@redocly/realm 0.136.0-next.4 → 0.136.0-next.5

package/dist/server/web-server/routes/mcp-routes/mcp-oauth.d.ts

@@ -1,4 +1,5 @@
 import type { Handler } from 'hono';
+import type { SsoConfig } from '@redocly/config';
 import type { Store } from '../../../store.js';
 export type McpContextPayload = {
     isMcpFlow: boolean;
@@ -10,6 +11,7 @@ export type McpContextPayload = {
     mcpCodeChallengeMethod?: string | null;
     timestamp: number;
 };
+export declare const SUPPORTED_MCP_GRANT_TYPES: readonly ['authorization_code', 'refresh_token'];
 export declare function verifyPkce(codeChallenge: string, codeChallengeMethod: string | undefined, codeVerifier: string): boolean;
 export declare function createMcpContextToken(context: McpContextPayload): Promise<string>;
 export declare function verifyAndParseMcpContextToken(token: string): Promise<McpContextPayload>;
@@ -20,7 +22,8 @@ export declare function mcpOAuthAuthorizationServerHandler(store: Store): Handle
  * Also it is simulating the client registration process.
  */
 export declare function mcpDynamicClientRegistrationHandler(store: Store): Handler;
+export declare function resolveMcpIdpId(ssoDirect: SsoConfig | undefined): string | undefined;
 export declare function mcpAuthorizationHandler(store: Store): Handler;
-export declare function mcpTokenPortalHandler(): Handler;
-export declare function mcpCallbackHandler(): Handler;
+export declare function mcpTokenPortalHandler(store: Store): Handler;
+export declare function mcpCallbackHandler(store: Store): Handler;
 //# sourceMappingURL=mcp-oauth.d.ts.map

package/dist/server/web-server/routes/mcp-routes/mcp-oauth.js

@@ -1 +1 @@
-import{getCookie as S}from"hono/cookie";import{createHash as D,timingSafeEqual as L}from"node:crypto";import{ulid as H}from"ulid";import{isMcpContentProtected as C}from"../../../plugins/mcp/auth/auth-handlers.js";import{isRedoclySso as q,isOidcProviderConfig as z}from"../../auth.js";import{AUTH_URL as M,JWT_SECRET_KEY as A}from"../../../constants/common.js";import{ServerRoutes as u}from"../../../../constants/api.js";import{AuthCookieNames as k}from"../../../../constants/common.js";import{withPathPrefix as _}from"@redocly/theme/core/utils";import{telemetry as m}from"../../../telemetry/index.js";import{envConfig as I}from"../../../config/env-config.js";import{createMcpAuthorizationCode as $,verifyMcpAuthorizationCode as N,createMcpSessionResource as f}from"../../auth.js";import*as h from"../../jwt/jwt.js";import{AlgorithmTypes as w}from"../../jwt/types.js";import{getRequestOrigin as E}from"../../utils/get-request-origin.js";import{fetchClientMetadataDocument as b,isClientMetadataDocumentUrl as P,isRedirectUriRegistered as j}from"./mcp-client-metadata.js";const o=(r,e,n=200,a)=>r.json(e,n,{"Content-Type":"application/json",...a??{}}),U=new Set(["S256"]),B="https://claude.ai/oauth/claude-code-client-metadata";function F(r,e,n){if(!U.has(e||""))return!1;const a=D("sha256").update(n).digest("base64url"),t=Buffer.from(a),s=Buffer.from(r);return t.length!==s.length?!1:L(t,s)}async function K(r){const e=Math.floor(Date.now()/1e3);return h.sign({type:"mcp_context",...r,iat:e,exp:e+600},A,w.HS256)}async function G(r){await h.verify(r,A,w.HS256);const{payload:e}=h.decode(r);if(e.type!=="mcp_context")throw new Error("Invalid context token type");return e}function se(r){return async e=>{if(!C(r))return o(e,{error:"not_found"},404);if(e.req.method!=="GET")return o(e,{error:"Method not allowed"},405,{Allow:"GET"});const n=E(e);return o(e,{resource:`${n}${_("/mcp")}`,authorization_servers:[n,M].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${n}${u.