@scalar/workspace-store 0.41.2 → 0.43.0

package/dist/request-example/context/headers.d.ts

@@ -0,0 +1,33 @@
+import type { HttpMethod } from '@scalar/helpers/http/http-methods';
+import type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+/**
+ * Generates a list of default headers for an OpenAPI operation and HTTP method.
+ *
+ * This function intelligently adds standard HTTP headers based on the request context:
+ * - Content-Type: Added only if the HTTP method supports a request body and the OpenAPI operation
+ *   defines a request body content type. Uses the selected content type from the operation or the
+ *   first defined request body content type.
+ * - Accept: Derived from the 2xx response content types in the spec (joined as a comma-separated list), falling back to a wildcard.
+ * - User-Agent: Added in Electron environments (desktop app or proxy) to identify the client.
+ *
+ * The function respects OpenAPI operation parameters and marks headers as overridden
+ * if they are explicitly defined in the operation. It also supports hiding disabled
+ * headers for specific request examples using x-scalar-disable-parameters.
+ *
+ * @param method The HTTP method of the operation (GET, POST, etc.)
+ * @param operation The OpenAPI OperationObject describing the endpoint
+ * @param exampleKey The current request example key
+ * @param hideDisabledHeaders If true, filters out headers marked as disabled for this example
+ * @returns Array of default header objects with their values and override status
+ */
+export declare const getDefaultHeaders: ({ method, operation, exampleName, hideDisabledHeaders, options, }: {
+    method: HttpMethod;
+    operation: OperationObject;
+    exampleName: string;
+    hideDisabledHeaders?: boolean;
+    options?: {
+        appVersion: string;
+        isElectron: boolean;
+    };
+}) => Record<string, string>;
+//# sourceMappingURL=headers.d.ts.map

package/dist/request-example/context/headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headers.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/headers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAA;AAKnG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,iBAAiB,GAAI,mEAS/B;IACD,MAAM,EAAE,UAAU,CAAA;IAClB,SAAS,EAAE,eAAe,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,OAAO,CAAC,EAAE;QACR,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,OAAO,CAAA;KACpB,CAAA;CACF,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAoCxB,CAAA"}

package/dist/request-example/context/headers.js

@@ -0,0 +1,54 @@
+import { canMethodHaveBody } from '@scalar/helpers/http/can-method-have-body';
+import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
+/** Default Accept header value to accept all response types. */
+const DEFAULT_ACCEPT = '*/*';
+/**
+ * Generates a list of default headers for an OpenAPI operation and HTTP method.
+ *
+ * This function intelligently adds standard HTTP headers based on the request context:
+ * - Content-Type: Added only if the HTTP method supports a request body and the OpenAPI operation
+ *   defines a request body content type. Uses the selected content type from the operation or the
+ *   first defined request body content type.
+ * - Accept: Derived from the 2xx response content types in the spec (joined as a comma-separated list), falling back to a wildcard.
+ * - User-Agent: Added in Electron environments (desktop app or proxy) to identify the client.
+ *
+ * The function respects OpenAPI operation parameters and marks headers as overridden
+ * if they are explicitly defined in the operation. It also supports hiding disabled
+ * headers for specific request examples using x-scalar-disable-parameters.
+ *
+ * @param method The HTTP method of the operation (GET, POST, etc.)
+ * @param operation The OpenAPI OperationObject describing the endpoint
+ * @param exampleKey The current request example key
+ * @param hideDisabledHeaders If true, filters out headers marked as disabled for this example
+ * @returns Array of default header objects with their values and override status
+ */
+export const getDefaultHeaders = ({ method, operation, exampleName, hideDisabledHeaders = false, options = {
+    isElectron: false,
+    appVersion: '0.0.0',
+}, }) => {
+    const disabledHeaders = operation['x-scalar-disable-parameters']?.['default-headers']?.[exampleName] ?? {};
+    const headers = new Headers();
+    const requestBody = getResolvedRef(operation.requestBody);
+    // Add Content-Type header only for methods that support a request body
+    if (canMethodHaveBody(method) && requestBody) {
+        const contentType = requestBody['x-scalar-selected-content-type']?.[exampleName] ?? Object.keys(requestBody.content ?? {})[0];
+        // We never want to add a content type of 'none' or invent one when the schema defines no body.
+        if (contentType && contentType !== 'none') {
+            headers.set('Content-Type', contentType);
+        }
+    }
+    // Derive Accept from the 2xx response content types so the server can pick the best match.
+    const successResponseKey = Object.keys(operation.responses ?? {}).find((k) => k.startsWith('2'));
+    const successResponse = successResponseKey ? getResolvedRef(operation.responses[successResponseKey]) : null;
+    const acceptValue = Object.keys(successResponse?.content ?? {}).join(', ') || DEFAULT_ACCEPT;
+    headers.set('Accept', acceptValue);
+    // Add User-Agent in Electron environments for client identification
+    if (options.isElectron && options.appVersion) {
+        headers.set('User-Agent', `Scalar/${options.appVersion}`);
+    }
+    // Filter out disabled headers if requested
+    if (hideDisabledHeaders) {
+        return Object.fromEntries(Array.from(headers.entries()).filter(([headerName]) => disabledHeaders[headerName.toLowerCase()] !== true));
+    }
+    return Object.fromEntries(headers.entries());
+};

