@redocly/realm 0.136.0-next.1 → 0.136.0-next.11

package/dist/server/web-server/routes/catalog/helpers/upsert-pages-stats.d.ts

@@ -7,6 +7,6 @@ type UpsertPagesStatsParams = {
     addedEntities?: EntityReadModelSchema[];
     removedEntities?: EntityReadModelSchema[];
 };
-export declare function upsertPagesStats({ ctx, catalogEntitiesService, addedEntities, removedEntities }: UpsertPagesStatsParams): Promise<void>;
+export declare function upsertPagesStats({ ctx, catalogEntitiesService, addedEntities, removedEntities, }: UpsertPagesStatsParams): Promise<void>;
 export {};
 //# sourceMappingURL=upsert-pages-stats.d.ts.map

package/dist/server/web-server/routes/dynamic-route.js

@@ -1 +1 @@
-import m from"path";import{REDOCLY_ROUTE_RBAC as U,REDOCLY_TEAMS_RBAC as b}from"@redocly/config";import{withoutPathPrefix as j,withPathPrefix as V}from"@redocly/theme/core/utils";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as M,CACHE_CONTROL_PUBLIC_HTML as W,DEFAULT_IMMUTABLE_CACHE_MAX_AGE as Z,X_REDOCLY_CACHE_CONTROL_HEADER as J,X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML as K}from"../../constants/common.js";import{removeTrailingSlash as Q}from"../../../utils/url/remove-trailing-slash.js";import{findInIterable as x}from"../../../utils/collection/find-in-iterable.js";import{sanitizeRedirectPathname as ee}from"../../../utils/url/sanitize-redirect-pathname.js";import{envConfig as te}from"../../config/env-config.js";import{sanitizePath as ne}from"../../../utils/path/sanitize-path.js";import{normalizeRouteSlug as oe}from"../../../utils/path/normalize-route-slug.js";import{isPathInFolder as re}from"../../../utils/path/is-path-in-folder.js";import{getLlmsTxtMdPathBySlug as ae}from"../../utils/llmstxt/get-llms-txt-md-path-by-slug.js";import{removeLeadingSlash as D}from"../../../utils/url/remove-leading-slash.js";import{processRedirects as ie}from"./helpers/process-redirects.js";import{renderPage as se,getServerProps as ce}from"../../ssr/index.js";import{canAccessAsset as le,canAccessResource as H}from"../../utils/rbac.js";import{handleErrorPageRender as q,handleUnauthorized as v,handleUnauthorizedAsset as B}from"../utils.js";import{DEFAULT_MAX_AGE_FOR_MIME_TYPE as me,MIME_TYPES as ue}from"../mime-types.js";import{fileExistsAsync as F}from"../../utils/index.js";import{isAiAgentRequest as de}from"../../utils/ai-agent-detection.js";import{getRedirectRoute as ge}from"../utils/legacy-openapi-redirects.js";import{getContentTypeHeaderValue as fe}from"../utils/content-type.js";import{telemetry as pe}from"../../../cli/telemetry/index.js";import{telemetry as he}from"../../telemetry/index.js";function Xe(e,z,Y){return async n=>{const R=n.get("logger"),a=n.req,i=new URL(a.url),r=j(ne(decodeURIComponent(i.pathname))),A=m.parse(r).ext===".md",E=de({accept:a.header("accept"),signatureAgent:a.header("signature-agent"),signature:a.header("signature"),signatureInput:a.header("signature-input"),userAgent:a.header("user-agent")}),l=oe(r),o=(a.method==="GET"||a.method==="HEAD")&&!A?e.getRouteBySlug(l,{followRedirect:!1})||x(e.routesBySlug?.values(),t=>t.hasClientRoutes&&(r===t.slug||r.startsWith(t.slug+"/"))):void 0,L=e.getRedirect(l);if(L){const t=ie({redirect:L,reqUrlSearch:i.search});return he.sendRedirectMessage([{object:"redirect",from:l,templateId:t.type.toString()}]),n.newResponse(null,t.type,{Location:t.location})}const f=te.isProductionEnv?301:302;if(o?.metadata?.type==="openapi"){const t=ge(i.pathname);if(t)return R.info("Legacy OpenAPI docs redirect from "+i.pathname),n.newResponse(null,f,{Location:encodeURI(t)});if(i.pathname.match(/[A-Z]/))return R.warn("Redirect to lowercase route to avoid 404 error"),n.newResponse(null,f,{Location:encodeURI(i.pathname.toLowerCase())})}if(r.endsWith("/")&&r!=="/"){const t=ee(new URL(l||"/",n.req.url).pathname);return n.newResponse(null,f,{Location:encodeURI(V((t==="/"?"/":Q(t))+i.search))})}const u=o&&E?ae(o.slug):void 0,_=u?await F(m.resolve(e.outdir,D(u))):!1,{isAuthenticated:d,teams:p,claims:{email:h}}=n.get("auth");if(o&&!H(o,{isAuthenticated:d,email:h,teams:p},e.config.access?.rbac,e.config.access?.requiresLogin))return d?q(n,e,{slug:o.slug,[b]:o[b],[U]:o[U]},403):v(n,e,o.slug);if(o&&(!E||!_)){const t=await z(o),c=await ce(o,n,t,e),{html:X,statusCode:y,error:k}=await se(o,c,n,e,pe),O=e.config.access?.rbac,I=!e.config.access?.requiresLogin&&(!O||!Object.keys(O).length),S=y>=400||!!k||!!e.compilationErrors?.length,$=I&&!S;let g;return S?g=M:I?g=W:g="private",n.html(X,y,{"Cache-Control":g,...$&&{[J]:K}})}const w=u&&_?u:r,G=D(w),s=m.resolve(e.outdir,G);if(!re(s,e.outdir))return B(n);if(A){const t=r==="index.html.md"?"/":r.replace(/\.md$/,""),c=e.getRouteBySlug(t,{followRedirect:!1});if(c&&!H(c,{isAuthenticated:d,email:h,teams:p},e.config.access?.rbac,e.config.access?.requiresLogin))return v(n,e,r)}const P=e.getGlobalConfig("access");if(!le(w,P?.rbac||{},P?.requiresLogin||!1,e.getGlobalConfig("directoryPaths"),{isAuthenticated:d,email:h,teams:p}))return B(n);const T=ue[m.extname(s)]||"text/plain",C=s.match(/assets\/.*\.[a-f0-9]{8,}\..+/)||s.match(/runtime\/chunks\/.*/)?Z:me[T],N=C?{"Cache-Control":`public, max-age=${C}, immutable`,Expires:new Date(Date.now()+C*1e3).toUTCString()}:{"Cache-Control":M};if(await F(s)){const t=a.query("download")!=null,c=await Y(s);return n.newResponse(c,200,{"Content-Type":fe(T),"Access-Control-Allow-Origin":"*",...N,...t&&{"Content-Disposition":`attachment; filename="${m.basename(s)}"`}})}else return q(n,e,{slug:l},404)}}export{Xe as dynamicRouteHandler};
+import m from"path";import{REDOCLY_ROUTE_RBAC as M,REDOCLY_TEAMS_RBAC as S}from"@redocly/config";import{combineUrls as V,withoutPathPrefix as W,withPathPrefix as Z}from"@redocly/theme/core/utils";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as D,CACHE_CONTROL_PUBLIC_HTML as J,DEFAULT_IMMUTABLE_CACHE_MAX_AGE as K,X_REDOCLY_CACHE_CONTROL_HEADER as Q,X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML as x}from"../../constants/common.js";import{removeTrailingSlash as ee}from"../../../utils/url/remove-trailing-slash.js";import{findInIterable as te}from"../../../utils/collection/find-in-iterable.js";import{sanitizeRedirectPathname as ne}from"../../../utils/url/sanitize-redirect-pathname.js";import{envConfig as re}from"../../config/env-config.js";import{sanitizePath as oe}from"../../../utils/path/sanitize-path.js";import{normalizeRouteSlug as ie}from"../../../utils/path/normalize-route-slug.js";import{isPathInFolder as ae}from"../../../utils/path/is-path-in-folder.js";import{getLlmsTxtMdPathBySlug as se}from"../../utils/llmstxt/get-llms-txt-md-path-by-slug.js";import{removeLeadingSlash as H}from"../../../utils/url/remove-leading-slash.js";import{processRedirects as ce}from"./helpers/process-redirects.js";import{renderPage as le,getServerProps as me}from"../../ssr/index.js";import{canAccessAsset as ue,canAccessResource as q}from"../../utils/rbac.js";import{handleErrorPageRender as v,handleUnauthorized as B,handleUnauthorizedAsset as F}from"../utils.js";import{DEFAULT_MAX_AGE_FOR_MIME_TYPE as de,MIME_TYPES as ge}from"../mime-types.js";import{fileExistsAsync as z}from"../../utils/index.js";import{isAiAgentRequest as fe}from"../../utils/ai-agent-detection.js";import{getRedirectRoute as pe}from"../utils/legacy-openapi-redirects.js";import{getContentTypeHeaderValue as he}from"../utils/content-type.js";import{telemetry as Re}from"../../../cli/telemetry/index.js";import{telemetry as Ce}from"../../telemetry/index.js";function ke(e,Y,G){return async n=>{const A=n.get("logger"),i=n.req,a=new URL(i.url),o=W(oe(decodeURIComponent(a.pathname))),E=m.parse(o).ext===".md",L=fe({accept:i.header("accept"),signatureAgent:i.header("signature-agent"),signature:i.header("signature"),signatureInput:i.header("signature-input"),userAgent:i.header("user-agent")}),s=ie(o),r=(i.method==="GET"||i.method==="HEAD")&&!E?e.getRouteBySlug(s,{followRedirect:!1})||te(e.routesBySlug?.values(),t=>t.hasClientRoutes&&(o===t.slug||o.startsWith(t.slug+"/"))):void 0,_=e.getRedirect(s);if(_){const t=ce({redirect:_,reqUrlSearch:a.search});return Ce.sendRedirectMessage([{id:s,object:"redirect",uri:`urn:redocly:realm:api:redirect:${s}`,from:s,templateId:t.type.toString()}]),n.newResponse(null,t.type,{Location:t.location})}const f=re.isProductionEnv?301:302;if(r?.metadata?.type==="openapi"){const t=pe(a.pathname);if(t)return A.info("Legacy OpenAPI docs redirect from "+a.pathname),n.newResponse(null,f,{Location:encodeURI(t)});if(a.pathname.match(/[A-Z]/))return A.warn("Redirect to lowercase route to avoid 404 error"),n.newResponse(null,f,{Location:encodeURI(a.pathname.toLowerCase())})}if(o.endsWith("/")&&o!=="/"){const t=ne(new URL(s||"/",n.req.url).pathname);return n.newResponse(null,f,{Location:encodeURI(Z((t==="/"?"/":ee(t))+a.search))})}const u=r&&L?se(r.slug):void 0,w=u?await z(m.resolve(e.outdir,H(u))):!1,{isAuthenticated:d,teams:p,claims:{email:h}}=n.get("auth");if(r&&!q(r,{isAuthenticated:d,email:h,teams:p},e.config.access?.rbac,e.config.access?.requiresLogin))return d?v(n,e,{slug:r.slug,[S]:r[S],[M]:r[M]},403):B(n,e,r.slug);if(r&&(!L||!w)){const t=await Y(r),C=await me(r,n,t,e),{html:$,statusCode:U,error:k}=await le(r,C,n,e,Re),b=e.config.access?.rbac,O=!e.config.access?.requiresLogin&&(!b||!Object.keys(b).length),I=U>=400||!!k||!!e.compilationErrors?.length,j=O&&!I;let g;return I?g=D:O?g=J:g="private",n.html($,U,{"Cache-Control":g,...j&&{[Q]:x}})}const P=u&&w?u:o,N=H(P),c=m.resolve(e.outdir,N);if(!ae(c,e.outdir))return F(n);let l;if(E){const t=o==="/index.html.md"?"/":o.replace(/\.md$/,"");if(l=e.getRouteBySlug(t,{followRedirect:!1}),l&&!q(l,{isAuthenticated:d,email:h,teams:p},e.config.access?.rbac,e.config.access?.requiresLogin))return B(n,e,o)}const T=e.getGlobalConfig("access");if(!ue(P,T?.rbac||{},T?.requiresLogin||!1,e.getGlobalConfig("directoryPaths"),{isAuthenticated:d,email:h,teams:p}))return F(n);const y=ge[m.extname(c)]||"text/plain",R=c.match(/assets\/.*\.[a-f0-9]{8,}\..+/)||c.match(/runtime\/chunks\/.*/)?K:de[y],X=R?{"Cache-Control":`public, max-age=${R}, immutable`,Expires:new Date(Date.now()+R*1e3).toUTCString()}:{"Cache-Control":D};if(await z(c)){const t=i.query("download")!=null,C=await G(c);return n.newResponse(C,200,{"Content-Type":he(y),"Access-Control-Allow-Origin":"*",...X,...l&&{"X-Robots-Tag":"noindex, follow",...e.config.seo?.siteUrl&&{Link:`<${V(e.config.seo.siteUrl,l.slug)}>; rel="canonical"`}},...t&&{"Content-Disposition":`attachment; filename="${m.basename(c)}"`}})}else return v(n,e,{slug:s},404)}}export{ke as dynamicRouteHandler};

