@scalar/cli 2.1.0 → 2.5.1

package/chunks/{chunk-UPUTMFD4.js → chunk-HCPN3KNF.js}

@@ -1,13 +1,15 @@
 import { createRequire as $$cR } from "node:module"; const require = $$cR(import.meta.url);
 import {
   RegistryResourceTypes,
-  baseRegistrySchema
-} from "./chunk-VTYTPSXO.js";
+  baseRegistrySchema,
+  contentShaSchema
+} from "./chunk-Q7DOQHZN.js";
 import {
   brandedUid,
   docVersionSchema,
   emailSchema,
   entitySchema,
+  external_exports,
   mintUid,
   nanoid,
   nanoidSchema,
@@ -17,10 +19,7 @@ import {
   slugSchema,
   timestampSchema,
   unixTimestamp
-} from "./chunk-ISGLWBXZ.js";
-import {
-  external_exports
-} from "./chunk-H2WRMLYY.js";
+} from "./chunk-IKT5F47M.js";
 
 // ../../packages/entities/dist/access-group/schema.js
 var emailDomainRegex = /^([A-Za-z0-9]+(-[A-Za-z0-9]+)*\.)+[A-Za-z]{2,}$/i;
@@ -120,7 +119,13 @@ var microsoftProfileSchema = external_exports.object({
    */
   xms_edov: external_exports.union([external_exports.boolean(), external_exports.string()]).optional()
 }).meta({ id: "microsoft-profile" });
-var hostingOauthResourceSchema = external_exports.enum([...RegistryResourceTypes, "sync-project", "project", "publish"]).meta({ id: "hosting-oauth-resource" });
+var hostingOauthResourceSchema = external_exports.enum([
+  ...RegistryResourceTypes,
+  "sync-project",
+  "project",
+  "publish",
+  "namespace"
+]).meta({ id: "hosting-oauth-resource" });
 var hostingOauthStateSchema = external_exports.object({
   uid: nanoidSchema,
   resource: external_exports.object({
@@ -162,7 +167,15 @@ var samlStateSchema = external_exports.object({
   // Expiry
   expiresAt: external_exports.number()
 }).meta({ id: "saml-state" });
-var ssoResourceSchema = external_exports.enum([...RegistryResourceTypes, "sync-project", "project", "publish", "mcp"]).meta({ id: "sso-resource" });
+var ssoResourceSchema = external_exports.enum([
+  ...RegistryResourceTypes,
+  "sync-project",
+  "project",
+  "publish",
+  "mcp",
+  /** A team's registry namespace page, rather than one record on it. */
+  "namespace"
+]).meta({ id: "sso-resource" });
 var relayStateSchema = external_exports.object({
   /** Uniquely identifies a relay state */
   uid: nanoidSchema.default(nanoid).meta({ default: "nanoid()" }),
@@ -190,11 +203,9 @@ var relayStateSchema = external_exports.object({
 var AuthDomains;
 (function(AuthDomains2) {
   AuthDomains2["Cli"] = "cli";
-  AuthDomains2["Docs"] = "docs";
   AuthDomains2["Client"] = "client";
   AuthDomains2["Local"] = "local";
   AuthDomains2["Dashboard"] = "dashboard";
-  AuthDomains2["Editor"] = "editor";
   AuthDomains2["Agent"] = "agent";
   AuthDomains2["Mcp"] = "mcp";
 })(AuthDomains || (AuthDomains = {}));
@@ -256,7 +267,19 @@ var loginPortalSchema = external_exports.object({
 // ../../packages/entities/dist/managed-schema/schema.js
 var managedSchemaVersion = entitySchema.extend({
   /** Version identifier (e.g. 0.0.1) for schema */
-  version: docVersionSchema.default("0.0.1")
+  version: docVersionSchema.default("0.0.1"),
+  /**
+   * SHA-256 hex digest of the YAML content the version serves, from its
+   * chain head. Integrity metadata for the YAML serialization, never a
+   * storage key.
