@scalar/api-client 3.19.2 → 3.20.0

package/dist/v2/blocks/scalar-auth-selector-block/helpers/auth-options.d.ts

@@ -1,9 +1,110 @@
-import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
-type AuthOption = {
-    label: string;
-    payload: SecuritySchemeObject;
-};
 /** Predefined authentication options */
-export declare const authOptions: Record<string, AuthOption>;
-export {};
+export declare const authOptions: {
+    apiKeyCookie: {
+        label: string;
+        payload: {
+            type: "apiKey";
+            in: "cookie";
+            name: string;
+        };
+    };
+    apiKeyHeader: {
+        label: string;
+        payload: {
+            type: "apiKey";
+            in: "header";
+            name: string;
+        };
+    };
+    apiKeyQuery: {
+        label: string;
+        payload: {
+            type: "apiKey";
+            in: "query";
+            name: string;
+        };
+    };
+    httpBasic: {
+        label: string;
+        payload: {
+            type: "http";
+            scheme: "basic";
+        };
+    };
+    httpBearer: {
+        label: string;
+        payload: {
+            type: "http";
+            scheme: "bearer";
+        };
+    };
+    oauth2DeviceAuthorization: {
+        label: string;
+        payload: {
+            type: "oauth2";
+            flows: {
+                deviceAuthorization: {
+                    deviceAuthorizationUrl: string;
+                    tokenUrl: string;
+                    refreshUrl: string;
+                    scopes: {};
+                };
+            };
+        };
+    };
+    oauth2Implicit: {
+        label: string;
+        payload: {
+            type: "oauth2";
+            flows: {
+                implicit: {
+                    authorizationUrl: string;
+                    refreshUrl: string;
+                    scopes: {};
+                };
+            };
+        };
+    };
+    oauth2Password: {
+        label: string;
+        payload: {
+            type: "oauth2";
+            flows: {
+                password: {
+                    tokenUrl: string;
+                    refreshUrl: string;
+                    scopes: {};
+                };
+            };
+        };
+    };
+    oauth2ClientCredentials: {
+        label: string;
+        payload: {
+            type: "oauth2";
+            flows: {
+                clientCredentials: {
+                    tokenUrl: string;
+                    refreshUrl: string;
+                    scopes: {};
+                };
+            };
+        };
+    };
+    oauth2AuthorizationFlow: {
+        label: string;
+        payload: {
+            type: "oauth2";
+            flows: {
+                authorizationCode: {
+                    authorizationUrl: string;
+                    tokenUrl: string;
+                    refreshUrl: string;
+                    'x-usePkce': "no";
+                    scopes: {};
+                };
+            };
+        };
+    };
+};
 //# sourceMappingURL=auth-options.d.ts.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/auth-options.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/auth-options.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,KAAK,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAElE,wCAAwC;AACxC,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA6FlD,CAAA"}
+{"version":3,"file":"auth-options.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/auth-options.ts"],"names":[],"mappings":"AAIA,wCAAwC;AACxC,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoGc,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/auth-options.js

@@ -39,6 +39,18 @@ var authOptions = {
 			scheme: "bearer"
 		}
 	},
+	oauth2DeviceAuthorization: {
+		label: "OAuth2 Device Authorization",
+		payload: {
+			type: "oauth2",
+			flows: { deviceAuthorization: {
+				deviceAuthorizationUrl: "",
+				tokenUrl: "",
+				refreshUrl: "",
+				scopes: {}
+			} }
+		}
+	},
 	oauth2Implicit: {
 		label: "Oauth2 Implicit Flow",
 		payload: {

package/dist/v2/blocks/scalar-auth-selector-block/helpers/auth-options.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-options.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/auth-options.ts"],"sourcesContent":["import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\ntype AuthOption = { label: string; payload: SecuritySchemeObject }\n\n/** Predefined authentication options */\nexport const authOptions: Record<string, AuthOption> = {\n  apiKeyCookie: {\n    label: 'API Key in Cookies',\n    payload: {\n      type: 'apiKey',\n      in: 'cookie',\n      name: 'apiKeyCookie',\n    },\n  },\n  apiKeyHeader: {\n    label: 'API Key in Headers',\n    payload: {\n      type: 'apiKey',\n      in: 'header',\n      name: 'apiKeyHeader',\n    },\n  },\n  apiKeyQuery: {\n    label: 'API Key in Query Params',\n    payload: {\n      type: 'apiKey',\n      in: 'query',\n      name: 'apiKeyQuery',\n    },\n  },\n  httpBasic: {\n    label: 'HTTP Basic',\n    payload: {\n      type: 'http',\n      scheme: 'basic',\n    },\n  },\n  httpBearer: {\n    label: 'HTTP Bearer',\n    payload: {\n      type: 'http',\n      scheme: 'bearer',\n    },\n  },\n  oauth2Implicit: {\n    label: 'Oauth2 Implicit Flow',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        implicit: {\n          authorizationUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2Password: {\n    label: 'Oauth2 Password Flow',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        password: {\n          tokenUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2ClientCredentials: {\n    label: 'Oauth2 Client Credentials',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        clientCredentials: {\n          tokenUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2AuthorizationFlow: {\n    label: 'Oauth2 Authorization Code',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        authorizationCode: {\n          authorizationUrl: '',\n          tokenUrl: '',\n          refreshUrl: '',\n          'x-usePkce': 'no',\n          scopes: {},\n        },\n      },\n    },\n  },\n}\n"],"mappings":";;AAKA,IAAa,cAA0C;CACrD,cAAc;EACZ,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,cAAc;EACZ,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,aAAa;EACX,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,WAAW;EACT,OAAO;EACP,SAAS;GACP,MAAM;GACN,QAAQ;EACV;CACF;CACA,YAAY;EACV,OAAO;EACP,SAAS;GACP,MAAM;GACN,QAAQ;EACV;CACF;CACA,gBAAgB;EACd,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,UAAU;IACR,kBAAkB;IAClB,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,gBAAgB;EACd,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,UAAU;IACR,UAAU;IACV,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,yBAAyB;EACvB,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,mBAAmB;IACjB,UAAU;IACV,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,yBAAyB;EACvB,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,mBAAmB;IACjB,kBAAkB;IAClB,UAAU;IACV,YAAY;IACZ,aAAa;IACb,QAAQ,CAAC;GACX,EACF;EACF;CACF;AACF"}
+{"version":3,"file":"auth-options.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/auth-options.ts"],"sourcesContent":["import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\ntype AuthOption = { label: string; payload: SecuritySchemeObject }\n\n/** Predefined authentication options */\nexport const authOptions = {\n  apiKeyCookie: {\n    label: 'API Key in Cookies',\n    payload: {\n      type: 'apiKey',\n      in: 'cookie',\n      name: 'apiKeyCookie',\n    },\n  },\n  apiKeyHeader: {\n    label: 'API Key in Headers',\n    payload: {\n      type: 'apiKey',\n      in: 'header',\n      name: 'apiKeyHeader',\n    },\n  },\n  apiKeyQuery: {\n    label: 'API Key in Query Params',\n    payload: {\n      type: 'apiKey',\n      in: 'query',\n      name: 'apiKeyQuery',\n    },\n  },\n  httpBasic: {\n    label: 'HTTP Basic',\n    payload: {\n      type: 'http',\n      scheme: 'basic',\n    },\n  },\n  httpBearer: {\n    label: 'HTTP Bearer',\n    payload: {\n      type: 'http',\n      scheme: 'bearer',\n    },\n  },\n  oauth2DeviceAuthorization: {\n    label: 'OAuth2 Device Authorization',\n    payload: {\n      type: 'oauth2',\n      flows: { deviceAuthorization: { deviceAuthorizationUrl: '', tokenUrl: '', refreshUrl: '', scopes: {} } },\n    },\n  },\n  oauth2Implicit: {\n    label: 'Oauth2 Implicit Flow',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        implicit: {\n          authorizationUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2Password: {\n    label: 'Oauth2 Password Flow',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        password: {\n          tokenUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2ClientCredentials: {\n    label: 'Oauth2 Client Credentials',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        clientCredentials: {\n          tokenUrl: '',\n          refreshUrl: '',\n          scopes: {},\n        },\n      },\n    },\n  },\n  oauth2AuthorizationFlow: {\n    label: 'Oauth2 Authorization Code',\n    payload: {\n      type: 'oauth2',\n      flows: {\n        authorizationCode: {\n          authorizationUrl: '',\n          tokenUrl: '',\n          refreshUrl: '',\n          'x-usePkce': 'no',\n          scopes: {},\n        },\n      },\n    },\n  },\n} satisfies Record<string, AuthOption>\n"],"mappings":";;AAKA,IAAa,cAAc;CACzB,cAAc;EACZ,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,cAAc;EACZ,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,aAAa;EACX,OAAO;EACP,SAAS;GACP,MAAM;GACN,IAAI;GACJ,MAAM;EACR;CACF;CACA,WAAW;EACT,OAAO;EACP,SAAS;GACP,MAAM;GACN,QAAQ;EACV;CACF;CACA,YAAY;EACV,OAAO;EACP,SAAS;GACP,MAAM;GACN,QAAQ;EACV;CACF;CACA,2BAA2B;EACzB,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EAAE,qBAAqB;IAAE,wBAAwB;IAAI,UAAU;IAAI,YAAY;IAAI,QAAQ,CAAC;GAAE,EAAE;EACzG;CACF;CACA,gBAAgB;EACd,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,UAAU;IACR,kBAAkB;IAClB,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,gBAAgB;EACd,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,UAAU;IACR,UAAU;IACV,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,yBAAyB;EACvB,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,mBAAmB;IACjB,UAAU;IACV,YAAY;IACZ,QAAQ,CAAC;GACX,EACF;EACF;CACF;CACA,yBAAyB;EACvB,OAAO;EACP,SAAS;GACP,MAAM;GACN,OAAO,EACL,mBAAmB;IACjB,kBAAkB;IAClB,UAAU;IACV,YAAY;IACZ,aAAa;IACb,QAAQ,CAAC;GACX,EACF;EACF;CACF;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/extract-security-scheme-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAClF,OAAO,KAAK,EASV,0BAA0B,EAC3B,MAAM,yCAAyC,CAAA;AAQhD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAkLjF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,EAC1D,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,KACnB,0BA2DF,CAAA"}
+{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAClF,OAAO,KAAK,EAUV,0BAA0B,EAC3B,MAAM,yCAAyC,CAAA;AAShD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAqMjF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,EAC1D,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,KACnB,0BA4DF,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-oauth2-metadata.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAGnF,OAAO,EACL,KAAK,sBAAsB,IAAI,2BAA2B,EAE3D,MAAM,kCAAkC,CAAA;AAKzC,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,EACX,UAAU,MAAM,EAChB,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAuBpD,CAAA"}
+{"version":3,"file":"fetch-oauth2-metadata.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAI3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAGnF,OAAO,EACL,KAAK,sBAAsB,IAAI,2BAA2B,EAE3D,MAAM,kCAAkC,CAAA;AAGzC,4FAA4F;AAC5F,eAAO,MAAM,mBAAmB,GAC9B,KAAK,MAAM,EACX,UAAU,MAAM,EAChB,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,2BAA2B,CAAC,CAuBpD,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.js