package/dist/server/web-server/routes/feedback.d.ts

@@ -16,7 +16,7 @@ type FeedbackData = {
     email?: string;
 };
 export declare function normalizeFeedbackMetadata(metadata?: FeedbackData['metadata']): Record<string, any> | undefined;
-export declare function normalizeFeedbackData({ component, path, location, lang, agent, targetFeature, score, max, reasons, comment, metadata, email }: FeedbackData): {
+export declare function normalizeFeedbackData({ component, path, location, lang, agent, targetFeature, score, max, reasons, comment, metadata, email, }: FeedbackData): {
     feedbackComponent: string;
     path: string | undefined;
     location: string | undefined;

package/dist/server/web-server/routes/helpers/process-redirects.d.ts

@@ -22,7 +22,7 @@ import type { StatusCode } from 'hono/utils/http-status';
  * processRedirects({ redirect: { to: 'https://example.com', type: 302 } });
  * // Returns: { location: 'https://example.com', type: 302 }
  */
-export declare function processRedirects({ redirect, reqUrlSearch }: {
+export declare function processRedirects({ redirect, reqUrlSearch, }: {
     redirect: WithRequired<RedirectConfig, 'to'>;
     reqUrlSearch?: string;
 }): {

package/dist/server/web-server/routes/mcp-routes/a2a.js

@@ -1 +1 @@
-import{withPathPrefix as t}from"@redocly/theme/core/utils";import{MCP_SERVER_CARD_SLUG as n}from"../../../../constants/common.js";import{telemetryTraceStep as a}from"../../../telemetry/helpers/trace-step.js";import{SKILLS_INDEX_SLUG as l}from"../skills/constants.js";function p(i){return async s=>await a("a2a",async o=>{const r=i.config.skills?.hide!==!0,e=[`<${t(n)}>; rel="mcp-server-card"`];return r&&e.push(`<${t(l)}>; rel="agent-skills"`),o?.setAttribute("skillsAdvertised",r),s.json({error:{code:"405",message:"Method not allowed"}},405,{Link:e.join(", ")})})}export{p as a2aHandler};
+import{withPathPrefix as i}from"@redocly/theme/core/utils";import{MCP_SERVER_CARD_SLUG as a}from"../../../../constants/common.js";import{telemetryTraceStep as l}from"../../../telemetry/helpers/trace-step.js";import{SKILLS_INDEX_SLUG as n}from"../skills/constants.js";function f(s){return async o=>await l("com.redocly.a2a.requested",async e=>{const r=s.config.skills?.hide!==!0,t=[`<${i(a)}>; rel="mcp-server-card"`];return r&&t.push(`<${i(n)}>; rel="agent-skills"`),e?.setAttribute("skillsAdvertised",r),e?.setAttribute("object","a2a"),e?.setAttribute("id","a2aId"),e?.setAttribute("uri","urn:redocly:realm:api:a2a:a2aId"),o.json({error:{code:"405",message:"Method not allowed"}},405,{Link:t.join(", ")})})}export{f as a2aHandler};

package/dist/server/web-server/routes/mcp-routes/agent-card.js

@@ -1 +1 @@
-import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as u}from"../../../constants/common.js";import{telemetryTraceStep as m}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as g}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as f}from"../../../web-server/utils/resolve-public-base-url.js";import{shouldHandleMcpAuth as A}from"../../../plugins/mcp/auth/auth-handlers.js";import{buildAgentCard as d}from"./utils/build-agent-card.js";function _(e){return async i=>await m("agent_card",async t=>{if(e.config.skills?.hide===!0)return i.newResponse(null,404);const{isAuthenticated:o,teams:c,claims:{email:a}}=i.get("auth"),r=e.config.access?.rbac||{},s=!!e.config.access?.requiresLogin,n=g(e.getSkills(),{isAuthenticated:o,teams:c,email:a},r,s),l=A(s,r);return t?.setAttribute("skillsCount",n.length),t?.setAttribute("mcpAuthRequired",l),i.json(d({seo:e.getGlobalConfig("seo"),baseUrl:f(e,i),skills:n,mcpAuthRequired:l}),200,{"Cache-Control":u,"Access-Control-Allow-Origin":"*"})})}export{_ as agentCardHandler};
+import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as c}from"../../../constants/common.js";import{telemetryTraceStep as d}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as g}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as m}from"../../../web-server/utils/resolve-public-base-url.js";import{shouldHandleMcpAuth as A}from"../../../plugins/mcp/auth/auth-handlers.js";import{buildAgentCard as C}from"./utils/build-agent-card.js";function y(e){return async r=>await d("com.redocly.agentCard.served",async t=>{if(t?.setAttribute("id","agentCardId"),t?.setAttribute("object","agentCard"),t?.setAttribute("uri","urn:redocly:realm:api:agentCard:agentCardId"),e.config.skills?.hide===!0)return r.newResponse(null,404);const{isAuthenticated:l,teams:a,claims:{email:u}}=r.get("auth"),i=e.config.access?.rbac||{},n=!!e.config.access?.requiresLogin,s=g(e.getSkills(),{isAuthenticated:l,teams:a,email:u},i,n),o=A(n,i);return t?.setAttribute("skillsCount",s.length),t?.setAttribute("mcpAuthRequired",o),r.json(C({seo:e.getGlobalConfig("seo"),baseUrl:m(e,r),skills:s,mcpAuthRequired:o}),200,{"Cache-Control":c,"Access-Control-Allow-Origin":"*"})})}export{y as agentCardHandler};

package/dist/server/web-server/routes/mcp-routes/mcp-oauth.d.ts

@@ -1,4 +1,6 @@
 import type { Handler } from 'hono';
+import type { SsoConfig } from '@redocly/config';
+import type { Store } from '../../../store.js';
 export type McpContextPayload = {
     isMcpFlow: boolean;
     originalRedirectUri: string | null;
@@ -9,17 +11,19 @@ export type McpContextPayload = {
     mcpCodeChallengeMethod?: string | null;
     timestamp: number;
 };
+export declare const SUPPORTED_MCP_GRANT_TYPES: readonly ['authorization_code', 'refresh_token'];
 export declare function verifyPkce(codeChallenge: string, codeChallengeMethod: string | undefined, codeVerifier: string): boolean;
 export declare function createMcpContextToken(context: McpContextPayload): Promise<string>;
 export declare function verifyAndParseMcpContextToken(token: string): Promise<McpContextPayload>;
-export declare function mcpOAuthProtectedResourceHandler(): Handler;
-export declare function mcpOAuthAuthorizationServerHandler(): Handler;
+export declare function mcpOAuthProtectedResourceHandler(store: Store): Handler;
+export declare function mcpOAuthAuthorizationServerHandler(store: Store): Handler;
 /**
  * This code is not used in the MCP server, but it is required to satisfy the OAuth 2.0 Dynamic Client Registration Protocol.
  * Also it is simulating the client registration process.
  */
-export declare function mcpDynamicClientRegistrationHandler(): Handler;
-export declare function mcpAuthorizationHandler(): Handler;
-export declare function mcpTokenPortalHandler(): Handler;
-export declare function mcpCallbackHandler(): Handler;
+export declare function mcpDynamicClientRegistrationHandler(store: Store): Handler;
+export declare function resolveMcpIdpId(ssoDirect: SsoConfig | undefined): string | undefined;
+export declare function mcpAuthorizationHandler(store: Store): Handler;
+export declare function mcpTokenPortalHandler(store: Store): Handler;
+export declare function mcpCallbackHandler(store: Store): Handler;
 //# sourceMappingURL=mcp-oauth.d.ts.map