package/dist/request-example/context/helpers/combine-params.d.ts

@@ -0,0 +1,4 @@
+import type { OperationObject, PathItemObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+/** Combine pathItem and operation parameters into a single, dereferenced parameter array */
+export declare const combineParams: (pathParams?: PathItemObject["parameters"], operationParams?: OperationObject["parameters"]) => OperationObject["parameters"];
+//# sourceMappingURL=combine-params.d.ts.map

package/dist/request-example/context/helpers/combine-params.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"combine-params.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/helpers/combine-params.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8DAA8D,CAAA;AAEnH,4FAA4F;AAC5F,eAAO,MAAM,aAAa,GACxB,aAAY,cAAc,CAAC,YAAY,CAAM,EAC7C,kBAAiB,eAAe,CAAC,YAAY,CAAM,KAClD,eAAe,CAAC,YAAY,CAqB9B,CAAA"}

package/dist/request-example/context/helpers/combine-params.js

@@ -0,0 +1,21 @@
+import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
+/** Combine pathItem and operation parameters into a single, dereferenced parameter array */
+export const combineParams = (pathParams = [], operationParams = []) => {
+    const operationKeys = operationParams.flatMap((unresolvedParam) => {
+        const param = getResolvedRef(unresolvedParam);
+        if (!param) {
+            return [];
+        }
+        return `${param.in}:${param.name}`;
+    });
+    const operationSet = new Set(operationKeys);
+    /** We must ensure we do not include any path params which exist in the operation */
+    const filteredPathParams = pathParams.filter((unresolvedParam) => {
+        const param = getResolvedRef(unresolvedParam);
+        if (!param) {
+            return false;
+        }
+        return !operationSet.has(`${param.in}:${param.name}`);
+    });
+    return [...filteredPathParams, ...operationParams];
+};

package/dist/request-example/context/index.d.ts

@@ -0,0 +1,12 @@
+export { getActiveEnvironment } from './environment.js';
+export { getRequestExampleContext } from './get-request-example-context.js';
+export { combineParams } from './helpers/combine-params.js';
+export { getActiveProxyUrl } from './proxy.js';
+export { getSecurityRequirements } from './security/get-security-requirements.js';
+export { getSecuritySchemes } from './security/get-security-schemes.js';
+export { getSelectedSecurity } from './security/get-selected-security.js';
+export { isAuthOptional } from './security/is-auth-optional.js';
+export type { MergedSecuritySchemes } from './security/merge-security.js';
+export { mergeSecurity } from './security/merge-security.js';
+export { getSelectedServer, getServers } from './servers.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/request-example/context/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAA;AACpD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAA;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sCAAsC,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAA;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAC5D,YAAY,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AACzD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA"}

package/dist/request-example/context/index.js

@@ -0,0 +1,10 @@
+export { getActiveEnvironment } from './environment.js';
+export { getRequestExampleContext } from './get-request-example-context.js';
+export { combineParams } from './helpers/combine-params.js';
+export { getActiveProxyUrl } from './proxy.js';
+export { getSecurityRequirements } from './security/get-security-requirements.js';
+export { getSecuritySchemes } from './security/get-security-schemes.js';
+export { getSelectedSecurity } from './security/get-selected-security.js';
+export { isAuthOptional } from './security/is-auth-optional.js';
+export { mergeSecurity } from './security/merge-security.js';
+export { getSelectedServer, getServers } from './servers.js';