@@ -1,19 +1,22 @@
+import { isAllowedOAuthUrl } from "./is-allowed-oauth-url.js";
 import { OpenIDConnectDiscoverySchema } from "./fetch-openid-connect-discovery.js";
 import { redirectToProxy } from "@scalar/helpers/url/redirect-to-proxy";
-import { isLocalUrl } from "@scalar/helpers/url/is-local-url";
 import { coerceValue } from "@scalar/workspace-store/schemas/typebox-coerce";
 //#region src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts
-var isAllowedMetadataUrl = (url) => url.protocol === "https:" || url.protocol === "http:" && isLocalUrl(url.href);
 /** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */
 var fetchOAuth2Metadata = async (url, proxyUrl, customFetch = fetch) => {
 	try {
 		const metadataUrl = new URL(url.trim());
-		if (!isAllowedMetadataUrl(metadataUrl)) return [/* @__PURE__ */ new Error("OAuth2 metadata URL must use HTTPS or HTTP for local development URLs"), null];
+		if (!isAllowedOAuthUrl(metadataUrl)) return [/* @__PURE__ */ new Error("OAuth2 metadata URL must use HTTPS or HTTP for local development URLs"), null];
 		const response = await customFetch(redirectToProxy(proxyUrl, metadataUrl.href));
 		if (!response.ok) return [/* @__PURE__ */ new Error(`Failed to fetch OAuth2 metadata: ${response.status} ${response.statusText}`), null];
 		const data = coerceValue(OpenIDConnectDiscoverySchema, await response.json());
-		if (!data.authorization_endpoint && !data.token_endpoint) return [/* @__PURE__ */ new Error("Invalid OAuth2 metadata: missing or invalid endpoints"), null];
-		for (const endpoint of [data.authorization_endpoint, data.token_endpoint]) if (endpoint && !isAllowedMetadataUrl(new URL(endpoint))) return [/* @__PURE__ */ new Error("OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs"), null];
+		if (!data.authorization_endpoint && !data.token_endpoint && !data.device_authorization_endpoint) return [/* @__PURE__ */ new Error("Invalid OAuth2 metadata: missing or invalid endpoints"), null];
+		for (const endpoint of [
+			data.authorization_endpoint,
+			data.token_endpoint,
+			data.device_authorization_endpoint
+		]) if (endpoint && !isAllowedOAuthUrl(new URL(endpoint))) return [/* @__PURE__ */ new Error("OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs"), null];
 		return [null, data];
 	} catch (error) {
 		return [error instanceof Error ? error : /* @__PURE__ */ new Error("Failed to fetch OAuth2 metadata"), null];

