@scalar/workspace-store 0.55.3 → 0.55.5

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @scalar/workspace-store
 
+## 0.55.5
+
+## 0.55.4
+
+### Patch Changes
+
+- [#9618](https://github.com/scalar/scalar/pull/9618): Render document-wide authentication for AsyncAPI documents. The introduction now shows the same Authentication selector used for OpenAPI, populated from `components.securitySchemes`, with requirements derived from the union of every server's `security` (AsyncAPI has no root-level `security`). When some servers require auth and others accept unauthenticated connections, a no-auth option is offered too. Schemes shared with OpenAPI (`http`, `oauth2`, `openIdConnect`, `apiKey`) get full input UI, and AsyncAPI OAuth2 `availableScopes` are mapped onto OpenAPI `scopes` so the scope list renders. Broker-specific types still appear in the selector but have no dedicated input yet. The selector is now fully interactive for AsyncAPI (selecting schemes, entering credentials, editing scopes) because the auth mutators accept AsyncAPI documents. Operation/channel-level auth is intentionally left for a follow-up.
+
 ## 0.55.3
 
 ### Patch Changes

package/README.md

@@ -2,6 +2,20 @@
 
 A powerful data store for managing OpenAPI documents. This package provides a flexible solution for handling multiple OpenAPI documents in a workspace environment
 
+---
+
+Scalar is an open-source API platform for teams who want beautiful developer interfaces without vendor lock-in.
+
+- **[API References](https://scalar.com/products/api-references/getting-started)** — Interactive API documentation from OpenAPI and AsyncAPI specs.
+- **[Docs](https://scalar.com/products/docs/getting-started)** — Write in Markdown/MDX, generate API references, sync with two-way Git.
+- **[SDKs](https://scalar.com/products/sdks/getting-started)** — Type-safe client libraries in TypeScript, Python, Go, PHP, Java, and Ruby.
+- **[MCP Servers](https://scalar.com/products/agent/getting-started)** — Generate secure MCP servers from your API spec.
+- **[API Client](https://scalar.com/products/api-client/getting-started)** — Open-source, offline-first Postman alternative built on OpenAPI.
+
+20M+ monthly npm installs · 15,500+ GitHub stars · MIT licensed · [scalar.com](https://scalar.com)
+
+---
+
 ## Server-Side workspace store
 
 Server side data store which enables document chunking to reduce initial loading time specially when working with large openapi documents

package/dist/channel-example/dedupe-requirements.d.ts

@@ -0,0 +1,9 @@
+import type { SecurityRequirementObject } from '../schemas/v3.1/strict/security-requirement.js';
+/**
+ * Remove duplicate security requirements, comparing by their JSON shape.
+ *
+ * Shared by the channel-connection and document-wide requirement builders, which both union
+ * requirements from several sources (servers, operations) and need to collapse identical entries.
+ */
+export declare const dedupeRequirements: (requirements: SecurityRequirementObject[]) => SecurityRequirementObject[];
+//# sourceMappingURL=dedupe-requirements.d.ts.map

package/dist/channel-example/dedupe-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe-requirements.d.ts","sourceRoot":"","sources":["../../src/channel-example/dedupe-requirements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAE3F;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAAI,cAAc,yBAAyB,EAAE,KAAG,yBAAyB,EAWvG,CAAA"}

package/dist/channel-example/dedupe-requirements.js

@@ -0,0 +1,17 @@
+/**
+ * Remove duplicate security requirements, comparing by their JSON shape.
+ *
+ * Shared by the channel-connection and document-wide requirement builders, which both union
+ * requirements from several sources (servers, operations) and need to collapse identical entries.
+ */
+export const dedupeRequirements = (requirements) => {
+    const seen = new Set();
+    return requirements.filter((requirement) => {
+        const key = JSON.stringify(requirement);
+        if (seen.has(key)) {
+            return false;
+        }
+        seen.add(key);
+        return true;
+    });
+};

package/dist/channel-example/get-asyncapi-security-requirements.d.ts

@@ -4,4 +4,12 @@ import type { SecurityRequirementObject } from '../schemas/v3.1/strict/security-
  * Converts AsyncAPI security arrays (operation, traits, server) into OpenAPI-style requirement objects.
  */
 export declare const getAsyncApiSecurityRequirements: (document: AsyncApiDocument, operation?: AsyncApiOperationObject | null, server?: AsyncApiServerObject | null) => SecurityRequirementObject[];
+/**
+ * Document-wide security requirements for an AsyncAPI document.
+ *
+ * AsyncAPI has no root-level `security`; the closest document-wide scope is the union of every
+ * server's security (a server applies to the whole connection). Operation-level security is
+ * intentionally excluded here — that is per-channel and handled separately.
+ */
+export declare const getAsyncApiDocumentSecurityRequirements: (document: AsyncApiDocument) => SecurityRequirementObject[];
 //# sourceMappingURL=get-asyncapi-security-requirements.d.ts.map

package/dist/channel-example/get-asyncapi-security-requirements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-asyncapi-security-requirements.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-asyncapi-security-requirements.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AAInC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AA6E3F;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC1C,UAAU,gBAAgB,EAC1B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,SAAS,oBAAoB,GAAG,IAAI,KACnC,yBAAyB,EAqB3B,CAAA"}
+{"version":3,"file":"get-asyncapi-security-requirements.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-asyncapi-security-requirements.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EAEvB,oBAAoB,EACrB,MAAM,4BAA4B,CAAA;AAInC,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AA+E3F;;GAEG;AACH,eAAO,MAAM,+BAA+B,GAC1C,UAAU,gBAAgB,EAC1B,YAAY,uBAAuB,GAAG,IAAI,EAC1C,SAAS,oBAAoB,GAAG,IAAI,KACnC,yBAAyB,EAY3B,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uCAAuC,GAAI,UAAU,gBAAgB,KAAG,yBAAyB,EAwB7G,CAAA"}