+   */
+  yamlSha: contentShaSchema.optional(),
+  /**
+   * SHA-256 hex digest of the JSON content the version serves, from its
+   * chain head. This is the blob key for both formats, matching the API
+   * document entity.
+   */
+  jsonSha: contentShaSchema.optional()
 }).meta({ id: "managed-schema-version" });
 var managedSchemaFormat = external_exports.enum(["json", "yaml"]).meta({ id: "managed-schema-format" });
 var managedSchema = baseRegistrySchema.extend({
@@ -264,12 +287,68 @@ var managedSchema = baseRegistrySchema.extend({
   uid: brandedUid().default(mintUid).meta({ default: "nanoid()" }),
   /** The current version served to consumers by default */
   version: docVersionSchema.default("0.0.1"),
-  /** All schema versions */
-  versions: managedSchemaVersion.array(),
   /** Default schema format for edit/view */
   format: managedSchemaFormat.default("json")
 }).meta({ id: "managed-schema" });
 
+// ../../packages/entities/dist/repository/repository.js
+var linkedRepositoryRemoteSchema = external_exports.discriminatedUnion("provider", [
+  external_exports.object({
+    provider: external_exports.literal("github"),
+    installationId: external_exports.number().int(),
+    /** GitHub's numeric repository id; stable across renames. */
+    id: external_exports.number().int(),
+    /** The `owner/repo` full name. */
+    name: external_exports.string().min(2),
+    defaultBranch: external_exports.string().default("main")
+  }),
+  external_exports.object({
+    provider: external_exports.literal("bitbucket"),
+    workspaceUuid: external_exports.string(),
+    workspaceSlug: external_exports.string(),
+    repoUuid: external_exports.string(),
+    repoSlug: external_exports.string(),
+    /** The `workspace/repo` full name. */
+    name: external_exports.string().min(2),
+    defaultBranch: external_exports.string().default("main")
+  })
+]).meta({ id: "linked-repository-remote" });
+var linkedRepositorySchema = entitySchema.extend({
+  /** Own uid, branded so it cannot be confused with another entity's uid */
+  uid: brandedUid().default(mintUid).meta({ default: "nanoid()" }),
+  remote: linkedRepositoryRemoteSchema,
+  /**
+   * The single internal mirror. Null until provisioning succeeds — the link
+   * itself must not fail because Forgejo was briefly unreachable, so the
+   * mirror is re-ensured on demand rather than required up front.
+   */
+  forgejo: external_exports.object({
+    owner: external_exports.string(),
+    repo: external_exports.string(),
+    branch: external_exports.string().default("main")
+  }).nullable().default(null),
+  /** Email of the user who linked the repository. */
+  linkedBy: external_exports.string()
+}).meta({ id: "linked-repository" });
+
+// ../../packages/entities/dist/repository/webhook-event-claim.js
+var webhookEventClaimRecordSchema = entitySchema.extend({
+  /** `<teamUid>:<projectUid>:<eventKey>`, unique across the collection. */
+  claimKey: external_exports.string(),
+  /**
+   * The delivery that holds the claim. A delivery whose work failed removes
+   * its own claim by this, so it cannot take away a claim another delivery
+   * has since taken over.
+   */
+  delivery: external_exports.string(),
+  /**
+   * When the claim lapses and this record may be collected, as a Date because
+   * MongoDB TTL indexes only act on BSON dates and silently ignore numeric
+   * fields.
