@scalar/api-client 3.23.2 → 3.23.3

package/dist/v2/blocks/scalar-auth-selector-block/components/RequestAuthTab.vue.js.map

@@ -1 +1 @@
-{"version":3,"file":"RequestAuthTab.vue.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/RequestAuthTab.vue"],"sourcesContent":["<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { ScalarIconButton } from '@scalar/components/icon-button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport { ScalarMarkdownSummary } from '@scalar/components/markdown'\nimport { ScalarModal, useModal } from '@scalar/components/modal'\nimport { ScalarIconGear } from '@scalar/icons'\nimport { useToasts } from '@scalar/use-toasts'\nimport type {\n  SecretsApiKey,\n  SecretsHttp,\n} from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport { canResetSecretField } from '@scalar/workspace-store/helpers/auth-secret-fields'\nimport { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref'\nimport {\n  getEnvironmentVariables,\n  type MergedSecuritySchemes,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport { getDocumentTypeLabel } from '@scalar/workspace-store/schemas/type-guards'\nimport type {\n  ApiKeyObject,\n  SecurityRequirementObject,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { capitalize, computed, ref } from 'vue'\n\nimport { refreshOauth2Token } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { getVisibleOrderedFlowKeys } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth-flows'\nimport {\n  runOAuth2Authorize,\n  storeOAuth2Tokens,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize'\nimport { getOauth2AcquisitionTarget } from '@/v2/blocks/scalar-auth-selector-block/helpers/security-scheme'\nimport {\n  DataTable,\n  DataTableCell,\n  DataTableRow,\n} from '@/v2/components/data-table'\nimport { useLocalization } from '@/v2/features/localization'\n\nimport OAuth2, { type OAuth2Options } from './OAuth2.vue'\nimport OAuth2Metadata from './OAuth2Metadata.vue'\nimport OpenIDConnect from './OpenIDConnect.vue'\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  isStatic,\n  proxyUrl,\n  selectedSecuritySchemas,\n  securitySchemes,\n  server,\n  eventBus,\n  options,\n  documentType = 'openapi',\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** Controls the display of certain borders which are used when we are non-collapsible */\n  isStatic: boolean\n  /** Proxy URL */\n  proxyUrl: string\n  /** Selected security schemes*/\n  selectedSecuritySchemas: SecurityRequirementObject\n  /** Merged security schemes from the document and the config together with the auth store secrets */\n  securitySchemes: MergedSecuritySchemes\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n  /** Type of the document the schemes belong to, used to label the missing-type warning */\n  documentType?: 'openapi' | 'asyncapi'\n}>()\n\nconst emits = defineEmits<{\n  (\n    e: 'update:selectedScopes',\n    payload: Omit<ApiReferenceEvents['auth:update:selected-scopes'], 'meta'>,\n  ): void\n  (e: 'upsert:scope', payload: ApiReferenceEvents['auth:upsert:scopes']): void\n  (e: 'delete:scope', payload: ApiReferenceEvents['auth:delete:scopes']): void\n}>()\n\nconst { translate } = useLocalization()\n\ntype SecurityItem = {\n  scheme: SecuritySchemeObjectSecret | undefined\n  name: string\n  scopes: string[]\n  /** Ordered, non-hidden oauth2/openIdConnect flow keys for this scheme (empty for other types). */\n  visibleFlowKeys: (keyof OAuthFlowsObjectSecret)[]\n}\n\n/**\n * Human-readable name of the document type.\n * Used in the missing-type warning so it points at the correct document\n * (e.g. \"AsyncAPI\") instead of always naming OpenAPI.\n */\nconst documentTypeLabel = computed<string>(() =>\n  getDocumentTypeLabel(documentType),\n)\n\n/**\n * Resolves security schemes from the OpenAPI document and combines them with their selected scopes.\n * Each item includes the scheme definition, name, and associated scopes.\n */\nconst security = computed<SecurityItem[]>(() =>\n  Object.entries(selectedSecuritySchemas).map(([name, scopes = []]) => {\n    const scheme = getResolvedRef(securitySchemes[name])\n    return {\n      scheme,\n      name,\n      scopes,\n      // Compute the visible, ordered flow keys once per scheme so the tabs, the label, and the\n      // active-flow tracking all agree on the same set (and we do not filter + sort on every access).\n      visibleFlowKeys:\n        scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\n          ? getVisibleOrderedFlowKeys(scheme.flows)\n          : [],\n    }\n  }),\n)\n\n/** Tracks which OAuth2 flow is currently active when multiple flows are available. */\nconst activeFlow = ref<string>('')\n\n/**\n * Keeps the selected flow in sync with the currently visible flow keys. Validating against the\n * visible set (not every declared flow) means a selection that becomes hidden — e.g. the document\n * is updated to mark the active flow with `x-scalar-ignore` — resets, so the default (first visible)\n * flow activates instead of leaving no tab selected.\n */\nconst selectedFlow = computed<string>(() => {\n  const visibleFlowKeys = security.value.flatMap((item) => item.visibleFlowKeys)\n\n  return visibleFlowKeys.some((key) => key === activeFlow.value)\n    ? activeFlow.value\n    : ''\n})\n\nconst setActiveFlow = (flow: string): void => {\n  activeFlow.value = flow\n}\n\n/** Determines if multiple auth schemes are configured, which affects the UI layout. */\nconst hasMultipleSchemes = computed<boolean>(() => security.value.length > 1)\n\n/**\n * Generates a human-readable label for the security scheme.\n * Intentionally omits the description here — it is rendered separately as\n * rich text via ScalarMarkdownSummary so markdown formatting is preserved.\n */\nconst generateLabel = (\n  name: string,\n  scheme: SecuritySchemeObjectSecret,\n): string => {\n  const capitalizedName = capitalize(name)\n\n  switch (scheme.type) {\n    case 'apiKey':\n      return `${capitalizedName}: ${scheme.in}`\n\n    case 'openIdConnect':\n    case 'oauth2': {\n      const firstFlow = getVisibleOrderedFlowKeys(scheme.flows)[0]\n      const currentFlow = selectedFlow.value || firstFlow\n      if (!currentFlow) {\n        return capitalizedName\n      }\n      return `${capitalizedName}: ${currentFlow}`\n    }\n\n    case 'http':\n      return `${capitalizedName}: ${scheme.scheme}`\n\n    default:\n      return capitalizedName\n  }\n}\n\n/**\n * Whether an API key scheme exposes an editable parameter name.\n *\n * OpenAPI `apiKey` and AsyncAPI `httpApiKey` (normalized to `apiKey`) name a query/header/cookie\n * parameter, so the Name input is shown. AsyncAPI `apiKey` places the key in the broker `user` or\n * `password` slot and has no parameter name, so the Name input is hidden and only the value is asked for.\n */\nconst apiKeyHasName = (scheme: { in?: string }): boolean =>\n  scheme.in !== 'user' && scheme.in !== 'password'\n\n/**\n * The scheme's type when it is one we do not render inputs for (a type outside both the OpenAPI\n * and AsyncAPI security scheme unions). Read through a helper so the fallback template branch,\n * where the scheme type is narrowed to `never` after the supported cases, can still surface the type.\n */\nconst getUnsupportedSchemeType = (\n  scheme: SecurityItem['scheme'],\n): string | undefined => scheme?.type\n\n/**\n * Determines if an OAuth2 flow tab should be active.\n * The first flow is active by default if no flow is explicitly selected.\n */\nconst isFlowActive = (flowKey: string, index: number): boolean =>\n  selectedFlow.value === flowKey || (index === 0 && !selectedFlow.value)\n\n/** Computes the container class for static display mode. */\nconst getStaticBorderClass = (): string | false => isStatic && 'border-t'\n\nconst handleHttpSecretsUpdate = (\n  payload: Omit<Partial<SecretsHttp>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', ...payload },\n    name,\n  })\n\nconst handleApiKeySecretsUpdate = (\n  payload: Omit<Partial<SecretsApiKey>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Name edits may update the document or a configured override; tokens remain secrets. */\nconst handleApiKeySecuritySchemeUpdate = (\n  payload: Omit<Partial<ApiKeyObject>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Handles scope selection updates for OAuth2 */\nconst handleScopesUpdate = (\n  name: string,\n  event: { scopes?: string[]; scope?: string; selected?: boolean },\n): void => {\n  emits('update:selectedScopes', {\n    id: Object.keys(selectedSecuritySchemas),\n    name,\n    ...event,\n  })\n}\n\n/** Handles scope-definition upserts (add / rename / description change) */\nconst handleScopeUpsert = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n): void => {\n  emits('upsert:scope', { ...event, name })\n}\n\n/** Handles scope-definition deletes */\nconst handleScopeDelete = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n): void => {\n  emits('delete:scope', { ...event, name })\n}\n\n/**\n * Computes dynamic classes for OAuth2 flow tabs based on active state.\n */\nconst getFlowTabClasses = (flowKey: string, index: number): string => {\n  const baseClasses =\n    'floating-bg text-c-3 relative cursor-pointer border-b border-transparent py-1 text-base font-medium'\n  const activeClasses = '!text-c-1 !rounded-none border-b !border-current'\n\n  return isFlowActive(flowKey, index)\n    ? `${baseClasses} ${activeClasses} ${isStatic ? 'opacity-100' : ''}`\n    : baseClasses\n}\n\n/**\n * OAuth2 token-acquisition target (an oauth2 scheme with an interactive grant) sourced from\n * the merged schemes. When the active scheme is HTTP bearer, this powers the inline\n * \"Authorize via OAuth2\" shortcut: the flow's bearer token is written onto the bearer scheme,\n * so the panel never switches to oauth2.\n *\n * The shortcut is purely a convenience, so it is offered for any interactive oauth2 scheme —\n * including one that is also independently selectable in the dropdown (e.g. Scalar Galaxy's\n * `oAuth2`). Whether that oauth2 scheme is *hidden* from the dropdown is a separate decision made\n * in the selector; here we only surface the shortcut.\n */\nconst oauth2Target = computed(() => getOauth2AcquisitionTarget(securitySchemes))\n\n/** Resolved oauth2 scheme object, for embedding its config form behind the gear. */\nconst oauth2Scheme = computed(() =>\n  oauth2Target.value\n    ? getResolvedRef(securitySchemes[oauth2Target.value.name])\n    : undefined,\n)\n\nconst acquisitionLoader = useLoadingState()\nconst { toast } = useToasts()\nconst configModal = useModal()\n/** Bearer scheme that opened the config modal, so its Authorize callback targets it. */\nconst configBearerName = ref<string | undefined>()\n\n/** Runs the OAuth2 flow and writes the resulting bearer token onto the bearer scheme. */\nconst handleAcquisitionAuthorize = async (\n  bearerName: string,\n): Promise<void> => {\n  const target = oauth2Target.value\n  if (!target || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error] = await runOAuth2Authorize({\n    eventBus,\n    bearerSchemeName: bearerName,\n    oauth2Name: target.name,\n    flows: target.flows,\n    flowType: target.flowType,\n    scopes: target.scopes,\n    server,\n    proxyUrl,\n    environment,\n    options,\n  })\n  await acquisitionLoader.clear()\n  if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToauthorize'),\n      'error',\n    )\n  }\n}\n\n/** Refreshes the OAuth2 token and rewrites it onto the bearer scheme. */\nconst handleAcquisitionRefresh = async (bearerName: string): Promise<void> => {\n  const target = oauth2Target.value\n  // Only the authorization-code flow carries a refresh token; implicit can't be refreshed.\n  if (target?.flowType !== 'authorizationCode' || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error, tokens] = await refreshOauth2Token(\n    target.flows,\n    target.flowType,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n  )\n  await acquisitionLoader.clear()\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, {\n      bearerSchemeName: bearerName,\n      oauth2Name: target.name,\n      flowType: target.flowType,\n      tokens,\n    })\n  } else if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToRefresh'),\n      'error',\n    )\n  }\n}\n\nconst openAcquisitionConfig = (bearerName: string): void => {\n  configBearerName.value = bearerName\n  configModal.show()\n}\n\n/** Closes the config modal and runs Authorize against the bearer scheme that opened it. */\nconst handleConfigAuthorize = (): void => {\n  const bearerName = configBearerName.value\n  configModal.hide()\n  if (bearerName) {\n    void handleAcquisitionAuthorize(bearerName)\n  }\n}\n</script>\n<template>\n  <template\n    v-for=\"{ scheme, name, scopes, visibleFlowKeys } in security\"\n    :key=\"name\">\n    <!--\n      Header row for AND'ed schemes: label (bold) and description (rich text) are\n      combined.\n    -->\n    <DataTableRow v-if=\"hasMultipleSchemes && scheme\">\n      <DataTableCell\n        :aria-label=\"generateLabel(name, scheme)\"\n        class=\"max-h-[auto]\">\n        <div class=\"bg-b-1 min-w-0 flex-1 px-3 py-1.25\">\n          <p class=\"text-c-1 leading-5.5 font-medium\">\n            {{ generateLabel(name, scheme) }}\n          </p>\n          <ScalarMarkdownSummary\n            v-if=\"scheme.description\"\n            class=\"auth-description text-c-2 w-full\"\n            :value=\"scheme.description\" />\n        </div>\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- Description: shown for single auth schemes with descriptions -->\n    <DataTableRow v-if=\"scheme?.description && !hasMultipleSchemes\">\n      <DataTableCell\n        :aria-label=\"scheme.description\"\n        class=\"max-h-[auto]\">\n        <ScalarMarkdownSummary\n          class=\"auth-description bg-b-1 text-c-2 min-w-0 flex-1 px-3 py-1.25\"\n          :value=\"scheme.description\" />\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- HTTP Authentication -->\n    <template v-if=\"scheme?.type === 'http'\">\n      <!-- Bearer Token -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer'\">\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          :placeholder=\"translate('apiClient.requestAuthTab.token')\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) => handleHttpSecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.bearerToken') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <!-- OAuth2 token-acquisition shortcut (shown when an interactive oauth2 flow exists) -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer' && oauth2Target\">\n        <!--\n          Authorize stays rightmost so it never moves: Refresh only appears once there is a token,\n          and it slots in between the gear and Authorize instead of pushing Authorize aside.\n        -->\n        <div class=\"flex h-8 items-center gap-2 border-t pr-1 pl-3 text-base\">\n          <span class=\"text-c-1 mr-auto\">{{\n            translate('apiClient.requestAuthTab.getAToken')\n          }}</span>\n          <ScalarIconButton\n            class=\"h-6 w-6 p-1.25\"\n            :icon=\"ScalarIconGear\"\n            :label=\"\n              translate('apiClient.requestAuthTab.configure', {\n                name: oauth2Target.name,\n              })\n            \"\n            @click=\"openAcquisitionConfig(name)\" />\n          <ScalarButton\n            v-if=\"\n              scheme['x-scalar-secret-token'] &&\n              oauth2Target.flowType === 'authorizationCode'\n            \"\n            class=\"px-3 py-1\"\n            :disabled=\"acquisitionLoader.isLoading\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"outlined\"\n            @click=\"handleAcquisitionRefresh(name)\">\n            {{ translate('apiClient.requestAuthTab.refresh') }}\n          </ScalarButton>\n          <ScalarButton\n            class=\"text-c-1 px-3 py-1\"\n            :loader=\"acquisitionLoader\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"gradient\"\n            @click=\"handleAcquisitionAuthorize(name)\">\n            {{\n              translate('apiClient.requestAuthTab.authorizeVia', {\n                name: oauth2Target.name,\n              })\n            }}\n          </ScalarButton>\n        </div>\n      </DataTableRow>\n\n      <!-- HTTP Basic Authentication -->\n      <template v-else-if=\"scheme?.scheme === 'basic'\">\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-username',\n                scheme['x-scalar-secret-username'],\n              )\n            \"\n            class=\"text-c-2\"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-username']\"\n            placeholder=\"janedoe\"\n            required\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-username',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-username': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.username') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-password',\n                scheme['x-scalar-secret-password'],\n              )\n            \"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-password']\"\n            placeholder=\"********\"\n            type=\"password\"\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-password',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-password': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.password') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n      </template>\n    </template>\n\n    <!-- API Key Authentication -->\n    <template v-else-if=\"scheme?.type === 'apiKey'\">\n      <DataTableRow v-if=\"apiKeyHasName(scheme)\">\n        <RequestAuthDataTableInput\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme.name ?? ''\"\n          placeholder=\"api-key\"\n          @update:modelValue=\"\n            (v) => handleApiKeySecuritySchemeUpdate({ name: v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.name') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"\n            apiKeyHasName(scheme) ? undefined : getStaticBorderClass()\n          \"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) =>\n              handleApiKeySecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.value') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <!-- OAuth 2.0  / OpenID Connect Authentication -->\n    <template\n      v-else-if=\"scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\">\n      <OAuth2Metadata\n        v-if=\"\n          scheme.type === 'oauth2' && (!isStatic || scheme.oauth2MetadataUrl)\n        \"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- OpenID Connect -->\n      <OpenIDConnect\n        v-if=\"scheme?.type === 'openIdConnect' && !visibleFlowKeys.length\"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :getStaticBorderClass\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- Flow selector tabs: shown when multiple visible flows are available -->\n      <DataTableRow v-if=\"visibleFlowKeys.length > 1\">\n        <div class=\"flex min-h-8 border-t text-base\">\n          <div class=\"flex h-8 max-w-full gap-2.5 overflow-x-auto px-3\">\n            <button\n              v-for=\"(key, ind) in visibleFlowKeys\"\n              :key=\"key\"\n              :class=\"getFlowTabClasses(key, ind)\"\n              type=\"button\"\n              @click=\"setActiveFlow(key)\">\n              <span class=\"relative z-10\">{{ key }}</span>\n            </button>\n          </div>\n        </div>\n      </DataTableRow>\n\n      <!-- OAuth2 flow configuration -->\n      <template\n        v-for=\"(key, ind) in visibleFlowKeys\"\n        :key=\"key\">\n        <OAuth2\n          v-if=\"scheme.flows && isFlowActive(key, ind)\"\n          :environment\n          :eventBus\n          :flows=\"scheme.flows\"\n          :name\n          :options\n          :proxyUrl\n          :scheme\n          :selectedScopes=\"scopes\"\n          :server\n          :type=\"key\"\n          @delete:scope=\"(event) => handleScopeDelete(name, event)\"\n          @update:selectedScopes=\"(event) => handleScopesUpdate(name, event)\"\n          @upsert:scope=\"(event) => handleScopeUpsert(name, event)\" />\n      </template>\n    </template>\n\n    <!-- Browser WebSocket connections cannot apply these broker credentials. -->\n    <div\n      v-else-if=\"\n        scheme?.type === 'userPassword' ||\n        scheme?.type === 'plain' ||\n        scheme?.type === 'scramSha256' ||\n        scheme?.type === 'scramSha512' ||\n        scheme?.type === 'X509' ||\n        scheme?.type === 'symmetricEncryption' ||\n        scheme?.type === 'asymmetricEncryption' ||\n        scheme?.type === 'gssapi'\n      \"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.unsupportedCredentials') }}\n    </div>\n\n    <!-- Mutual TLS credentials are chosen during the browser-managed TLS handshake. -->\n    <div\n      v-else-if=\"scheme?.type === 'mutualTLS'\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.mutualTlsHint') }}\n    </div>\n\n    <!-- Scheme has a type we do not render inputs for -->\n    <div\n      v-else-if=\"getUnsupportedSchemeType(scheme)\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.unsupportedType', {\n          type: getUnsupportedSchemeType(scheme) ?? '',\n        })\n      }}\n    </div>\n\n    <!-- Scheme is missing type -->\n    <div\n      v-else\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.missingType', {\n          type: documentTypeLabel,\n        })\n      }}\n    </div>\n  </template>\n\n  <!-- OAuth2 configuration modal (opened from the bearer scheme's gear) -->\n  <ScalarModal\n    v-if=\"oauth2Target && oauth2Scheme\"\n    size=\"sm\"\n    :state=\"configModal\"\n    :title=\"\n      translate('apiClient.requestAuthTab.configure', {\n        name: oauth2Target.name,\n      })\n    \">\n    <DataTable\n      :columns=\"['']\"\n      presentational>\n      <OAuth2\n        :environment\n        :eventBus\n        :flows=\"oauth2Target.flows\"\n        hideActions\n        :name=\"oauth2Target.name\"\n        :options\n        :proxyUrl\n        :scheme=\"oauth2Scheme\"\n        :selectedScopes=\"oauth2Target.scopes\"\n        :server\n        :type=\"oauth2Target.flowType\"\n        @delete:scope=\"(event) => handleScopeDelete(oauth2Target!.name, event)\"\n        @update:selectedScopes=\"\n          (event) => handleScopesUpdate(oauth2Target!.name, event)\n        \"\n        @upsert:scope=\"\n          (event) => handleScopeUpsert(oauth2Target!.name, event)\n        \" />\n    </DataTable>\n    <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        size=\"sm\"\n        variant=\"outlined\"\n        @click=\"configModal.hide()\">\n        {{ translate('apiClient.requestAuthTab.cancel') }}\n      </ScalarButton>\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        :loader=\"acquisitionLoader\"\n        size=\"sm\"\n        @click=\"handleConfigAuthorize\">\n        {{ translate('apiClient.requestAuthTab.authorize') }}\n      </ScalarButton>\n    </div>\n  </ScalarModal>\n</template>\n"],"mappings":""}