package/dist/channel-example/get-asyncapi-security-requirements.js

@@ -1,6 +1,7 @@
 import { isObjectEqual } from '@scalar/helpers/object/is-object-equal';
 import { getNameFromRef } from '../helpers/get-name-from-ref.js';
 import { getResolvedRef } from '../helpers/get-resolved-ref.js';
+import { dedupeRequirements } from './dedupe-requirements.js';
 const getSecuritySchemeNameFromRef = (ref) => getNameFromRef(ref, ['components', 'securitySchemes']);
 /** Strips requirement-only `scopes` so inline entries can match component scheme definitions. */
 const getSecuritySchemeDefinition = (entry) => {
@@ -64,13 +65,32 @@ export const getAsyncApiSecurityRequirements = (document, operation, server) =>
         : serverRequirements.length === 0
             ? operationRequirements
             : [...operationRequirements, ...serverRequirements];
-    const seen = new Set();
-    return combined.filter((requirement) => {
-        const key = JSON.stringify(requirement);
-        if (seen.has(key)) {
-            return false;
-        }
-        seen.add(key);
-        return true;
-    });
+    return dedupeRequirements(combined);
+};
+/**
+ * Document-wide security requirements for an AsyncAPI document.
+ *
+ * AsyncAPI has no root-level `security`; the closest document-wide scope is the union of every
+ * server's security (a server applies to the whole connection). Operation-level security is
+ * intentionally excluded here — that is per-channel and handled separately.
+ */
+export const getAsyncApiDocumentSecurityRequirements = (document) => {
+    const servers = document.servers ? getResolvedRef(document.servers) : undefined;
+    if (!servers) {
+        return [];
+    }
+    const resolvedServers = Object.values(servers).map((serverRef) => getResolvedRef(serverRef));
+    const perServerRequirements = resolvedServers.map((server) => getAsyncApiSecurityRequirements(document, null, server));
+    const combined = perServerRequirements.flat();
+    // When some servers require auth while others accept unauthenticated connections, surface the
+    // no-auth path as an optional `{}` requirement so those servers stay selectable. "No auth" is
+    // keyed off the declared `security` array (absent or empty), not off a server whose declared
+    // security failed to resolve to a scheme — that server still requires auth. If no server
+    // requires auth at all, we return `[]` and let the selector treat every scheme as optional.
+    const someRequireAuth = perServerRequirements.some((requirements) => requirements.length > 0);
+    const someDeclareNoAuth = resolvedServers.some((server) => !server?.security?.length);
+    if (someRequireAuth && someDeclareNoAuth) {
+        combined.push({});
+    }
+    return dedupeRequirements(combined);
 };

package/dist/channel-example/get-channel-connection-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-connection-context.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAS9E,OAAO,KAAK,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAQ9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAGrD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAK5D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,uBAAuB,qBAAqB,EAC5C,UAAS,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,cAAc,EAAE,2BAA2B,CAAA;IAC3C,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,6BAA6B,CAwItC,CAAA"}
+{"version":3,"file":"get-channel-connection-context.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-context.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAS9E,OAAO,KAAK,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AACnG,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAQ9C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAA;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAK5D;;;GAGG;AACH,eAAO,MAAM,2BAA2B,GACtC,gBAAgB,cAAc,EAC9B,cAAc,MAAM,EACpB,uBAAuB,qBAAqB,EAC5C,UAAS,OAAO,CAAC;IACf,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvC,cAAc,EAAE,2BAA2B,CAAA;IAC3C,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAA;CAC3C,CAAM,KACN,MAAM,CAAC,6BAA6B,CAwItC,CAAA"}

package/dist/channel-example/get-channel-connection-context.js

@@ -85,7 +85,7 @@ export const getChannelConnectionContext = (workspaceStore, documentName, channe
         method: ASYNCAPI_CHANNEL_AUTH_METHOD,
     });
     const components = document.components ? getResolvedRef(document.components) : undefined;
-    const securitySchemes = mergeSecurity((components?.securitySchemes ?? {}), options.authentication?.securitySchemes ?? {}, workspaceStore.auth, documentName);
+    const securitySchemes = mergeSecurity(components?.securitySchemes ?? {}, options.authentication?.securitySchemes ?? {}, workspaceStore.auth, documentName);
     const securityRequirements = getChannelConnectionSecurityRequirements(document, channel, selectedServer?.server ?? null, channelOperations);
     const selectedSecurity = getSelectedSecurity(documentSelectedSecurity, channelSelectedSecurity, securityRequirements, securitySchemes, options.authentication?.preferredSecurityScheme);
     const selectedSecuritySchemes = getSecuritySchemes(securitySchemes, selectedSecurity.selectedSchemes[selectedSecurity.selectedIndex] ?? {});

package/dist/channel-example/get-channel-connection-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-channel-connection-security.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAG/G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAE3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAevE;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACnD,UAAU,gBAAgB,EAC1B,UAAU,qBAAqB,EAC/B,QAAQ,oBAAoB,GAAG,IAAI,EACnC,mBAAmB,uBAAuB,EAAE,KAC3C,yBAAyB,EAQ3B,CAAA"}
+{"version":3,"file":"get-channel-connection-security.d.ts","sourceRoot":"","sources":["../../src/channel-example/get-channel-connection-security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAA;AAG/G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,4CAA4C,CAAA;AAG3F,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AAEvE;;GAEG;AACH,eAAO,MAAM,wCAAwC,GACnD,UAAU,gBAAgB,EAC1B,UAAU,qBAAqB,EAC/B,QAAQ,oBAAoB,GAAG,IAAI,EACnC,mBAAmB,uBAAuB,EAAE,KAC3C,yBAAyB,EAQ3B,CAAA"}

package/dist/channel-example/get-channel-connection-security.js

@@ -1,15 +1,5 @@
 import { getAsyncApiSecurityRequirements } from '../channel-example/get-asyncapi-security-requirements.js';
-const dedupeRequirements = (requirements) => {
-    const seen = new Set();
-    return requirements.filter((requirement) => {
-        const key = JSON.stringify(requirement);
-        if (seen.has(key)) {
-            return false;
-        }
-        seen.add(key);
-        return true;
-    });
-};
+import { dedupeRequirements } from './dedupe-requirements.js';
 /**
  * Merges security requirements from the selected server and all operations on a channel.
  */

