@redocly/realm 0.136.0-next.4 → 0.136.0-next.5

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # @redocly/realm
 
+## 0.136.0-next.5
+
+### Minor Changes
+
+- f7bb0ce633c: Added support for automatic access token refresh for the MCP server.
+  MCP clients keep long-running sessions alive without repeated browser logins.
+- 339a4748440: Added `locale` and `translate` options to the `renderForLlms` tag render context, allowing custom Markdoc tags to localize their content in `llms.txt` and AI search output at build time.
+
+### Patch Changes
+
+- 12eed09e5b6: Fixed an issue in API docs where documented array items were not displayed in a nested indexed row.
+- a8f19de21ab: Fixed security vulnerabilities `CVE-2026-59896`, `CVE-2026-59895`, and `CVE-2026-59897` by upgrading `hono` to version `4.12.27`.
+- 50ec00284cd: Updated `@redocly/openapi-core` to version `2.40.0`.
+- a8f19de21ab: Fixed security vulnerability `GHSA-c2j3-45gr-mqc4` by upgrading `dompurify` to version `3.4.12`.
+- a8f19de21ab: Fixed security vulnerability `CVE-2026-59869` by upgrading `js-yaml` to version `4.3.0`.
+- Updated dependencies [12eed09e5b6]
+- Updated dependencies [50ec00284cd]
+- Updated dependencies [a8f19de21ab]
+- Updated dependencies [339a4748440]
+- Updated dependencies [a8f19de21ab]
+  - @redocly/openapi-docs@3.24.0-next.5
+  - @redocly/theme@0.68.0-next.3
+  - @redocly/asyncapi-docs@1.13.0-next.5
+  - @redocly/graphql-docs@1.13.0-next.5
+  - @redocly/portal-plugin-mock-server@0.21.0-next.5
+
 ## 0.136.0-next.4
 
 ### Minor Changes

package/dist/client/ErrorBoundary.js

@@ -1 +1 @@
-import*as s from"react";import{ErrorDetails as a}from"./app/Error/ErrorDetails";import{telemetry as n}from"./app/telemetry/index.js";class p extends s.Component{constructor(r){super(r),this.state={error:void 0}}componentDidCatch(r,c){const{name:e,message:t}=r,o={name:e,message:t,stack:c.componentStack??void 0};this.setState({error:o}),n.sendClientErrorMessage([{object:"client",message:`${e}: ${t}`,url:location.href}]),n.sendError(o,"ReactErrorBoundary"),process.env.NODE_ENV!=="production"&&console.log(r)}render(){return this.state.error&&process.env.NODE_ENV!=="production"?s.createElement(a,{error:this.state.error}):this.props.children}}export{p as ErrorBoundary};
+import*as s from"react";import{getBaseDataAttributes as c}from"@redocly/theme/core/utils";import{ErrorDetails as i}from"./app/Error/ErrorDetails";import{telemetry as n}from"./app/telemetry/index.js";class l extends s.Component{constructor(r){super(r),this.state={error:void 0}}componentDidCatch(r,a){const{name:e,message:t}=r,o={name:e,message:t,stack:a.componentStack??void 0};this.setState({error:o}),n.sendClientErrorMessage([{...c("reactErrorBoundary","client"),message:`${e}: ${t}`,url:location.href}]),n.sendError(o,"ReactErrorBoundary"),process.env.NODE_ENV!=="production"&&console.log(r)}render(){return this.state.error&&process.env.NODE_ENV!=="production"?s.createElement(i,{error:this.state.error}):this.props.children}}export{l as ErrorBoundary};

package/dist/client/app/l10n/hooks/useTranslate.js

@@ -1 +1 @@
-import a from"i18next";import{useMemo as u}from"react";import{useL10n as o}from"./useL10n";const d=()=>{const{lang:r}=o();return{translate:u(()=>(n,t)=>{let e=t&&typeof t=="string"?t:void 0,s=e?void 0:t;return n?a.t(n,{defaultValue:e,...s})||e||n||"":e??""},[r])}};export{d as useTranslate};
+import r from"i18next";import{useMemo as e}from"react";import{createTranslate as o}from"../../../../utils/l10n/create-translate.js";import{useL10n as n}from"./useL10n";const p=()=>{const{lang:t}=n();return{translate:e(()=>o(r.t),[t])}};export{p as useTranslate};

package/dist/client/app/l10n/initL10n.js

@@ -1 +1 @@
-import c from"i18next";import{DEFAULT_LOCALE_PLACEHOLDER as f}from"../../../constants/common.js";import{defaultTranslationImports as u}from"../../../constants/l10n/default-translations.js";async function p(a,s){const n=a?.defaultLocale||f,i=a?.translations??{},e=a?.locales?[...new Set(a.locales.flatMap(t=>[t.code,t.code.split("-")[0]]))]:[n],l={};for(const t of e){const o=await u[t]?.()||{};l[t]={translation:{...o,...i[t]?.translation}}}return{load:"currentOnly",lng:s,nonExplicitSupportedLngs:!0,fallbackLng:t=>{if(!t)return[n];const o=t.split("-")[0];if(t===n)return o!==t?[o,n]:[n];const r=[t];return o!==t&&r.push(o),r.push(n),r},interpolation:{escapeValue:!1},debug:!1,resources:{...l}}}async function d(a,s){const n=await p(a,s);await c.init(n)}export{d as initL10n};
+import o from"i18next";import{buildI18nConfig as a}from"../../../utils/l10n/build-i18n-config.js";async function c(i,n){const t=await a(i,n);await o.init(t)}export{c as initL10n};

package/dist/client/templates/openapi-docs/helpers.d.ts

@@ -13,6 +13,6 @@ export declare function joinWithSeparator(base?: string, path?: string, sep?: st
 export declare function parsePartials(partials?: Record<string, any>): Record<string, Node[] | Node> | undefined;
 export declare function usePatchedStore(storeJs: OpenAPIDocsStore, { markdown, baseSlug }: PageProps): OpenAPIDocsStore;
 export declare function safeParseFunction(fnInput: EventFunctionInput): ((event: EventType) => void) | null;
-export declare function mergeEvents(userFunction: ((event: EventType) => void) | null, telemetryEvent?: AsyncApiRealmUI.GetEventData<'openapi_docs'>[number]['eventType']): (event: EventType) => void;
+export declare function mergeEvents(userFunction: ((event: EventType) => void) | null, telemetryEvent?: AsyncApiRealmUI.GetEventData<'com.redocly.openapiDocs.interacted'>[0]['eventType']): (event: EventType) => void;
 export {};
 //# sourceMappingURL=helpers.d.ts.map

package/dist/client/templates/openapi-docs/helpers.js

@@ -1,5 +1,5 @@
-import{useMemo as f}from"react";import{components as d}from"@redocly-markdoc/components";import{schema as c}from"@redocly-markdoc/schema";import{Ast as g}from"@markdoc/markdoc";import{PageNavigation as h}from"@redocly/theme/components/PageNavigation/PageNavigation";import{tags as _,components as y}from"@redocly/theme/markdoc/default";import{Breadcrumbs as P}from"@redocly/theme/components/Breadcrumbs/Breadcrumbs";import{withPathPrefix as m}from"@redocly/theme/core/utils";import{ServerRoutes as u}from"../../../constants/api.js";import{OPENAPI_DOCS_TEMPLATE_ID as w}from"../../../constants/common.js";import{isBrowser as S}from"../../../utils/env/is-browser.js";import*as O from"../../../markdoc/nodes/index.js";import v from"../../../markdoc/tags/index.js";import{normalizeCustomTags as C}from"../../../markdoc/helpers/normalize-custom-tags.js";import*as T from"../../app/markdoc/custom-components/index.js";import{usePageData as x,useSidebarSiblingsData as A}from"../../providers/page-data/hooks";import{telemetry as E}from"../../app/telemetry/index.js";import{getMockServerDocsConfig as R}from"./mock-server-config.js";function X(o="",r="",t="/"){return o.endsWith(t)&&(o=o.slice(0,-t.length)),r.startsWith(t)&&(r=r.slice(t.length)),!o||!r?o+r:o+t+r}function b(o){if(o)return Object.entries(o).reduce((r,[t,n])=>(r[t]=g.fromJSON(JSON.stringify(n)),r),{})}function Z(o,{markdown:r,baseSlug:t}){return f(()=>{const i=S();if(o.options.oAuth2RedirectURI=i?`${window.location.origin}${m(u.REPLAY_OAUTH2_CALLBACK)}`:void 0,o.options.routingBasePath=m(t),o.options.mockServer=R(o.options.mockServer,t),o.options.corsProxyUrl===void 0){const e=m(`${u.CORS_PROXY}/`);o.options.corsProxyUrl=i?new URL(e,window.location.origin).toString():e}o.options.scrollYOffset=i?parseInt(getComputedStyle(document.documentElement).getPropertyValue("--navbar-height"),10):0,o.options.markdocOptions={tags:{...v,..._,...C(c?.tags??{})},nodes:{...O,...c?.nodes??{}},functions:{...c?.functions??{}},components:{...T,...y,...d,...globalThis.__LOADER.markdocComponents},...r,partials:b(r?.partials)},o.options.unstable_hooks={...o.options.unstable_hooks,MiddlePanelFooter:()=>{const{templateId:e}=x()||{},{nextPage:s,prevPage:a}=A()||{};return e===w?null:h({nextPage:s,prevPage:a})},MiddlePanelHeader:()=>P({})};const l={codeSamplesLanguageSwitch:"samples_language_switch",codeSamplesCopy:"code_samples_copy",panelToggle:"panel_toggle",targetServerSwitch:"target_server_switch",tryItOpen:"try_it_toggle",tryItSent:"try_it_sent"},p={};for(const[e,s]of Object.entries(l)){const a=U(o.options.events?.[e]);p[e]=F(a,s)}return o.options.events=p,o},[o,r,t])}function U(o){if(typeof window>"u")return null;if(typeof o=="function")return o;if(typeof o!="string")return null;try{const r=o.trim();if(!r.match(/^(\([^)]*\)\s*=>\s*.+|[a-zA-Z_$][\w$]*\s*=>\s*.+)$/))throw new Error("Invalid function format. Only arrow functions allowed.");if(["eval","Function","constructor","prototype","__proto__","import","require","process","global","window","document"].some(i=>r.includes(i)))throw new Error("Function contains prohibited keywords");return new Function("event",`
+import{useMemo as f}from"react";import{components as g}from"@redocly-markdoc/components";import{schema as c}from"@redocly-markdoc/schema";import{Ast as d}from"@markdoc/markdoc";import{PageNavigation as h}from"@redocly/theme/components/PageNavigation/PageNavigation";import{tags as _,components as y}from"@redocly/theme/markdoc/default";import{Breadcrumbs as P}from"@redocly/theme/components/Breadcrumbs/Breadcrumbs";import{withPathPrefix as m,getBaseDataAttributes as w}from"@redocly/theme/core/utils";import{ServerRoutes as u}from"../../../constants/api.js";import{OPENAPI_DOCS_TEMPLATE_ID as S}from"../../../constants/common.js";import{isBrowser as O}from"../../../utils/env/is-browser.js";import*as v from"../../../markdoc/nodes/index.js";import C from"../../../markdoc/tags/index.js";import{normalizeCustomTags as T}from"../../../markdoc/helpers/normalize-custom-tags.js";import*as A from"../../app/markdoc/custom-components/index.js";import{usePageData as x,useSidebarSiblingsData as D}from"../../providers/page-data/hooks";import{telemetry as E}from"../../app/telemetry/index.js";import{getMockServerDocsConfig as R}from"./mock-server-config.js";function Z(o="",r="",t="/"){return o.endsWith(t)&&(o=o.slice(0,-t.length)),r.startsWith(t)&&(r=r.slice(t.length)),!o||!r?o+r:o+t+r}function b(o){if(o)return Object.entries(o).reduce((r,[t,n])=>(r[t]=d.fromJSON(JSON.stringify(n)),r),{})}function G(o,{markdown:r,baseSlug:t}){return f(()=>{const i=O();if(o.options.oAuth2RedirectURI=i?`${window.location.origin}${m(u.REPLAY_OAUTH2_CALLBACK)}`:void 0,o.options.routingBasePath=m(t),o.options.mockServer=R(o.options.mockServer,t),o.options.corsProxyUrl===void 0){const e=m(`${u.CORS_PROXY}/`);o.options.corsProxyUrl=i?new URL(e,window.location.origin).toString():e}o.options.scrollYOffset=i?parseInt(getComputedStyle(document.documentElement).getPropertyValue("--navbar-height"),10):0,o.options.markdocOptions={tags:{...C,..._,...T(c?.tags??{})},nodes:{...v,...c?.nodes??{}},functions:{...c?.functions??{}},components:{...A,...y,...g,...globalThis.__LOADER.markdocComponents},...r,partials:b(r?.partials)},o.options.unstable_hooks={...o.options.unstable_hooks,MiddlePanelFooter:()=>{const{templateId:e}=x()||{},{nextPage:s,prevPage:a}=D()||{};return e===S?null:h({nextPage:s,prevPage:a})},MiddlePanelHeader:()=>P({})};const l={codeSamplesLanguageSwitch:"samples_language_switch",codeSamplesCopy:"code_samples_copy",panelToggle:"panel_toggle",targetServerSwitch:"target_server_switch",tryItOpen:"try_it_toggle",tryItSent:"try_it_sent"},p={};for(const[e,s]of Object.entries(l)){const a=I(o.options.events?.[e]);p[e]=U(a,s)}return o.options.events=p,o},[o,r,t])}function I(o){if(typeof window>"u")return null;if(typeof o=="function")return o;if(typeof o!="string")return null;try{const r=o.trim();if(!r.match(/^(\([^)]*\)\s*=>\s*.+|[a-zA-Z_$][\w$]*\s*=>\s*.+)$/))throw new Error("Invalid function format. Only arrow functions allowed.");if(["eval","Function","constructor","prototype","__proto__","import","require","process","global","window","document"].some(i=>r.includes(i)))throw new Error("Function contains prohibited keywords");return new Function("event",`
       'use strict';
       const userFn = ${r};
       return userFn(event);
-    `)}catch(r){return console.error("Function parsing error:",r),null}}function F(o,r){return t=>{if(o)try{o(t)}catch(n){console.error("User event handler error:",n)}if(r)try{E.sendOpenapiDocsMessage([{object:"openapi_docs",eventType:r,operationHttpVerb:t.operationHttpVerb,operationPath:t.operationPath,lang:"lang"in t?t.lang:void 0,action:t.action,state:"state"in t?t.state:void 0,serverUrl:"serverUrl"in t?t.serverUrl:void 0}])}catch{}}}export{X as joinWithSeparator,F as mergeEvents,b as parsePartials,U as safeParseFunction,Z as usePatchedStore};
+    `)}catch(r){return console.error("Function parsing error:",r),null}}function U(o,r){return t=>{if(o)try{o(t)}catch(n){console.error("User event handler error:",n)}if(r)try{E.sendOpenapiDocsMessage([{...w("openapiDocsInteraction","openapiDocs"),eventType:r,operationHttpVerb:t.operationHttpVerb,operationPath:t.operationPath,lang:"lang"in t?t.lang:void 0,action:t.action,state:"state"in t?t.state:void 0,serverUrl:"serverUrl"in t?t.serverUrl:void 0}])}catch{}}}export{Z as joinWithSeparator,U as mergeEvents,b as parsePartials,I as safeParseFunction,G as usePatchedStore};

