@scalar/api-client 3.6.1 → 3.8.0

package/CHANGELOG.md

@@ -1,5 +1,155 @@
 # @scalar/api-client
 
+## 3.8.0
+
+### Minor Changes
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: make `WorkspaceDocument` an union of OpenApiDocument and AsyncApiDocument
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: let the command palette pick a registry document version
+
+### Patch Changes
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: add Cmd/Ctrl+S for `ui:save:local-document` so hosts (e.g. scalar-app) can match the header Save control for local workspaces
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix(api-client): block invalid request URLs before send and surface `buildRequest` failures as results
+
+  Request construction now treats a bad merged URL as a first-class failure instead of throwing deep inside helpers. After `mergeUrls`, `resolveRequestFactoryUrl` rejects incomplete targets when strict mode applies: relative URLs, an empty server base, or path strings that still contain unresolved `{{variable}}` placeholders. Callers may set `allowMissingRequestServerBase` where a full absolute URL is intentionally optional (for example the embedded modal layout in `OperationBlock`, or API Reference `onBeforeRequest` hooks that build against the document origin).
+
+  `buildRequest` returns a `Result` (`ok` / `err`) with stable error codes such as `MISSING_REQUEST_SERVER_BASE`, `INVALID_REQUEST_FACTORY_URL`, and `BUILD_REQUEST_FAILED` for unexpected synchronous failures. Those failures are wrapped with `safeRun` from `@scalar/helpers`, which logs to `console.error` and maps throws to a string message on the result. The API Reference plugin path logs and skips `onBeforeRequest` when a preview request cannot be built, so user hooks never run against a half-built fetch payload.
+
+  Downstream packages (`api-client`, `api-reference`, `scalar-app` where applicable) unwrap the result, show toasts or logs, and avoid calling `sendRequest` until the URL is valid.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: OAuth scope CRUD UI
+  - **Scope definitions vs selection**: adding, editing, or removing a scope on the OAuth flow now goes through dedicated workspace events `auth:upsert:scopes` and `auth:delete:scopes`, plumbed from `OAuth2` → `RequestAuthTab` → `RequestAuthDataTable` and registered in `initializeWorkspaceEventHandlers`. Updating checked scopes remains `auth:update:selected-scopes` without `newScopePayload`.
+  - **OAuthScopesInput**: row hover actions to edit or delete a scope; one shared add/edit modal; when the flow defines no scopes, the summary shows **No Scopes Defined**, **Select All** / **Deselect All** and the expand chevron are hidden, the disclosure summary is disabled, and **Add Scope** stays outside so it remains clickable; the `–` before a description is omitted when the description is empty or missing.
+  - **OAuthScopesAddModal**: supports edit mode (`scope` prop), inline errors for missing name and duplicate names (replacing toast-only validation), trims submitted names, and tests clean up teleported modal DOM between runs.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: some polish for the scalar-app
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: format raw JSON responses with jsonc-parser
+
+  Raw JSON response bodies in the API client are now formatted with `jsonc-parser` instead of `@scalar/helpers` `prettyPrintJson`. The previous path parsed with `JSON.parse` and re-stringified with `JSON.stringify`, which coerces every JSON number to a JavaScript `Number` and loses precision for integers beyond `Number.MAX_SAFE_INTEGER` (a common pain point for 64-bit IDs and other large values). `jsonc-parser` formats the document as text, so numeric literals stay identical to the response on the wire while indentation and line breaks are still normalized. JSON with Comments (JSONC) tokens also remain valid alongside CodeMirror’s JSON mode.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): Remove unwanted scrollbar beside auth scope checkboxes
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: share executable URL build for copy and buildRequest
+
+  Copy URL from the operation address bar now matches the URL that is actually sent: path parameters, operation query string, environment substitution, and security schemes that use in: query are all applied the same way as Send.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: handle registry document and version deletion in document settings
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: prevent address bar from stretching past max width
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: add more analytics events
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: add Preview/Raw tabs for JSON responses with true raw body view
+
+  JSON bodies now open on a formatted Preview tab (JSONC pretty-print without JSON.parse round-trip). The Raw tab shows the exact decoded response text. Other media types are unchanged; HTML, images, and other previews already used the same toggle pattern.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: padding on addressbar with no servers
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: history bug on operation switch
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix(api-client): narrow request table parameter info popover width
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix(api-client): expand object query parameters in the request UI
+- [#9211](https://github.com/scalar/scalar/pull/9211): feat: optimize layout for mobile
+  - Hide the document breadcrumb on small screens and surface workspace
+    switching from the menu instead, so the top bar stays uncluttered.
+  - Convert the document save / discard / pull / push / publish buttons to
+    header-button styling and only render the trailing divider when there
+    are actual cluster buttons next to it.
+  - Stack the address bar onto two rows on small screens so the URL and
+    the action cluster (copy / history / send) each get a full row.
+  - Hide the "Log in" affordance from the small-screen top bar (the menu
+    still owns it) and keep only the primary "Register" CTA there.
+  - Give the pre-request and post-response script editors proper vertical
+    padding so the help text no longer clips when it wraps.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix(api-client): hide OAuth2 client secret when PKCE is enabled and omit it from token requests
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: posthog stream warning
+- [#9211](https://github.com/scalar/scalar/pull/9211): refactor: remove the main import file since it was empty
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix(api-client): request body content types — OpenAPI extras, MIME labels, and "Other" without auto Content-Type
+
+  The request body dropdown lists built-in types first, then any additional media types from the OpenAPI operation. Labels use the MIME essence (no `charset` in the label). The **Other** option is available again for a raw body: it does **not** add an automatic `Content-Type` header (users can set one manually). Code snippets avoid injecting `Content-Type: other`.
+
+  `getDefaultHeaders` and `filterDisabledDefaultHeaders` are exported from `@scalar/workspace-store/request-example`; the API client uses them for code snippets instead of a duplicate helper.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix invalid Tailwind gap utility in the address bar
+- [#9211](https://github.com/scalar/scalar/pull/9211): fix: prevent stuck response overlay after overlapping sends
+
+  Fixes a case where the response loading overlay could stay visible indefinitely and **Cancel** had no effect after opening an example and sending a request very quickly (or when multiple sends overlapped).
+  The reason for that is that `ResponseLoadingOverlay` delays showing the spinner by 1s. Each `hooks:on:request:sent` scheduled a new `setTimeout` without clearing the previous one. Overlapping `sent` events could leave an orphaned timer that still called `loader.start()` after the request had already finished and `hooks:on:request:complete` had run—so the overlay turned on with no further `complete`, and **Cancel** targeted an `AbortController` that no longer matched the finished request.
+
+- [#9211](https://github.com/scalar/scalar/pull/9211): build: switch Monaco Vite plugin to ESM and align workers
+- [#9211](https://github.com/scalar/scalar/pull/9211): chore: move app files from client to scalar-app
+
+## 3.7.0
+
+### Minor Changes