package/dist/channel-example/index.d.ts

@@ -4,7 +4,7 @@ export type { ChannelMessageEntry } from './get-all-channel-messages.js';
 export { getAllChannelMessages } from './get-all-channel-messages.js';
 export type { AsyncApiProtocolOption, AsyncApiReachabilityContext, AsyncApiServerOption, OperationReachability, } from './get-async-api-protocols.js';
 export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
-export { getAsyncApiSecurityRequirements } from './get-asyncapi-security-requirements.js';
+export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, } from './get-asyncapi-security-requirements.js';
 export { getChannelConnectionContext } from './get-channel-connection-context.js';
 export { getChannelConnectionSecurityRequirements } from './get-channel-connection-security.js';
 export type { ChannelOperationSummary } from './get-channel-operations.js';

package/dist/channel-example/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channel-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChG,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,GAAG,EACH,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAA;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACzE,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/channel-example/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AAChG,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,wBAAwB,EACxB,mBAAmB,EACnB,eAAe,GAChB,MAAM,wBAAwB,CAAA;AAC/B,YAAY,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AACrE,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAA;AAClE,YAAY,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,GAAG,EACH,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,uCAAuC,EACvC,+BAA+B,GAChC,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAA;AAC9E,OAAO,EAAE,wCAAwC,EAAE,MAAM,mCAAmC,CAAA;AAC5F,YAAY,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAA;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAA;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAA;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,YAAY,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAC5E,YAAY,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AAC/E,OAAO,EAAE,kBAAkB,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAA;AACzE,YAAY,EAAE,6BAA6B,EAAE,qBAAqB,EAAE,MAAM,SAAS,CAAA"}

package/dist/channel-example/index.js

@@ -1,7 +1,7 @@
 export { ASYNCAPI_WEBSOCKET_PROTOCOLS, buildAsyncApiServerBaseUrl, buildConnectionUrl, buildWsQueryParams, getAsyncApiServerVariables, getUrlSchemeFromProtocol, isWebSocketProtocol, mergeWsBindings, } from './build-connection-url.js';
 export { getAllChannelMessages } from './get-all-channel-messages.js';
 export { ALL, createReachabilityContext, getAsyncApiProtocols, getAsyncApiServerOptions, getOperationProtocols, getOperationReachability, getOperationServerNames, operationMatchesProtocol, operationMatchesServer, } from './get-async-api-protocols.js';
-export { getAsyncApiSecurityRequirements } from './get-asyncapi-security-requirements.js';
+export { getAsyncApiDocumentSecurityRequirements, getAsyncApiSecurityRequirements, } from './get-asyncapi-security-requirements.js';
 export { getChannelConnectionContext } from './get-channel-connection-context.js';
 export { getChannelConnectionSecurityRequirements } from './get-channel-connection-security.js';
 export { getChannelOperations } from './get-channel-operations.js';

package/dist/mutators/auth.d.ts

@@ -1,7 +1,7 @@
 import type { WorkspaceStore } from '../client.js';
 import type { AuthEvents } from '../events/definitions/auth.js';
 import type { WorkspaceDocument } from '../schemas.js';
-import type { OAuth2Object } from '../schemas/v3.1/strict/security-scheme.js';
+import type { SecuritySchemeObject } from '../schemas/v3.1/strict/security-scheme.js';
 /**
  * Updates the selected security schemes for either the entire document or a specific operation.
  * - Adds newly created security schemes (if any) to the workspace document's components.
@@ -50,7 +50,7 @@ export declare const updateSelectedSecuritySchemes: (store: WorkspaceStore | nul
  *   name: 'MyHttpAuth',
  * })
  */
-export declare const updateSecurityScheme: (document: WorkspaceDocument | null, { payload, name }: AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").ApiKeyObject | import("../schemas/v3.1/strict/security-scheme.js").HttpObject | OAuth2Object | import("../schemas/v3.1/strict/security-scheme.js").OpenIdConnectObject | undefined;
+export declare const updateSecurityScheme: (document: WorkspaceDocument | null, { payload, name }: AuthEvents["auth:update:security-scheme"]) => SecuritySchemeObject | undefined;
 /**
  * Sets the selected authentication tab (scheme) index for the given OpenAPI document or operation.
  * - When on the document level, updates the 'selectedIndex' on the document's x-scalar-selected-security extension.
@@ -155,7 +155,7 @@ export declare const authMutatorsFactory: ({ document, store, }: {
 }) => {
     updateSelectedSecuritySchemes: (payload: AuthEvents["auth:update:selected-security-schemes"]) => Promise<void>;
     clearSelectedSecuritySchemes: (payload: AuthEvents["auth:clear:selected-security-schemes"]) => void;
-    updateSecurityScheme: (payload: AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").ApiKeyObject | import("../schemas/v3.1/strict/security-scheme.js").HttpObject | OAuth2Object | import("../schemas/v3.1/strict/security-scheme.js").OpenIdConnectObject | undefined;
+    updateSecurityScheme: (payload: AuthEvents["auth:update:security-scheme"]) => SecuritySchemeObject | undefined;
     updateSecuritySchemeSecrets: (payload: AuthEvents["auth:update:security-scheme-secrets"]) => void;
     clearSecuritySchemeSecrets: (payload: AuthEvents["auth:clear:security-scheme-secrets"]) => void;
     updateSelectedAuthTab: (payload: AuthEvents["auth:update:active-index"]) => void;