+{"version":3,"file":"RequestAuthTab.vue.js","names":["_sfc_main"],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/RequestAuthTab.vue"],"sourcesContent":["<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { ScalarIconButton } from '@scalar/components/icon-button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport { ScalarMarkdownSummary } from '@scalar/components/markdown'\nimport { ScalarModal, useModal } from '@scalar/components/modal'\nimport { ScalarIconGear } from '@scalar/icons'\nimport { useToasts } from '@scalar/use-toasts'\nimport type {\n  SecretsApiKey,\n  SecretsHttp,\n} from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport { canResetSecretField } from '@scalar/workspace-store/helpers/auth-secret-fields'\nimport { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref'\nimport {\n  getEnvironmentVariables,\n  type MergedSecuritySchemes,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport { getDocumentTypeLabel } from '@scalar/workspace-store/schemas/type-guards'\nimport type {\n  ApiKeyObject,\n  SecurityRequirementObject,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { capitalize, computed, ref } from 'vue'\n\nimport { refreshOauth2Token } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { getVisibleOrderedFlowKeys } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth-flows'\nimport {\n  runOAuth2Authorize,\n  storeOAuth2Tokens,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize'\nimport { getOauth2AcquisitionTarget } from '@/v2/blocks/scalar-auth-selector-block/helpers/security-scheme'\nimport {\n  DataTable,\n  DataTableCell,\n  DataTableRow,\n} from '@/v2/components/data-table'\nimport { useLocalization } from '@/v2/features/localization'\n\nimport OAuth2, { type OAuth2Options } from './OAuth2.vue'\nimport OAuth2Metadata from './OAuth2Metadata.vue'\nimport OpenIDConnect from './OpenIDConnect.vue'\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  isStatic,\n  proxyUrl,\n  selectedSecuritySchemas,\n  securitySchemes,\n  server,\n  eventBus,\n  options,\n  documentType = 'openapi',\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** Controls the display of certain borders which are used when we are non-collapsible */\n  isStatic: boolean\n  /** Proxy URL */\n  proxyUrl: string\n  /** Selected security schemes*/\n  selectedSecuritySchemas: SecurityRequirementObject\n  /** Merged security schemes from the document and the config together with the auth store secrets */\n  securitySchemes: MergedSecuritySchemes\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n  /** Type of the document the schemes belong to, used to label the missing-type warning */\n  documentType?: 'openapi' | 'asyncapi'\n}>()\n\nconst emits = defineEmits<{\n  (\n    e: 'update:selectedScopes',\n    payload: Omit<ApiReferenceEvents['auth:update:selected-scopes'], 'meta'>,\n  ): void\n  (e: 'upsert:scope', payload: ApiReferenceEvents['auth:upsert:scopes']): void\n  (e: 'delete:scope', payload: ApiReferenceEvents['auth:delete:scopes']): void\n}>()\n\nconst { translate } = useLocalization()\n\ntype SecurityItem = {\n  scheme: SecuritySchemeObjectSecret | undefined\n  name: string\n  scopes: string[]\n  /** Ordered, non-hidden oauth2/openIdConnect flow keys for this scheme (empty for other types). */\n  visibleFlowKeys: (keyof OAuthFlowsObjectSecret)[]\n}\n\n/**\n * Human-readable name of the document type.\n * Used in the missing-type warning so it points at the correct document\n * (e.g. \"AsyncAPI\") instead of always naming OpenAPI.\n */\nconst documentTypeLabel = computed<string>(() =>\n  getDocumentTypeLabel(documentType),\n)\n\n/**\n * Resolves security schemes from the OpenAPI document and combines them with their selected scopes.\n * Each item includes the scheme definition, name, and associated scopes.\n */\nconst security = computed<SecurityItem[]>(() =>\n  Object.entries(selectedSecuritySchemas).map(([name, scopes = []]) => {\n    const scheme = getResolvedRef(securitySchemes[name])\n    return {\n      scheme,\n      name,\n      scopes,\n      // Compute the visible, ordered flow keys once per scheme so the tabs, the label, and the\n      // active-flow tracking all agree on the same set (and we do not filter + sort on every access).\n      visibleFlowKeys:\n        scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\n          ? getVisibleOrderedFlowKeys(scheme.flows)\n          : [],\n    }\n  }),\n)\n\n/** Tracks which OAuth2 flow is currently active when multiple flows are available. */\nconst activeFlow = ref<string>('')\n\n/**\n * Keeps the selected flow in sync with the currently visible flow keys. Validating against the\n * visible set (not every declared flow) means a selection that becomes hidden — e.g. the document\n * is updated to mark the active flow with `x-scalar-ignore` — resets, so the default (first visible)\n * flow activates instead of leaving no tab selected.\n */\nconst selectedFlow = computed<string>(() => {\n  const visibleFlowKeys = security.value.flatMap((item) => item.visibleFlowKeys)\n\n  return visibleFlowKeys.some((key) => key === activeFlow.value)\n    ? activeFlow.value\n    : ''\n})\n\nconst setActiveFlow = (flow: string): void => {\n  activeFlow.value = flow\n}\n\n/** Determines if multiple auth schemes are configured, which affects the UI layout. */\nconst hasMultipleSchemes = computed<boolean>(() => security.value.length > 1)\n\n/**\n * Generates a human-readable label for the security scheme.\n * Intentionally omits the description here — it is rendered separately as\n * rich text via ScalarMarkdownSummary so markdown formatting is preserved.\n */\nconst generateLabel = (\n  name: string,\n  scheme: SecuritySchemeObjectSecret,\n): string => {\n  const capitalizedName = capitalize(name)\n\n  switch (scheme.type) {\n    case 'apiKey':\n      return `${capitalizedName}: ${scheme.in}`\n\n    case 'openIdConnect':\n    case 'oauth2': {\n      const firstFlow = getVisibleOrderedFlowKeys(scheme.flows)[0]\n      const currentFlow = selectedFlow.value || firstFlow\n      if (!currentFlow) {\n        return capitalizedName\n      }\n      return `${capitalizedName}: ${currentFlow}`\n    }\n\n    case 'http':\n      return `${capitalizedName}: ${scheme.scheme}`\n\n    default:\n      return capitalizedName\n  }\n}\n\n/**\n * Whether an API key scheme exposes an editable parameter name.\n *\n * OpenAPI `apiKey` and AsyncAPI `httpApiKey` (normalized to `apiKey`) name a query/header/cookie\n * parameter, so the Name input is shown. AsyncAPI `apiKey` places the key in the broker `user` or\n * `password` slot and has no parameter name, so the Name input is hidden and only the value is asked for.\n */\nconst apiKeyHasName = (scheme: { in?: string }): boolean =>\n  scheme.in !== 'user' && scheme.in !== 'password'\n\n/**\n * The scheme's type when it is one we do not render inputs for (a type outside both the OpenAPI\n * and AsyncAPI security scheme unions). Read through a helper so the fallback template branch,\n * where the scheme type is narrowed to `never` after the supported cases, can still surface the type.\n */\nconst getUnsupportedSchemeType = (\n  scheme: SecurityItem['scheme'],\n): string | undefined => scheme?.type\n\n/**\n * Determines if an OAuth2 flow tab should be active.\n * The first flow is active by default if no flow is explicitly selected.\n */\nconst isFlowActive = (flowKey: string, index: number): boolean =>\n  selectedFlow.value === flowKey || (index === 0 && !selectedFlow.value)\n\n/** Computes the container class for static display mode. */\nconst getStaticBorderClass = (): string | false => isStatic && 'border-t'\n\nconst handleHttpSecretsUpdate = (\n  payload: Omit<Partial<SecretsHttp>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', ...payload },\n    name,\n  })\n\nconst handleApiKeySecretsUpdate = (\n  payload: Omit<Partial<SecretsApiKey>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Name edits may update the document or a configured override; tokens remain secrets. */\nconst handleApiKeySecuritySchemeUpdate = (\n  payload: Omit<Partial<ApiKeyObject>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Handles scope selection updates for OAuth2 */\nconst handleScopesUpdate = (\n  name: string,\n  event: { scopes?: string[]; scope?: string; selected?: boolean },\n): void => {\n  emits('update:selectedScopes', {\n    id: Object.keys(selectedSecuritySchemas),\n    name,\n    ...event,\n  })\n}\n\n/** Handles scope-definition upserts (add / rename / description change) */\nconst handleScopeUpsert = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n): void => {\n  emits('upsert:scope', { ...event, name })\n}\n\n/** Handles scope-definition deletes */\nconst handleScopeDelete = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n): void => {\n  emits('delete:scope', { ...event, name })\n}\n\n/**\n * Computes dynamic classes for OAuth2 flow tabs based on active state.\n */\nconst getFlowTabClasses = (flowKey: string, index: number): string => {\n  const baseClasses =\n    'floating-bg text-c-3 relative cursor-pointer border-b border-transparent py-1 text-base font-medium'\n  const activeClasses = '!text-c-1 !rounded-none border-b !border-current'\n\n  return isFlowActive(flowKey, index)\n    ? `${baseClasses} ${activeClasses} ${isStatic ? 'opacity-100' : ''}`\n    : baseClasses\n}\n\n/**\n * OAuth2 token-acquisition target (an oauth2 scheme with an interactive grant) sourced from\n * the merged schemes. When the active scheme is HTTP bearer, this powers the inline\n * \"Authorize via OAuth2\" shortcut: the flow's bearer token is written onto the bearer scheme,\n * so the panel never switches to oauth2.\n *\n * The shortcut is purely a convenience, so it is offered for any interactive oauth2 scheme —\n * including one that is also independently selectable in the dropdown (e.g. Scalar Galaxy's\n * `oAuth2`). Whether that oauth2 scheme is *hidden* from the dropdown is a separate decision made\n * in the selector; here we only surface the shortcut.\n */\nconst oauth2Target = computed(() => getOauth2AcquisitionTarget(securitySchemes))\n\n/** Resolved oauth2 scheme object, for embedding its config form behind the gear. */\nconst oauth2Scheme = computed(() =>\n  oauth2Target.value\n    ? getResolvedRef(securitySchemes[oauth2Target.value.name])\n    : undefined,\n)\n\nconst acquisitionLoader = useLoadingState()\nconst { toast } = useToasts()\nconst configModal = useModal()\n/** Bearer scheme that opened the config modal, so its Authorize callback targets it. */\nconst configBearerName = ref<string | undefined>()\n\n/** Runs the OAuth2 flow and writes the resulting bearer token onto the bearer scheme. */\nconst handleAcquisitionAuthorize = async (\n  bearerName: string,\n): Promise<void> => {\n  const target = oauth2Target.value\n  if (!target || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error] = await runOAuth2Authorize({\n    eventBus,\n    bearerSchemeName: bearerName,\n    oauth2Name: target.name,\n    flows: target.flows,\n    flowType: target.flowType,\n    scopes: target.scopes,\n    server,\n    proxyUrl,\n    environment,\n    options,\n  })\n  await acquisitionLoader.clear()\n  if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToauthorize'),\n      'error',\n    )\n  }\n}\n\n/** Refreshes the OAuth2 token and rewrites it onto the bearer scheme. */\nconst handleAcquisitionRefresh = async (bearerName: string): Promise<void> => {\n  const target = oauth2Target.value\n  // Only the authorization-code flow carries a refresh token; implicit can't be refreshed.\n  if (target?.flowType !== 'authorizationCode' || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error, tokens] = await refreshOauth2Token(\n    target.flows,\n    target.flowType,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n  )\n  await acquisitionLoader.clear()\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, {\n      bearerSchemeName: bearerName,\n      oauth2Name: target.name,\n      flowType: target.flowType,\n      tokens,\n    })\n  } else if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToRefresh'),\n      'error',\n    )\n  }\n}\n\nconst openAcquisitionConfig = (bearerName: string): void => {\n  configBearerName.value = bearerName\n  configModal.show()\n}\n\n/** Closes the config modal and runs Authorize against the bearer scheme that opened it. */\nconst handleConfigAuthorize = (): void => {\n  const bearerName = configBearerName.value\n  configModal.hide()\n  if (bearerName) {\n    void handleAcquisitionAuthorize(bearerName)\n  }\n}\n</script>\n<template>\n  <template\n    v-for=\"{ scheme, name, scopes, visibleFlowKeys } in security\"\n    :key=\"name\">\n    <!--\n      Header row for AND'ed schemes: label (bold) and description (rich text) are\n      combined.\n    -->\n    <DataTableRow v-if=\"hasMultipleSchemes && scheme\">\n      <DataTableCell\n        :aria-label=\"generateLabel(name, scheme)\"\n        class=\"max-h-[auto]\">\n        <div class=\"bg-b-1 min-w-0 flex-1 px-3 py-1.25\">\n          <p class=\"text-c-1 leading-5.5 font-medium\">\n            {{ generateLabel(name, scheme) }}\n          </p>\n          <ScalarMarkdownSummary\n            v-if=\"scheme.description\"\n            class=\"auth-description text-c-2 w-full\"\n            :value=\"scheme.description\" />\n        </div>\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- Description: shown for single auth schemes with descriptions -->\n    <DataTableRow v-if=\"scheme?.description && !hasMultipleSchemes\">\n      <DataTableCell\n        :aria-label=\"scheme.description\"\n        class=\"max-h-[auto]\">\n        <ScalarMarkdownSummary\n          class=\"auth-description bg-b-1 text-c-2 min-w-0 flex-1 px-3 py-1.25\"\n          :value=\"scheme.description\" />\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- HTTP Authentication -->\n    <template v-if=\"scheme?.type === 'http'\">\n      <!-- Bearer Token -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer'\">\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          :placeholder=\"translate('apiClient.requestAuthTab.token')\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) => handleHttpSecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.bearerToken') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <!-- OAuth2 token-acquisition shortcut (shown when an interactive oauth2 flow exists) -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer' && oauth2Target\">\n        <!--\n          Authorize stays rightmost so it never moves: Refresh only appears once there is a token,\n          and it slots in between the gear and Authorize instead of pushing Authorize aside.\n        -->\n        <div class=\"flex h-8 items-center gap-2 border-t pr-1 pl-3 text-base\">\n          <span class=\"text-c-1 mr-auto\">{{\n            translate('apiClient.requestAuthTab.getAToken')\n          }}</span>\n          <ScalarIconButton\n            class=\"h-6 w-6 p-1.25\"\n            :icon=\"ScalarIconGear\"\n            :label=\"\n              translate('apiClient.requestAuthTab.configure', {\n                name: oauth2Target.name,\n              })\n            \"\n            @click=\"openAcquisitionConfig(name)\" />\n          <ScalarButton\n            v-if=\"\n              scheme['x-scalar-secret-token'] &&\n              oauth2Target.flowType === 'authorizationCode'\n            \"\n            class=\"px-3 py-1\"\n            :disabled=\"acquisitionLoader.isLoading\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"outlined\"\n            @click=\"handleAcquisitionRefresh(name)\">\n            {{ translate('apiClient.requestAuthTab.refresh') }}\n          </ScalarButton>\n          <ScalarButton\n            class=\"text-c-1 px-3 py-1\"\n            :loader=\"acquisitionLoader\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"gradient\"\n            @click=\"handleAcquisitionAuthorize(name)\">\n            {{\n              translate('apiClient.requestAuthTab.authorizeVia', {\n                name: oauth2Target.name,\n              })\n            }}\n          </ScalarButton>\n        </div>\n      </DataTableRow>\n\n      <!-- HTTP Basic Authentication -->\n      <template v-else-if=\"scheme?.scheme === 'basic'\">\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-username',\n                scheme['x-scalar-secret-username'],\n              )\n            \"\n            class=\"text-c-2\"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-username']\"\n            placeholder=\"janedoe\"\n            required\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-username',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-username': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.username') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-password',\n                scheme['x-scalar-secret-password'],\n              )\n            \"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-password']\"\n            placeholder=\"********\"\n            type=\"password\"\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-password',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-password': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.password') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n      </template>\n    </template>\n\n    <!-- API Key Authentication -->\n    <template v-else-if=\"scheme?.type === 'apiKey'\">\n      <DataTableRow v-if=\"apiKeyHasName(scheme)\">\n        <RequestAuthDataTableInput\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme.name ?? ''\"\n          placeholder=\"api-key\"\n          @update:modelValue=\"\n            (v) => handleApiKeySecuritySchemeUpdate({ name: v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.name') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"\n            apiKeyHasName(scheme) ? undefined : getStaticBorderClass()\n          \"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) =>\n              handleApiKeySecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.value') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <!-- OAuth 2.0  / OpenID Connect Authentication -->\n    <template\n      v-else-if=\"scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\">\n      <OAuth2Metadata\n        v-if=\"\n          scheme.type === 'oauth2' && (!isStatic || scheme.oauth2MetadataUrl)\n        \"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- OpenID Connect -->\n      <OpenIDConnect\n        v-if=\"scheme?.type === 'openIdConnect' && !visibleFlowKeys.length\"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :getStaticBorderClass\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- Flow selector tabs: shown when multiple visible flows are available -->\n      <DataTableRow v-if=\"visibleFlowKeys.length > 1\">\n        <div class=\"flex min-h-8 border-t text-base\">\n          <div class=\"flex h-8 max-w-full gap-2.5 overflow-x-auto px-3\">\n            <button\n              v-for=\"(key, ind) in visibleFlowKeys\"\n              :key=\"key\"\n              :class=\"getFlowTabClasses(key, ind)\"\n              type=\"button\"\n              @click=\"setActiveFlow(key)\">\n              <span class=\"relative z-10\">{{ key }}</span>\n            </button>\n          </div>\n        </div>\n      </DataTableRow>\n\n      <!-- OAuth2 flow configuration -->\n      <template\n        v-for=\"(key, ind) in visibleFlowKeys\"\n        :key=\"key\">\n        <OAuth2\n          v-if=\"scheme.flows && isFlowActive(key, ind)\"\n          :environment\n          :eventBus\n          :flows=\"scheme.flows\"\n          :name\n          :options\n          :proxyUrl\n          :scheme\n          :selectedScopes=\"scopes\"\n          :server\n          :type=\"key\"\n          @delete:scope=\"(event) => handleScopeDelete(name, event)\"\n          @update:selectedScopes=\"(event) => handleScopesUpdate(name, event)\"\n          @upsert:scope=\"(event) => handleScopeUpsert(name, event)\" />\n      </template>\n    </template>\n\n    <!-- Browser WebSocket connections cannot apply these broker credentials. -->\n    <div\n      v-else-if=\"\n        scheme?.type === 'userPassword' ||\n        scheme?.type === 'plain' ||\n        scheme?.type === 'scramSha256' ||\n        scheme?.type === 'scramSha512' ||\n        scheme?.type === 'X509' ||\n        scheme?.type === 'symmetricEncryption' ||\n        scheme?.type === 'asymmetricEncryption' ||\n        scheme?.type === 'gssapi'\n      \"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.unsupportedCredentials') }}\n    </div>\n\n    <!-- Mutual TLS credentials are chosen during the browser-managed TLS handshake. -->\n    <div\n      v-else-if=\"scheme?.type === 'mutualTLS'\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.mutualTlsHint') }}\n    </div>\n\n    <!-- Scheme has a type we do not render inputs for -->\n    <div\n      v-else-if=\"getUnsupportedSchemeType(scheme)\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.unsupportedType', {\n          type: getUnsupportedSchemeType(scheme) ?? '',\n        })\n      }}\n    </div>\n\n    <!-- Scheme is missing type -->\n    <div\n      v-else\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.missingType', {\n          type: documentTypeLabel,\n        })\n      }}\n    </div>\n  </template>\n\n  <!-- OAuth2 configuration modal (opened from the bearer scheme's gear) -->\n  <ScalarModal\n    v-if=\"oauth2Target && oauth2Scheme\"\n    size=\"sm\"\n    :state=\"configModal\"\n    :title=\"\n      translate('apiClient.requestAuthTab.configure', {\n        name: oauth2Target.name,\n      })\n    \">\n    <DataTable\n      :columns=\"['']\"\n      presentational>\n      <OAuth2\n        :environment\n        :eventBus\n        :flows=\"oauth2Target.flows\"\n        hideActions\n        :name=\"oauth2Target.name\"\n        :options\n        :proxyUrl\n        :scheme=\"oauth2Scheme\"\n        :selectedScopes=\"oauth2Target.scopes\"\n        :server\n        :type=\"oauth2Target.flowType\"\n        @delete:scope=\"(event) => handleScopeDelete(oauth2Target!.name, event)\"\n        @update:selectedScopes=\"\n          (event) => handleScopesUpdate(oauth2Target!.name, event)\n        \"\n        @upsert:scope=\"\n          (event) => handleScopeUpsert(oauth2Target!.name, event)\n        \" />\n    </DataTable>\n    <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        size=\"sm\"\n        variant=\"outlined\"\n        @click=\"configModal.hide()\">\n        {{ translate('apiClient.requestAuthTab.cancel') }}\n      </ScalarButton>\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        :loader=\"acquisitionLoader\"\n        size=\"sm\"\n        @click=\"handleConfigAuthorize\">\n        {{ translate('apiClient.requestAuthTab.authorize') }}\n      </ScalarButton>\n    </div>\n  </ScalarModal>\n</template>\n"],"mappings":""}

package/dist/v2/blocks/scalar-auth-selector-block/components/{RequestAuthTab.vue.script.js → RequestAuthTab.vue_vue_type_script_setup_true_lang.js}