package/dist/constants/common.d.ts

@@ -3,6 +3,7 @@ export declare const AuthCookieNames: {
     readonly AUTHORIZATION: 'authorization';
     readonly IDP_ID_TOKEN: 'idp_id_token';
     readonly IDP_ACCESS_TOKEN: 'idp_access_token';
+    readonly IDP_REFRESH_TOKEN: 'idp_refresh_token';
     readonly FEDERATED_ACCESS_TOKEN: 'federated_access_token';
     readonly FEDERATED_ID_TOKEN: 'federated_id_token';
 };
@@ -103,6 +104,8 @@ export declare const FEATURE: {
     readonly aiSearchLimit: 'aiSearchLimit';
     readonly kvStorageLimit: 'kvStorageLimit';
     readonly mcp: 'mcp';
+    readonly mcpGateway: 'mcpGateway';
+    readonly mcpMode: 'mcpMode';
     readonly banner: 'banner';
 };
 //# sourceMappingURL=common.d.ts.map

package/dist/constants/common.js

@@ -1 +1 @@
-const a={AUTHORIZATION:"authorization",IDP_ID_TOKEN:"idp_id_token",IDP_ACCESS_TOKEN:"idp_access_token",FEDERATED_ACCESS_TOKEN:"federated_access_token",FEDERATED_ID_TOKEN:"federated_id_token"},n="post_logout",_="openapi_docs",E="asyncapi_docs",p="graphql_docs",A="/_spec-gql",i="markdoc",S="tags",c="*",L={[c]:"read"},O=["openid","email"],d=1440*60,I=720*60*60,T="anonymous",R="authenticated",l="**",C="Reunite",x="translations.yaml",P="redocly.yaml",D="@redocly/theme",N="@theme",m="@skills",U="SKILL.md",u="/.well-known/agent-skills",g="/.well-known/agent-card.json",M="/a2a",h="/.well-known/mcp/server-card.json",F="/app-data.json",b="/eject-component";var t;(function(o){o.BUILD="build",o.DEVELOP="develop",o.PREPARE="prepare"})(t||(t={}));var e;(function(o){o.RATING="rating",o.SENTIMENT="sentiment",o.COMMENT="comment",o.MOOD="mood",o.PROBLEM="problem",o.SCALE="scale"})(e||(e={}));var r;(function(o){o.AI_SEARCH="aiSearch"})(r||(r={}));const k="/login",v="/invite",G={AUTH0_PASS:"/auth/auth0-pass"},H={NotExist:"ENOENT"},y="default_locale",K="sidebar-",B="PUBLIC_",w="branch.",V=["BROKEN_LINK","MARKDOC","RESOLVE"],f=["logo","navbar","products","footer","sidebar","scripts","links","feedback","search","aiAssistant","colorMode","palette","navigation","codeSnippet","markdown","openapi","graphql","analytics","userMenu","versionPicker","breadcrumbs","catalog","entitiesCatalog","scorecard","scorecards","scorecardClassic","mcp","banner"],s="redocly_category",j="redocly_product",q="redocly_version",X="redocly_teams",Q=s,W={asyncapi:"asyncapi",apiFunctions:"apiFunctions",reactPages:"reactPages",catalog:"catalog",catalogClassic:"catalogClassic",lint:"lint",scorecard:"scorecard",scorecards:"scorecards",l10n:"l10n",openapi:"openapi",graphql:"graphql",markdown:"markdown",devOnboarding:"devOnboarding",seo:"seo",redirects:"redirects",customPlugins:"customPlugins",themeEjecting:"themeEjecting",products:"products",breadcrumbs:"breadcrumbs",mockServer:"mockServer",sso:"sso",rbac:"rbac",analytics:"analytics",removeAttribution:"removeAttribution",advancedSearch:"advancedSearch",soap:"soap",ssoDirect:"ssoDirect",codeWalkthrough:"codeWalkthrough",aiSearchLimit:"aiSearchLimit",kvStorageLimit:"kvStorageLimit",mcp:"mcp",banner:"banner"};export{M as A2A_SLUG,g as AGENT_CARD_SLUG,u as AGENT_SKILLS_BASE,E as ASYNC_API_DOCS_TEMPLATE_ID,a as AuthCookieNames,w as BRANCH_ENV_PREFIX,P as CONFIG_FILE_NAME,i as CUSTOM_MARKDOC_OPTIONS_PATH,S as CUSTOM_MARKDOC_TAGS_PATH,T as DEFAULT_ANONYMOUS_VISITOR_TEAM,R as DEFAULT_AUTHENTICATED_TEAM,d as DEFAULT_COOKIE_EXPIRATION,y as DEFAULT_LOCALE_PLACEHOLDER,l as DEFAULT_RBAC_SCOPE,C as DEFAULT_SSO_IDP_TITLE,D as DEFAULT_THEME_NAME,k as DEV_LOGIN_SLUG,b as EJECT_COMPONENT_URL,G as ExternalRoutes,W as FEATURE,e as FEEDBACK_TYPES,H as FsErrors,F as GLOBAL_DATA_URL,A as GRAPHQL_SPEC_SLUG,p as GRAPHQL_TEMPLATE_ID,v as INVITE_SLUG,V as MARKDOC_ERROR_TYPES,h as MCP_SERVER_CARD_SLUG,_ as OPENAPI_DOCS_TEMPLATE_ID,I as POST_LOGOUT_COOKIE_EXPIRATION,n as POST_LOGOUT_COOKIE_NAME,B as PUBLIC_ENV_PREFIX,L as PUBLIC_RBAC_SCOPE_ITEM,c as RBAC_ALL_OTHER_TEAMS,O as REQUIRED_OIDC_SCOPES,r as RbacFeatures,s as SEARCH_CATEGORY_FIELD,Q as SEARCH_GROUP_FACET_FIELD,j as SEARCH_PRODUCT_FIELD,X as SEARCH_RBAC_FIELD,q as SEARCH_VERSION_FIELD,K as SIDEBAR_PREFIX,x as TRANSLATIONS_FILE_NAME,f as UI_ACCESSIBLE_CONFIG_PROPS,m as USER_SKILLS_ALIAS,U as USER_SKILL_FILENAME,N as USER_THEME_ALIAS,t as cliCommandNames};
+const a={AUTHORIZATION:"authorization",IDP_ID_TOKEN:"idp_id_token",IDP_ACCESS_TOKEN:"idp_access_token",IDP_REFRESH_TOKEN:"idp_refresh_token",FEDERATED_ACCESS_TOKEN:"federated_access_token",FEDERATED_ID_TOKEN:"federated_id_token"},n="post_logout",_="openapi_docs",E="asyncapi_docs",p="graphql_docs",i="/_spec-gql",A="markdoc",S="tags",c="*",O={[c]:"read"},d=["openid","email"],L=1440*60,I=720*60*60,T="anonymous",R="authenticated",l="**",C="Reunite",x="translations.yaml",P="redocly.yaml",D="@redocly/theme",N="@theme",m="@skills",U="SKILL.md",u="/.well-known/agent-skills",g="/.well-known/agent-card.json",M="/a2a",h="/.well-known/mcp/server-card.json",F="/app-data.json",k="/eject-component";var t;(function(o){o.BUILD="build",o.DEVELOP="develop",o.PREPARE="prepare"})(t||(t={}));var e;(function(o){o.RATING="rating",o.SENTIMENT="sentiment",o.COMMENT="comment",o.MOOD="mood",o.PROBLEM="problem",o.SCALE="scale"})(e||(e={}));var r;(function(o){o.AI_SEARCH="aiSearch"})(r||(r={}));const b="/login",G="/invite",v={AUTH0_PASS:"/auth/auth0-pass"},H={NotExist:"ENOENT"},y="default_locale",K="sidebar-",w="PUBLIC_",B="branch.",f=["BROKEN_LINK","MARKDOC","RESOLVE"],V=["logo","navbar","products","footer","sidebar","scripts","links","feedback","search","aiAssistant","colorMode","palette","navigation","codeSnippet","markdown","openapi","graphql","analytics","userMenu","versionPicker","breadcrumbs","catalog","entitiesCatalog","scorecard","scorecards","scorecardClassic","mcp","banner"],s="redocly_category",j="redocly_product",q="redocly_version",X="redocly_teams",Q=s,W={asyncapi:"asyncapi",apiFunctions:"apiFunctions",reactPages:"reactPages",catalog:"catalog",catalogClassic:"catalogClassic",lint:"lint",scorecard:"scorecard",scorecards:"scorecards",l10n:"l10n",openapi:"openapi",graphql:"graphql",markdown:"markdown",devOnboarding:"devOnboarding",seo:"seo",redirects:"redirects",customPlugins:"customPlugins",themeEjecting:"themeEjecting",products:"products",breadcrumbs:"breadcrumbs",mockServer:"mockServer",sso:"sso",rbac:"rbac",analytics:"analytics",removeAttribution:"removeAttribution",advancedSearch:"advancedSearch",soap:"soap",ssoDirect:"ssoDirect",codeWalkthrough:"codeWalkthrough",aiSearchLimit:"aiSearchLimit",kvStorageLimit:"kvStorageLimit",mcp:"mcp",mcpGateway:"mcpGateway",mcpMode:"mcpMode",banner:"banner"};export{M as A2A_SLUG,g as AGENT_CARD_SLUG,u as AGENT_SKILLS_BASE,E as ASYNC_API_DOCS_TEMPLATE_ID,a as AuthCookieNames,B as BRANCH_ENV_PREFIX,P as CONFIG_FILE_NAME,A as CUSTOM_MARKDOC_OPTIONS_PATH,S as CUSTOM_MARKDOC_TAGS_PATH,T as DEFAULT_ANONYMOUS_VISITOR_TEAM,R as DEFAULT_AUTHENTICATED_TEAM,L as DEFAULT_COOKIE_EXPIRATION,y as DEFAULT_LOCALE_PLACEHOLDER,l as DEFAULT_RBAC_SCOPE,C as DEFAULT_SSO_IDP_TITLE,D as DEFAULT_THEME_NAME,b as DEV_LOGIN_SLUG,k as EJECT_COMPONENT_URL,v as ExternalRoutes,W as FEATURE,e as FEEDBACK_TYPES,H as FsErrors,F as GLOBAL_DATA_URL,i as GRAPHQL_SPEC_SLUG,p as GRAPHQL_TEMPLATE_ID,G as INVITE_SLUG,f as MARKDOC_ERROR_TYPES,h as MCP_SERVER_CARD_SLUG,_ as OPENAPI_DOCS_TEMPLATE_ID,I as POST_LOGOUT_COOKIE_EXPIRATION,n as POST_LOGOUT_COOKIE_NAME,w as PUBLIC_ENV_PREFIX,O as PUBLIC_RBAC_SCOPE_ITEM,c as RBAC_ALL_OTHER_TEAMS,d as REQUIRED_OIDC_SCOPES,r as RbacFeatures,s as SEARCH_CATEGORY_FIELD,Q as SEARCH_GROUP_FACET_FIELD,j as SEARCH_PRODUCT_FIELD,X as SEARCH_RBAC_FIELD,q as SEARCH_VERSION_FIELD,K as SIDEBAR_PREFIX,x as TRANSLATIONS_FILE_NAME,V as UI_ACCESSIBLE_CONFIG_PROPS,m as USER_SKILLS_ALIAS,U as USER_SKILL_FILENAME,N as USER_THEME_ALIAS,t as cliCommandNames};