package/dist/mutators/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/mutators/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAQ3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAGlD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uCAAuC,CAAA;AAEzE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,4CAA4C,UAAU,CAAC,uCAAuC,CAAC,kBA+EhG,CAAA;AA2BD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,iBAAiB,GAAG,IAAI,EAClC,mBAAmB,UAAU,CAAC,6BAA6B,CAAC,+NAiB7D,CAAA;AA6CD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,iBAAiB,UAAU,CAAC,0BAA0B,CAAC,SAiDxD,CAAA;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,4BAA4B,UAAU,CAAC,6BAA6B,CAAC,SAmDtE,CAAA;AAiED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,0DAA0D,UAAU,CAAC,oBAAoB,CAAC,SAuD3F,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,2BAA2B,UAAU,CAAC,oBAAoB,CAAC,SAuB5D,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,WAAW,UAAU,CAAC,6BAA6B,CAAC,SAmFrD,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAI,sBAGjC;IACD,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAClC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAC7B;6CAE4C,UAAU,CAAC,uCAAuC,CAAC;4CAEpD,UAAU,CAAC,sCAAsC,CAAC;oCAE1D,UAAU,CAAC,6BAA6B,CAAC;2CAElC,UAAU,CAAC,qCAAqC,CAAC;0CAElD,UAAU,CAAC,oCAAoC,CAAC;qCAErD,UAAU,CAAC,0BAA0B,CAAC;oCAEvC,UAAU,CAAC,6BAA6B,CAAC;2BAElD,UAAU,CAAC,oBAAoB,CAAC;2BAChC,UAAU,CAAC,oBAAoB,CAAC;oCACvB,UAAU,CAAC,6BAA6B,CAAC;CAG5E,CAAA"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/mutators/auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAC9C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAQ3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAGlD,OAAO,KAAK,EAAgB,oBAAoB,EAAE,MAAM,uCAAuC,CAAA;AAuC/F;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,6BAA6B,GACxC,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,4CAA4C,UAAU,CAAC,uCAAuC,CAAC,kBAgFhG,CAAA;AAwBD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,oBAAoB,GAC/B,UAAU,iBAAiB,GAAG,IAAI,EAClC,mBAAmB,UAAU,CAAC,6BAA6B,CAAC,qCAwB7D,CAAA;AAuCD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,qBAAqB,GAChC,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,iBAAiB,UAAU,CAAC,0BAA0B,CAAC,SAgDxD,CAAA;AAaD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,4BAA4B,UAAU,CAAC,6BAA6B,CAAC,SAgDtE,CAAA;AAqED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,0DAA0D,UAAU,CAAC,oBAAoB,CAAC,SA2D3F,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,GACtB,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,2BAA2B,UAAU,CAAC,oBAAoB,CAAC,SAwB5D,CAAA;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,cAAc,GAAG,IAAI,EAC5B,UAAU,iBAAiB,GAAG,IAAI,EAClC,WAAW,UAAU,CAAC,6BAA6B,CAAC,SAmFrD,CAAA;AAED,eAAO,MAAM,mBAAmB,GAAI,sBAGjC;IACD,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAClC,KAAK,EAAE,cAAc,GAAG,IAAI,CAAA;CAC7B;6CAE4C,UAAU,CAAC,uCAAuC,CAAC;4CAEpD,UAAU,CAAC,sCAAsC,CAAC;oCAE1D,UAAU,CAAC,6BAA6B,CAAC;2CAElC,UAAU,CAAC,qCAAqC,CAAC;0CAElD,UAAU,CAAC,oCAAoC,CAAC;qCAErD,UAAU,CAAC,0BAA0B,CAAC;oCAEvC,UAAU,CAAC,6BAA6B,CAAC;2BAElD,UAAU,CAAC,oBAAoB,CAAC;2BAChC,UAAU,CAAC,oBAAoB,CAAC;oCACvB,UAAU,CAAC,6BAA6B,CAAC;CAG5E,CAAA"}