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-oauth2-metadata.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { isLocalUrl } from '@scalar/helpers/url/is-local-url'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n// RFC 8414 and OIDC share these consumed fields; this alias does not imply OIDC issuer semantics.\nimport {\n  type OpenIDConnectDiscovery as AuthorizationServerMetadata,\n  OpenIDConnectDiscoverySchema as AuthorizationServerMetadataSchema,\n} from './fetch-openid-connect-discovery'\n\nconst isAllowedMetadataUrl = (url: URL): boolean =>\n  url.protocol === 'https:' || (url.protocol === 'http:' && isLocalUrl(url.href))\n\n/** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */\nexport const fetchOAuth2Metadata = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<AuthorizationServerMetadata>> => {\n  try {\n    const metadataUrl = new URL(url.trim())\n    if (!isAllowedMetadataUrl(metadataUrl)) {\n      return [new Error('OAuth2 metadata URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n    const response = await customFetch(redirectToProxy(proxyUrl, metadataUrl.href))\n    if (!response.ok) {\n      return [new Error(`Failed to fetch OAuth2 metadata: ${response.status} ${response.statusText}`), null]\n    }\n    const data = coerceValue(AuthorizationServerMetadataSchema, await response.json())\n    if (!data.authorization_endpoint && !data.token_endpoint) {\n      return [new Error('Invalid OAuth2 metadata: missing or invalid endpoints'), null]\n    }\n    for (const endpoint of [data.authorization_endpoint, data.token_endpoint]) {\n      if (endpoint && !isAllowedMetadataUrl(new URL(endpoint))) {\n        return [new Error('OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs'), null]\n      }\n    }\n    return [null, data]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to fetch OAuth2 metadata'), null]\n  }\n}\n"],"mappings":";;;;;AAaA,IAAM,wBAAwB,QAC5B,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,WAAW,IAAI,IAAI;;AAG/E,IAAa,sBAAsB,OACjC,KACA,UACA,cAA2B,UAC6B;CACxD,IAAI;EACF,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC;EACtC,IAAI,CAAC,qBAAqB,WAAW,GACnC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAElG,MAAM,WAAW,MAAM,YAAY,gBAAgB,UAAU,YAAY,IAAI,CAAC;EAC9E,IAAI,CAAC,SAAS,IACZ,OAAO,iBAAC,IAAI,MAAM,oCAAoC,SAAS,OAAO,GAAG,SAAS,YAAY,GAAG,IAAI;EAEvG,MAAM,OAAO,YAAY,8BAAmC,MAAM,SAAS,KAAK,CAAC;EACjF,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBACxC,OAAO,iBAAC,IAAI,MAAM,uDAAuD,GAAG,IAAI;EAElF,KAAK,MAAM,YAAY,CAAC,KAAK,wBAAwB,KAAK,cAAc,GACtE,IAAI,YAAY,CAAC,qBAAqB,IAAI,IAAI,QAAQ,CAAC,GACrD,OAAO,iBAAC,IAAI,MAAM,6EAA6E,GAAG,IAAI;EAG1G,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,iCAAiC,GAAG,IAAI;CAC7F;AACF"}
+{"version":3,"file":"fetch-oauth2-metadata.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n// RFC 8414 and OIDC share these consumed fields; this alias does not imply OIDC issuer semantics.\nimport {\n  type OpenIDConnectDiscovery as AuthorizationServerMetadata,\n  OpenIDConnectDiscoverySchema as AuthorizationServerMetadataSchema,\n} from './fetch-openid-connect-discovery'\nimport { isAllowedOAuthUrl } from './is-allowed-oauth-url'\n\n/** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */\nexport const fetchOAuth2Metadata = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<AuthorizationServerMetadata>> => {\n  try {\n    const metadataUrl = new URL(url.trim())\n    if (!isAllowedOAuthUrl(metadataUrl)) {\n      return [new Error('OAuth2 metadata URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n    const response = await customFetch(redirectToProxy(proxyUrl, metadataUrl.href))\n    if (!response.ok) {\n      return [new Error(`Failed to fetch OAuth2 metadata: ${response.status} ${response.statusText}`), null]\n    }\n    const data = coerceValue(AuthorizationServerMetadataSchema, await response.json())\n    if (!data.authorization_endpoint && !data.token_endpoint && !data.device_authorization_endpoint) {\n      return [new Error('Invalid OAuth2 metadata: missing or invalid endpoints'), null]\n    }\n    for (const endpoint of [data.authorization_endpoint, data.token_endpoint, data.device_authorization_endpoint]) {\n      if (endpoint && !isAllowedOAuthUrl(new URL(endpoint))) {\n        return [new Error('OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs'), null]\n      }\n    }\n    return [null, data]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to fetch OAuth2 metadata'), null]\n  }\n}\n"],"mappings":";;;;;;AAcA,IAAa,sBAAsB,OACjC,KACA,UACA,cAA2B,UAC6B;CACxD,IAAI;EACF,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC;EACtC,IAAI,CAAC,kBAAkB,WAAW,GAChC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAElG,MAAM,WAAW,MAAM,YAAY,gBAAgB,UAAU,YAAY,IAAI,CAAC;EAC9E,IAAI,CAAC,SAAS,IACZ,OAAO,iBAAC,IAAI,MAAM,oCAAoC,SAAS,OAAO,GAAG,SAAS,YAAY,GAAG,IAAI;EAEvG,MAAM,OAAO,YAAY,8BAAmC,MAAM,SAAS,KAAK,CAAC;EACjF,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,kBAAkB,CAAC,KAAK,+BAChE,OAAO,iBAAC,IAAI,MAAM,uDAAuD,GAAG,IAAI;EAElF,KAAK,MAAM,YAAY;GAAC,KAAK;GAAwB,KAAK;GAAgB,KAAK;EAA6B,GAC1G,IAAI,YAAY,CAAC,kBAAkB,IAAI,IAAI,QAAQ,CAAC,GAClD,OAAO,iBAAC,IAAI,MAAM,6EAA6E,GAAG,IAAI;EAG1G,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,iCAAiC,GAAG,IAAI;CAC7F;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.d.ts

@@ -10,6 +10,8 @@ import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/
 export declare const OpenIDConnectDiscoverySchema: import("@scalar/typebox").TObject<{
     /** URL of the OAuth 2.0 Authorization Endpoint */
     authorization_endpoint: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
+    /** RFC8628 device authorization endpoint. */
+    device_authorization_endpoint: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** URL of the OAuth 2.0 Token Endpoint */
     token_endpoint: import("@scalar/typebox").TOptional<import("@scalar/typebox").TString>;
     /** List of OAuth 2.0 scope values that this server supports */

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-openid-connect-discovery.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAE3E,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,iBAAiB,CAAA;AAGnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;IACvC,kDAAkD;;IAElD,0CAA0C;;IAE1C,+DAA+D;;IAE/D,oEAAoE;;IAEpE,uDAAuD;;EAEvD,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEhF;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAW,CAAA;AAEpC;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GACtC,KAAK,MAAM,EACX,UAAU,MAAM,EAChB,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CA2C/C,CAAA"}
+{"version":3,"file":"fetch-openid-connect-discovery.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAE3E,OAAO,EAAE,KAAK,MAAM,EAAQ,MAAM,iBAAiB,CAAA;AAGnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAEnF;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;IACvC,kDAAkD;;IAElD,6CAA6C;;IAE7C,0CAA0C;;IAE1C,+DAA+D;;IAE/D,oEAAoE;;IAEpE,uDAAuD;;EAEvD,CAAA;AAEF,MAAM,MAAM,sBAAsB,GAAG,MAAM,CAAC,OAAO,4BAA4B,CAAC,CAAA;AAEhF;;;GAGG;AACH,eAAO,MAAM,YAAY,WAAW,CAAA;AAEpC;;;;;;;;GAQG;AACH,eAAO,MAAM,2BAA2B,GACtC,KAAK,MAAM,EACX,UAAU,MAAM,EAChB,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,sBAAsB,CAAC,CA2C/C,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.js

@@ -11,6 +11,8 @@ import { Type } from "@scalar/typebox";
 var OpenIDConnectDiscoverySchema = Type.Object({
 	/** URL of the OAuth 2.0 Authorization Endpoint */
 	authorization_endpoint: Type.Optional(Type.String()),
+	/** RFC8628 device authorization endpoint. */
+	device_authorization_endpoint: Type.Optional(Type.String()),
 	/** URL of the OAuth 2.0 Token Endpoint */
 	token_endpoint: Type.Optional(Type.String()),
 	/** List of OAuth 2.0 scope values that this server supports */