package/dist/server/config/env-config.d.ts

@@ -52,9 +52,8 @@ declare function loadEnvConfig(): {
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: boolean | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: boolean | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: boolean | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: boolean | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: boolean | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG: boolean;
     TYPESENSE_API_URL?: string | undefined;
@@ -134,9 +133,8 @@ export declare const envConfig: {
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: boolean | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: boolean | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: boolean | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: boolean | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: boolean | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG: boolean;
     TYPESENSE_API_URL?: string | undefined;

package/dist/server/config/env-schema.d.ts

@@ -56,9 +56,8 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL: z.ZodOptional<z.ZodString>;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT: z.ZodOptional<z.ZodString>;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
 } & {
     SEARCH_DEV_REINIT: z.ZodOptional<z.ZodString>;
     SEARCH_DEV_DEBUG: z.ZodEffects<z.ZodDefault<z.ZodEnum<["true", "false"]>>, boolean, "false" | "true" | undefined>;
@@ -135,9 +134,8 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: boolean | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: boolean | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: boolean | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: boolean | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: boolean | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG: boolean;
     TYPESENSE_API_URL?: string | undefined;
@@ -207,9 +205,8 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: "false" | "true" | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: "false" | "true" | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: "false" | "true" | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: "false" | "true" | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: "false" | "true" | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG?: "false" | "true" | undefined;
     TYPESENSE_API_URL?: string | undefined;
@@ -279,9 +276,8 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: boolean | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: boolean | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: boolean | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: boolean | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: boolean | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG: boolean;
     TYPESENSE_API_URL?: string | undefined;
@@ -351,9 +347,8 @@ export declare const envSchema: z.ZodEffects<z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: "false" | "true" | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: "false" | "true" | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: "false" | "true" | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: "false" | "true" | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: "false" | "true" | undefined;
     SEARCH_DEV_REINIT?: string | undefined;
     SEARCH_DEV_DEBUG?: "false" | "true" | undefined;
     TYPESENSE_API_URL?: string | undefined;

package/dist/server/config/env-schemas/feature-flags.d.ts

@@ -15,12 +15,10 @@ export declare const featureFlagsSchema: z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL: z.ZodOptional<z.ZodString>;
     /** (Optional) API endpoint for the agent feedback endpoint;**/
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT: z.ZodOptional<z.ZodString>;
-    /** Experimental: serve the Docs MCP server in codemode (a single `execute` tool). */
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
-    /** Experimental: give the docs MCP `execute` sandbox a guarded `fetch` that can call gateway-eligible APIs. */
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
     /** Escape hatch: disables the Node Permission Model sandbox on API function and MCP tool worker processes (hosted Reunite environments only). */
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
+    /** Experimental: prompt for upstream API credentials via URL-mode elicitation. Requires the gateway capability. */
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED: z.ZodEffects<z.ZodOptional<z.ZodEnum<["true", "false"]>>, boolean | undefined, "false" | "true" | undefined>;
 }, "strip", z.ZodTypeAny, {
     NEW_CATALOG_ENABLED?: boolean | undefined;
     NEW_SCORECARDS_ENABLED?: boolean | undefined;
@@ -31,9 +29,8 @@ export declare const featureFlagsSchema: z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: boolean | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: boolean | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: boolean | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: boolean | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: boolean | undefined;
 }, {
     NEW_CATALOG_ENABLED?: "false" | "true" | undefined;
     NEW_SCORECARDS_ENABLED?: "false" | "true" | undefined;
@@ -44,8 +41,7 @@ export declare const featureFlagsSchema: z.ZodObject<{
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED?: "false" | "true" | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL?: string | undefined;
     REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT?: string | undefined;
-    REDOCLY_EXP_MCP_CODE_MODE_ENABLED?: "false" | "true" | undefined;
-    REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED?: "false" | "true" | undefined;
     REDOCLY_DISABLE_API_FUNCTION_SANDBOX?: "false" | "true" | undefined;
+    REDOCLY_EXP_MCP_ELICITATION_ENABLED?: "false" | "true" | undefined;
 }>;
 //# sourceMappingURL=feature-flags.d.ts.map

package/dist/server/config/env-schemas/feature-flags.js

@@ -1 +1 @@
-import{z as _}from"zod";import{envBooleanStringOptional as E}from"../../utils/envs/env-boolean-string.js";const D=_.object({NEW_CATALOG_ENABLED:E(),NEW_SCORECARDS_ENABLED:E(),ENABLE_COMMENTS:_.string().optional(),REDOCLY_EXP_DISABLE_MD_VALIDATION:E(),ENABLE_SOURCE_MAPS:E(),PLAN_GATES:_.string().optional(),REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED:E(),REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL:_.string().optional(),REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT:_.string().optional(),REDOCLY_EXP_MCP_CODE_MODE_ENABLED:E(),REDOCLY_EXP_MCP_GATEWAY_SERVER_ENABLED:E(),REDOCLY_DISABLE_API_FUNCTION_SANDBOX:E()});export{D as featureFlagsSchema};
+import{z as _}from"zod";import{envBooleanStringOptional as E}from"../../utils/envs/env-boolean-string.js";const N=_.object({NEW_CATALOG_ENABLED:E(),NEW_SCORECARDS_ENABLED:E(),ENABLE_COMMENTS:_.string().optional(),REDOCLY_EXP_DISABLE_MD_VALIDATION:E(),ENABLE_SOURCE_MAPS:E(),PLAN_GATES:_.string().optional(),REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_ENABLED:E(),REDOCLY_EXP_LLMSTXT_AGENT_FEEDBACK_URL:_.string().optional(),REDOCLY_EXP_LLMSTXT_AGENT_ENDPOINT:_.string().optional(),REDOCLY_DISABLE_API_FUNCTION_SANDBOX:E(),REDOCLY_EXP_MCP_ELICITATION_ENABLED:E()});export{N as featureFlagsSchema};

package/dist/server/constants/common.d.ts

@@ -11,6 +11,8 @@ export declare const DEFAULT_THEME_PLUGIN_PATH = "@redocly/theme/plugin.js";
 export declare const STYLES_FILE = "styles.css";
 export declare const DEFAULT_PROJECT_PLUGIN_PATHS: string[];
 export declare const JWT_SECRET_KEY: string;
+export declare const MCP_ACCESS_TOKEN_TTL_SEC: number;
+export declare const MCP_REFRESH_SESSION_LIFETIME_SEC: number;
 export declare const I18N_DIR_NAME = "@i18n";
 export declare const L10N_DIR_NAME = "@l10n";
 export declare const RESERVED_DIR_NAMES: string[];