package/dist/request-example/context/proxy.d.ts

@@ -0,0 +1,18 @@
+import type { Workspace } from '../../schemas/workspace.js';
+export type Layout = 'web' | 'other';
+/**
+ * Returns the default proxy URL for web layout.
+ * For the 'web' layout, this ensures requests use Scalar's hosted proxy unless overridden,
+ * which is important for browser environments with CORS or network restrictions.
+ * For 'desktop' or 'modal' layouts, returns null to indicate no proxy by default.
+ */
+export declare const getDefaultProxyUrl: (layout: Layout) => "https://proxy.scalar.com" | null;
+/**
+ * Returns the active proxy URL for the workspace.
+ *
+ * Logic:
+ * - If the active proxy url is not set, use the default proxy url.
+ * - Otherwise, use the active proxy url.
+ */
+export declare const getActiveProxyUrl: (activeProxyUrl: Workspace["x-scalar-active-proxy"], layout: Layout) => string | null;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/request-example/context/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAEpD,MAAM,MAAM,MAAM,GAAG,KAAK,GAAG,OAAO,CAAA;AAEpC;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,sCAKhD,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,gBAAgB,SAAS,CAAC,uBAAuB,CAAC,EAAE,QAAQ,MAAM,kBAMnG,CAAA"}

package/dist/request-example/context/proxy.js

@@ -0,0 +1,26 @@
+/**
+ * Returns the default proxy URL for web layout.
+ * For the 'web' layout, this ensures requests use Scalar's hosted proxy unless overridden,
+ * which is important for browser environments with CORS or network restrictions.
+ * For 'desktop' or 'modal' layouts, returns null to indicate no proxy by default.
+ */
+export const getDefaultProxyUrl = (layout) => {
+    if (layout === 'web') {
+        return 'https://proxy.scalar.com';
+    }
+    return null;
+};
+/**
+ * Returns the active proxy URL for the workspace.
+ *
+ * Logic:
+ * - If the active proxy url is not set, use the default proxy url.
+ * - Otherwise, use the active proxy url.
+ */
+export const getActiveProxyUrl = (activeProxyUrl, layout) => {
+    // If the active proxy url is not set, use the default proxy url
+    if (activeProxyUrl === undefined) {
+        return getDefaultProxyUrl(layout);
+    }
+    return activeProxyUrl;
+};

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts

@@ -0,0 +1,10 @@
+import type { SecurityScheme } from '@scalar/types/entities';
+import type { AuthStore } from '@scalar/workspace-store/entities/auth';
+import type { DeepPartial } from '@scalar/workspace-store/helpers/overrides-proxy';
+import type { SecuritySchemeObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
+/** A combined scheme that includes both the auth store secrets and a deep partial of the config auth */
+export type ConfigAuthScheme = SecuritySchemeObject & DeepPartial<SecurityScheme>;
+/** Extract the secrets from the config and the auth store */
+export declare const extractSecuritySchemeSecrets: (scheme: SecuritySchemeObject & DeepPartial<SecurityScheme>, authStore: AuthStore, name: string, documentSlug: string) => SecuritySchemeObjectSecret;
+//# sourceMappingURL=extract-security-scheme-secrets.d.ts.map

package/dist/request-example/context/security/extract-security-scheme-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-security-scheme-secrets.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/extract-security-scheme-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAC5D,OAAO,KAAK,EAAE,SAAS,EAA2C,MAAM,uCAAuC,CAAA;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iDAAiD,CAAA;AAQlF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,8DAA8D,CAAA;AAExG,OAAO,KAAK,EAUV,0BAA0B,EAC3B,MAAM,iDAAiD,CAAA;AAExD,wGAAwG;AACxG,MAAM,MAAM,gBAAgB,GAAG,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,CAAA;AAyKjF,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,GAEvC,QAAQ,oBAAoB,GAAG,WAAW,CAAC,cAAc,CAAC,EAC1D,WAAW,SAAS,EACpB,MAAM,MAAM,EACZ,cAAc,MAAM,KACnB,0BA2DF,CAAA"}

