@redocly/realm 0.136.0-next.0 → 0.136.0-next.10

package/dist/server/web-server/routes/mcp-routes/mcp-oauth.js

@@ -1 +1 @@
-import{getCookie as C}from"hono/cookie";import{createHash as U,timingSafeEqual as R}from"node:crypto";import{ulid as v}from"ulid";import{AUTH_URL as f,JWT_SECRET_KEY as M}from"../../../constants/common.js";import{ServerRoutes as _}from"../../../../constants/api.js";import{AuthCookieNames as T}from"../../../../constants/common.js";import{withPathPrefix as u}from"@redocly/theme/core/utils";import{telemetry as m}from"../../../telemetry/index.js";import{envConfig as A}from"../../../config/env-config.js";import{createMcpAuthorizationCode as O,verifyMcpAuthorizationCode as D,createMcpSessionResource as h}from"../../auth.js";import*as g from"../../jwt/jwt.js";import{AlgorithmTypes as S}from"../../jwt/types.js";import{getRequestOrigin as y}from"../../utils/get-request-origin.js";import{fetchClientMetadataDocument as L,isClientMetadataDocumentUrl as k,isRedirectUriRegistered as H}from"./mcp-client-metadata.js";const o=(e,r,n=200,a)=>e.json(r,n,{"Content-Type":"application/json",...a??{}}),I=new Set(["S256"]),q="https://claude.ai/oauth/claude-code-client-metadata";function z(e,r,n){if(!I.has(r||""))return!1;const a=U("sha256").update(n).digest("base64url"),t=Buffer.from(a),s=Buffer.from(e);return t.length!==s.length?!1:R(t,s)}async function $(e){const r=Math.floor(Date.now()/1e3);return g.sign({type:"mcp_context",...e,iat:r,exp:r+600},M,S.HS256)}async function N(e){await g.verify(e,M,S.HS256);const{payload:r}=g.decode(e);if(r.type!=="mcp_context")throw new Error("Invalid context token type");return r}function x(){return async e=>{if(e.req.method!=="GET")return o(e,{error:"Method not allowed"},405,{Allow:"GET"});const r=y(e);return o(e,{resource:`${r}${u("/mcp")}`,authorization_servers:[r,f].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${r}${_.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:["openid","profile","email","offline_access"],bearer_token_types_supported:["Bearer"]})}}function ee(){return async e=>{const r=y(e);return o(e,{issuer:f||"",authorization_endpoint:`${r}${u(_.MCP_AUTHORIZATION)}`,token_endpoint:`${r}${u(_.MCP_TOKEN_PORTAL)}`,jwks_uri:`${f||""}/.well-known/jwks.json`,scopes_supported:["openid","profile","email","offline_access"],registration_endpoint:`${r}${u(_.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token","client_credentials"],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function re(){return async e=>{if(e.req.method!=="POST")return o(e,{error:"Method not allowed"},405);try{return o(e,{client_id:A.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:["authorization_code","refresh_token"],response_types:["code"],scope:"openid offline email",subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(r){return o(e,{error:"invalid_request",error_description:r?.message||"Unable to register client"},500)}}}function te(){return async e=>{const r=new URL(e.req.url),{searchParams:n}=r,a=n.get("redirect_uri"),t=n.get("client_id"),s=n.get("code_challenge"),i=n.get("code_challenge_method"),d=v();if(s&&!I.has(i||""))return o(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...I].join(", ")}`},400);if(k(t)&&!s)return o(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(k(t)&&a)try{const c=await L(t),l=t===q;if(!H(a,c.redirect_uris,{ignorePort:l}))return o(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(c){const l=c instanceof Error?c.message:String(c);return o(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${l}`},400)}m.sendMcpAuthorizationStartedMessage([{...h(d),redirect_uri:a||null}]);const p=y(e),w={isMcpFlow:!0,originalRedirectUri:a,mcpClientId:t,mcpState:n.get("state"),mcpSessionId:d,mcpCodeChallenge:s,mcpCodeChallengeMethod:s?i:null,timestamp:Date.now()};try{const c=await $(w),l=new URL(u(_.IDP_LOGIN),p);return l.searchParams.set("redirectTo",`${_.MCP_CALLBACK}/${c}`),l.searchParams.set("idpId","oidc"),e.redirect(l.toString())}catch(c){const l=c instanceof Error?c.message:String(c),P=c instanceof Error?c.stack:String(c);m.sendMcpAuthorizationFailedMessage([{...h(d),error:l,error_details:P}]);const E=new URL(u(`${f}/oauth2/auth`));return E.search=n.toString(),e.redirect(E.toString())}}}function oe(){return async e=>{if(e.req.method!=="POST")return o(e,{error:"Method not allowed"},405);try{const r=await e.req.formData(),n=r.get("grant_type"),a=r.get("code"),t=r.get("redirect_uri")||void 0,s=r.get("code_verifier")||void 0;if(n!=="authorization_code"||!a)return o(e,{error:"invalid_request",error_description:"Invalid grant type or missing authorization code"},400);try{const i=await D(a);if(t&&t!==i.redirect_uri)return o(e,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(i.code_challenge){if(!s)return o(e,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!z(i.code_challenge,i.code_challenge_method,s))return o(e,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(A.OAUTH_CLIENT_ID&&i.client_id&&!k(i.client_id)&&i.client_id!==A.OAUTH_CLIENT_ID)return o(e,{error:"invalid_client",error_description:"Client mismatch"},400);const d=i.id_token;if(typeof d!="string"||d.length===0)return o(e,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);let p=d;if(i.idp_access_token){const{payload:c,header:{kid:l}}=g.decode(d);p=await g.sign({...c,idp_access_token:i.idp_access_token},M,S.HS256,l)}return o(e,{access_token:p,token_type:"Bearer",expires_in:3600,scope:"openid profile email",id_token:d},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch{return o(e,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(r){const n=r instanceof Error?r.message:String(r);return o(e,{error:"server_error",error_description:"Failed to process token request",error_details:n},500)}}}function ne(){return async e=>{const r=new URL(e.req.url);let n=r.searchParams.get("context");if(!n&&r.pathname.startsWith(u(`${_.MCP_CALLBACK}/`))){const t=r.pathname.split("/");n=t[t.length-1]}if(!n)return m.sendMcpAuthorizationFailedMessage([{...h(null),error:"Missing context parameter",error_details:null}]),e.text("Missing context parameter",400);let a=null;try{const t=await N(n);if(a=t.mcpSessionId||null,!t.isMcpFlow||!t.originalRedirectUri)throw new Error("Invalid MCP context");const s=C(e,T.IDP_ID_TOKEN)||C(e,T.AUTHORIZATION),i=C(e,T.IDP_ACCESS_TOKEN);if(!s)return m.sendMcpAuthorizationFailedMessage([{...h(a),error:"Authentication required",error_details:null}]),e.text("Authentication required",401);const d=await O({idToken:s,idpAccessToken:i||void 0,clientId:t.mcpClientId||"",redirectUri:t.originalRedirectUri,codeChallenge:t.mcpCodeChallenge||void 0,codeChallengeMethod:t.mcpCodeChallengeMethod||void 0,ttlSec:600}),p=new URL(t.originalRedirectUri);return p.searchParams.set("code",d),t.mcpState&&p.searchParams.set("state",t.mcpState),m.sendMcpAuthorizationCompletedMessage([{...h(a),redirect_uri:t.originalRedirectUri||null}]),e.redirect(p.toString())}catch(t){const s=t instanceof Error?t.message:String(t),i=t instanceof Error?t.stack:String(t);return m.sendMcpAuthorizationFailedMessage([{...h(a),error:s,error_details:i}]),e.text(`Invalid MCP callback: ${s}`,400)}}}export{$ as createMcpContextToken,te as mcpAuthorizationHandler,ne as mcpCallbackHandler,re as mcpDynamicClientRegistrationHandler,ee as mcpOAuthAuthorizationServerHandler,x as mcpOAuthProtectedResourceHandler,oe as mcpTokenPortalHandler,N as verifyAndParseMcpContextToken,z as verifyPkce};
+import{getCookie as A}from"hono/cookie";import{createHash as J,timingSafeEqual as V}from"node:crypto";import{ulid as Y}from"ulid";import{isMcpContentProtected as P}from"../../../plugins/mcp/auth/auth-handlers.js";import{isRedoclySso as Z,isOidcProviderConfig as v}from"../../auth.js";import{AUTH_URL as R,JWT_SECRET_KEY as m,MCP_ACCESS_TOKEN_TTL_SEC as b,MCP_REFRESH_SESSION_LIFETIME_SEC as W}from"../../../constants/common.js";import{ServerRoutes as T}from"../../../../constants/api.js";import{AuthCookieNames as U}from"../../../../constants/common.js";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{telemetry as M}from"../../../telemetry/index.js";import{envConfig as D}from"../../../config/env-config.js";import{createMcpAuthorizationCode as x,verifyMcpAuthorizationCode as Q,createMcpRefreshToken as z,verifyMcpRefreshToken as X,createMcpSessionResource as y,oidcJwksCache as F,oidcRefreshTokenGrant as ee,getOidcMetadata as re,discoverJwks as te}from"../../auth.js";import*as S from"../../jwt/jwt.js";import{AlgorithmTypes as q}from"../../jwt/types.js";import{getRequestOrigin as L}from"../../utils/get-request-origin.js";import{encryptClaimValue as H}from"../../../utils/crypto/encrypt-claim-value.js";import{decryptAesGcm as ne}from"../../../utils/crypto/decrypt-aes-gcm.js";import{encryptAesGcm as G}from"../../../utils/crypto/encrypt-aes-gcm.js";import{fetchClientMetadataDocument as oe,isClientMetadataDocumentUrl as N,isRedirectUriRegistered as ie}from"./mcp-client-metadata.js";const s=(r,e,n=200,i)=>r.json(e,n,{"Content-Type":"application/json",...i??{}}),j=new Set(["S256"]),$=["authorization_code","refresh_token"],E=["openid","profile","email","offline_access"],se="https://claude.ai/oauth/claude-code-client-metadata";function ce(r,e,n){if(!j.has(e||""))return!1;const i=J("sha256").update(n).digest("base64url"),c=Buffer.from(i),o=Buffer.from(r);return c.length!