package/dist/server/constants/common.js

@@ -1 +1 @@
-import{ServerRoutes as A}from"../../constants/api.js";import{USER_THEME_ALIAS as I}from"../../constants/common.js";import{envConfig as _}from"../config/env-config.js";const N="runtime",x="/assets",U="/_spec",l="/_bundle",M="static",a="redocly:::linkOriginal",P="@",i="default",m=new RegExp("((?!@i18n\\/|@l10n\\/)\\/?@.*?(?=\\/))","g"),F="@redocly/theme/plugin.js",H="styles.css",u=["@theme/plugin.js","@theme/plugin.cjs","@theme/plugin.mjs"],d=_.JWT_SECRET_KEY||"test_secret_key",c="@i18n",p="@l10n",G=[I,c,p],Y="https://redocly.com/auth/aud",K="catalog.json",B="scorecard.json",g="page-count.json",h="sitemap.xml",J="llms.txt",o=_.PROJECT_ID,R=_.PROJECT_SLUG,e=_.ORGANIZATION_ID,n=_.ORG_SLUG,E=_.BH_API_URL,s=E&&n&&R?`${E}/orgs/${n}/projects/${R}`:void 0,t=E&&e&&o?`${E}/orgs/${e}/projects/${o}`:void 0,S=E?`${E}/entitlements/.well-known/jwks`:"https://app.cloud.redocly.com/api/entitlements/.well-known/jwks",W=_.ENTITLEMENTS_JWKS_CDN_URL||S,f=s?`${s}/feedback`:"",j=t?`${t}/ai-agentic-conversations`:"",k=t?`${t}/semantic-search`:"",w="no-store",V=365*24*60*60,X="X-Redocly-Cache-Control",$="no-cache",v="public, s-maxage=86400, max-age=10, must-revalidate",y=_.AUTH_URL,b="Developer Documentation",T=_.REDOCLY_SSR_RENDER_MODE==="worker"?"worker":"main",Z=T==="main"?0:_.REDOCLY_SSR_WORKERS_MIN!=null?Number(_.REDOCLY_SSR_WORKERS_MIN):2,q=T==="main"?1:_.REDOCLY_SSR_WORKERS_MAX!=null?Number(_.REDOCLY_SSR_WORKERS_MAX):5,z="-----BEGIN CERTIFICATE-----",Q="-----END CERTIFICATE-----",__=!_.isDevelopMode&&_.REDOCLY_TELEMETRY!=="off"||_.REDOCLY_TELEMETRY==="on",E_="http://localhost:4318/v1/traces",t_=[A.HEALTH],r=_.SERVER_EDITOR_APP_URL||"http://127.0.0.1:3000",o_=_.REDOCLY_CORS_ORIGINS?_.REDOCLY_CORS_ORIGINS.split(",").map(L=>L.trim()).filter(Boolean).concat(r):[r],R_="markdown/partials",e_="markdown/partials-deps";export{o_ as ALLOWED_CORS_ORIGINS,Y as ALTERNATIVE_AUD_CLAIM_NAME,j as ASK_AI_API_URL,y as AUTH_URL,z as BEGIN_CERTIFICATE_DELIMITER,s as BH_API_PROJECTS_URL,t as BH_API_PROJECTS_URL_V2,w as CACHE_CONTROL_NO_STORE_HEADER_VALUE,$ as CACHE_CONTROL_PUBLIC_HTML,K as CATALOG_OUTPUT_FILE_NAME,V as DEFAULT_IMMUTABLE_CACHE_MAX_AGE,u as DEFAULT_PROJECT_PLUGIN_PATHS,F as DEFAULT_THEME_PLUGIN_PATH,b as DEFAULT_TITLE,i as DEFAULT_VERSION_NAME,U as DEPRECATED_PUBLIC_API_DEFINITIONS_FOLDER,Q as END_CERTIFICATE_DELIMITER,W as ENTITLEMENTS_JWKS_URL,f as FEEDBACK_API_URL,c as I18N_DIR_NAME,d as JWT_SECRET_KEY,p as L10N_DIR_NAME,a as LINK_ORIGINAL_ATTR_NAME,J as LLMS_TXT_FILE_NAME,R_ as MARKDOC_PARTIALS_DATA_KEY,e_ as MARKDOC_PARTIALS_DEPS_KEY,e as ORG_ID,n as ORG_SLUG,t_ as OTEL_EXCLUDED_ROUTES,E_ as OTEL_TRACES_DEV_URL,g as PAGE_COUNT_OUTPUT_FILE_NAME,o as PROJECT_ID,R as PROJECT_SLUG,l as PUBLIC_API_DEFINITIONS_FOLDER,x as PUBLIC_ASSETS_FOLDER,M as PUBLIC_STATIC_FOLDER,G as RESERVED_DIR_NAMES,N as RUNTIME_RESOURCES_DIR,B as SCORECARD_OUTPUT_FILE_NAME,k as SEMANTIC_SEARCH_API_URL,r as SERVER_EDITOR_APP_URL,h as SITEMAP_FILE_NAME,T as SSR_RENDER_MODE,q as SSR_WORKERS_MAX,Z as SSR_WORKERS_MIN,H as STYLES_FILE,__ as TELEMETRY_ENABLED,m as VERSIONED_FOLDER_REGEXP_MATCH,P as VERSION_SEPARATOR,X as X_REDOCLY_CACHE_CONTROL_HEADER,v as X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML};
+import{ServerRoutes as I}from"../../constants/api.js";import{USER_THEME_ALIAS as A}from"../../constants/common.js";import{envConfig as _}from"../config/env-config.js";const N="runtime",x="/assets",U="/_spec",M="/_bundle",P="static",l="redocly:::linkOriginal",a="@",i="default",m=new RegExp("((?!@i18n\\/|@l10n\\/)\\/?@.*?(?=\\/))","g"),F="@redocly/theme/plugin.js",H="styles.css",u=["@theme/plugin.js","@theme/plugin.cjs","@theme/plugin.mjs"],d=_.JWT_SECRET_KEY||"test_secret_key",G=3600,K=1440*60,c="@i18n",S="@l10n",Y=[A,c,S],B="https://redocly.com/auth/aud",g="catalog.json",h="scorecard.json",J="page-count.json",W="sitemap.xml",f="llms.txt",o=_.PROJECT_ID,R=_.PROJECT_SLUG,e=_.ORGANIZATION_ID,n=_.ORG_SLUG,E=_.BH_API_URL,s=E&&n&&R?`${E}/orgs/${n}/projects/${R}`:void 0,t=E&&e&&o?`${E}/orgs/${e}/projects/${o}`:void 0,p=E?`${E}/entitlements/.well-known/jwks`:"https://app.cloud.redocly.com/api/entitlements/.well-known/jwks",j=_.ENTITLEMENTS_JWKS_CDN_URL||p,k=s?`${s}/feedback`:"",w=t?`${t}/ai-agentic-conversations`:"",V=t?`${t}/semantic-search`:"",X="no-store",$=365*24*60*60,v="X-Redocly-Cache-Control",y="no-cache",b="public, s-maxage=86400, max-age=10, must-revalidate",Z=_.AUTH_URL,q="Developer Documentation",T=_.REDOCLY_SSR_RENDER_MODE==="worker"?"worker":"main",z=T==="main"?0:_.REDOCLY_SSR_WORKERS_MIN!=null?Number(_.REDOCLY_SSR_WORKERS_MIN):2,Q=T==="main"?1:_.REDOCLY_SSR_WORKERS_MAX!=null?Number(_.REDOCLY_SSR_WORKERS_MAX):5,__="-----BEGIN CERTIFICATE-----",E_="-----END CERTIFICATE-----",t_=!_.isDevelopMode&&_.REDOCLY_TELEMETRY!=="off"||_.REDOCLY_TELEMETRY==="on",o_="http://localhost:4318/v1/traces",R_=[I.HEALTH],r=_.SERVER_EDITOR_APP_URL||"http://127.0.0.1:3000",e_=_.REDOCLY_CORS_ORIGINS?_.REDOCLY_CORS_ORIGINS.split(",").map(L=>L.trim()).filter(Boolean).concat(r):[r],n_="markdown/partials",s_="markdown/partials-deps";export{e_ as ALLOWED_CORS_ORIGINS,B as ALTERNATIVE_AUD_CLAIM_NAME,w as ASK_AI_API_URL,Z as AUTH_URL,__ as BEGIN_CERTIFICATE_DELIMITER,s as BH_API_PROJECTS_URL,t as BH_API_PROJECTS_URL_V2,X as CACHE_CONTROL_NO_STORE_HEADER_VALUE,y as CACHE_CONTROL_PUBLIC_HTML,g as CATALOG_OUTPUT_FILE_NAME,$ as DEFAULT_IMMUTABLE_CACHE_MAX_AGE,u as DEFAULT_PROJECT_PLUGIN_PATHS,F as DEFAULT_THEME_PLUGIN_PATH,q as DEFAULT_TITLE,i as DEFAULT_VERSION_NAME,U as DEPRECATED_PUBLIC_API_DEFINITIONS_FOLDER,E_ as END_CERTIFICATE_DELIMITER,j as ENTITLEMENTS_JWKS_URL,k as FEEDBACK_API_URL,c as I18N_DIR_NAME,d as JWT_SECRET_KEY,S as L10N_DIR_NAME,l as LINK_ORIGINAL_ATTR_NAME,f as LLMS_TXT_FILE_NAME,n_ as MARKDOC_PARTIALS_DATA_KEY,s_ as MARKDOC_PARTIALS_DEPS_KEY,G as MCP_ACCESS_TOKEN_TTL_SEC,K as MCP_REFRESH_SESSION_LIFETIME_SEC,e as ORG_ID,n as ORG_SLUG,R_ as OTEL_EXCLUDED_ROUTES,o_ as OTEL_TRACES_DEV_URL,J as PAGE_COUNT_OUTPUT_FILE_NAME,o as PROJECT_ID,R as PROJECT_SLUG,M as PUBLIC_API_DEFINITIONS_FOLDER,x as PUBLIC_ASSETS_FOLDER,P as PUBLIC_STATIC_FOLDER,Y as RESERVED_DIR_NAMES,N as RUNTIME_RESOURCES_DIR,h as SCORECARD_OUTPUT_FILE_NAME,V as SEMANTIC_SEARCH_API_URL,r as SERVER_EDITOR_APP_URL,W as SITEMAP_FILE_NAME,T as SSR_RENDER_MODE,Q as SSR_WORKERS_MAX,z as SSR_WORKERS_MIN,H as STYLES_FILE,t_ as TELEMETRY_ENABLED,m as VERSIONED_FOLDER_REGEXP_MATCH,a as VERSION_SEPARATOR,v as X_REDOCLY_CACHE_CONTROL_HEADER,b as X_REDOCLY_CACHE_CONTROL_PUBLIC_HTML};

package/dist/server/constants/entitlements.js

@@ -1 +1 @@
-const e={pro:{rbac:!1,sso:!1,analytics:!0,removeAttribution:!1,advancedSearch:!1,ssoDirect:!1,aiSearchLimit:0,kvStorageLimit:.5,mcp:!1},enterprise:{rbac:!0,sso:!0,analytics:!0,removeAttribution:!0,advancedSearch:!0,ssoDirect:!1,aiSearchLimit:750,kvStorageLimit:5,mcp:!0}},t=["@redocly/portal-plugin-async-api/plugin.js","@redocly/portal-plugin-mock-server/plugin.js","@redocly/portal-plugin-soap-api/plugin.js"],r={"code-walkthrough":"codeWalkthrough",step:"codeWalkthrough",toggle:"codeWalkthrough",input:"codeWalkthrough"};export{r as GATED_MARKDOC_TAGS,t as GATED_PLUGINS,e as PLAN_GATES_DEFAULTS};
+const e={pro:{rbac:!1,sso:!1,analytics:!0,removeAttribution:!1,advancedSearch:!1,ssoDirect:!1,aiSearchLimit:0,kvStorageLimit:.5,mcp:!1,mcpGateway:!1,mcpMode:"tools"},enterprise:{rbac:!0,sso:!0,analytics:!0,removeAttribution:!0,advancedSearch:!0,ssoDirect:!1,aiSearchLimit:750,kvStorageLimit:5,mcp:!0,mcpGateway:!0,mcpMode:"code"}},t=["@redocly/portal-plugin-async-api/plugin.js","@redocly/portal-plugin-mock-server/plugin.js","@redocly/portal-plugin-soap-api/plugin.js"],a={"code-walkthrough":"codeWalkthrough",step:"codeWalkthrough",toggle:"codeWalkthrough",input:"codeWalkthrough"};export{a as GATED_MARKDOC_TAGS,t as GATED_PLUGINS,e as PLAN_GATES_DEFAULTS};

package/dist/server/plugins/config-parser/loaders/utils/read-and-validate-config.js