+
+- [#9018](https://github.com/scalar/scalar/pull/9018): feat: make `WorkspaceDocument` an union of OpenApiDocument and AsyncApiDocument
+- [#9089](https://github.com/scalar/scalar/pull/9089): feat: let the command palette pick a registry document version
+
+### Patch Changes
+
+- [#9185](https://github.com/scalar/scalar/pull/9185): feat: add Cmd/Ctrl+S for `ui:save:local-document` so hosts (e.g. scalar-app) can match the header Save control for local workspaces
+- [#9184](https://github.com/scalar/scalar/pull/9184): fix(api-client): block invalid request URLs before send and surface `buildRequest` failures as results
+
+  Request construction now treats a bad merged URL as a first-class failure instead of throwing deep inside helpers. After `mergeUrls`, `resolveRequestFactoryUrl` rejects incomplete targets when strict mode applies: relative URLs, an empty server base, or path strings that still contain unresolved `{{variable}}` placeholders. Callers may set `allowMissingRequestServerBase` where a full absolute URL is intentionally optional (for example the embedded modal layout in `OperationBlock`, or API Reference `onBeforeRequest` hooks that build against the document origin).
+
+  `buildRequest` returns a `Result` (`ok` / `err`) with stable error codes such as `MISSING_REQUEST_SERVER_BASE`, `INVALID_REQUEST_FACTORY_URL`, and `BUILD_REQUEST_FAILED` for unexpected synchronous failures. Those failures are wrapped with `safeRun` from `@scalar/helpers`, which logs to `console.error` and maps throws to a string message on the result. The API Reference plugin path logs and skips `onBeforeRequest` when a preview request cannot be built, so user hooks never run against a half-built fetch payload.
+
+  Downstream packages (`api-client`, `api-reference`, `scalar-app` where applicable) unwrap the result, show toasts or logs, and avoid calling `sendRequest` until the URL is valid.
+
+- [#9168](https://github.com/scalar/scalar/pull/9168): fix: OAuth scope CRUD UI
+  - **Scope definitions vs selection**: adding, editing, or removing a scope on the OAuth flow now goes through dedicated workspace events `auth:upsert:scopes` and `auth:delete:scopes`, plumbed from `OAuth2` → `RequestAuthTab` → `RequestAuthDataTable` and registered in `initializeWorkspaceEventHandlers`. Updating checked scopes remains `auth:update:selected-scopes` without `newScopePayload`.
+  - **OAuthScopesInput**: row hover actions to edit or delete a scope; one shared add/edit modal; when the flow defines no scopes, the summary shows **No Scopes Defined**, **Select All** / **Deselect All** and the expand chevron are hidden, the disclosure summary is disabled, and **Add Scope** stays outside so it remains clickable; the `–` before a description is omitted when the description is empty or missing.
+  - **OAuthScopesAddModal**: supports edit mode (`scope` prop), inline errors for missing name and duplicate names (replacing toast-only validation), trims submitted names, and tests clean up teleported modal DOM between runs.
+
+- [#9199](https://github.com/scalar/scalar/pull/9199): feat: some polish for the scalar-app
+- [#9171](https://github.com/scalar/scalar/pull/9171): fix: format raw JSON responses with jsonc-parser
+
+  Raw JSON response bodies in the API client are now formatted with `jsonc-parser` instead of `@scalar/helpers` `prettyPrintJson`. The previous path parsed with `JSON.parse` and re-stringified with `JSON.stringify`, which coerces every JSON number to a JavaScript `Number` and loses precision for integers beyond `Number.MAX_SAFE_INTEGER` (a common pain point for 64-bit IDs and other large values). `jsonc-parser` formats the document as text, so numeric literals stay identical to the response on the wire while indentation and line breaks are still normalized. JSON with Comments (JSONC) tokens also remain valid alongside CodeMirror’s JSON mode.
+
+- [#9204](https://github.com/scalar/scalar/pull/9204): Remove unwanted scrollbar beside auth scope checkboxes
+- [#9150](https://github.com/scalar/scalar/pull/9150): fix: share executable URL build for copy and buildRequest
+
+  Copy URL from the operation address bar now matches the URL that is actually sent: path parameters, operation query string, environment substitution, and security schemes that use in: query are all applied the same way as Send.
+
+- [#9081](https://github.com/scalar/scalar/pull/9081): fix: handle registry document and version deletion in document settings
+- [#9173](https://github.com/scalar/scalar/pull/9173): fix: prevent address bar from stretching past max width
+- [#9125](https://github.com/scalar/scalar/pull/9125): feat: add more analytics events
+- [#9172](https://github.com/scalar/scalar/pull/9172): feat: add Preview/Raw tabs for JSON responses with true raw body view
+
+  JSON bodies now open on a formatted Preview tab (JSONC pretty-print without JSON.parse round-trip). The Raw tab shows the exact decoded response text. Other media types are unchanged; HTML, images, and other previews already used the same toggle pattern.
+
+- [#9205](https://github.com/scalar/scalar/pull/9205): fix: padding on addressbar with no servers
+- [#9197](https://github.com/scalar/scalar/pull/9197): fix: history bug on operation switch
+- [#9146](https://github.com/scalar/scalar/pull/9146): fix(api-client): narrow request table parameter info popover width
+- [#9055](https://github.com/scalar/scalar/pull/9055): fix(api-client): expand object query parameters in the request UI
+- [#9135](https://github.com/scalar/scalar/pull/9135): feat: optimize layout for mobile
+  - Hide the document breadcrumb on small screens and surface workspace
+    switching from the menu instead, so the top bar stays uncluttered.
+  - Convert the document save / discard / pull / push / publish buttons to
+    header-button styling and only render the trailing divider when there
+    are actual cluster buttons next to it.
+  - Stack the address bar onto two rows on small screens so the URL and
+    the action cluster (copy / history / send) each get a full row.
+  - Hide the "Log in" affordance from the small-screen top bar (the menu
+    still owns it) and keep only the primary "Register" CTA there.
+  - Give the pre-request and post-response script editors proper vertical
+    padding so the help text no longer clips when it wraps.
+
+- [#9174](https://github.com/scalar/scalar/pull/9174): fix(api-client): hide OAuth2 client secret when PKCE is enabled and omit it from token requests
+- [#9124](https://github.com/scalar/scalar/pull/9124): fix: posthog stream warning
+- [#9122](https://github.com/scalar/scalar/pull/9122): refactor: remove the main import file since it was empty
+- [#9134](https://github.com/scalar/scalar/pull/9134): fix(api-client): request body content types — OpenAPI extras, MIME labels, and "Other" without auto Content-Type
+
+  The request body dropdown lists built-in types first, then any additional media types from the OpenAPI operation. Labels use the MIME essence (no `charset` in the label). The **Other** option is available again for a raw body: it does **not** add an automatic `Content-Type` header (users can set one manually). Code snippets avoid injecting `Content-Type: other`.
+
+  `getDefaultHeaders` and `filterDisabledDefaultHeaders` are exported from `@scalar/workspace-store/request-example`; the API client uses them for code snippets instead of a duplicate helper.
+
+- [#9199](https://github.com/scalar/scalar/pull/9199): fix invalid Tailwind gap utility in the address bar
+- [#9130](https://github.com/scalar/scalar/pull/9130): fix: prevent stuck response overlay after overlapping sends
+
+  Fixes a case where the response loading overlay could stay visible indefinitely and **Cancel** had no effect after opening an example and sending a request very quickly (or when multiple sends overlapped).
+  The reason for that is that `ResponseLoadingOverlay` delays showing the spinner by 1s. Each `hooks:on:request:sent` scheduled a new `setTimeout` without clearing the previous one. Overlapping `sent` events could leave an orphaned timer that still called `loader.start()` after the request had already finished and `hooks:on:request:complete` had run—so the overlay turned on with no further `complete`, and **Cancel** targeted an `AbortController` that no longer matched the finished request.
+
+- [#9110](https://github.com/scalar/scalar/pull/9110): build: switch Monaco Vite plugin to ESM and align workers
+- [#9113](https://github.com/scalar/scalar/pull/9113): chore: move app files from client to scalar-app
+
 ## 3.6.1
 