+   */
+  expiresAt: external_exports.date()
+}).meta({ id: "webhook-event-claim-record" });
+
 // ../../packages/entities/dist/waitlist/index.js
 var WaitlistProducts;
 (function(WaitlistProducts2) {
@@ -293,6 +372,95 @@ var waitlistRecordSchema = external_exports.object({
   })
 }).meta({ id: "waitlist-record" });
 
+// ../../packages/entities/dist/webhook/schema.js
+var webhookEventSchema = external_exports.enum(["sdk.build.completed"]).meta({ id: "webhook-event" });
+var webhookDisabledReasonSchema = external_exports.enum(["consecutive-failures"]).meta({ id: "webhook-disabled-reason" });
+var webhookSubscriptionSchema = entitySchema.extend({
+  uid: brandedUid().default(mintUid).meta({ default: "nanoid()" }),
+  teamUid: nanoidSchema,
+  /** Event delivered to this endpoint. */
+  event: webhookEventSchema.default("sdk.build.completed"),
+  /** Where deliveries are POSTed. Validated against the SSRF guard on write. */
+  url: external_exports.url(),
+  /** Whether deliveries are attempted. Cleared by the auto-disable path. */
+  enabled: external_exports.boolean().default(true),
+  /** Optional label describing the endpoint. */
+  description: external_exports.string().max(200).default(""),
+  /**
+   * Terminal failures since the last success. Reset to zero on any 2xx, and
+   * compared against {@link WEBHOOK_FAILURE_DISABLE_THRESHOLD}.
+   */
+  consecutiveFailures: external_exports.number().int().min(0).default(0),
+  /**
+   * Set when the platform disabled this itself, so the dashboard can explain
+   * why an endpoint stopped rather than showing a bare "off" toggle.
+   *
+   * Nullable as well as optional: mongobase round-trips an unset optional as
+   * null, and a strict parse would drop the whole document on read.
+   */
+  disabledReason: webhookDisabledReasonSchema.nullable().optional(),
+  /** When the platform disabled it, in unix seconds. Nullable, as above. */
+  disabledAt: external_exports.number().nullable().optional()
+}).meta({ id: "webhook-subscription" });
+var WEBHOOK_SECRET_KEY_VERSION = 1;
+var WEBHOOK_SECRET_GRACE_PERIOD_SECONDS = 24 * 60 * 60;
+var webhookSecretSchema = entitySchema.extend({
+  uid: brandedUid(),
+  teamUid: nanoidSchema,
+  /** AES-256-GCM ciphertext of the secret, hex encoded. */
+  ciphertext: external_exports.string(),
+  /** Initialisation vector for {@link ciphertext}, hex encoded. */
+  iv: external_exports.string(),
+  /**
+   * GCM authentication tag, hex encoded. Covers the ciphertext and the
+   * subscription the record belongs to, so tampering or moving a record
+   * between endpoints fails the decrypt.
+   */
+  tag: external_exports.string(),
+  /** {@link WEBHOOK_SECRET_KEY_VERSION} in force when this was written. */
+  keyVersion: external_exports.number().int().default(WEBHOOK_SECRET_KEY_VERSION),
+  /**
+   * The secret this one replaced, kept signing until `expiresAt` so a
+   * routine roll does not drop deliveries while the customer updates their
+   * receiver. At most one — rolling again inside the window replaces it.
+   *
+   * Nullable as well as optional: mongobase round-trips an unset optional as
+   * null, and a strict parse would drop the whole document on read.
+   */
+  previous: external_exports.object({
+    ciphertext: external_exports.string(),
+    iv: external_exports.string(),
+    tag: external_exports.string(),
+    keyVersion: external_exports.number().int(),
+    /** Unix seconds after which this secret stops signing deliveries. */
+    expiresAt: external_exports.number()
+  }).nullable().optional()
+}).meta({ id: "webhook-secret" });
+var webhookDeliveryStatusSchema = external_exports.enum(["pending", "succeeded", "failed"]).meta({ id: "webhook-delivery-status" });
+var webhookDeliverySchema = entitySchema.extend({
+  uid: brandedUid().default(mintUid).meta({ default: "nanoid()" }),
+  teamUid: nanoidSchema,
+  subscriptionUid: brandedUid(),
+  event: webhookEventSchema,
+  /**
+   * What made this delivery unique for its subscription — the build uid for a
+   * build event. Pub/Sub is at-least-once, so a redelivered source message
+   * must land on the same delivery document rather than POSTing twice.