@@ -1 +1 @@
-import w from"path";import{lintConfig as A,loadConfig as T,createConfigTypes as U}from"@redocly/openapi-core";import{deepMerge as $}from"../../../../../utils/object/deep-merge.js";import{logger as d}from"../../../../tools/notifiers/logger.js";import{BRANCH_ENV_PREFIX as L}from"../../../../../constants/common.js";import{sanitizeBranchName as x}from"../../../../utils/envs/sanitize-branch-name.js";import{envConfig as C}from"../../../../config/env-config.js";import{safeParsePartial as E}from"../../safe-parse.js";import{formatConfigProblem as B}from"../../format-error.js";import{ExternalResolver as j}from"../../../../fs/utils/external-ref-resolver.js";import{resolveMutuallyExclusiveProps as q}from"../../resolve-mutual-exclusion.js";function g(e,t,s,o){t in e&&e[t]&&typeof e[t]=="string"&&(/^https?:\/\/.*/.test(e[t])||o(new Error(`Invalid ${s} URL: "${e[t]}". ${s} must start with "http://" or "https://".`)))}function N(e,t){if("access"in e&&e.access&&typeof e.access=="object"){const s=e.access;g(s,"logoutReturnUrl","access.logoutReturnUrl",t),g(s,"residency","access.residency",t);const o=["requiresLogin","logoutReturnUrl","residency","sso","rbac"];for(const a of o)a in s&&s[a]!==void 0&&a in e&&e[a]!==void 0&&t(new Error(`Property '${a}' is defined both at root level and in 'access' object. Please use 'access.${a}' to define this configuration.`))}}async function G(e,t,s,o){const u=t.getFileInfo(e)?.realRelativePath||e;async function c(){const l=new j(t),p=w.join(t.cwd,u),i=await T({configPath:p,externalRefResolver:l}),f=await o(i.resolvedConfig);if(f===void 0)return i.resolvedConfig;const P=[...i.document?.source?await A({config:i,externalConfigTypes:U(f,i)}):[],...i.document?.source?q(i.resolvedConfig,i.document?.source):[]];if(P.length>0)for(const b of P)s(new Error(B(b,t.cwd)));return i.resolvedConfig}const r=await t.exists(e)?await c():{},R=k(r),y=await o(r);g(r,"residency","Residency",s),g(r,"logoutReturnUrl","Logout return URL",s),N(r,s);let m=y?E(y,r):r;const{env:h}=m;if(h){const l=C.REDOCLY_ENV,p=h[l]||{},i=C.PUBLIC_REDOCLY_BRANCH_NAME||"",f=i?x(i):"",v=f&&h[`${L}${f}`]||{};m=$(m,v,p)}const n=I(m,R);if(n.imports&&n.imports.length>0){d.warn("The 'imports' property is deprecated. Please use 'plugins' property instead.");const l=new Set([...n.plugins||[],...n.imports.map(p=>w.posix.join(p,"plugin.js"))]);n.plugins=Array.from(l),delete n.imports}if(n.catalog&&(d.warn("The 'catalog' property is deprecated. Please use 'catalogClassic' property instead."),n.catalogClassic={...n.catalog},delete n.catalog),n.scorecard&&(d.warn("The 'scorecard' property is deprecated. Please use 'scorecardClassic' property instead."),n.scorecardClassic=n.scorecard,delete n.scorecard),n.search?.ai){d.warn("The 'search.ai' property is deprecated. Please use 'aiAssistant' property instead.");const l={...n.search?.ai,...n.aiAssistant,suggestions:n.aiAssistant?.suggestions?.length?n.aiAssistant.suggestions:n.search?.ai.suggestions||[]};n.aiAssistant=l,delete n.search.ai}return _(n)}function _(e){const t={...e},o={..."access"in e&&e.access&&typeof e.access=="object"?e.access:{}},a=["requiresLogin","logoutReturnUrl","residency","sso","idps","rbac"],u=[];for(const c of a){const r=t[c];r!==void 0&&(u.push(c),c==="requiresLogin"&&o.requiresLogin===void 0&&(o.requiresLogin=r),c==="logoutReturnUrl"&&o.logoutReturnUrl===void 0&&(o.logoutReturnUrl=r),c==="residency"&&o.residency===void 0&&(o.residency=r),c==="sso"&&o.sso===void 0&&(o.sso=r),c==="idps"&&o.idps===void 0&&(o.idps=r),c==="rbac"&&o.rbac===void 0&&(o.rbac=r),delete t[c])}return u.length>0&&d.warn(`The following properties at root level are deprecated: ${u.join(", ")}. Please move them to the 'access' object.`),Object.keys(o).length>0&&(t.access=o),t}function k(e){if(!e.theme)return[];d.warn("The 'theme' property in redocly.yaml is deprecated. Please move all of the properties from 'theme' to the root of the config.");const t=[];for(const s of Object.keys(e.theme))e[s]==null?t.push(s):d.warn(`Detected both '${s}' and 'theme.${s}' properties in redocly.yaml. The 'theme.${s}' property will be ignored and needs to be removed or merged into the '${s}'.`);return t}function I(e,t){if(!e.theme||t.length===0)return e;const s={...e};for(const o of t)s[o]=e.theme[o];return delete s.theme,s}export{_ as ensureAccessBackwardsCompatibility,G as readAndValidateConfig};
+import w from"path";import{lintConfig as A,loadConfig as T,createConfigTypes as U}from"@redocly/openapi-core";import{deepMerge as $}from"../../../../../utils/object/deep-merge.js";import{logger as d}from"../../../../tools/notifiers/logger.js";import{BRANCH_ENV_PREFIX as L}from"../../../../../constants/common.js";import{sanitizeBranchName as x}from"../../../../utils/envs/sanitize-branch-name.js";import{envConfig as C}from"../../../../config/env-config.js";import{safeParsePartial as E}from"../../safe-parse.js";import{formatConfigProblem as B}from"../../format-error.js";import{ExternalResolver as j}from"../../../../fs/utils/external-ref-resolver.js";import{resolveMutuallyExclusiveProps as q}from"../../resolve-mutual-exclusion.js";function h(e,t,s,o){t in e&&e[t]&&typeof e[t]=="string"&&(/^https?:\/\/.*/.test(e[t])||o(new Error(`Invalid ${s} URL: "${e[t]}". ${s} must start with "http://" or "https://".`)))}function N(e,t){if("access"in e&&e.access&&typeof e.access=="object"){const s=e.access;h(s,"logoutReturnUrl","access.logoutReturnUrl",t),h(s,"residency","access.residency",t);const o=["requiresLogin","logoutReturnUrl","residency","sso","rbac"];for(const a of o)a in s&&s[a]!==void 0&&a in e&&e[a]!==void 0&&t(new Error(`Property '${a}' is defined both at root level and in 'access' object. Please use 'access.${a}' to define this configuration.`))}}async function J(e,t,s,o){const p=t.getFileInfo(e)?.realRelativePath||e;async function i(){const l=new j(t),u=w.join(t.cwd,p),c=await T({configPath:u,externalRefResolver:l}),f=await o(c.resolvedConfig);if(f===void 0)return c.resolvedConfig;const m=c.document?.source,P=[...m?await A({config:c,externalConfigTypes:U(f,c)}):[],...m?q(c.resolvedConfig,m):[]];if(P.length>0)for(const b of P)s(new Error(B(b,t.cwd)));return c.resolvedConfig}const r=await t.exists(e)?await i():{},R=k(r),v=await o(r);h(r,"residency","Residency",s),h(r,"logoutReturnUrl","Logout return URL",s),N(r,s);let g=v?E(v,r):r;const{env:y}=g;if(y){const l=C.REDOCLY_ENV,u=y[l]||{},c=C.PUBLIC_REDOCLY_BRANCH_NAME||"",f=c?x(c):"",m=f&&y[`${L}${f}`]||{};g=$(g,m,u)}const n=I(g,R);if(n.imports&&n.imports.length>0){d.warn("The 'imports' property is deprecated. Please use 'plugins' property instead.");const l=new Set([...n.plugins||[],...n.imports.map(u=>w.posix.join(u,"plugin.js"))]);n.plugins=Array.from(l),delete n.imports}if(n.catalog&&(d.warn("The 'catalog' property is deprecated. Please use 'catalogClassic' property instead."),n.catalogClassic={...n.catalog},delete n.catalog),n.scorecard&&(d.warn("The 'scorecard' property is deprecated. Please use 'scorecardClassic' property instead."),n.scorecardClassic=n.scorecard,delete n.scorecard),n.search?.ai){d.warn("The 'search.ai' property is deprecated. Please use 'aiAssistant' property instead.");const l={...n.search?.ai,...n.aiAssistant,suggestions:n.aiAssistant?.suggestions?.length?n.aiAssistant.suggestions:n.search?.ai.suggestions||[]};n.aiAssistant=l,delete n.search.ai}return _(n)}function _(e){const t={...e},o={..."access"in e&&e.access&&typeof e.access=="object"?e.access:{}},a=["requiresLogin","logoutReturnUrl","residency","sso","idps","rbac"],p=[];for(const i of a){const r=t[i];r!==void 0&&(p.push(i),i==="requiresLogin"&&o.requiresLogin===void 0&&(o.requiresLogin=r),i==="logoutReturnUrl"&&o.logoutReturnUrl===void 0&&(o.logoutReturnUrl=r),i==="residency"&&o.residency===void 0&&(o.residency=r),i==="sso"&&o.sso===void 0&&(o.sso=r),i==="idps"&&o.idps===void 0&&(o.idps=r),i==="rbac"&&o.rbac===void 0&&(o.rbac=r),delete t[i])}return p.length>0&&d.warn(`The following properties at root level are deprecated: ${p.join(", ")}. Please move them to the 'access' object.`),Object.keys(o).length>0&&(t.access=o),t}function k(e){if(!e.theme)return[];d.warn("The 'theme' property in redocly.yaml is deprecated. Please move all of the properties from 'theme' to the root of the config.");const t=[];for(const s of Object.keys(e.theme))e[s]==null?t.push(s):d.warn(`Detected both '${s}' and 'theme.${s}' properties in redocly.yaml. The 'theme.${s}' property will be ignored and needs to be removed or merged into the '${s}'.`);return t}function I(e,t){if(!e.theme||t.length===0)return e;const s={...e};for(const o of t)s[o]=e.theme[o];return delete s.theme,s}export{_ as ensureAccessBackwardsCompatibility,J as readAndValidateConfig};