package/dist/server/web-server/routes/mcp-routes/mcp-oauth.js

@@ -1 +1 @@
-import{getCookie as C}from"hono/cookie";import{createHash as U,timingSafeEqual as R}from"node:crypto";import{ulid as v}from"ulid";import{AUTH_URL as f,JWT_SECRET_KEY as M}from"../../../constants/common.js";import{ServerRoutes as _}from"../../../../constants/api.js";import{AuthCookieNames as T}from"../../../../constants/common.js";import{withPathPrefix as u}from"@redocly/theme/core/utils";import{telemetry as m}from"../../../telemetry/index.js";import{envConfig as A}from"../../../config/env-config.js";import{createMcpAuthorizationCode as O,verifyMcpAuthorizationCode as D,createMcpSessionResource as h}from"../../auth.js";import*as g from"../../jwt/jwt.js";import{AlgorithmTypes as S}from"../../jwt/types.js";import{getRequestOrigin as y}from"../../utils/get-request-origin.js";import{fetchClientMetadataDocument as L,isClientMetadataDocumentUrl as k,isRedirectUriRegistered as H}from"./mcp-client-metadata.js";const o=(e,r,n=200,a)=>e.json(r,n,{"Content-Type":"application/json",...a??{}}),I=new Set(["S256"]),q="https://claude.ai/oauth/claude-code-client-metadata";function z(e,r,n){if(!I.has(r||""))return!1;const a=U("sha256").update(n).digest("base64url"),t=Buffer.from(a),s=Buffer.from(e);return t.length!==s.length?!1:R(t,s)}async function $(e){const r=Math.floor(Date.now()/1e3);return g.sign({type:"mcp_context",...e,iat:r,exp:r+600},M,S.HS256)}async function N(e){await g.verify(e,M,S.HS256);const{payload:r}=g.decode(e);if(r.type!=="mcp_context")throw new Error("Invalid context token type");return r}function x(){return async e=>{if(e.req.method!=="GET")return o(e,{error:"Method not allowed"},405,{Allow:"GET"});const r=y(e);return o(e,{resource:`${r}${u("/mcp")}`,authorization_servers:[r,f].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${r}${_.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:["openid","profile","email","offline_access"],bearer_token_types_supported:["Bearer"]})}}function ee(){return async e=>{const r=y(e);return o(e,{issuer:f||"",authorization_endpoint:`${r}${u(_.MCP_AUTHORIZATION)}`,token_endpoint:`${r}${u(_.MCP_TOKEN_PORTAL)}`,jwks_uri:`${f||""}/.well-known/jwks.json`,scopes_supported:["openid","profile","email","offline_access"],registration_endpoint:`${r}${u(_.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token","client_credentials"],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function re(){return async e=>{if(e.req.method!=="POST")return o(e,{error:"Method not allowed"},405);try{return o(e,{client_id:A.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:["authorization_code","refresh_token"],response_types:["code"],scope:"openid offline email",subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(r){return o(e,{error:"invalid_request",error_description:r?.message||"Unable to register client"},500)}}}function te(){return async e=>{const r=new URL(e.req.url),{searchParams:n}=r,a=n.get("redirect_uri"),t=n.get("client_id"),s=n.get("code_challenge"),i=n.get("code_challenge_method"),d=v();if(s&&!I.has(i||""))return o(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...I].join(", ")}`},400);if(k(t)&&!s)return o(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(k(t)&&a)try{const c=await L(t),l=t===q;if(!H(a,c.redirect_uris,{ignorePort:l}))return o(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(c){const l=c instanceof Error?c.message:String(c);return o(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${l}`},400)}m.sendMcpAuthorizationStartedMessage([{...h(d),redirect_uri:a||null}]);const p=y(e),w={isMcpFlow:!0,originalRedirectUri:a,mcpClientId:t,mcpState:n.get("state"),mcpSessionId:d,mcpCodeChallenge:s,mcpCodeChallengeMethod:s?i:null,timestamp:Date.now()};try{const c=await $(w),l=new URL(u(_.IDP_LOGIN),p);return l.searchParams.set("redirectTo",`${_.MCP_CALLBACK}/${c}`),l.searchParams.set("idpId","oidc"),e.redirect(l.toString())}catch(c){const l=c instanceof Error?c.message:String(c),P=c instanceof Error?c.stack:String(c);m.sendMcpAuthorizationFailedMessage([{...h(d),error:l,error_details:P}]);const E=new URL(u(`${f}/oauth2/auth`));return E.search=n.toString(),e.redirect(E.toString())}}}function oe(){return async e=>{if(e.req.method!=="POST")return o(e,{error:"Method not allowed"},405);try{const r=await e.req.formData(),n=r.get("grant_type"),a=r.get("code"),t=r.get("redirect_uri")||void 0,s=r.get("code_verifier")||void 0;if(n!=="authorization_code"||!a)return o(e,{error:"invalid_request",error_description:"Invalid grant type or missing authorization code"},400);try{const i=await D(a);if(t&&t!==i.redirect_uri)return o(e,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(i.code_challenge){if(!s)return o(e,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!z(i.code_challenge,i.code_challenge_method,s))return o(e,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(A.OAUTH_CLIENT_ID&&i.client_id&&!k(i.client_id)&&i.client_id!==A.OAUTH_CLIENT_ID)return o(e,{error:"invalid_client",error_description:"Client mismatch"},400);const d=i.id_token;if(typeof d!="string"||d.length===0)return o(e,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);let p=d;if(i.idp_access_token){const{payload:c,header:{kid:l}}=g.decode(d);p=await g.sign({...c,idp_access_token:i.idp_access_token},M,S.HS256,l)}return o(e,{access_token:p,token_type:"Bearer",expires_in:3600,scope:"openid profile email",id_token:d},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch{return o(e,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(r){const n=r instanceof Error?r.message:String(r);return o(e,{error:"server_error",error_description:"Failed to process token request",error_details:n},500)}}}function ne(){return async e=>{const r=new URL(e.req.url);let n=r.searchParams.get("context");if(!n&&r.pathname.startsWith(u(`${_.MCP_CALLBACK}/`))){const t=r.pathname.split("/");n=t[t.length-1]}if(!n)return m.sendMcpAuthorizationFailedMessage([{...h(null),error:"Missing context parameter",error_details:null}]),e.text("Missing context parameter",400);let a=null;try{const t=await N(n);if(a=t.mcpSessionId||null,!t.isMcpFlow||!t.originalRedirectUri)throw new Error("Invalid MCP context");const s=C(e,T.IDP_ID_TOKEN)||C(e,T.AUTHORIZATION),i=C(e,T.IDP_ACCESS_TOKEN);if(!s)return m.sendMcpAuthorizationFailedMessage([{...h(a),error:"Authentication required",error_details:null}]),e.text("Authentication required",401);const d=await O({idToken:s,idpAccessToken:i||void 0,clientId:t.mcpClientId||"",redirectUri:t.originalRedirectUri,codeChallenge:t.mcpCodeChallenge||void 0,codeChallengeMethod:t.mcpCodeChallengeMethod||void 0,ttlSec:600}),p=new URL(t.originalRedirectUri);return p.searchParams.set("code",d),t.mcpState&&p.searchParams.set("state",t.mcpState),m.sendMcpAuthorizationCompletedMessage([{...h(a),redirect_uri:t.originalRedirectUri||null}]),e.redirect(p.toString())}catch(t){const s=t instanceof Error?t.message:String(t),i=t instanceof Error?t.stack:String(t);return m.sendMcpAuthorizationFailedMessage([{...h(a),error:s,error_details:i}]),e.text(`Invalid MCP callback: ${s}`,400)}}}export{$ as createMcpContextToken,te as mcpAuthorizationHandler,ne as mcpCallbackHandler,re as mcpDynamicClientRegistrationHandler,ee as mcpOAuthAuthorizationServerHandler,x as mcpOAuthProtectedResourceHandler,oe as mcpTokenPortalHandler,N as verifyAndParseMcpContextToken,z as verifyPkce};
+import{getCookie as A}from"hono/cookie";import{createHash as J,timingSafeEqual as V}from"node:crypto";import{ulid as Y}from"ulid";import{isMcpContentProtected as P}from"../../../plugins/mcp/auth/auth-handlers.js";import{isRedoclySso as Z,isOidcProviderConfig as v}from"../../auth.js";import{AUTH_URL as R,JWT_SECRET_KEY as m,MCP_ACCESS_TOKEN_TTL_SEC as b,MCP_REFRESH_SESSION_LIFETIME_SEC as W}from"../../../constants/common.js";import{ServerRoutes as T}from"../../../../constants/api.js";import{AuthCookieNames as U}from"../../../../constants/common.js";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{telemetry as M}from"../../../telemetry/index.js";import{envConfig as D}from"../../../config/env-config.js";import{createMcpAuthorizationCode as x,verifyMcpAuthorizationCode as Q,createMcpRefreshToken as z,verifyMcpRefreshToken as X,createMcpSessionResource as y,oidcJwksCache as F,oidcRefreshTokenGrant as ee,getOidcMetadata as re,discoverJwks as te}from"../../auth.js";import*as S from"../../jwt/jwt.js";import{AlgorithmTypes as q}from"../../jwt/types.js";import{getRequestOrigin as L}from"../../utils/get-request-origin.js";import{encryptClaimValue as H}from"../../../utils/crypto/encrypt-claim-value.js";import{decryptAesGcm as ne}from"../../../utils/crypto/decrypt-aes-gcm.js";import{encryptAesGcm as G}from"../../../utils/crypto/encrypt-aes-gcm.js";import{fetchClientMetadataDocument as oe,isClientMetadataDocumentUrl as N,isRedirectUriRegistered as ie}from"./mcp-client-metadata.js";const s=(r,e,n=200,i)=>r.json(e,n,{"Content-Type":"application/json",...i??{}}),j=new Set(["S256"]),$=["authorization_code","refresh_token"],E=["openid","profile","email","offline_access"],se="https://claude.ai/oauth/claude-code-client-metadata";function ce(r,e,n){if(!j.has(e||""))return!1;const i=J("sha256").update(n).digest("base64url"),c=Buffer.from(i),o=Buffer.from(r);return c.length!==o.length?!1:V(c,o)}async function de(r){const e=Math.floor(Date.now()/1e3);return S.sign({type:"mcp_context",...r,iat:e,exp:e+600},m,q.HS256)}async function ae(r){await S.verify(r,m,q.HS256);const{payload:e}=S.decode(r);if(e.type!=="mcp_context")throw new Error("Invalid context token type");return e}function Re(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="GET")return s(e,{error:"Method not allowed"},405,{Allow:"GET"});const n=L(e);return s(e,{resource:`${n}${I("/mcp")}`,authorization_servers:[n,R].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${n}${T.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:[...E],bearer_token_types_supported:["Bearer"]})}}function Ue(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=L(e);return s(e,{issuer:R||"",authorization_endpoint:`${n}${I(T.MCP_AUTHORIZATION)}`,token_endpoint:`${n}${I(T.MCP_TOKEN_PORTAL)}`,jwks_uri:`${R||""}/.well-known/jwks.json`,scopes_supported:[...E],registration_endpoint:`${n}${I(T.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:[...$],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function Oe(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{return s(e,{client_id:D.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:[...$],response_types:["code"],scope:E.join(" "),subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(n){return s(e,{error:"invalid_request",error_description:n?.message||"Unable to register client"},500)}}}function B(r){const e=r||{},n=Object.keys(e),i=n.find(o=>v(e[o])&&Z(e[o])),c=n.find(o=>v(e[o]));return i||c||n[0]}function De(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=new URL(e.req.url),{searchParams:i}=n,c=i.get("redirect_uri"),o=i.get("client_id"),a=i.get("code_challenge"),t=i.get("code_challenge_method"),p=Y();if(a&&!j.has(t||""))return s(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...j].join(", ")}`},400);if(N(o)&&!a)return s(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(N(o)&&c)try{const d=await oe(o),l=o===se;if(!ie(c,d.redirect_uris,{ignorePort:l}))return s(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(d){const l=d instanceof Error?d.message:String(d);return s(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${l}`},400)}M.sendMcpAuthorizationStartedMessage([{...y(p),redirect_uri:c||null}]);const f=L(e),_={isMcpFlow:!0,originalRedirectUri:c,mcpClientId:o,mcpState:i.get("state"),mcpSessionId:p,mcpCodeChallenge:a,mcpCodeChallengeMethod:a?t:null,timestamp:Date.now()};try{const d=await de(_),l=new URL(I(T.IDP_LOGIN),f);l.searchParams.set("redirectTo",`${T.MCP_CALLBACK}/${d}`);const k=B(r.getConfig().ssoDirect);return k?(l.searchParams.set("idpId",k),e.redirect(l.toString())):s(e,{error:"not_found"},404)}catch(d){const l=d instanceof Error?d.message:String(d),k=d instanceof Error?d.stack:String(d);M.sendMcpAuthorizationFailedMessage([{...y(p),error:l,error_details:k}]);const C=new URL(I(`${R}/oauth2/auth`));return C.search=i.toString(),e.redirect(C.toString())}}}async function K(r){const e=Math.floor(Date.now()/1e3),n=await S.sign({...r.claims,...r.idpId?{idpId:r.idpId}:{},...r.idpAccessTokenEnc?{idp_access_token:r.idpAccessTokenEnc}:{},...r.ttlSec?{iat:e,exp:e+r.ttlSec}:{}},m,q.HS256,r.kid),i=r.ttlSec??(typeof r.claims.exp=="number"?Math.max(r.claims.exp-e,0):b);return{accessToken:n,expiresIn:i}}async function pe(r,e,n){const i=g=>s(r,{error:"invalid_grant",error_description:g},400),c=r.get("logger"),o=n.get("refresh_token"),a=n.get("client_id")||void 0;if(!o)return s(r,{error:"invalid_request",error_description:"refresh_token is required"},400);let t;try{t=await X(o)}catch(g){return c?.warn("MCP refresh token rejected: %s",g instanceof Error?g.message:String(g)),i("Invalid refresh token")}if(a&&a!==t.client_id)return i("Client mismatch");const p=t.idp_id?e.getConfig().ssoDirect?.[t.idp_id]:void 0;let f,_,d=t.idp_access_token_enc,l=t.idp_refresh_token_enc;if(t.idp_refresh_token_enc){let g;try{g=ne(t.idp_refresh_token_enc,m)}catch{return i("Invalid refresh token")}if(!t.idp_id||!v(p))return i("Unknown identity provider");let u;try{const h=await re(t.idp_id,p);if(!h?.token_endpoint)return i("Identity provider has no token endpoint");u=await ee(h.token_endpoint,g,p)}catch(h){return c?.warn("MCP refresh failed to reach the IdP token endpoint: %s",h instanceof Error?h.message:String(h)),s(r,{error:"server_error",error_description:"Failed to refresh session"},500)}if(u.error||!(u.id_token||u.access_token))return c?.warn("MCP refresh rejected by IdP: %s",u.error||"empty token response"),i("Refresh rejected by identity provider");if(u.refresh_token&&(l=G(u.refresh_token,m)),u.access_token&&(d=H(u.access_token,m)),u.id_token)try{const h=S.decode(u.id_token);f=h.payload,_=h.header.kid}catch{return i("Invalid token response from identity provider")}}const k=v(p)&&p.tokenExpirationTime||b,C=f??t.claims,w=await K({claims:C,kid:_,idpId:t.idp_id,idpAccessTokenEnc:d,ttlSec:f?void 0:k}),O=await z({clientId:t.client_id,idpId:t.idp_id,claims:C,idpAccessTokenEnc:d,idpRefreshTokenEnc:l,sessionExp:t.session_exp});return s(r,{access_token:w.accessToken,token_type:"Bearer",expires_in:w.expiresIn,refresh_token:O,scope:E.join(" ")},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}function qe(r){return async e=>{if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{const n=await e.req.formData(),i=n.get("grant_type"),c=n.get("code"),o=n.get("redirect_uri")||void 0,a=n.get("code_verifier")||void 0;if(!$.includes(i))return s(e,{error:"invalid_request",error_description:"Invalid grant type"},400);if(i==="refresh_token")return await pe(e,r,n);if(!c)return s(e,{error:"invalid_request",error_description:"Missing authorization code"},400);try{const t=await Q(c);if(o&&o!==t.redirect_uri)return s(e,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(t.code_challenge){if(!a)return s(e,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!ce(t.code_challenge,t.code_challenge_method,a))return s(e,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(D.OAUTH_CLIENT_ID&&t.client_id&&!N(t.client_id)&&t.client_id!==D.OAUTH_CLIENT_ID)return s(e,{error:"invalid_client",error_description:"Client mismatch"},400);const p=t.id_token;if(typeof p!="string"||p.length===0)return s(e,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);const f=t.idp_access_token_enc??(t.idp_access_token?H(t.idp_access_token,m):void 0),_=S.decode(p),{accessToken:d,expiresIn:l}=await K({claims:_.payload,kid:_.header.kid,idpId:t.idp_id,idpAccessTokenEnc:f}),C=Math.floor(Date.now()/1e3)+W,w=await z({clientId:t.client_id,idpId:t.idp_id,claims:_.payload,idpAccessTokenEnc:f,idpRefreshTokenEnc:t.idp_refresh_token_enc,sessionExp:C}),O={access_token:d,token_type:"Bearer",expires_in:l,refresh_token:w,scope:E.join(" "),id_token:p};return s(e,O,200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch(t){return e.get("logger")?.warn("MCP token exchange failed: %s",t instanceof Error?t.message:String(t)),s(e,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(n){const i=n instanceof Error?n.message:String(n);return s(e,{error:"server_error",error_description:"Failed to process token request",error_details:i},500)}}}async function le(r,e){try{const{payload:n,header:i}=S.decode(r);if(typeof n.idpId=="string"&&n.idpId)return n.idpId;if(i.kid){F.jwks[i.kid]==null&&await te(e||{});const c=F.jwks[i.kid];if(c?.idpId)return c.idpId}}catch{}return B(e)}function Le(r){return async e=>{const n=new URL(e.req.url);let i=n.searchParams.get("context");if(!i&&n.pathname.startsWith(I(`${T.MCP_CALLBACK}/`))){const o=n.pathname.split("/");i=o[o.length-1]}if(!i)return M.sendMcpAuthorizationFailedMessage([{...y(null),error:"Missing context parameter",error_details:null}]),e.text("Missing context parameter",400);let c=null;try{const o=await ae(i);if(c=o.mcpSessionId||null,!o.isMcpFlow||!o.originalRedirectUri)throw new Error("Invalid MCP context");const a=A(e,U.IDP_ID_TOKEN)||A(e,U.AUTHORIZATION),t=A(e,U.IDP_ACCESS_TOKEN),p=A(e,U.IDP_REFRESH_TOKEN);if(!a)return M.sendMcpAuthorizationFailedMessage([{...y(c),error:"Authentication required",error_details:null}]),e.text("Authentication required",401);const f=await x({idToken:a,idpId:await le(a,r.getConfig().ssoDirect),idpAccessTokenEnc:t?H(t,m):void 0,idpRefreshTokenEnc:p?G(p,m):void 0,clientId:o.mcpClientId||"",redirectUri:o.originalRedirectUri,codeChallenge:o.mcpCodeChallenge||void 0,codeChallengeMethod:o.mcpCodeChallengeMethod||void 0,ttlSec:600}),_=new URL(o.originalRedirectUri);return _.searchParams.set("code",f),o.mcpState&&_.searchParams.set("state",o.mcpState),M.sendMcpAuthorizationCompletedMessage([{...y(c),redirect_uri:o.originalRedirectUri||null}]),e.redirect(_.toString())}catch(o){const a=o instanceof Error?o.message:String(o),t=o instanceof Error?o.stack:String(o);return M.sendMcpAuthorizationFailedMessage([{...y(c),error:a,error_details:t}]),e.text(`Invalid MCP callback: ${a}`,400)}}}export{$ as SUPPORTED_MCP_GRANT_TYPES,de as createMcpContextToken,De as mcpAuthorizationHandler,Le as mcpCallbackHandler,Oe as mcpDynamicClientRegistrationHandler,Ue as mcpOAuthAuthorizationServerHandler,Re as mcpOAuthProtectedResourceHandler,qe as mcpTokenPortalHandler,B as resolveMcpIdpId,ae as verifyAndParseMcpContextToken,ce as verifyPkce};