==o.length?!1:V(c,o)}async function de(r){const e=Math.floor(Date.now()/1e3);return S.sign({type:"mcp_context",...r,iat:e,exp:e+600},m,q.HS256)}async function ae(r){await S.verify(r,m,q.HS256);const{payload:e}=S.decode(r);if(e.type!=="mcp_context")throw new Error("Invalid context token type");return e}function Re(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="GET")return s(e,{error:"Method not allowed"},405,{Allow:"GET"});const n=L(e);return s(e,{resource:`${n}${I("/mcp")}`,authorization_servers:[n,R].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${n}${T.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:[...E],bearer_token_types_supported:["Bearer"]})}}function Ue(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=L(e);return s(e,{issuer:R||"",authorization_endpoint:`${n}${I(T.MCP_AUTHORIZATION)}`,token_endpoint:`${n}${I(T.MCP_TOKEN_PORTAL)}`,jwks_uri:`${R||""}/.well-known/jwks.json`,scopes_supported:[...E],registration_endpoint:`${n}${I(T.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:[...$],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function Oe(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{return s(e,{client_id:D.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:[...$],response_types:["code"],scope:E.join(" "),subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(n){return s(e,{error:"invalid_request",error_description:n?.message||"Unable to register client"},500)}}}function B(r){const e=r||{},n=Object.keys(e),i=n.find(o=>v(e[o])&&Z(e[o])),c=n.find(o=>v(e[o]));return i||c||n[0]}function De(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=new URL(e.req.url),{searchParams:i}=n,c=i.get("redirect_uri"),o=i.get("client_id"),a=i.get("code_challenge"),t=i.get("code_challenge_method"),p=Y();if(a&&!j.has(t||""))return s(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...j].join(", ")}`},400);if(N(o)&&!a)return s(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(N(o)&&c)try{const d=await oe(o),l=o===se;if(!ie(c,d.redirect_uris,{ignorePort:l}))return s(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(d){const l=d instanceof Error?d.message:String(d);return s(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${l}`},400)}M.sendMcpAuthorizationStartedMessage([{...y(p),redirect_uri:c||null}]);const f=L(e),_={isMcpFlow:!0,originalRedirectUri:c,mcpClientId:o,mcpState:i.get("state"),mcpSessionId:p,mcpCodeChallenge:a,mcpCodeChallengeMethod:a?t:null,timestamp:Date.now()};try{const d=await de(_),l=new URL(I(T.IDP_LOGIN),f);l.searchParams.set("redirectTo",`${T.MCP_CALLBACK}/${d}`);const k=B(r.getConfig().ssoDirect);return k?(l.searchParams.set("idpId",k),e.redirect(l.toString())):s(e,{error:"not_found"},404)}catch(d){const l=d instanceof Error?d.message:String(d),k=d instanceof Error?d.stack:String(d);M.sendMcpAuthorizationFailedMessage([{...y(p),error:l,error_details:k}]);const C=new URL(I(`${R}/oauth2/auth`));return C.search=i.toString(),e.redirect(C.toString())}}}async function K(r){const e=Math.floor(Date.now()/1e3),n=await S.sign({...r.claims,...r.idpId?{idpId:r.idpId}:{},...r.idpAccessTokenEnc?{idp_access_token:r.idpAccessTokenEnc}:{},...r.ttlSec?{iat:e,exp:e+r.ttlSec}:{}},m,q.HS256,r.kid),i=r.ttlSec??(typeof r.claims.exp=="number"?Math.max(r.claims.exp-e,0):b);return{accessToken:n,expiresIn:i}}async function pe(r,e,n){const i=g=>s(r,{error:"invalid_grant",error_description:g},400),c=r.get("logger"),o=n.get("refresh_token"),a=n.get("client_id")||void 0;if(!o)return s(r,{error:"invalid_request",error_description:"refresh_token is required"},400);let t;try{t=await X(o)}catch(g){return c?.warn("MCP refresh token rejected: %s",g instanceof Error?g.message:String(g)),i("Invalid refresh token")}if(a&&a!==t.client_id)return i("Client mismatch");const p=t.idp_id?e.getConfig().ssoDirect?.[t.idp_id]:void 0;let f,_,d=t.idp_access_token_enc,l=t.idp_refresh_token_enc;if(t.idp_refresh_token_enc){let g;try{g=ne(t.idp_refresh_token_enc,m)}catch{return i("Invalid refresh token")}if(!t.idp_id||!v(p))return i("Unknown identity provider");let u;try{const h=await re(t.idp_id,p);if(!h?.token_endpoint)return i("Identity provider has no token endpoint");u=await ee(h.token_endpoint,g,p)}catch(h){return c?.warn("MCP refresh failed to reach the IdP token endpoint: %s",h instanceof Error?h.message:String(h)),s(r,{error:"server_error",error_description:"Failed to refresh session"},500)}if(u.error||!(u.id_token||u.access_token))return c?.warn("MCP refresh rejected by IdP: %s",u.error||"empty token response"),i("Refresh rejected by identity provider");if(u.refresh_token&&(l=G(u.refresh_token,m)),u.access_token&&(d=H(u.access_token,m)),u.id_token)try{const h=S.decode(u.id_token);f=h.payload,_=h.header.kid}catch{return i("Invalid token response from identity provider")}}const k=v(p)&&p.tokenExpirationTime||b,C=f??t.claims,w=await K({claims:C,kid:_,idpId:t.idp_id,idpAccessTokenEnc:d,ttlSec:f?void 0:k}),O=await z({clientId:t.client_id,idpId:t.idp_id,claims:C,idpAccessTokenEnc:d,idpRefreshTokenEnc:l,sessionExp:t.session_exp});return s(r,{access_token:w.accessToken,token_type:"Bearer",expires_in:w.expiresIn,refresh_token:O,scope:E.join(" ")},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}function qe(r){return async e=>{if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{const n=await e.req.formData(),i=n.get("grant_type"),c=n.get("code"),o=n.get("redirect_uri")||void 0,a=n.get("code_verifier")||void 0;if(!$.includes(i))return s(e,{error:"invalid_request",error_description:"Invalid grant type"},400);if(i==="refresh_token")return await pe(e,r,n);if(!c)return s(e,{error:"invalid_request",error_description:"Missing authorization code"},400);try{const t=await Q(c);if(o&&o!==t.redirect_uri)return s(e,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(t.code_challenge){if(!a)return s(e,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!ce(t.code_challenge,t.code_challenge_method,a))return s(e,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(D.OAUTH_CLIENT_ID&&t.client_id&&!N(t.client_id)&&t.client_id!==D.OAUTH_CLIENT_ID)return s(e,{error:"invalid_client",error_description:"Client mismatch"},400);const p=t.id_token;if(typeof p!="string"||p.length===0)return s(e,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);const f=t.idp_access_token_enc??(t.idp_access_token?H(t.idp_access_token,m):void 0),_=S.decode(p),{accessToken:d,expiresIn:l}=await K({claims:_.payload,kid:_.header.kid,idpId:t.idp_id,idpAccessTokenEnc:f}),C=Math.floor(Date.now()/1e3)+W,w=await z({clientId:t.client_id,idpId:t.idp_id,claims:_.payload,idpAccessTokenEnc:f,idpRefreshTokenEnc:t.idp_refresh_token_enc,sessionExp:C}),O={access_token:d,token_type:"Bearer",expires_in:l,refresh_token:w,scope:E.join(" "),id_token:p};return s(e,O,200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch(t){return e.get("logger")?.warn("MCP token exchange failed: %s",t instanceof Error?t.message:String(t)),s(e,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(n){const i=n instanceof Error?n.message:String(n);return s(e,{error:"server_error",error_description:"Failed to process token request",error_details:i},500)}}}async function le(r,e){try{const{payload:n,header:i}=S.decode(r);if(typeof n.idpId=="string"&&n.idpId)return n.idpId;if(i.kid){F.jwks[i.kid]==null&&await te(e||{});const c=F.jwks[i.kid];if(c?.idpId)return c.idpId}}catch{}return B(e)}function Le(r){return async e=>{const n=new URL(e.req.url);let i=n.searchParams.get("context");if(!i&&n.pathname.startsWith(I(`${T.MCP_CALLBACK}/`))){const o=n.pathname.split("/");i=o[o.length-1]}if(!i)return M.sendMcpAuthorizationFailedMessage([{...y(null),error:"Missing context parameter",error_details:null}]),e.text("Missing context parameter",400);let c=null;try{const o=await ae(i);if(c=o.mcpSessionId||null,!o.isMcpFlow||!o.originalRedirectUri)throw new Error("Invalid MCP context");const a=A(e,U.IDP_ID_TOKEN)||A(e,U.AUTHORIZATION),t=A(e,U.IDP_ACCESS_TOKEN),p=A(e,U.IDP_REFRESH_TOKEN);if(!a)return M.sendMcpAuthorizationFailedMessage([{...y(c),error:"Authentication required",error_details:null}]),e.text("Authentication required",401);const f=await x({idToken:a,idpId:await le(a,r.getConfig().ssoDirect),idpAccessTokenEnc:t?H(t,m):void 0,idpRefreshTokenEnc:p?G(p,m):void 0,clientId:o.mcpClientId||"",redirectUri:o.originalRedirectUri,codeChallenge:o.mcpCodeChallenge||void 0,codeChallengeMethod:o.mcpCodeChallengeMethod||void 0,ttlSec:600}),_=new URL(o.originalRedirectUri);return _.searchParams.set("code",f),o.mcpState&&_.searchParams.set("state",o.mcpState),M.sendMcpAuthorizationCompletedMessage([{...y(c),redirect_uri:o.originalRedirectUri||null}]),e.redirect(_.toString())}catch(o){const a=o instanceof Error?o.message:String(o),t=o instanceof Error?o.stack:String(o);return M.sendMcpAuthorizationFailedMessage([{...y(c),error:a,error_details:t}]),e.text(`Invalid MCP callback: ${a}`,400)}}}export{$ as SUPPORTED_MCP_GRANT_TYPES,de as createMcpContextToken,De as mcpAuthorizationHandler,Le as mcpCallbackHandler,Oe as mcpDynamicClientRegistrationHandler,Ue as mcpOAuthAuthorizationServerHandler,Re as mcpOAuthProtectedResourceHandler,qe as mcpTokenPortalHandler,B as resolveMcpIdpId,ae as verifyAndParseMcpContextToken,ce as verifyPkce};