package/dist/request-example/context/security/extract-security-scheme-secrets.js

@@ -0,0 +1,167 @@
+import { isObject } from '@scalar/helpers/object/is-object';
+import { objectEntries } from '@scalar/helpers/object/object-entries';
+/**
+ * Maps x-scalar-secret fields to their corresponding input field names.
+ * This allows us to fall back to config values when auth store secrets are not available.
+ */
+const SECRET_TO_INPUT_FIELD_MAP = {
+    'x-scalar-secret-client-id': 'x-scalar-client-id',
+    'x-scalar-secret-client-secret': 'clientSecret',
+    'x-scalar-secret-password': 'password',
+    'x-scalar-secret-redirect-uri': 'x-scalar-redirect-uri',
+    'x-scalar-secret-token': 'token',
+    'x-scalar-secret-username': 'username',
+    'x-scalar-secret-auth-url': 'authorizationUrl',
+    'x-scalar-secret-token-url': 'tokenUrl',
+};
+const mergeFlowSecrets = (properties, configSecrets, authStoreSecrets = {}) => Object.fromEntries(properties.map((property) => {
+    // Super merge in order of priority: auth store > config > config input field > empty string
+    const value = authStoreSecrets[property] ||
+        configSecrets[property] ||
+        configSecrets[SECRET_TO_INPUT_FIELD_MAP[property]] ||
+        '';
+    return [property, value];
+}));
+const extractRefreshTokenSecret = (authStoreSecrets = {}) => {
+    const refreshToken = authStoreSecrets['x-scalar-secret-refresh-token'];
+    if (typeof refreshToken === 'string') {
+        return { 'x-scalar-secret-refresh-token': refreshToken };
+    }
+    return {};
+};
+const extractCredentialsLocation = (configSecrets, authStoreSecrets = {}) => {
+    const credentialsLocation = authStoreSecrets['x-scalar-credentials-location'] ??
+        configSecrets['x-scalar-credentials-location'];
+    return credentialsLocation ? { 'x-scalar-credentials-location': credentialsLocation } : {};
+};
+/**
+ * Extract flow secrets and selected scopes for OAuth-like flows.
+ * Reused by both oauth2 and openIdConnect security schemes.
+ */
+const extractOAuthFlowSecrets = (flows, storeSecrets) => {
+    const selectedScopes = new Set();
+    const extractedFlows = objectEntries(flows ?? {}).reduce((acc, [key, flow]) => {
+        if (!isObject(flow)) {
+            return acc;
+        }
+        // Store any selected scopes from the config
+        const flowSelectedScopes = flow['selectedScopes'];
+        if (Array.isArray(flowSelectedScopes)) {
+            flowSelectedScopes.forEach((scope) => typeof scope === 'string' && selectedScopes.add(scope));
+        }
+        // Implicit flow
+        if (key === 'implicit') {
+            acc.implicit = {
+                ...flow,
+                ...mergeFlowSecrets([
+                    'x-scalar-secret-client-id',
+                    'x-scalar-secret-redirect-uri',
+                    'x-scalar-secret-token',
+                    'x-scalar-secret-auth-url',
+                ], flow, storeSecrets?.implicit),
+                ...extractRefreshTokenSecret(storeSecrets?.implicit),
+            };
+        }
+        // Password flow
+        if (key === 'password') {
+            acc[key] = {
+                ...flow,
+                ...mergeFlowSecrets([
+                    'x-scalar-secret-client-id',
+                    'x-scalar-secret-client-secret',
+                    'x-scalar-secret-username',
+                    'x-scalar-secret-password',
+                    'x-scalar-secret-token',
+                    'x-scalar-secret-token-url',
+                ], flow, storeSecrets?.password),
+                ...extractCredentialsLocation(flow, storeSecrets?.password),
+                ...extractRefreshTokenSecret(storeSecrets?.password),
+            };
+        }
+        // Client credentials flow
+        if (key === 'clientCredentials') {
+            acc[key] = {
+                ...flow,