 ### Patch Changes

package/dist/components/HttpMethod/HttpMethod.vue.js

@@ -1,6 +1,6 @@
-import _plugin_vue_export_helper_default from "../../_virtual/_plugin-vue_export-helper.js";
 import HttpMethod_vue_vue_type_script_setup_true_lang_default from "./HttpMethod.vue.script.js";
 /* empty css                         */
+import _plugin_vue_export_helper_default from "../../_virtual/_plugin-vue_export-helper.js";
 //#region src/components/HttpMethod/HttpMethod.vue
 var HttpMethod_default = /* @__PURE__ */ _plugin_vue_export_helper_default(HttpMethod_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-7a19f363"]]);
 //#endregion

package/dist/components/HttpMethod/index.js

@@ -0,0 +1,2 @@
+import HttpMethod_default from "./HttpMethod.vue.js";
+export { HttpMethod_default as HttpMethod };

package/dist/components/ScalarAsciiArt/ScalarAsciiArt.vue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScalarAsciiArt.vue.d.ts","sourceRoot":"","sources":["../../../src/components/ScalarAsciiArt/ScalarAsciiArt.vue"],"names":[],"mappings":"AAoEA,KAAK,WAAW,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AA2EtD,QAAA,MAAM,YAAY,kSAEhB,CAAC;wBACkB,OAAO,YAAY;AAAxC,wBAAyC"}

package/dist/components/{ScalarAsciiArt.vue.js → ScalarAsciiArt/ScalarAsciiArt.vue.js}