package/dist/server/web-server/routes/mcp-routes/mcp-routes.js

@@ -1 +1 @@
-import{corsMiddleware as p}from"../../middleware/corsMiddleware.js";import{ServerRoutes as n}from"../../../../constants/api.js";import{EntitlementsProvider as r}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as t}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as C,A2A_SLUG as a,MCP_SERVER_CARD_SLUG as l}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as A,mcpOAuthAuthorizationServerHandler as d,mcpDynamicClientRegistrationHandler as s,mcpAuthorizationHandler as _,mcpTokenPortalHandler as R,mcpCallbackHandler as m}from"./mcp-oauth.js";import{mcpServerCardHandler as E}from"./mcp-server-card.js";import{agentCardHandler as P}from"./agent-card.js";import{a2aHandler as T}from"./a2a.js";function N(e,i){const o=i.getConfig().mcp,c=r.instance().canAccessFeature("mcp");!o?.hide&&!o?.docs?.hide&&c&&(e.get(t(l),E(i)),e.get(t(C),P(i)),e.use(t(a),p({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(t(a),T(i)),e.get(`${n.MCP_OAUTH_PROTECTED_RESOURCE}${t("/mcp")}`,A()),e.get(n.MCP_OAUTH_AUTHORIZATION_SERVER,d()),e.post(t(n.MCP_DYNAMIC_CLIENT_REGISTRATION),s()),e.get(t(n.MCP_AUTHORIZATION),_()),e.post(t(n.MCP_TOKEN_PORTAL),R()),e.get(t(n.MCP_CALLBACK),m()),e.get(t(`${n.MCP_CALLBACK}/*`),m()))}export{N as installMcpRoutes};
+import{corsMiddleware as o}from"../../middleware/corsMiddleware.js";import{ServerRoutes as a}from"../../../../constants/api.js";import{EntitlementsProvider as C}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as i}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as l,A2A_SLUG as t,MCP_SERVER_CARD_SLUG as A}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as d,mcpOAuthAuthorizationServerHandler as _,mcpDynamicClientRegistrationHandler as r,mcpAuthorizationHandler as R,mcpTokenPortalHandler as E,mcpCallbackHandler as c}from"./mcp-oauth.js";import{mcpServerCardHandler as P}from"./mcp-server-card.js";import{agentCardHandler as T}from"./agent-card.js";import{a2aHandler as s}from"./a2a.js";function N(e,n){const m=n.getConfig().mcp,p=C.instance().canAccessFeature("mcp");!m?.hide&&!m?.docs?.hide&&p&&(e.get(i(A),P(n)),e.get(i(l),T(n)),e.use(i(t),o({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(i(t),s(n)),e.get(`${a.MCP_OAUTH_PROTECTED_RESOURCE}${i("/mcp")}`,d(n)),e.get(a.MCP_OAUTH_AUTHORIZATION_SERVER,_(n)),e.post(i(a.MCP_DYNAMIC_CLIENT_REGISTRATION),r(n)),e.get(i(a.MCP_AUTHORIZATION),R(n)),e.post(i(a.MCP_TOKEN_PORTAL),E(n)),e.get(i(a.MCP_CALLBACK),c(n)),e.get(i(`${a.MCP_CALLBACK}/*`),c(n)))}export{N as installMcpRoutes};

package/dist/server/web-server/routes/mcp-routes/mcp-server-card.js

@@ -1 +1 @@
-import{LATEST_PROTOCOL_VERSION as f}from"@redocly/mcp-typescript-sdk/types.js";import{withPathPrefix as h}from"@redocly/theme/core/utils";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"../../../plugins/mcp/constants.js";import{RESERVED_ROUTES as O}from"../../../plugins/get-reserved-routes.js";import{isMcpCodeModeEnabled as T}from"../../../plugins/mcp/utils/mode.js";import{CODE_MODE_TOOL_NAMES as A,DESCRIBE_TOOLS_TOOL_NAME as R,FETCH_TOOL_NAME as g}from"../../../plugins/mcp/codemode/constants.js";import{EXECUTE_TOOL_SCHEMA as M}from"../../../plugins/mcp/codemode/tools/execute-schema.js";import{describeToolsSchema as b}from"../../../plugins/mcp/codemode/tools/describe-tools.js";import{buildCodeModeInstructions as L,buildExecuteDescription as v,DESCRIBE_TOOLS_DESCRIPTION as D}from"../../../plugins/mcp/codemode/prompts.js";import{composeExecuteAnnotations as I}from"../../../plugins/mcp/codemode/capabilities/index.js";import{ALL_CAPABILITIES as P}from"../../../plugins/mcp/codemode/capabilities/registry.js";import{isGatewayCapabilityEnabled as V}from"../../../plugins/mcp/gateway-mcp/eligibility.js";import{shouldHandleMcpAuth as y}from"../../../plugins/mcp/auth/auth-handlers.js";import{resolvePublicBaseUrl as H}from"../../../web-server/utils/resolve-public-base-url.js";import{telemetryTraceStep as N}from"../../../telemetry/helpers/trace-step.js";import{MCP_AUTH_SCHEMES as U}from"./constants.js";const x="https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",w="1.0";function to(t){const r=T(),E=new Date().toISOString().slice(0,10);return async c=>await N("mcp_server_card",async s=>{const o=t.getConfig(),m=o.mcp?.docs?.name||S,a=t.getMcpTools().filter(e=>!A.has(e.name)),i=V(o.mcp)?[...P]:[],l=i.some(e=>e.id===g),n=(r?[{...M,description:v(l),annotations:I(i)},{name:R,description:D,schema:b(a,i)}]:a).map(({name:e,description:C,schema:_,annotations:p})=>({name:e,description:C,inputSchema:_,...p?{annotations:p}:{}})),u=o.skills?.hide===!0?[]:t.getSkills(),d={$schema:x,version:w,protocolVersion:f,serverInfo:{name:m,title:m,version:E},description:o.seo?.description,documentationUrl:H(t,c),transport:{type:"streamable-http",endpoint:h(O.mcp)},capabilities:{logging:{},tools:{listChanged:!0},...u.length>0?{resources:{listChanged:!0},completions:{}}:{}},authentication:y(!!o.access?.requiresLogin,o.access?.rbac)?{required:!0,schemes:U}:void 0,instructions:r?L(l):void 0,tools:n.length>0?n:["dynamic"]};return s?.setAttribute("mode",r?"code":"tools"),s?.setAttribute("toolsCount",n.length),s?.setAttribute("authRequired",d.authentication!==void 0),c.json(d,200,{"Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=3600"})})}export{to as mcpServerCardHandler};
+import{withPathPrefix as S}from"@redocly/theme/core/utils";import{DEFAULT_DOCS_MCP_SERVER_NAME as h,MCP_PROTOCOL_VERSION as f}from"../../../plugins/mcp/constants.js";import{RESERVED_ROUTES as O}from"../../../plugins/get-reserved-routes.js";import{isMcpCodeModeEnabled as A}from"../../../plugins/mcp/utils/mode.js";import{CODE_MODE_TOOL_NAMES as T,DESCRIBE_TOOLS_TOOL_NAME as b,FETCH_TOOL_NAME as M}from"../../../plugins/mcp/codemode/constants.js";import{EXECUTE_TOOL_SCHEMA as R}from"../../../plugins/mcp/codemode/tools/execute-schema.js";import{describeToolsSchema as g}from"../../../plugins/mcp/codemode/tools/describe-tools.js";import{buildCodeModeInstructions as v,buildExecuteDescription as I,DESCRIBE_TOOLS_DESCRIPTION as L}from"../../../plugins/mcp/codemode/prompts.js";import{composeExecuteAnnotations as D}from"../../../plugins/mcp/codemode/capabilities/index.js";import{ALL_CAPABILITIES as P}from"../../../plugins/mcp/codemode/capabilities/registry.js";import{isGatewayCapabilityEnabled as y}from"../../../plugins/mcp/gateway-mcp/eligibility.js";import{shouldHandleMcpAuth as V}from"../../../plugins/mcp/auth/auth-handlers.js";import{resolvePublicBaseUrl as H}from"../../../web-server/utils/resolve-public-base-url.js";import{telemetryTraceStep as N}from"../../../telemetry/helpers/trace-step.js";import{MCP_AUTH_SCHEMES as U}from"./constants.js";const x="https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",w="1.0";function oe(r){const i=A(),u=new Date().toISOString().slice(0,10);return async c=>await N("com.redocly.mcpServerCard.served",async e=>{e?.setAttribute("id","mcpServerCardId"),e?.setAttribute("object","mcpServerCard"),e?.setAttribute("uri","urn:redocly:realm:api:mcpServerCard:mcpServerCardId");const o=r.getConfig(),m=o.mcp?.docs?.name||h,a=r.getMcpTools().filter(t=>!T.has(t.name)),s=y(o.mcp)?[...P]:[],d=s.some(t=>t.id===M),n=(i?[{...R,description:I(d),annotations:D(s)},{name:b,description:L,schema:g(a,s)}]:a).map(({name:t,description:E,schema:_,annotations:p})=>({name:t,description:E,inputSchema:_,...p?{annotations:p}:{}})),C=o.skills?.hide===!0?[]:r.getSkills(),l={$schema:x,version:w,protocolVersion:f,serverInfo:{name:m,title:m,version:u},description:o.seo?.description,documentationUrl:H(r,c),transport:{type:"streamable-http",endpoint:S(O.mcp)},capabilities:{logging:{},tools:{listChanged:!0},...C.length>0?{resources:{listChanged:!0},completions:{}}:{}},authentication:V(!!o.access?.requiresLogin,o.access?.rbac)?{required:!0,schemes:U}:void 0,instructions:i?v(d):void 0,tools:n.length>0?n:["dynamic"]};return e?.setAttribute("mode",i?"code":"tools"),e?.setAttribute("toolsCount",n.length),e?.setAttribute("authRequired",l.authentication!==void 0),c.json(l,200,{"Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=3600"})})}export{oe as mcpServerCardHandler};

package/dist/server/web-server/routes/mcp-routes/utils/build-agent-card.d.ts

@@ -1,7 +1,7 @@
 import type { SeoConfig } from '@redocly/config';
 import type { Skill } from '../../../../types/plugins/skills.js';
 import type { AgentCard } from '../types.js';
-export declare function buildAgentCard({ seo, baseUrl, skills, mcpAuthRequired }: {
+export declare function buildAgentCard({ seo, baseUrl, skills, mcpAuthRequired, }: {
     seo: SeoConfig | undefined;
     baseUrl: string;
     skills: Skill[];