package/dist/server/plugins/markdown/search/create-render-tag-fn.d.ts

@@ -1,4 +1,5 @@
 import type { MarkdocTagSchema } from '@redocly/theme/markdoc/tags/types';
+import type { TFunction } from '@redocly/theme/core/types';
 import type { RenderTagFn } from '../../../types/plugins/markdown';
-export declare function createRenderTagFn(markdocTags: Record<string, MarkdocTagSchema> | undefined): RenderTagFn;
+export declare function createRenderTagFn(markdocTags: Record<string, MarkdocTagSchema> | undefined, locale: string, translate: TFunction): RenderTagFn;
 //# sourceMappingURL=create-render-tag-fn.d.ts.map

package/dist/server/plugins/markdown/search/create-render-tag-fn.js

@@ -1 +1 @@
-function t(e){return(r,n)=>{if(r.tag)return e?.[r.tag]?.renderForLlms?.(r,n)}}export{t as createRenderTagFn};
+function a(e,n,t){return(r,u)=>{if(r.tag)return e?.[r.tag]?.renderForLlms?.(r,{...u,locale:n,translate:t})}}export{a as createRenderTagFn};

package/dist/server/plugins/markdown/search/get-ai-search-documents.js

@@ -1,9 +1,9 @@
-import _ from"@markdoc/markdoc";import D from"node:path";import{AI_SEARCH_CHUNK_SIZE as E,AI_SEARCH_DOCUMENT_CHUNK_SIZE as M}from"../../../constants/plugins/search.js";import{slugger as P}from"../../../../utils/slugger.js";import{joinSectionContent as U}from"./join-section-content.js";import{toMarkdown as b}from"./to-markdown.js";import{AstToSearchNodeTransformer as I}from"./walk-sections.js";import{createRenderTagFn as x}from"./create-render-tag-fn.js";import{getLocaleFromRelativePath as y}from"../../../fs/utils/get-locale-from-relative-path.js";import{HeadingNode as L}from"./nodes/heading-node.js";import{extractDocumentSearchFacets as H}from"./search-facets.js";import{formatDocumentMetadata as K}from"../../search/utils.js";import{TagNode as N}from"./nodes/tag-node.js";import{MARKDOC_PARTIALS_DATA_KEY as R}from"../../../constants/common.js";const j=Symbol(),et=(n,r)=>async(e,c,i,s)=>{if(r?.excludeFromSearch)return;P.reset();const a=await e.getNavText?.()||D.basename(e.fsPath),u=_.Ast.fromJSON(c.ast),f=new I({partials:s.getGlobalConfig(R)||{},renderTag:x(s.markdocOptions.tags),getInnerContent:b,ast:u,skipConditionals:!0}),d=Array.from(f.transform());return{async getLLMsTxts(){const o=r?.seo,g=o&&typeof o=="object"&&"description"in o?String(o.description):void 0,C=U(d);return[{title:a,description:g,slug:e.slug,fsPath:e.fsPath,content:C,includeInLLMsTxt:!0}]},async getSearchDocuments(){return F(e,d,n,a)}}};function F(n,r,e,c){const i=n.slug,s=new Map,a=n.metadata||{},u=H(a,e),f=K(a),d=f?`Metadata:
-${f}
-`:"";let o=[];for(const t of r)if(t instanceof L){o.splice(t.attributes.level-1,6);const l=t.attributes.level>2,m=o[o.length-1]?.title,S=o[o.length-1]?.url,T=l&&m?m:O(c,t),A=l&&S?S:t.getUrl(i),h={title:T,content:"",url:A,level:t.attributes.level,toc:o.map(v=>p(v.section)).join(`
-`)};(t.attributes.level>1||p(t)!==c)&&(h.content+=h.content?`
-`:"",h.content+=t.content.trimEnd()),s.set(t.id,h),o.push({section:t,title:T,url:A})}else if(t instanceof N)s.set(t.id,{title:t.content,content:t.content,url:t.getUrl(i),level:t.attributes.level+1,toc:o.map(l=>p(l.section)).concat(t.content).join(`
-`)});else{const l=t.parentNode?.id??j,m=s.get(l)??{title:c,content:"",url:i,level:1/0,toc:""};m.content+=m.content?`
-`:"",m.content+=t.content.trimEnd(),s.set(l,m)}const g=w(Array.from(s.values())),C=y(n.fsPath);return g.filter(t=>t.content).map(t=>({title:t.title,url:t.url,content:[d,t.toc||`# ${c}`,t.content].filter(Boolean).join(`
-`),fsPath:n.fsPath,locale:C,product:n.product?.name,facets:u}))}function k(n){return n.length/4}function w(n){if(n.length===0)return[];const r=[];let e=n[0];for(let c=1;c<n.length;c++){const i=n[c],s=k(e.content),a=k(i.content),u=c===n.length-1;a<E&&(s<M||u)&&i.level>e.level?e.content+=`
-`+i.content:(r.push(e),e=i)}return r.push(e),r}function O(n,r){return r.content===n?n:`${n} \u2192 ${p(r)}`}function p(n){return n.content.replace(/^#+/,"").trim()}export{et as getAiDocumentsStore};
+import _ from"@markdoc/markdoc";import D from"node:path";import{AI_SEARCH_CHUNK_SIZE as b,AI_SEARCH_DOCUMENT_CHUNK_SIZE as E}from"../../../constants/plugins/search.js";import{slugger as M}from"../../../../utils/slugger.js";import{joinSectionContent as P}from"./join-section-content.js";import{toMarkdown as U}from"./to-markdown.js";import{AstToSearchNodeTransformer as x}from"./walk-sections.js";import{createRenderTagFn as I}from"./create-render-tag-fn.js";import{getBuildTranslateContext as y}from"../../../utils/l10n/get-build-translate-context.js";import{getLocaleFromRelativePath as L}from"../../../fs/utils/get-locale-from-relative-path.js";import{HeadingNode as H}from"./nodes/heading-node.js";import{extractDocumentSearchFacets as K}from"./search-facets.js";import{formatDocumentMetadata as N}from"../../search/utils.js";import{TagNode as R}from"./nodes/tag-node.js";import{MARKDOC_PARTIALS_DATA_KEY as j}from"../../../constants/common.js";const w=Symbol(),rt=(n,o)=>async(e,r,i,c)=>{if(o?.excludeFromSearch)return;M.reset();const l=await e.getNavText?.()||D.basename(e.fsPath),f=_.Ast.fromJSON(r.ast),{locale:d,translate:C}=await y(e.slug,c.getGlobalData?.().l10n),s=new x({partials:c.getGlobalConfig(j)||{},renderTag:I(c.markdocOptions.tags,d,C),getInnerContent:U,ast:f,skipConditionals:!0}),g=Array.from(s.transform());return{async getLLMsTxts(){const u=o?.seo,t=u&&typeof u=="object"&&"description"in u?String(u.description):void 0,a=P(g);return[{title:l,description:t,slug:e.slug,fsPath:e.fsPath,content:a,includeInLLMsTxt:!0}]},async getSearchDocuments(){return F(e,g,n,l)}}};function F(n,o,e,r){const i=n.slug,c=new Map,l=n.metadata||{},f=K(l,e),d=N(l),C=d?`Metadata:
+${d}
+`:"";let s=[];for(const t of o)if(t instanceof H){s.splice(t.attributes.level-1,6);const a=t.attributes.level>2,m=s[s.length-1]?.title,S=s[s.length-1]?.url,T=a&&m?m:$(r,t),A=a&&S?S:t.getUrl(i),h={title:T,content:"",url:A,level:t.attributes.level,toc:s.map(v=>p(v.section)).join(`
+`)};(t.attributes.level>1||p(t)!==r)&&(h.content+=h.content?`
+`:"",h.content+=t.content.trimEnd()),c.set(t.id,h),s.push({section:t,title:T,url:A})}else if(t instanceof R)c.set(t.id,{title:t.content,content:t.content,url:t.getUrl(i),level:t.attributes.level+1,toc:s.map(a=>p(a.section)).concat(t.content).join(`
+`)});else{const a=t.parentNode?.id??w,m=c.get(a)??{title:r,content:"",url:i,level:1/0,toc:""};m.content+=m.content?`
+`:"",m.content+=t.content.trimEnd(),c.set(a,m)}const g=O(Array.from(c.values())),u=L(n.fsPath);return g.filter(t=>t.content).map(t=>({title:t.title,url:t.url,content:[C,t.toc||`# ${r}`,t.content].filter(Boolean).join(`
+`),fsPath:n.fsPath,locale:u,product:n.product?.name,facets:f}))}function k(n){return n.length/4}function O(n){if(n.length===0)return[];const o=[];let e=n[0];for(let r=1;r<n.length;r++){const i=n[r],c=k(e.content),l=k(i.content),f=r===n.length-1;l<b&&(c<E||f)&&i.level>e.level?e.content+=`
+`+i.content:(o.push(e),e=i)}return o.push(e),o}function $(n,o){return o.content===n?n:`${n} \u2192 ${p(o)}`}function p(n){return n.content.replace(/^#+/,"").trim()}export{rt as getAiDocumentsStore};