@@ -585,4 +585,4 @@ var RequestAuthTab_vue_vue_type_script_setup_true_lang_default = /*@__PURE__*/ d
 //#endregion
 export { RequestAuthTab_vue_vue_type_script_setup_true_lang_default as default };
 
-//# sourceMappingURL=RequestAuthTab.vue.script.js.map
+//# sourceMappingURL=RequestAuthTab.vue_vue_type_script_setup_true_lang.js.map

package/dist/v2/blocks/scalar-auth-selector-block/components/RequestAuthTab.vue_vue_type_script_setup_true_lang.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"RequestAuthTab.vue_vue_type_script_setup_true_lang.js","names":["_openBlock","_createElementBlock","_Fragment","_renderList","_createBlock","_unref","DataTableRow","_withCtx","_createVNode","DataTableCell","_createElementVNode","_toDisplayString","_createCommentVNode","RequestAuthDataTableInput","_createTextVNode","OAuth2Metadata","OpenIDConnect","_normalizeClass","OAuth2","DataTable"],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/components/RequestAuthTab.vue"],"sourcesContent":["<script setup lang=\"ts\">\nimport { ScalarButton } from '@scalar/components/button'\nimport { ScalarIconButton } from '@scalar/components/icon-button'\nimport { useLoadingState } from '@scalar/components/loading'\nimport { ScalarMarkdownSummary } from '@scalar/components/markdown'\nimport { ScalarModal, useModal } from '@scalar/components/modal'\nimport { ScalarIconGear } from '@scalar/icons'\nimport { useToasts } from '@scalar/use-toasts'\nimport type {\n  SecretsApiKey,\n  SecretsHttp,\n} from '@scalar/workspace-store/entities/auth'\nimport type {\n  ApiReferenceEvents,\n  WorkspaceEventBus,\n} from '@scalar/workspace-store/events'\nimport { canResetSecretField } from '@scalar/workspace-store/helpers/auth-secret-fields'\nimport { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref'\nimport {\n  getEnvironmentVariables,\n  type MergedSecuritySchemes,\n  type OAuthFlowsObjectSecret,\n  type SecuritySchemeObjectSecret,\n} from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport { getDocumentTypeLabel } from '@scalar/workspace-store/schemas/type-guards'\nimport type {\n  ApiKeyObject,\n  SecurityRequirementObject,\n  ServerObject,\n} from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { capitalize, computed, ref } from 'vue'\n\nimport { refreshOauth2Token } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { getVisibleOrderedFlowKeys } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth-flows'\nimport {\n  runOAuth2Authorize,\n  storeOAuth2Tokens,\n} from '@/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize'\nimport { getOauth2AcquisitionTarget } from '@/v2/blocks/scalar-auth-selector-block/helpers/security-scheme'\nimport {\n  DataTable,\n  DataTableCell,\n  DataTableRow,\n} from '@/v2/components/data-table'\nimport { useLocalization } from '@/v2/features/localization'\n\nimport OAuth2, { type OAuth2Options } from './OAuth2.vue'\nimport OAuth2Metadata from './OAuth2Metadata.vue'\nimport OpenIDConnect from './OpenIDConnect.vue'\nimport RequestAuthDataTableInput from './RequestAuthDataTableInput.vue'\n\nconst {\n  environment,\n  isStatic,\n  proxyUrl,\n  selectedSecuritySchemas,\n  securitySchemes,\n  server,\n  eventBus,\n  options,\n  documentType = 'openapi',\n} = defineProps<{\n  /** Current environment configuration */\n  environment: XScalarEnvironment\n  /** Controls the display of certain borders which are used when we are non-collapsible */\n  isStatic: boolean\n  /** Proxy URL */\n  proxyUrl: string\n  /** Selected security schemes*/\n  selectedSecuritySchemas: SecurityRequirementObject\n  /** Merged security schemes from the document and the config together with the auth store secrets */\n  securitySchemes: MergedSecuritySchemes\n  /** Current server configuration */\n  server: ServerObject | null\n  /** Event bus for authentication updates */\n  eventBus: WorkspaceEventBus\n  /**  Any config options required for the OAuth2 flow */\n  options?: OAuth2Options\n  /** Type of the document the schemes belong to, used to label the missing-type warning */\n  documentType?: 'openapi' | 'asyncapi'\n}>()\n\nconst emits = defineEmits<{\n  (\n    e: 'update:selectedScopes',\n    payload: Omit<ApiReferenceEvents['auth:update:selected-scopes'], 'meta'>,\n  ): void\n  (e: 'upsert:scope', payload: ApiReferenceEvents['auth:upsert:scopes']): void\n  (e: 'delete:scope', payload: ApiReferenceEvents['auth:delete:scopes']): void\n}>()\n\nconst { translate } = useLocalization()\n\ntype SecurityItem = {\n  scheme: SecuritySchemeObjectSecret | undefined\n  name: string\n  scopes: string[]\n  /** Ordered, non-hidden oauth2/openIdConnect flow keys for this scheme (empty for other types). */\n  visibleFlowKeys: (keyof OAuthFlowsObjectSecret)[]\n}\n\n/**\n * Human-readable name of the document type.\n * Used in the missing-type warning so it points at the correct document\n * (e.g. \"AsyncAPI\") instead of always naming OpenAPI.\n */\nconst documentTypeLabel = computed<string>(() =>\n  getDocumentTypeLabel(documentType),\n)\n\n/**\n * Resolves security schemes from the OpenAPI document and combines them with their selected scopes.\n * Each item includes the scheme definition, name, and associated scopes.\n */\nconst security = computed<SecurityItem[]>(() =>\n  Object.entries(selectedSecuritySchemas).map(([name, scopes = []]) => {\n    const scheme = getResolvedRef(securitySchemes[name])\n    return {\n      scheme,\n      name,\n      scopes,\n      // Compute the visible, ordered flow keys once per scheme so the tabs, the label, and the\n      // active-flow tracking all agree on the same set (and we do not filter + sort on every access).\n      visibleFlowKeys:\n        scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\n          ? getVisibleOrderedFlowKeys(scheme.flows)\n          : [],\n    }\n  }),\n)\n\n/** Tracks which OAuth2 flow is currently active when multiple flows are available. */\nconst activeFlow = ref<string>('')\n\n/**\n * Keeps the selected flow in sync with the currently visible flow keys. Validating against the\n * visible set (not every declared flow) means a selection that becomes hidden — e.g. the document\n * is updated to mark the active flow with `x-scalar-ignore` — resets, so the default (first visible)\n * flow activates instead of leaving no tab selected.\n */\nconst selectedFlow = computed<string>(() => {\n  const visibleFlowKeys = security.value.flatMap((item) => item.visibleFlowKeys)\n\n  return visibleFlowKeys.some((key) => key === activeFlow.value)\n    ? activeFlow.value\n    : ''\n})\n\nconst setActiveFlow = (flow: string): void => {\n  activeFlow.value = flow\n}\n\n/** Determines if multiple auth schemes are configured, which affects the UI layout. */\nconst hasMultipleSchemes = computed<boolean>(() => security.value.length > 1)\n\n/**\n * Generates a human-readable label for the security scheme.\n * Intentionally omits the description here — it is rendered separately as\n * rich text via ScalarMarkdownSummary so markdown formatting is preserved.\n */\nconst generateLabel = (\n  name: string,\n  scheme: SecuritySchemeObjectSecret,\n): string => {\n  const capitalizedName = capitalize(name)\n\n  switch (scheme.type) {\n    case 'apiKey':\n      return `${capitalizedName}: ${scheme.in}`\n\n    case 'openIdConnect':\n    case 'oauth2': {\n      const firstFlow = getVisibleOrderedFlowKeys(scheme.flows)[0]\n      const currentFlow = selectedFlow.value || firstFlow\n      if (!currentFlow) {\n        return capitalizedName\n      }\n      return `${capitalizedName}: ${currentFlow}`\n    }\n\n    case 'http':\n      return `${capitalizedName}: ${scheme.scheme}`\n\n    default:\n      return capitalizedName\n  }\n}\n\n/**\n * Whether an API key scheme exposes an editable parameter name.\n *\n * OpenAPI `apiKey` and AsyncAPI `httpApiKey` (normalized to `apiKey`) name a query/header/cookie\n * parameter, so the Name input is shown. AsyncAPI `apiKey` places the key in the broker `user` or\n * `password` slot and has no parameter name, so the Name input is hidden and only the value is asked for.\n */\nconst apiKeyHasName = (scheme: { in?: string }): boolean =>\n  scheme.in !== 'user' && scheme.in !== 'password'\n\n/**\n * The scheme's type when it is one we do not render inputs for (a type outside both the OpenAPI\n * and AsyncAPI security scheme unions). Read through a helper so the fallback template branch,\n * where the scheme type is narrowed to `never` after the supported cases, can still surface the type.\n */\nconst getUnsupportedSchemeType = (\n  scheme: SecurityItem['scheme'],\n): string | undefined => scheme?.type\n\n/**\n * Determines if an OAuth2 flow tab should be active.\n * The first flow is active by default if no flow is explicitly selected.\n */\nconst isFlowActive = (flowKey: string, index: number): boolean =>\n  selectedFlow.value === flowKey || (index === 0 && !selectedFlow.value)\n\n/** Computes the container class for static display mode. */\nconst getStaticBorderClass = (): string | false => isStatic && 'border-t'\n\nconst handleHttpSecretsUpdate = (\n  payload: Omit<Partial<SecretsHttp>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', ...payload },\n    name,\n  })\n\nconst handleApiKeySecretsUpdate = (\n  payload: Omit<Partial<SecretsApiKey>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Name edits may update the document or a configured override; tokens remain secrets. */\nconst handleApiKeySecuritySchemeUpdate = (\n  payload: Omit<Partial<ApiKeyObject>, 'type'>,\n  name: string,\n): void =>\n  eventBus.emit('auth:update:security-scheme', {\n    payload: { type: 'apiKey', ...payload },\n    name,\n  })\n\n/** Handles scope selection updates for OAuth2 */\nconst handleScopesUpdate = (\n  name: string,\n  event: { scopes?: string[]; scope?: string; selected?: boolean },\n): void => {\n  emits('update:selectedScopes', {\n    id: Object.keys(selectedSecuritySchemas),\n    name,\n    ...event,\n  })\n}\n\n/** Handles scope-definition upserts (add / rename / description change) */\nconst handleScopeUpsert = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:upsert:scopes'], 'name'>,\n): void => {\n  emits('upsert:scope', { ...event, name })\n}\n\n/** Handles scope-definition deletes */\nconst handleScopeDelete = (\n  name: string,\n  event: Omit<ApiReferenceEvents['auth:delete:scopes'], 'name'>,\n): void => {\n  emits('delete:scope', { ...event, name })\n}\n\n/**\n * Computes dynamic classes for OAuth2 flow tabs based on active state.\n */\nconst getFlowTabClasses = (flowKey: string, index: number): string => {\n  const baseClasses =\n    'floating-bg text-c-3 relative cursor-pointer border-b border-transparent py-1 text-base font-medium'\n  const activeClasses = '!text-c-1 !rounded-none border-b !border-current'\n\n  return isFlowActive(flowKey, index)\n    ? `${baseClasses} ${activeClasses} ${isStatic ? 'opacity-100' : ''}`\n    : baseClasses\n}\n\n/**\n * OAuth2 token-acquisition target (an oauth2 scheme with an interactive grant) sourced from\n * the merged schemes. When the active scheme is HTTP bearer, this powers the inline\n * \"Authorize via OAuth2\" shortcut: the flow's bearer token is written onto the bearer scheme,\n * so the panel never switches to oauth2.\n *\n * The shortcut is purely a convenience, so it is offered for any interactive oauth2 scheme —\n * including one that is also independently selectable in the dropdown (e.g. Scalar Galaxy's\n * `oAuth2`). Whether that oauth2 scheme is *hidden* from the dropdown is a separate decision made\n * in the selector; here we only surface the shortcut.\n */\nconst oauth2Target = computed(() => getOauth2AcquisitionTarget(securitySchemes))\n\n/** Resolved oauth2 scheme object, for embedding its config form behind the gear. */\nconst oauth2Scheme = computed(() =>\n  oauth2Target.value\n    ? getResolvedRef(securitySchemes[oauth2Target.value.name])\n    : undefined,\n)\n\nconst acquisitionLoader = useLoadingState()\nconst { toast } = useToasts()\nconst configModal = useModal()\n/** Bearer scheme that opened the config modal, so its Authorize callback targets it. */\nconst configBearerName = ref<string | undefined>()\n\n/** Runs the OAuth2 flow and writes the resulting bearer token onto the bearer scheme. */\nconst handleAcquisitionAuthorize = async (\n  bearerName: string,\n): Promise<void> => {\n  const target = oauth2Target.value\n  if (!target || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error] = await runOAuth2Authorize({\n    eventBus,\n    bearerSchemeName: bearerName,\n    oauth2Name: target.name,\n    flows: target.flows,\n    flowType: target.flowType,\n    scopes: target.scopes,\n    server,\n    proxyUrl,\n    environment,\n    options,\n  })\n  await acquisitionLoader.clear()\n  if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToauthorize'),\n      'error',\n    )\n  }\n}\n\n/** Refreshes the OAuth2 token and rewrites it onto the bearer scheme. */\nconst handleAcquisitionRefresh = async (bearerName: string): Promise<void> => {\n  const target = oauth2Target.value\n  // Only the authorization-code flow carries a refresh token; implicit can't be refreshed.\n  if (target?.flowType !== 'authorizationCode' || acquisitionLoader.isLoading) {\n    return\n  }\n  acquisitionLoader.start()\n  const [error, tokens] = await refreshOauth2Token(\n    target.flows,\n    target.flowType,\n    proxyUrl,\n    server,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n  )\n  await acquisitionLoader.clear()\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, {\n      bearerSchemeName: bearerName,\n      oauth2Name: target.name,\n      flowType: target.flowType,\n      tokens,\n    })\n  } else if (error) {\n    toast(\n      error?.message ?? translate('apiClient.requestAuthTab.failedToRefresh'),\n      'error',\n    )\n  }\n}\n\nconst openAcquisitionConfig = (bearerName: string): void => {\n  configBearerName.value = bearerName\n  configModal.show()\n}\n\n/** Closes the config modal and runs Authorize against the bearer scheme that opened it. */\nconst handleConfigAuthorize = (): void => {\n  const bearerName = configBearerName.value\n  configModal.hide()\n  if (bearerName) {\n    void handleAcquisitionAuthorize(bearerName)\n  }\n}\n</script>\n<template>\n  <template\n    v-for=\"{ scheme, name, scopes, visibleFlowKeys } in security\"\n    :key=\"name\">\n    <!--\n      Header row for AND'ed schemes: label (bold) and description (rich text) are\n      combined.\n    -->\n    <DataTableRow v-if=\"hasMultipleSchemes && scheme\">\n      <DataTableCell\n        :aria-label=\"generateLabel(name, scheme)\"\n        class=\"max-h-[auto]\">\n        <div class=\"bg-b-1 min-w-0 flex-1 px-3 py-1.25\">\n          <p class=\"text-c-1 leading-5.5 font-medium\">\n            {{ generateLabel(name, scheme) }}\n          </p>\n          <ScalarMarkdownSummary\n            v-if=\"scheme.description\"\n            class=\"auth-description text-c-2 w-full\"\n            :value=\"scheme.description\" />\n        </div>\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- Description: shown for single auth schemes with descriptions -->\n    <DataTableRow v-if=\"scheme?.description && !hasMultipleSchemes\">\n      <DataTableCell\n        :aria-label=\"scheme.description\"\n        class=\"max-h-[auto]\">\n        <ScalarMarkdownSummary\n          class=\"auth-description bg-b-1 text-c-2 min-w-0 flex-1 px-3 py-1.25\"\n          :value=\"scheme.description\" />\n      </DataTableCell>\n    </DataTableRow>\n\n    <!-- HTTP Authentication -->\n    <template v-if=\"scheme?.type === 'http'\">\n      <!-- Bearer Token -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer'\">\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          :placeholder=\"translate('apiClient.requestAuthTab.token')\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) => handleHttpSecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.bearerToken') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n\n      <!-- OAuth2 token-acquisition shortcut (shown when an interactive oauth2 flow exists) -->\n      <DataTableRow v-if=\"scheme.scheme === 'bearer' && oauth2Target\">\n        <!--\n          Authorize stays rightmost so it never moves: Refresh only appears once there is a token,\n          and it slots in between the gear and Authorize instead of pushing Authorize aside.\n        -->\n        <div class=\"flex h-8 items-center gap-2 border-t pr-1 pl-3 text-base\">\n          <span class=\"text-c-1 mr-auto\">{{\n            translate('apiClient.requestAuthTab.getAToken')\n          }}</span>\n          <ScalarIconButton\n            class=\"h-6 w-6 p-1.25\"\n            :icon=\"ScalarIconGear\"\n            :label=\"\n              translate('apiClient.requestAuthTab.configure', {\n                name: oauth2Target.name,\n              })\n            \"\n            @click=\"openAcquisitionConfig(name)\" />\n          <ScalarButton\n            v-if=\"\n              scheme['x-scalar-secret-token'] &&\n              oauth2Target.flowType === 'authorizationCode'\n            \"\n            class=\"px-3 py-1\"\n            :disabled=\"acquisitionLoader.isLoading\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"outlined\"\n            @click=\"handleAcquisitionRefresh(name)\">\n            {{ translate('apiClient.requestAuthTab.refresh') }}\n          </ScalarButton>\n          <ScalarButton\n            class=\"text-c-1 px-3 py-1\"\n            :loader=\"acquisitionLoader\"\n            size=\"sm\"\n            type=\"button\"\n            variant=\"gradient\"\n            @click=\"handleAcquisitionAuthorize(name)\">\n            {{\n              translate('apiClient.requestAuthTab.authorizeVia', {\n                name: oauth2Target.name,\n              })\n            }}\n          </ScalarButton>\n        </div>\n      </DataTableRow>\n\n      <!