package/dist/server/web-server/routes/page-data.js

@@ -1 +1 @@
-import{ServerRoutes as w}from"../../../constants/api.js";import{DEV_LOGIN_SLUG as U}from"../../../constants/common.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as r,DEFAULT_TITLE as $}from"../../constants/common.js";import{findInIterable as F}from"../../../utils/collection/find-in-iterable.js";import{removeTrailingSlash as N}from"../../../utils/url/remove-trailing-slash.js";import{envConfig as b}from"../../config/env-config.js";import{canAccessResource as q,filterDataByAccessDeep as T,isResourcePubliclyAccessible as B}from"../../utils/rbac.js";import{getServerProps as H}from"../../ssr/index.js";import{readSharedData as M}from"../../utils/index.js";import{getRedirectLoginUrl as G}from"../utils/get-redirect-login-url.js";import{processRedirects as V}from"./helpers/process-redirects.js";import{removeErrorDetails as W}from"../utils/remove-error-details.js";import{telemetry as k}from"../../telemetry/index.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as K}from"../../plugins/mcp/constants.js";function ie(e,n){return async(t,g)=>{const m=t.get("logger"),{req:p}=t,{pathname:d}=new URL(p.url),{seo:f,ssoDirect:h}=e.getConfig(),i=f?.title||$;if(e?.compilationErrors?.length&&b.isDevelopMode)return t.json({templateId:"compilation-error",props:{compilationErrors:e?.compilationErrors},sharedDataIds:{}},500,{"Cache-Control":r});const u=d.match(/page-data(.*)data.json$/);if(!u)return g();const c=decodeURI(u[1]),s=c==="/index/"?"/":N(c),o=e.getRouteBySlug(s,{followRedirect:!1})||F(e.routesBySlug.values(),a=>a.hasClientRoutes&&c.startsWith(a.slug+"/"));if(c===w.OIDC_CALLBACK+"/")return t.json({templateId:"403OIDC",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}}},200,{"Cache-Control":r});const{isAuthenticated:C,teams:D,claims:{name:j,picture:A,email:I}}=t.get("auth"),R={isAuthenticated:C,email:I,teams:D},l={isAuthenticated:C,name:j,picture:A,email:I,teams:D};if(s==="/mcp"&&e.globalData.mcpData?.docs?.enabled)return t.json({templateId:K,sharedDataIds:{},props:{},userData:l},405,{"Cache-Control":r});const L=e.getRedirect(s);if(L){const a=V({redirect:L}).location;return k.sendRedirectMessage([{object:"redirect",from:s,templateId:"404"}]),t.json({templateId:"404",redirectTo:a,sharedDataIds:{},props:{}},301,{"Cache-Control":r})}if(!o){const a=e.getRouteBySlug(s,{followRedirect:!0});return m.error(`Page not found: ${d}`),t.json({templateId:"404",redirectTo:a?.slug,sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l},404,{"Cache-Control":r})}if(m.verbose(`Page viewed: ${o.slug}`),!q(o,R,e.config.access?.rbac,e.config.access?.requiresLogin)&&o.slug!==U){if(C)return t.json({templateId:"403",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}},userData:l},403,{"Cache-Control":r});const a=Object.keys(h||{}).length>0;return t.json({templateId:"404",sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l,...a?{redirectTo:G(e,o.slug)}:{}},a?401:404,{"Cache-Control":r})}const S=T(o.versions,R,e.config.access?.rbac,e.config.access?.requiresLogin),_=e.routesSharedData.get(o.slug)||{},v=await n(o),P=await H(o,t,v,e),{sharedDataIds:O,...E}=P,y={templateId:o.templateId,versions:S,sharedDataIds:{..._,...O||{}},props:b.isProductionEnv?W(E):E,slug:o.slug,userData:l,isPublic:B(o,e.config)};return t.json(y,200,{"Cache-Control":r})}}function ce(e){return async(n,t)=>{const g=n.get("logger"),{req:m}=n,{pathname:p}=new URL(m.url),d=p.match(/\/page-data\/shared\/(.*)\.json/);if(!d)return t();const f=decodeURIComponent(d[1]),h=await M(f,e.outdir),{isAuthenticated:i,teams:u,claims:{email:c}}=n.get("auth"),s=T(h,{isAuthenticated:i,email:c,teams:u},e.config.access?.rbac,e.config.access?.requiresLogin);return s?n.json(s,200,{"Cache-Control":r}):(g.error(`Shared data not found: ${p}`),n.text("Not Found",404,{"Cache-Control":r}))}}export{ie as pageDataHandler,ce as sharedPageDataHandler};
+import{ServerRoutes as $}from"../../../constants/api.js";import{DEV_LOGIN_SLUG as w}from"../../../constants/common.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as a,DEFAULT_TITLE as U}from"../../constants/common.js";import{findInIterable as F}from"../../../utils/collection/find-in-iterable.js";import{removeTrailingSlash as N}from"../../../utils/url/remove-trailing-slash.js";import{envConfig as b}from"../../config/env-config.js";import{canAccessResource as q,filterDataByAccessDeep as T,isResourcePubliclyAccessible as B}from"../../utils/rbac.js";import{getServerProps as H}from"../../ssr/index.js";import{readSharedData as M}from"../../utils/index.js";import{getRedirectLoginUrl as G}from"../utils/get-redirect-login-url.js";import{processRedirects as V}from"./helpers/process-redirects.js";import{removeErrorDetails as W}from"../utils/remove-error-details.js";import{telemetry as k}from"../../telemetry/index.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as K}from"../../plugins/mcp/constants.js";function ie(e,n){return async(t,g)=>{const m=t.get("logger"),{req:p}=t,{pathname:d}=new URL(p.url),{seo:f,ssoDirect:h}=e.getConfig(),i=f?.title||U;if(e?.compilationErrors?.length&&b.isDevelopMode)return t.json({templateId:"compilation-error",props:{compilationErrors:e?.compilationErrors},sharedDataIds:{}},500,{"Cache-Control":a});const u=d.match(/page-data(.*)data.json$/);if(!u)return g();const c=decodeURI(u[1]),r=c==="/index/"?"/":N(c),o=e.getRouteBySlug(r,{followRedirect:!1})||F(e.routesBySlug.values(),s=>s.hasClientRoutes&&c.startsWith(s.slug+"/"));if(c===$.OIDC_CALLBACK+"/")return t.json({templateId:"403OIDC",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}}},200,{"Cache-Control":a});const{isAuthenticated:C,teams:D,claims:{name:j,picture:A,email:I}}=t.get("auth"),R={isAuthenticated:C,email:I,teams:D},l={isAuthenticated:C,name:j,picture:A,email:I,teams:D};if(r==="/mcp"&&e.globalData.mcpData?.docs?.enabled)return t.json({templateId:K,sharedDataIds:{},props:{},userData:l},405,{"Cache-Control":a});const L=e.getRedirect(r);if(L){const s=V({redirect:L}).location;return k.sendRedirectMessage([{id:r,object:"redirect",uri:`urn:redocly:realm:api:redirect:${r}`,from:r,templateId:"404"}]),t.json({templateId:"404",redirectTo:s,sharedDataIds:{},props:{}},301,{"Cache-Control":a})}if(!o){const s=e.getRouteBySlug(r,{followRedirect:!0});return m.error(`Page not found: ${d}`),t.json({templateId:"404",redirectTo:s?.slug,sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l},404,{"Cache-Control":a})}if(m.verbose(`Page viewed: ${o.slug}`),!q(o,R,e.config.access?.rbac,e.config.access?.requiresLogin)&&o.slug!==w){if(C)return t.json({templateId:"403",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}},userData:l},403,{"Cache-Control":a});const s=Object.keys(h||{}).length>0;return t.json({templateId:"404",sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l,...s?{redirectTo:G(e,o.slug)}:{}},s?401:404,{"Cache-Control":a})}const S=T(o.versions,R,e.config.access?.rbac,e.config.access?.requiresLogin),_=e.routesSharedData.get(o.slug)||{},v=await n(o),P=await H(o,t,v,e),{sharedDataIds:y,...E}=P,O={templateId:o.templateId,versions:S,sharedDataIds:{..._,...y||{}},props:b.isProductionEnv?W(E):E,slug:o.slug,userData:l,isPublic:B(o,e.config)};return t.json(O,200,{"Cache-Control":a})}}function ce(e){return async(n,t)=>{const g=n.get("logger"),{req:m}=n,{pathname:p}=new URL(m.url),d=p.match(/\/page-data\/shared\/(.*)\.json/);if(!d)return t();const f=decodeURIComponent(d[1]),h=await M(f,e.outdir),{isAuthenticated:i,teams:u,claims:{email:c}}=n.get("auth"),r=T(h,{isAuthenticated:i,email:c,teams:u},e.config.access?.rbac,e.config.access?.requiresLogin);return r?n.json(r,200,{"Cache-Control":a}):(g.error(`Shared data not found: ${p}`),n.text("Not Found",404,{"Cache-Control":a}))}}export{ie as pageDataHandler,ce as sharedPageDataHandler};