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-openid-connect-discovery.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { type Static, Type } from '@scalar/typebox'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n/**\n * OpenID Connect Discovery Document (subset)\n * Represents the metadata fields consumed by the auth selector flow conversion.\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html\n */\nexport const OpenIDConnectDiscoverySchema = Type.Object({\n  /** URL of the OAuth 2.0 Authorization Endpoint */\n  authorization_endpoint: Type.Optional(Type.String()),\n  /** URL of the OAuth 2.0 Token Endpoint */\n  token_endpoint: Type.Optional(Type.String()),\n  /** List of OAuth 2.0 scope values that this server supports */\n  scopes_supported: Type.Optional(Type.Array(Type.String())),\n  /** List of OAuth 2.0 grant type values that this server supports */\n  grant_types_supported: Type.Optional(Type.Array(Type.String())),\n  /** Supported PKCE code challenge methods (RFC 7636) */\n  code_challenge_methods_supported: Type.Optional(Type.Array(Type.String())),\n})\n\nexport type OpenIDConnectDiscovery = Static<typeof OpenIDConnectDiscoverySchema>\n\n/**\n * The required scope for OpenID Connect requests.\n * If this scope is present, the request is an OIDC request; otherwise, it is a standard OAuth 2.0 request.\n */\nexport const OPENID_SCOPE = 'openid'\n\n/**\n * Fetches the OpenID Connect discovery document from the specified URL.\n * Supports both full discovery URLs and issuer URLs.\n *\n * @param url - The OpenID Connect discovery URL or issuer URL\n * @param proxyUrl - Optional CORS proxy to route the request through\n * @param customFetch - Fetch used for the discovery request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack.\n * @returns The discovery document or an error\n */\nexport const fetchOpenIDConnectDiscovery = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OpenIDConnectDiscovery>> => {\n  try {\n    // If the URL does not end with the well-known path, append it\n    let discoveryUrl = url.trim()\n\n    if (!discoveryUrl) {\n      return [new Error('URL cannot be empty'), null]\n    }\n\n    // Remove trailing slash if present\n    if (discoveryUrl.endsWith('/')) {\n      discoveryUrl = discoveryUrl.slice(0, -1)\n    }\n\n    // If the URL does not already include the well-known path, append it\n    if (!discoveryUrl.includes('/.well-known/openid-configuration')) {\n      discoveryUrl = `${discoveryUrl}/.well-known/openid-configuration`\n    }\n\n    const proxiedUrl = redirectToProxy(proxyUrl, discoveryUrl)\n    const response = await customFetch(proxiedUrl)\n\n    if (!response.ok) {\n      return [\n        new Error(`Failed to fetch OpenID Connect discovery document: ${response.status} ${response.statusText}`),\n        null,\n      ]\n    }\n\n    const data = coerceValue(OpenIDConnectDiscoverySchema, await response.json())\n\n    // Validate that we have the essential fields\n    if (!data.authorization_endpoint && !data.token_endpoint) {\n      return [new Error('Invalid OpenID Connect discovery document: missing required endpoints'), null]\n    }\n\n    return [null, data]\n  } catch (error) {\n    if (error instanceof Error) {\n      return [error, null]\n    }\n    return [new Error('Failed to fetch OpenID Connect discovery document'), null]\n  }\n}\n"],"mappings":";;;;;;;;;;AAaA,IAAa,+BAA+B,KAAK,OAAO;;CAEtD,wBAAwB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAEnD,gBAAgB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAE3C,kBAAkB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAEzD,uBAAuB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAE9D,kCAAkC,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;;;;;;;;;;AAmBD,IAAa,8BAA8B,OACzC,KACA,UACA,cAA2B,UACwB;CACnD,IAAI;EAEF,IAAI,eAAe,IAAI,KAAK;EAE5B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,qBAAqB,GAAG,IAAI;EAIhD,IAAI,aAAa,SAAS,GAAG,GAC3B,eAAe,aAAa,MAAM,GAAG,EAAE;EAIzC,IAAI,CAAC,aAAa,SAAS,mCAAmC,GAC5D,eAAe,GAAG,aAAa;EAIjC,MAAM,WAAW,MAAM,YADJ,gBAAgB,UAAU,YACV,CAAU;EAE7C,IAAI,CAAC,SAAS,IACZ,OAAO,iBACL,IAAI,MAAM,sDAAsD,SAAS,OAAO,GAAG,SAAS,YAAY,GACxG,IACF;EAGF,MAAM,OAAO,YAAY,8BAA8B,MAAM,SAAS,KAAK,CAAC;EAG5E,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBACxC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAGlG,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,OAAO,CAAC,OAAO,IAAI;EAErB,OAAO,iBAAC,IAAI,MAAM,mDAAmD,GAAG,IAAI;CAC9E;AACF"}
+{"version":3,"file":"fetch-openid-connect-discovery.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { type Static, Type } from '@scalar/typebox'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n/**\n * OpenID Connect Discovery Document (subset)\n * Represents the metadata fields consumed by the auth selector flow conversion.\n *\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html\n */\nexport const OpenIDConnectDiscoverySchema = Type.Object({\n  /** URL of the OAuth 2.0 Authorization Endpoint */\n  authorization_endpoint: Type.Optional(Type.String()),\n  /** RFC8628 device authorization endpoint. */\n  device_authorization_endpoint: Type.Optional(Type.String()),\n  /** URL of the OAuth 2.0 Token Endpoint */\n  token_endpoint: Type.Optional(Type.String()),\n  /** List of OAuth 2.0 scope values that this server supports */\n  scopes_supported: Type.Optional(Type.Array(Type.String())),\n  /** List of OAuth 2.0 grant type values that this server supports */\n  grant_types_supported: Type.Optional(Type.Array(Type.String())),\n  /** Supported PKCE code challenge methods (RFC 7636) */\n  code_challenge_methods_supported: Type.Optional(Type.Array(Type.String())),\n})\n\nexport type OpenIDConnectDiscovery = Static<typeof OpenIDConnectDiscoverySchema>\n\n/**\n * The required scope for OpenID Connect requests.\n * If this scope is present, the request is an OIDC request; otherwise, it is a standard OAuth 2.0 request.\n */\nexport const OPENID_SCOPE = 'openid'\n\n/**\n * Fetches the OpenID Connect discovery document from the specified URL.\n * Supports both full discovery URLs and issuer URLs.\n *\n * @param url - The OpenID Connect discovery URL or issuer URL\n * @param proxyUrl - Optional CORS proxy to route the request through\n * @param customFetch - Fetch used for the discovery request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack.\n * @returns The discovery document or an error\n */\nexport const fetchOpenIDConnectDiscovery = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OpenIDConnectDiscovery>> => {\n  try {\n    // If the URL does not end with the well-known path, append it\n    let discoveryUrl = url.trim()\n\n    if (!discoveryUrl) {\n      return [new Error('URL cannot be empty'), null]\n    }\n\n    // Remove trailing slash if present\n    if (discoveryUrl.endsWith('/')) {\n      discoveryUrl = discoveryUrl.slice(0, -1)\n    }\n\n    // If the URL does not already include the well-known path, append it\n    if (!discoveryUrl.includes('/.well-known/openid-configuration')) {\n      discoveryUrl = `${discoveryUrl}/.well-known/openid-configuration`\n    }\n\n    const proxiedUrl = redirectToProxy(proxyUrl, discoveryUrl)\n    const response = await customFetch(proxiedUrl)\n\n    if (!response.ok) {\n      return [\n        new Error(`Failed to fetch OpenID Connect discovery document: ${response.status} ${response.statusText}`),\n        null,\n      ]\n    }\n\n    const data = coerceValue(OpenIDConnectDiscoverySchema, await response.json())\n\n    // Validate that we have the essential fields\n    if (!data.authorization_endpoint && !data.token_endpoint) {\n      return [new Error('Invalid OpenID Connect discovery document: missing required endpoints'), null]\n    }\n\n    return [null, data]\n  } catch (error) {\n    if (error instanceof Error) {\n      return [error, null]\n    }\n    return [new Error('Failed to fetch OpenID Connect discovery document'), null]\n  }\n}\n"],"mappings":";;;;;;;;;;AAaA,IAAa,+BAA+B,KAAK,OAAO;;CAEtD,wBAAwB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAEnD,+BAA+B,KAAK,SAAS,KAAK,OAAO,CAAC;;CAE1D,gBAAgB,KAAK,SAAS,KAAK,OAAO,CAAC;;CAE3C,kBAAkB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAEzD,uBAAuB,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;;CAE9D,kCAAkC,KAAK,SAAS,KAAK,MAAM,KAAK,OAAO,CAAC,CAAC;AAC3E,CAAC;;;;;;;;;;AAmBD,IAAa,8BAA8B,OACzC,KACA,UACA,cAA2B,UACwB;CACnD,IAAI;EAEF,IAAI,eAAe,IAAI,KAAK;EAE5B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,qBAAqB,GAAG,IAAI;EAIhD,IAAI,aAAa,SAAS,GAAG,GAC3B,eAAe,aAAa,MAAM,GAAG,EAAE;EAIzC,IAAI,CAAC,aAAa,SAAS,mCAAmC,GAC5D,eAAe,GAAG,aAAa;EAIjC,MAAM,WAAW,MAAM,YADJ,gBAAgB,UAAU,YACV,CAAU;EAE7C,IAAI,CAAC,SAAS,IACZ,OAAO,iBACL,IAAI,MAAM,sDAAsD,SAAS,OAAO,GAAG,SAAS,YAAY,GACxG,IACF;EAGF,MAAM,OAAO,YAAY,8BAA8B,MAAM,SAAS,KAAK,CAAC;EAG5E,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,gBACxC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAGlG,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,IAAI,iBAAiB,OACnB,OAAO,CAAC,OAAO,IAAI;EAErB,OAAO,iBAAC,IAAI,MAAM,mDAAmD,GAAG,IAAI;CAC9E;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.d.ts