package/dist/server/web-server/routes/mcp-routes/mcp-routes.js

@@ -1 +1 @@
-import{corsMiddleware as p}from"../../middleware/corsMiddleware.js";import{ServerRoutes as n}from"../../../../constants/api.js";import{EntitlementsProvider as r}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as t}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as C,A2A_SLUG as a,MCP_SERVER_CARD_SLUG as l}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as A,mcpOAuthAuthorizationServerHandler as d,mcpDynamicClientRegistrationHandler as s,mcpAuthorizationHandler as _,mcpTokenPortalHandler as R,mcpCallbackHandler as m}from"./mcp-oauth.js";import{mcpServerCardHandler as E}from"./mcp-server-card.js";import{agentCardHandler as P}from"./agent-card.js";import{a2aHandler as T}from"./a2a.js";function N(e,i){const o=i.getConfig().mcp,c=r.instance().canAccessFeature("mcp");!o?.hide&&!o?.docs?.hide&&c&&(e.get(t(l),E(i)),e.get(t(C),P(i)),e.use(t(a),p({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(t(a),T(i)),e.get(`${n.MCP_OAUTH_PROTECTED_RESOURCE}${t("/mcp")}`,A()),e.get(n.MCP_OAUTH_AUTHORIZATION_SERVER,d()),e.post(t(n.MCP_DYNAMIC_CLIENT_REGISTRATION),s()),e.get(t(n.MCP_AUTHORIZATION),_()),e.post(t(n.MCP_TOKEN_PORTAL),R()),e.get(t(n.MCP_CALLBACK),m()),e.get(t(`${n.MCP_CALLBACK}/*`),m()))}export{N as installMcpRoutes};
+import{corsMiddleware as o}from"../../middleware/corsMiddleware.js";import{ServerRoutes as a}from"../../../../constants/api.js";import{EntitlementsProvider as C}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as i}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as l,A2A_SLUG as t,MCP_SERVER_CARD_SLUG as A}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as d,mcpOAuthAuthorizationServerHandler as _,mcpDynamicClientRegistrationHandler as r,mcpAuthorizationHandler as R,mcpTokenPortalHandler as E,mcpCallbackHandler as c}from"./mcp-oauth.js";import{mcpServerCardHandler as P}from"./mcp-server-card.js";import{agentCardHandler as T}from"./agent-card.js";import{a2aHandler as s}from"./a2a.js";function N(e,n){const m=n.getConfig().mcp,p=C.instance().canAccessFeature("mcp");!m?.hide&&!m?.docs?.hide&&p&&(e.get(i(A),P(n)),e.get(i(l),T(n)),e.use(i(t),o({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(i(t),s(n)),e.get(`${a.MCP_OAUTH_PROTECTED_RESOURCE}${i("/mcp")}`,d(n)),e.get(a.MCP_OAUTH_AUTHORIZATION_SERVER,_(n)),e.post(i(a.MCP_DYNAMIC_CLIENT_REGISTRATION),r(n)),e.get(i(a.MCP_AUTHORIZATION),R(n)),e.post(i(a.MCP_TOKEN_PORTAL),E(n)),e.get(i(a.MCP_CALLBACK),c(n)),e.get(i(`${a.MCP_CALLBACK}/*`),c(n)))}export{N as installMcpRoutes};