package/dist/server/web-server/routes/resolve-route.js

@@ -1 +1 @@
-import{Source as m}from"@redocly/openapi-core";import g from"node:fs/promises";import d from"node:path";import{withPathPrefix as S,getPathPrefix as h,combineUrls as E}from"@redocly/theme/core/utils";import{OPENAPI_SHARED_DATA_PREFIX as P}from"../../constants/plugins/openapi-docs.js";import{CATALOG_BASE_SLUG as y,CATALOG_SLUGS as _}from"../../../constants/catalog-entities.js";import{CATALOG_ENTITIES_FILES_REGEX as I}from"../../constants/plugins/catalog-entities.js";import{removeTrailingSlash as T}from"../../../utils/url/remove-trailing-slash.js";import{normalizeRouteSlug as U}from"../../../utils/path/normalize-route-slug.js";import{promiseMapLimit as $}from"../../utils/async/promise-map-limit.js";import{getRoutesByLines as R,getPointerPosition as q}from"../../plugins/openapi-docs/ast-utils.js";import{readSharedData as j}from"../../utils/index.js";function X(o){return async t=>{const s=await t.req.json(),n=decodeURI(T(s.split("?")[0])),[e]=n.split("#"),u=h(),a=U(e.slice(u.length)),l=a.startsWith(y)?y:a,r=o.getRouteBySlug(l);if(r&&o.getRouteByFsPath(r.fsPath)?.metadata?.type==="openapi"){const c=await j(`${P}${r.fsPath}`,o.outdir),i=Object.keys(c.routesMapping).find(p=>E(r.baseSlug,c.routesMapping[p])===n);if(!c.sourcePath)return t.json({route:r},200);let f;if(i){const p=d.join(o.contentDir,r.fsPath),b=await g.readFile(p,"utf-8"),L=new m(p,b);f=q(i,L)}return t.json({route:{fsPath:r.fsPath,pointer:i,position:f}},200)}return t.json({route:r},200)}}function k(o){return async t=>{const s=await t.req.json(),n=await $(s,5,async e=>A(e,o));return t.json({routes:n},200)}}function J(o){return async t=>{const s=await t.req.json(),n=await A(s,o);return t.json(n,200)}}function K(o){return async t=>{const s=(t.req.query("lines")||"").split(",").map(a=>parseInt(a)),n=t.req.query("file");if(!n)return t.json("No data",400);const e=await j(`${P}${n}`,o.outdir),u=d.join(o.contentDir,n);try{const a=await g.readFile(u,"utf-8");if(!e)return t.json("No data",400);const l=new m(u,a),r=R(s,l,e.routesMapping,e.baseSlug);return t.json(r,200)}catch{return t.json("No data",400)}}}async function A(o,t){const[s,n]=o.split(":");if(I.test(s))return{route:{slug:`${y}/${_.ALL}`}};let e=t.getRouteByFsPath(s);if(e?.metadata?.type==="openapi"){const l=await j(`${P}${s}`,t.outdir);if(l?.sourcePath){const r=d.join(t.contentDir,e.fsPath),w=await g.readFile(r,"utf-8"),c=new m(r,w),i=R([parseInt(n,10)],c,l.routesMapping,e.baseSlug);if(i.length)return{route:{slug:h()?S(i[0]):i[0],filePath:o}}}}const u=e?.slug?h()?S(e?.slug):e?.slug:"";return{route:{...e,pageName:e?await e?.getNavText?.():"",slug:u,filePath:o}}}export{K as getRoutesByLineHandler,J as resolvePathHandler,k as resolvePathsHandler,X as resolveSlugHandler};
+import{Source as P}from"@redocly/openapi-core";import y from"node:fs/promises";import S from"node:path";import{withPathPrefix as j,getPathPrefix as h,combineUrls as w}from"@redocly/theme/core/utils";import{API_DOCS_SHARED_DATA_PREFIX as d}from"../../constants/plugins/api-docs.js";import{CATALOG_BASE_SLUG as b,CATALOG_SLUGS as $}from"../../../constants/catalog-entities.js";import{CATALOG_ENTITIES_FILES_REGEX as I}from"../../constants/plugins/catalog-entities.js";import{removeTrailingSlash as E}from"../../../utils/url/remove-trailing-slash.js";import{normalizeRouteSlug as N}from"../../../utils/path/normalize-route-slug.js";import{promiseMapLimit as T}from"../../utils/async/promise-map-limit.js";import{getRoutesByLines as L,getPointerPosition as U}from"../../plugins/openapi-docs/ast-utils.js";import{readSharedData as m}from"../../utils/index.js";const q=new Set(["openapi","asyncapi"]);function K(n){return async t=>{const i=await t.req.json(),r=decodeURI(E(i.split("?")[0])),[o]=r.split("#"),g=h(),f=N(o.slice(g.length)),u=f.startsWith(b)?b:f,e=n.getRouteBySlug(u);if(e){const p=n.getRouteByFsPath(e.fsPath);if(p?.metadata?.type&&q.has(p.metadata.type)){const a=await m(`${d}${e.fsPath}`,n.outdir);if(!a?.routesMapping)return t.json({route:e},200);const s=Object.keys(a.routesMapping).find(c=>w(e.baseSlug,a.routesMapping[c])===r);if(!a.sourcePath)return t.json({route:e},200);let l;if(s){const c=S.join(n.contentDir,e.fsPath),R=await y.readFile(c,"utf-8"),_=new P(c,R);l=U(s,_)}return t.json({route:{fsPath:e.fsPath,pointer:s,position:l}},200)}if(p?.metadata?.type==="graphql"){const a=await m(`${d}${e.fsPath}`,n.outdir);if(!a?.graphqlPositions)return t.json({route:e},200);const s=Object.keys(a.graphqlPositions).find(c=>w(e.baseSlug,c)===r),l=s?a.graphqlPositions[s].position:void 0;return t.json({route:{fsPath:e.fsPath,position:l}},200)}}return t.json({route:e},200)}}function X(n){return async t=>{const i=await t.req.json(),r=await T(i,5,async o=>A(o,n));return t.json({routes:r},200)}}function Y(n){return async t=>{const i=await t.req.json(),r=await A(i,n);return t.json(r,200)}}function J(n){return async t=>{const i=(t.req.query("lines")||"").split(",").map(f=>parseInt(f)),r=t.req.query("file");if(!r)return t.json("No data",400);const o=await m(`${d}${r}`,n.outdir),g=S.join(n.contentDir,r);try{const f=await y.readFile(g,"utf-8");if(!o)return t.json("No data",400);const u=new P(g,f),e=L(i,u,o.routesMapping,o.baseSlug);return t.json(e,200)}catch{return t.json("No data",400)}}}async function A(n,t){const[i,r]=n.split(":");if(I.test(i))return{route:{slug:`${b}/${$.ALL}`}};let o=t.getRouteByFsPath(i);if(o?.metadata?.type&&q.has(o.metadata.type)){const u=await m(`${d}${i}`,t.outdir);if(u?.sourcePath){const e=S.join(t.contentDir,o.fsPath),p=await y.readFile(e,"utf-8"),a=new P(e,p),s=L([parseInt(r,10)],a,u.routesMapping,o.baseSlug);if(s.length)return{route:{slug:h()?j(s[0]):s[0],filePath:n}}}}if(o?.metadata?.type==="graphql"){const u=await m(`${d}${i}`,t.outdir),e=parseInt(r,10);if(u?.sourcePath&&u.graphqlPositions&&!Number.isNaN(e)){let p,a=1/0;for(const[s,{startLine:l,endLine:c}]of Object.entries(u.graphqlPositions))l<=e&&e<=c&&c-l<a&&(a=c-l,p=s);if(p){const s=w(o.baseSlug,p);return{route:{slug:h()?j(s):s,filePath:n}}}}}const g=o?.slug?h()?j(o?.slug):o?.slug:"";return{route:{...o,pageName:o?await o?.getNavText?.():"",slug:g,filePath:n}}}export{J as getRoutesByLineHandler,Y as resolvePathHandler,X as resolvePathsHandler,K as resolveSlugHandler};

package/dist/server/web-server/routes/search.js

@@ -1 +1 @@
-import{telemetryTraceStep as C}from"../../telemetry/helpers/trace-step.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as T}from"../../constants/common.js";import{expandTeamsForRead as E}from"../../utils/rbac.js";function F(e){return async t=>(t.header("Cache-Control",T),await C("search",async s=>{const i=t.get("logger"),a=t.get("auth"),A=i.startTiming(),o=e.getConfig().access?.requiresLogin&&!a.isAuthenticated,u=t.req.valid("json");s?.setAttribute("engine",e?.searchEngine?.type),s?.setAttribute("query",u.query||""),s?.setAttribute("user",a.claims.email??"anonymous"),s?.setAttribute("noAccess",o);const g=e.getSearchFacets(),r=o?{}:e.searchEngine?await e.searchEngine.search(u,{...a,teams:E(e.config.access?.rbac,a.teams)},g):{};let l=0;if(Object.keys(r).length){const f=r.documents;for(const[c,n]of Object.entries(f))l+=n.length}return i.infoTime(A,`Search with query "${u.query||""}". Total results: ${l}`),s?.setAttribute("resultsCount",l),t.json(r)}))}function j(e){return async t=>(t.header("Cache-Control",T),await C("search.facets",async s=>{const i=t.get("logger"),a=t.get("auth"),m=e.getConfig().access?.requiresLogin&&!a.isAuthenticated,o=t.req.valid("json");s?.setAttribute("engine",e?.searchEngine?.type),s?.setAttribute("user",a.claims.email??"anonymous"),s?.setAttribute("noAccess",m);const u=i.startTiming(),g=e.getSearchFacets(),r=m?{}:e.searchEngine?await e.searchEngine.countFacets(o,a,g):{},l=!!o.field;let f=[];if(l){const c=o.field,n=c&&g.get(c);if(n){const h={...n};h.values=r?.[c]||[],f.push(h)}}else{const c=new Map;for(const[n,h]of g){const y=r?.[n],d={...h};d.values=y||h.values.map(b=>({value:b,count:0})),c.set(n,d)}f=Array.from(c,([,n])=>n)}return i.verboseTime(u,"Search facets"),t.json(f)}))}export{j as searchFacetsHandler,F as searchHandler};
+import{telemetryTraceStep as b}from"../../telemetry/helpers/trace-step.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as C}from"../../constants/common.js";import{expandTeamsForRead as E}from"../../utils/rbac.js";function v(t){return async s=>(s.header("Cache-Control",C),await b("com.redocly.search.performed",async e=>{e?.setAttribute("id","searchQueryId"),e?.setAttribute("object","searchQuery"),e?.setAttribute("uri","urn:redocly:realm:api:searchQuery:searchQueryId");const i=s.get("logger"),r=s.get("auth"),d=i.startTiming(),a=t.getConfig().access?.requiresLogin&&!r.isAuthenticated,u=s.req.valid("json");e?.setAttribute("engine",t?.searchEngine?.type),e?.setAttribute("query",u.query||""),e?.setAttribute("user",r.claims.email??"anonymous"),e?.setAttribute("noAccess",a);const l=t.getSearchFacets(),o=a?{}:t.searchEngine?await t.searchEngine.search(u,{...r,teams:E(t.config.access?.rbac,r.teams)},l):{};let h=0;if(Object.keys(o).length){const g=o.documents;for(const[c,n]of Object.entries(g))h+=n.length}return i.infoTime(d,`Search with query "${u.query||""}". Total results: ${h}`),e?.setAttribute("resultsCount",h),s.json(o)}))}function p(t){return async s=>(s.header("Cache-Control",C),await b("com.redocly.search.facets",async e=>{e?.setAttribute("id","searchFacetsId"),e?.setAttribute("object","searchFacets"),e?.setAttribute("uri","urn:redocly:realm:api:searchFacets:searchFacetsId");const i=s.get("logger"),r=s.get("auth"),m=t.getConfig().access?.requiresLogin&&!r.isAuthenticated,a=s.req.valid("json");e?.setAttribute("engine",t?.searchEngine?.type),e?.setAttribute("user",r.claims.email??"anonymous"),e?.setAttribute("noAccess",m);const u=i.startTiming(),l=t.getSearchFacets(),o=m?{}:t.searchEngine?await t.searchEngine.countFacets(a,r,l):{},h=!!a.field;let g=[];if(h){const c=a.field,n=c&&l.get(c);if(n){const f={...n};f.values=o?.[c]||[],g.push(f)}}else{const c=new Map;for(const[n,f]of l){const y=o?.[n],A={...f};A.values=y||f.values.map(T=>({value:T,count:0})),c.set(n,A)}g=Array.from(c,([,n])=>n)}return i.verboseTime(u,"Search facets"),s.json(g)}))}export{p as searchFacetsHandler,v as searchHandler};

package/dist/server/web-server/routes/semantic-search.js

@@ -1 +1 @@
-import{withPathPrefix as p}from"@redocly/theme/core/utils";import{SEMANTIC_SEARCH_API_URL as r}from"../../constants/common.js";function l(u){return async e=>{if(!r)return e.newResponse(null,404);const n=e.get("auth"),o={"Content-Type":"application/json"};n.idpAccessToken&&(o.Cookie=`accessToken=${n.idpAccessToken}`);const a=await e.req.json();try{const t=await fetch(r,{method:"POST",body:JSON.stringify(a),headers:o});if(t.ok){const c=(await t.json()).documents.map(s=>({...s,url:p(s.url)}));return e.json(c)}const i=await t.text();return e.newResponse(i,t.status,{"Content-Type":"application/json"})}catch(t){return e.json({error:"Failed to fetch semantic search results",details:String(t)},500)}}}export{l as semanticSearchHandler};
+import{withPathPrefix as p}from"@redocly/theme/core/utils";import{SEMANTIC_SEARCH_API_URL as s}from"../../constants/common.js";import{fetchWithClient as u}from"../../utils/fetch-with-client.js";function T(d){return async t=>{if(!s)return t.newResponse(null,404);const n=t.get("auth"),o={"Content-Type":"application/json"};n.idpAccessToken&&(o.Cookie=`accessToken=${n.idpAccessToken}`);const a=await t.req.json();try{const e=await u(s,{method:"POST",body:JSON.stringify(a),headers:o});if(e.ok){const c=(await e.json()).documents.map(r=>({...r,url:p(r.url)}));return t.json(c)}const i=await e.text();return t.newResponse(i,e.status,{"Content-Type":"application/json"})}catch(e){return t.json({error:"Failed to fetch semantic search results",details:String(e)},500)}}}export{T as semanticSearchHandler};