@@ -1,8 +1,8 @@
-import _plugin_vue_export_helper_default from "../_virtual/_plugin-vue_export-helper.js";
+import _plugin_vue_export_helper_default from "../../_virtual/_plugin-vue_export-helper.js";
 import ScalarAsciiArt_vue_vue_type_script_setup_true_lang_default from "./ScalarAsciiArt.vue.script.js";
 /* empty css                             */
-//#region src/components/ScalarAsciiArt.vue
-var ScalarAsciiArt_default = /* @__PURE__ */ _plugin_vue_export_helper_default(ScalarAsciiArt_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-69ebd973"]]);
+//#region src/components/ScalarAsciiArt/ScalarAsciiArt.vue
+var ScalarAsciiArt_default = /* @__PURE__ */ _plugin_vue_export_helper_default(ScalarAsciiArt_vue_vue_type_script_setup_true_lang_default, [["__scopeId", "data-v-9a695e58"]]);
 //#endregion
 export { ScalarAsciiArt_default as default };
 

package/dist/components/ScalarAsciiArt/ScalarAsciiArt.vue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScalarAsciiArt.vue.js","names":[],"sources":["../../../src/components/ScalarAsciiArt/ScalarAsciiArt.vue"],"sourcesContent":["<script setup lang=\"ts\">\nimport { computed, type StyleValue } from 'vue'\n\nconst props = defineProps<{ art: string; animate?: boolean }>()\n\nconst BLINK = 500 // ms - Cursor blink speed\nconst PRINT = 100 // ms - Text print speed\n\nconst lines = computed<string[]>(() => props.art.split('\\n'))\n\nconst getLineAnimation = (chars: number, row: number): StyleValue => ({\n  animationDuration: `${chars * PRINT}ms, ${BLINK}ms`,\n  animationTimingFunction: `steps(${chars}), step-end`,\n  animationDelay: `${row * PRINT}ms, 0ms`,\n  animationIterationCount: `1, ${(((lines.value?.length ?? 0) + (lines.value?.[lines.value?.length - 1]?.length ?? 0) + 5) * PRINT) / BLINK}`,\n})\n</script>\n<template>\n  <div\n    aria-hidden=\"true\"\n    class=\"ascii-art font-code flex flex-col items-start text-[6px] leading-[7px]\"\n    :class=\"{ 'ascii-art-animate': animate }\"\n    role=\"presentation\"\n    inert>\n    <span\n      v-for=\"(line, i) in lines\"\n      :key=\"i\"\n      class=\"inline-block\"\n      :style=\"{ width: `calc(${line.length + 1}ch)` }\">\n      <!-- prettier-ignore -->\n      <span\nclass=\"inline-block whitespace-pre overflow-hidden\"\n:style=\"getLineAnimation(line.length, i)\">{{\n       line\n      }}</span>\n    </span>\n  </div>\n</template>\n<style scoped>\n.ascii-art-animate .ascii-art-line {\n  border-right: 1ch solid transparent;\n  animation:\n    typewriter 4s steps(1) 1s 1 normal both,\n    blinkTextCursor 500ms steps(1) infinite normal;\n}\n\n@keyframes typewriter {\n  from {\n    width: 0;\n  }\n  to {\n    width: 100%;\n  }\n}\n@keyframes blinkTextCursor {\n  0% {\n    border-right-color: currentColor;\n  }\n  50% {\n    border-right-color: transparent;\n  }\n}\n</style>\n"],"mappings":""}

package/dist/components/{ScalarAsciiArt.vue.script.js → ScalarAsciiArt/ScalarAsciiArt.vue.script.js}

@@ -1,5 +1,5 @@
 import { Fragment, computed, createElementBlock, createElementVNode, defineComponent, normalizeClass, normalizeStyle, openBlock, renderList, toDisplayString } from "vue";
-//#region src/components/ScalarAsciiArt.vue?vue&type=script&setup=true&lang.ts
+//#region src/components/ScalarAsciiArt/ScalarAsciiArt.vue?vue&type=script&setup=true&lang.ts
 var BLINK = 500;
 var PRINT = 100;
 var ScalarAsciiArt_vue_vue_type_script_setup_true_lang_default = /* @__PURE__ */ defineComponent({

package/dist/components/ScalarAsciiArt/ScalarAsciiArt.vue.script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ScalarAsciiArt.vue.script.js","names":[],"sources":["../../../src/components/ScalarAsciiArt/ScalarAsciiArt.vue"],"sourcesContent":["<script setup lang=\"ts\">\nimport { computed, type StyleValue } from 'vue'\n\nconst props = defineProps<{ art: string; animate?: boolean }>()\n\nconst BLINK = 500 // ms - Cursor blink speed\nconst PRINT = 100 // ms - Text print speed\n\nconst lines = computed<string[]>(() => props.art.split('\\n'))\n\nconst getLineAnimation = (chars: number, row: number): StyleValue => ({\n  animationDuration: `${chars * PRINT}ms, ${BLINK}ms`,\n  animationTimingFunction: `steps(${chars}), step-end`,\n  animationDelay: `${row * PRINT}ms, 0ms`,\n  animationIterationCount: `1, ${(((lines.value?.length ?? 0) + (lines.value?.[lines.value?.length - 1]?.length ?? 0) + 5) * PRINT) / BLINK}`,\n})\n</script>\n<template>\n  <div\n    aria-hidden=\"true\"\n    class=\"ascii-art font-code flex flex-col items-start text-[6px] leading-[7px]\"\n    :class=\"{ 'ascii-art-animate': animate }\"\n    role=\"presentation\"\n    inert>\n    <span\n      v-for=\"(line, i) in lines\"\n      :key=\"i\"\n      class=\"inline-block\"\n      :style=\"{ width: `calc(${line.length + 1}ch)` }\">\n      <!-- prettier-ignore -->\n      <span\nclass=\"inline-block whitespace-pre overflow-hidden\"\n:style=\"getLineAnimation(line.length, i)\">{{\n       line\n      }}</span>\n    </span>\n  </div>\n</template>\n<style scoped>\n.ascii-art-animate .ascii-art-line {\n  border-right: 1ch solid transparent;\n  animation:\n    typewriter 4s steps(1) 1s 1 normal both,\n    blinkTextCursor 500ms steps(1) infinite normal;\n}\n\n@keyframes typewriter {\n  from {\n    width: 0;\n  }\n  to {\n    width: 100%;\n  }\n}\n@keyframes blinkTextCursor {\n  0% {\n    border-right-color: currentColor;\n  }\n  50% {\n    border-right-color: transparent;\n  }\n}\n</style>\n"],"mappings":";;AAKA,IAAM,QAAQ;AACd,IAAM,QAAQ;;;;;;;;EAHd,MAAM,QAAQ;EAKd,MAAM,QAAQ,eAAyB,MAAM,IAAI,MAAM,KAAK,CAAA;EAE5D,MAAM,oBAAoB,OAAe,SAA6B;GACpE,mBAAmB,GAAG,QAAQ,MAAM,MAAM,MAAM;GAChD,yBAAyB,SAAS,MAAM;GACxC,gBAAgB,GAAG,MAAM,MAAM;GAC/B,yBAAyB,QAAS,MAAM,OAAO,UAAU,MAAM,MAAM,QAAQ,MAAM,OAAO,SAAS,IAAI,UAAU,KAAK,KAAK,QAAS;GACrI;;uBAGC,mBAkBM,OAAA;IAjBJ,eAAY;IACZ,OAAK,eAAA,CAAC,0EAAwE,EAAA,qBAC/C,QAAA,SAAO,CAAA,CAAA;IACtC,MAAK;IACL,OAAA;yBACA,mBAWO,UAAA,MAAA,WAVe,MAAA,QAAZ,MAAM,MAAC;wBADjB,mBAWO,QAAA;KATJ,KAAK;KACN,OAAM;KACL,OAAK,eAAA,EAAA,OAAA,QAAmB,KAAK,SAAM,EAAA,MAAA,CAAA;QAEpC,mBAIS,QAAA;KAHf,OAAM;KACL,OAAK,eAAE,iBAAiB,KAAK,QAAQ,EAAC,CAAA;uBAChC,KAAI,EAAA,EAAA,CAAA,EAAA,EAAA"}