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:["openid","profile","email","offline_access"],bearer_token_types_supported:["Bearer"]})}}function ce(r){return async e=>{if(!C(r))return o(e,{error:"not_found"},404);const n=E(e);return o(e,{issuer:M||"",authorization_endpoint:`${n}${_(u.MCP_AUTHORIZATION)}`,token_endpoint:`${n}${_(u.MCP_TOKEN_PORTAL)}`,jwks_uri:`${M||""}/.well-known/jwks.json`,scopes_supported:["openid","profile","email","offline_access"],registration_endpoint:`${n}${_(u.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:["authorization_code","refresh_token","client_credentials"],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function de(r){return async e=>{if(!C(r))return o(e,{error:"not_found"},404);if(e.req.method!=="POST")return o(e,{error:"Method not allowed"},405);try{return o(e,{client_id:I.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:["authorization_code","refresh_token"],response_types:["code"],scope:"openid offline email",subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(n){return o(e,{error:"invalid_request",error_description:n?.message||"Unable to register client"},500)}}}function le(r){return async e=>{if(!C(r))return o(e,{error:"not_found"},404);const n=new URL(e.req.url),{searchParams:a}=n,t=a.get("redirect_uri"),s=a.get("client_id"),i=a.get("code_challenge"),d=a.get("code_challenge_method"),l=H();if(i&&!U.has(d||""))return o(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...U].join(", ")}`},400);if(P(s)&&!i)return o(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(P(s)&&t)try{const c=await b(s),p=s===B;if(!j(t,c.redirect_uris,{ignorePort:p}))return o(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(c){const p=c instanceof Error?c.message:String(c);return o(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${p}`},400)}m.sendMcpAuthorizationStartedMessage([{...f(l),redirect_uri:t||null}]);const v=E(e),T={isMcpFlow:!0,originalRedirectUri:t,mcpClientId:s,mcpState:a.get("state"),mcpSessionId:l,mcpCodeChallenge:i,mcpCodeChallengeMethod:i?d:null,timestamp:Date.now()};try{const c=await K(T),p=new URL(_(u.IDP_LOGIN),v);p.searchParams.set("redirectTo",`${u.MCP_CALLBACK}/${c}`);const g=r.getConfig().ssoDirect||{},R=Object.entries(g).find(([,O])=>z(O)&&q(O))?.[0]??Object.keys(g)[0];return R?(p.searchParams.set("idpId",R),e.redirect(p.toString())):o(e,{error:"not_found"},404)}catch(c){const p=c instanceof Error?c.message:String(c),g=c instanceof Error?c.stack:String(c);m.sendMcpAuthorizationFailedMessage([{...f(l),error:p,error_details:g}]);const y=new URL(_(`${M}/oauth2/auth`));return y.search=a.toString(),e.redirect(y.toString())}}}function pe(){return async r=>{if(r.req.method!=="POST")return o(r,{error:"Method not allowed"},405);try{const e=await r.req.formData(),n=e.get("grant_type"),a=e.get("code"),t=e.get("redirect_uri")||void 0,s=e.get("code_verifier")||void 0;if(n!=="authorization_code"||!a)return o(r,{error:"invalid_request",error_description:"Invalid grant type or missing authorization code"},400);try{const i=await N(a);if(t&&t!==i.redirect_uri)return o(r,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(i.code_challenge){if(!s)return o(r,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!F(i.code_challenge,i.code_challenge_method,s))return o(r,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(I.OAUTH_CLIENT_ID&&i.client_id&&!P(i.client_id)&&i.client_id!==I.OAUTH_CLIENT_ID)return o(r,{error:"invalid_client",error_description:"Client mismatch"},400);const d=i.id_token;if(typeof d!