+                ...mergeFlowSecrets([
+                    'x-scalar-secret-client-id',
+                    'x-scalar-secret-client-secret',
+                    'x-scalar-secret-token',
+                    'x-scalar-secret-token-url',
+                ], flow, storeSecrets?.clientCredentials),
+                ...extractCredentialsLocation(flow, storeSecrets?.clientCredentials),
+                ...extractRefreshTokenSecret(storeSecrets?.clientCredentials),
+            };
+        }
+        // Authorization code flow
+        if (key === 'authorizationCode') {
+            acc[key] = {
+                ...flow,
+                ...mergeFlowSecrets([
+                    'x-scalar-secret-client-id',
+                    'x-scalar-secret-client-secret',
+                    'x-scalar-secret-redirect-uri',
+                    'x-scalar-secret-token',
+                    'x-scalar-secret-auth-url',
+                    'x-scalar-secret-token-url',
+                ], flow, storeSecrets?.authorizationCode),
+                ...extractCredentialsLocation(flow, storeSecrets?.authorizationCode),
+                ...extractRefreshTokenSecret(storeSecrets?.authorizationCode),
+            };
+        }
+        return acc;
+    }, {});
+    return { flows: extractedFlows, selectedScopes: Array.from(selectedScopes) };
+};
+/** Extract the secrets from the config and the auth store */
+export const extractSecuritySchemeSecrets = (
+// Include the config fields
+scheme, authStore, name, documentSlug) => {
+    const secrets = authStore.getAuthSecrets(documentSlug, name);
+    // Handle API Key security schemes
+    if (scheme.type === 'apiKey') {
+        const storeSecrets = secrets?.type === 'apiKey' ? secrets : undefined;
+        return {
+            ...scheme,
+            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] || scheme.value || '',
+        };
+    }
+    // Handle HTTP Auth security schemes (e.g., Basic, Bearer)
+    if (scheme.type === 'http') {
+        const storeSecrets = secrets?.type === 'http' ? secrets : undefined;
+        return {
+            ...scheme,
+            'x-scalar-secret-token': storeSecrets?.['x-scalar-secret-token'] || scheme.token || '',
+            'x-scalar-secret-username': storeSecrets?.['x-scalar-secret-username'] || scheme.username || '',
+            'x-scalar-secret-password': storeSecrets?.['x-scalar-secret-password'] || scheme.password || '',
+        };
+    }
+    // Handle OAuth2 security schemes and all supported flows
+    if (scheme.type === 'oauth2') {
+        const storeSecrets = secrets?.type === 'oauth2' ? secrets : undefined;
+        const extracted = extractOAuthFlowSecrets(scheme.flows, storeSecrets);
+        const configuredDefaultScopes = Array.isArray(scheme['x-default-scopes'])
+            ? scheme['x-default-scopes'].filter((scope) => typeof scope === 'string')
+            : [];
+        const mergedDefaultScopes = Array.from(new Set([...configuredDefaultScopes, ...extracted.selectedScopes]));
+        return {
+            ...scheme,
+            flows: extracted.flows,
+            'x-default-scopes': mergedDefaultScopes,
+        };
+    }
+    // OpenID Connect uses auth-store-only discovered flows, but we expose them in OAuth-like flow format.
+    if (scheme.type === 'openIdConnect') {
+        const storeSecrets = secrets?.type === 'openIdConnect' ? secrets : undefined;
+        const extracted = extractOAuthFlowSecrets({
+            implicit: storeSecrets?.implicit,
+            password: storeSecrets?.password,
+            clientCredentials: storeSecrets?.clientCredentials,
+            authorizationCode: storeSecrets?.authorizationCode,
+        }, storeSecrets);
+        return {
+            ...scheme,
+            ...(objectEntries(extracted.flows).length ? { flows: extracted.flows } : {}),
+        };
+    }
+    return scheme;
+};