package/dist/components/ScalarAsciiArt/index.d.ts

@@ -0,0 +1,2 @@
+export { default as ScalarAsciiArt } from './ScalarAsciiArt.vue.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/ScalarAsciiArt/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/ScalarAsciiArt/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,cAAc,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/components/ScalarAsciiArt/index.js

@@ -0,0 +1,2 @@
+import ScalarAsciiArt_default from "./ScalarAsciiArt.vue.js";
+export { ScalarAsciiArt_default as ScalarAsciiArt };

package/dist/components/Sidebar/Actions/DeleteSidebarListElement.vue.d.ts

@@ -3,11 +3,11 @@ type __VLS_Props = {
     warningMessage: string | undefined;
 };
 declare const __VLS_export: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
-    close: () => any;
     delete: () => any;
+    close: () => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
-    onClose?: (() => any) | undefined;
     onDelete?: (() => any) | undefined;
+    onClose?: (() => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;
 export default _default;

package/dist/components/Sidebar/Actions/SidebarListElementForm.vue.d.ts

@@ -7,11 +7,11 @@ type __VLS_Slots = {} & {
     default?: (props: typeof __VLS_1) => any;
 };
 declare const __VLS_base: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
-    cancel: () => any;
     submit: () => any;
+    cancel: () => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
-    onCancel?: (() => any) | undefined;
     onSubmit?: (() => any) | undefined;
+    onCancel?: (() => any) | undefined;
 }>, {}, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const __VLS_export: __VLS_WithSlots<typeof __VLS_base, __VLS_Slots>;
 declare const _default: typeof __VLS_export;

package/dist/components/Sidebar/index.d.ts

@@ -0,0 +1,2 @@
+export { default as DeleteSidebarListElement } from './Actions/DeleteSidebarListElement.vue.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/Sidebar/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/Sidebar/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,wBAAwB,EAAE,MAAM,wCAAwC,CAAA"}

package/dist/components/Sidebar/index.js

@@ -0,0 +1,2 @@
+import DeleteSidebarListElement_default from "./Actions/DeleteSidebarListElement.vue.js";
+export { DeleteSidebarListElement_default as DeleteSidebarListElement };

package/dist/components/ViewLayout/index.d.ts

@@ -0,0 +1,4 @@
+export { default as ViewLayout } from './ViewLayout.vue.js';
+export { default as ViewLayoutContent } from './ViewLayoutContent.vue.js';
+export { default as ViewLayoutSection } from './ViewLayoutSection.vue.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/components/ViewLayout/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/components/ViewLayout/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACxD,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AACtE,OAAO,EAAE,OAAO,IAAI,iBAAiB,EAAE,MAAM,yBAAyB,CAAA"}

package/dist/components/ViewLayout/index.js

@@ -0,0 +1,4 @@
+import ViewLayout_default from "./ViewLayout.vue.js";
+import ViewLayoutContent_default from "./ViewLayoutContent.vue.js";
+import ViewLayoutSection_default from "./ViewLayoutSection.vue.js";
+export { ViewLayout_default as ViewLayout, ViewLayoutContent_default as ViewLayoutContent, ViewLayoutSection_default as ViewLayoutSection };

package/dist/plugins/posthog/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/posthog/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,YAAY,CAAA;AAGzD,MAAM,MAAM,aAAa,GAAG;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,cAAc,CAAA;CAC1B,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,aAAa,KAAG,YA4D3D,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/plugins/posthog/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAW,MAAM,YAAY,CAAA;AAKzD,MAAM,MAAM,aAAa,GAAG;IAC1B,mCAAmC;IACnC,MAAM,EAAE,MAAM,CAAA;IACd,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAA;IACf,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,cAAc,CAAA;CAC1B,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,aAAa,KAAG,YAkF3D,CAAA"}

package/dist/plugins/posthog/index.js

@@ -1,3 +1,4 @@
+import { sanitizeEventPayload } from "./sanitize-event-payload.js";
 import ph from "posthog-js";
 //#region src/plugins/posthog/index.ts
 /**
@@ -12,18 +13,26 @@ import ph from "posthog-js";
 var PostHogClientPlugin = (config) => {
 	let posthog = null;
 	return {
-		on: {
-			"hooks:on:request:sent": () => posthog?.capture("hooks:on:request:sent"),
-			"operation:create:operation": () => posthog?.capture("operation:create:operation"),
-			"operation:delete:operation": () => posthog?.capture("operation:delete:operation"),
-			"document:create:empty-document": () => posthog?.capture("document:create:empty-document"),
-			"document:delete:document": () => posthog?.capture("document:delete:document"),
-			"tag:create:tag": () => posthog?.capture("tag:create:tag"),
-			"server:add:server": () => posthog?.capture("server:add:server"),
-			"auth:update:selected-security-schemes": () => posthog?.capture("auth:update:selected-security-schemes"),
-			"environment:upsert:environment": () => posthog?.capture("environment:upsert:environment"),
-			"ui:open:client-modal": () => posthog?.capture("ui:open:client-modal"),
-			"ui:download:document": () => posthog?.capture("ui:download:document")
+		on: ({ event, payload }) => {
+			if (event === "log:user-login") {
+				if (payload?.uid) posthog?.identify(payload.uid, {
+					email: payload.email,
+					teamUid: payload.teamUid
+				});
+				return;
+			}
+			if (event === "log:user-logout") {
+				posthog?.reset();
+				return;
+			}
+			const result = sanitizeEventPayload(event, payload);
+			if (result === null) return;
+			const properties = typeof result === "object" && result !== null ? result : { value: result };
+			if (Object.keys(properties).length === 0) {
+				posthog?.capture(event);
+				return;
+			}
+			posthog?.capture(event, properties);
 		},
 		lifecycle: {
 			onInit(context) {