-- HTTP Basic Authentication -->\n      <template v-else-if=\"scheme?.scheme === 'basic'\">\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-username',\n                scheme['x-scalar-secret-username'],\n              )\n            \"\n            class=\"text-c-2\"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-username']\"\n            placeholder=\"janedoe\"\n            required\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-username',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-username': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.username') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n        <DataTableRow>\n          <RequestAuthDataTableInput\n            :canReset=\"\n              canResetSecretField(\n                scheme,\n                'x-scalar-secret-password',\n                scheme['x-scalar-secret-password'],\n              )\n            \"\n            :environment\n            :modelValue=\"scheme['x-scalar-secret-password']\"\n            placeholder=\"********\"\n            type=\"password\"\n            @reset=\"\n              eventBus.emit('auth:reset:security-scheme-secret', {\n                name,\n                field: 'x-scalar-secret-password',\n              })\n            \"\n            @update:modelValue=\"\n              (v) =>\n                handleHttpSecretsUpdate({ 'x-scalar-secret-password': v }, name)\n            \">\n            {{ translate('apiClient.requestAuthTab.password') }}\n          </RequestAuthDataTableInput>\n        </DataTableRow>\n      </template>\n    </template>\n\n    <!-- API Key Authentication -->\n    <template v-else-if=\"scheme?.type === 'apiKey'\">\n      <DataTableRow v-if=\"apiKeyHasName(scheme)\">\n        <RequestAuthDataTableInput\n          :containerClass=\"getStaticBorderClass()\"\n          :environment\n          :modelValue=\"scheme.name ?? ''\"\n          placeholder=\"api-key\"\n          @update:modelValue=\"\n            (v) => handleApiKeySecuritySchemeUpdate({ name: v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.name') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n      <DataTableRow>\n        <RequestAuthDataTableInput\n          :canReset=\"\n            canResetSecretField(\n              scheme,\n              'x-scalar-secret-token',\n              scheme['x-scalar-secret-token'],\n            )\n          \"\n          :containerClass=\"\n            apiKeyHasName(scheme) ? undefined : getStaticBorderClass()\n          \"\n          :environment\n          :modelValue=\"scheme['x-scalar-secret-token']\"\n          placeholder=\"QUxMIFlPVVIgQkFTRSBBUkUgQkVMT05HIFRPIFVT\"\n          type=\"password\"\n          @reset=\"\n            eventBus.emit('auth:reset:security-scheme-secret', {\n              name,\n              field: 'x-scalar-secret-token',\n            })\n          \"\n          @update:modelValue=\"\n            (v) =>\n              handleApiKeySecretsUpdate({ 'x-scalar-secret-token': v }, name)\n          \">\n          {{ translate('apiClient.requestAuthTab.value') }}\n        </RequestAuthDataTableInput>\n      </DataTableRow>\n    </template>\n\n    <!-- OAuth 2.0  / OpenID Connect Authentication -->\n    <template\n      v-else-if=\"scheme?.type === 'oauth2' || scheme?.type === 'openIdConnect'\">\n      <OAuth2Metadata\n        v-if=\"\n          scheme.type === 'oauth2' && (!isStatic || scheme.oauth2MetadataUrl)\n        \"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- OpenID Connect -->\n      <OpenIDConnect\n        v-if=\"scheme?.type === 'openIdConnect' && !visibleFlowKeys.length\"\n        :customFetch=\"options?.customFetch\"\n        :environment\n        :eventBus\n        :getStaticBorderClass\n        :name\n        :proxyUrl\n        :scheme />\n\n      <!-- Flow selector tabs: shown when multiple visible flows are available -->\n      <DataTableRow v-if=\"visibleFlowKeys.length > 1\">\n        <div class=\"flex min-h-8 border-t text-base\">\n          <div class=\"flex h-8 max-w-full gap-2.5 overflow-x-auto px-3\">\n            <button\n              v-for=\"(key, ind) in visibleFlowKeys\"\n              :key=\"key\"\n              :class=\"getFlowTabClasses(key, ind)\"\n              type=\"button\"\n              @click=\"setActiveFlow(key)\">\n              <span class=\"relative z-10\">{{ key }}</span>\n            </button>\n          </div>\n        </div>\n      </DataTableRow>\n\n      <!-- OAuth2 flow configuration -->\n      <template\n        v-for=\"(key, ind) in visibleFlowKeys\"\n        :key=\"key\">\n        <OAuth2\n          v-if=\"scheme.flows && isFlowActive(key, ind)\"\n          :environment\n          :eventBus\n          :flows=\"scheme.flows\"\n          :name\n          :options\n          :proxyUrl\n          :scheme\n          :selectedScopes=\"scopes\"\n          :server\n          :type=\"key\"\n          @delete:scope=\"(event) => handleScopeDelete(name, event)\"\n          @update:selectedScopes=\"(event) => handleScopesUpdate(name, event)\"\n          @upsert:scope=\"(event) => handleScopeUpsert(name, event)\" />\n      </template>\n    </template>\n\n    <!-- Browser WebSocket connections cannot apply these broker credentials. -->\n    <div\n      v-else-if=\"\n        scheme?.type === 'userPassword' ||\n        scheme?.type === 'plain' ||\n        scheme?.type === 'scramSha256' ||\n        scheme?.type === 'scramSha512' ||\n        scheme?.type === 'X509' ||\n        scheme?.type === 'symmetricEncryption' ||\n        scheme?.type === 'asymmetricEncryption' ||\n        scheme?.type === 'gssapi'\n      \"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.unsupportedCredentials') }}\n    </div>\n\n    <!-- Mutual TLS credentials are chosen during the browser-managed TLS handshake. -->\n    <div\n      v-else-if=\"scheme?.type === 'mutualTLS'\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{ translate('apiClient.requestAuthTab.mutualTlsHint') }}\n    </div>\n\n    <!-- Scheme has a type we do not render inputs for -->\n    <div\n      v-else-if=\"getUnsupportedSchemeType(scheme)\"\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.unsupportedType', {\n          type: getUnsupportedSchemeType(scheme) ?? '',\n        })\n      }}\n    </div>\n\n    <!-- Scheme is missing type -->\n    <div\n      v-else\n      class=\"text-c-3 flex items-center justify-center border-t p-4 px-4 text-center text-xs text-balance\">\n      {{\n        translate('apiClient.requestAuthTab.missingType', {\n          type: documentTypeLabel,\n        })\n      }}\n    </div>\n  </template>\n\n  <!-- OAuth2 configuration modal (opened from the bearer scheme's gear) -->\n  <ScalarModal\n    v-if=\"oauth2Target && oauth2Scheme\"\n    size=\"sm\"\n    :state=\"configModal\"\n    :title=\"\n      translate('apiClient.requestAuthTab.configure', {\n        name: oauth2Target.name,\n      })\n    \">\n    <DataTable\n      :columns=\"['']\"\n      presentational>\n      <OAuth2\n        :environment\n        :eventBus\n        :flows=\"oauth2Target.flows\"\n        hideActions\n        :name=\"oauth2Target.name\"\n        :options\n        :proxyUrl\n        :scheme=\"oauth2Scheme\"\n        :selectedScopes=\"oauth2Target.scopes\"\n        :server\n        :type=\"oauth2Target.flowType\"\n        @delete:scope=\"(event) => handleScopeDelete(oauth2Target!.name, event)\"\n        @update:selectedScopes=\"\n          (event) => handleScopesUpdate(oauth2Target!.name, event)\n        \"\n        @upsert:scope=\"\n          (event) => handleScopeUpsert(oauth2Target!.name, event)\n        \" />\n    </DataTable>\n    <div class=\"flex h-8 items-center justify-end gap-2 border-t\">\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        size=\"sm\"\n        variant=\"outlined\"\n        @click=\"configModal.hide()\">\n        {{ translate('apiClient.requestAuthTab.cancel') }}\n      </ScalarButton>\n      <ScalarButton\n        class=\"p-0 px-2 py-0.5\"\n        :loader=\"acquisitionLoader\"\n        size=\"sm\"\n        @click=\"handleConfigAuthorize\">\n        {{ translate('apiClient.requestAuthTab.authorize') }}\n      </ScalarButton>\n    </div>\n  </ScalarModal>\n</template>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmFA,MAAM,QAAQ;EASd,MAAM,EAAE,cAAc,gBAAgB;EAetC,MAAM,oBAAoB,eACxB,qBAAqB,QAAA,YAAY,CACnC;;;;;EAMA,MAAM,WAAW,eACf,OAAO,QAAQ,QAAA,uBAAuB,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC,OAAO;GACnE,MAAM,SAAS,eAAe,QAAA,gBAAgB,KAAK;GACnD,OAAO;IACL;IACA;IACA;IAGA,iBACE,QAAQ,SAAS,YAAY,QAAQ,SAAS,kBAC1C,0BAA0B,OAAO,KAAK,IACtC,CAAC;GACT;EACF,CAAC,CACH;;EAGA,MAAM,aAAa,IAAY,EAAE;;;;;;;EAQjC,MAAM,eAAe,eAAuB;GAG1C,OAFwB,SAAS,MAAM,SAAS,SAAS,KAAK,eAEvD,CAAA,CAAgB,MAAM,QAAQ,QAAQ,WAAW,KAAK,IACzD,WAAW,QACX;EACN,CAAC;EAED,MAAM,iBAAiB,SAAuB;GAC5C,WAAW,QAAQ;EACrB;;EAGA,MAAM,qBAAqB,eAAwB,SAAS,MAAM,SAAS,CAAC;;;;;;EAO5E,MAAM,iBACJ,MACA,WACW;GACX,MAAM,kBAAkB,WAAW,IAAI;GAEvC,QAAQ,OAAO,MAAf;IACE,KAAK,UACH,OAAO,GAAG,gBAAgB,IAAI,OAAO;IAEvC,KAAK;IACL,KAAK,UAAU;KACb,MAAM,YAAY,0BAA0B,OAAO,KAAK,CAAC,CAAC;KAC1D,MAAM,cAAc,aAAa,SAAS;KAC1C,IAAI,CAAC,aACH,OAAO;KAET,OAAO,GAAG,gBAAgB,IAAI;IAChC;IAEA,KAAK,QACH,OAAO,GAAG,gBAAgB,IAAI,OAAO;IAEvC,SACE,OAAO;GACX;EACF;;;;;;;;EASA,MAAM,iBAAiB,WACrB,OAAO,OAAO,UAAU,OAAO,OAAO;;;;;;EAOxC,MAAM,4BACJ,WACuB,QAAQ;;;;;EAMjC,MAAM,gBAAgB,SAAiB,UACrC,aAAa,UAAU,WAAY,UAAU,KAAK,CAAC,aAAa;;EAGlE,MAAM,6BAA6C,QAAA,YAAY;EAE/D,MAAM,2BACJ,SACA,SAEA,QAAA,SAAS,KAAK,uCAAuC;GACnD,SAAS;IAAE,MAAM;IAAQ,GAAG;GAAQ;GACpC;EACF,CAAC;EAEH,MAAM,6BACJ,SACA,SAEA,QAAA,SAAS,KAAK,uCAAuC;GACnD,SAAS;IAAE,MAAM;IAAU,GAAG;GAAQ;GACtC;EACF,CAAC;;EAGH,MAAM,oCACJ,SACA,SAEA,QAAA,SAAS,KAAK,+BAA+B;GAC3C,SAAS;IAAE,MAAM;IAAU,GAAG;GAAQ;GACtC;EACF,CAAC;;EAGH,MAAM,sBACJ,MACA,UACS;GACT,MAAM,yBAAyB;IAC7B,IAAI,OAAO,KAAK,QAAA,uBAAuB;IACvC;IACA,GAAG;GACL,CAAC;EACH;;EAGA,MAAM,qBACJ,MACA,UACS;GACT,MAAM,gBAAgB;IAAE,GAAG;IAAO;GAAK,CAAC;EAC1C;;EAGA,MAAM,qBACJ,MACA,UACS;GACT,MAAM,gBAAgB;IAAE,GAAG;IAAO;GAAK,CAAC;EAC1C;;;;EAKA,MAAM,qBAAqB,SAAiB,UAA0B;GACpE,MAAM,cACJ;GAGF,OAAO,aAAa,SAAS,KAAK,IAC9B,GAAG,YAAY,oDAAoB,QAAA,WAAW,gBAAgB,OAC9D;EACN;;;;;;;;;;;;EAaA,MAAM,eAAe,eAAe,2BAA2B,QAAA,eAAe,CAAC;;EAG/E,MAAM,eAAe,eACnB,aAAa,QACT,eAAe,QAAA,gBAAgB,aAAa,MAAM,KAAK,IACvD,KAAA,CACN;EAEA,MAAM,oBAAoB,gBAAgB;EAC1C,MAAM,EAAE,UAAU,UAAU;EAC5B,MAAM,cAAc,SAAS;;EAE7B,MAAM,mBAAmB,IAAwB;;EAGjD,MAAM,6BAA6B,OACjC,eACkB;GAClB,MAAM,SAAS,aAAa;GAC5B,IAAI,CAAC,UAAU,kBAAkB,WAC/B;GAEF,kBAAkB,MAAM;GACxB,MAAM,CAAC,SAAS,MAAM,mBAAmB;IACvC,UAAO,QAAA;IACP,kBAAkB;IAClB,YAAY,OAAO;IACnB,OAAO,OAAO;IACd,UAAU,OAAO;IACjB,QAAQ,OAAO;IACf,QAAK,QAAA;IACL,UAAO,QAAA;IACP,aAAU,QAAA;IACV,SAAM,QAAA;GACR,CAAC;GACD,MAAM,kBAAkB,MAAM;GAC9B,IAAI,OACF,MACE,OAAO,WAAW,UAAU,4CAA4C,GACxE,OACF;EAEJ;;EAGA,MAAM,2BAA2B,OAAO,eAAsC;GAC5E,MAAM,SAAS,aAAa;GAE5B,IAAI,QAAQ,aAAa,uBAAuB,kBAAkB,WAChE;GAEF,kBAAkB,MAAM;GACxB,MAAM,CAAC,OAAO,UAAU,MAAM,mBAC5B,OAAO,OACP,OAAO,UACP,QAAA,UACA,QAAA,QACA,wBAAwB,QAAA,WAAW,GACnC,QAAA,SAAS,WACX;GACA,MAAM,kBAAkB,MAAM;GAC9B,IAAI,QAAQ,aACV,kBAAkB,QAAA,UAAU;IAC1B,kBAAkB;IAClB,YAAY,OAAO;IACnB,UAAU,OAAO;IACjB;GACF,CAAC;QACI,IAAI,OACT,MACE,OAAO,WAAW,UAAU,0CAA0C,GACtE,OACF;EAEJ;EAEA,MAAM,yBAAyB,eAA6B;GAC1D,iBAAiB,QAAQ;GACzB,YAAY,KAAK;EACnB;;EAGA,MAAM,8BAAoC;GACxC,MAAM,aAAa,iBAAiB;GACpC,YAAY,KAAK;GACjB,IAAI,YACF,2BAAgC,UAAU;EAE9C;;G,yDAGEA,UAAA,IAAA,GAAAC,mBAkUWC,UAAA,MAAAC,WAjU2C,SAAA,QAAQ,EAAnD,QAAQ,MAAM,QAAQ,sBAAe;IACxC,OAAAH,UAAA,GAAAC,mBAAAC,UAAA,EAAA,KAAA,KAAI,GAAA;KAKU,mBAAA,SAAsB,UAA1CF,UAAA,GAAAI,YAceC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;MAbb,SAAAC,cAYgB,CAZhBC,YAYgBH,MAAAI,qBAAA,GAAA;OAXb,cAAY,cAAc,MAAM,MAAM;OACvC,OAAM;;OACN,SAAAF,cAQM,CARNG,mBAQM,OARN,YAQM,CAPJA,mBAEI,KAFJ,YAEIC,gBADC,cAAc,MAAM,MAAM,CAAA,GAAA,CAAA,GAGvB,OAAO,eADfX,UAAA,GAAAI,YAGgCC,MAAA,qBAAA,GAAA;;QAD9B,OAAM;QACL,OAAO,OAAO;;;;;;KAMH,QAAQ,eAAW,CAAK,mBAAA,SAA5CL,UAAA,GAAAI,YAQeC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;MAPb,SAAAC,cAMgB,CANhBC,YAMgBH,MAAAI,qBAAA,GAAA;OALb,cAAY,OAAO;OACpB,OAAM;;OACN,SAAAF,cAEgC,CAFhCC,YAEgCH,MAAA,qBAAA,GAAA;QAD9B,OAAM;QACL,OAAO,OAAO;;;;;;KAKL,QAAQ,SAAI,UAA5BL,UAAA,GAAAC,mBAqIWC,UAAA,EAAA,KAAA,EAAA,GAAA,CAnIW,OAAO,WAAM,YAAjCF,UAAA,GAAAI,YAyBeC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;MAxBb,SAAAC,cAuB4B,CAvB5BC,YAuB4BK,mCAAA;OAtBzB,UAAuBR,MAAA,mBAAA,CAAmB,CAAgB,Q,yBAA6D,OAAM,wB;OAO7H,gBAAgB,qBAAoB;OACpC,aAAA,QAAA;OACA,YAAY,OAAM;OAClB,aAAaA,MAAA,SAAA,CAAS,CAAA,gCAAA;OACvB,MAAK;OACJ,UAAK,WAAe,QAAA,SAAS,KAAI,qCAAA;QAAsD;;;OAMvF,wBAAiC,MAAM,wBAAuB,EAAA,yBAA4B,EAAC,GAAI,IAAI;;OAGpG,SAAAE,cAAuD,CAApDO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,sCAAA,CAAA,GAAA,CAAA,C;;;;;;;;;;;;K,0CAKI,OAAO,WAAM,YAAiB,aAAA,SAAlDL,UAAA,GAAAI,YA6CeC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;MAxCb,SAAAC,cAuCM,CAvCNG,mBAuCM,OAvCN,YAuCM;OAtCJA,mBAES,QAFT,YAESC,gBADPN,MAAA,SAAA,CAAS,CAAA,oCAAA,CAAA,GAAA,CAAA;OAEXG,YAQyCH,MAAA,gBAAA,GAAA;QAPvC,OAAM;QACL,MAAMA,MAAA,cAAA;QACN,OAAsBA,MAAA,SAAA,CAAS,CAAA,sCAAA,EAA+D,MAAA,aAAA,MAAa,K;QAK3G,UAAK,WAAE,sBAAsB,IAAI;;;;;;OAEb,OAAM,4BAA2C,aAAA,MAAa,aAAQ,uBAD7FL,UAAA,GAAAI,YAYeC,MAAA,YAAA,GAAA;;QAPb,OAAM;QACL,UAAUA,MAAA,iBAAA,CAAiB,CAAC;QAC7B,MAAK;QACL,MAAK;QACL,SAAQ;QACP,UAAK,WAAE,yBAAyB,IAAI;;QACrC,SAAAE,cAAmD,CAAhDO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,kCAAA,CAAA,GAAA,CAAA,C;;;OAEdG,YAYeH,MAAA,YAAA,GAAA;QAXb,OAAM;QACL,QAAQA,MAAA,iBAAA;QACT,MAAK;QACL,MAAK;QACL,SAAQ;QACP,UAAK,WAAE,2BAA2B,IAAI;;QACvC,SAAAE,cAIE,CAHAO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,yCAAA,EAAkE,MAAA,aAAA,MAAa,K;;;;;K,YAS3E,QAAQ,WAAM,WAAnCL,UAAA,GAAAC,mBAsDWC,UAAA,EAAA,KAAA,EAAA,GAAA,CArDTM,YA0BeH,MAAAC,oBAAA,GAAA,MAAA;MAzBb,SAAAC,cAwB4B,CAxB5BC,YAwB4BK,mCAAA;OAvBzB,UAAyBR,MAAA,mBAAA,CAAmB,CAAkB,Q,4BAAoE,OAAM,2B;OAOzI,OAAM;OACL,aAAA,QAAA;OACA,YAAY,OAAM;OACnB,aAAY;OACZ,UAAA;OACC,UAAK,WAAiB,QAAA,SAAS,KAAI,qCAAA;QAAwD;;;OAM3F,wBAAmC,MAAsB,wBAAuB,EAAA,4BAA+B,EAAC,GAAI,IAAI;;OAIzH,SAAAE,cAAoD,CAAjDO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,mCAAA,CAAA,GAAA,CAAA,C;;;;;;;;;;K,UAGhBG,YAyBeH,MAAAC,oBAAA,GAAA,MAAA;MAxBb,SAAAC,cAuB4B,CAvB5BC,YAuB4BK,mCAAA;OAtBzB,UAAyBR,MAAA,mBAAA,CAAmB,CAAkB,Q,4BAAoE,OAAM,2B;OAOxI,aAAA,QAAA;OACA,YAAY,OAAM;OACnB,aAAY;OACZ,MAAK;OACJ,UAAK,WAAiB,QAAA,SAAS,KAAI,qCAAA;QAAwD;;;OAM3F,wBAAmC,MAAsB,wBAAuB,EAAA,4BAA+B,EAAC,GAAI,IAAI;;OAIzH,SAAAE,cAAoD,CAAjDO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,mCAAA,CAAA,GAAA,CAAA,C;;;;;;;;;;K,wDAOC,QAAQ,SAAI,YAAjCL,UAAA,GAAAC,mBA0CWC,UAAA,EAAA,KAAA,EAAA,GAAA,CAzCW,cAAc,MAAM,KAAxCF,UAAA,GAAAI,YAWeC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;MAVb,SAAAC,cAS4B,CAT5BC,YAS4BK,mCAAA;OARzB,gBAAgB,qBAAoB;OACpC,aAAA,QAAA;OACA,YAAY,OAAO,QAAI;OACxB,aAAY;OACX,wBAAiC,MAAM,iCAAgC,EAAA,MAAS,EAAC,GAAI,IAAI;;OAG1F,SAAAN,cAAgD,CAA7CO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,+BAAA,CAAA,GAAA,CAAA,C;;;;;;;;;K,0CAGhBG,YA4BeH,MAAAC,oBAAA,GAAA,MAAA;MA3Bb,SAAAC,cA0B4B,CA1B5BC,YA0B4BK,mCAAA;OAzBzB,UAAuBR,MAAA,mBAAA,CAAmB,CAAgB,Q,yBAA6D,OAAM,wB;OAO7H,gBAA6B,cAAc,MAAM,IAAI,KAAA,IAAY,qBAAoB;OAGrF,aAAA,QAAA;OACA,YAAY,OAAM;OACnB,aAAY;OACZ,MAAK;OACJ,UAAK,WAAe,QAAA,SAAS,KAAI,qCAAA;QAAsD;;;OAMvF,wBAAiC,MAAoB,0BAAyB,EAAA,yBAA4B,EAAC,GAAI,IAAI;;OAIpH,SAAAE,cAAiD,CAA9CO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,gCAAA,CAAA,GAAA,CAAA,C;;;;;;;;;;;K,kBAOL,QAAQ,SAAI,YAAiB,QAAQ,SAAI,mBADtDL,UAAA,GAAAC,mBA4DWC,UAAA,EAAA,KAAA,EAAA,GAAA;MAzDU,OAAO,SAAI,aAAA,CAAmB,QAAA,YAAY,OAAO,sBADpEF,UAAA,GAAAI,YASYW,wBAAA;;OALT,aAAa,QAAA,SAAS;OACtB,aAAA,QAAA;OACA,UAAA,QAAA;OACA;OACA,UAAA,QAAA;OACA;;;;;;;;;MAIK,QAAQ,SAAI,mBAAA,CAAyB,gBAAgB,UAD7Df,UAAA,GAAAI,YAQYY,uBAAA;;OANT,aAAa,QAAA,SAAS;OACtB,aAAA,QAAA;OACA,UAAA,QAAA;OACA;OACA;OACA,UAAA,QAAA;OACA;;;;;;;;;MAGiB,gBAAgB,SAAM,KAA1ChB,UAAA,GAAAI,YAaeC,MAAAC,oBAAA,GAAA,EAAA,KAAA,EAAA,GAAA;OAZb,SAAAC,cAWM,CAXNG,mBAWM,OAXN,YAWM,CAVJA,mBASM,OATN,YASM,EARJV,UAAA,IAAA,GAAAC,mBAOSC,UAAA,MAAAC,WANc,kBAAb,KAAK,QAAG;QADlB,OAAAH,UAAA,GAAAC,mBAOS,UAAA;SALD;SACL,OAAKgB,eAAE,kBAAkB,KAAK,GAAG,CAAA;SAClC,MAAK;SACJ,UAAK,WAAE,cAAc,GAAG;Q,IACzBP,mBAA4C,QAA5C,YAA4CC,gBAAb,GAAG,GAAA,CAAA,C;;;;OAO1CX,UAAA,IAAA,GAAAC,mBAkBWC,UAAA,MAAAC,WAjBY,kBAAb,KAAK,QAAG;OACV,OAAAH,UAAA,GAAAC,mBAAAC,UAAA,EAAA,IAAG,GAAA,CAED,OAAO,SAAS,aAAa,KAAK,GAAG,KAD7CF,UAAA,GAAAI,YAc8Dc,gBAAA;;QAZ3D,aAAA,QAAA;QACA,UAAA,QAAA;QACA,OAAO,OAAO;QACd;QACA,SAAA,QAAA;QACA,UAAA,QAAA;QACA;QACA,gBAAgB;QAChB,QAAA,QAAA;QACA,MAAM;QACN,mBAAe,UAAU,kBAAkB,MAAM,KAAK;QACtD,4BAAwB,UAAU,mBAAmB,MAAM,KAAK;QAChE,mBAAe,UAAU,kBAAkB,MAAM,KAAK;;;;;;;;;;;;;;;;;K,UAMvC,QAAQ,SAAI,kBAA+B,QAAQ,SAAI,WAAwB,QAAQ,SAAI,iBAA8B,QAAQ,SAAI,iBAA8B,QAAQ,SAAI,UAAuB,QAAQ,SAAI,yBAAsC,QAAQ,SAAI,0BAAuC,QAAQ,SAAI,YAD7UlB,UAAA,GAAAC,mBAaM,OAbN,YAaMU,gBADDN,MAAA,SAAA,CAAS,CAAA,iDAAA,CAAA,GAAA,CAAA,KAKD,QAAQ,SAAI,eADzBL,UAAA,GAAAC,mBAIM,OAJN,aAIMU,gBADDN,MAAA,SAAA,CAAS,CAAA,wCAAA,CAAA,GAAA,CAAA,KAKD,yBAAyB,MAAM,KAD5CL,UAAA,GAAAC,mBAQM,OARN,aAQMU,gBAJFN,MAAA,SAAA,CAAS,CAAA,4CAAA,EAA+D,MAAA,yBAAyB,MAAM,KAAA,G,YAO3GL,UAAA,GAAAC,mBAQM,OARN,aAQMU,gBAJFN,MAAA,SAAA,CAAS,CAAA,wCAAA,EAA2D,MAAA,kBAAA,M;;G,WASlE,aAAA,SAAgB,aAAA,SADxBL,UAAA,GAAAI,YAgDcC,MAAA,WAAA,GAAA;;IA9CZ,MAAK;IACJ,OAAOA,MAAA,WAAA;IACP,OAAcA,MAAA,SAAA,CAAS,CAAA,sCAAA,EAAuD,MAAA,aAAA,MAAa,K;;IAK5F,SAAAE,cAsBY,CAtBZC,YAsBYH,MAAAc,iBAAA,GAAA;KArBT,SAAS,CAAA,EAAA;KACV,gBAAA;;KACA,SAAAZ,cAkBM,CAlBNC,YAkBMU,gBAAA;MAjBH,aAAA,QAAA;MACA,UAAA,QAAA;MACA,OAAO,aAAA,MAAa;MACrB,aAAA;MACC,MAAM,aAAA,MAAa;MACnB,SAAA,QAAA;MACA,UAAA,QAAA;MACA,QAAQ,aAAA;MACR,gBAAgB,aAAA,MAAa;MAC7B,QAAA,QAAA;MACA,MAAM,aAAA,MAAa;MACnB,kBAAY,OAAA,OAAA,OAAA,MAAG,UAAU,kBAAkB,aAAA,MAAc,MAAM,KAAK;MACpE,2BAAqB,OAAA,OAAA,OAAA,MAAc,UAAU,mBAAmB,aAAA,MAAc,MAAM,KAAK;MAGzF,kBAAY,OAAA,OAAA,OAAA,MAAc,UAAU,kBAAkB,aAAA,MAAc,MAAM,KAAK;;;;;;;;;;;;;;I,IAIpFR,mBAeM,OAfN,aAeM,CAdJF,YAMeH,MAAA,YAAA,GAAA;KALb,OAAM;KACN,MAAK;KACL,SAAQ;KACP,SAAK,OAAA,OAAA,OAAA,MAAA,WAAEA,MAAA,WAAA,CAAW,CAAC,KAAI;;KACxB,SAAAE,cAAkD,CAA/CO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,iCAAA,CAAA,GAAA,CAAA,C;;I,IAEdG,YAMeH,MAAA,YAAA,GAAA;KALb,OAAM;KACL,QAAQA,MAAA,iBAAA;KACT,MAAK;KACJ,SAAO;;KACR,SAAAE,cAAqD,CAAlDO,gBAAAH,gBAAAN,MAAA,SAAA,CAAS,CAAA,oCAAA,CAAA,GAAA,CAAA,C"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
-import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import type { CustomFetch } from '../../operation-block/helpers/send-request.js';
 import { type OpenIDConnectDiscovery as AuthorizationServerMetadata } from './fetch-openid-connect-discovery.js';
 /** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */
 export declare const fetchOAuth2Metadata: (url: string, proxyUrl: string, customFetch?: CustomFetch) => Promise<ErrorResponse<AuthorizationServerMetadata>>;