package/dist/request-example/context/security/get-security-requirements.d.ts

@@ -0,0 +1,12 @@
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { OperationObject } from '@scalar/workspace-store/schemas/v3.1/strict/operation';
+/**
+ * Compute what the security requirements should be for a request
+ *
+ * If an operation has only one optional security requirement,
+ * use the document security and ensure it includes an optional object.
+ *
+ * Otherwise we generally go operation -> document security.
+ */
+export declare const getSecurityRequirements: (documentSecurity: OpenApiDocument["security"], operationSecurity?: OperationObject["security"]) => Partial<Record<string, string[]>>[];
+//# sourceMappingURL=get-security-requirements.d.ts.map

package/dist/request-example/context/security/get-security-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-security-requirements.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/get-security-requirements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAA;AACnG,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uDAAuD,CAAA;AAE5F;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,GAClC,kBAAkB,eAAe,CAAC,UAAU,CAAC,EAC7C,oBAAoB,eAAe,CAAC,UAAU,CAAC,wCAShD,CAAA"}

package/dist/request-example/context/security/get-security-requirements.js

@@ -0,0 +1,16 @@
+/**
+ * Compute what the security requirements should be for a request
+ *
+ * If an operation has only one optional security requirement,
+ * use the document security and ensure it includes an optional object.
+ *
+ * Otherwise we generally go operation -> document security.
+ */
+export const getSecurityRequirements = (documentSecurity, operationSecurity) => {
+    // If the operation security is optional, use the document security and ensure it includes an optional object
+    if (JSON.stringify(operationSecurity) === '[{}]' && documentSecurity?.length) {
+        const documentHasOptional = Boolean(documentSecurity.find((s) => JSON.stringify(s) === '{}'));
+        return documentHasOptional ? documentSecurity : [...documentSecurity, {}];
+    }
+    return operationSecurity ?? documentSecurity ?? [];
+};

package/dist/request-example/context/security/get-security-schemes.d.ts

@@ -0,0 +1,9 @@
+import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
+import type { MergedSecuritySchemes } from '../../../request-example/context/security/merge-security.js';
+import type { SecurityRequirementObject } from '../../../schemas/v3.1/strict/security-requirement.js';
+/**
+ * Get the selected security schemes from security requirements.
+ * Takes security requirement objects and resolves them to actual security scheme objects.
+ */
+export declare const getSecuritySchemes: (securitySchemes: MergedSecuritySchemes, selectedSecurity: SecurityRequirementObject[]) => SecuritySchemeObjectSecret[];
+//# sourceMappingURL=get-security-schemes.d.ts.map

package/dist/request-example/context/security/get-security-schemes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-security-schemes.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/get-security-schemes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AACjG,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAE3F;;;GAGG;AACH,eAAO,MAAM,kBAAkB,GAC7B,iBAAiB,qBAAqB,EACtC,kBAAkB,yBAAyB,EAAE,KAC5C,0BAA0B,EAUpB,CAAA"}

package/dist/request-example/context/security/get-security-schemes.js

@@ -0,0 +1,13 @@
+import { objectKeys } from '@scalar/helpers/object/object-keys';
+import { getResolvedRef } from '../../../helpers/get-resolved-ref.js';
+/**
+ * Get the selected security schemes from security requirements.
+ * Takes security requirement objects and resolves them to actual security scheme objects.
+ */
+export const getSecuritySchemes = (securitySchemes, selectedSecurity) => selectedSecurity.flatMap((scheme) => objectKeys(scheme).flatMap((key) => {
+    const scheme = getResolvedRef(securitySchemes?.[key]);
+    if (scheme) {
+        return scheme;
+    }
+    return [];
+})) ?? [];

package/dist/request-example/context/security/get-selected-security.d.ts

@@ -0,0 +1,15 @@
+import type { SelectedSecurity } from '@scalar/workspace-store/entities/auth';
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+type DefaultScopeScheme = {
+    type?: string;
+    'x-default-scopes'?: string[];
+};
+/**
+ * Resolves which security selection to use for an operation.
+ * Priority: operation-level selection, then document-level selection, then a default.
+ * When neither level has a selection, returns the first security requirement unless
+ * authentication is optional or there are no requirements, in which case returns no selection.
+ */
+export declare const getSelectedSecurity: (documentSelectedSecurity: SelectedSecurity | undefined, operationSelectedSecurity: SelectedSecurity | undefined, securityRequirements?: NonNullable<OpenApiDocument["security"]>, securitySchemes?: Record<string, DefaultScopeScheme | undefined>) => SelectedSecurity;
+export {};
+//# sourceMappingURL=get-selected-security.d.ts.map