@@ -0,0 +1,3 @@
+/** Allows HTTPS, with HTTP reserved for local development hosts and reserved test domains. */
+export declare const isAllowedOAuthUrl: (url: URL) => boolean;
+//# sourceMappingURL=is-allowed-oauth-url.d.ts.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-allowed-oauth-url.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.ts"],"names":[],"mappings":"AAEA,8FAA8F;AAC9F,eAAO,MAAM,iBAAiB,GAAI,KAAK,GAAG,KAAG,OACoC,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.js

@@ -0,0 +1,8 @@
+import { isLocalUrl } from "@scalar/helpers/url/is-local-url";
+//#region src/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.ts
+/** Allows HTTPS, with HTTP reserved for local development hosts and reserved test domains. */
+var isAllowedOAuthUrl = (url) => url.protocol === "https:" || url.protocol === "http:" && isLocalUrl(url.href);
+//#endregion
+export { isAllowedOAuthUrl };
+
+//# sourceMappingURL=is-allowed-oauth-url.js.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-allowed-oauth-url.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/is-allowed-oauth-url.ts"],"sourcesContent":["import { isLocalUrl } from '@scalar/helpers/url/is-local-url'\n\n/** Allows HTTPS, with HTTP reserved for local development hosts and reserved test domains. */\nexport const isAllowedOAuthUrl = (url: URL): boolean =>\n  url.protocol === 'https:' || (url.protocol === 'http:' && isLocalUrl(url.href))\n"],"mappings":";;;AAGA,IAAa,qBAAqB,QAChC,IAAI,aAAa,YAAa,IAAI,aAAa,WAAW,WAAW,IAAI,IAAI"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.d.ts

@@ -0,0 +1,3 @@
+/** Encode OAuth client passwords using form encoding before Basic authentication (RFC6749 section 2.3.1). */
+export declare const oauthClientAuthorization: (clientId: string, clientSecret: string) => string;
+//# sourceMappingURL=oauth-client-authorization.d.ts.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.ts"],"names":[],"mappings":"AAEA,6GAA6G;AAC7G,eAAO,MAAM,wBAAwB,GAAI,UAAU,MAAM,EAAE,cAAc,MAAM,KAAG,MAGjF,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.js

@@ -0,0 +1,11 @@
+import { encode } from "js-base64";
+//#region src/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.ts
+/** Encode OAuth client passwords using form encoding before Basic authentication (RFC6749 section 2.3.1). */
+var oauthClientAuthorization = (clientId, clientSecret) => {
+	const formEncode = (value) => new URLSearchParams({ value }).toString().slice(6);
+	return `Basic ${encode(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`;
+};
+//#endregion
+export { oauthClientAuthorization };
+
+//# sourceMappingURL=oauth-client-authorization.js.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-client-authorization.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth-client-authorization.ts"],"sourcesContent":["import { encode } from 'js-base64'\n\n/** Encode OAuth client passwords using form encoding before Basic authentication (RFC6749 section 2.3.1). */\nexport const oauthClientAuthorization = (clientId: string, clientSecret: string): string => {\n  const formEncode = (value: string): string => new URLSearchParams({ value }).toString().slice('value='.length)\n  return `Basic ${encode(`${formEncode(clientId)}:${formEncode(clientSecret)}`)}`\n}\n"],"mappings":";;;AAGA,IAAa,4BAA4B,UAAkB,iBAAiC;CAC1F,MAAM,cAAc,UAA0B,IAAI,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,MAAM,CAAe;CAC7G,OAAO,SAAS,OAAO,GAAG,WAAW,QAAQ,EAAE,GAAG,WAAW,YAAY,GAAG;AAC9E"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.d.ts

@@ -0,0 +1,19 @@
+import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
+import type { OAuthFlowDeviceAuthorizationSecret } from '@scalar/workspace-store/request-example';
+import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
+import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import { type OAuth2Tokens } from './oauth.js';
+/** Information the user needs to approve a device without exposing the device code. */
+export type DeviceAuthorizationPrompt = {
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete?: string;
+};
+/** Device flow UI and cancellation hooks. */
+export type DeviceAuthorizationOptions = {
+    onPrompt: (prompt: DeviceAuthorizationPrompt) => void;
+    signal: AbortSignal;
+};
+/** Performs the RFC8628 device grant, respecting expiry, pending responses, and polling backoff. */
+export declare const authorizeDevice: (flow: OAuthFlowDeviceAuthorizationSecret, scopes: string[], server: ServerObject | null, proxyUrl: string, environment: Record<string, string>, customFetch?: CustomFetch, options?: DeviceAuthorizationOptions) => Promise<ErrorResponse<OAuth2Tokens>>;
+//# sourceMappingURL=oauth-device-authorization.d.ts.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-authorization.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,kCAAkC,EAAE,MAAM,yCAAyC,CAAA;AACjG,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAEhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAGnF,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,SAAS,CAAA;AAOhE,uFAAuF;AACvF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,uBAAuB,CAAC,EAAE,MAAM,CAAA;CACjC,CAAA;AAED,6CAA6C;AAC7C,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,EAAE,CAAC,MAAM,EAAE,yBAAyB,KAAK,IAAI,CAAA;IACrD,MAAM,EAAE,WAAW,CAAA;CACpB,CAAA;AA4BD,oGAAoG;AACpG,eAAO,MAAM,eAAe,GAC1B,MAAM,kCAAkC,EACxC,QAAQ,MAAM,EAAE,EAChB,QAAQ,YAAY,GAAG,IAAI,EAC3B,UAAU,MAAM,EAChB,aAAa,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,cAAa,WAAmB,EAChC,UAAU,0BAA0B,KACnC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA4HrC,CAAA"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.js