package/dist/plugins/posthog/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/plugins/posthog/index.ts"],"sourcesContent":["import type { ClientPlugin } from '@scalar/oas-utils/helpers'\nimport type { ConfigDefaults, PostHog } from 'posthog-js'\nimport ph from 'posthog-js'\n\nexport type PostHogConfig = {\n  /** Your PostHog project API key */\n  apiKey: string\n  /** The PostHog API host URL */\n  apiHost: string\n  /** The PostHog UI host URL (for session recordings, surveys, etc.) */\n  uiHost?: string\n  /** PostHog defaults version identifier */\n  defaults?: ConfigDefaults\n}\n\n/**\n * PostHog analytics plugin for the API Client.\n *\n * Loading this plugin opts in to analytics. If the plugin is not loaded,\n * no tracking occurs.\n *\n * Respects the `telemetry` configuration option — when set to `false`,\n * capturing is disabled. Reacts dynamically to config changes at runtime.\n */\nexport const PostHogClientPlugin = (config: PostHogConfig): ClientPlugin => {\n  let posthog: PostHog | null = null\n\n  return {\n    on: {\n      'hooks:on:request:sent': () => posthog?.capture('hooks:on:request:sent'),\n      'operation:create:operation': () => posthog?.capture('operation:create:operation'),\n      'operation:delete:operation': () => posthog?.capture('operation:delete:operation'),\n      'document:create:empty-document': () => posthog?.capture('document:create:empty-document'),\n      'document:delete:document': () => posthog?.capture('document:delete:document'),\n      'tag:create:tag': () => posthog?.capture('tag:create:tag'),\n      'server:add:server': () => posthog?.capture('server:add:server'),\n      'auth:update:selected-security-schemes': () => posthog?.capture('auth:update:selected-security-schemes'),\n      'environment:upsert:environment': () => posthog?.capture('environment:upsert:environment'),\n      'ui:open:client-modal': () => posthog?.capture('ui:open:client-modal'),\n      'ui:download:document': () => posthog?.capture('ui:download:document'),\n    },\n    lifecycle: {\n      onInit(context) {\n        if (typeof window === 'undefined') {\n          return\n        }\n\n        const instance = ph.init(\n          config.apiKey,\n          {\n            api_host: config.apiHost,\n            ...(config.uiHost ? { ui_host: config.uiHost } : {}),\n            ...(config.defaults ? { defaults: config.defaults } : {}),\n            opt_out_capturing_by_default: true,\n          },\n          'scalar-api-client',\n        )\n\n        if (instance) {\n          posthog = instance\n          posthog.register({ product: 'api-client' })\n\n          if (context?.config.telemetry !== false) {\n            posthog.opt_in_capturing()\n          }\n        }\n      },\n      onConfigChange(context) {\n        if (!posthog) {\n          return\n        }\n\n        if (context.config.telemetry === false) {\n          posthog.opt_out_capturing()\n        } else {\n          posthog.opt_in_capturing()\n        }\n      },\n      onDestroy() {\n        posthog?.reset()\n        posthog = null\n      },\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;AAwBA,IAAa,uBAAuB,WAAwC;CAC1E,IAAI,UAA0B;AAE9B,QAAO;EACL,IAAI;GACF,+BAA+B,SAAS,QAAQ,wBAAwB;GACxE,oCAAoC,SAAS,QAAQ,6BAA6B;GAClF,oCAAoC,SAAS,QAAQ,6BAA6B;GAClF,wCAAwC,SAAS,QAAQ,iCAAiC;GAC1F,kCAAkC,SAAS,QAAQ,2BAA2B;GAC9E,wBAAwB,SAAS,QAAQ,iBAAiB;GAC1D,2BAA2B,SAAS,QAAQ,oBAAoB;GAChE,+CAA+C,SAAS,QAAQ,wCAAwC;GACxG,wCAAwC,SAAS,QAAQ,iCAAiC;GAC1F,8BAA8B,SAAS,QAAQ,uBAAuB;GACtE,8BAA8B,SAAS,QAAQ,uBAAuB;GACvE;EACD,WAAW;GACT,OAAO,SAAS;AACd,QAAI,OAAO,WAAW,YACpB;IAGF,MAAM,WAAW,GAAG,KAClB,OAAO,QACP;KACE,UAAU,OAAO;KACjB,GAAI,OAAO,SAAS,EAAE,SAAS,OAAO,QAAQ,GAAG,EAAE;KACnD,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,UAAU,GAAG,EAAE;KACxD,8BAA8B;KAC/B,EACD,oBACD;AAED,QAAI,UAAU;AACZ,eAAU;AACV,aAAQ,SAAS,EAAE,SAAS,cAAc,CAAC;AAE3C,SAAI,SAAS,OAAO,cAAc,MAChC,SAAQ,kBAAkB;;;GAIhC,eAAe,SAAS;AACtB,QAAI,CAAC,QACH;AAGF,QAAI,QAAQ,OAAO,cAAc,MAC/B,SAAQ,mBAAmB;QAE3B,SAAQ,kBAAkB;;GAG9B,YAAY;AACV,aAAS,OAAO;AAChB,cAAU;;GAEb;EACF"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/plugins/posthog/index.ts"],"sourcesContent":["import type { ClientPlugin } from '@scalar/oas-utils/helpers'\nimport type { ConfigDefaults, PostHog } from 'posthog-js'\nimport ph from 'posthog-js'\n\nimport { sanitizeEventPayload } from './sanitize-event-payload'\n\nexport type PostHogConfig = {\n  /** Your PostHog project API key */\n  apiKey: string\n  /** The PostHog API host URL */\n  apiHost: string\n  /** The PostHog UI host URL (for session recordings, surveys, etc.) */\n  uiHost?: string\n  /** PostHog defaults version identifier */\n  defaults?: ConfigDefaults\n}\n\n/**\n * PostHog analytics plugin for the API Client.\n *\n * Loading this plugin opts in to analytics. If the plugin is not loaded,\n * no tracking occurs.\n *\n * Respects the `telemetry` configuration option — when set to `false`,\n * capturing is disabled. Reacts dynamically to config changes at runtime.\n */\nexport const PostHogClientPlugin = (config: PostHogConfig): ClientPlugin => {\n  let posthog: PostHog | null = null\n\n  return {\n    on: ({ event, payload }) => {\n      // User logs in — never capture this event; identify only when payload has a uid.\n      // Thanks to the tagged-union narrowing, `payload` is the login payload here;\n      // the `payload?.uid` guard is purely defensive against bad runtime data.\n      if (event === 'log:user-login') {\n        if (payload?.uid) {\n          posthog?.identify(payload.uid, { email: payload.email, teamUid: payload.teamUid })\n        }\n        return\n      }\n\n      // User logs out\n      if (event === 'log:user-logout') {\n        posthog?.reset()\n        return\n      }\n\n      // Only capture events that are in the allowlist\n      const result = sanitizeEventPayload(event, payload)\n      if (result === null) {\n        return\n      }\n\n      const properties = typeof result === 'object' && result !== null ? result : { value: result }\n\n      // When the extractor returned no useful properties, fire the event\n      // without a properties argument so PostHog records the event fact alone\n      // (rather than a noisy `{}` payload).\n      if (Object.keys(properties).length === 0) {\n        posthog?.capture(event)\n        return\n      }\n\n      posthog?.capture(event, properties)\n    },\n    lifecycle: {\n      onInit(context) {\n        if (typeof window === 'undefined') {\n          return\n        }\n\n        const instance = ph.init(\n          config.apiKey,\n          {\n            api_host: config.apiHost,\n            ...(config.uiHost ? { ui_host: config.uiHost } : {}),\n            ...(config.defaults ? { defaults: config.defaults } : {}),\n            opt_out_capturing_by_default: true,\n          },\n          'scalar-api-client',\n        )\n\n        if (instance) {\n          posthog = instance\n          posthog.register({ product: 'api-client' })\n\n          if (context?.config.telemetry !== false) {\n            posthog.opt_in_capturing()\n          }\n        }\n      },\n      onConfigChange(context) {\n        if (!posthog) {\n          return\n        }\n\n        if (context.config.telemetry === false) {\n          posthog.opt_out_capturing()\n        } else {\n          posthog.opt_in_capturing()\n        }\n      },\n      onDestroy() {\n        posthog?.reset()\n        posthog = null\n      },\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;AA0BA,IAAa,uBAAuB,WAAwC;CAC1E,IAAI,UAA0B;AAE9B,QAAO;EACL,KAAK,EAAE,OAAO,cAAc;AAI1B,OAAI,UAAU,kBAAkB;AAC9B,QAAI,SAAS,IACX,UAAS,SAAS,QAAQ,KAAK;KAAE,OAAO,QAAQ;KAAO,SAAS,QAAQ;KAAS,CAAC;AAEpF;;AAIF,OAAI,UAAU,mBAAmB;AAC/B,aAAS,OAAO;AAChB;;GAIF,MAAM,SAAS,qBAAqB,OAAO,QAAQ;AACnD,OAAI,WAAW,KACb;GAGF,MAAM,aAAa,OAAO,WAAW,YAAY,WAAW,OAAO,SAAS,EAAE,OAAO,QAAQ;AAK7F,OAAI,OAAO,KAAK,WAAW,CAAC,WAAW,GAAG;AACxC,aAAS,QAAQ,MAAM;AACvB;;AAGF,YAAS,QAAQ,OAAO,WAAW;;EAErC,WAAW;GACT,OAAO,SAAS;AACd,QAAI,OAAO,WAAW,YACpB;IAGF,MAAM,WAAW,GAAG,KAClB,OAAO,QACP;KACE,UAAU,OAAO;KACjB,GAAI,OAAO,SAAS,EAAE,SAAS,OAAO,QAAQ,GAAG,EAAE;KACnD,GAAI,OAAO,WAAW,EAAE,UAAU,OAAO,UAAU,GAAG,EAAE;KACxD,8BAA8B;KAC/B,EACD,oBACD;AAED,QAAI,UAAU;AACZ,eAAU;AACV,aAAQ,SAAS,EAAE,SAAS,cAAc,CAAC;AAE3C,SAAI,SAAS,OAAO,cAAc,MAChC,SAAQ,kBAAkB;;;GAIhC,eAAe,SAAS;AACtB,QAAI,CAAC,QACH;AAGF,QAAI,QAAQ,OAAO,cAAc,MAC/B,SAAQ,mBAAmB;QAE3B,SAAQ,kBAAkB;;GAG9B,YAAY;AACV,aAAS,OAAO;AAChB,cAAU;;GAEb;EACF"}