package/dist/mutators/auth.js

@@ -1,11 +1,44 @@
-import { generateUniqueValue } from '../helpers/generate-unique-value.js';
 import { forEachPathItemOperation, getPathItemOperation } from '../helpers/for-each-path-item-operation.js';
+import { generateUniqueValue } from '../helpers/generate-unique-value.js';
 import { getResolvedRef } from '../helpers/get-resolved-ref.js';
 import { isNonOptionalSecurityRequirement } from '../helpers/is-non-optional-security-requirement.js';
 import { mergeObjects } from '../helpers/merge-object.js';
 import { unpackProxyObject } from '../helpers/unpack-proxy.js';
 import { getSelectedSecurity } from '../request-example/context/security/get-selected-security.js';
-import { isOpenApiDocument } from '../schemas/type-guards.js';
+import { isAsyncApiDocument, isOpenApiDocument } from '../schemas/type-guards.js';
+/**
+ * The auth-store key for a document's selection and secret state.
+ *
+ * Both OpenAPI and AsyncAPI documents persist it on `x-scalar-navigation.name`, so auth selection
+ * and credential entry work for either spec. Returns `undefined` for anything else (or a document
+ * without a navigation name), in which case the caller does nothing.
+ */
+const getAuthDocumentName = (document) => {
+    if (isOpenApiDocument(document) || isAsyncApiDocument(document)) {
+        return document['x-scalar-navigation']?.name || undefined;
+    }
+    return undefined;
+};
+/**
+ * The document's `components.securitySchemes`, resolving the AsyncAPI `components` `$ref` wrapper.
+ * Used when building a fallback selection, so scope selection works for both spec types.
+ */
+const getDocumentSecuritySchemes = (document) => {
+    if (isOpenApiDocument(document)) {
+        return (document.components?.securitySchemes ?? {});
+    }
+    if (isAsyncApiDocument(document)) {
+        const components = document.components ? getResolvedRef(document.components) : undefined;
+        return (components?.securitySchemes ?? {});
+    }
+    return {};
+};
+/**
+ * The key an OAuth2 flow stores its scope map under. OpenAPI uses `scopes`; AsyncAPI uses
+ * `availableScopes` (which `mergeSecurity` renames to `scopes` for rendering), so scope edits
+ * must target the right key to round-trip.
+ */
+const getFlowScopeKey = (document) => isAsyncApiDocument(document) ? 'availableScopes' : 'scopes';
 /**
  * Updates the selected security schemes for either the entire document or a specific operation.
  * - Adds newly created security schemes (if any) to the workspace document's components.
@@ -31,10 +64,7 @@ import { isOpenApiDocument } from '../schemas/type-guards.js';
  * ```
  */
 export const updateSelectedSecuritySchemes = async (store, document, { selectedRequirements, newSchemes, meta }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
@@ -45,31 +75,35 @@ export const updateSelectedSecuritySchemes = async (store, document, { selectedR
         }
         return store?.auth.getAuthSelectedSchemas({ type: 'operation', documentName, path: meta.path, method: meta.method });
     };
-    const createdSecurityRequirements = await Promise.all(newSchemes.map(async (newScheme) => {
-        const uniqueSchemeName = await generateUniqueValue({
-            defaultValue: newScheme.name,
-            validation: (value) => !document.components?.securitySchemes?.[value],
-            maxRetries: 100,
-        });
-        if (!uniqueSchemeName) {
-            return;
-        }
-        // Ensure components and securitySchemes exist
-        if (!document.components) {
-            document.components = {};
-        }
-        if (!document.components.securitySchemes) {
-            document.components.securitySchemes = {};
-        }
-        // Add the new security scheme definition
-        document.components.securitySchemes[uniqueSchemeName] = newScheme.scheme;
-        // Return an OpenAPI Security Requirement Object for this new scheme (empty scope array)
-        return {
-            [uniqueSchemeName]: [],
-        };
-    }));
-    // Create any new security schemes required, ensuring unique names for the components
-    const createdSchemes = createdSecurityRequirements.filter(Boolean);
+    // New scheme definitions can only be materialised into an OpenAPI `components` block. AsyncAPI
+    // document-level auth only ever selects existing schemes, so there is nothing to create there.
+    const createdSchemes = [];
+    if (isOpenApiDocument(document)) {
+        const createdSecurityRequirements = await Promise.all(newSchemes.map(async (newScheme) => {
+            const uniqueSchemeName = await generateUniqueValue({
+                defaultValue: newScheme.name,
+                validation: (value) => !document.components?.securitySchemes?.[value],
+                maxRetries: 100,
+            });
+            if (!uniqueSchemeName) {
+                return;
+            }
+            // Ensure components and securitySchemes exist
+            if (!document.components) {
+                document.components = {};
+            }
+            if (!document.components.securitySchemes) {
+                document.components.securitySchemes = {};
+            }
+            // Add the new security scheme definition
+            document.components.securitySchemes[uniqueSchemeName] = newScheme.scheme;
+            // Return an OpenAPI Security Requirement Object for this new scheme (empty scope array)
+            return {
+                [uniqueSchemeName]: [],
+            };
+        }));
+        createdSchemes.push(...createdSecurityRequirements.filter(Boolean));
+    }
     const target = getTarget();
     const newSelectedSecuritySchemes = [...selectedRequirements, ...createdSchemes];
     const getSelectedIndex = () => {
@@ -94,10 +128,7 @@ export const updateSelectedSecuritySchemes = async (store, document, { selectedR
  * If the document name cannot be determined, nothing happens.
  */
 const clearSelectedSecuritySchemes = (store, document, { meta }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
@@ -130,25 +161,29 @@ const clearSelectedSecuritySchemes = (store, document, { meta }) => {
  * })
  */
 export const updateSecurityScheme = (document, { payload, name }) => {
-    if (!isOpenApiDocument(document)) {
+    if (!isOpenApiDocument(document) && !isAsyncApiDocument(document)) {
         return;
     }
-    const target = getResolvedRef(document.components?.securitySchemes?.[name]);
+    const target = getResolvedRef(getDocumentSecuritySchemes(document)[name]);
     if (!target) {
         console.error(`Security scheme ${name} not found`);
         return;
     }
-    // Handle HTTP (basic, bearer, etc.)
-    if (target.type === payload.type) {
+    // AsyncAPI's `httpApiKey` is presented as `apiKey` in the UI, so treat that as an equivalent
+    // update. Handle HTTP (basic, bearer, etc.) and the shared types the same way. The stored type is
+    // read as a string because AsyncAPI broker types are outside the OpenAPI `SecuritySchemeObject` union.
+    const storedType = target.type;
+    const isEquivalentType = storedType === payload.type || (storedType === 'httpApiKey' && payload.type === 'apiKey');
+    if (isEquivalentType) {
+        // Preserve the document's original spec type — never let the UI's normalized type overwrite it.
+        const originalType = target.type;
         mergeObjects(target, payload);
+        target.type = originalType;
     }
     return target;
 };
 const updateSecuritySchemeSecrets = (store, document, { payload, name, overwrite = false }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
@@ -162,10 +197,7 @@ const updateSecuritySchemeSecrets = (store, document, { payload, name, overwrite
     store?.auth.setAuthSecrets(documentName, name, result);
 };
 const clearSecuritySchemeSecrets = (store, document, { name }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
@@ -198,16 +230,15 @@ const clearSecuritySchemeSecrets = (store, document, { name }) => {
  * });
  */
 export const updateSelectedAuthTab = (store, document, { index, meta }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
-    // Ensure the path/method exists in the document
-    if (meta.type === 'operation' && getPathItemOperation(document.paths?.[meta.path], meta.method) === undefined) {
-        return;
+    // Operation-level auth only applies to OpenAPI documents; ensure the path/method exists.
+    if (meta.type === 'operation') {
+        if (!isOpenApiDocument(document) || getPathItemOperation(document.paths?.[meta.path], meta.method) === undefined) {
+            return;
+        }
     }
     // Determine the target object for setting the auth tab index:
     // - Document/root level
@@ -276,10 +307,7 @@ const securityRequirementIdsMatch = (requirement, id) => {
  * ```
  */
 export const updateSelectedScopes = (store, document, { id, name, scopes, meta }) => {
-    if (!isOpenApiDocument(document)) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
+    const documentName = getAuthDocumentName(document);
     if (!documentName) {
         return;
     }
@@ -296,7 +324,7 @@ export const updateSelectedScopes = (store, document, { id, name, scopes, meta }
     // supplied (derived from `id`), which makes `getSelectedSecurity` build the requirement
     // from that scheme alone and never read the requirements array.
     const target = getTarget() ??
-        getSelectedSecurity(undefined, undefined, [], (document.components?.securitySchemes ?? {}), id.length === 1 ? id[0] : id);
+        getSelectedSecurity(undefined, undefined, [], getDocumentSecuritySchemes(document), id.length === 1 ? id[0] : id);
     const nextSelectedSchemes = unpackProxyObject(target.selectedSchemes, { depth: 1 }) ?? [];
     // Match the security requirement by scheme key names (order-insensitive: Object.keys order
     // can differ between the store copy and the UI payload for the same requirement object).
@@ -314,17 +342,15 @@ export const updateSelectedScopes = (store, document, { id, name, scopes, meta }
  * Returns `null` when the scheme or flow cannot be found, or the scheme is not an OAuth2 / OpenID Connect scheme.
  */
 const resolveOAuthFlow = (document, name, flowType) => {
-    if (!isOpenApiDocument(document)) {
-        return null;
-    }
-    const securityScheme = getResolvedRef(document.components?.securitySchemes?.[name]);
+    const securityScheme = getResolvedRef(getDocumentSecuritySchemes(document)[name]);
     if (!securityScheme) {
         return null;
     }
     if (securityScheme.type !== 'oauth2' && securityScheme.type !== 'openIdConnect') {
         return null;
     }
-    return securityScheme.flows?.[flowType] ?? null;
+    const flow = securityScheme.flows?.[flowType];
+    return flow ? getResolvedRef(flow) : null;
 };
 /**
  * Walks every selection container that lives under a document (the document-level
@@ -333,11 +359,8 @@ const resolveOAuthFlow = (document, name, flowType) => {
  * `setAuthSelectedSchemas` so persistence hooks run.
  */
 const walkSelectedSchemes = (store, document, transform) => {
-    if (!isOpenApiDocument(document) || !store) {
-        return;
-    }
-    const documentName = document['x-scalar-navigation']?.name;
-    if (!documentName) {
+    const documentName = getAuthDocumentName(document);
+    if (!store || !documentName) {
         return;
     }
     const apply = (payload) => {
@@ -353,11 +376,14 @@ const walkSelectedSchemes = (store, document, transform) => {
         });
     };
     apply({ type: 'document', documentName });
-    Object.entries(document.paths ?? {}).forEach(([path, pathItemRef]) => {
-        forEachPathItemOperation(pathItemRef, (method) => {
-            apply({ type: 'operation', documentName, path, method });
+    // Operation-level selections only exist for OpenAPI documents (path / method).
+    if (isOpenApiDocument(document)) {
+        Object.entries(document.paths ?? {}).forEach(([path, pathItemRef]) => {
+            forEachPathItemOperation(pathItemRef, (method) => {
+                apply({ type: 'operation', documentName, path, method });
+            });
         });
-    });
+    }
 };
 /**
  * Adds a new scope to an OAuth flow, or renames / updates the description of an existing one.
@@ -371,23 +397,27 @@ const walkSelectedSchemes = (store, document, transform) => {
  * flow without a separate selection mutation.
  */
 export const upsertScope = (store, document, { name, flowType, scope, description, oldScope, enable }) => {
-    if (!isOpenApiDocument(document)) {
+    if (!isOpenApiDocument(document) && !isAsyncApiDocument(document)) {
         return;
     }
     const flow = resolveOAuthFlow(document, name, flowType);
     if (!flow) {
         return;
     }
-    flow.scopes ||= {};
+    const scopeKey = getFlowScopeKey(document);
+    if (!flow[scopeKey]) {
+        flow[scopeKey] = {};
+    }
+    const scopes = flow[scopeKey];
     const isRename = Boolean(oldScope) && oldScope !== scope;
     // Rename: drop the previous key so iteration order stays predictable.
     if (isRename) {
-        if (!(oldScope in flow.scopes)) {
+        if (!(oldScope in scopes)) {
             return;
         }
-        delete flow.scopes[oldScope];
+        delete scopes[oldScope];
     }
-    flow.scopes[scope] = description;
+    scopes[scope] = description;
     if (!isRename && !enable) {
         return;
     }
@@ -421,14 +451,15 @@ export const upsertScope = (store, document, { name, flowType, scope, descriptio
  * the matching security scheme.
  */
 export const deleteScope = (store, document, { name, flowType, scope }) => {
-    if (!isOpenApiDocument(document)) {
+    if (!isOpenApiDocument(document) && !isAsyncApiDocument(document)) {
         return;
     }
     const flow = resolveOAuthFlow(document, name, flowType);
-    if (!flow?.scopes) {
+    const scopes = flow?.[getFlowScopeKey(document)];
+    if (!scopes) {
         return;
     }
-    delete flow.scopes[scope];
+    delete scopes[scope];
     walkSelectedSchemes(store, document, (selectedSchemes) => {
         selectedSchemes.forEach((requirement) => {
             if (!isNonOptionalSecurityRequirement(requirement)) {