package/dist/server/web-server/routes/mcp-routes/mcp-server-card.js

@@ -1 +1 @@
-import{LATEST_PROTOCOL_VERSION as f}from"@redocly/mcp-typescript-sdk/types.js";import{withPathPrefix as h}from"@redocly/theme/core/utils";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"../../../plugins/mcp/constants.js";import{RESERVED_ROUTES as O}from"../../../plugins/get-reserved-routes.js";import{isMcpCodeModeEnabled as T}from"../../../plugins/mcp/utils/mode.js";import{CODE_MODE_TOOL_NAMES as A,DESCRIBE_TOOLS_TOOL_NAME as R,FETCH_TOOL_NAME as g}from"../../../plugins/mcp/codemode/constants.js";import{EXECUTE_TOOL_SCHEMA as M}from"../../../plugins/mcp/codemode/tools/execute-schema.js";import{describeToolsSchema as b}from"../../../plugins/mcp/codemode/tools/describe-tools.js";import{buildCodeModeInstructions as L,buildExecuteDescription as v,DESCRIBE_TOOLS_DESCRIPTION as D}from"../../../plugins/mcp/codemode/prompts.js";import{composeExecuteAnnotations as I}from"../../../plugins/mcp/codemode/capabilities/index.js";import{ALL_CAPABILITIES as P}from"../../../plugins/mcp/codemode/capabilities/registry.js";import{isGatewayCapabilityEnabled as V}from"../../../plugins/mcp/gateway-mcp/eligibility.js";import{shouldHandleMcpAuth as y}from"../../../plugins/mcp/auth/auth-handlers.js";import{resolvePublicBaseUrl as H}from"../../../web-server/utils/resolve-public-base-url.js";import{telemetryTraceStep as N}from"../../../telemetry/helpers/trace-step.js";import{MCP_AUTH_SCHEMES as U}from"./constants.js";const x="https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",w="1.0";function to(t){const r=T(),E=new Date().toISOString().slice(0,10);return async c=>await N("mcp_server_card",async s=>{const o=t.getConfig(),m=o.mcp?.docs?.name||S,a=t.getMcpTools().filter(e=>!A.has(e.name)),i=V(o.mcp)?[...P]:[],l=i.some(e=>e.id===g),n=(r?[{...M,description:v(l),annotations:I(i)},{name:R,description:D,schema:b(a,i)}]:a).map(({name:e,description:C,schema:_,annotations:p})=>({name:e,description:C,inputSchema:_,...p?{annotations:p}:{}})),u=o.skills?.hide===!0?[]:t.getSkills(),d={$schema:x,version:w,protocolVersion:f,serverInfo:{name:m,title:m,version:E},description:o.seo?.description,documentationUrl:H(t,c),transport:{type:"streamable-http",endpoint:h(O.mcp)},capabilities:{logging:{},tools:{listChanged:!0},...u.length>0?{resources:{listChanged:!0},completions:{}}:{}},authentication:y(!!o.access?.requiresLogin,o.access?.rbac)?{required:!0,schemes:U}:void 0,instructions:r?L(l):void 0,tools:n.length>0?n:["dynamic"]};return s?.setAttribute("mode",r?"code":"tools"),s?.setAttribute("toolsCount",n.length),s?.setAttribute("authRequired",d.authentication!==void 0),c.json(d,200,{"Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=3600"})})}export{to as mcpServerCardHandler};
+import{withPathPrefix as S}from"@redocly/theme/core/utils";import{DEFAULT_DOCS_MCP_SERVER_NAME as h,MCP_PROTOCOL_VERSION as f}from"../../../plugins/mcp/constants.js";import{RESERVED_ROUTES as O}from"../../../plugins/get-reserved-routes.js";import{isMcpCodeModeEnabled as A}from"../../../plugins/mcp/utils/mode.js";import{CODE_MODE_TOOL_NAMES as T,DESCRIBE_TOOLS_TOOL_NAME as b,FETCH_TOOL_NAME as M}from"../../../plugins/mcp/codemode/constants.js";import{EXECUTE_TOOL_SCHEMA as R}from"../../../plugins/mcp/codemode/tools/execute-schema.js";import{describeToolsSchema as g}from"../../../plugins/mcp/codemode/tools/describe-tools.js";import{buildCodeModeInstructions as v,buildExecuteDescription as I,DESCRIBE_TOOLS_DESCRIPTION as L}from"../../../plugins/mcp/codemode/prompts.js";import{composeExecuteAnnotations as D}from"../../../plugins/mcp/codemode/capabilities/index.js";import{ALL_CAPABILITIES as P}from"../../../plugins/mcp/codemode/capabilities/registry.js";import{isGatewayCapabilityEnabled as y}from"../../../plugins/mcp/gateway-mcp/eligibility.js";import{shouldHandleMcpAuth as V}from"../../../plugins/mcp/auth/auth-handlers.js";import{resolvePublicBaseUrl as H}from"../../../web-server/utils/resolve-public-base-url.js";import{telemetryTraceStep as N}from"../../../telemetry/helpers/trace-step.js";import{MCP_AUTH_SCHEMES as U}from"./constants.js";const x="https://static.modelcontextprotocol.io/schemas/mcp-server-card/v1.json",w="1.0";function oe(r){const i=A(),u=new Date().toISOString().slice(0,10);return async c=>await N("com.redocly.mcpServerCard.served",async e=>{e?.setAttribute("id","mcpServerCardId"),e?.setAttribute("object","mcpServerCard"),e?.setAttribute("uri","urn:redocly:realm:api:mcpServerCard:mcpServerCardId");const o=r.getConfig(),m=o.mcp?.docs?.name||h,a=r.getMcpTools().filter(t=>!T.has(t.name)),s=y(o.mcp)?[...P]:[],d=s.some(t=>t.id===M),n=(i?[{...R,description:I(d),annotations:D(s)},{name:b,description:L,schema:g(a,s)}]:a).map(({name:t,description:E,schema:_,annotations:p})=>({name:t,description:E,inputSchema:_,...p?{annotations:p}:{}})),C=o.skills?.hide===!0?[]:r.getSkills(),l={$schema:x,version:w,protocolVersion:f,serverInfo:{name:m,title:m,version:u},description:o.seo?.description,documentationUrl:H(r,c),transport:{type:"streamable-http",endpoint:S(O.mcp)},capabilities:{logging:{},tools:{listChanged:!0},...C.length>0?{resources:{listChanged:!0},completions:{}}:{}},authentication:V(!!o.access?.requiresLogin,o.access?.rbac)?{required:!0,schemes:U}:void 0,instructions:i?v(d):void 0,tools:n.length>0?n:["dynamic"]};return e?.setAttribute("mode",i?"code":"tools"),e?.setAttribute("toolsCount",n.length),e?.setAttribute("authRequired",l.authentication!==void 0),c.json(l,200,{"Access-Control-Allow-Origin":"*","Cache-Control":"public, max-age=3600"})})}export{oe as mcpServerCardHandler};

package/dist/server/web-server/routes/mcp-routes/utils/build-agent-card.d.ts

@@ -1,7 +1,7 @@
 import type { SeoConfig } from '@redocly/config';
 import type { Skill } from '../../../../types/plugins/skills.js';
 import type { AgentCard } from '../types.js';
-export declare function buildAgentCard({ seo, baseUrl, skills, mcpAuthRequired }: {
+export declare function buildAgentCard({ seo, baseUrl, skills, mcpAuthRequired, }: {
     seo: SeoConfig | undefined;
     baseUrl: string;
     skills: Skill[];

package/dist/server/web-server/routes/page-data.js

@@ -1 +1 @@
-import{ServerRoutes as w}from"../../../constants/api.js";import{DEV_LOGIN_SLUG as U}from"../../../constants/common.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as r,DEFAULT_TITLE as $}from"../../constants/common.js";import{findInIterable as F}from"../../../utils/collection/find-in-iterable.js";import{removeTrailingSlash as N}from"../../../utils/url/remove-trailing-slash.js";import{envConfig as b}from"../../config/env-config.js";import{canAccessResource as q,filterDataByAccessDeep as T,isResourcePubliclyAccessible as B}from"../../utils/rbac.js";import{getServerProps as H}from"../../ssr/index.js";import{readSharedData as M}from"../../utils/index.js";import{getRedirectLoginUrl as G}from"../utils/get-redirect-login-url.js";import{processRedirects as V}from"./helpers/process-redirects.js";import{removeErrorDetails as W}from"../utils/remove-error-details.js";import{telemetry as k}from"../../telemetry/index.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as K}from"../../plugins/mcp/constants.js";function ie(e,n){return async(t,g)=>{const m=t.get("logger"),{req:p}=t,{pathname:d}=new URL(p.url),{seo:f,ssoDirect:h}=e.getConfig(),i=f?.title||$;if(e?.compilationErrors?.length&&b.isDevelopMode)return t.json({templateId:"compilation-error",props:{compilationErrors:e?.compilationErrors},sharedDataIds:{}},500,{"Cache-Control":r});const u=d.match(/page-data(.*)data.json$/);if(!u)return g();const c=decodeURI(u[1]),s=c==="/index/"?"/":N(c),o=e.getRouteBySlug(s,{followRedirect:!1})||F(e.routesBySlug.values(),a=>a.hasClientRoutes&&c.startsWith(a.slug+"/"));if(c===w.OIDC_CALLBACK+"/")return t.json({templateId:"403OIDC",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}}},200,{"Cache-Control":r});const{isAuthenticated:C,teams:D,claims:{name:j,picture:A,email:I}}=t.get("auth"),R={isAuthenticated:C,email:I,teams:D},l={isAuthenticated:C,name:j,picture:A,email:I,teams:D};if(s==="/mcp"&&e.globalData.mcpData?.docs?.enabled)return t.json({templateId:K,sharedDataIds:{},props:{},userData:l},405,{"Cache-Control":r});const L=e.getRedirect(s);if(L){const a=V({redirect:L}).location;return k.sendRedirectMessage([{object:"redirect",from:s,templateId:"404"}]),t.json({templateId:"404",redirectTo:a,sharedDataIds:{},props:{}},301,{"Cache-Control":r})}if(!o){const a=e.getRouteBySlug(s,{followRedirect:!0});return m.error(`Page not found: ${d}`),t.json({templateId:"404",redirectTo:a?.slug,sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l},404,{"Cache-Control":r})}if(m.verbose(`Page viewed: ${o.slug}`),!q(o,R,e.config.access?.rbac,e.config.access?.requiresLogin)&&o.slug!==U){if(C)return t.json({templateId:"403",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}},userData:l},403,{"Cache-Control":r});const a=Object.keys(h||{}).length>0;return t.json({templateId:"404",sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l,...a?{redirectTo:G(e,o.slug)}:{}},a?401:404,{"Cache-Control":r})}const S=T(o.versions,R,e.config.access?.rbac,e.config.access?.requiresLogin),_=e.routesSharedData.get(o.slug)||{},v=await n(o),P=await H(o,t,v,e),{sharedDataIds:O,...E}=P,y={templateId:o.templateId,versions:S,sharedDataIds:{..._,...O||{}},props:b.isProductionEnv?W(E):E,slug:o.slug,userData:l,isPublic:B(o,e.config)};return t.json(y,200,{"Cache-Control":r})}}function ce(e){return async(n,t)=>{const g=n.get("logger"),{req:m}=n,{pathname:p}=new URL(m.url),d=p.match(/\/page-data\/shared\/(.*)\.json/);if(!d)return t();const f=decodeURIComponent(d[1]),h=await M(f,e.outdir),{isAuthenticated:i,teams:u,claims:{email:c}}=n.get("auth"),s=T(h,{isAuthenticated:i,email:c,teams:u},e.config.access?.rbac,e.config.access?.requiresLogin);return s?n.json(s,200,{"Cache-Control":r}):(g.error(`Shared data not found: ${p}`),n.text("Not Found",404,{"Cache-Control":r}))}}export{ie as pageDataHandler,ce as sharedPageDataHandler};
+import{ServerRoutes as $}from"../../../constants/api.js";import{DEV_LOGIN_SLUG as w}from"../../../constants/common.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as a,DEFAULT_TITLE as U}from"../../constants/common.js";import{findInIterable as F}from"../../../utils/collection/find-in-iterable.js";import{removeTrailingSlash as N}from"../../../utils/url/remove-trailing-slash.js";import{envConfig as b}from"../../config/env-config.js";import{canAccessResource as q,filterDataByAccessDeep as T,isResourcePubliclyAccessible as B}from"../../utils/rbac.js";import{getServerProps as H}from"../../ssr/index.js";import{readSharedData as M}from"../../utils/index.js";import{getRedirectLoginUrl as G}from"../utils/get-redirect-login-url.js";import{processRedirects as V}from"./helpers/process-redirects.js";import{removeErrorDetails as W}from"../utils/remove-error-details.js";import{telemetry as k}from"../../telemetry/index.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as K}from"../../plugins/mcp/constants.js";function ie(e,n){return async(t,g)=>{const m=t.get("logger"),{req:p}=t,{pathname:d}=new URL(p.url),{seo:f,ssoDirect:h}=e.getConfig(),i=f?.title||U;if(e?.compilationErrors?.length&&b.isDevelopMode)return t.json({templateId:"compilation-error",props:{compilationErrors:e?.compilationErrors},sharedDataIds:{}},500,{"Cache-Control":a});const u=d.match(/page-data(.*)data.json$/);if(!u)return g();const c=decodeURI(u[1]),r=c==="/index/"?"/":N(c),o=e.getRouteBySlug(r,{followRedirect:!1})||F(e.routesBySlug.values(),s=>s.hasClientRoutes&&c.startsWith(s.slug+"/"));if(c===$.OIDC_CALLBACK+"/")return t.json({templateId:"403OIDC",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}}},200,{"Cache-Control":a});const{isAuthenticated:C,teams:D,claims:{name:j,picture:A,email:I}}=t.get("auth"),R={isAuthenticated:C,email:I,teams:D},l={isAuthenticated:C,name:j,picture:A,email:I,teams:D};if(r==="/mcp"&&e.globalData.mcpData?.docs?.enabled)return t.json({templateId:K,sharedDataIds:{},props:{},userData:l},405,{"Cache-Control":a});const L=e.getRedirect(r);if(L){const s=V({redirect:L}).location;return k.sendRedirectMessage([{id:r,object:"redirect",uri:`urn:redocly:realm:api:redirect:${r}`,from:r,templateId:"404"}]),t.json({templateId:"404",redirectTo:s,sharedDataIds:{},props:{}},301,{"Cache-Control":a})}if(!o){const s=e.getRouteBySlug(r,{followRedirect:!0});return m.error(`Page not found: ${d}`),t.json({templateId:"404",redirectTo:s?.slug,sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l},404,{"Cache-Control":a})}if(m.verbose(`Page viewed: ${o.slug}`),!q(o,R,e.config.access?.rbac,e.config.access?.requiresLogin)&&o.slug!==w){if(C)return t.json({templateId:"403",sharedDataIds:{},props:{seo:{title:`${i} - Forbidden`}},userData:l},403,{"Cache-Control":a});const s=Object.keys(h||{}).length>0;return t.json({templateId:"404",sharedDataIds:{},props:{seo:{title:`${i} - Not Found`}},userData:l,...s?{redirectTo:G(e,o.slug)}:{}},s?401:404,{"Cache-Control":a})}const S=T(o.versions,R,e.config.access?.rbac,e.config.access?.requiresLogin),_=e.routesSharedData.get(o.slug)||{},v=await n(o),P=await H(o,t,v,e),{sharedDataIds:y,...E}=P,O={templateId:o.templateId,versions:S,sharedDataIds:{..._,...y||{}},props:b.isProductionEnv?W(E):E,slug:o.slug,userData:l,isPublic:B(o,e.config)};return t.json(O,200,{"Cache-Control":a})}}function ce(e){return async(n,t)=>{const g=n.get("logger"),{req:m}=n,{pathname:p}=new URL(m.url),d=p.match(/\/page-data\/shared\/(.*)\.json/);if(!d)return t();const f=decodeURIComponent(d[1]),h=await M(f,e.outdir),{isAuthenticated:i,teams:u,claims:{email:c}}=n.get("auth"),r=T(h,{isAuthenticated:i,email:c,teams:u},e.config.access?.rbac,e.config.access?.requiresLogin);return r?n.json(r,200,{"Cache-Control":a}):(g.error(`Shared data not found: ${p}`),n.text("Not Found",404,{"Cache-Control":a}))}}export{ie as pageDataHandler,ce as sharedPageDataHandler};