package/dist/plugins/posthog/sanitize-event-payload.d.ts

@@ -0,0 +1,25 @@
+import type { ApiReferenceEvents } from '@scalar/workspace-store/events';
+/**
+ * Allowlist of events that should be forwarded to PostHog.
+ *
+ * Each key is an event name; its value is an extractor that pulls only the
+ * safe, non-PII properties we want to track. Events not in this map are
+ * silently dropped — this keeps the analytics surface explicit and auditable.
+ */
+type PayloadExtractor<K extends keyof ApiReferenceEvents = keyof ApiReferenceEvents> = (payload: ApiReferenceEvents[K]) => Record<string, unknown> | ApiReferenceEvents[K];
+/** Maps every event to either a typed extractor or `undefined` (opt-out) */
+type TrackedEventsMap = {
+    [K in keyof ApiReferenceEvents]: PayloadExtractor<K> | undefined;
+};
+export declare const TRACKED_EVENTS: TrackedEventsMap;
+/**
+ * Returns sanitized properties for a tracked event, or `null` if the event
+ * should not be captured at all.
+ *
+ * This is the only function that the PostHog plugin needs to call — it
+ * encapsulates both the "should we track this?" decision and the "what
+ * properties are safe to send?" extraction in one step.
+ */
+export declare const sanitizeEventPayload: <K extends keyof ApiReferenceEvents>(event: K, payload: ApiReferenceEvents[K]) => Record<string, unknown> | ApiReferenceEvents[K] | null;
+export {};
+//# sourceMappingURL=sanitize-event-payload.d.ts.map

package/dist/plugins/posthog/sanitize-event-payload.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-event-payload.d.ts","sourceRoot":"","sources":["../../../src/plugins/posthog/sanitize-event-payload.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAuBxE;;;;;;GAMG;AACH,KAAK,gBAAgB,CAAC,CAAC,SAAS,MAAM,kBAAkB,GAAG,MAAM,kBAAkB,IAAI,CACrF,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAA;AAEpD,4EAA4E;AAC5E,KAAK,gBAAgB,GAAG;KACrB,CAAC,IAAI,MAAM,kBAAkB,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,SAAS;CACjE,CAAA;AAED,eAAO,MAAM,cAAc,EAAE,gBA6H5B,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,MAAM,kBAAkB,EACrE,OAAO,CAAC,EACR,SAAS,kBAAkB,CAAC,CAAC,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,IAMpD,CAAA"}

package/dist/plugins/posthog/sanitize-event-payload.js

@@ -0,0 +1,136 @@
+import { getValueAtPath } from "@scalar/helpers/object/get-value-at-path";
+//#region src/plugins/posthog/sanitize-event-payload.ts
+/**
+* Builds an extractor that pulls a string from `payload` at `path` and emits
+* it under `{ [key]: value }`. Returns `{}` when the leaf is missing or is
+* not a string.
+*
+* `key` defaults to the dotted form of `path` (e.g. `['meta', 'type']` becomes
+* `'meta.type'`), matching the existing PostHog property names.
+*
+* Built on `getValueAtPath`, so null/undefined traversal and missing segments
+* are handled centrally.
+*/
+var stringAtPath = (path, key = path.join(".")) => {
+	return (payload) => {
+		const value = getValueAtPath(payload, path);
+		return typeof value === "string" ? { [key]: value } : {};
+	};
+};
+/** Extractor for events whose only useful property is the fact they fired. */
+var empty = () => ({});
+var TRACKED_EVENTS = {
+	"auth:update:selected-security-schemes": stringAtPath(["meta", "type"]),
+	"auth:update:active-index": stringAtPath(["meta", "type"]),
+	"auth:update:security-scheme": stringAtPath(["payload", "type"]),
+	"auth:clear:selected-security-schemes": stringAtPath(["meta", "type"]),
+	"auth:update:selected-scopes": stringAtPath(["meta", "type"]),
+	"auth:delete:security-scheme": empty,
+	"auth:clear:security-scheme-secrets": empty,
+	"auth:upsert:scopes": empty,
+	"auth:delete:scopes": empty,
+	"cookie:upsert:cookie": stringAtPath(["collectionType"]),
+	"cookie:delete:cookie": stringAtPath(["collectionType"]),
+	"environment:upsert:environment": stringAtPath(["collectionType"]),
+	"environment:delete:environment": stringAtPath(["collectionType"]),
+	"environment:upsert:environment-variable": stringAtPath(["collectionType"]),
+	"environment:delete:environment-variable": stringAtPath(["collectionType"]),
+	"document:create:empty-document": empty,
+	"document:delete:document": empty,
+	"document:update:info": empty,
+	"document:update:icon": empty,
+	"document:update:watch-mode": empty,
+	"operation:send:request:hotkey": empty,
+	"operation:cancel:request": empty,
+	"operation:create:operation": empty,
+	"operation:delete:operation": empty,
+	"operation:create:draft-example": empty,
+	"operation:delete:example": empty,
+	"operation:update:requestBody:contentType": stringAtPath(["payload", "contentType"]),
+	"operation:update:pathMethod": empty,
+	"operation:rename:example": empty,
+	"operation:reload:history": empty,
+	"ui:open:client-modal": empty,
+	"ui:open:command-palette": empty,
+	"ui:open:settings": empty,
+	"ui:download:document": stringAtPath(["format"]),
+	"ui:toggle:sidebar": empty,
+	"ui:save:local-document": empty,
+	"copy-url:address-bar": empty,
+	"tabs:add:tab": empty,
+	"tabs:copy:url": empty,
+	"server:add:server": empty,
+	"server:delete:server": empty,
+	"tag:create:tag": empty,
+	"tag:delete:tag": empty,
+	"hooks:on:request:sent": empty,
+	"hooks:on:request:complete": empty,
+	"hooks:on:rebase:document:complete": empty,
+	"workspace:update:color-mode": empty,
+	"workspace:update:theme": empty,
+	"workspace:update:selected-client": empty,
+	"workspace:update:active-proxy": (payload) => ({ enabled: !!payload }),
+	"workspace:update:active-environment": empty,
+	"update:dark-mode": empty,
+	"update:active-document": empty,
+	"update:selected-client": empty,
+	"log:login-click": empty,
+	"log:register-click": empty,
+	"auth:update:security-scheme-secrets": void 0,
+	"analytics:on:show-more": void 0,
+	"analytics:on:loaded": void 0,
+	"document:update:extension": void 0,
+	"log:user-login": void 0,
+	"log:user-logout": void 0,
+	"operation:update:meta": void 0,
+	"operation:update:extension": void 0,
+	"operation:upsert:parameter": void 0,
+	"operation:update:extra-parameters": void 0,
+	"operation:delete:parameter": void 0,
+	"operation:delete-all:parameters": void 0,
+	"operation:update:requestBody:value": void 0,
+	"operation:update:requestBody:formValue": void 0,
+	"server:initialize:servers": void 0,
+	"server:update:server": void 0,
+	"server:update:variables": void 0,
+	"server:update:selected": void 0,
+	"server:clear:servers": void 0,
+	"tabs:update:tabs": void 0,
+	"tabs:close:tab": void 0,
+	"tabs:close:other-tabs": void 0,
+	"tabs:navigate:previous": void 0,
+	"tabs:navigate:next": void 0,
+	"tabs:focus:tab": void 0,
+	"tabs:focus:tab-last": void 0,
+	"ui:focus:address-bar": void 0,
+	"ui:focus:send-button": void 0,
+	"ui:focus:search": void 0,
+	"ui:open:create-workspace": void 0,
+	"ui:close:client-modal": void 0,
+	"ui:navigate": void 0,
+	"toggle:nav-item": void 0,
+	"select:nav-item": void 0,
+	"intersecting:nav-item": void 0,
+	"scroll-to:nav-item": void 0,
+	"scroll-to:model-by-name": void 0,
+	"copy-url:nav-item": void 0,
+	"tag:edit:tag": void 0,
+	"workspace:update:name": void 0
+};
+/**
+* Returns sanitized properties for a tracked event, or `null` if the event
+* should not be captured at all.
+*
+* This is the only function that the PostHog plugin needs to call — it
+* encapsulates both the "should we track this?" decision and the "what
+* properties are safe to send?" extraction in one step.
+*/
+var sanitizeEventPayload = (event, payload) => {
+	const extractor = TRACKED_EVENTS[event];
+	if (!extractor) return null;
+	return extractor(payload);
+};
+//#endregion
+export { sanitizeEventPayload };
+
+//# sourceMappingURL=sanitize-event-payload.js.map

