAC5C,MAAM,EAAE;IACf,2CAA2C;eAChC,MAAM,EAAE;IACnB,2CAA2C;;IAE3C,2CAA2C;eAChC,OAAO;IAClB,uCAAuC;kBACzB,MAAM;IACpB,8BAA8B;eACnB,OAAO;IAClB,oCAAoC;kBACtB,OAAO;IACrB,kCAAkC;kBACpB,OAAO;IACrB,qBAAqB;WACd,OAAO;IACd,2BAA2B;mBACZ,OAAO;IACtB,+BAA+B;eACpB,kBAAkB;IAC7B,uCAAuC;iBAC1B,SAAS,EAAE;IACxB,sCAAsC;uBACnB,OAAO;IAC1B,wBAAwB;mBACT,OAAO;IACtB,wCAAwC;2BACjB,OAAO;IAC9B,gCAAgC;iBACnB,OAAO;IACpB,wCAAwC;oBACxB,OAAO;IACvB,yHAAyH;mBAC1G,OAAO;IACtB,sDAAsD;uBACnC,OAAO;IAC1B,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,mDAAmD;wBAC/B,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI;IAC3C,0CAA0C;kBAC5B,OAAO;;;;;;cAsCO,UAAU;cAAQ,aAAa;;;cA4tB/C,CAAC,KAAK,IAAiB,KAAK,GAAG;;WAClC,CAAC,KAAK,IAAiB,KAAK,GAAG;EAYtC,CAAC;AACL,KAAK,eAAe,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG;IAChC,QAAO;QACN,MAAM,EAAE,CAAC,CAAC;KACV,CAAA;CACD,CAAC"}

package/dist/v2/components/code-input/CodeInput.vue.js

@@ -3,7 +3,7 @@ import CodeInput_vue_vue_type_script_setup_true_lang_default from "./CodeInput.v
 /* empty css                        */
 /* empty css                          */
 //#region src/v2/components/code-input/CodeInput.vue
-var CodeInput_default = /*#__PURE__*/ _plugin_vue_export_helper_default(CodeInput_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-dfc591f4"]]);
+var CodeInput_default = /*#__PURE__*/ _plugin_vue_export_helper_default(CodeInput_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-dbc85839"]]);
 //#endregion
 export { CodeInput_default as default };