package/dist/request-example/context/security/get-selected-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-selected-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/get-selected-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uCAAuC,CAAA;AAE7E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAA;AAInG,KAAK,kBAAkB,GAAG;IACxB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC9B,CAAA;AA4BD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAC9B,0BAA0B,gBAAgB,GAAG,SAAS,EACtD,2BAA2B,gBAAgB,GAAG,SAAS,EACvD,uBAAsB,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAM,EACnE,kBAAiB,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,SAAS,CAAM,KACnE,gBA4BF,CAAA"}

package/dist/request-example/context/security/get-selected-security.js

@@ -0,0 +1,49 @@
+import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
+import { isAuthOptional } from './is-auth-optional.js';
+const applyDefaultScopes = (requirement, securitySchemes) => {
+    let didApplyDefaultScopes = false;
+    const hydratedRequirement = Object.fromEntries(Object.entries(requirement).map(([name, scopes]) => {
+        if (Array.isArray(scopes) && scopes.length > 0) {
+            return [name, scopes];
+        }
+        const scheme = getResolvedRef(securitySchemes[name]);
+        const defaultScopes = scheme?.type === 'oauth2' ? scheme['x-default-scopes'] : undefined;
+        if (Array.isArray(defaultScopes) && defaultScopes.length > 0) {
+            didApplyDefaultScopes = true;
+            return [name, [...defaultScopes]];
+        }
+        return [name, scopes];
+    }));
+    return didApplyDefaultScopes ? hydratedRequirement : requirement;
+};
+/**
+ * Resolves which security selection to use for an operation.
+ * Priority: operation-level selection, then document-level selection, then a default.
+ * When neither level has a selection, returns the first security requirement unless
+ * authentication is optional or there are no requirements, in which case returns no selection.
+ */
+export const getSelectedSecurity = (documentSelectedSecurity, operationSelectedSecurity, securityRequirements = [], securitySchemes = {}) => {
+    // Operation level security
+    if (operationSelectedSecurity) {
+        return operationSelectedSecurity;
+    }
+    // Document level security
+    if (documentSelectedSecurity) {
+        return documentSelectedSecurity;
+    }
+    const isOptional = isAuthOptional(securityRequirements);
+    const firstRequirement = securityRequirements[0];
+    // No need to default if auth is optional
+    if (isOptional || !firstRequirement) {
+        return {
+            selectedIndex: -1,
+            selectedSchemes: [],
+        };
+    }
+    // Default to the first requirement
+    const hydratedRequirement = applyDefaultScopes(firstRequirement, securitySchemes);
+    return {
+        selectedIndex: 0,
+        selectedSchemes: [hydratedRequirement],
+    };
+};

package/dist/request-example/context/security/is-auth-optional.d.ts

@@ -0,0 +1,4 @@
+import type { OpenApiDocument } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+/** Determines if the authentication is optional */
+export declare const isAuthOptional: (securityRequirements: NonNullable<OpenApiDocument["security"]>) => boolean;
+//# sourceMappingURL=is-auth-optional.d.ts.map

package/dist/request-example/context/security/is-auth-optional.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-auth-optional.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/is-auth-optional.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8DAA8D,CAAA;AAEnG,mDAAmD;AACnD,eAAO,MAAM,cAAc,GAAI,sBAAsB,WAAW,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,KAAG,OAK/F,CAAA"}

package/dist/request-example/context/security/is-auth-optional.js

@@ -0,0 +1,6 @@
+/** Determines if the authentication is optional */
+export const isAuthOptional = (securityRequirements) => {
+    const hasComplexRequirement = securityRequirements.some((requirement) => Object.keys(requirement).length > 1);
+    const hasEmptyRequirement = securityRequirements.some((requirement) => Object.keys(requirement).length === 0);
+    return hasEmptyRequirement && !hasComplexRequirement;
+};

package/dist/request-example/context/security/merge-security.d.ts

@@ -0,0 +1,9 @@
+import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
+import type { AuthStore } from '@scalar/workspace-store/entities/auth';
+import { type ComponentsObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
+/** Document security merged with the config security schemes */
+export type MergedSecuritySchemes = Record<string, SecuritySchemeObjectSecret>;
+/** Merge the authentication config with the document security schemes + the auth store secrets */
+export declare const mergeSecurity: (documentSecuritySchemes: ComponentsObject["securitySchemes"], configSecuritySchemes: AuthenticationConfiguration["securitySchemes"], authStore: AuthStore, documentName: string) => MergedSecuritySchemes;
+//# sourceMappingURL=merge-security.d.ts.map