package/dist/server/web-server/routes/skills/skill-markdown.js

@@ -1 +1 @@
-import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as c}from"../../../constants/common.js";import{telemetryTraceStep as a}from"../../../telemetry/helpers/trace-step.js";import{canAccessSkill as m}from"../../../utils/skills/can-access-skill.js";import{MIME_TYPES as u}from"../../mime-types.js";import{getContentTypeHeaderValue as p}from"../../utils/content-type.js";function _(n){return async e=>await a("agent_skill",async r=>{const t=e.req.param("slug")??"";if(r?.setAttribute("skill",t),n.config.skills?.hide===!0)return e.newResponse(null,404);const s=n.skills.get(t),{isAuthenticated:l,teams:i,claims:{email:o}}=e.get("auth");return s&&m(s,{isAuthenticated:l,teams:i,email:o},n.config.access?.rbac,n.config.access?.requiresLogin)?e.newResponse(s.content,200,{"Content-Type":p(u[".md"]),"Cache-Control":c,"Access-Control-Allow-Origin":"*"}):e.newResponse(null,404)})}export{_ as skillMarkdownHandler};
+import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as c}from"../../../constants/common.js";import{telemetryTraceStep as a}from"../../../telemetry/helpers/trace-step.js";import{canAccessSkill as u}from"../../../utils/skills/can-access-skill.js";import{MIME_TYPES as m}from"../../mime-types.js";import{getContentTypeHeaderValue as g}from"../../utils/content-type.js";function y(n){return async e=>await a("com.redocly.agentSkill.served",async t=>{t?.setAttribute("object","agentSkill");const r=e.req.param("slug")??"";if(t?.setAttribute("id",r),t?.setAttribute("uri",`urn:redocly:realm:api:agentSkill:${r}`),t?.setAttribute("skill",r),n.config.skills?.hide===!0)return e.newResponse(null,404);const s=n.skills.get(r),{isAuthenticated:i,teams:l,claims:{email:o}}=e.get("auth");return s&&u(s,{isAuthenticated:i,teams:l,email:o},n.config.access?.rbac,n.config.access?.requiresLogin)?e.newResponse(s.content,200,{"Content-Type":g(m[".md"]),"Cache-Control":c,"Access-Control-Allow-Origin":"*"}):e.newResponse(null,404)})}export{y as skillMarkdownHandler};

package/dist/server/web-server/routes/skills/skills-index.js

@@ -1 +1 @@
-import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as o}from"../../../constants/common.js";import{telemetryTraceStep as c}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as a}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as u}from"../../utils/resolve-public-base-url.js";import{buildSkillsIndex as m}from"./build-skills-index.js";function b(e){return async i=>await c("agent_skills_index",async l=>{if(e.config.skills?.hide===!0)return l?.setAttribute("skillsCount",0),i.newResponse(null,404);const{isAuthenticated:t,teams:n,claims:{email:r}}=i.get("auth"),s=a(e.getSkills(),{isAuthenticated:t,teams:n,email:r},e.config.access?.rbac,e.config.access?.requiresLogin);return l?.setAttribute("skillsCount",s.length),i.json(m(s,u(e,i)),200,{"Cache-Control":o,"Access-Control-Allow-Origin":"*"})})}export{b as skillsIndexHandler};
+import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as o}from"../../../constants/common.js";import{telemetryTraceStep as u}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as a}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as c}from"../../utils/resolve-public-base-url.js";import{buildSkillsIndex as d}from"./build-skills-index.js";function f(e){return async l=>await u("com.redocly.agentSkillsIndex.served",async i=>{if(i?.setAttribute("id","agentSkillsIndexId"),i?.setAttribute("object","agentSkillsIndex"),i?.setAttribute("uri","urn:redocly:realm:api:agentSkillsIndex:agentSkillsIndexId"),e.config.skills?.hide===!0)return i?.setAttribute("skillsCount",0),l.newResponse(null,404);const{isAuthenticated:s,teams:n,claims:{email:r}}=l.get("auth"),t=a(e.getSkills(),{isAuthenticated:s,teams:n,email:r},e.config.access?.rbac,e.config.access?.requiresLogin);return i?.setAttribute("skillsCount",t.length),l.json(d(t,c(e,l)),200,{"Cache-Control":o,"Access-Control-Allow-Origin":"*"})})}export{f as skillsIndexHandler};

package/dist/server/web-server/utils/prepare-list-response.d.ts

@@ -15,7 +15,7 @@ export type ListResponseResult<T extends {
 };
 export declare function prepareListResponse<T extends {
     id: string;
-}>({ data, params, totalCount, nameTransformationsFromDatabase, hasMore }: {
+}>({ data, params, totalCount, nameTransformationsFromDatabase, hasMore, }: {
     data: T[];
     params: PaginationParams;
     totalCount?: number;

package/dist/server/workers/api-routes-worker-pool.js

@@ -1 +1 @@
-import{getAllowedEnvs as r}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as o}from"./worker-pool.js";const p="executeApiRoute",e=3,i=new o({workerScript:"./api-routes-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:r,lazy:!0});export{p as API_ROUTES_WORKER_KEY,i as apiRoutesWorkers};
+import{getAllowedEnvs as r}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as o}from"./worker-pool.js";const p="executeApiRoute",e=3,i=new o({workerScript:"./api-routes-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:r,lazy:!0,sandbox:!0});export{p as API_ROUTES_WORKER_KEY,i as apiRoutesWorkers};

package/dist/server/workers/mcp-tool-worker-pool.js

@@ -1 +1 @@
-import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",c="isMcpToolAvailable",e=5,l=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0});export{c as MCP_TOOL_IS_AVAILABLE_KEY,p as MCP_TOOL_WORKER_KEY,l as mcpToolWorkers};
+import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",c="isMcpToolAvailable",e=5,l=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0,sandbox:!0});export{c as MCP_TOOL_IS_AVAILABLE_KEY,p as MCP_TOOL_WORKER_KEY,l as mcpToolWorkers};

package/dist/server/workers/worker-pool.d.ts

@@ -3,6 +3,7 @@ import type { WorkerTypeMapping, WorkerParams, WorkerResponse } from './types.js
 export type WorkerPoolConfig = {
     workerScript: string;
     lazy: boolean;
+    sandbox?: boolean;
     resolveForkEnv?: () => Record<string, string | undefined>;
 } & WorkerPoolOptions;
 type RegisteredWorkers = keyof WorkerTypeMapping;

package/dist/server/workers/worker-pool.js

@@ -1 +1 @@
-import n from"workerpool";import{basename as a,dirname as s,resolve as l}from"node:path";import{fileURLToPath as h}from"node:url";import{envConfig as m}from"../config/env-config.js";class v{#t=null;#r;constructor(o){this.#r=o,this.#r.lazy||(this.#t=this.#o())}#o(){const{workerScript:o,lazy:t,resolveForkEnv:r,...e}=this.#r;let i=this.#e(o);return r&&e.forkOpts&&(e.forkOpts={...e.forkOpts,env:r()}),n.pool(i,{...e})}#e(o){let t=o;if(!t.endsWith(".js")&&!t.endsWith(".mjs")&&(t=`${t}.${m.isDevelopMode?"js":"mjs"}`),!t.startsWith("."))return t;const r=s(h(import.meta.url)),e=a(r)==="chunks"?s(r):r;return l(e,t)}#i(){return this.#t||(this.#t=this.#o()),this.#t}async exec(o,t,r){let i=this.#i().exec(o,t);return r?.timeout&&(i=i.timeout(r.timeout)),await i}async terminate(){this.#t&&(await this.#t.terminate(),this.#t=null)}}export{v as WorkerPool};
+import l from"workerpool";import{mkdirSync as m}from"node:fs";import{basename as u,dirname as c,resolve as f}from"node:path";import{fileURLToPath as p}from"node:url";import{envConfig as n}from"../config/env-config.js";import{SandboxContext as v}from"../utils/sandbox-context.js";const h=(()=>{const o=c(p(import.meta.url));return u(o)==="chunks"?c(o):o})();class P{#t=null;#r;constructor(r){this.#r=r,this.#r.lazy||(this.#t=this.#e())}#e(){const{workerScript:r,lazy:t,sandbox:i,resolveForkEnv:s,...e}=this.#r,a=this.#s(r);return s&&e.forkOpts&&(e.forkOpts={...e.forkOpts,env:s()}),this.#o(i)?l.pool(a,{...e,forkOpts:this.#i(e.forkOpts)}):l.pool(a,{...e})}#o(r){return!!r&&n.isReunite&&n.REDOCLY_DISABLE_API_FUNCTION_SANDBOX!==!0}#i(r){const t=v.resolve(h);try{m(t.tmpDir,{recursive:!0})}catch{}return{...r,cwd:t.serverOutDir,execArgv:[...t.execArgv,...r?.execArgv??[]],env:{...r?.env,...t.env}}}#s(r){let t=r;return!t.endsWith(".js")&&!t.endsWith(".mjs")&&(t=`${t}.${n.isDevelopMode?"js":"mjs"}`),t.startsWith(".")?f(h,t):t}#n(){return this.#t||(this.#t=this.#e()),this.#t}async exec(r,t,i){let e=this.#n().exec(r,t);return i?.timeout&&(e=e.timeout(i.timeout)),await e}async terminate(){this.#t&&(await this.#t.terminate(),this.#t=null)}}export{P as WorkerPool};

package/dist/types/entitlements.d.ts

@@ -35,9 +35,14 @@ export type PlanGates = {
     [FEATURE.aiSearchLimit]: number;
     [FEATURE.kvStorageLimit]: number;
     [FEATURE.mcp]: boolean;
+    [FEATURE.mcpGateway]: boolean;
+    [FEATURE.mcpMode]: 'tools' | 'code';
+    [FEATURE.gatewayFetchRatePerMin]: number;
+    [FEATURE.gatewayFetchQuotaPerDay]: number;
+    [FEATURE.gatewayFetchBudgetPerExec]: number;
 };
 export type Entitlements = {
-    [key in Feature]: boolean | number;
+    [key in Feature]: boolean | number | string;
 };
 export type ProductPlan = 'pro' | 'enterprise';
 //# sourceMappingURL=entitlements.d.ts.map

package/dist/types/markdoc.d.ts

@@ -1,5 +1,6 @@
 import type { Node, Variable, RenderableTreeNode, Function } from '@markdoc/markdoc';
-import type { RenderTagFn } from '../server/types/plugins/markdown.js';
+import type { RenderForLlmsRenderContext } from '@redocly/theme/markdoc/tags/types';
+export type RenderTagFn = (node: Node, context: RenderForLlmsRenderContext) => string | undefined;
 export type GetInnerContentFnOptions = {
     indent?: number;
     isTrim?: boolean;