+   */
+  dedupeKey: external_exports.string(),
+  /** The exact JSON body that is sent. */
+  payload: external_exports.string(),
+  /** Attempts made so far, across Cloud Tasks retries. */
+  attempts: external_exports.number().int().min(0).default(0),
+  status: webhookDeliveryStatusSchema.default("pending"),
+  /** Unix seconds of the most recent attempt. Nullable for the round-trip reason above. */
+  lastAttemptAt: external_exports.number().nullable().optional(),
+  /** HTTP status the endpoint returned, when it returned one at all. */
+  responseStatus: external_exports.number().nullable().optional(),
+  /** Why the last attempt failed, in terms a customer can act on. */
+  errorMessage: external_exports.string().nullable().optional()
+}).meta({ id: "webhook-delivery" });
+
 // ../../packages/entities/dist/workspace/hotkeys/constants.js
 var HOTKEY_EVENT_NAMES = [
   "closeModal",
@@ -457,9 +625,13 @@ export {
   identityProviders,
   identityProviderRecordSchema,
   loginPortalSchema,
+  managedSchemaVersion,
   managedSchema,
+  linkedRepositorySchema,
   WaitlistProducts,
   WaitlistSources,
+  webhookSubscriptionSchema,
+  webhookDeliverySchema,
   workspaceVersionSchema,
   workspaceSchema
 };

package/chunks/{chunk-P646T2WH.js → chunk-HPL3ZZ2P.js}

@@ -1,4 +1,10 @@
 import { createRequire as $$cR } from "node:module"; const require = $$cR(import.meta.url);
+import {
+  billingPlanSchema
+} from "./chunk-VNYE4R7N.js";
+import {
+  sharedProjectSchema
+} from "./chunk-OQKDBLOZ.js";
 import {
   SCALAR_AGENT_KEY_HEADER,
   agentDocsProjectSchema,
@@ -15,18 +21,12 @@ import {
   mcpServerToolModes,
   mcpServerVersionSchema,
   monthlyUsageSchema
-} from "./chunk-TLFMATXR.js";
-import {
-  billingPlanSchema
-} from "./chunk-4DGQIAJX.js";
+} from "./chunk-GSGZHE26.js";
 import {
+  external_exports,
   nanoidSchema,
-  sharedProjectSchema,
   slugSchema
-} from "./chunk-ISGLWBXZ.js";
-import {
-  external_exports
-} from "./chunk-H2WRMLYY.js";
+} from "./chunk-IKT5F47M.js";
 
 // ../../packages/entities/dist/api/agent/shared.js
 var agentApiErrorSchema = external_exports.object({
@@ -240,6 +240,83 @@ var analyticsRoutes = {
   }
 };
 
+// ../../packages/entities/dist/api/agent/dashboard.js
+var DASHBOARD_EDITOR_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "read_file",
+  "list_files",
+  "glob",
+  "grep",
+  "write_file",
+  "edit_file",
+  "get_current_file",
+  "validate_openapi",
+  "summarize_openapi",
+  "validate_config"
+]);
+var DASHBOARD_SDK_TOOL_NAMES = /* @__PURE__ */ new Set([
+  "get_sdk_config",
+  "set_sdk_config"
+]);
+var DASHBOARD_SDK_CONTEXT_KEY = "sdk-studio";
+var DASHBOARD_EDITOR_CONTEXT_KEY = "docs-editor";
+var DASHBOARD_CHAT_CONTEXT_MAX_CHARS = 12e4;
+var DASHBOARD_CHAT_MAX_MESSAGES = 400;
+var dashboardChatSettingsSchema = external_exports.object({
+  mode: external_exports.enum(["fast", "medium", "max"]).default("medium")
+});
+var dashboardChatBodySchema = external_exports.object({
+  id: external_exports.string(),
+  /**
+   * Only what the browser composed or the model answered. A `system`
+   * message is the server's alone, so one a client stamps is refused at
+   * the door rather than joined to the real system prompt.