package/dist/plugins/posthog/sanitize-event-payload.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize-event-payload.js","names":[],"sources":["../../../src/plugins/posthog/sanitize-event-payload.ts"],"sourcesContent":["import { getValueAtPath } from '@scalar/helpers/object/get-value-at-path'\nimport type { ApiReferenceEvents } from '@scalar/workspace-store/events'\n\n/**\n * Builds an extractor that pulls a string from `payload` at `path` and emits\n * it under `{ [key]: value }`. Returns `{}` when the leaf is missing or is\n * not a string.\n *\n * `key` defaults to the dotted form of `path` (e.g. `['meta', 'type']` becomes\n * `'meta.type'`), matching the existing PostHog property names.\n *\n * Built on `getValueAtPath`, so null/undefined traversal and missing segments\n * are handled centrally.\n */\nconst stringAtPath = (path: string[], key: string = path.join('.')) => {\n  return (payload: unknown): Record<string, unknown> => {\n    const value = getValueAtPath(payload, path)\n    return typeof value === 'string' ? { [key]: value } : {}\n  }\n}\n\n/** Extractor for events whose only useful property is the fact they fired. */\nconst empty = (): Record<string, unknown> => ({})\n\n/**\n * Allowlist of events that should be forwarded to PostHog.\n *\n * Each key is an event name; its value is an extractor that pulls only the\n * safe, non-PII properties we want to track. Events not in this map are\n * silently dropped — this keeps the analytics surface explicit and auditable.\n */\ntype PayloadExtractor<K extends keyof ApiReferenceEvents = keyof ApiReferenceEvents> = (\n  payload: ApiReferenceEvents[K],\n) => Record<string, unknown> | ApiReferenceEvents[K]\n\n/** Maps every event to either a typed extractor or `undefined` (opt-out) */\ntype TrackedEventsMap = {\n  [K in keyof ApiReferenceEvents]: PayloadExtractor<K> | undefined\n}\n\nexport const TRACKED_EVENTS: TrackedEventsMap = {\n  // Auth events — track the scheme type so we know which auth methods are popular\n  'auth:update:selected-security-schemes': stringAtPath(['meta', 'type']),\n  'auth:update:active-index': stringAtPath(['meta', 'type']),\n  'auth:update:security-scheme': stringAtPath(['payload', 'type']),\n  'auth:clear:selected-security-schemes': stringAtPath(['meta', 'type']),\n  'auth:update:selected-scopes': stringAtPath(['meta', 'type']),\n  'auth:delete:security-scheme': empty,\n  'auth:clear:security-scheme-secrets': empty,\n  'auth:upsert:scopes': empty,\n  'auth:delete:scopes': empty,\n\n  // Cookie events — track whether it belongs to a document or workspace\n  'cookie:upsert:cookie': stringAtPath(['collectionType']),\n  'cookie:delete:cookie': stringAtPath(['collectionType']),\n\n  // Environment events — same document-vs-workspace distinction\n  'environment:upsert:environment': stringAtPath(['collectionType']),\n  'environment:delete:environment': stringAtPath(['collectionType']),\n  'environment:upsert:environment-variable': stringAtPath(['collectionType']),\n  'environment:delete:environment-variable': stringAtPath(['collectionType']),\n\n  // Document lifecycle\n  'document:create:empty-document': empty,\n  'document:delete:document': empty,\n  'document:update:info': empty,\n  'document:update:icon': empty,\n  'document:update:watch-mode': empty,\n\n  // Operation events — contentType helps us understand payload format usage\n  'operation:send:request:hotkey': empty,\n  'operation:cancel:request': empty,\n  'operation:create:operation': empty,\n  'operation:delete:operation': empty,\n  'operation:create:draft-example': empty,\n  'operation:delete:example': empty,\n  'operation:update:requestBody:contentType': stringAtPath(['payload', 'contentType']),\n  'operation:update:pathMethod': empty,\n  'operation:rename:example': empty,\n  'operation:reload:history': empty,\n\n  // UI events — track which surfaces users interact with\n  'ui:open:client-modal': empty,\n  'ui:open:command-palette': empty,\n  'ui:open:settings': empty,\n  'ui:download:document': stringAtPath(['format']),\n  'ui:toggle:sidebar': empty,\n  'ui:save:local-document': empty,\n  'copy-url:address-bar': empty,\n  'tabs:add:tab': empty,\n  'tabs:copy:url': empty,\n\n  // Server events\n  'server:add:server': empty,\n  'server:delete:server': empty,\n\n  // Tag events\n  'tag:create:tag': empty,\n  'tag:delete:tag': empty,\n\n  // Request lifecycle hooks — lets us measure request volume without capturing bodies\n  'hooks:on:request:sent': empty,\n  'hooks:on:request:complete': empty,\n  'hooks:on:rebase:document:complete': empty,\n\n  // Workspace preference events\n  'workspace:update:color-mode': empty,\n  'workspace:update:theme': empty,\n  'workspace:update:selected-client': empty,\n  'workspace:update:active-proxy': (payload) => ({ enabled: !!payload }),\n  'workspace:update:active-environment': empty,\n\n  // Meta events\n  'update:dark-mode': empty,\n  'update:active-document': empty,\n  'update:selected-client': empty,\n\n  // Account funnel events\n  'log:login-click': empty,\n  'log:register-click': empty,\n\n  // ---------------------------------------------------------------------------\n  // Do not track — explicitly opted out so new events cause a type error\n  // until they are consciously placed above with a payload\n  // ---------------------------------------------------------------------------\n  'auth:update:security-scheme-secrets': undefined,\n  'analytics:on:show-more': undefined,\n  'analytics:on:loaded': undefined,\n  'document:update:extension': undefined,\n  'log:user-login': undefined,\n  'log:user-logout': undefined,\n  'operation:update:meta': undefined,\n  'operation:update:extension': undefined,\n  'operation:upsert:parameter': undefined,\n  'operation:update:extra-parameters': undefined,\n  'operation:delete:parameter': undefined,\n  'operation:delete-all:parameters': undefined,\n  'operation:update:requestBody:value': undefined,\n  'operation:update:requestBody:formValue': undefined,\n  'server:initialize:servers': undefined,\n  'server:update:server': undefined,\n  'server:update:variables': undefined,\n  'server:update:selected': undefined,\n  'server:clear:servers': undefined,\n  'tabs:update:tabs': undefined,\n  'tabs:close:tab': undefined,\n  'tabs:close:other-tabs': undefined,\n  'tabs:navigate:previous': undefined,\n  'tabs:navigate:next': undefined,\n  'tabs:focus:tab': undefined,\n  'tabs:focus:tab-last': undefined,\n  'ui:focus:address-bar': undefined,\n  'ui:focus:send-button': undefined,\n  'ui:focus:search': undefined,\n  'ui:open:create-workspace': undefined,\n  'ui:close:client-modal': undefined,\n  'ui:navigate': undefined,\n  'toggle:nav-item': undefined,\n  'select:nav-item': undefined,\n  'intersecting:nav-item': undefined,\n  'scroll-to:nav-item': undefined,\n  'scroll-to:model-by-name': undefined,\n  'copy-url:nav-item': undefined,\n  'tag:edit:tag': undefined,\n  'workspace:update:name': undefined,\n}\n\n/**\n * Returns sanitized properties for a tracked event, or `null` if the event\n * should not be captured at all.\n *\n * This is the only function that the PostHog plugin needs to call — it\n * encapsulates both the \"should we track this?\" decision and the \"what\n * properties are safe to send?\" extraction in one step.\n */\nexport const sanitizeEventPayload = <K extends keyof ApiReferenceEvents>(\n  event: K,\n  payload: ApiReferenceEvents[K],\n): Record<string, unknown> | ApiReferenceEvents[K] | null => {\n  const extractor = TRACKED_EVENTS[event]\n  if (!extractor) {\n    return null\n  }\n  return extractor(payload)\n}\n"],"mappings":";;;;;;;;;;;;;AAcA,IAAM,gBAAgB,MAAgB,MAAc,KAAK,KAAK,IAAI,KAAK;AACrE,SAAQ,YAA8C;EACpD,MAAM,QAAQ,eAAe,SAAS,KAAK;AAC3C,SAAO,OAAO,UAAU,WAAW,GAAG,MAAM,OAAO,GAAG,EAAE;;;;AAK5D,IAAM,eAAwC,EAAE;AAkBhD,IAAa,iBAAmC;CAE9C,yCAAyC,aAAa,CAAC,QAAQ,OAAO,CAAC;CACvE,4BAA4B,aAAa,CAAC,QAAQ,OAAO,CAAC;CAC1D,+BAA+B,aAAa,CAAC,WAAW,OAAO,CAAC;CAChE,wCAAwC,aAAa,CAAC,QAAQ,OAAO,CAAC;CACtE,+BAA+B,aAAa,CAAC,QAAQ,OAAO,CAAC;CAC7D,+BAA+B;CAC/B,sCAAsC;CACtC,sBAAsB;CACtB,sBAAsB;CAGtB,wBAAwB,aAAa,CAAC,iBAAiB,CAAC;CACxD,wBAAwB,aAAa,CAAC,iBAAiB,CAAC;CAGxD,kCAAkC,aAAa,CAAC,iBAAiB,CAAC;CAClE,kCAAkC,aAAa,CAAC,iBAAiB,CAAC;CAClE,2CAA2C,aAAa,CAAC,iBAAiB,CAAC;CAC3E,2CAA2C,aAAa,CAAC,iBAAiB,CAAC;CAG3E,kCAAkC;CAClC,4BAA4B;CAC5B,wBAAwB;CACxB,wBAAwB;CACxB,8BAA8B;CAG9B,iCAAiC;CACjC,4BAA4B;CAC5B,8BAA8B;CAC9B,8BAA8B;CAC9B,kCAAkC;CAClC,4BAA4B;CAC5B,4CAA4C,aAAa,CAAC,WAAW,cAAc,CAAC;CACpF,+BAA+B;CAC/B,4BAA4B;CAC5B,4BAA4B;CAG5B,wBAAwB;CACxB,2BAA2B;CAC3B,oBAAoB;CACpB,wBAAwB,aAAa,CAAC,SAAS,CAAC;CAChD,qBAAqB;CACrB,0BAA0B;CAC1B,wBAAwB;CACxB,gBAAgB;CAChB,iBAAiB;CAGjB,qBAAqB;CACrB,wBAAwB;CAGxB,kBAAkB;CAClB,kBAAkB;CAGlB,yBAAyB;CACzB,6BAA6B;CAC7B,qCAAqC;CAGrC,+BAA+B;CAC/B,0BAA0B;CAC1B,oCAAoC;CACpC,kCAAkC,aAAa,EAAE,SAAS,CAAC,CAAC,SAAS;CACrE,uCAAuC;CAGvC,oBAAoB;CACpB,0BAA0B;CAC1B,0BAA0B;CAG1B,mBAAmB;CACnB,sBAAsB;CAMtB,uCAAuC,KAAA;CACvC,0BAA0B,KAAA;CAC1B,uBAAuB,KAAA;CACvB,6BAA6B,KAAA;CAC7B,kBAAkB,KAAA;CAClB,mBAAmB,KAAA;CACnB,yBAAyB,KAAA;CACzB,8BAA8B,KAAA;CAC9B,8BAA8B,KAAA;CAC9B,qCAAqC,KAAA;CACrC,8BAA8B,KAAA;CAC9B,mCAAmC,KAAA;CACnC,sCAAsC,KAAA;CACtC,0CAA0C,KAAA;CAC1C,6BAA6B,KAAA;CAC7B,wBAAwB,KAAA;CACxB,2BAA2B,KAAA;CAC3B,0BAA0B,KAAA;CAC1B,wBAAwB,KAAA;CACxB,oBAAoB,KAAA;CACpB,kBAAkB,KAAA;CAClB,yBAAyB,KAAA;CACzB,0BAA0B,KAAA;CAC1B,sBAAsB,KAAA;CACtB,kBAAkB,KAAA;CAClB,uBAAuB,KAAA;CACvB,wBAAwB,KAAA;CACxB,wBAAwB,KAAA;CACxB,mBAAmB,KAAA;CACnB,4BAA4B,KAAA;CAC5B,yBAAyB,KAAA;CACzB,eAAe,KAAA;CACf,mBAAmB,KAAA;CACnB,mBAAmB,KAAA;CACnB,yBAAyB,KAAA;CACzB,sBAAsB,KAAA;CACtB,2BAA2B,KAAA;CAC3B,qBAAqB,KAAA;CACrB,gBAAgB,KAAA;CAChB,yBAAyB,KAAA;CAC1B;;;;;;;;;AAUD,IAAa,wBACX,OACA,YAC2D;CAC3D,MAAM,YAAY,eAAe;AACjC,KAAI,CAAC,UACH,QAAO;AAET,QAAO,UAAU,QAAQ"}