package/dist/mutators/index.d.ts

@@ -66,7 +66,7 @@ export declare function generateClientMutators(store: WorkspaceStore | null): {
         auth: {
             updateSelectedSecuritySchemes: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:selected-security-schemes"]) => Promise<void>;
             clearSelectedSecuritySchemes: (payload: import("../events/definitions/auth.js").AuthEvents["auth:clear:selected-security-schemes"]) => void;
-            updateSecurityScheme: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").ApiKeyObject | import("../schemas/v3.1/strict/security-scheme.js").HttpObject | import("../schemas/v3.1/strict/security-scheme.js").OAuth2Object | import("../schemas/v3.1/strict/security-scheme.js").OpenIdConnectObject | undefined;
+            updateSecurityScheme: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").SecuritySchemeObject | undefined;
             updateSecuritySchemeSecrets: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme-secrets"]) => void;
             clearSecuritySchemeSecrets: (payload: import("../events/definitions/auth.js").AuthEvents["auth:clear:security-scheme-secrets"]) => void;
             updateSelectedAuthTab: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:active-index"]) => void;
@@ -157,7 +157,7 @@ export declare function generateClientMutators(store: WorkspaceStore | null): {
         auth: {
             updateSelectedSecuritySchemes: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:selected-security-schemes"]) => Promise<void>;
             clearSelectedSecuritySchemes: (payload: import("../events/definitions/auth.js").AuthEvents["auth:clear:selected-security-schemes"]) => void;
-            updateSecurityScheme: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").ApiKeyObject | import("../schemas/v3.1/strict/security-scheme.js").HttpObject | import("../schemas/v3.1/strict/security-scheme.js").OAuth2Object | import("../schemas/v3.1/strict/security-scheme.js").OpenIdConnectObject | undefined;
+            updateSecurityScheme: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme"]) => import("../schemas/v3.1/strict/security-scheme.js").SecuritySchemeObject | undefined;
             updateSecuritySchemeSecrets: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:security-scheme-secrets"]) => void;
             clearSecuritySchemeSecrets: (payload: import("../events/definitions/auth.js").AuthEvents["auth:clear:security-scheme-secrets"]) => void;
             updateSelectedAuthTab: (payload: import("../events/definitions/auth.js").AuthEvents["auth:update:active-index"]) => void;