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"fetch-oauth2-metadata.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { isAllowedOAuthUrl } from '@scalar/helpers/url/is-allowed-oauth-url'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n// RFC 8414 and OIDC share these consumed fields; this alias does not imply OIDC issuer semantics.\nimport {\n  type OpenIDConnectDiscovery as AuthorizationServerMetadata,\n  OpenIDConnectDiscoverySchema as AuthorizationServerMetadataSchema,\n} from './fetch-openid-connect-discovery'\n\n/** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */\nexport const fetchOAuth2Metadata = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<AuthorizationServerMetadata>> => {\n  try {\n    const metadataUrl = new URL(url.trim())\n    if (!isAllowedOAuthUrl(metadataUrl)) {\n      return [new Error('OAuth2 metadata URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n    const response = await customFetch(redirectToProxy(proxyUrl, metadataUrl.href))\n    if (!response.ok) {\n      return [new Error(`Failed to fetch OAuth2 metadata: ${response.status} ${response.statusText}`), null]\n    }\n    const data = coerceValue(AuthorizationServerMetadataSchema, await response.json())\n    if (!data.authorization_endpoint && !data.token_endpoint && !data.device_authorization_endpoint) {\n      return [new Error('Invalid OAuth2 metadata: missing or invalid endpoints'), null]\n    }\n    for (const endpoint of [data.authorization_endpoint, data.token_endpoint, data.device_authorization_endpoint]) {\n      if (endpoint && !isAllowedOAuthUrl(new URL(endpoint))) {\n        return [new Error('OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs'), null]\n      }\n    }\n    return [null, data]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to fetch OAuth2 metadata'), null]\n  }\n}\n"],"mappings":";;;;;;AAcA,IAAa,sBAAsB,OACjC,KACA,UACA,cAA2B,UAC6B;CACxD,IAAI;EACF,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC;EACtC,IAAI,CAAC,kBAAkB,WAAW,GAChC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAElG,MAAM,WAAW,MAAM,YAAY,gBAAgB,UAAU,YAAY,IAAI,CAAC;EAC9E,IAAI,CAAC,SAAS,IACZ,OAAO,iBAAC,IAAI,MAAM,oCAAoC,SAAS,OAAO,GAAG,SAAS,YAAY,GAAG,IAAI;EAEvG,MAAM,OAAO,YAAY,8BAAmC,MAAM,SAAS,KAAK,CAAC;EACjF,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,kBAAkB,CAAC,KAAK,+BAChE,OAAO,iBAAC,IAAI,MAAM,uDAAuD,GAAG,IAAI;EAElF,KAAK,MAAM,YAAY;GAAC,KAAK;GAAwB,KAAK;GAAgB,KAAK;EAA6B,GAC1G,IAAI,YAAY,CAAC,kBAAkB,IAAI,IAAI,QAAQ,CAAC,GAClD,OAAO,iBAAC,IAAI,MAAM,6EAA6E,GAAG,IAAI;EAG1G,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,iCAAiC,GAAG,IAAI;CAC7F;AACF"}
+{"version":3,"file":"fetch-oauth2-metadata.js","names":["AuthorizationServerMetadataSchema"],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/fetch-oauth2-metadata.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { isAllowedOAuthUrl } from '@scalar/helpers/url/is-allowed-oauth-url'\nimport { redirectToProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\n// RFC 8414 and OIDC share these consumed fields; this alias does not imply OIDC issuer semantics.\nimport {\n  type OpenIDConnectDiscovery as AuthorizationServerMetadata,\n  OpenIDConnectDiscoverySchema as AuthorizationServerMetadataSchema,\n} from './fetch-openid-connect-discovery'\n\n/** Fetches the exact RFC8414 metadata URL, without applying OIDC issuer URL conventions. */\nexport const fetchOAuth2Metadata = async (\n  url: string,\n  proxyUrl: string,\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<AuthorizationServerMetadata>> => {\n  try {\n    const metadataUrl = new URL(url.trim())\n    if (!isAllowedOAuthUrl(metadataUrl)) {\n      return [new Error('OAuth2 metadata URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n    const response = await customFetch(redirectToProxy(proxyUrl, metadataUrl.href))\n    if (!response.ok) {\n      return [new Error(`Failed to fetch OAuth2 metadata: ${response.status} ${response.statusText}`), null]\n    }\n    const data = coerceValue(AuthorizationServerMetadataSchema, await response.json())\n    if (!data.authorization_endpoint && !data.token_endpoint && !data.device_authorization_endpoint) {\n      return [new Error('Invalid OAuth2 metadata: missing or invalid endpoints'), null]\n    }\n    for (const endpoint of [data.authorization_endpoint, data.token_endpoint, data.device_authorization_endpoint]) {\n      if (endpoint && !isAllowedOAuthUrl(new URL(endpoint))) {\n        return [new Error('OAuth2 metadata endpoints must use HTTPS or HTTP for local development URLs'), null]\n      }\n    }\n    return [null, data]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to fetch OAuth2 metadata'), null]\n  }\n}\n"],"mappings":";;;;;;AAcA,IAAa,sBAAsB,OACjC,KACA,UACA,cAA2B,UAC6B;CACxD,IAAI;EACF,MAAM,cAAc,IAAI,IAAI,IAAI,KAAK,CAAC;EACtC,IAAI,CAAC,kBAAkB,WAAW,GAChC,OAAO,iBAAC,IAAI,MAAM,uEAAuE,GAAG,IAAI;EAElG,MAAM,WAAW,MAAM,YAAY,gBAAgB,UAAU,YAAY,IAAI,CAAC;EAC9E,IAAI,CAAC,SAAS,IACZ,OAAO,iBAAC,IAAI,MAAM,oCAAoC,SAAS,OAAO,GAAG,SAAS,YAAY,GAAG,IAAI;EAEvG,MAAM,OAAO,YAAYA,8BAAmC,MAAM,SAAS,KAAK,CAAC;EACjF,IAAI,CAAC,KAAK,0BAA0B,CAAC,KAAK,kBAAkB,CAAC,KAAK,+BAChE,OAAO,iBAAC,IAAI,MAAM,uDAAuD,GAAG,IAAI;EAElF,KAAK,MAAM,YAAY;GAAC,KAAK;GAAwB,KAAK;GAAgB,KAAK;EAA6B,GAC1G,IAAI,YAAY,CAAC,kBAAkB,IAAI,IAAI,QAAQ,CAAC,GAClD,OAAO,iBAAC,IAAI,MAAM,6EAA6E,GAAG,IAAI;EAG1G,OAAO,CAAC,MAAM,IAAI;CACpB,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,wBAAQ,IAAI,MAAM,iCAAiC,GAAG,IAAI;CAC7F;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/fetch-openid-connect-discovery.d.ts

@@ -1,6 +1,6 @@
 import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import { type Static } from '@scalar/typebox';
-import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import type { CustomFetch } from '../../operation-block/helpers/send-request.js';
 /**
  * OpenID Connect Discovery Document (subset)
  * Represents the metadata fields consumed by the auth selector flow conversion.

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth-device-authorization.d.ts

@@ -1,7 +1,7 @@
 import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import type { OAuthFlowDeviceAuthorizationSecret } from '@scalar/workspace-store/request-example';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
-import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import type { CustomFetch } from '../../operation-block/helpers/send-request.js';
 import { type OAuth2Tokens } from './oauth.js';
 /** Information the user needs to approve a device without exposing the device code. */
 export type DeviceAuthorizationPrompt = {

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.d.ts

@@ -1,7 +1,7 @@
 import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error';
 import type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
-import type { CustomFetch } from '../../../../v2/blocks/operation-block/helpers/send-request.js';
+import type { CustomFetch } from '../../operation-block/helpers/send-request.js';
 import { type DeviceAuthorizationOptions } from './oauth-device-authorization.js';
 type ActiveServerBase = {
     basePath: string;

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js

@@ -90,11 +90,13 @@ var authorizeOauth2 = async (flows, type, selectedScopes, activeServer, proxyUrl
 			}
 		}
 		const typedFlow = flows[type];
-		if (!captureCallback) if (typedFlow["x-scalar-secret-redirect-uri"].startsWith("/")) {
-			const baseUrl = getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname;
-			const redirectUri = new URL(typedFlow["x-scalar-secret-redirect-uri"], baseUrl).toString();
-			url.searchParams.set("redirect_uri", redirectUri);
-		} else url.searchParams.set("redirect_uri", typedFlow["x-scalar-secret-redirect-uri"]);
+		if (!captureCallback) {
+			if (typedFlow["x-scalar-secret-redirect-uri"].startsWith("/")) {
+				const baseUrl = getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname;
+				const redirectUri = new URL(typedFlow["x-scalar-secret-redirect-uri"], baseUrl).toString();
+				url.searchParams.set("redirect_uri", redirectUri);
+			} else url.searchParams.set("redirect_uri", typedFlow["x-scalar-secret-redirect-uri"]);
+		}
 		if (flow["x-scalar-security-query"]) Object.keys(flow["x-scalar-security-query"]).forEach((key) => {
 			const value = flow["x-scalar-security-query"]?.[key];
 			if (!value) return;