package/dist/server/web-server/routes/resolve-route.js

@@ -1 +1 @@
-import{Source as m}from"@redocly/openapi-core";import g from"node:fs/promises";import d from"node:path";import{withPathPrefix as S,getPathPrefix as h,combineUrls as E}from"@redocly/theme/core/utils";import{OPENAPI_SHARED_DATA_PREFIX as P}from"../../constants/plugins/openapi-docs.js";import{CATALOG_BASE_SLUG as y,CATALOG_SLUGS as _}from"../../../constants/catalog-entities.js";import{CATALOG_ENTITIES_FILES_REGEX as I}from"../../constants/plugins/catalog-entities.js";import{removeTrailingSlash as T}from"../../../utils/url/remove-trailing-slash.js";import{normalizeRouteSlug as U}from"../../../utils/path/normalize-route-slug.js";import{promiseMapLimit as $}from"../../utils/async/promise-map-limit.js";import{getRoutesByLines as R,getPointerPosition as q}from"../../plugins/openapi-docs/ast-utils.js";import{readSharedData as j}from"../../utils/index.js";function X(o){return async t=>{const s=await t.req.json(),n=decodeURI(T(s.split("?")[0])),[e]=n.split("#"),u=h(),a=U(e.slice(u.length)),l=a.startsWith(y)?y:a,r=o.getRouteBySlug(l);if(r&&o.getRouteByFsPath(r.fsPath)?.metadata?.type==="openapi"){const c=await j(`${P}${r.fsPath}`,o.outdir),i=Object.keys(c.routesMapping).find(p=>E(r.baseSlug,c.routesMapping[p])===n);if(!c.sourcePath)return t.json({route:r},200);let f;if(i){const p=d.join(o.contentDir,r.fsPath),b=await g.readFile(p,"utf-8"),L=new m(p,b);f=q(i,L)}return t.json({route:{fsPath:r.fsPath,pointer:i,position:f}},200)}return t.json({route:r},200)}}function k(o){return async t=>{const s=await t.req.json(),n=await $(s,5,async e=>A(e,o));return t.json({routes:n},200)}}function J(o){return async t=>{const s=await t.req.json(),n=await A(s,o);return t.json(n,200)}}function K(o){return async t=>{const s=(t.req.query("lines")||"").split(",").map(a=>parseInt(a)),n=t.req.query("file");if(!n)return t.json("No data",400);const e=await j(`${P}${n}`,o.outdir),u=d.join(o.contentDir,n);try{const a=await g.readFile(u,"utf-8");if(!e)return t.json("No data",400);const l=new m(u,a),r=R(s,l,e.routesMapping,e.baseSlug);return t.json(r,200)}catch{return t.json("No data",400)}}}async function A(o,t){const[s,n]=o.split(":");if(I.test(s))return{route:{slug:`${y}/${_.ALL}`}};let e=t.getRouteByFsPath(s);if(e?.metadata?.type==="openapi"){const l=await j(`${P}${s}`,t.outdir);if(l?.sourcePath){const r=d.join(t.contentDir,e.fsPath),w=await g.readFile(r,"utf-8"),c=new m(r,w),i=R([parseInt(n,10)],c,l.routesMapping,e.baseSlug);if(i.length)return{route:{slug:h()?S(i[0]):i[0],filePath:o}}}}const u=e?.slug?h()?S(e?.slug):e?.slug:"";return{route:{...e,pageName:e?await e?.getNavText?.():"",slug:u,filePath:o}}}export{K as getRoutesByLineHandler,J as resolvePathHandler,k as resolvePathsHandler,X as resolveSlugHandler};
+import{Source as P}from"@redocly/openapi-core";import y from"node:fs/promises";import S from"node:path";import{withPathPrefix as j,getPathPrefix as h,combineUrls as w}from"@redocly/theme/core/utils";import{API_DOCS_SHARED_DATA_PREFIX as d}from"../../constants/plugins/api-docs.js";import{CATALOG_BASE_SLUG as b,CATALOG_SLUGS as $}from"../../../constants/catalog-entities.js";import{CATALOG_ENTITIES_FILES_REGEX as I}from"../../constants/plugins/catalog-entities.js";import{removeTrailingSlash as E}from"../../../utils/url/remove-trailing-slash.js";import{normalizeRouteSlug as N}from"../../../utils/path/normalize-route-slug.js";import{promiseMapLimit as T}from"../../utils/async/promise-map-limit.js";import{getRoutesByLines as L,getPointerPosition as U}from"../../plugins/openapi-docs/ast-utils.js";import{readSharedData as m}from"../../utils/index.js";const q=new Set(["openapi","asyncapi"]);function K(n){return async t=>{const i=await t.req.json(),r=decodeURI(E(i.split("?")[0])),[o]=r.split("#"),g=h(),f=N(o.slice(g.length)),u=f.startsWith(b)?b:f,e=n.getRouteBySlug(u);if(e){const p=n.getRouteByFsPath(e.fsPath);if(p?.metadata?.type&&q.has(p.metadata.type)){const a=await m(`${d}${e.fsPath}`,n.outdir);if(!a?.routesMapping)return t.json({route:e},200);const s=Object.keys(a.routesMapping).find(c=>w(e.baseSlug,a.routesMapping[c])===r);if(!a.sourcePath)return t.json({route:e},200);let l;if(s){const c=S.join(n.contentDir,e.fsPath),R=await y.readFile(c,"utf-8"),_=new P(c,R);l=U(s,_)}return t.json({route:{fsPath:e.fsPath,pointer:s,position:l}},200)}if(p?.metadata?.type==="graphql"){const a=await m(`${d}${e.fsPath}`,n.outdir);if(!a?.graphqlPositions)return t.json({route:e},200);const s=Object.keys(a.graphqlPositions).find(c=>w(e.baseSlug,c)===r),l=s?a.graphqlPositions[s].position:void 0;return t.json({route:{fsPath:e.fsPath,position:l}},200)}}return t.json({route:e},200)}}function X(n){return async t=>{const i=await t.req.json(),r=await T(i,5,async o=>A(o,n));return t.json({routes:r},200)}}function Y(n){return async t=>{const i=await t.req.json(),r=await A(i,n);return t.json(r,200)}}function J(n){return async t=>{const i=(t.req.query("lines")||"").split(",").map(f=>parseInt(f)),r=t.req.query("file");if(!r)return t.json("No data",400);const o=await m(`${d}${r}`,n.outdir),g=S.join(n.contentDir,r);try{const f=await y.readFile(g,"utf-8");if(!o)return t.json("No data",400);const u=new P(g,f),e=L(i,u,o.routesMapping,o.baseSlug);return t.json(e,200)}catch{return t.json("No data",400)}}}async function A(n,t){const[i,r]=n.split(":");if(I.test(i))return{route:{slug:`${b}/${$.ALL}`}};let o=t.getRouteByFsPath(i);if(o?.metadata?.type&&q.has(o.metadata.type)){const u=await m(`${d}${i}`,t.outdir);if(u?.sourcePath){const e=S.join(t.contentDir,o.fsPath),p=await y.readFile(e,"utf-8"),a=new P(e,p),s=L([parseInt(r,10)],a,u.routesMapping,o.baseSlug);if(s.length)return{route:{slug:h()?j(s[0]):s[0],filePath:n}}}}if(o?.metadata?.type==="graphql"){const u=await m(`${d}${i}`,t.outdir),e=parseInt(r,10);if(u?.sourcePath&&u.graphqlPositions&&!Number.isNaN(e)){let p,a=1/0;for(const[s,{startLine:l,endLine:c}]of Object.entries(u.graphqlPositions))l<=e&&e<=c&&c-l<a&&(a=c-l,p=s);if(p){const s=w(o.baseSlug,p);return{route:{slug:h()?j(s):s,filePath:n}}}}}const g=o?.slug?h()?j(o?.slug):o?.slug:"";return{route:{...o,pageName:o?await o?.getNavText?.():"",slug:g,filePath:n}}}export{J as getRoutesByLineHandler,Y as resolvePathHandler,X as resolvePathsHandler,K as resolveSlugHandler};