package/dist/request-example/context/security/merge-security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAErE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AAE9E,kGAAkG;AAClG,eAAO,MAAM,aAAa,GACxB,yBAAyB,gBAAgB,CAAC,iBAAiB,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,KACnB,qBA2BF,CAAA"}

package/dist/request-example/context/security/merge-security.js

@@ -0,0 +1,29 @@
+import { objectEntries } from '@scalar/helpers/object/object-entries';
+import { deepClone } from '@scalar/workspace-store/helpers/deep-clone';
+import { getResolvedRef } from '@scalar/workspace-store/helpers/get-resolved-ref';
+import { mergeObjects } from '@scalar/workspace-store/helpers/merge-object';
+import { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce';
+import { SecuritySchemeObjectSchema, } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import { extractSecuritySchemeSecrets } from './extract-security-scheme-secrets.js';
+/** Merge the authentication config with the document security schemes + the auth store secrets */
+export const mergeSecurity = (documentSecuritySchemes = {}, configSecuritySchemes = {}, authStore, documentName) => {
+    /** Resolve any refs in the document security schemes */
+    const resolvedDocumentSecuritySchemes = objectEntries(documentSecuritySchemes).reduce((acc, [key, value]) => {
+        const resolved = deepClone(getResolvedRef(value));
+        if (resolved) {
+            acc[key] = resolved;
+        }
+        return acc;
+    }, {});
+    /** Merge the config security schemes into the document security schemes */
+    const mergedSchemes = mergeObjects(resolvedDocumentSecuritySchemes, configSecuritySchemes) ?? {};
+    /** Convert the config secrets to the new secret extensions */
+    return objectEntries(mergedSchemes).reduce((acc, [name, value]) => {
+        // We coerce in case the scheme is missing any key fields like type
+        const coerced = coerceValue(SecuritySchemeObjectSchema, value);
+        // We then overwrite it back with the original value to keep any other fields like description, etc.
+        const merged = { ...coerced, ...value };
+        acc[name] = extractSecuritySchemeSecrets(merged, authStore, name, documentName);
+        return acc;
+    }, {});
+};

package/dist/request-example/context/servers.d.ts

@@ -0,0 +1,26 @@
+import type { ServerObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
+import type { WorkspaceDocument } from '../../schemas.js';
+import type { OperationObject } from '../../schemas/v3.1/strict/operation.js';
+/**
+ * Server processing options containing base URLs for resolving relative server URLs.
+ */
+type ServerProcessingOptions = {
+    baseServerUrl?: string;
+    documentUrl?: string;
+};
+/**
+ * Retrieves and processes servers from an OpenAPI document.
+ *
+ * This function handles several scenarios:
+ * 1. No servers provided - creates a default server from document URL or fallback
+ * 2. Invalid server configurations - filters them out with warnings
+ * 3. Relative URLs - resolves them to absolute URLs using available base URLs
+ *
+ * @param servers - Array of OpenAPI server objects from the document
+ * @param options - Configuration options for server processing
+ * @returns Array of validated Server entities
+ */
+export declare function getServers(servers: ServerObject[] | undefined, options?: ServerProcessingOptions): ServerObject[];
+export declare const getSelectedServer: (document: WorkspaceDocument | null, operation: OperationObject | null, configServers: ServerObject[] | null, servers: ServerObject[]) => ServerObject | null;
+export {};
+//# sourceMappingURL=servers.d.ts.map

package/dist/request-example/context/servers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"servers.d.ts","sourceRoot":"","sources":["../../../src/request-example/context/servers.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,8DAA8D,CAAA;AAEhG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAA;AAEtE;;GAEG;AACH,KAAK,uBAAuB,GAAG;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,OAAO,GAAE,uBAA4B,GAAG,YAAY,EAAE,CASrH;AAoED,eAAO,MAAM,iBAAiB,GAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,WAAW,eAAe,GAAG,IAAI,EACjC,eAAe,YAAY,EAAE,GAAG,IAAI,EACpC,SAAS,YAAY,EAAE,KACtB,YAAY,GAAG,IAWjB,CAAA"}