package/dist/request-example/context/security/merge-security.d.ts

@@ -1,9 +1,17 @@
 import type { AuthenticationConfiguration } from '@scalar/types/api-reference';
+import type { AsyncApiComponentsObject } from '@scalar/types/asyncapi/3.1';
 import type { AuthStore } from '@scalar/workspace-store/entities/auth';
 import { type ComponentsObject } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
 import type { SecuritySchemeObjectSecret } from '../../../request-example/builder/security/secret-types.js';
 /** Document security merged with the config security schemes */
 export type MergedSecuritySchemes = Record<string, SecuritySchemeObjectSecret>;
-/** Merge the authentication config with the document security schemes + the auth store secrets */
-export declare const mergeSecurity: (documentSecuritySchemes: ComponentsObject["securitySchemes"], configSecuritySchemes: AuthenticationConfiguration["securitySchemes"], authStore: AuthStore, documentName: string, oauth2RedirectUri?: string) => MergedSecuritySchemes;
+/**
+ * Merge the authentication config with the document security schemes + the auth store secrets.
+ *
+ * AsyncAPI keeps its security schemes in the same `components.securitySchemes` slot and shares the
+ * `http`/`apiKey`/`oauth2`/`openIdConnect` shapes with OpenAPI, so we accept either spec's schemes
+ * here. Every value is coerced into the OpenAPI `SecuritySchemeObject` shape below, so broker-specific
+ * AsyncAPI types still flow through and degrade gracefully downstream.
+ */
+export declare const mergeSecurity: (documentSecuritySchemes: ComponentsObject["securitySchemes"] | NonNullable<AsyncApiComponentsObject["securitySchemes"]>, configSecuritySchemes: AuthenticationConfiguration["securitySchemes"], authStore: AuthStore, documentName: string, oauth2RedirectUri?: string) => MergedSecuritySchemes;
 //# sourceMappingURL=merge-security.d.ts.map

package/dist/request-example/context/security/merge-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAErE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AAE9E,kGAAkG;AAClG,eAAO,MAAM,aAAa,GACxB,yBAAyB,gBAAgB,CAAC,iBAAiB,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBA2BF,CAAA"}
+{"version":3,"file":"merge-security.d.ts","sourceRoot":"","sources":["../../../../src/request-example/context/security/merge-security.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAA;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAgC,MAAM,4BAA4B,CAAA;AACxG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uCAAuC,CAAA;AAKtE,OAAO,EACL,KAAK,gBAAgB,EAGtB,MAAM,8DAA8D,CAAA;AAErE,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAIjG,gEAAgE;AAChE,MAAM,MAAM,qBAAqB,GAAG,MAAM,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAA;AAqE9E;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,GACxB,yBACI,gBAAgB,CAAC,iBAAiB,CAAC,GACnC,WAAW,CAAC,wBAAwB,CAAC,iBAAiB,CAAC,CAAM,EACjE,uBAAuB,2BAA2B,CAAC,iBAAiB,CAAM,EAC1E,WAAW,SAAS,EACpB,cAAc,MAAM,EACpB,oBAAoB,MAAM,KACzB,qBAmCF,CAAA"}

package/dist/request-example/context/security/merge-security.js

@@ -5,7 +5,68 @@ import { mergeObjects } from '@scalar/workspace-store/helpers/merge-object';
 import { coerceValue } from '@scalar/workspace-store/schemas/typebox-coerce';
 import { SecuritySchemeObjectSchema, } from '@scalar/workspace-store/schemas/v3.1/strict/openapi-document';
 import { extractSecuritySchemeSecrets } from './extract-security-scheme-secrets.js';
-/** Merge the authentication config with the document security schemes + the auth store secrets */
+const hasAvailableScopes = (flow) => {
+    const resolved = getResolvedRef(flow);
+    return Boolean(resolved) && typeof resolved === 'object' && 'availableScopes' in resolved;
+};
+/**
+ * Rename each AsyncAPI OAuth2 flow's `availableScopes` map onto OpenAPI's `scopes`.
+ *
+ * AsyncAPI and OpenAPI use the same scope-name → description map, but under different keys. The
+ * auth UI reads `flow.scopes`, so without this rename an AsyncAPI OAuth2 scheme would render with
+ * no selectable scopes. Flows that already use `scopes` (OpenAPI) are returned untouched, so this
+ * is a no-op for OpenAPI schemes.
+ */
+const normalizeAsyncApiOAuthFlows = (flows) => {
+    const resolvedFlows = getResolvedRef(flows);
+    if (!resolvedFlows || typeof resolvedFlows !== 'object') {
+        return flows;
+    }
+    const entries = Object.entries(resolvedFlows);
+    if (!entries.some(([, flowValue]) => hasAvailableScopes(flowValue))) {
+        return flows;
+    }
+    return Object.fromEntries(entries.map(([flowKey, flowValue]) => {
+        if (!hasAvailableScopes(flowValue)) {
+            return [flowKey, flowValue];
+        }
+        // Prefer an OpenAPI-native `scopes` map if one is somehow already present, so we never drop it.
+        const { availableScopes, scopes: existingScopes, ...rest } = getResolvedRef(flowValue);
+        return [flowKey, { ...rest, scopes: existingScopes ?? availableScopes ?? {} }];
+    }));
+};
+/**
+ * Map AsyncAPI-only security scheme shapes onto their OpenAPI equivalents where one exists.
+ *
+ * AsyncAPI's `httpApiKey` (a named key in `query`/`header`/`cookie`) is structurally identical to
+ * OpenAPI's `apiKey`, so we rename the type and let the shared apiKey path handle rendering and
+ * request injection. AsyncAPI OAuth2 flows carry their scope map under `availableScopes`, which we
+ * rename to OpenAPI's `scopes`. Everything else is returned unchanged — including AsyncAPI's own
+ * `apiKey` (`in: user | password`, no name), which has no OpenAPI counterpart and is value-only.
+ */
+const normalizeAsyncApiSecurityScheme = (scheme) => {
+    if (!(scheme && typeof scheme === 'object' && 'type' in scheme)) {
+        return scheme;
+    }
+    if (scheme.type === 'httpApiKey') {
+        return { ...scheme, type: 'apiKey' };
+    }
+    if (scheme.type === 'oauth2' && 'flows' in scheme && scheme.flows) {
+        const normalizedFlows = normalizeAsyncApiOAuthFlows(scheme.flows);
+        if (normalizedFlows !== scheme.flows) {
+            return { ...scheme, flows: normalizedFlows };
+        }
+    }
+    return scheme;
+};
+/**
+ * Merge the authentication config with the document security schemes + the auth store secrets.
+ *
+ * AsyncAPI keeps its security schemes in the same `components.securitySchemes` slot and shares the
+ * `http`/`apiKey`/`oauth2`/`openIdConnect` shapes with OpenAPI, so we accept either spec's schemes
+ * here. Every value is coerced into the OpenAPI `SecuritySchemeObject` shape below, so broker-specific
+ * AsyncAPI types still flow through and degrade gracefully downstream.
+ */
 export const mergeSecurity = (documentSecuritySchemes = {}, configSecuritySchemes = {}, authStore, documentName, oauth2RedirectUri) => {
     /** Resolve any refs in the document security schemes */
     const resolvedDocumentSecuritySchemes = objectEntries(documentSecuritySchemes).reduce((acc, [key, value]) => {
@@ -19,10 +80,15 @@ export const mergeSecurity = (documentSecuritySchemes = {}, configSecurityScheme
     const mergedSchemes = mergeObjects(resolvedDocumentSecuritySchemes, configSecuritySchemes) ?? {};
     /** Convert the config secrets to the new secret extensions */
     return objectEntries(mergedSchemes).reduce((acc, [name, value]) => {
+        // Fold AsyncAPI-only types (e.g. `httpApiKey`) onto their OpenAPI equivalents before coercing,
+        // so the downstream apiKey/http/oauth2 machinery recognises them instead of rejecting the type.
+        const scheme = normalizeAsyncApiSecurityScheme(value);
         // We coerce in case the scheme is missing any key fields like type
-        const coerced = coerceValue(SecuritySchemeObjectSchema, value);
+        const coerced = coerceValue(SecuritySchemeObjectSchema, scheme);
         // We then overwrite it back with the original value to keep any other fields like description, etc.
-        const merged = { ...coerced, ...value };
+        // `coerced` has already laundered the value into the OpenAPI shape (including any AsyncAPI scheme),
+        // so we narrow here to restore the extra fields without re-widening the type.
+        const merged = { ...coerced, ...scheme };
         acc[name] = extractSecuritySchemeSecrets(merged, authStore, name, documentName, oauth2RedirectUri);
         return acc;
     }, {});