package/dist/utils/l10n/build-i18n-config.d.ts

@@ -0,0 +1,24 @@
+import type { InitOptions } from 'i18next';
+import type { GlobalData } from '../../types/index.js';
+/**
+ * Builds the i18next init config shared by the client runtime (`initL10n`) and the
+ * build-time translate used in `renderForLlms` (`createBuildTranslate`), so both
+ * resolve translations identically: same default-translation merge, same locale
+ * fallback chain.
+ *
+ * @param l10n - The project's l10n data (`defaultLocale`, configured `locales`, and
+ * `translations` overrides), or `undefined` for a project with no l10n config.
+ * @param locale - The `lng` to set on the resulting config (the instance's `resources`
+ * still cover every configured locale, so a fixed translator for any other locale can
+ * still be derived from the same config via `i18next.getFixedT(otherLocale)`).
+ * @returns An i18next `InitOptions` object with merged default + project translations
+ * and a `code → langPart → defaultLocale` fallback chain.
+ *
+ * @example
+ * ```ts
+ * const config = await buildI18nConfig(l10n, 'ja');
+ * await i18next.init(config);
+ * ```
+ */
+export declare function buildI18nConfig(l10n: GlobalData['l10n'], locale: InitOptions['lng']): Promise<InitOptions>;
+//# sourceMappingURL=build-i18n-config.d.ts.map

package/dist/utils/l10n/build-i18n-config.js

@@ -0,0 +1 @@
+import{DEFAULT_LOCALE_PLACEHOLDER as u}from"../../constants/common.js";import{defaultTranslationImports as c}from"../../constants/l10n/default-translations.js";async function L(s,r){const a=s?.defaultLocale||u,e=s?.translations??{},i=s?.locales?[...new Set(s.locales.flatMap(t=>[t.code,t.code.split("-")[0]]))]:[a],l={};for(const t of i){const n=await c[t]?.()||{};l[t]={translation:{...n,...e[t]?.translation}}}return{load:"currentOnly",lng:r,nonExplicitSupportedLngs:!0,fallbackLng:t=>{if(!t)return[a];const n=t.split("-")[0];if(t===a)return n!==t?[n,a]:[a];const o=[t];return n!==t&&o.push(n),o.push(a),o},interpolation:{escapeValue:!1},debug:!1,resources:{...l}}}export{L as buildI18nConfig};

package/dist/utils/l10n/create-translate.d.ts

@@ -0,0 +1,19 @@
+import type { TFunction, TOptions } from '@redocly/theme/core/types';
+/**
+ * Wraps a raw i18next `t`-like function (`useTranslate`'s `i18next.t`, or a
+ * build-time `instance.getFixedT(locale)`) with the shared value/defaultValue/options
+ * resolution used across the client and build-time translate paths.
+ *
+ * @param rawT - The underlying i18next translate function to resolve keys against.
+ * @returns A `TFunction` that resolves `value` via `rawT`, falling back to
+ * `defaultValue` (when passed as the second argument or via `options.defaultValue`)
+ * and then to `value` itself when the key is untranslated.
+ *
+ * @example
+ * ```ts
+ * const translate = createTranslate(i18next.t);
+ * translate('greeting.hello', 'Hello'); // translated string, or 'Hello' if missing
+ * ```
+ */
+export declare function createTranslate(rawT: (key: string, opts?: TOptions) => string): TFunction;
+//# sourceMappingURL=create-translate.d.ts.map

package/dist/utils/l10n/create-translate.js

@@ -0,0 +1 @@
+function u(r){return(n,t)=>{const e=typeof t=="string"?t:void 0,f=e?void 0:t;return n?r(n,{defaultValue:e,...f})||e||n||"":e??""}}export{u as createTranslate};

package/dist/utils/url/get-shared-data-fetch-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Builds the exact URL used to fetch shared page data over HTTP. The client
+ * loader and the server-side `<link rel="preload">` generation must both use
+ * this function so the preloaded URL matches the fetched URL byte for byte.
+ *
+ * @param id - The unique identifier of the shared data resource.
+ * @param isDevelopMode - Whether the portal runs in develop mode, where the URL is kept raw instead of URI-encoded.
+ * @returns The path-prefixed (and, outside develop mode, URI-encoded) shared data URL.
+ *
+ * @example
+ * ```ts
+ * getSharedDataFetchUrl('with space', false);
+ * // "/page-data/shared/with%20space.json"
+ * ```
+ */
+export declare function getSharedDataFetchUrl(id: string, isDevelopMode: boolean): string;
+//# sourceMappingURL=get-shared-data-fetch-url.d.ts.map

package/dist/utils/url/get-shared-data-fetch-url.js

@@ -0,0 +1 @@
+import{withPathPrefix as a}from"@redocly/theme/core/utils";import{getSharedDataUrl as o}from"./get-shared-data-url.js";function n(t,e){const r=a(o(t));return e?r:encodeURI(r)}export{n as getSharedDataFetchUrl};

package/dist/utils/url/parse-preview-url.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Parses an absolute preview URL string. Accepts `https:` on any host, and `http:`
+ * only on `localhost` hosts, which is how previews are served in the local dev
+ * environment. Returns `null` on parse errors and for any other scheme/host pair.
+ *
+ * @param uri - Absolute URL string to parse.
+ * @returns A `URL` when the string is a valid preview URL; otherwise `null`.
+ *
+ * @example
+ * ```ts
+ * parsePreviewUrl('https://slug--branch.preview.redocly.app');
+ * // URL { href: 'https://slug--branch.preview.redocly.app/' }
+ *
+ * parsePreviewUrl('http://slug--branch.preview.localhost');
+ * // URL { href: 'http://slug--branch.preview.localhost/' }
+ *
+ * parsePreviewUrl('http://slug--branch.preview.redocly.app');
+ * // null
+ * ```
+ */
+export declare function parsePreviewUrl(uri: string): URL | null;
+//# sourceMappingURL=parse-preview-url.d.ts.map

package/dist/utils/url/parse-preview-url.js

@@ -0,0 +1 @@
+import{parseHttpsUrl as n}from"./parse-https-url.js";function s(t){const o=n(t);if(o)return o;try{const r=new URL(t);return r.protocol==="http:"&&l(r.hostname)?r:null}catch{return null}}function l(t){return t==="localhost"||t.endsWith(".localhost")}export{s as parsePreviewUrl};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/realm",
-  "version": "0.136.0-next.0",
+  "version": "0.136.0-next.10",
   "description": "",
   "type": "module",
   "bin": {
@@ -21,7 +21,8 @@
     "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
     "@libsql/client": "0.17.3",
     "@markdoc/markdoc": "0.5.2",
-    "@opentelemetry/api": "1.9.0",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@opentelemetry/api": "1.9.1",
     "@opentelemetry/context-zone": "2.0.1",
     "@opentelemetry/core": "2.8.0",
     "@opentelemetry/exporter-trace-otlp-http": "0.219.0",
@@ -32,8 +33,7 @@
     "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "@redocly/ajv": "8.18.0",
-    "@redocly/mcp-typescript-sdk": "1.18.1",
-    "@redocly/openapi-core": "2.39.0",
+    "@redocly/openapi-core": "2.44.2",
     "@shikijs/transformers": "3.21.0",
     "@tanstack/react-query": "5.62.3",
     "@tanstack/react-table": "8.21.3",
@@ -51,15 +51,14 @@
     "enquirer": "2.3.6",
     "esbuild": "0.28.1",
     "escape-carriage": "^1.3.1",
-    "fetch-to-node": "^2.1.0",
     "fflate": "0.7.4",
     "flexsearch": "0.7.43",
     "graphql": "16.12.0",
-    "hono": "4.12.25",
+    "hono": "4.12.34",
     "htmlparser2": "8.0.2",
     "i18next": "22.4.15",
     "is-glob": "4.0.3",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "lru-cache": "11.1.0",
     "minimatch": "10.2.4",
     "mri": "1.2.0",
@@ -74,7 +73,7 @@
     "react-calendar": "5.1.0",
     "react-date-picker": "11.0.0",
     "react-dom": "^19.2.4",
-    "react-router-dom": "^6.30.3",
+    "react-router-dom": "^7.18.1",
     "react-select": "5.10.1",
     "reactjs-popup": "2.0.6",
     "semver": "7.7.3",
@@ -86,6 +85,7 @@
     "tty-browserify": "0.0.1",
     "typesense": "2.1.0",
     "ulid": "^2.3.0",
+    "undici": "^6.27.0",
     "web-vitals": "3.3.1",
     "workerpool": "9.2.0",
     "ws": "^8.21.0",
@@ -93,14 +93,15 @@
     "xpath": "0.0.34",
     "yaml-ast-parser": "0.0.43",
     "zod": "^3.25.76",
-    "@redocly/asyncapi-docs": "1.13.0-next.0",
-    "@redocly/config": "0.52.0",
-    "@redocly/graphql-docs": "1.13.0-next.0",
-    "@redocly/openapi-docs": "3.24.0-next.0",
+    "@redocly/api-docs": "0.1.0-next.2",
+    "@redocly/asyncapi-docs": "1.13.0-next.9",
+    "@redocly/config": "0.53.1",
+    "@redocly/graphql-docs": "1.13.0-next.9",
+    "@redocly/openapi-docs": "3.24.0-next.9",
     "@redocly/portal-legacy-ui": "0.18.0",
-    "@redocly/portal-plugin-mock-server": "0.21.0-next.0",
-    "@redocly/realm-asyncapi-sdk": "0.14.0-next.0",
-    "@redocly/theme": "0.68.0-next.0"
+    "@redocly/portal-plugin-mock-server": "0.21.0-next.9",
+    "@redocly/realm-asyncapi-sdk": "0.14.0-next.3",
+    "@redocly/theme": "0.68.0-next.6"
   },
   "peerDependencies": {
     "react": "^19.2.4",

package/dist/markdoc/helpers/get-operation/get-operation-info-by-id.d.ts

@@ -1,4 +0,0 @@
-import type { OpenAPIDefinition } from '@redocly/openapi-docs';
-import type { OperationInfo } from './types';
-export declare function getOperationInfoById(definition: OpenAPIDefinition, operationId?: string): OperationInfo | undefined;
-//# sourceMappingURL=get-operation-info-by-id.d.ts.map

package/dist/markdoc/helpers/get-operation/get-operation-info-by-id.js

@@ -1 +0,0 @@
-import{isOperationName as f,JsonPointer as c}from"@redocly/openapi-docs";function m(i,s){const a=i.paths||{};for(const p of Object.entries(a)){const[r,e]=p,o=Object.entries(e).find(([t,n])=>f(t)&&n.operationId===s);if(o){const[t,n]=o;return{...n,pathName:r,httpVerb:t,pathParameters:e.parameters||[],pathServers:e.servers,pointer:c.compile(["paths",r,t]),isWebhook:!1}}}}export{m as getOperationInfoById};

package/dist/markdoc/helpers/get-operation/get-operation-info-by-pointer.d.ts

@@ -1,4 +0,0 @@
-import type { OpenAPIDefinition } from '@redocly/openapi-docs';
-import type { OperationInfo } from './types';
-export declare function getOperationInfoByPointer(definition: OpenAPIDefinition, pointer: string): OperationInfo | undefined;
-//# sourceMappingURL=get-operation-info-by-pointer.d.ts.map