+   */
+  messages: external_exports.array(external_exports.object({ role: external_exports.enum(["user", "assistant"]) }).loose()).max(DASHBOARD_CHAT_MAX_MESSAGES),
+  /**
+   * `{ [pluginId]: slice }` — opaque here. Each server tool pack validates
+   * its own key and ignores the rest, so a client ahead of the server can
+   * send a slice nothing reads yet.
+   */
+  context: external_exports.record(external_exports.string(), external_exports.unknown()).default({}),
+  settings: dashboardChatSettingsSchema.default({ mode: "medium" }),
+  /**
+   * Wire names the browser can execute this turn. The server offers a
+   * client-executed tool only when it is named here, so a call the browser
+   * cannot answer never reaches the model.
+   */
+  clientTools: external_exports.array(external_exports.string().max(64)).max(64).default([])
+}).superRefine((body, ctx) => {
+  if (JSON.stringify(body.context).length > DASHBOARD_CHAT_CONTEXT_MAX_CHARS) {
+    ctx.addIssue({ code: "custom", message: "context too large" });
+  }
+  if (body.clientTools.some((name) => DASHBOARD_SDK_TOOL_NAMES.has(name)) && !body.context[DASHBOARD_SDK_CONTEXT_KEY]) {
+    ctx.addIssue({
+      code: "custom",
+      message: "sdk tools require the sdk-studio context slice"
+    });
+  }
+  if (body.clientTools.some((name) => DASHBOARD_EDITOR_TOOL_NAMES.has(name)) && !body.context[DASHBOARD_EDITOR_CONTEXT_KEY]) {
+    ctx.addIssue({
+      code: "custom",
+      message: "editor tools require docs-editor context"
+    });
+  }
+});
+var dashboardRoutes = {
+  chat: {
+    method: "POST",
+    path: () => "/dashboard/chat",
+    body: dashboardChatBodySchema,
+    responses: {
+      400: agentApiErrorSchema,
+      402: agentApiErrorSchema,
+      403: agentApiErrorSchema
+    },
+    responseMediaType: "text/event-stream",
+    summary: "Chat with the dashboard assistant"
+  }
+};
+
 // ../../packages/entities/dist/api/agent/docs.js
 var docsProjectAgentInfoSchema = external_exports.object({
   id: external_exports.string(),
@@ -249,6 +326,19 @@ var docsProjectAgentInfoSchema = external_exports.object({
   mcpServerSlug: external_exports.string().nullable(),
   mcpInstallationSlug: external_exports.string().nullable()
 });
+var docsChatContextSchema = external_exports.object({
+  /** The Vue-router path of the current page, without the hash. */
+  path: external_exports.string().max(2048),
+  /** The `route.meta.page` type (e.g. `page`, `openapi-single`), for phrasing. */
+  kind: external_exports.string().max(64).optional(),
+  /** The OpenAPI/AsyncAPI document the page belongs to, when it is a reference. */
+  documentUid: external_exports.string().max(256).optional(),
+  /**
+   * Full navigation id of the entity in view. Lets the server rebuild the
+   * anchored `to` for a single-page reference operation and match it.
+   */
+  navId: external_exports.string().max(2048).optional()
+});
 var docsRoutes = {
   getProject: {
     method: "GET",
@@ -289,7 +379,13 @@ var docsRoutes = {
   chat: {
     method: "POST",
     path: () => "/docs/chat",
-    body: external_exports.object({ id: external_exports.string(), messages: external_exports.any().array() }),
+    body: external_exports.object({
+      id: external_exports.string(),
+      messages: external_exports.any().array(),
+      // What the visitor is currently viewing, so the agent can answer about it.
+      // Optional so a docs bundle that sends no context keeps working unchanged.