package/dist/server/plugins/mcp/codemode/tools/execute.js

@@ -1 +1 @@
-import{mcpToolHandlers as s}from"../../../../../client/mcp-tool-handlers-entry.js";import{runInSandbox as c}from"../../../../sandbox/sandbox.js";import{isMcpToolAvailable as l}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as m,isFetchCapable as f}from"../../gateway-mcp/fetch-capability.js";import{CODE_MODE_TOOL_NAMES as u,EXECUTE_TOOL_NAME as p}from"../constants.js";import{sanitizeToolName as d}from"../build-tool-type-declarations.js";import{invokeTool as b}from"../invoke-tool.js";import{createSandboxSetup as T}from"../sandbox/create-sandbox-setup.js";const E=async(e,t,i)=>{const o=await O(t,i),n=f(t)?m(t):void 0,{result:r,error:a}=await c(e.code,{setupContext:T(o,n)});return{content:[{type:"text",text:JSON.stringify({result:r,error:a})}],isError:a!==void 0}};async function O(e,t){const i={};for(const o of Object.keys(s))u.has(o)||!await l({toolName:o,context:e}).catch(()=>!1)||(i[d(o)]=r=>b(o,r,e,t));return i}var C={[p]:E};export{C as default};
+import{mcpToolHandlers as l}from"../../../../../client/mcp-tool-handlers-entry.js";import{runInSandbox as m}from"../../../../sandbox/sandbox.js";import{isMcpToolAvailable as u}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as f,isFetchCapable as p}from"../../gateway-mcp/fetch-capability.js";import{withAuthRequiredMeta as d}from"../../gateway-mcp/upstream-auth.js";import{CODE_MODE_TOOL_NAMES as b,EXECUTE_TOOL_NAME as h}from"../constants.js";import{sanitizeToolName as E}from"../build-tool-type-declarations.js";import{invokeTool as T}from"../invoke-tool.js";import{createSandboxSetup as O}from"../sandbox/create-sandbox-setup.js";const A=async(e,t,i)=>{const o=await v(t,i),r=[],n=p(t)?f(t,c=>r.push(c)):void 0,{result:a,error:s}=await m(e.code,{setupContext:O(o,n)});return d({content:[{type:"text",text:JSON.stringify({result:a,error:s})}],isError:s!==void 0},r)};async function v(e,t){const i={};for(const o of Object.keys(l))b.has(o)||!await u({toolName:o,context:e}).catch(()=>!1)||(i[E(o)]=n=>T(o,n,e,t));return i}var F={[h]:A};export{F as default};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -0,0 +1,25 @@
+import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
+import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
+export declare const ELICITATION_TIMEOUT_MS = 300000;
+export type SendElicitRequest = (request: object, resultSchema: unknown, options: {
+    timeout: number;
+}) => Promise<{
+    action: string;
+}>;
+export type ElicitationOutcome = {
+    status: 'accepted';
+} | {
+    status: 'fallback';
+    text: string;
+} | {
+    status: 'skipped';
+};
+export declare function runUpstreamCredentialElicitation({ sendRequest, clientSupportsElicitation, sessionId, baseUrl, events, auth, }: {
+    sendRequest: SendElicitRequest;
+    clientSupportsElicitation: boolean;
+    sessionId: string;
+    baseUrl: string;
+    events: UpstreamAuthRequiredEvent[];
+    auth: UpstreamAuthScheme;
+}): Promise<ElicitationOutcome>;
+//# sourceMappingURL=elicitation.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -0,0 +1,2 @@
+import{ElicitResultSchema as m}from"@redocly/mcp-typescript-sdk/types.js";import{logger as d}from"../../../tools/notifiers/logger.js";import{secretStore as p,ELICITATION_TTL_MS as h}from"./secret-store.js";const f=3e5;async function $({sendRequest:e,clientSupportsElicitation:t,sessionId:r,baseUrl:i,events:n,auth:s}){const a=n[0],l=p.createElicitation({sessionId:r,api:a.api,name:a.name,auth:s}),c=g(i,l);if(!t)return{status:"fallback",text:u(n,c)};try{return(await e({method:"elicitation/create",params:{mode:"url",message:`The "${a.name}" API requires credentials. Open the link to provide them securely; they never pass through the chat.`,url:c,elicitationId:l}},m,{timeout:f})).action==="accept"?{status:"accepted"}:{status:"skipped"}}catch(o){return d.warn(`URL-mode elicitation failed, falling back to markdown link: ${o instanceof Error?o.message:String(o)}`),{status:"fallback",text:u(n,c)}}}function g(e,t){if(!e)return`/mcp/credentials?token=${t}`;try{const r=new URL("/mcp/credentials",e);return r.searchParams.set("token",t),r.toString()}catch{return`${e}/mcp/credentials?token=${t}`}}function u(e,t){const[r,...i]=e,n=[`The upstream API "${r.name}" returned 401 Unauthorized.`,"",`**Action required: show the user the link below and ask them to open it in a browser to provide the API credentials (valid ${Math.round(h/6e4)} minutes):**`,"",t,"","Then call this tool again - the credentials are applied server-side and never appear in the conversation."];if(i.length>0){const s=i.map(a=>`"${a.name}"`).join(", ");n.push("",`The remaining APIs (${s}) will prompt for credentials on subsequent calls.`)}return n.join(`
+`)}export{f as ELICITATION_TIMEOUT_MS,$ as runUpstreamCredentialElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -1,18 +1,8 @@
 import type { OpenAPIDefinition } from '@redocly/openapi-docs';
 import type { OpenAPIMcp } from '@redocly/openapi-docs/lib/types/open-api.js';
-import type { RbacConfig } from '@redocly/config';
-type GatewayVisibility = {
-    hide?: boolean;
-    docs?: {
-        hide?: boolean;
-        ignore?: readonly string[];
-    };
-    gateway?: {
-        hide?: boolean;
-    };
-};
-/** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs/gateway hidden. */
-export declare function isGatewayCapabilityEnabled(mcp: GatewayVisibility | undefined): boolean;
+import type { RbacConfig, RedoclyConfig } from '@redocly/config';
+/** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
+export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;
 /** Whether an API is eligible for the gateway (fetch-capable `execute` + `/mcp` advertisement). */
 export declare function isGatewayEligible(info: OpenAPIDefinition['info'] | undefined, relativePath: string, rbacConfig: RbacConfig): boolean;
 /**
@@ -24,7 +14,6 @@ export declare function shouldAdvertiseGatewayXMcp(definition: (OpenAPIDefinitio
     'x-mcp'?: {
         servers?: unknown[];
     };
-}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig: GatewayVisibility | undefined): boolean;
+}) | undefined, relativePath: string, rbacConfig: RbacConfig, mcpConfig?: RedoclyConfig['mcp']): boolean;
 export declare function buildGatewayXMcp(url: string): OpenAPIMcp;
-export {};
 //# sourceMappingURL=eligibility.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/eligibility.js

@@ -1 +1 @@
-import{join as r}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as a}from"../../../../constants/common.js";import{canDownloadApiDefinition as n}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as l}from"../utils.js";import{isMcpGatewayEnabled as c}from"../utils/mode.js";import{isDefinitionHidden as f,hasGatewayConfig as m}from"../utils/xmcp-utils.js";function u(o){return c()&&!o?.hide&&!o?.docs?.hide&&!o?.gateway?.hide}function d(o,e,i){return f(o,"gateway")?!1:n(r(s,e),i,!1,{isAuthenticated:!1,teams:[a]})||m(o)}function D(o,e,i,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,e,i)&&l(e,o,t)}function M(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{M as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,D as shouldAdvertiseGatewayXMcp};
+import{join as e}from"node:path";import{PUBLIC_API_DEFINITIONS_FOLDER as s}from"../../../constants/common.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as a}from"../../../../constants/common.js";import{canDownloadApiDefinition as n}from"../../../utils/rbac.js";import{MCP_PROTOCOL_VERSION as p}from"../constants.js";import{isApiIncludedInDocsMcp as c}from"../utils.js";import{isMcpGatewayEnabled as l}from"../utils/mode.js";import{isDefinitionHidden as m,hasGatewayConfig as f}from"../utils/xmcp-utils.js";function u(o){return l()&&!o?.hide&&!o?.docs?.hide}function d(o,i,r){return m(o,"gateway")?!1:n(e(s,i),r,!1,{isAuthenticated:!1,teams:[a]})||f(o)}function D(o,i,r,t){return u(t)&&!o?.["x-mcp"]?.servers?.length&&d(o?.info,i,r)&&c(i,o,t)}function M(o){return{protocolVersion:p,capabilities:{tools:{}},servers:[{url:o}],tools:[],resources:[],prompts:[]}}export{M as buildGatewayXMcp,u as isGatewayCapabilityEnabled,d as isGatewayEligible,D as shouldAdvertiseGatewayXMcp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.d.ts

@@ -1,13 +1,13 @@
 import type { OpenAPIServer } from '@redocly/openapi-docs/lib/types/open-api.js';
 /**
- * Build case-insensitive host matchers from an API's server URL templates (plus any
- * configured extra hosts). A server URL host may contain server-variable placeholders
- * (e.g. a tenant `{subdomain}`); each placeholder expands to its `enum` values, or - when
- * free-form - to one DNS label plus any fixed parent domain carried by the variable's
- * `default`. So `{subdomain}.dealpos.com` matches `acme.dealpos.com`, and a whole-host
- * `{subdomain}` defaulting to `acme.dealpos.net` matches `<tenant>.dealpos.net`, but neither
- * matches `a.b.dealpos.com`, the bare parent domain, or an unrelated host.
+ * Build case-insensitive host matchers from an API's server URL templates. A server URL host
+ * may contain server-variable placeholders (e.g. a tenant `{subdomain}`); each placeholder
+ * expands to its `enum` values, or - when free-form - to one DNS label plus any fixed parent
+ * domain carried by the variable's `default`. So `{subdomain}.dealpos.com` matches
+ * `acme.dealpos.com`, and a whole-host `{subdomain}` defaulting to `acme.dealpos.net` matches
+ * `<tenant>.dealpos.net`, but neither matches `a.b.dealpos.com`, the bare parent domain, or an
+ * unrelated host.
  */
-export declare function buildAllowedHostMatchers(servers?: readonly OpenAPIServer[], extraHosts?: readonly string[]): RegExp[];
+export declare function buildAllowedHostMatchers(servers?: readonly OpenAPIServer[]): RegExp[];
 export declare function isHostAllowed(host: string, matchers: readonly RegExp[]): boolean;
 //# sourceMappingURL=allowed-hosts.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.js