package/dist/markdoc/helpers/get-operation/get-operation-info-by-pointer.js

@@ -1 +0,0 @@
-import{JsonPointer as i}from"@redocly/openapi-docs";function h(s,e){try{const[t,o,n]=i.parse(e),r=s.paths[o],a=r?.[n];return a&&{...a,pathName:o,httpVerb:n,pathParameters:r.parameters||[],pathServers:r.servers,pointer:e,isWebhook:!1}}catch(t){console.error(t);return}}export{h as getOperationInfoByPointer};

package/dist/markdoc/helpers/get-operation/get-operation.d.ts

@@ -1,14 +0,0 @@
-import type { OperationIdentifier } from './types';
-import type { OpenAPIDefinition, Options, OperationModel } from '@redocly/openapi-docs';
-import type { RedocConfig } from '@redocly/config';
-export declare function getOperation(store: {
-    definition: OpenAPIDefinition;
-    options: RedocConfig;
-}, { operationId, pointer }: OperationIdentifier, options: Options, { exampleKey, mimeType, environments, environment, requestBody }: {
-    exampleKey?: string;
-    mimeType?: string;
-    environments?: Record<string, Record<string, string>>;
-    environment?: string;
-    requestBody?: any;
-}): OperationModel | undefined;
-//# sourceMappingURL=get-operation.d.ts.map

package/dist/markdoc/helpers/get-operation/get-operation.js

@@ -1 +0,0 @@
-import{getOperation as E,getServerEnvName as l,normalizeOptions as x,OpenAPIParser as h,getTagOrGroup as q}from"@redocly/openapi-docs";import{getOperationInfoById as v}from"./get-operation-info-by-id.js";import{getOperationInfoByPointer as y}from"./get-operation-info-by-pointer.js";function M(s,{operationId:i,pointer:f},m,{exampleKey:r,mimeType:a,environments:p,environment:d,requestBody:g}){let o;if(i?o=v(s.definition,i):f&&(o=y(s.definition,f)),!o)return;const O=new h(s.definition,void 0,x(s.options)),u=o.tags?.[0],B=u?q("group",{name:u},void 0):void 0,n=E(O,o,B,m,"");if(a&&n.requestBody?.content?.mediaTypes&&(n.requestBody.content.mediaTypes=n.requestBody?.content?.mediaTypes.filter(e=>e.name===a)),r&&(n.requestBody?.content?.mediaTypes.forEach(e=>{if(!e.examples)return;const t=e.examples[r];e.examples=t?{[r]:t}:{}}),n.responses?.forEach(e=>{e.content?.mediaTypes?.forEach(t=>{if(!t.examples)return;const c=t.examples[r];t.examples=c?{[r]:c}:{}})})),g&&n.requestBody?.content?.mediaTypes.forEach(e=>{e.examples={}}),p&&(n.servers=n.servers.map(e=>{const t=p?.[l(e)];return t?{...e,url:t.server||e.url}:e})),d){const e=n.servers.filter(t=>d===l(t));n.servers=e.length?e:n.servers}return n}export{M as getOperation};

package/dist/markdoc/helpers/get-operation/index.d.ts

@@ -1,4 +0,0 @@
-export * from './get-operation-info-by-id.js';
-export * from './get-operation-info-by-pointer.js';
-export * from './get-operation.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/markdoc/helpers/get-operation/index.js

@@ -1 +0,0 @@
-export*from"./get-operation-info-by-id.js";export*from"./get-operation-info-by-pointer.js";export*from"./get-operation.js";

package/dist/markdoc/helpers/get-operation/types/index.d.ts

@@ -1,4 +0,0 @@
-export type * from './operation-identifier';
-export type * from './operation-info';
-export type * from './operation-parameters';
-//# sourceMappingURL=index.d.ts.map

package/dist/markdoc/helpers/get-operation/types/operation-identifier.d.ts

@@ -1,5 +0,0 @@
-export type OperationIdentifier = {
-    operationId?: string;
-    pointer?: string;
-};
-//# sourceMappingURL=operation-identifier.d.ts.map

package/dist/markdoc/helpers/get-operation/types/operation-info.d.ts

@@ -1,6 +0,0 @@
-import type { OpenAPIOperation } from '@redocly/openapi-docs';
-export type OperationInfo = {
-    pathName: string;
-    httpVerb: string;
-} & OpenAPIOperation;
-//# sourceMappingURL=operation-info.d.ts.map

package/dist/markdoc/helpers/get-operation/types/operation-parameters.d.ts

@@ -1,3 +0,0 @@
-import type { OpenAPIParameterLocation } from '@redocly/openapi-docs';
-export type OperationParameters = Partial<Record<OpenAPIParameterLocation, object>>;
-//# sourceMappingURL=operation-parameters.d.ts.map

package/dist/server/plugins/markdown/attribute-resolvers/helpers/get-media-content-samples.d.ts

@@ -1,4 +0,0 @@
-import type { MediaContentModel } from '@redocly/openapi-docs/lib/models/types.js';
-import type { ResolvedSampleBlock } from '../../../../../types/index.js';
-export declare function getMediaContentSamples(content: MediaContentModel | undefined, exampleKey: string | undefined, titlePrefix: string): ResolvedSampleBlock[];
-//# sourceMappingURL=get-media-content-samples.d.ts.map

package/dist/server/plugins/markdown/attribute-resolvers/helpers/get-media-content-samples.js

@@ -1 +0,0 @@
-import{convertSampleToString as p}from"@redocly/openapi-docs/lib/services/code-samples/convertSampleToString.js";import{langFromMime as r}from"@redocly/openapi-docs/lib/utils/openapi.js";import{getExampleValueByMimeType as c}from"@redocly/openapi-docs/lib/services/code-samples/get-example-value-by-mime-type.js";function d(o,t,l){const a=[];if(!o?.hasSample)return a;for(const e of o.mediaTypes??[]){const n=e.examples||e.formExamples||{},m=Object.keys(n);if(!m.length)continue;const s=m.length===1?n[m[0]]:t&&n[t]||n[m[0]],i=p(s.value,e.name,e.schema);i!==void 0&&a.push({lang:r(e.name),title:`${l} ${e.name}`,source:c(i,e.name,s.encoding)})}return a}export{d as getMediaContentSamples};

package/dist/server/plugins/mcp/codemode/sandbox/sandbox-polyfills.d.ts

@@ -1,3 +0,0 @@
-export declare const SANDBOX_POLYFILLS = "\n  const URLSearchParams = class URLSearchParams {\n    constructor(init) {\n      this._params = [];\n      if (typeof init === 'string') {\n        const str = init.startsWith('?') ? init.slice(1) : init;\n        for (const pair of (str ? str.split('&') : [])) {\n          const eq = pair.indexOf('=');\n          const k = eq >= 0 ? pair.slice(0, eq) : pair;\n          const v = eq >= 0 ? pair.slice(eq + 1) : '';\n          if (k) this._params.push([decodeURIComponent(k), decodeURIComponent(v)]);\n        }\n      } else if (init != null && typeof init === 'object') {\n        for (const [k, v] of Object.entries(init)) this._params.push([k, String(v)]);\n      }\n    }\n    append(key, value) { this._params.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._params = this._params.filter(([pk]) => pk !== k);\n      this._params.push([k, v]);\n    }\n    get(key) { return (this._params.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    getAll(key) { return this._params.filter(([k]) => k === String(key)).map(([, v]) => v); }\n    has(key) { return this._params.some(([k]) => k === String(key)); }\n    delete(key) { this._params = this._params.filter(([k]) => k !== String(key)); }\n    entries() { return this._params.values(); }\n    [Symbol.iterator]() { return this._params.values(); }\n    toString() {\n      return this._params\n        .map(([k, v]) => encodeURIComponent(k) + '=' + encodeURIComponent(v))\n        .join('&');\n    }\n  };\n  globalThis.URLSearchParams = URLSearchParams;\n\n  const FormData = class FormData {\n    constructor() { this._fields = []; }\n    append(key, value) { this._fields.push([String(key), String(value)]); }\n    set(key, value) {\n      const k = String(key), v = String(value);\n      this._fields = this._fields.filter(([fk]) => fk !== k);\n      this._fields.push([k, v]);\n    }\n    get(key) { return (this._fields.find(([k]) => k === String(key)) ?? [undefined, null])[1]; }\n    has(key) { return this._fields.some(([k]) => k === String(key)); }\n    delete(key) { this._fields = this._fields.filter(([k]) => k !== String(key)); }\n    entries() { return this._fields.values(); }\n    [Symbol.iterator]() { return this._fields.values(); }\n  };\n  globalThis.FormData = FormData;\n";
-export declare const SANDBOX_FETCH_SETUP = "\n  const hostFetch = globalThis.__fetch;\n  delete globalThis.__fetch;\n  globalThis.fetch = (url, init = {}) => {\n    let body;\n    let autoContentType;\n    if (init.body instanceof URLSearchParams) {\n      body = init.body.toString();\n      autoContentType = 'application/x-www-form-urlencoded';\n    } else if (init.body instanceof FormData) {\n      const boundary = '----FormBoundary' + Math.random().toString(36).slice(2);\n      body = init.body._fields\n        .map(([k, v]) =>\n          '--' + boundary + '\\r\\nContent-Disposition: form-data; name=\"' + k + '\"\\r\\n\\r\\n' + v,\n        )\n        .join('\\r\\n') + '\\r\\n--' + boundary + '--';\n      autoContentType = 'multipart/form-data; boundary=' + boundary;\n    } else if (init.body != null && typeof init.body !== 'string') {\n      throw new TypeError('fetch body must be a string, URLSearchParams, or FormData');\n    } else {\n      body = init.body ?? undefined;\n    }\n    const callerHeaders = init.headers;\n    const hasContentType = callerHeaders != null && Object.keys(callerHeaders).some(\n      (k) => k.toLowerCase() === 'content-type',\n    );\n    const headers = autoContentType && !hasContentType\n      ? Object.assign({ 'content-type': autoContentType }, callerHeaders)\n      : callerHeaders;\n    return hostFetch(JSON.stringify({ url: String(url), method: init.method, headers, body }))\n      .then((json) => {\n        const res = JSON.parse(json);\n        const resHeaders = res.headers || {};\n        return {\n          status: res.status,\n          statusText: res.statusText,\n          ok: res.ok,\n          headers: {\n            get: (name) => {\n              const value = resHeaders[String(name).toLowerCase()];\n              return value === undefined ? null : value;\n            },\n          },\n          json: () => Promise.resolve(JSON.parse(res.bodyText)),\n          text: () => Promise.resolve(res.bodyText),\n        };\n      });\n  };\n";
-//# sourceMappingURL=sandbox-polyfills.d.ts.map

package/dist/server/plugins/mcp/codemode/sandbox/sandbox.d.ts

@@ -1,3 +0,0 @@
-import type { RunInSandboxOptions, SandboxResult, SandboxTool } from '../types.js';
-export declare function runInSandbox(code: string, tools: Record<string, SandboxTool>, options?: RunInSandboxOptions): Promise<SandboxResult>;
-//# sourceMappingURL=sandbox.d.ts.map