package/dist/schemas/type-guards.d.ts

@@ -21,4 +21,11 @@ export declare const isAsyncApiDocument: (value: unknown) => value is AsyncApiDo
  * document shapes, or `undefined` when it matches neither.
  */
 export declare const getDocumentType: (value: unknown) => "openapi" | "asyncapi" | undefined;
+/**
+ * Human-readable label for a document type, e.g. for badges and warnings.
+ *
+ * Defaults to `'OpenAPI'` when the type is unknown, matching the OpenAPI-native surfaces that
+ * only distinguish AsyncAPI as the exception.
+ */
+export declare const getDocumentTypeLabel: (documentType: "openapi" | "asyncapi" | undefined) => string;
 //# sourceMappingURL=type-guards.d.ts.map

package/dist/schemas/type-guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-guards.d.ts","sourceRoot":"","sources":["../../src/schemas/type-guards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAElE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eACgB,CAAA;AAE5E;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBACiB,CAAA;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,SAAS,GAAG,UAAU,GAAG,SAUzE,CAAA"}
+{"version":3,"file":"type-guards.d.ts","sourceRoot":"","sources":["../../src/schemas/type-guards.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAA;AAElE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAErE;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,eACgB,CAAA;AAE5E;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,gBACiB,CAAA;AAE9E;;;;;GAKG;AACH,eAAO,MAAM,eAAe,GAAI,OAAO,OAAO,KAAG,SAAS,GAAG,UAAU,GAAG,SAUzE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,GAAI,cAAc,SAAS,GAAG,UAAU,GAAG,SAAS,KAAG,MAClC,CAAA"}

package/dist/schemas/type-guards.js

@@ -28,3 +28,10 @@ export const getDocumentType = (value) => {
     }
     return undefined;
 };
+/**
+ * Human-readable label for a document type, e.g. for badges and warnings.
+ *
+ * Defaults to `'OpenAPI'` when the type is unknown, matching the OpenAPI-native surfaces that
+ * only distinguish AsyncAPI as the exception.
+ */
+export const getDocumentTypeLabel = (documentType) => documentType === 'asyncapi' ? 'AsyncAPI' : 'OpenAPI';

package/package.json

@@ -16,7 +16,7 @@
     "openapi",
     "scalar"
   ],
-  "version": "0.55.3",
+  "version": "0.55.5",
   "engines": {
     "node": ">=22"
   },
@@ -148,14 +148,14 @@
     "type-fest": "^5.3.1",
     "vue": "^3.5.30",
     "yaml": "^2.8.3",
-    "@scalar/helpers": "0.9.0",
-    "@scalar/asyncapi-upgrader": "0.1.2",
-    "@scalar/json-magic": "0.12.17",
-    "@scalar/openapi-upgrader": "0.2.9",
-    "@scalar/schemas": "0.7.2",
-    "@scalar/types": "0.16.2",
-    "@scalar/snippetz": "0.9.21",
-    "@scalar/validation": "0.6.0"
+    "@scalar/asyncapi-upgrader": "0.1.3",
+    "@scalar/helpers": "0.9.1",
+    "@scalar/json-magic": "0.12.18",
+    "@scalar/schemas": "0.7.3",
+    "@scalar/openapi-upgrader": "0.2.10",
+    "@scalar/types": "0.16.3",
+    "@scalar/validation": "0.6.1",
+    "@scalar/snippetz": "0.9.22"
   },
   "devDependencies": {
     "@google-cloud/storage": "7.16.0",