@@ -0,0 +1,117 @@
+import { oauthClientAuthorization } from "./oauth-client-authorization.js";
+import { isAllowedOAuthUrl } from "./is-allowed-oauth-url.js";
+import { getActiveServerBase } from "./oauth.js";
+import { makeUrlAbsolute } from "@scalar/helpers/url/make-url-absolute";
+import { replaceEnvVariables } from "@scalar/helpers/regex/replace-variables";
+import { isObject } from "@scalar/helpers/object/is-object";
+import { redirectToProxy } from "@scalar/helpers/url/redirect-to-proxy";
+//#region src/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+var MAX_TIMEOUT_MS = 2147483647;
+/** Waits between polls, releasing the timer immediately when cancelled or expired. */
+var waitForPoll = (milliseconds, signal) => new Promise((resolve, reject) => {
+	signal.throwIfAborted();
+	const abort = () => {
+		clearTimeout(timer);
+		reject(signal.reason);
+	};
+	const timer = setTimeout(() => {
+		signal.removeEventListener("abort", abort);
+		resolve();
+	}, milliseconds);
+	signal.addEventListener("abort", abort, { once: true });
+});
+var verificationUrl = (value) => {
+	if (typeof value !== "string") throw new Error("Missing device verification URL");
+	const url = new URL(value);
+	if (!isAllowedOAuthUrl(url)) throw new Error("Device verification URL must use HTTPS or HTTP for local development URLs");
+	return url.href;
+};
+/** Performs the RFC8628 device grant, respecting expiry, pending responses, and polling backoff. */
+var authorizeDevice = async (flow, scopes, server, proxyUrl, environment, customFetch = fetch, options) => {
+	try {
+		if (!options) throw new Error("Device authorization requires a verification prompt");
+		const resolveValue = (value) => replaceEnvVariables(value, environment);
+		const endpoint = (value) => redirectToProxy(proxyUrl, makeUrlAbsolute(resolveValue(value), getActiveServerBase(server, environment)));
+		const clientId = resolveValue(flow["x-scalar-secret-client-id"]);
+		const clientSecret = resolveValue(flow["x-scalar-secret-client-secret"]);
+		const headers = { "Content-Type": "application/x-www-form-urlencoded" };
+		const credentials = new URLSearchParams();
+		if (clientSecret && flow["x-scalar-credentials-location"] !== "body") headers.Authorization = oauthClientAuthorization(clientId, clientSecret);
+		else {
+			credentials.set("client_id", clientId);
+			if (clientSecret) credentials.set("client_secret", clientSecret);
+		}
+		const deviceBody = new URLSearchParams(credentials);
+		if (scopes.length) deviceBody.set("scope", scopes.join(" "));
+		const response = await customFetch(endpoint(flow.deviceAuthorizationUrl), {
+			method: "POST",
+			headers,
+			body: deviceBody,
+			signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+		});
+		const data = await response.json();
+		options.signal.throwIfAborted();
+		if (!isObject(data)) throw new Error("Invalid device authorization response");
+		if (!response.ok) throw new Error(String(data.error_description ?? data.error ?? "Device authorization failed"));
+		if (typeof data.device_code !== "string" || !data.device_code || typeof data.user_code !== "string" || !data.user_code || typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0 || data.interval !== void 0 && (typeof data.interval !== "number" || !Number.isFinite(data.interval) || data.interval < 0)) throw new Error("Invalid device authorization response");
+		const lifetime = Math.min(data.expires_in * 1e3, MAX_TIMEOUT_MS);
+		const expiresAt = Date.now() + lifetime;
+		const expiry = AbortSignal.timeout(lifetime);
+		const signal = AbortSignal.any([options.signal, expiry]);
+		options.onPrompt({
+			userCode: data.user_code,
+			verificationUri: verificationUrl(data.verification_uri),
+			...data.verification_uri_complete ? { verificationUriComplete: verificationUrl(data.verification_uri_complete) } : {}
+		});
+		const body = new URLSearchParams(credentials);
+		for (const [key, value] of Object.entries(flow["x-scalar-security-body"] ?? {})) body.set(key, resolveValue(value));
+		body.set("grant_type", "urn:ietf:params:oauth:grant-type:device_code");
+		body.set("device_code", data.device_code);
+		let interval = typeof data.interval === "number" ? Math.max(1e3, data.interval * 1e3) : 5e3;
+		try {
+			while (Date.now() < expiresAt) {
+				await waitForPoll(Math.min(interval, expiresAt - Date.now()), signal);
+				signal.throwIfAborted();
+				if (Date.now() >= expiresAt) throw new Error("Device authorization expired");
+				const tokenResponse = await customFetch(endpoint(flow["x-scalar-secret-token-url"] || flow.tokenUrl), {
+					method: "POST",
+					headers,
+					body,
+					signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)])
+				}).catch((error) => {
+					signal.throwIfAborted();
+					if (error instanceof Error && error.name === "TimeoutError") return null;
+					throw error;
+				});
+				if (!tokenResponse) {
+					interval = Math.min(interval * 2, expiresAt - Date.now());
+					continue;
+				}
+				const token = await tokenResponse.json();
+				if (!isObject(token)) throw new Error("Invalid device token response");
+				if (token.error === "authorization_pending") continue;
+				if (token.error === "slow_down") {
+					interval = Math.min(interval + 5e3, expiresAt - Date.now());
+					continue;
+				}
+				const accessToken = token[flow["x-tokenName"] || "access_token"];
+				if (tokenResponse.ok && typeof accessToken === "string" && accessToken) return [null, {
+					accessToken,
+					...typeof token.refresh_token === "string" ? { refreshToken: token.refresh_token } : {}
+				}];
+				throw new Error(String(token.error_description ?? token.error ?? "Failed to get an access token"));
+			}
+			throw new Error("Device authorization expired");
+		} catch (error) {
+			if (expiry.aborted && !options.signal.aborted) throw new Error("Device authorization expired");
+			throw error;
+		}
+	} catch (error) {
+		return [error instanceof Error ? error : new Error("Device authorization failed", { cause: error }), null];
+	}
+};
+//#endregion
+export { authorizeDevice };
+
+//# sourceMappingURL=oauth-device-authorization.js.map