@@ -1 +1 @@
-const i=/\{([^}]+)\}/g;function m(n=[],e=[]){const t=[];for(const r of n){const o=u(r);o&&t.push(o)}for(const r of e){const o=h(r);o&&t.push(o)}return t}function p(n,e){return e.some(t=>t.test(n))}function u(n){const e=f(n.url);if(!e)return null;let t="",r=0;for(const o of e.matchAll(i)){const[c,l]=o;t+=s(e.slice(r,o.index)),t+=a(n.variables?.[l]),r=o.index+c.length}return t+=s(e.slice(r)),t.includes("\\.")?new RegExp(`^${t}$`,"i"):null}function a(n){const e=n?.enum?.filter(Boolean);if(e&&e.length>0)return`(?:${e.map(s).join("|")})`;const t=n?.default?.split(".").slice(1).join(".");return t?`[^.]+\\.${s(t)}`:"[^.]+"}function h(n){const e=n.trim().toLowerCase();return e?e.startsWith("*.")?new RegExp(`^[^.]+\\.${s(e.slice(2))}$`,"i"):new RegExp(`^${s(e)}$`,"i"):null}function f(n){if(!n)return null;const t=n.replace(/^[a-z][a-z0-9+.-]*:\/\//i,"").split(/[/?#]/,1)[0];return t&&(t.includes("@")?t.slice(t.lastIndexOf("@")+1):t).replace(/:(?:\d+|\{[^}]+\})$/,"")||null}function s(n){return n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{m as buildAllowedHostMatchers,p as isHostAllowed};
+const h=/\{([^}]+)\}/g;function g(n=[]){const e=[];for(const t of n){const r=p(t);r&&e.push(r)}return e}function x(n,e){return e.some(t=>t.test(n))}function p(n){const e=m(n.url);if(!e)return null;let t="",r=0,o=!1;for(const l of e.matchAll(h)){const[i,f]=l,c=e.slice(r,l.index);c.includes(".")&&(o=!0),t+=s(c);const u=d(n.variables?.[f]);u.guaranteesDot&&(o=!0),t+=u.pattern,r=l.index+i.length}const a=e.slice(r);return a.includes(".")&&(o=!0),t+=s(a),o?new RegExp(`^${t}$`,"i"):null}function d(n){const e=n?.enum?.filter(Boolean);if(e&&e.length>0)return{pattern:`(?:${e.map(s).join("|")})`,guaranteesDot:e.every(r=>r.includes("."))};const t=n?.default?.split(".").slice(1).join(".");return t?{pattern:`[^.]+\\.${s(t)}`,guaranteesDot:!0}:{pattern:"[^.]+",guaranteesDot:!1}}function m(n){if(!n)return null;const t=n.replace(/^[a-z][a-z0-9+.-]*:\/\//i,"").split(/[/?#]/,1)[0];return t&&(t.includes("@")?t.slice(t.lastIndexOf("@")+1):t).replace(/:(?:\d+|\{[^}]+\})$/,"")||null}function s(n){return n.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{g as buildAllowedHostMatchers,x as isHostAllowed};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -1,12 +1,26 @@
+import { Agent, type Dispatcher } from 'undici';
 import type { SandboxFetch } from '../../codemode/types.js';
+import type { UpstreamAuthRequiredEvent } from '../upstream-auth.js';
+import type { StoredSecret } from '../secret-store.js';
+export declare const ssrfSafeAgent: Agent;
+export type FetchBridgeApi = {
+    slug: string;
+    name: string;
+    matchers: readonly RegExp[];
+    secret?: StoredSecret;
+};
 type FetchBridgeOptions = {
     allowedHosts: readonly RegExp[];
+    apis?: readonly FetchBridgeApi[];
     authorization?: string;
+    onAuthRequired?: (event: UpstreamAuthRequiredEvent) => void;
     fetchImpl?: typeof fetch;
+    dispatcher?: Dispatcher;
     timeoutMs?: number;
     maxResponseBytes?: number;
 };
 /** Build the host-side `fetch` the gateway sandbox calls. */
-export declare function buildFetchBridge({ allowedHosts, authorization, fetchImpl, timeoutMs, maxResponseBytes, }: FetchBridgeOptions): SandboxFetch;
+export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, }: FetchBridgeOptions): SandboxFetch;
+export declare function readCappedBody(response: Response, maxBytes: number): Promise<string>;
 export {};
 //# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -1 +1 @@
-import{assertUrlAllowed as f}from"./ssrf-guard.js";const b=3e4,w=1024*1024;function m({allowedHosts:t,authorization:e,fetchImpl:o=fetch,timeoutMs:n=b,maxResponseBytes:s=w}){return async r=>{const a=f(r.url,t),d=g(r.headers,e),c=new AbortController,u=setTimeout(()=>c.abort(),n);try{const i=await o(a,{method:r.method??"GET",headers:d,body:r.body,redirect:"manual",signal:c.signal}),h=await y(i,s);return{status:i.status,statusText:i.statusText,ok:i.ok,headers:T(i.headers),bodyText:h}}finally{clearTimeout(u)}}}async function y(t,e){const o=Number(t.headers.get("content-length"));if(Number.isFinite(o)&&o>e)throw l(e,o);if(!t.body)return"";const n=t.body.getReader(),s=new TextDecoder;let r=0,a="";try{for(;;){const{done:d,value:c}=await n.read();if(d)break;if(r+=c.byteLength,r>e)throw l(e,r);a+=s.decode(c,{stream:!0})}return a+s.decode()}finally{await n.cancel().catch(()=>{})}}function l(t,e){return new Error(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function g(t,e){const o={};let n=!1;for(const[s,r]of Object.entries(t??{})){const a=s.toLowerCase();a==="host"||a==="content-length"||(a==="authorization"&&(n=!0),o[s]=r)}return e&&!n&&(o.Authorization=e),o}function T(t){const e={};return t.forEach((o,n)=>{e[n.toLowerCase()]=o}),e}export{m as buildFetchBridge};
+import{Agent as y}from"undici";import{assertUrlAllowed as T}from"./ssrf-guard.js";import{createSsrfSafeLookup as E}from"./ssrf-safe-lookup.js";const A=3e4,L=1024*1024,S=new y({connect:{lookup:E()}});function F({allowedHosts:t,apis:e=[],authorization:r,onAuthRequired:o,fetchImpl:c=fetch,dispatcher:n=S,timeoutMs:d=A,maxResponseBytes:i=L}){const a=[...t,...e.flatMap(l=>l.matchers)];return async l=>{const h=T(l.url,a),m=e.filter(s=>s.matchers.some(f=>f.test(h.hostname))),u=m.length===1?m[0]:void 0,b=v(l.headers,u?.secret,r),g=new AbortController,p=setTimeout(()=>g.abort(),d);try{const s=await c(h,{method:l.method??"GET",headers:b,body:l.body,redirect:"manual",signal:g.signal,dispatcher:n});s.status===401&&u&&o&&o({api:u.slug,name:u.name});const f=await k(s,i);return{status:s.status,statusText:s.statusText,ok:s.ok,headers:_(s.headers),bodyText:f}}finally{clearTimeout(p)}}}async function k(t,e){const r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw w(e,r);if(!t.body)return"";const o=t.body.getReader(),c=new TextDecoder;let n=0,d="";try{for(;;){const{done:i,value:a}=await o.read();if(i)break;if(n+=a.byteLength,n>e)throw w(e,n);d+=c.decode(a,{stream:!0})}return d+c.decode()}finally{await o.cancel().catch(()=>{})}}function w(t,e){return new Error(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function v(t,e,r){const o={},c=new Set;for(const[d,i]of Object.entries(t??{})){const a=d.toLowerCase();a==="host"||a==="content-length"||(c.add(a),o[d]=i)}const n=e??(r?{header:"Authorization",value:r}:void 0);return n&&!c.has(n.header.toLowerCase())&&(o[n.header]=n.value),o}function _(t){const e={};return t.forEach((r,o)=>{e[o.toLowerCase()]=r}),e}export{F as buildFetchBridge,k as readCappedBody,S as ssrfSafeAgent};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-blocklist.d.ts

@@ -0,0 +1,10 @@
+export declare class SsrfBlockedError extends Error {
+    code: string;
+    constructor(message: string);
+}
+/**
+ * True if `ip` (a literal IPv4/IPv6 string) is in a range unsafe to reach. Non-IP input is
+ * treated as blocked (fail closed). Handles IPv4-mapped IPv6 by checking the embedded IPv4.
+ */
+export declare function isBlockedIp(ip: string): boolean;
+//# sourceMappingURL=ssrf-blocklist.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-blocklist.js

@@ -0,0 +1 @@
+import{BlockList as l,isIP as i}from"node:net";class E extends Error{code="SSRF_BLOCKED";constructor(t){super(t),this.name="SsrfBlockedError"}}const x=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4],["255.255.255.255",32]],h=[["::",128],["::1",128],["64:ff9b::",96],["64:ff9b:1::",48],["100::",64],["2001::",32],["2001:db8::",32],["2002::",16],["fc00::",7],["fe80::",10],["fec0::",10],["ff00::",8]],c=(()=>{const n=new l;for(const[t,r]of x)n.addSubnet(t,r,"ipv4");for(const[t,r]of h)n.addSubnet(t,r,"ipv6");return n})();function m(n){if(i(n)!==6)return;const t=S(n);if(!(t.length===8&&t[0]===0&&t[1]===0&&t[2]===0&&t[3]===0&&t[4]===0&&t[5]===65535))return;const e=t[6]??0,f=t[7]??0;return[e>>8&255,e&255,f>>8&255,f&255].join(".")}function S(n){const r=n.replace(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,(s,d,p,u,a)=>`:${((+d&255)<<8|+p&255).toString(16)}:${((+u&255)<<8|+a&255).toString(16)}`).split("::");if(r.length>2)return[];const e=r[0]?r[0].split(":"):[],f=r[1]?r[1].split(":"):[],o=r.length===2?8-e.length-f.length:0;return o<0?[]:[...e,...Array(o).fill("0"),...f].map(s=>Number.parseInt(s,16))}function B(n){const t=i(n);if(t===0||c.check(n,t===4?"ipv4":"ipv6"))return!0;if(t===6){const r=m(n);if(r&&c.check(r,"ipv4"))return!0}return!1}export{E as SsrfBlockedError,B as isBlockedIp};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.d.ts

@@ -4,6 +4,6 @@
  * Returns the parsed URL on success; throws with a clear message otherwise.
  */
 export declare function assertUrlAllowed(rawUrl: string, matchers: readonly RegExp[]): URL;
-/** True for loopback, private, link-local, unspecified, or otherwise internal addresses. */
+/** True for localhost or any literal IP in a blocked (private/reserved/loopback/link-local/…) range. */
 export declare function isBlockedAddress(host: string): boolean;
 //# sourceMappingURL=ssrf-guard.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.js

@@ -1 +1 @@
-import{isHostAllowed as f}from"./allowed-hosts.js";function c(e,r){let t;try{t=new URL(e)}catch{throw new Error(`Invalid URL: ${e}`)}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new Error(`Only http(s) URLs are allowed, got ${t.protocol}`);const n=o(t.hostname);if(u(n)||!f(n,r))throw new Error(`Host "${n}" is not allowed`);return t}function u(e){const r=o(e.toLowerCase());return r==="localhost"||r.endsWith(".localhost")?!0:i(r)?s(r):r.includes(":")?l(r):!1}function o(e){return e.replace(/^\[|\]$/g,"")}function i(e){return/^\d{1,3}(\.\d{1,3}){3}$/.test(e)}function s(e){const[r,t]=e.split(".").map(Number);return r===0||r===10||r===127||r===169&&t===254||r===172&&t>=16&&t<=31||r===192&&t===168||r===100&&t>=64&&t<=127}function l(e){if(e==="::1"||e==="::")return!0;const r=e.match(/::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/);if(r)return s(r[1]);const t=parseInt(e.split(":")[0],16);return Number.isNaN(t)?!1:t>=65152&&t<=65215||t>=64512&&t<=65023}export{c as assertUrlAllowed,u as isBlockedAddress};
+import{isIP as n}from"node:net";import{isHostAllowed as l}from"./allowed-hosts.js";import{isBlockedIp as i}from"./ssrf-blocklist.js";function w(r,t){let o;try{o=new URL(r)}catch{throw new Error(`Invalid URL: ${r}`)}if(o.protocol!=="http:"&&o.protocol!=="https:")throw new Error(`Only http(s) URLs are allowed, got ${o.protocol}`);if(o.username||o.password)throw new Error("URLs must not contain embedded credentials");const e=s(o.hostname);if(c(e)||!l(e,t))throw new Error(`Host "${e}" is not allowed`);return o}function c(r){const t=s(r.toLowerCase()).split("%")[0];return t==="localhost"||t.endsWith(".localhost")?!0:n(t)!==0?i(t):!1}function s(r){return r.replace(/^\[|\]$/g,"")}export{w as assertUrlAllowed,c as isBlockedAddress};