package/dist/server/web-server/routes/search.js

@@ -1 +1 @@
-import{telemetryTraceStep as C}from"../../telemetry/helpers/trace-step.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as T}from"../../constants/common.js";import{expandTeamsForRead as E}from"../../utils/rbac.js";function F(e){return async t=>(t.header("Cache-Control",T),await C("search",async s=>{const i=t.get("logger"),a=t.get("auth"),A=i.startTiming(),o=e.getConfig().access?.requiresLogin&&!a.isAuthenticated,u=t.req.valid("json");s?.setAttribute("engine",e?.searchEngine?.type),s?.setAttribute("query",u.query||""),s?.setAttribute("user",a.claims.email??"anonymous"),s?.setAttribute("noAccess",o);const g=e.getSearchFacets(),r=o?{}:e.searchEngine?await e.searchEngine.search(u,{...a,teams:E(e.config.access?.rbac,a.teams)},g):{};let l=0;if(Object.keys(r).length){const f=r.documents;for(const[c,n]of Object.entries(f))l+=n.length}return i.infoTime(A,`Search with query "${u.query||""}". Total results: ${l}`),s?.setAttribute("resultsCount",l),t.json(r)}))}function j(e){return async t=>(t.header("Cache-Control",T),await C("search.facets",async s=>{const i=t.get("logger"),a=t.get("auth"),m=e.getConfig().access?.requiresLogin&&!a.isAuthenticated,o=t.req.valid("json");s?.setAttribute("engine",e?.searchEngine?.type),s?.setAttribute("user",a.claims.email??"anonymous"),s?.setAttribute("noAccess",m);const u=i.startTiming(),g=e.getSearchFacets(),r=m?{}:e.searchEngine?await e.searchEngine.countFacets(o,a,g):{},l=!!o.field;let f=[];if(l){const c=o.field,n=c&&g.get(c);if(n){const h={...n};h.values=r?.[c]||[],f.push(h)}}else{const c=new Map;for(const[n,h]of g){const y=r?.[n],d={...h};d.values=y||h.values.map(b=>({value:b,count:0})),c.set(n,d)}f=Array.from(c,([,n])=>n)}return i.verboseTime(u,"Search facets"),t.json(f)}))}export{j as searchFacetsHandler,F as searchHandler};
+import{telemetryTraceStep as b}from"../../telemetry/helpers/trace-step.js";import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as C}from"../../constants/common.js";import{expandTeamsForRead as E}from"../../utils/rbac.js";function v(t){return async s=>(s.header("Cache-Control",C),await b("com.redocly.search.performed",async e=>{e?.setAttribute("id","searchQueryId"),e?.setAttribute("object","searchQuery"),e?.setAttribute("uri","urn:redocly:realm:api:searchQuery:searchQueryId");const i=s.get("logger"),r=s.get("auth"),d=i.startTiming(),a=t.getConfig().access?.requiresLogin&&!r.isAuthenticated,u=s.req.valid("json");e?.setAttribute("engine",t?.searchEngine?.type),e?.setAttribute("query",u.query||""),e?.setAttribute("user",r.claims.email??"anonymous"),e?.setAttribute("noAccess",a);const l=t.getSearchFacets(),o=a?{}:t.searchEngine?await t.searchEngine.search(u,{...r,teams:E(t.config.access?.rbac,r.teams)},l):{};let h=0;if(Object.keys(o).length){const g=o.documents;for(const[c,n]of Object.entries(g))h+=n.length}return i.infoTime(d,`Search with query "${u.query||""}". Total results: ${h}`),e?.setAttribute("resultsCount",h),s.json(o)}))}function p(t){return async s=>(s.header("Cache-Control",C),await b("com.redocly.search.facets",async e=>{e?.setAttribute("id","searchFacetsId"),e?.setAttribute("object","searchFacets"),e?.setAttribute("uri","urn:redocly:realm:api:searchFacets:searchFacetsId");const i=s.get("logger"),r=s.get("auth"),m=t.getConfig().access?.requiresLogin&&!r.isAuthenticated,a=s.req.valid("json");e?.setAttribute("engine",t?.searchEngine?.type),e?.setAttribute("user",r.claims.email??"anonymous"),e?.setAttribute("noAccess",m);const u=i.startTiming(),l=t.getSearchFacets(),o=m?{}:t.searchEngine?await t.searchEngine.countFacets(a,r,l):{},h=!!a.field;let g=[];if(h){const c=a.field,n=c&&l.get(c);if(n){const f={...n};f.values=o?.[c]||[],g.push(f)}}else{const c=new Map;for(const[n,f]of l){const y=o?.[n],A={...f};A.values=y||f.values.map(T=>({value:T,count:0})),c.set(n,A)}g=Array.from(c,([,n])=>n)}return i.verboseTime(u,"Search facets"),s.json(g)}))}export{p as searchFacetsHandler,v as searchHandler};

package/dist/server/web-server/routes/skills/skill-markdown.js

@@ -1 +1 @@
-import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as c}from"../../../constants/common.js";import{telemetryTraceStep as a}from"../../../telemetry/helpers/trace-step.js";import{canAccessSkill as m}from"../../../utils/skills/can-access-skill.js";import{MIME_TYPES as u}from"../../mime-types.js";import{getContentTypeHeaderValue as p}from"../../utils/content-type.js";function _(n){return async e=>await a("agent_skill",async r=>{const t=e.req.param("slug")??"";if(r?.setAttribute("skill",t),n.config.skills?.hide===!0)return e.newResponse(null,404);const s=n.skills.get(t),{isAuthenticated:l,teams:i,claims:{email:o}}=e.get("auth");return s&&m(s,{isAuthenticated:l,teams:i,email:o},n.config.access?.rbac,n.config.access?.requiresLogin)?e.newResponse(s.content,200,{"Content-Type":p(u[".md"]),"Cache-Control":c,"Access-Control-Allow-Origin":"*"}):e.newResponse(null,404)})}export{_ as skillMarkdownHandler};
+import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as c}from"../../../constants/common.js";import{telemetryTraceStep as a}from"../../../telemetry/helpers/trace-step.js";import{canAccessSkill as u}from"../../../utils/skills/can-access-skill.js";import{MIME_TYPES as m}from"../../mime-types.js";import{getContentTypeHeaderValue as g}from"../../utils/content-type.js";function y(n){return async e=>await a("com.redocly.agentSkill.served",async t=>{t?.setAttribute("object","agentSkill");const r=e.req.param("slug")??"";if(t?.setAttribute("id",r),t?.setAttribute("uri",`urn:redocly:realm:api:agentSkill:${r}`),t?.setAttribute("skill",r),n.config.skills?.hide===!0)return e.newResponse(null,404);const s=n.skills.get(r),{isAuthenticated:i,teams:l,claims:{email:o}}=e.get("auth");return s&&u(s,{isAuthenticated:i,teams:l,email:o},n.config.access?.rbac,n.config.access?.requiresLogin)?e.newResponse(s.content,200,{"Content-Type":g(m[".md"]),"Cache-Control":c,"Access-Control-Allow-Origin":"*"}):e.newResponse(null,404)})}export{y as skillMarkdownHandler};

package/dist/server/web-server/routes/skills/skills-index.js

@@ -1 +1 @@
-import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as o}from"../../../constants/common.js";import{telemetryTraceStep as c}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as a}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as u}from"../../utils/resolve-public-base-url.js";import{buildSkillsIndex as m}from"./build-skills-index.js";function b(e){return async i=>await c("agent_skills_index",async l=>{if(e.config.skills?.hide===!0)return l?.setAttribute("skillsCount",0),i.newResponse(null,404);const{isAuthenticated:t,teams:n,claims:{email:r}}=i.get("auth"),s=a(e.getSkills(),{isAuthenticated:t,teams:n,email:r},e.config.access?.rbac,e.config.access?.requiresLogin);return l?.setAttribute("skillsCount",s.length),i.json(m(s,u(e,i)),200,{"Cache-Control":o,"Access-Control-Allow-Origin":"*"})})}export{b as skillsIndexHandler};
+import{CACHE_CONTROL_NO_STORE_HEADER_VALUE as o}from"../../../constants/common.js";import{telemetryTraceStep as u}from"../../../telemetry/helpers/trace-step.js";import{getAccessibleSkills as a}from"../../../utils/skills/get-accessible-skills.js";import{resolvePublicBaseUrl as c}from"../../utils/resolve-public-base-url.js";import{buildSkillsIndex as d}from"./build-skills-index.js";function f(e){return async l=>await u("com.redocly.agentSkillsIndex.served",async i=>{if(i?.setAttribute("id","agentSkillsIndexId"),i?.setAttribute("object","agentSkillsIndex"),i?.setAttribute("uri","urn:redocly:realm:api:agentSkillsIndex:agentSkillsIndexId"),e.config.skills?.hide===!0)return i?.setAttribute("skillsCount",0),l.newResponse(null,404);const{isAuthenticated:s,teams:n,claims:{email:r}}=l.get("auth"),t=a(e.getSkills(),{isAuthenticated:s,teams:n,email:r},e.config.access?.rbac,e.config.access?.requiresLogin);return i?.setAttribute("skillsCount",t.length),l.json(d(t,c(e,l)),200,{"Cache-Control":o,"Access-Control-Allow-Origin":"*"})})}export{f as skillsIndexHandler};

package/dist/server/web-server/utils/prepare-list-response.d.ts

@@ -15,7 +15,7 @@ export type ListResponseResult<T extends {
 };
 export declare function prepareListResponse<T extends {
     id: string;
-}>({ data, params, totalCount, nameTransformationsFromDatabase, hasMore }: {
+}>({ data, params, totalCount, nameTransformationsFromDatabase, hasMore, }: {
     data: T[];
     params: PaginationParams;
     totalCount?: number;

package/dist/server/workers/api-routes-worker-pool.js

@@ -1 +1 @@
-import{getAllowedEnvs as r}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as o}from"./worker-pool.js";const p="executeApiRoute",e=3,i=new o({workerScript:"./api-routes-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:r,lazy:!0});export{p as API_ROUTES_WORKER_KEY,i as apiRoutesWorkers};
+import{getAllowedEnvs as r}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as o}from"./worker-pool.js";const p="executeApiRoute",e=3,i=new o({workerScript:"./api-routes-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:r,lazy:!0,sandbox:!0});export{p as API_ROUTES_WORKER_KEY,i as apiRoutesWorkers};

package/dist/server/workers/mcp-tool-worker-pool.js

@@ -1 +1 @@
-import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",c="isMcpToolAvailable",e=5,l=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0});export{c as MCP_TOOL_IS_AVAILABLE_KEY,p as MCP_TOOL_WORKER_KEY,l as mcpToolWorkers};
+import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",c="isMcpToolAvailable",e=5,l=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0,sandbox:!0});export{c as MCP_TOOL_IS_AVAILABLE_KEY,p as MCP_TOOL_WORKER_KEY,l as mcpToolWorkers};

package/dist/server/workers/worker-pool.d.ts

@@ -3,6 +3,7 @@ import type { WorkerTypeMapping, WorkerParams, WorkerResponse } from './types.js
 export type WorkerPoolConfig = {
     workerScript: string;
     lazy: boolean;
+    sandbox?: boolean;
     resolveForkEnv?: () => Record<string, string | undefined>;
 } & WorkerPoolOptions;
 type RegisteredWorkers = keyof WorkerTypeMapping;

package/dist/server/workers/worker-pool.js

@@ -1 +1 @@
-import n from"workerpool";import{basename as a,dirname as s,resolve as l}from"node:path";import{fileURLToPath as h}from"node:url";import{envConfig as m}from"../config/env-config.js";class v{#t=null;#r;constructor(o){this.#r=o,this.#r.lazy||(this.#t=this.#o())}#o(){const{workerScript:o,lazy:t,resolveForkEnv:r,...e}=this.#r;let i=this.#e(o);return r&&e.forkOpts&&(e.forkOpts={...e.forkOpts,env:r()}),n.pool(i,{...e})}#e(o){let t=o;if(!t.endsWith(".js")&&!t.endsWith(".mjs")&&(t=`${t}.${m.isDevelopMode?"js":"mjs"}`),!t.startsWith("."))return t;const r=s(h(import.meta.url)),e=a(r)==="chunks"?s(r):r;return l(e,t)}#i(){return this.#t||(this.#t=this.#o()),this.#t}async exec(o,t,r){let i=this.#i().exec(o,t);return r?.timeout&&(i=i.timeout(r.timeout)),await i}async terminate(){this.#t&&(await this.#t.terminate(),this.#t=null)}}export{v as WorkerPool};
+import l from"workerpool";import{mkdirSync as m}from"node:fs";import{basename as u,dirname as c,resolve as f}from"node:path";import{fileURLToPath as p}from"node:url";import{envConfig as n}from"../config/env-config.js";import{SandboxContext as v}from"../utils/sandbox-context.js";const h=(()=>{const o=c(p(import.meta.url));return u(o)==="chunks"?c(o):o})();class P{#t=null;#r;constructor(r){this.#r=r,this.#r.lazy||(this.#t=this.#e())}#e(){const{workerScript:r,lazy:t,sandbox:i,resolveForkEnv:s,...e}=this.#r,a=this.#s(r);return s&&e.forkOpts&&(e.forkOpts={...e.forkOpts,env:s()}),this.#o(i)?l.pool(a,{...e,forkOpts:this.#i(e.forkOpts)}):l.pool(a,{...e})}#o(r){return!!r&&n.isReunite&&n.REDOCLY_DISABLE_API_FUNCTION_SANDBOX!==!0}#i(r){const t=v.resolve(h);try{m(t.tmpDir,{recursive:!0})}catch{}return{...r,cwd:t.serverOutDir,execArgv:[...t.execArgv,...r?.execArgv??[]],env:{...r?.env,...t.env}}}#s(r){let t=r;return!t.endsWith(".js")&&!t.endsWith(".mjs")&&(t=`${t}.${n.isDevelopMode?"js":"mjs"}`),t.startsWith(".")?f(h,t):t}#n(){return this.#t||(this.#t=this.#e()),this.#t}async exec(r,t,i){let e=this.#n().exec(r,t);return i?.timeout&&(e=e.timeout(i.timeout)),await e}async terminate(){this.#t&&(await this.#t.terminate(),this.#t=null)}}export{P as WorkerPool};