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-device-authorization.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { isObject } from '@scalar/helpers/object/is-object'\nimport { replaceEnvVariables } from '@scalar/helpers/regex/replace-variables'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowDeviceAuthorizationSecret } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { isAllowedOAuthUrl } from './is-allowed-oauth-url'\nimport { type OAuth2Tokens, getActiveServerBase } from './oauth'\nimport { oauthClientAuthorization } from './oauth-client-authorization'\n\nconst REQUEST_TIMEOUT_MS = 30_000\n// Maximum delay supported by the browser timer API.\nconst MAX_TIMEOUT_MS = 2_147_483_647\n\n/** Information the user needs to approve a device without exposing the device code. */\nexport type DeviceAuthorizationPrompt = {\n  userCode: string\n  verificationUri: string\n  verificationUriComplete?: string\n}\n\n/** Device flow UI and cancellation hooks. */\nexport type DeviceAuthorizationOptions = {\n  onPrompt: (prompt: DeviceAuthorizationPrompt) => void\n  signal: AbortSignal\n}\n\n/** Waits between polls, releasing the timer immediately when cancelled or expired. */\nconst waitForPoll = (milliseconds: number, signal: AbortSignal): Promise<void> =>\n  new Promise((resolve, reject) => {\n    signal.throwIfAborted()\n    const abort = (): void => {\n      clearTimeout(timer)\n      reject(signal.reason)\n    }\n    const timer = setTimeout(() => {\n      signal.removeEventListener('abort', abort)\n      resolve()\n    }, milliseconds)\n    signal.addEventListener('abort', abort, { once: true })\n  })\n\nconst verificationUrl = (value: unknown): string => {\n  if (typeof value !== 'string') {\n    throw new Error('Missing device verification URL')\n  }\n  const url = new URL(value)\n  if (!isAllowedOAuthUrl(url)) {\n    throw new Error('Device verification URL must use HTTPS or HTTP for local development URLs')\n  }\n  return url.href\n}\n\n/** Performs the RFC8628 device grant, respecting expiry, pending responses, and polling backoff. */\nexport const authorizeDevice = async (\n  flow: OAuthFlowDeviceAuthorizationSecret,\n  scopes: string[],\n  server: ServerObject | null,\n  proxyUrl: string,\n  environment: Record<string, string>,\n  customFetch: CustomFetch = fetch,\n  options?: DeviceAuthorizationOptions,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  try {\n    if (!options) {\n      throw new Error('Device authorization requires a verification prompt')\n    }\n    const resolveValue = (value: string): string => replaceEnvVariables(value, environment)\n    const endpoint = (value: string): string =>\n      redirectToProxy(proxyUrl, makeUrlAbsolute(resolveValue(value), getActiveServerBase(server, environment)))\n    const clientId = resolveValue(flow['x-scalar-secret-client-id'])\n    const clientSecret = resolveValue(flow['x-scalar-secret-client-secret'])\n    const headers: Record<string, string> = { 'Content-Type': 'application/x-www-form-urlencoded' }\n    const credentials = new URLSearchParams()\n    if (clientSecret && flow['x-scalar-credentials-location'] !== 'body') {\n      headers.Authorization = oauthClientAuthorization(clientId, clientSecret)\n    } else {\n      credentials.set('client_id', clientId)\n      if (clientSecret) {\n        credentials.set('client_secret', clientSecret)\n      }\n    }\n    const deviceBody = new URLSearchParams(credentials)\n    if (scopes.length) {\n      deviceBody.set('scope', scopes.join(' '))\n    }\n    const response = await customFetch(endpoint(flow.deviceAuthorizationUrl), {\n      method: 'POST',\n      headers,\n      body: deviceBody,\n      signal: AbortSignal.any([options.signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),\n    })\n    const data: unknown = await response.json()\n    options.signal.throwIfAborted()\n    if (!isObject(data)) {\n      throw new Error('Invalid device authorization response')\n    }\n    if (!response.ok) {\n      throw new Error(String(data.error_description ?? data.error ?? 'Device authorization failed'))\n    }\n    if (\n      typeof data.device_code !== 'string' ||\n      !data.device_code ||\n      typeof data.user_code !== 'string' ||\n      !data.user_code ||\n      typeof data.expires_in !== 'number' ||\n      !Number.isFinite(data.expires_in) ||\n      data.expires_in <= 0 ||\n      (data.interval !== undefined &&\n        (typeof data.interval !== 'number' || !Number.isFinite(data.interval) || data.interval < 0))\n    ) {\n      throw new Error('Invalid device authorization response')\n    }\n    const lifetime = Math.min(data.expires_in * 1000, MAX_TIMEOUT_MS)\n    const expiresAt = Date.now() + lifetime\n    const expiry = AbortSignal.timeout(lifetime)\n    const signal = AbortSignal.any([options.signal, expiry])\n    options.onPrompt({\n      userCode: data.user_code,\n      verificationUri: verificationUrl(data.verification_uri),\n      ...(data.verification_uri_complete\n        ? { verificationUriComplete: verificationUrl(data.verification_uri_complete) }\n        : {}),\n    })\n    const body = new URLSearchParams(credentials)\n    for (const [key, value] of Object.entries(flow['x-scalar-security-body'] ?? {})) {\n      body.set(key, resolveValue(value))\n    }\n    body.set('grant_type', 'urn:ietf:params:oauth:grant-type:device_code')\n    body.set('device_code', data.device_code)\n    let interval = typeof data.interval === 'number' ? Math.max(1000, data.interval * 1000) : 5000\n    try {\n      while (Date.now() < expiresAt) {\n        await waitForPoll(Math.min(interval, expiresAt - Date.now()), signal)\n        signal.throwIfAborted()\n        if (Date.now() >= expiresAt) {\n          throw new Error('Device authorization expired')\n        }\n        // Connection timeouts require a lower polling frequency (RFC8628 section 3.5).\n        const tokenResponse = await customFetch(endpoint(flow['x-scalar-secret-token-url'] || flow.tokenUrl), {\n          method: 'POST',\n          headers,\n          body,\n          signal: AbortSignal.any([signal, AbortSignal.timeout(REQUEST_TIMEOUT_MS)]),\n        }).catch((error: unknown) => {\n          signal.throwIfAborted()\n          if (error instanceof Error && error.name === 'TimeoutError') {\n            return null\n          }\n          throw error\n        })\n        if (!tokenResponse) {\n          // Saturating at expiry never schedules an earlier poll: the loop expires instead.\n          interval = Math.min(interval * 2, expiresAt - Date.now())\n          continue\n        }\n        const token: unknown = await tokenResponse.json()\n        if (!isObject(token)) {\n          throw new Error('Invalid device token response')\n        }\n        if (token.error === 'authorization_pending') {\n          continue\n        }\n        if (token.error === 'slow_down') {\n          interval = Math.min(interval + 5000, expiresAt - Date.now())\n          continue\n        }\n        const accessToken = token[flow['x-tokenName'] || 'access_token']\n        if (tokenResponse.ok && typeof accessToken === 'string' && accessToken) {\n          return [\n            null,\n            { accessToken, ...(typeof token.refresh_token === 'string' ? { refreshToken: token.refresh_token } : {}) },\n          ]\n        }\n        throw new Error(String(token.error_description ?? token.error ?? 'Failed to get an access token'))\n      }\n      throw new Error('Device authorization expired')\n    } catch (error) {\n      if (expiry.aborted && !options.signal.aborted) {\n        throw new Error('Device authorization expired')\n      }\n      throw error\n    }\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Device authorization failed', { cause: error }), null]\n  }\n}\n"],"mappings":";;;;;;;;AAcA,IAAM,qBAAqB;AAE3B,IAAM,iBAAiB;;AAgBvB,IAAM,eAAe,cAAsB,WACzC,IAAI,SAAS,SAAS,WAAW;CAC/B,OAAO,eAAe;CACtB,MAAM,cAAoB;EACxB,aAAa,KAAK;EAClB,OAAO,OAAO,MAAM;CACtB;CACA,MAAM,QAAQ,iBAAiB;EAC7B,OAAO,oBAAoB,SAAS,KAAK;EACzC,QAAQ;CACV,GAAG,YAAY;CACf,OAAO,iBAAiB,SAAS,OAAO,EAAE,MAAM,KAAK,CAAC;AACxD,CAAC;AAEH,IAAM,mBAAmB,UAA2B;CAClD,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,MAAM,iCAAiC;CAEnD,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,IAAI,CAAC,kBAAkB,GAAG,GACxB,MAAM,IAAI,MAAM,2EAA2E;CAE7F,OAAO,IAAI;AACb;;AAGA,IAAa,kBAAkB,OAC7B,MACA,QACA,QACA,UACA,aACA,cAA2B,OAC3B,YACyC;CACzC,IAAI;EACF,IAAI,CAAC,SACH,MAAM,IAAI,MAAM,qDAAqD;EAEvE,MAAM,gBAAgB,UAA0B,oBAAoB,OAAO,WAAW;EACtF,MAAM,YAAY,UAChB,gBAAgB,UAAU,gBAAgB,aAAa,KAAK,GAAG,oBAAoB,QAAQ,WAAW,CAAC,CAAC;EAC1G,MAAM,WAAW,aAAa,KAAK,4BAA4B;EAC/D,MAAM,eAAe,aAAa,KAAK,gCAAgC;EACvE,MAAM,UAAkC,EAAE,gBAAgB,oCAAoC;EAC9F,MAAM,cAAc,IAAI,gBAAgB;EACxC,IAAI,gBAAgB,KAAK,qCAAqC,QAC5D,QAAQ,gBAAgB,yBAAyB,UAAU,YAAY;OAClE;GACL,YAAY,IAAI,aAAa,QAAQ;GACrC,IAAI,cACF,YAAY,IAAI,iBAAiB,YAAY;EAEjD;EACA,MAAM,aAAa,IAAI,gBAAgB,WAAW;EAClD,IAAI,OAAO,QACT,WAAW,IAAI,SAAS,OAAO,KAAK,GAAG,CAAC;EAE1C,MAAM,WAAW,MAAM,YAAY,SAAS,KAAK,sBAAsB,GAAG;GACxE,QAAQ;GACR;GACA,MAAM;GACN,QAAQ,YAAY,IAAI,CAAC,QAAQ,QAAQ,YAAY,QAAQ,kBAAkB,CAAC,CAAC;EACnF,CAAC;EACD,MAAM,OAAgB,MAAM,SAAS,KAAK;EAC1C,QAAQ,OAAO,eAAe;EAC9B,IAAI,CAAC,SAAS,IAAI,GAChB,MAAM,IAAI,MAAM,uCAAuC;EAEzD,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,OAAO,KAAK,qBAAqB,KAAK,SAAS,6BAA6B,CAAC;EAE/F,IACE,OAAO,KAAK,gBAAgB,YAC5B,CAAC,KAAK,eACN,OAAO,KAAK,cAAc,YAC1B,CAAC,KAAK,aACN,OAAO,KAAK,eAAe,YAC3B,CAAC,OAAO,SAAS,KAAK,UAAU,KAChC,KAAK,cAAc,KAClB,KAAK,aAAa,KAAA,MAChB,OAAO,KAAK,aAAa,YAAY,CAAC,OAAO,SAAS,KAAK,QAAQ,KAAK,KAAK,WAAW,IAE3F,MAAM,IAAI,MAAM,uCAAuC;EAEzD,MAAM,WAAW,KAAK,IAAI,KAAK,aAAa,KAAM,cAAc;EAChE,MAAM,YAAY,KAAK,IAAI,IAAI;EAC/B,MAAM,SAAS,YAAY,QAAQ,QAAQ;EAC3C,MAAM,SAAS,YAAY,IAAI,CAAC,QAAQ,QAAQ,MAAM,CAAC;EACvD,QAAQ,SAAS;GACf,UAAU,KAAK;GACf,iBAAiB,gBAAgB,KAAK,gBAAgB;GACtD,GAAI,KAAK,4BACL,EAAE,yBAAyB,gBAAgB,KAAK,yBAAyB,EAAE,IAC3E,CAAC;EACP,CAAC;EACD,MAAM,OAAO,IAAI,gBAAgB,WAAW;EAC5C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,6BAA6B,CAAC,CAAC,GAC5E,KAAK,IAAI,KAAK,aAAa,KAAK,CAAC;EAEnC,KAAK,IAAI,cAAc,8CAA8C;EACrE,KAAK,IAAI,eAAe,KAAK,WAAW;EACxC,IAAI,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,IAAI,KAAM,KAAK,WAAW,GAAI,IAAI;EAC1F,IAAI;GACF,OAAO,KAAK,IAAI,IAAI,WAAW;IAC7B,MAAM,YAAY,KAAK,IAAI,UAAU,YAAY,KAAK,IAAI,CAAC,GAAG,MAAM;IACpE,OAAO,eAAe;IACtB,IAAI,KAAK,IAAI,KAAK,WAChB,MAAM,IAAI,MAAM,8BAA8B;IAGhD,MAAM,gBAAgB,MAAM,YAAY,SAAS,KAAK,gCAAgC,KAAK,QAAQ,GAAG;KACpG,QAAQ;KACR;KACA;KACA,QAAQ,YAAY,IAAI,CAAC,QAAQ,YAAY,QAAQ,kBAAkB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC,OAAO,UAAmB;KAC3B,OAAO,eAAe;KACtB,IAAI,iBAAiB,SAAS,MAAM,SAAS,gBAC3C,OAAO;KAET,MAAM;IACR,CAAC;IACD,IAAI,CAAC,eAAe;KAElB,WAAW,KAAK,IAAI,WAAW,GAAG,YAAY,KAAK,IAAI,CAAC;KACxD;IACF;IACA,MAAM,QAAiB,MAAM,cAAc,KAAK;IAChD,IAAI,CAAC,SAAS,KAAK,GACjB,MAAM,IAAI,MAAM,+BAA+B;IAEjD,IAAI,MAAM,UAAU,yBAClB;IAEF,IAAI,MAAM,UAAU,aAAa;KAC/B,WAAW,KAAK,IAAI,WAAW,KAAM,YAAY,KAAK,IAAI,CAAC;KAC3D;IACF;IACA,MAAM,cAAc,MAAM,KAAK,kBAAkB;IACjD,IAAI,cAAc,MAAM,OAAO,gBAAgB,YAAY,aACzD,OAAO,CACL,MACA;KAAE;KAAa,GAAI,OAAO,MAAM,kBAAkB,WAAW,EAAE,cAAc,MAAM,cAAc,IAAI,CAAC;IAAG,CAC3G;IAEF,MAAM,IAAI,MAAM,OAAO,MAAM,qBAAqB,MAAM,SAAS,+BAA+B,CAAC;GACnG;GACA,MAAM,IAAI,MAAM,8BAA8B;EAChD,SAAS,OAAO;GACd,IAAI,OAAO,WAAW,CAAC,QAAQ,OAAO,SACpC,MAAM,IAAI,MAAM,8BAA8B;GAEhD,MAAM;EACR;CACF,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,+BAA+B,EAAE,OAAO,MAAM,CAAC,GAAG,IAAI;CAC3G;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts

@@ -2,6 +2,7 @@ import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
 import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import { type DeviceAuthorizationOptions } from './oauth-device-authorization.js';
 type ActiveServerBase = {
     basePath: string;
 } | {
@@ -64,7 +65,7 @@ customFetch?: CustomFetch,
  * When provided, the system browser plus a host-owned redirect target replaces the
  * default popup-polling approach. Required for the Electron desktop app.
  */
-captureCallback?: CaptureOAuth2Callback) => Promise<ErrorResponse<OAuth2Tokens>>;
+captureCallback?: CaptureOAuth2Callback, deviceOptions?: DeviceAuthorizationOptions) => Promise<ErrorResponse<OAuth2Tokens>>;
 /**
  * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.
  *

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAanF,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;CACzB,KAAK,OAAO,CACX,aAAa,CAAC;IACZ,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CACH,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW;AACzB;;;;GAIG;AACH,kBAAkB,qBAAqB,KACtC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA6NrC,CAAA;AAkJD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAwFrC,CAAA"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wCAAwC,CAAA;AAK3E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAA;AAErF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAGhG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kDAAkD,CAAA;AAInF,OAAO,EAAE,KAAK,0BAA0B,EAAmB,MAAM,8BAA8B,CAAA;AAW/F,KAAK,gBAAgB,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;AAE1F,MAAM,MAAM,YAAY,GAAG;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE;IAC3C,6EAA6E;IAC7E,gBAAgB,EAAE,MAAM,CAAA;CACzB,KAAK,OAAO,CACX,aAAa,CAAC;IACZ,4FAA4F;IAC5F,WAAW,EAAE,MAAM,CAAA;IACnB,wFAAwF;IACxF,WAAW,EAAE,MAAM,CAAA;CACpB,CAAC,CACH,CAAA;AAED,kEAAkE;AAClE,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,sBAAsB,EAAE,UAAU,CAAC,CAAA;AAEzE;;;GAGG;AACH,eAAO,MAAM,YAAY,GACvB,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,MAIA,CAAA;AAEH;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,cAAc,YAAY,GAAG,IAAI,EACjC,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,KAChD,gBAWF,CAAA;AAuCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,GAC1B,OAAO,sBAAsB,EAC7B,MAAM,MAAM,sBAAsB,EAClC,gBAAgB,MAAM,EAAE;AACxB,wEAAwE;AACxE,cAAc,YAAY,GAAG,IAAI;AACjC,kCAAkC;AAClC,UAAU,MAAM;AAChB,6FAA6F;AAC7F,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,mHAAmH;AACnH,cAAc,WAAW;AACzB;;;;GAIG;AACH,kBAAkB,qBAAqB,EACvC,gBAAgB,0BAA0B,KACzC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CA8OrC,CAAA;AAmJD;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,OAAO,sBAAsB,EAC7B,MAAM,gBAAgB;AACtB,kCAAkC;AAClC,UAAU,MAAM;AAChB,+DAA+D;AAC/D,cAAc,YAAY,GAAG,IAAI;AACjC,2EAA2E;AAC3E,uBAAsB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;AACjD,gIAAgI;AAChI,cAAa,WAAmB,KAC/B,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAyFrC,CAAA"}