package/dist/v2/blocks/scalar-auth-selector-block/helpers/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isAllowedOAuthUrl } from '@scalar/helpers/url/is-allowed-oauth-url'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\nimport { oauthClientAuthorization } from './oauth-client-authorization'\nimport { type DeviceAuthorizationOptions, authorizeDevice } from './oauth-device-authorization'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/**\n * Captures the OAuth2 redirect for environments where the browser-popup polling\n * approach cannot work (notably the Electron desktop app, where the renderer\n * runs on `file://` and providers reject `file://` redirect URIs).\n *\n * The implementation opens the authorization URL in the system browser and\n * resolves once the provider redirects back. Because the redirect target (for\n * example an ephemeral loopback port) is only known to the host environment, the\n * implementation appends the `redirect_uri` itself and reports back the exact\n * value it used so the token exchange can send the matching `redirect_uri`.\n */\nexport type CaptureOAuth2Callback = (params: {\n  /** The fully built authorization URL, without a `redirect_uri` parameter. */\n  authorizationUrl: string\n}) => Promise<\n  ErrorResponse<{\n    /** The full callback URL the provider redirected to, including query and/or hash params. */\n    callbackUrl: string\n    /** The `redirect_uri` the host environment used, so the token exchange can match it. */\n    redirectUri: string\n  }>\n>\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n  /**\n   * Optional redirect capture for interactive flows (authorization code and implicit).\n   * When provided, the system browser plus a host-owned redirect target replaces the\n   * default popup-polling approach. Required for the Electron desktop app.\n   */\n  captureCallback?: CaptureOAuth2Callback,\n  deviceOptions?: DeviceAuthorizationOptions,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    if (type === 'deviceAuthorization' && flows.deviceAuthorization) {\n      return authorizeDevice(\n        flows.deviceAuthorization,\n        selectedScopes,\n        activeServer,\n        proxyUrl,\n        environmentVariables,\n        customFetch,\n        deviceOptions,\n      )\n    }\n    if (type === 'deviceAuthorization') {\n      return [new Error('Flow not found'), null]\n    }\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authUrl = flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl\n    if (!authUrl.trim()) {\n      return [new Error('Authorization URL is required'), null]\n    }\n    const authorizationUrl = makeUrlAbsolute(authUrl, getActiveServerBase(activeServer, environmentVariables))\n\n    const url = new URL(authorizationUrl)\n    if (!isAllowedOAuthUrl(url)) {\n      return [new Error('Authorization URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // The capture path appends its own `redirect_uri` (it owns the target, for\n    // example an ephemeral loopback port), so we only set it here for the popup path.\n    if (!captureCallback) {\n      // Handle relative redirect uris\n      if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n        const baseUrl =\n          getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n        const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n        url.searchParams.set('redirect_uri', redirectUri)\n      } else {\n        url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n      }\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set(\n      'client_id',\n      replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim(),\n    )\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    // Capture path: open the system browser and let the host environment catch\n    // the redirect (used by the desktop app, where popup polling cannot work).\n    if (captureCallback) {\n      const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() })\n\n      if (captureError || !capture) {\n        return [captureError ?? new Error('Failed to capture the OAuth2 redirect'), null]\n      }\n\n      const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n        getOAuthCallbackData(() => capture.callbackUrl, flow['x-tokenName'] || 'access_token')\n\n      if (error) {\n        return [new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null]\n      }\n\n      // Implicit Flow\n      if (accessToken) {\n        if ((accessTokenParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return [null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }]\n      }\n\n      // Authorization Code Server Flow\n      if (code && type === 'authorizationCode') {\n        if ((codeParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return authorizeServers(\n          flows,\n          type,\n          scopes,\n          {\n            code,\n            pkce,\n            proxyUrl,\n            customFetch,\n            // The token request must echo the exact redirect_uri used in the authorization request.\n            redirectUri: capture.redirectUri,\n          },\n          activeServer,\n          environmentVariables,\n        )\n      }\n\n      return [new Error('No authorization code or access token was returned'), null]\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n    redirectUri,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n    /** Overrides the stored redirect_uri (the capture path owns the real target). */\n    redirectUri?: string\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim()\n  const clientSecret = replaceEnvVariables(flow['x-scalar-secret-client-secret'], environmentVariables).trim()\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /**\n   * PKCE and client authentication are independent: a confidential client may use both.\n   * We send the client_secret whenever one is set, regardless of PKCE (see RFC 9700 Section 2.1.1).\n   */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody =\n    addCredentialsToBody || ((type === 'authorizationCode' || type === 'deviceAuthorization') && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n  if (redirectUri) {\n    formData.set('redirect_uri', redirectUri)\n  } else if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = oauthClientAuthorization(clientId, clientSecret)\n    }\n\n    // Check if we should use the proxy\n    const tokenUrlValue = flow['x-scalar-secret-token-url'] ?? flow.tokenUrl\n    if (!tokenUrlValue.trim()) {\n      return [new Error('Token URL is required'), null]\n    }\n    const tokenUrl = makeUrlAbsolute(tokenUrlValue, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim()\n  const clientSecret = replaceEnvVariables(flow['x-scalar-secret-client-secret'], environmentVariables).trim()\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /** A confidential client keeps using its secret on refresh, even when PKCE is enabled. */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody =\n    addCredentialsToBody || ((type === 'authorizationCode' || type === 'deviceAuthorization') && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = oauthClientAuthorization(clientId, clientSecret)\n    }\n\n    const refreshUrl = flow.refreshUrl || (flow['x-scalar-secret-token-url'] ?? flow.tokenUrl)\n    if (!refreshUrl.trim()) {\n      return [new Error('Token URL is required'), null]\n    }\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+DA,IAAa,gBACX,cACA,uBAA+C,CAAC,MAEhD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,YAAY,CAAC,GAC9E,oBACF;;;;;;;AAQF,IAAa,uBACX,cACA,uBAA+C,CAAC,MAC3B;CACrB,MAAM,YAAY,aAAa,cAAc,oBAAoB;CACjE,IAAI,CAAC,WACH,OAAO,CAAC;CAGV,IAAI,eAAe,SAAS,GAC1B,OAAO,OAAO,WAAW,cAAc,CAAC,IAAI,EAAE,UAAU,UAAU;CAGpE,OAAO,EAAE,SAAS,UAAU;AAC9B;;;;;;AAOA,IAAM,6BAAqC;CAEzC,MAAM,yBAAS,IAAI,WAAW,EAAE;CAChC,OAAO,gBAAgB,MAAM;CAG7B,OAAO,eAAe,QAAQ,IAAI;AACpC;;;;AAKA,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;CACxG,IAAI,aAAa,SACf,OAAO;CAIT,IAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;EAChD,QAAQ,KAAK,wFAAwF;EACrG,OAAO;CACT;CAIA,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAGzD,OAAO,eAAe,IAAI,WAAW,MAAM,GAAG,IAAI;AACpD;;;;;;AAOA,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,CAAC,GAEhD,aAMA,iBACA,kBACyC;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI;EACF,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAG3C,IAAI,SAAS,yBAAyB,MAAM,qBAC1C,OAAO,gBACL,MAAM,qBACN,gBACA,cACA,UACA,sBACA,aACA,aACF;EAEF,IAAI,SAAS,uBACX,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAE3C,MAAM,SAAS,eAAe,KAAK,GAAG;EAGtC,IAAI,SAAS,uBAAuB,SAAS,YAC3C,OAAO,iBACL,OACA,MACA,QACA;GACE;GACA;EACF,GACA,cACA,oBACF;EAIF,MAAM,SAAS,KAAK,OAAO,IAAI,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,EAAE;EAE9D,MAAM,UAAU,MAAM,KAAK,CAAE,+BAA+B,MAAM,KAAK,CAAE;EACzE,IAAI,CAAC,QAAQ,KAAK,GAChB,OAAO,iBAAC,IAAI,MAAM,+BAA+B,GAAG,IAAI;EAE1D,MAAM,mBAAmB,gBAAgB,SAAS,oBAAoB,cAAc,oBAAoB,CAAC;EAEzG,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,IAAI,CAAC,kBAAkB,GAAG,GACxB,OAAO,iBAAC,IAAI,MAAM,qEAAqE,GAAG,IAAI;;EAIhG,IAAI,OAAyB;EAG7B,IAAI,SAAS,YACX,IAAI,aAAa,IAAI,iBAAiB,OAAO;OACxC,IAAI,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;GAExB,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAG5C,IAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,qBAAqB;IAC1C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,YAAY;IAGtF,OAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;IACvE;IAGA,IAAI,aAAa,IAAI,kBAAkB,aAAa;IACpD,IAAI,aAAa,IAAI,yBAAyB,KAAK,mBAAmB;GACxE;EACF;EAEA,MAAM,YAAY,MAAM;EAIxB,IAAI,CAAC,iBAEH,IAAI,UAAU,+BAA+B,CAAC,WAAW,GAAG,GAAG;GAC7D,MAAM,UACJ,aAAa,cAAc,oBAAoB,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;GAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,OAAO,CAAC,CAAC,SAAS;GAEzF,IAAI,aAAa,IAAI,gBAAgB,WAAW;EAClD,OACE,IAAI,aAAa,IAAI,gBAAgB,UAAU,+BAA+B;EAIlF,IAAI,KAAK,4BACP,OAAO,KAAK,KAAK,0BAA0B,CAAC,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,0BAA0B,GAAG;GAChD,IAAI,CAAC,OACH;GAEF,IAAI,aAAa,IAAI,KAAK,KAAK;EACjC,CAAC;EAIH,IAAI,aAAa,IACf,aACA,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK,CACpF;EACA,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,QACF,IAAI,aAAa,IAAI,SAAS,MAAM;EAKtC,IAAI,iBAAiB;GACnB,MAAM,CAAC,cAAc,WAAW,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,SAAS,EAAE,CAAC;GAE1F,IAAI,gBAAgB,CAAC,SACnB,OAAO,CAAC,gCAAgB,IAAI,MAAM,uCAAuC,GAAG,IAAI;GAGlF,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,QAAQ,aAAa,KAAK,kBAAkB,cAAc;GAEvF,IAAI,OACF,OAAO,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI;GAIrG,IAAI,aAAa;IACf,KAAK,mBAAmB,IAAI,OAAO,KAAK,UAAU,OAChD,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,CAAC,MAAM;KAAE;KAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IAAG,CAAC;GAC1E;GAGA,IAAI,QAAQ,SAAS,qBAAqB;IACxC,KAAK,YAAY,IAAI,OAAO,KAAK,UAAU,OACzC,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,iBACL,OACA,MACA,QACA;KACE;KACA;KACA;KACA;KAEA,aAAa,QAAQ;IACvB,GACA,cACA,oBACF;GACF;GAEA,OAAO,iBAAC,IAAI,MAAM,oDAAoD,GAAG,IAAI;EAC/E;EAGA,MAAM,aAAa,OAAO,KAAK,KAAK,mBAAmB,uCAAc;EAGrE,IAAI,YAEF,OAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,cAAc;IAG5F,IAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;KACrD,cAAc,iBAAiB;KAC/B,WAAW,MAAM;KAEjB,IAAI,OAAO;MACT,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;MACrG;KACF;KAGA,IAAI,aAAa;MAGf,KAFe,mBAAmB,IAAI,OAAO,KAAK,UAEnC,OACb,QAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;MAAG,CAAC,CAAC;WAE1E,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,IAAI,QAAQ,SAAS,qBAAqB;MAGxC,KAFe,YAAY,IAAI,OAAO,KAAK,UAE5B,OACb,iBACE,OACA,MACA,QACA;OACE;OACA;OACA;OACA;MACF,GACA,cACA,oBACF,CAAC,CACE,KAAK,OAAO,CAAC,CACb,OAAO,UAAmB;OACzB,QAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC,GAC5F,IACF,CAAC;MACH,CAAC;WAEH,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,QAAQ,iBAAC,IAAI,MAAM,kDAAkD,GAAG,IAAI,CAAC;IAC/E;GACF,GAAG,GAAG;EACR,CAAC;EAEH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CACvD,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,MAAM,CAAC,GAAG,IAAI;CAC/G;AACF;;;;;AAMA,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,OACd,gBAQE,CAAC,GACL,cACA,uBAA+C,CAAC,MACP;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,WAAW,IAAI,gBAAgB;CAGrC,IAAI,WAAW,SAAS,uBAAuB,SAAS,aACtD,SAAS,IAAI,SAAS,MAAM;CAI9B,MAAM,WAAW,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK;CACnG,MAAM,eAAe,oBAAoB,KAAK,kCAAkC,oBAAoB,CAAC,CAAC,KAAK;;CAE3G,MAAM,uBAAuB,KAAK,qCAAqC;;;;;CAKvE,MAAM,kBAAkB,QAAQ,YAAY;CAQ5C,IAFE,yBAA0B,SAAS,uBAAuB,SAAS,0BAA0B,CAAC,iBAG9F,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAE5C,IAAI,aACF,SAAS,IAAI,gBAAgB,WAAW;MACnC,IAAI,kCAAkC,QAAQ,KAAK,iCACxD,SAAS,IAAI,gBAAgB,KAAK,+BAA+B;CAInE,IAAI,MAAM;EACR,SAAS,IAAI,QAAQ,IAAI;EACzB,SAAS,IAAI,cAAc,oBAAoB;EAG/C,IAAI,MACF,SAAS,IAAI,iBAAiB,KAAK,YAAY;CAEnD,OAEK,IAAI,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;EACxB,SAAS,IAAI,cAAc,UAAU;EACrC,SAAS,IAAI,YAAY,UAAU,2BAA2B;EAC9D,SAAS,IAAI,YAAY,UAAU,2BAA2B;CAChE,OAGE,SAAS,IAAI,cAAc,oBAAoB;CAIjD,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAGA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,yBAAyB,UAAU,YAAY;EAIzE,MAAM,gBAAgB,KAAK,gCAAgC,KAAK;EAChE,IAAI,CAAC,cAAc,KAAK,GACtB,OAAO,iBAAC,IAAI,MAAM,uBAAuB,GAAG,IAAI;EAElD,MAAM,WAAW,gBAAgB,eAAe,oBAAoB,cAAc,oBAAoB,CAAC;EAWvG,MAAM,eAAe,OAAM,MALR,YALP,eAAe,UAAU,QAAQ,IACzC,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,MACxE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAIrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;EAElC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,+BAA+B,GAAG,IAAI;EAGlH,OAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,aAAa,IAAI,CAAC;EAAG,CAAC;CAC9F,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,MAAM,CAAC,GAC/F,IACF;CACF;AACF;;;;;;;AAQA,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,CAAC,GAEhD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,eAAe,KAAK;CAC1B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CAGvD,MAAM,WAAW,IAAI,gBAAgB;CACrC,SAAS,IAAI,cAAc,eAAe;CAC1C,SAAS,IAAI,iBAAiB,YAAY;CAG1C,MAAM,WAAW,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK;CACnG,MAAM,eAAe,oBAAoB,KAAK,kCAAkC,oBAAoB,CAAC,CAAC,KAAK;CAC3G,MAAM,uBAAuB,KAAK,qCAAqC;;CAEvE,MAAM,kBAAkB,QAAQ,YAAY;CAQ5C,IAFE,yBAA0B,SAAS,uBAAuB,SAAS,0BAA0B,CAAC,iBAG9F,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAG5C,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAEA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,yBAAyB,UAAU,YAAY;EAGzE,MAAM,aAAa,KAAK,eAAe,KAAK,gCAAgC,KAAK;EACjF,IAAI,CAAC,WAAW,KAAK,GACnB,OAAO,iBAAC,IAAI,MAAM,uBAAuB,GAAG,IAAI;EAElD,MAAM,qBAAqB,gBAAgB,YAAY,oBAAoB,cAAc,oBAAoB,CAAC;EAU9G,MAAM,eAAe,OAAM,MALR,YAJP,eAAe,UAAU,kBAAkB,IACnD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,MAClF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAGrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;EAErC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,sBAAsB,GAAG,IAAI;EAGzG,OAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,gBAAgB,IAAI,EAAE,aAAa;EAC/F,CACF;CACF,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,MAAM,CAAC,GAC1F,IACF;CACF;AACF"}
+{"version":3,"file":"oauth.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/oauth.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport { replaceEnvVariables, replacePathVariables } from '@scalar/helpers/regex/replace-variables'\nimport { isAllowedOAuthUrl } from '@scalar/helpers/url/is-allowed-oauth-url'\nimport { isRelativePath } from '@scalar/helpers/url/is-relative-path'\nimport { makeUrlAbsolute } from '@scalar/helpers/url/make-url-absolute'\nimport { shouldUseProxy } from '@scalar/helpers/url/redirect-to-proxy'\nimport type { OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example'\nimport { getServerVariables } from '@scalar/workspace-store/request-example'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\nimport { fromUint8Array } from 'js-base64'\n\nimport type { CustomFetch } from '@/v2/blocks/operation-block/helpers/send-request'\n\nimport { getOAuthCallbackData } from './oauth-callback'\nimport { oauthClientAuthorization } from './oauth-client-authorization'\nimport { type DeviceAuthorizationOptions, authorizeDevice } from './oauth-device-authorization'\n\n/** Oauth2 security schemes which are not implicit */\ntype NonImplicitFlows = Omit<OAuthFlowsObjectSecret, 'implicit'>\n\ntype PKCEState = {\n  codeVerifier: string\n  codeChallenge: string\n  codeChallengeMethod: string\n}\n\ntype ActiveServerBase = { basePath: string } | { baseUrl: string } | Record<string, never>\n\nexport type OAuth2Tokens = {\n  accessToken: string\n  refreshToken?: string\n}\n\n/**\n * Captures the OAuth2 redirect for environments where the browser-popup polling\n * approach cannot work (notably the Electron desktop app, where the renderer\n * runs on `file://` and providers reject `file://` redirect URIs).\n *\n * The implementation opens the authorization URL in the system browser and\n * resolves once the provider redirects back. Because the redirect target (for\n * example an ephemeral loopback port) is only known to the host environment, the\n * implementation appends the `redirect_uri` itself and reports back the exact\n * value it used so the token exchange can send the matching `redirect_uri`.\n */\nexport type CaptureOAuth2Callback = (params: {\n  /** The fully built authorization URL, without a `redirect_uri` parameter. */\n  authorizationUrl: string\n}) => Promise<\n  ErrorResponse<{\n    /** The full callback URL the provider redirected to, including query and/or hash params. */\n    callbackUrl: string\n    /** The `redirect_uri` the host environment used, so the token exchange can match it. */\n    redirectUri: string\n  }>\n>\n\n/** Flow types that support token refresh (all except implicit) */\ntype RefreshableFlows = Exclude<keyof OAuthFlowsObjectSecret, 'implicit'>\n\n/**\n * Resolves the active server URL using OpenAPI server variables first, then\n * Scalar environment variables.\n */\nexport const getServerUrl = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): string =>\n  replaceEnvVariables(\n    replacePathVariables(activeServer?.url ?? '', getServerVariables(activeServer)),\n    environmentVariables,\n  )\n\n/**\n * Builds the base option used when OAuth URLs are relative to the active server.\n *\n * Relative server URLs become browser-only base paths because they need the\n * current window location to resolve correctly.\n */\nexport const getActiveServerBase = (\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): ActiveServerBase => {\n  const serverUrl = getServerUrl(activeServer, environmentVariables)\n  if (!serverUrl) {\n    return {}\n  }\n\n  if (isRelativePath(serverUrl)) {\n    return typeof window === 'undefined' ? {} : { basePath: serverUrl }\n  }\n\n  return { baseUrl: serverUrl }\n}\n\n/**\n * Generates a random string for PKCE code verifier\n *\n * @see https://www.rfc-editor.org/rfc/rfc7636#page-8\n */\nconst generateCodeVerifier = (): string => {\n  // Generate 32 random bytes\n  const buffer = new Uint8Array(32)\n  crypto.getRandomValues(buffer)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(buffer, true)\n}\n\n/**\n * Creates a code challenge from the code verifier\n */\nconst generateCodeChallenge = async (verifier: string, encoding: 'SHA-256' | 'plain'): Promise<string> => {\n  if (encoding === 'plain') {\n    return verifier\n  }\n\n  // If crypto.subtle.digest is not a function, we cannot use SHA-256\n  if (typeof crypto?.subtle?.digest !== 'function') {\n    console.warn('SHA-256 is only supported when using https, using a plain text code challenge instead.')\n    return verifier\n  }\n\n  // ASCII encoding is just taking the lower 8 bits of each character\n  const encoder = new TextEncoder()\n  const data = encoder.encode(verifier)\n  const digest = await crypto.subtle.digest('SHA-256', data)\n\n  // Base64URL encode the bytes\n  return fromUint8Array(new Uint8Array(digest), true)\n}\n\n/**\n * Authorize oauth2 flow\n *\n * @returns the resolved oauth2 tokens\n */\nexport const authorizeOauth2 = async (\n  flows: OAuthFlowsObjectSecret,\n  type: keyof OAuthFlowsObjectSecret,\n  selectedScopes: string[],\n  /** We use the active server to set a base for relative redirect uris */\n  activeServer: ServerObject | null,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** Flattened environment variables used to resolve server URL templates like `{protocol}` */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the token request; the desktop app passes an IPC-backed fetch (see {@link authorizeServers}). */\n  customFetch?: CustomFetch,\n  /**\n   * Optional redirect capture for interactive flows (authorization code and implicit).\n   * When provided, the system browser plus a host-owned redirect target replaces the\n   * default popup-polling approach. Required for the Electron desktop app.\n   */\n  captureCallback?: CaptureOAuth2Callback,\n  deviceOptions?: DeviceAuthorizationOptions,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  try {\n    if (!flow) {\n      return [new Error('Flow not found'), null]\n    }\n\n    if (type === 'deviceAuthorization' && flows.deviceAuthorization) {\n      return authorizeDevice(\n        flows.deviceAuthorization,\n        selectedScopes,\n        activeServer,\n        proxyUrl,\n        environmentVariables,\n        customFetch,\n        deviceOptions,\n      )\n    }\n    if (type === 'deviceAuthorization') {\n      return [new Error('Flow not found'), null]\n    }\n    const scopes = selectedScopes.join(' ')\n\n    // Client Credentials or Password Flow\n    if (type === 'clientCredentials' || type === 'password') {\n      return authorizeServers(\n        flows,\n        type,\n        scopes,\n        {\n          proxyUrl,\n          customFetch,\n        },\n        activeServer,\n        environmentVariables,\n      )\n    }\n\n    // Generate a random state string with the length of 8 characters\n    const state = (Math.random() + 1).toString(36).substring(2, 10)\n\n    const authUrl = flows[type]!['x-scalar-secret-auth-url'] ?? flows[type]!.authorizationUrl\n    if (!authUrl.trim()) {\n      return [new Error('Authorization URL is required'), null]\n    }\n    const authorizationUrl = makeUrlAbsolute(authUrl, getActiveServerBase(activeServer, environmentVariables))\n\n    const url = new URL(authorizationUrl)\n    if (!isAllowedOAuthUrl(url)) {\n      return [new Error('Authorization URL must use HTTPS or HTTP for local development URLs'), null]\n    }\n\n    /** Special PKCE state */\n    let pkce: PKCEState | null = null\n\n    // Params unique to the flows\n    if (type === 'implicit') {\n      url.searchParams.set('response_type', 'token')\n    } else if (type === 'authorizationCode') {\n      const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n      url.searchParams.set('response_type', 'code')\n\n      // PKCE\n      if (typedFlow['x-usePkce'] !