package/dist/types/entitlements.d.ts

@@ -35,9 +35,14 @@ export type PlanGates = {
     [FEATURE.aiSearchLimit]: number;
     [FEATURE.kvStorageLimit]: number;
     [FEATURE.mcp]: boolean;
+    [FEATURE.mcpGateway]: boolean;
+    [FEATURE.mcpMode]: 'tools' | 'code';
+    [FEATURE.gatewayFetchRatePerMin]: number;
+    [FEATURE.gatewayFetchQuotaPerDay]: number;
+    [FEATURE.gatewayFetchBudgetPerExec]: number;
 };
 export type Entitlements = {
-    [key in Feature]: boolean | number;
+    [key in Feature]: boolean | number | string;
 };
 export type ProductPlan = 'pro' | 'enterprise';
 //# sourceMappingURL=entitlements.d.ts.map

package/dist/types/markdoc.d.ts

@@ -1,5 +1,6 @@
 import type { Node, Variable, RenderableTreeNode, Function } from '@markdoc/markdoc';
-import type { RenderTagFn } from '../server/types/plugins/markdown.js';
+import type { RenderForLlmsRenderContext } from '@redocly/theme/markdoc/tags/types';
+export type RenderTagFn = (node: Node, context: RenderForLlmsRenderContext) => string | undefined;
 export type GetInnerContentFnOptions = {
     indent?: number;
     isTrim?: boolean;

package/dist/utils/l10n/build-i18n-config.d.ts

@@ -0,0 +1,24 @@
+import type { InitOptions } from 'i18next';
+import type { GlobalData } from '../../types/index.js';
+/**
+ * Builds the i18next init config shared by the client runtime (`initL10n`) and the
+ * build-time translate used in `renderForLlms` (`createBuildTranslate`), so both
+ * resolve translations identically: same default-translation merge, same locale
+ * fallback chain.
+ *
+ * @param l10n - The project's l10n data (`defaultLocale`, configured `locales`, and
+ * `translations` overrides), or `undefined` for a project with no l10n config.
+ * @param locale - The `lng` to set on the resulting config (the instance's `resources`
+ * still cover every configured locale, so a fixed translator for any other locale can
+ * still be derived from the same config via `i18next.getFixedT(otherLocale)`).
+ * @returns An i18next `InitOptions` object with merged default + project translations
+ * and a `code → langPart → defaultLocale` fallback chain.
+ *
+ * @example
+ * ```ts
+ * const config = await buildI18nConfig(l10n, 'ja');
+ * await i18next.init(config);
+ * ```
+ */
+export declare function buildI18nConfig(l10n: GlobalData['l10n'], locale: InitOptions['lng']): Promise<InitOptions>;
+//# sourceMappingURL=build-i18n-config.d.ts.map

package/dist/utils/l10n/build-i18n-config.js

@@ -0,0 +1 @@
+import{DEFAULT_LOCALE_PLACEHOLDER as u}from"../../constants/common.js";import{defaultTranslationImports as c}from"../../constants/l10n/default-translations.js";async function L(s,r){const a=s?.defaultLocale||u,e=s?.translations??{},i=s?.locales?[...new Set(s.locales.flatMap(t=>[t.code,t.code.split("-")[0]]))]:[a],l={};for(const t of i){const n=await c[t]?.()||{};l[t]={translation:{...n,...e[t]?.translation}}}return{load:"currentOnly",lng:r,nonExplicitSupportedLngs:!0,fallbackLng:t=>{if(!t)return[a];const n=t.split("-")[0];if(t===a)return n!==t?[n,a]:[a];const o=[t];return n!==t&&o.push(n),o.push(a),o},interpolation:{escapeValue:!1},debug:!1,resources:{...l}}}export{L as buildI18nConfig};

package/dist/utils/l10n/create-translate.d.ts

@@ -0,0 +1,19 @@
+import type { TFunction, TOptions } from '@redocly/theme/core/types';
+/**
+ * Wraps a raw i18next `t`-like function (`useTranslate`'s `i18next.t`, or a
+ * build-time `instance.getFixedT(locale)`) with the shared value/defaultValue/options
+ * resolution used across the client and build-time translate paths.
+ *
+ * @param rawT - The underlying i18next translate function to resolve keys against.
+ * @returns A `TFunction` that resolves `value` via `rawT`, falling back to
+ * `defaultValue` (when passed as the second argument or via `options.defaultValue`)
+ * and then to `value` itself when the key is untranslated.
+ *
+ * @example
+ * ```ts
+ * const translate = createTranslate(i18next.t);
+ * translate('greeting.hello', 'Hello'); // translated string, or 'Hello' if missing
+ * ```
+ */
+export declare function createTranslate(rawT: (key: string, opts?: TOptions) => string): TFunction;
+//# sourceMappingURL=create-translate.d.ts.map

package/dist/utils/l10n/create-translate.js

@@ -0,0 +1 @@
+function u(r){return(n,t)=>{const e=typeof t=="string"?t:void 0,f=e?void 0:t;return n?r(n,{defaultValue:e,...f})||e||n||"":e??""}}export{u as createTranslate};

package/dist/utils/url/get-shared-data-fetch-url.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Builds the exact URL used to fetch shared page data over HTTP. The client
+ * loader and the server-side `<link rel="preload">` generation must both use
+ * this function so the preloaded URL matches the fetched URL byte for byte.
+ *
+ * @param id - The unique identifier of the shared data resource.
+ * @param isDevelopMode - Whether the portal runs in develop mode, where the URL is kept raw instead of URI-encoded.
+ * @returns The path-prefixed (and, outside develop mode, URI-encoded) shared data URL.
+ *
+ * @example
+ * ```ts
+ * getSharedDataFetchUrl('with space', false);
+ * // "/page-data/shared/with%20space.json"
+ * ```
+ */
+export declare function getSharedDataFetchUrl(id: string, isDevelopMode: boolean): string;
+//# sourceMappingURL=get-shared-data-fetch-url.d.ts.map

package/dist/utils/url/get-shared-data-fetch-url.js

@@ -0,0 +1 @@
+import{withPathPrefix as a}from"@redocly/theme/core/utils";import{getSharedDataUrl as o}from"./get-shared-data-url.js";function n(t,e){const r=a(o(t));return e?r:encodeURI(r)}export{n as getSharedDataFetchUrl};

package/dist/utils/url/parse-preview-url.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Parses an absolute preview URL string. Accepts `https:` on any host, and `http:`
+ * only on `localhost` hosts, which is how previews are served in the local dev
+ * environment. Returns `null` on parse errors and for any other scheme/host pair.
+ *
+ * @param uri - Absolute URL string to parse.
+ * @returns A `URL` when the string is a valid preview URL; otherwise `null`.
+ *
+ * @example
+ * ```ts
+ * parsePreviewUrl('https://slug--branch.preview.redocly.app');
+ * // URL { href: 'https://slug--branch.preview.redocly.app/' }
+ *
+ * parsePreviewUrl('http://slug--branch.preview.localhost');
+ * // URL { href: 'http://slug--branch.preview.localhost/' }
+ *
+ * parsePreviewUrl('http://slug--branch.preview.redocly.app');
+ * // null
+ * ```
+ */
+export declare function parsePreviewUrl(uri: string): URL | null;
+//# sourceMappingURL=parse-preview-url.d.ts.map

package/dist/utils/url/parse-preview-url.js

@@ -0,0 +1 @@
+import{parseHttpsUrl as n}from"./parse-https-url.js";function s(t){const o=n(t);if(o)return o;try{const r=new URL(t);return r.protocol==="http:"&&l(r.hostname)?r:null}catch{return null}}function l(t){return t==="localhost"||t.endsWith(".localhost")}export{s as parsePreviewUrl};

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@redocly/realm",
-  "version": "0.136.0-next.1",
+  "version": "0.136.0-next.11",
   "description": "",
   "type": "module",
   "bin": {
     "realm": "bin.js"
   },
   "engines": {
-    "node": ">=22.12.0 || >=20.19.0 <21.0.0",
+    "node": ">=22.22.0",
     "npm": ">=10"
   },
   "keywords": [],
@@ -21,6 +21,7 @@
     "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
     "@libsql/client": "0.17.3",
     "@markdoc/markdoc": "0.5.2",
+    "@modelcontextprotocol/server": "2.0.0",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/context-zone": "2.0.1",
     "@opentelemetry/core": "2.8.0",
@@ -32,8 +33,7 @@
     "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "@redocly/ajv": "8.18.0",
-    "@redocly/mcp-typescript-sdk": "1.18.1",
-    "@redocly/openapi-core": "2.39.0",
+    "@redocly/openapi-core": "2.45.0",
     "@shikijs/transformers": "3.21.0",
     "@tanstack/react-query": "5.62.3",
     "@tanstack/react-table": "8.21.3",
@@ -51,15 +51,14 @@
     "enquirer": "2.3.6",
     "esbuild": "0.28.1",
     "escape-carriage": "^1.3.1",
-    "fetch-to-node": "^2.1.0",
     "fflate": "0.7.4",
     "flexsearch": "0.7.43",
     "graphql": "16.12.0",
-    "hono": "4.12.25",
+    "hono": "4.12.34",
     "htmlparser2": "8.0.2",
     "i18next": "22.4.15",
     "is-glob": "4.0.3",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "lru-cache": "11.1.0",
     "minimatch": "10.2.4",
     "mri": "1.2.0",
@@ -70,11 +69,11 @@
     "path-browserify": "1.0.1",
     "picomatch": "2.3.2",
     "quickjs-emscripten-core": "0.32.0",
-    "react": "^19.2.4",
+    "react": "^19.2.7",
     "react-calendar": "5.1.0",
     "react-date-picker": "11.0.0",
-    "react-dom": "^19.2.4",
-    "react-router-dom": "^6.30.3",
+    "react-dom": "^19.2.7",
+    "react-router": "^8.3.0",
     "react-select": "5.10.1",
     "reactjs-popup": "2.0.6",
     "semver": "7.7.3",
@@ -86,6 +85,7 @@
     "tty-browserify": "0.0.1",
     "typesense": "2.1.0",
     "ulid": "^2.3.0",
+    "undici": "^6.27.0",
     "web-vitals": "3.3.1",
     "workerpool": "9.2.0",
     "ws": "^8.21.0",
@@ -93,18 +93,19 @@
     "xpath": "0.0.34",
     "yaml-ast-parser": "0.0.43",
     "zod": "^3.25.76",
-    "@redocly/asyncapi-docs": "1.13.0-next.1",
-    "@redocly/config": "0.52.0",
-    "@redocly/graphql-docs": "1.13.0-next.1",
-    "@redocly/openapi-docs": "3.24.0-next.1",
-    "@redocly/portal-legacy-ui": "0.18.0",
-    "@redocly/portal-plugin-mock-server": "0.21.0-next.1",
-    "@redocly/realm-asyncapi-sdk": "0.14.0-next.0",
-    "@redocly/theme": "0.68.0-next.0"
+    "@redocly/api-docs": "0.1.0-next.3",
+    "@redocly/asyncapi-docs": "1.13.0-next.10",
+    "@redocly/config": "0.53.1",
+    "@redocly/graphql-docs": "1.13.0-next.10",
+    "@redocly/openapi-docs": "3.24.0-next.10",
+    "@redocly/portal-legacy-ui": "0.19.0-next.0",
+    "@redocly/portal-plugin-mock-server": "0.21.0-next.10",
+    "@redocly/realm-asyncapi-sdk": "0.14.0-next.3",
+    "@redocly/theme": "0.68.0-next.7"
   },
   "peerDependencies": {
-    "react": "^19.2.4",
-    "react-dom": "^19.2.4"
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7"
   },
   "nx": {
     "implicitDependencies": [