+      context: docsChatContextSchema.optional()
+    }),
     responses: { 400: agentApiErrorSchema, 403: agentApiErrorSchema },
     responseMediaType: "text/event-stream",
     summary: "Chat with the docs agent"
@@ -568,6 +664,8 @@ var mcpOperationToolDetailSchema = external_exports.object({
   curatedToolEnabled: external_exports.boolean(),
   name: external_exports.string().nullable(),
   description: external_exports.string().nullable(),
+  deprecated: external_exports.boolean(),
+  deprecationMessage: external_exports.string().nullable(),
   openApiOperationId: external_exports.string().nullable(),
   operationSummary: external_exports.string().nullable()
 });
@@ -650,6 +748,7 @@ var mcpServerRoutes = {
     body: external_exports.object({
       name: external_exports.string().min(1).max(100),
       slug: slugSchema,
+      autoAddOperations: external_exports.boolean(),
       operations: external_exports.array(external_exports.uuid()),
       docsPages: external_exports.array(external_exports.uuid()),
       bumpStrategy: bumpStrategySchema,
@@ -727,12 +826,16 @@ var mcpServerRoutes = {
     params: external_exports.object({ id: external_exports.uuid(), operationToolId: external_exports.uuid() }),
     body: external_exports.object({
       name: external_exports.string().nullable().optional(),
-      description: external_exports.string().nullable().optional()
+      description: external_exports.string().nullable().optional(),
+      deprecated: external_exports.boolean().optional(),
+      deprecationMessage: external_exports.string().nullable().optional()
     }),
     response: external_exports.object({
       operationToolId: external_exports.string(),
       name: external_exports.string().nullable().optional(),
-      description: external_exports.string().nullable().optional()
+      description: external_exports.string().nullable().optional(),
+      deprecated: external_exports.boolean().optional(),
+      deprecationMessage: external_exports.string().nullable().optional()
     }),
     responses: { 400: agentApiErrorSchema, 403: agentApiErrorSchema },
     summary: "Set custom name and description on an operation tool"
@@ -950,6 +1053,8 @@ var mcpVersionToolsSchema = external_exports.object({
     curatedToolEnabled: external_exports.boolean(),
     name: external_exports.string().nullable(),
     description: external_exports.string().nullable(),
+    deprecated: external_exports.boolean(),
+    deprecationMessage: external_exports.string().nullable(),
     path: external_exports.string(),
     method: external_exports.string(),
     versionId: external_exports.string(),
@@ -1035,7 +1140,9 @@ var mcpVersionRoutes = {
         executeRequestToolEnabled: external_exports.boolean().optional(),
         curatedToolEnabled: external_exports.boolean().optional(),
         name: external_exports.string().nullable().optional(),
-        description: external_exports.string().nullable().optional()
+        description: external_exports.string().nullable().optional(),
+        deprecated: external_exports.boolean().optional(),
+        deprecationMessage: external_exports.string().nullable().optional()
       })).optional(),
       docsPageTools: external_exports.array(external_exports.object({
         docsPageId: external_exports.uuid(),
@@ -1545,6 +1652,7 @@ var agentApi = {
   },
   registry: registryRoutes,
   docs: docsRoutes,
+  dashboard: dashboardRoutes,
   editor: editorRoutes,
   openapi: openapiRoutes,
   analytics: analyticsRoutes,
@@ -1580,7 +1688,17 @@ export {
   mcpErrorEntrySchema,
   mcpErrorsResultSchema,
   analyticsRoutes,
+  DASHBOARD_EDITOR_TOOL_NAMES,
+  DASHBOARD_SDK_TOOL_NAMES,
+  DASHBOARD_SDK_CONTEXT_KEY,
+  DASHBOARD_EDITOR_CONTEXT_KEY,
+  DASHBOARD_CHAT_CONTEXT_MAX_CHARS,
+  DASHBOARD_CHAT_MAX_MESSAGES,
+  dashboardChatSettingsSchema,
+  dashboardChatBodySchema,
+  dashboardRoutes,
   docsProjectAgentInfoSchema,
+  docsChatContextSchema,
   docsRoutes,
   editorChatBodySchema,
   pullRequestDescriptionBodySchema,