== 'no') {\n        const codeVerifier = generateCodeVerifier()\n        const codeChallenge = await generateCodeChallenge(codeVerifier, typedFlow['x-usePkce'])\n\n        // Set state for later verification\n        pkce = {\n          codeVerifier,\n          codeChallenge,\n          codeChallengeMethod: typedFlow['x-usePkce'] === 'SHA-256' ? 'S256' : 'plain',\n        }\n\n        // Set the code challenge and method on the url\n        url.searchParams.set('code_challenge', codeChallenge)\n        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod)\n      }\n    }\n\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n\n    // The capture path appends its own `redirect_uri` (it owns the target, for\n    // example an ephemeral loopback port), so we only set it here for the popup path.\n    if (!captureCallback) {\n      // Handle relative redirect uris\n      if (typedFlow['x-scalar-secret-redirect-uri'].startsWith('/')) {\n        const baseUrl =\n          getServerUrl(activeServer, environmentVariables) || window.location.origin + window.location.pathname\n        const redirectUri = new URL(typedFlow['x-scalar-secret-redirect-uri'], baseUrl).toString()\n\n        url.searchParams.set('redirect_uri', redirectUri)\n      } else {\n        url.searchParams.set('redirect_uri', typedFlow['x-scalar-secret-redirect-uri'])\n      }\n    }\n\n    if (flow['x-scalar-security-query']) {\n      Object.keys(flow['x-scalar-security-query']).forEach((key: string): void => {\n        const value = flow['x-scalar-security-query']?.[key]\n        if (!value) {\n          return\n        }\n        url.searchParams.set(key, value)\n      })\n    }\n\n    // Common to all flows\n    url.searchParams.set(\n      'client_id',\n      replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim(),\n    )\n    url.searchParams.set('state', state)\n    if (scopes) {\n      url.searchParams.set('scope', scopes)\n    }\n\n    // Capture path: open the system browser and let the host environment catch\n    // the redirect (used by the desktop app, where popup polling cannot work).\n    if (captureCallback) {\n      const [captureError, capture] = await captureCallback({ authorizationUrl: url.toString() })\n\n      if (captureError || !capture) {\n        return [captureError ?? new Error('Failed to capture the OAuth2 redirect'), null]\n      }\n\n      const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n        getOAuthCallbackData(() => capture.callbackUrl, flow['x-tokenName'] || 'access_token')\n\n      if (error) {\n        return [new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null]\n      }\n\n      // Implicit Flow\n      if (accessToken) {\n        if ((accessTokenParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return [null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }]\n      }\n\n      // Authorization Code Server Flow\n      if (code && type === 'authorizationCode') {\n        if ((codeParams?.get('state') ?? null) !== state) {\n          return [new Error('State mismatch'), null]\n        }\n        return authorizeServers(\n          flows,\n          type,\n          scopes,\n          {\n            code,\n            pkce,\n            proxyUrl,\n            customFetch,\n            // The token request must echo the exact redirect_uri used in the authorization request.\n            redirectUri: capture.redirectUri,\n          },\n          activeServer,\n          environmentVariables,\n        )\n      }\n\n      return [new Error('No authorization code or access token was returned'), null]\n    }\n\n    const windowFeatures = 'left=100,top=100,width=800,height=600'\n    const authWindow = window.open(url, 'openAuth2Window', windowFeatures)\n\n    // Open up a window and poll until closed or we have the data we want\n    if (authWindow) {\n      // We need to return a promise here due to the setInterval\n      return new Promise<ErrorResponse<OAuth2Tokens>>((resolve) => {\n        const checkWindowClosed = setInterval(() => {\n          const { accessToken, accessTokenParams, code, codeParams, error, errorDescription, refreshToken } =\n            getOAuthCallbackData(() => authWindow.location.href, flow['x-tokenName'] || 'access_token')\n\n          // The window has closed OR we have what we are looking for so we stop polling\n          if (authWindow.closed || accessToken || code || error) {\n            clearInterval(checkWindowClosed)\n            authWindow.close()\n\n            if (error) {\n              resolve([new Error(`OAuth error: ${error}${errorDescription ? ` (${errorDescription})` : ''}`), null])\n              return\n            }\n\n            // Implicit Flow\n            if (accessToken) {\n              const _state = accessTokenParams?.get('state') ?? null\n\n              if (_state === state) {\n                resolve([null, { accessToken, ...(refreshToken ? { refreshToken } : {}) }])\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // Authorization Code Server Flow\n            if (code && type === 'authorizationCode') {\n              const _state = codeParams?.get('state') ?? null\n\n              if (_state === state) {\n                void authorizeServers(\n                  flows,\n                  type,\n                  scopes,\n                  {\n                    code,\n                    pkce,\n                    proxyUrl,\n                    customFetch,\n                  },\n                  activeServer,\n                  environmentVariables,\n                )\n                  .then(resolve)\n                  .catch((error: unknown) => {\n                    resolve([\n                      error instanceof Error ? error : new Error('Failed to get an access token', { cause: error }),\n                      null,\n                    ])\n                  })\n              } else {\n                resolve([new Error('State mismatch'), null])\n              }\n              return\n            }\n\n            // User closed window without authorizing\n            resolve([new Error('Window was closed without granting authorization'), null])\n          }\n        }, 200)\n      })\n    }\n    return [new Error('Failed to open auth window'), null]\n  } catch (error) {\n    return [error instanceof Error ? error : new Error('Failed to authorize oauth2 flow', { cause: error }), null]\n  }\n}\n\n/**\n * Makes the BE authorization call to grab the token server to server\n * Used for clientCredentials and authorizationCode\n */\nconst authorizeServers = async (\n  flows: NonImplicitFlows,\n  type: keyof NonImplicitFlows,\n  scopes: string,\n  {\n    code,\n    pkce,\n    proxyUrl,\n    customFetch = fetch,\n    redirectUri,\n  }: {\n    code?: string\n    pkce?: PKCEState | null\n    proxyUrl?: string\n    customFetch?: CustomFetch\n    /** Overrides the stored redirect_uri (the capture path owns the real target). */\n    redirectUri?: string\n  } = {},\n  activeServer: ServerObject | null,\n  environmentVariables: Record<string, string> = {},\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const formData = new URLSearchParams()\n\n  // Only client credentials and password flows support scopes in the token request\n  if (scopes && (type === 'clientCredentials' || type === 'password')) {\n    formData.set('scope', scopes)\n  }\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim()\n  const clientSecret = replaceEnvVariables(flow['x-scalar-secret-client-secret'], environmentVariables).trim()\n  /** Where to add the credentials */\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /**\n   * PKCE and client authentication are independent: a confidential client may use both.\n   * We send the client_secret whenever one is set, regardless of PKCE (see RFC 9700 Section 2.1.1).\n   */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the token body.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody =\n    addCredentialsToBody || ((type === 'authorizationCode' || type === 'deviceAuthorization') && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n  if (redirectUri) {\n    formData.set('redirect_uri', redirectUri)\n  } else if ('x-scalar-secret-redirect-uri' in flow && flow['x-scalar-secret-redirect-uri']) {\n    formData.set('redirect_uri', flow['x-scalar-secret-redirect-uri'])\n  }\n\n  // Authorization Code\n  if (code) {\n    formData.set('code', code)\n    formData.set('grant_type', 'authorization_code')\n\n    // PKCE\n    if (pkce) {\n      formData.set('code_verifier', pkce.codeVerifier)\n    }\n  }\n  // Password\n  else if (type === 'password') {\n    const typedFlow = flows[type]! // Safe to assert due to earlier check\n    formData.set('grant_type', 'password')\n    formData.set('username', typedFlow['x-scalar-secret-username'])\n    formData.set('password', typedFlow['x-scalar-secret-password'])\n  }\n  // Client Credentials\n  else {\n    formData.set('grant_type', 'client_credentials')\n  }\n\n  // Additional request body parameters\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    // Add client id + secret to headers for confidential clients.\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = oauthClientAuthorization(clientId, clientSecret)\n    }\n\n    // Check if we should use the proxy\n    const tokenUrlValue = flow['x-scalar-secret-token-url'] ?? flow.tokenUrl\n    if (!tokenUrlValue.trim()) {\n      return [new Error('Token URL is required'), null]\n    }\n    const tokenUrl = makeUrlAbsolute(tokenUrlValue, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, tokenUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', tokenUrl]]).toString()}`\n      : tokenUrl\n\n    // Make the call\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    // Use custom token name if specified, otherwise default to access_token\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const refreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Failed to get an access token'), null]\n    }\n\n    return [null, { accessToken, ...(typeof refreshToken === 'string' ? { refreshToken } : {}) }]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to get an access token. Please check your credentials.', { cause: error }),\n      null,\n    ]\n  }\n}\n\n/**\n * Exchange a refresh token for a new access token using the `grant_type=refresh_token` flow.\n *\n * Uses the stored refresh token, client credentials, and the token URL (or refreshUrl when available)\n * to request fresh tokens from the authorization server per RFC 6749 Section 6.\n */\nexport const refreshOauth2Token = async (\n  flows: OAuthFlowsObjectSecret,\n  type: RefreshableFlows,\n  /** If we want to use the proxy */\n  proxyUrl: string,\n  /** We use the active server to set a base for relative URLs */\n  activeServer: ServerObject | null,\n  /** Flattened environment variables used to resolve server URL templates */\n  environmentVariables: Record<string, string> = {},\n  /** Fetch used for the refresh request; the desktop app passes an IPC-backed fetch so it leaves the renderer's network stack. */\n  customFetch: CustomFetch = fetch,\n): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const flow = flows[type]\n\n  if (!flow) {\n    return [new Error('OAuth2 flow was not defined'), null]\n  }\n\n  const refreshToken = flow['x-scalar-secret-refresh-token']\n  if (!refreshToken) {\n    return [new Error('No refresh token available'), null]\n  }\n\n  const formData = new URLSearchParams()\n  formData.set('grant_type', 'refresh_token')\n  formData.set('refresh_token', refreshToken)\n\n  // Ignore surrounding copy/paste whitespace without changing stored credentials or other secrets.\n  const clientId = replaceEnvVariables(flow['x-scalar-secret-client-id'], environmentVariables).trim()\n  const clientSecret = replaceEnvVariables(flow['x-scalar-secret-client-secret'], environmentVariables).trim()\n  const addCredentialsToBody = flow['x-scalar-credentials-location'] === 'body'\n  /** A confidential client keeps using its secret on refresh, even when PKCE is enabled. */\n  const hasClientSecret = Boolean(clientSecret)\n  /**\n   * Public authorization-code clients still need client_id in the refresh body per RFC 6749 Section 6.\n   * We only send it implicitly for that case to avoid conflicting with Basic auth.\n   */\n  const shouldSendClientIdInBody =\n    addCredentialsToBody || ((type === 'authorizationCode' || type === 'deviceAuthorization') && !hasClientSecret)\n\n  if (shouldSendClientIdInBody) {\n    formData.set('client_id', clientId)\n  }\n  if (addCredentialsToBody && hasClientSecret) {\n    formData.set('client_secret', clientSecret)\n  }\n\n  if (flow['x-scalar-security-body']) {\n    Object.entries(flow['x-scalar-security-body']).forEach(([key, value]) => {\n      if (value !== undefined && value !== null) {\n        formData.set(key, String(value))\n      }\n    })\n  }\n\n  try {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/x-www-form-urlencoded',\n    }\n\n    if (!addCredentialsToBody && hasClientSecret) {\n      headers.Authorization = oauthClientAuthorization(clientId, clientSecret)\n    }\n\n    const refreshUrl = flow.refreshUrl || (flow['x-scalar-secret-token-url'] ?? flow.tokenUrl)\n    if (!refreshUrl.trim()) {\n      return [new Error('Token URL is required'), null]\n    }\n    const absoluteRefreshUrl = makeUrlAbsolute(refreshUrl, getActiveServerBase(activeServer, environmentVariables))\n    const url = shouldUseProxy(proxyUrl, absoluteRefreshUrl)\n      ? `${proxyUrl}?${new URLSearchParams([['scalar_url', absoluteRefreshUrl]]).toString()}`\n      : absoluteRefreshUrl\n\n    const resp = await customFetch(url, {\n      method: 'POST',\n      headers,\n      body: formData,\n    })\n    const responseData = await resp.json()\n\n    const tokenName = flow['x-tokenName'] || 'access_token'\n    const accessToken = responseData[tokenName]\n    const newRefreshToken = responseData.refresh_token\n\n    if (!accessToken) {\n      return [new Error(responseData.error_description ?? responseData.error ?? 'Token refresh failed'), null]\n    }\n\n    return [\n      null,\n      {\n        accessToken,\n        ...(typeof newRefreshToken === 'string' ? { refreshToken: newRefreshToken } : { refreshToken }),\n      },\n    ]\n  } catch (error) {\n    return [\n      error instanceof Error\n        ? error\n        : new Error('Failed to refresh the access token. Please re-authorize.', { cause: error }),\n      null,\n    ]\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AA+DA,IAAa,gBACX,cACA,uBAA+C,CAAC,MAEhD,oBACE,qBAAqB,cAAc,OAAO,IAAI,mBAAmB,YAAY,CAAC,GAC9E,oBACF;;;;;;;AAQF,IAAa,uBACX,cACA,uBAA+C,CAAC,MAC3B;CACrB,MAAM,YAAY,aAAa,cAAc,oBAAoB;CACjE,IAAI,CAAC,WACH,OAAO,CAAC;CAGV,IAAI,eAAe,SAAS,GAC1B,OAAO,OAAO,WAAW,cAAc,CAAC,IAAI,EAAE,UAAU,UAAU;CAGpE,OAAO,EAAE,SAAS,UAAU;AAC9B;;;;;;AAOA,IAAM,6BAAqC;CAEzC,MAAM,yBAAS,IAAI,WAAW,EAAE;CAChC,OAAO,gBAAgB,MAAM;CAG7B,OAAO,eAAe,QAAQ,IAAI;AACpC;;;;AAKA,IAAM,wBAAwB,OAAO,UAAkB,aAAmD;CACxG,IAAI,aAAa,SACf,OAAO;CAIT,IAAI,OAAO,QAAQ,QAAQ,WAAW,YAAY;EAChD,QAAQ,KAAK,wFAAwF;EACrG,OAAO;CACT;CAIA,MAAM,OAAO,IADO,YACP,CAAA,CAAQ,OAAO,QAAQ;CACpC,MAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;CAGzD,OAAO,eAAe,IAAI,WAAW,MAAM,GAAG,IAAI;AACpD;;;;;;AAOA,IAAa,kBAAkB,OAC7B,OACA,MACA,gBAEA,cAEA,UAEA,uBAA+C,CAAC,GAEhD,aAMA,iBACA,kBACyC;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI;EACF,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAG3C,IAAI,SAAS,yBAAyB,MAAM,qBAC1C,OAAO,gBACL,MAAM,qBACN,gBACA,cACA,UACA,sBACA,aACA,aACF;EAEF,IAAI,SAAS,uBACX,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;EAE3C,MAAM,SAAS,eAAe,KAAK,GAAG;EAGtC,IAAI,SAAS,uBAAuB,SAAS,YAC3C,OAAO,iBACL,OACA,MACA,QACA;GACE;GACA;EACF,GACA,cACA,oBACF;EAIF,MAAM,SAAS,KAAK,OAAO,IAAI,EAAA,CAAG,SAAS,EAAE,CAAC,CAAC,UAAU,GAAG,EAAE;EAE9D,MAAM,UAAU,MAAM,KAAK,CAAE,+BAA+B,MAAM,KAAK,CAAE;EACzE,IAAI,CAAC,QAAQ,KAAK,GAChB,OAAO,iBAAC,IAAI,MAAM,+BAA+B,GAAG,IAAI;EAE1D,MAAM,mBAAmB,gBAAgB,SAAS,oBAAoB,cAAc,oBAAoB,CAAC;EAEzG,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,IAAI,CAAC,kBAAkB,GAAG,GACxB,OAAO,iBAAC,IAAI,MAAM,qEAAqE,GAAG,IAAI;;EAIhG,IAAI,OAAyB;EAG7B,IAAI,SAAS,YACX,IAAI,aAAa,IAAI,iBAAiB,OAAO;OACxC,IAAI,SAAS,qBAAqB;GACvC,MAAM,YAAY,MAAM;GAExB,IAAI,aAAa,IAAI,iBAAiB,MAAM;GAG5C,IAAI,UAAU,iBAAiB,MAAM;IACnC,MAAM,eAAe,qBAAqB;IAC1C,MAAM,gBAAgB,MAAM,sBAAsB,cAAc,UAAU,YAAY;IAGtF,OAAO;KACL;KACA;KACA,qBAAqB,UAAU,iBAAiB,YAAY,SAAS;IACvE;IAGA,IAAI,aAAa,IAAI,kBAAkB,aAAa;IACpD,IAAI,aAAa,IAAI,yBAAyB,KAAK,mBAAmB;GACxE;EACF;EAEA,MAAM,YAAY,MAAM;EAIxB,IAAI,CAAC,iBAAiB;GAEpB,IAAI,UAAU,+BAA+B,CAAC,WAAW,GAAG,GAAG;IAC7D,MAAM,UACJ,aAAa,cAAc,oBAAoB,KAAK,OAAO,SAAS,SAAS,OAAO,SAAS;IAC/F,MAAM,cAAc,IAAI,IAAI,UAAU,iCAAiC,OAAO,CAAC,CAAC,SAAS;IAEzF,IAAI,aAAa,IAAI,gBAAgB,WAAW;GAClD,OACE,IAAI,aAAa,IAAI,gBAAgB,UAAU,+BAA+B;EAElF;EAEA,IAAI,KAAK,4BACP,OAAO,KAAK,KAAK,0BAA0B,CAAC,CAAC,SAAS,QAAsB;GAC1E,MAAM,QAAQ,KAAK,0BAA0B,GAAG;GAChD,IAAI,CAAC,OACH;GAEF,IAAI,aAAa,IAAI,KAAK,KAAK;EACjC,CAAC;EAIH,IAAI,aAAa,IACf,aACA,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK,CACpF;EACA,IAAI,aAAa,IAAI,SAAS,KAAK;EACnC,IAAI,QACF,IAAI,aAAa,IAAI,SAAS,MAAM;EAKtC,IAAI,iBAAiB;GACnB,MAAM,CAAC,cAAc,WAAW,MAAM,gBAAgB,EAAE,kBAAkB,IAAI,SAAS,EAAE,CAAC;GAE1F,IAAI,gBAAgB,CAAC,SACnB,OAAO,CAAC,gCAAgB,IAAI,MAAM,uCAAuC,GAAG,IAAI;GAGlF,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,QAAQ,aAAa,KAAK,kBAAkB,cAAc;GAEvF,IAAI,OACF,OAAO,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI;GAIrG,IAAI,aAAa;IACf,KAAK,mBAAmB,IAAI,OAAO,KAAK,UAAU,OAChD,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,CAAC,MAAM;KAAE;KAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;IAAG,CAAC;GAC1E;GAGA,IAAI,QAAQ,SAAS,qBAAqB;IACxC,KAAK,YAAY,IAAI,OAAO,KAAK,UAAU,OACzC,OAAO,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI;IAE3C,OAAO,iBACL,OACA,MACA,QACA;KACE;KACA;KACA;KACA;KAEA,aAAa,QAAQ;IACvB,GACA,cACA,oBACF;GACF;GAEA,OAAO,iBAAC,IAAI,MAAM,oDAAoD,GAAG,IAAI;EAC/E;EAGA,MAAM,aAAa,OAAO,KAAK,KAAK,mBAAmB,uCAAc;EAGrE,IAAI,YAEF,OAAO,IAAI,SAAsC,YAAY;GAC3D,MAAM,oBAAoB,kBAAkB;IAC1C,MAAM,EAAE,aAAa,mBAAmB,MAAM,YAAY,OAAO,kBAAkB,iBACjF,2BAA2B,WAAW,SAAS,MAAM,KAAK,kBAAkB,cAAc;IAG5F,IAAI,WAAW,UAAU,eAAe,QAAQ,OAAO;KACrD,cAAc,iBAAiB;KAC/B,WAAW,MAAM;KAEjB,IAAI,OAAO;MACT,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB,KAAK,iBAAiB,KAAK,IAAI,GAAG,IAAI,CAAC;MACrG;KACF;KAGA,IAAI,aAAa;MAGf,KAFe,mBAAmB,IAAI,OAAO,KAAK,UAEnC,OACb,QAAQ,CAAC,MAAM;OAAE;OAAa,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;MAAG,CAAC,CAAC;WAE1E,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,IAAI,QAAQ,SAAS,qBAAqB;MAGxC,KAFe,YAAY,IAAI,OAAO,KAAK,UAE5B,OACb,iBACE,OACA,MACA,QACA;OACE;OACA;OACA;OACA;MACF,GACA,cACA,oBACF,CAAC,CACE,KAAK,OAAO,CAAC,CACb,OAAO,UAAmB;OACzB,QAAQ,CACN,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,iCAAiC,EAAE,OAAO,MAAM,CAAC,GAC5F,IACF,CAAC;MACH,CAAC;WAEH,QAAQ,iBAAC,IAAI,MAAM,gBAAgB,GAAG,IAAI,CAAC;MAE7C;KACF;KAGA,QAAQ,iBAAC,IAAI,MAAM,kDAAkD,GAAG,IAAI,CAAC;IAC/E;GACF,GAAG,GAAG;EACR,CAAC;EAEH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CACvD,SAAS,OAAO;EACd,OAAO,CAAC,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,mCAAmC,EAAE,OAAO,MAAM,CAAC,GAAG,IAAI;CAC/G;AACF;;;;;AAMA,IAAM,mBAAmB,OACvB,OACA,MACA,QACA,EACE,MACA,MACA,UACA,cAAc,OACd,gBAQE,CAAC,GACL,cACA,uBAA+C,CAAC,MACP;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,WAAW,IAAI,gBAAgB;CAGrC,IAAI,WAAW,SAAS,uBAAuB,SAAS,aACtD,SAAS,IAAI,SAAS,MAAM;CAI9B,MAAM,WAAW,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK;CACnG,MAAM,eAAe,oBAAoB,KAAK,kCAAkC,oBAAoB,CAAC,CAAC,KAAK;;CAE3G,MAAM,uBAAuB,KAAK,qCAAqC;;;;;CAKvE,MAAM,kBAAkB,QAAQ,YAAY;CAQ5C,IAFE,yBAA0B,SAAS,uBAAuB,SAAS,0BAA0B,CAAC,iBAG9F,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAE5C,IAAI,aACF,SAAS,IAAI,gBAAgB,WAAW;MACnC,IAAI,kCAAkC,QAAQ,KAAK,iCACxD,SAAS,IAAI,gBAAgB,KAAK,+BAA+B;CAInE,IAAI,MAAM;EACR,SAAS,IAAI,QAAQ,IAAI;EACzB,SAAS,IAAI,cAAc,oBAAoB;EAG/C,IAAI,MACF,SAAS,IAAI,iBAAiB,KAAK,YAAY;CAEnD,OAEK,IAAI,SAAS,YAAY;EAC5B,MAAM,YAAY,MAAM;EACxB,SAAS,IAAI,cAAc,UAAU;EACrC,SAAS,IAAI,YAAY,UAAU,2BAA2B;EAC9D,SAAS,IAAI,YAAY,UAAU,2BAA2B;CAChE,OAGE,SAAS,IAAI,cAAc,oBAAoB;CAIjD,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAGA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,yBAAyB,UAAU,YAAY;EAIzE,MAAM,gBAAgB,KAAK,gCAAgC,KAAK;EAChE,IAAI,CAAC,cAAc,KAAK,GACtB,OAAO,iBAAC,IAAI,MAAM,uBAAuB,GAAG,IAAI;EAElD,MAAM,WAAW,gBAAgB,eAAe,oBAAoB,cAAc,oBAAoB,CAAC;EAWvG,MAAM,eAAe,OAAM,MALR,YALP,eAAe,UAAU,QAAQ,IACzC,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,MACxE,UAGgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAIrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,eAAe,aAAa;EAElC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,+BAA+B,GAAG,IAAI;EAGlH,OAAO,CAAC,MAAM;GAAE;GAAa,GAAI,OAAO,iBAAiB,WAAW,EAAE,aAAa,IAAI,CAAC;EAAG,CAAC;CAC9F,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,iEAAiE,EAAE,OAAO,MAAM,CAAC,GAC/F,IACF;CACF;AACF;;;;;;;AAQA,IAAa,qBAAqB,OAChC,OACA,MAEA,UAEA,cAEA,uBAA+C,CAAC,GAEhD,cAA2B,UACc;CACzC,MAAM,OAAO,MAAM;CAEnB,IAAI,CAAC,MACH,OAAO,iBAAC,IAAI,MAAM,6BAA6B,GAAG,IAAI;CAGxD,MAAM,eAAe,KAAK;CAC1B,IAAI,CAAC,cACH,OAAO,iBAAC,IAAI,MAAM,4BAA4B,GAAG,IAAI;CAGvD,MAAM,WAAW,IAAI,gBAAgB;CACrC,SAAS,IAAI,cAAc,eAAe;CAC1C,SAAS,IAAI,iBAAiB,YAAY;CAG1C,MAAM,WAAW,oBAAoB,KAAK,8BAA8B,oBAAoB,CAAC,CAAC,KAAK;CACnG,MAAM,eAAe,oBAAoB,KAAK,kCAAkC,oBAAoB,CAAC,CAAC,KAAK;CAC3G,MAAM,uBAAuB,KAAK,qCAAqC;;CAEvE,MAAM,kBAAkB,QAAQ,YAAY;CAQ5C,IAFE,yBAA0B,SAAS,uBAAuB,SAAS,0BAA0B,CAAC,iBAG9F,SAAS,IAAI,aAAa,QAAQ;CAEpC,IAAI,wBAAwB,iBAC1B,SAAS,IAAI,iBAAiB,YAAY;CAG5C,IAAI,KAAK,2BACP,OAAO,QAAQ,KAAK,yBAAyB,CAAC,CAAC,SAAS,CAAC,KAAK,WAAW;EACvE,IAAI,UAAU,KAAA,KAAa,UAAU,MACnC,SAAS,IAAI,KAAK,OAAO,KAAK,CAAC;CAEnC,CAAC;CAGH,IAAI;EACF,MAAM,UAAkC,EACtC,gBAAgB,oCAClB;EAEA,IAAI,CAAC,wBAAwB,iBAC3B,QAAQ,gBAAgB,yBAAyB,UAAU,YAAY;EAGzE,MAAM,aAAa,KAAK,eAAe,KAAK,gCAAgC,KAAK;EACjF,IAAI,CAAC,WAAW,KAAK,GACnB,OAAO,iBAAC,IAAI,MAAM,uBAAuB,GAAG,IAAI;EAElD,MAAM,qBAAqB,gBAAgB,YAAY,oBAAoB,cAAc,oBAAoB,CAAC;EAU9G,MAAM,eAAe,OAAM,MALR,YAJP,eAAe,UAAU,kBAAkB,IACnD,GAAG,SAAS,GAAG,IAAI,gBAAgB,CAAC,CAAC,cAAc,kBAAkB,CAAC,CAAC,CAAC,CAAC,SAAS,MAClF,oBAEgC;GAClC,QAAQ;GACR;GACA,MAAM;EACR,CAAC,EAAA,CAC+B,KAAK;EAGrC,MAAM,cAAc,aADF,KAAK,kBAAkB;EAEzC,MAAM,kBAAkB,aAAa;EAErC,IAAI,CAAC,aACH,OAAO,CAAC,IAAI,MAAM,aAAa,qBAAqB,aAAa,SAAS,sBAAsB,GAAG,IAAI;EAGzG,OAAO,CACL,MACA;GACE;GACA,GAAI,OAAO,oBAAoB,WAAW,EAAE,cAAc,gBAAgB,IAAI,EAAE,aAAa;EAC/F,CACF;CACF,SAAS,OAAO;EACd,OAAO,CACL,iBAAiB,QACb,QACA,IAAI,MAAM,4DAA4D,EAAE,OAAO,MAAM,CAAC,GAC1F,IACF;CACF;AACF"}

package/dist/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.d.ts

@@ -3,8 +3,8 @@ import type { WorkspaceEventBus } from '@scalar/workspace-store/events';
 import { type OAuthFlowsObjectSecret } from '@scalar/workspace-store/request-example';
 import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments';
 import type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document';
-import type { OAuth2Options } from '../../../../v2/blocks/scalar-auth-selector-block/components/OAuth2.vue.js';
-import { type OAuth2Tokens } from '../../../../v2/blocks/scalar-auth-selector-block/helpers/oauth.js';
+import type { OAuth2Options } from '../components/OAuth2.vue.js';
+import { type OAuth2Tokens } from './oauth.js';
 /**
  * Persists OAuth2 tokens split across the two schemes that care about them:
  *

package/dist/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.js

@@ -38,13 +38,14 @@ var storeOAuth2Tokens = (eventBus, params) => {
 var runOAuth2Authorize = async (params) => {
 	const { eventBus, bearerSchemeName, oauth2Name, flows, flowType, scopes, server, proxyUrl, environment, options } = params;
 	const flow = flows[flowType];
-	const result = await authorizeOauth2(flow && (flowType === "authorizationCode" || flowType === "implicit") ? {
+	const preparedFlows = flow && (flowType === "authorizationCode" || flowType === "implicit") ? {
 		...flows,
 		[flowType]: {
 			...flow,
 			"x-scalar-secret-redirect-uri": flow["x-scalar-secret-redirect-uri"] || resolveDefaultOAuth2RedirectUri(options ?? {}) || ""
 		}
-	} : flows, flowType, scopes, server, proxyUrl, getEnvironmentVariables(environment), options?.customFetch, options?.captureOAuth2Callback);
+	} : flows;
+	const result = await authorizeOauth2(preparedFlows, flowType, scopes, server, proxyUrl, getEnvironmentVariables(environment), options?.customFetch, options?.captureOAuth2Callback);
 	const tokens = result[1];
 	if (tokens?.accessToken) storeOAuth2Tokens(eventBus, {
 		bearerSchemeName,

package/dist/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-oauth2-authorize.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport type { WorkspaceEventBus } from '@scalar/workspace-store/events'\nimport { type OAuthFlowsObjectSecret, getEnvironmentVariables } from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { OAuth2Options } from '@/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue'\nimport { type OAuth2Tokens, authorizeOauth2 } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\n\n/**\n * Persists OAuth2 tokens split across the two schemes that care about them:\n *\n * - The **access token** lands on the consuming HTTP bearer scheme, so it is sent as\n *   `Authorization: Bearer <token>` without the bearer scheme losing focus.\n * - The **refresh token** stays on the oauth2 scheme, which is the only place that knows\n *   how to refresh (token URL, flow, client credentials).\n */\nexport const storeOAuth2Tokens = (\n  eventBus: WorkspaceEventBus,\n  params: {\n    bearerSchemeName: string\n    oauth2Name: string\n    flowType: keyof OAuthFlowsObjectSecret\n    tokens: OAuth2Tokens\n  },\n): void => {\n  const { bearerSchemeName, oauth2Name, flowType, tokens } = params\n\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', 'x-scalar-secret-token': tokens.accessToken },\n    name: bearerSchemeName,\n  })\n\n  if (tokens.refreshToken) {\n    eventBus.emit('auth:update:security-scheme-secrets', {\n      payload: {\n        type: 'oauth2',\n        [flowType]: { 'x-scalar-secret-refresh-token': tokens.refreshToken },\n      },\n      name: oauth2Name,\n    })\n  }\n}\n\n/**\n * Runs the OAuth2 authorization flow and stores the resulting tokens on the bearer scheme\n * (access token) and the oauth2 scheme (refresh token).\n *\n * Used by the bearer scheme's \"Authorize via OAuth2\" shortcut: it defaults the redirect URI\n * (`authorizeOauth2` reads it straight off the flow), kicks off the flow, then routes the\n * tokens through {@link storeOAuth2Tokens}.\n */\nexport const runOAuth2Authorize = async (params: {\n  eventBus: WorkspaceEventBus\n  bearerSchemeName: string\n  oauth2Name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: keyof OAuthFlowsObjectSecret\n  scopes: string[]\n  server: ServerObject | null\n  proxyUrl: string\n  environment: XScalarEnvironment\n  options?: OAuth2Options\n}): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const { eventBus, bearerSchemeName, oauth2Name, flows, flowType, scopes, server, proxyUrl, environment, options } =\n    params\n\n  const flow = flows[flowType]\n\n  // authorizeOauth2 reads the redirect URI directly off interactive flows, so default it\n  // when unset — a scheme merged in from Scalar config can then authorize without first\n  // opening the configuration form.\n  const preparedFlows =\n    flow && (flowType === 'authorizationCode' || flowType === 'implicit')\n      ? {\n          ...flows,\n          [flowType]: {\n            ...flow,\n            'x-scalar-secret-redirect-uri':\n              (flow as unknown as Record<string, string | undefined>)['x-scalar-secret-redirect-uri'] ||\n              resolveDefaultOAuth2RedirectUri(options ?? {}) ||\n              '',\n          },\n        }\n      : flows\n\n  const result = await authorizeOauth2(\n    preparedFlows,\n    flowType,\n    scopes,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n    options?.captureOAuth2Callback,\n  )\n  const tokens = result[1]\n\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, { bearerSchemeName, oauth2Name, flowType, tokens })\n  }\n\n  return result\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAa,qBACX,UACA,WAMS;CACT,MAAM,EAAE,kBAAkB,YAAY,UAAU,WAAW;CAE3D,SAAS,KAAK,uCAAuC;EACnD,SAAS;GAAE,MAAM;GAAQ,yBAAyB,OAAO;EAAY;EACrE,MAAM;CACR,CAAC;CAED,IAAI,OAAO,cACT,SAAS,KAAK,uCAAuC;EACnD,SAAS;GACP,MAAM;IACL,WAAW,EAAE,iCAAiC,OAAO,aAAa;EACrE;EACA,MAAM;CACR,CAAC;AAEL;;;;;;;;;AAUA,IAAa,qBAAqB,OAAO,WAWG;CAC1C,MAAM,EAAE,UAAU,kBAAkB,YAAY,OAAO,UAAU,QAAQ,QAAQ,UAAU,aAAa,YACtG;CAEF,MAAM,OAAO,MAAM;CAmBnB,MAAM,SAAS,MAAM,gBAbnB,SAAS,aAAa,uBAAuB,aAAa,cACtD;EACE,GAAG;GACF,WAAW;GACV,GAAG;GACH,gCACG,KAAuD,mCACxD,gCAAgC,WAAW,CAAC,CAAC,KAC7C;EACJ;CACF,IACA,OAIJ,UACA,QACA,QACA,UACA,wBAAwB,WAAW,GACnC,SAAS,aACT,SAAS,qBACX;CACA,MAAM,SAAS,OAAO;CAEtB,IAAI,QAAQ,aACV,kBAAkB,UAAU;EAAE;EAAkB;EAAY;EAAU;CAAO,CAAC;CAGhF,OAAO;AACT"}
+{"version":3,"file":"run-oauth2-authorize.js","names":[],"sources":["../../../../../src/v2/blocks/scalar-auth-selector-block/helpers/run-oauth2-authorize.ts"],"sourcesContent":["import type { ErrorResponse } from '@scalar/helpers/errors/normalize-error'\nimport type { WorkspaceEventBus } from '@scalar/workspace-store/events'\nimport { type OAuthFlowsObjectSecret, getEnvironmentVariables } from '@scalar/workspace-store/request-example'\nimport type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments'\nimport type { ServerObject } from '@scalar/workspace-store/schemas/v3.2/strict/openapi-document'\n\nimport type { OAuth2Options } from '@/v2/blocks/scalar-auth-selector-block/components/OAuth2.vue'\nimport { type OAuth2Tokens, authorizeOauth2 } from '@/v2/blocks/scalar-auth-selector-block/helpers/oauth'\nimport { resolveDefaultOAuth2RedirectUri } from '@/v2/blocks/scalar-auth-selector-block/helpers/resolve-default-oauth2-redirect-url'\n\n/**\n * Persists OAuth2 tokens split across the two schemes that care about them:\n *\n * - The **access token** lands on the consuming HTTP bearer scheme, so it is sent as\n *   `Authorization: Bearer <token>` without the bearer scheme losing focus.\n * - The **refresh token** stays on the oauth2 scheme, which is the only place that knows\n *   how to refresh (token URL, flow, client credentials).\n */\nexport const storeOAuth2Tokens = (\n  eventBus: WorkspaceEventBus,\n  params: {\n    bearerSchemeName: string\n    oauth2Name: string\n    flowType: keyof OAuthFlowsObjectSecret\n    tokens: OAuth2Tokens\n  },\n): void => {\n  const { bearerSchemeName, oauth2Name, flowType, tokens } = params\n\n  eventBus.emit('auth:update:security-scheme-secrets', {\n    payload: { type: 'http', 'x-scalar-secret-token': tokens.accessToken },\n    name: bearerSchemeName,\n  })\n\n  if (tokens.refreshToken) {\n    eventBus.emit('auth:update:security-scheme-secrets', {\n      payload: {\n        type: 'oauth2',\n        [flowType]: { 'x-scalar-secret-refresh-token': tokens.refreshToken },\n      },\n      name: oauth2Name,\n    })\n  }\n}\n\n/**\n * Runs the OAuth2 authorization flow and stores the resulting tokens on the bearer scheme\n * (access token) and the oauth2 scheme (refresh token).\n *\n * Used by the bearer scheme's \"Authorize via OAuth2\" shortcut: it defaults the redirect URI\n * (`authorizeOauth2` reads it straight off the flow), kicks off the flow, then routes the\n * tokens through {@link storeOAuth2Tokens}.\n */\nexport const runOAuth2Authorize = async (params: {\n  eventBus: WorkspaceEventBus\n  bearerSchemeName: string\n  oauth2Name: string\n  flows: OAuthFlowsObjectSecret\n  flowType: keyof OAuthFlowsObjectSecret\n  scopes: string[]\n  server: ServerObject | null\n  proxyUrl: string\n  environment: XScalarEnvironment\n  options?: OAuth2Options\n}): Promise<ErrorResponse<OAuth2Tokens>> => {\n  const { eventBus, bearerSchemeName, oauth2Name, flows, flowType, scopes, server, proxyUrl, environment, options } =\n    params\n\n  const flow = flows[flowType]\n\n  // authorizeOauth2 reads the redirect URI directly off interactive flows, so default it\n  // when unset — a scheme merged in from Scalar config can then authorize without first\n  // opening the configuration form.\n  const preparedFlows =\n    flow && (flowType === 'authorizationCode' || flowType === 'implicit')\n      ? {\n          ...flows,\n          [flowType]: {\n            ...flow,\n            'x-scalar-secret-redirect-uri':\n              (flow as unknown as Record<string, string | undefined>)['x-scalar-secret-redirect-uri'] ||\n              resolveDefaultOAuth2RedirectUri(options ?? {}) ||\n              '',\n          },\n        }\n      : flows\n\n  const result = await authorizeOauth2(\n    preparedFlows,\n    flowType,\n    scopes,\n    server,\n    proxyUrl,\n    getEnvironmentVariables(environment),\n    options?.customFetch,\n    options?.captureOAuth2Callback,\n  )\n  const tokens = result[1]\n\n  if (tokens?.accessToken) {\n    storeOAuth2Tokens(eventBus, { bearerSchemeName, oauth2Name, flowType, tokens })\n  }\n\n  return result\n}\n"],"mappings":";;;;;;;;;;;;AAkBA,IAAa,qBACX,UACA,WAMS;CACT,MAAM,EAAE,kBAAkB,YAAY,UAAU,WAAW;CAE3D,SAAS,KAAK,uCAAuC;EACnD,SAAS;GAAE,MAAM;GAAQ,yBAAyB,OAAO;EAAY;EACrE,MAAM;CACR,CAAC;CAED,IAAI,OAAO,cACT,SAAS,KAAK,uCAAuC;EACnD,SAAS;GACP,MAAM;IACL,WAAW,EAAE,iCAAiC,OAAO,aAAa;EACrE;EACA,MAAM;CACR,CAAC;AAEL;;;;;;;;;AAUA,IAAa,qBAAqB,OAAO,WAWG;CAC1C,MAAM,EAAE,UAAU,kBAAkB,YAAY,OAAO,UAAU,QAAQ,QAAQ,UAAU,aAAa,YACtG;CAEF,MAAM,OAAO,MAAM;CAKnB,MAAM,gBACJ,SAAS,aAAa,uBAAuB,aAAa,cACtD;EACE,GAAG;GACF,WAAW;GACV,GAAG;GACH,gCACG,KAAuD,mCACxD,gCAAgC,WAAW,CAAC,CAAC,KAC7C;EACJ;CACF,IACA;CAEN,MAAM,SAAS,MAAM,gBACnB,eACA,UACA,QACA,QACA,UACA,wBAAwB,WAAW,GACnC,SAAS,aACT,SAAS,qBACX;CACA,MAAM,SAAS,OAAO;CAEtB,IAAI,QAAQ,aACV,kBAAkB,UAAU;EAAE;EAAkB;EAAY;EAAU;CAAO,CAAC;CAGhF,OAAO;AACT"}

package/dist/v2/blocks/scalar-auth-selector-block/index.js

@@ -1,2 +1 @@
-import AuthSelector_default from "./components/AuthSelector.vue.js";
-export { AuthSelector_default as AuthSelector };
+export { default as AuthSelector } from "./components/AuthSelector.vue.js";

package/dist/v2/components/code-input/CodeInput.vue.d.ts

@@ -1,7 +1,7 @@
 import { EditorView, type CodeMirrorLanguage, type Extension } from '@scalar/use-codemirror';
 import type { XScalarEnvironment } from '@scalar/workspace-store/schemas/extensions/document/x-scalar-environments';
 import { type Ref } from 'vue';
-import type { ClientLayout } from '../../../v2/types/layout';
+import type { ClientLayout } from '../../types/layout.js';
 export type CodeInputModelValue = string | number | boolean | Array<string | number | boolean> | Record<string, unknown>;
 /**
  * CodeInput

package/dist/v2/components/code-input/CodeInput.vue.js

@@ -1,7 +1,7 @@
 import _plugin_vue_export_helper_default from "../../../_virtual/_plugin-vue_export-helper.js";
-import CodeInput_vue_vue_type_script_setup_true_lang_default from "./CodeInput.vue.script.js";
-/* empty css                        */
-/* empty css                          */
+import CodeInput_vue_vue_type_script_setup_true_lang_default from "./CodeInput.vue_vue_type_script_setup_true_lang.js";
+/* empty css                                                              */
+/* empty css                                              */
 //#region src/v2/components/code-input/CodeInput.vue
 var CodeInput_default = /*#__PURE__*/ _plugin_vue_export_helper_default(CodeInput_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-fce866d6"]]);
 //#endregion