="string"||d.length===0)return o(r,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);let l=d;if(i.idp_access_token){const{payload:T,header:{kid:c}}=h.decode(d);l=await h.sign({...T,idp_access_token:i.idp_access_token},A,w.HS256,c)}return o(r,{access_token:l,token_type:"Bearer",expires_in:3600,scope:"openid profile email",id_token:d},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch{return o(r,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(e){const n=e instanceof Error?e.message:String(e);return o(r,{error:"server_error",error_description:"Failed to process token request",error_details:n},500)}}}function ue(){return async r=>{const e=new URL(r.req.url);let n=e.searchParams.get("context");if(!n&&e.pathname.startsWith(_(`${u.MCP_CALLBACK}/`))){const t=e.pathname.split("/");n=t[t.length-1]}if(!n)return m.sendMcpAuthorizationFailedMessage([{...f(null),error:"Missing context parameter",error_details:null}]),r.text("Missing context parameter",400);let a=null;try{const t=await G(n);if(a=t.mcpSessionId||null,!t.isMcpFlow||!t.originalRedirectUri)throw new Error("Invalid MCP context");const s=S(r,k.IDP_ID_TOKEN)||S(r,k.AUTHORIZATION),i=S(r,k.IDP_ACCESS_TOKEN);if(!s)return m.sendMcpAuthorizationFailedMessage([{...f(a),error:"Authentication required",error_details:null}]),r.text("Authentication required",401);const d=await $({idToken:s,idpAccessToken:i||void 0,clientId:t.mcpClientId||"",redirectUri:t.originalRedirectUri,codeChallenge:t.mcpCodeChallenge||void 0,codeChallengeMethod:t.mcpCodeChallengeMethod||void 0,ttlSec:600}),l=new URL(t.originalRedirectUri);return l.searchParams.set("code",d),t.mcpState&&l.searchParams.set("state",t.mcpState),m.sendMcpAuthorizationCompletedMessage([{...f(a),redirect_uri:t.originalRedirectUri||null}]),r.redirect(l.toString())}catch(t){const s=t instanceof Error?t.message:String(t),i=t instanceof Error?t.stack:String(t);return m.sendMcpAuthorizationFailedMessage([{...f(a),error:s,error_details:i}]),r.text(`Invalid MCP callback: ${s}`,400)}}}export{K as createMcpContextToken,le as mcpAuthorizationHandler,ue as mcpCallbackHandler,de as mcpDynamicClientRegistrationHandler,ce as mcpOAuthAuthorizationServerHandler,se as mcpOAuthProtectedResourceHandler,pe as mcpTokenPortalHandler,G as verifyAndParseMcpContextToken,F as verifyPkce};
+import{getCookie as A}from"hono/cookie";import{createHash as J,timingSafeEqual as V}from"node:crypto";import{ulid as Y}from"ulid";import{isMcpContentProtected as P}from"../../../plugins/mcp/auth/auth-handlers.js";import{isRedoclySso as Z,isOidcProviderConfig as v}from"../../auth.js";import{AUTH_URL as R,JWT_SECRET_KEY as m,MCP_ACCESS_TOKEN_TTL_SEC as b,MCP_REFRESH_SESSION_LIFETIME_SEC as W}from"../../../constants/common.js";import{ServerRoutes as T}from"../../../../constants/api.js";import{AuthCookieNames as U}from"../../../../constants/common.js";import{withPathPrefix as I}from"@redocly/theme/core/utils";import{telemetry as M}from"../../../telemetry/index.js";import{envConfig as D}from"../../../config/env-config.js";import{createMcpAuthorizationCode as x,verifyMcpAuthorizationCode as Q,createMcpRefreshToken as z,verifyMcpRefreshToken as X,createMcpSessionResource as y,oidcJwksCache as F,oidcRefreshTokenGrant as ee,getOidcMetadata as re,discoverJwks as te}from"../../auth.js";import*as S from"../../jwt/jwt.js";import{AlgorithmTypes as q}from"../../jwt/types.js";import{getRequestOrigin as L}from"../../utils/get-request-origin.js";import{encryptClaimValue as H}from"../../../utils/crypto/encrypt-claim-value.js";import{decryptAesGcm as ne}from"../../../utils/crypto/decrypt-aes-gcm.js";import{encryptAesGcm as G}from"../../../utils/crypto/encrypt-aes-gcm.js";import{fetchClientMetadataDocument as oe,isClientMetadataDocumentUrl as N,isRedirectUriRegistered as ie}from"./mcp-client-metadata.js";const s=(r,e,n=200,i)=>r.json(e,n,{"Content-Type":"application/json",...i??{}}),j=new Set(["S256"]),$=["authorization_code","refresh_token"],E=["openid","profile","email","offline_access"],se="https://claude.ai/oauth/claude-code-client-metadata";function ce(r,e,n){if(!j.has(e||""))return!1;const i=J("sha256").update(n).digest("base64url"),c=Buffer.from(i),o=Buffer.from(r);return c.length!==o.length?!1:V(c,o)}async function de(r){const e=Math.floor(Date.now()/1e3);return S.sign({type:"mcp_context",...r,iat:e,exp:e+600},m,q.HS256)}async function ae(r){await S.verify(r,m,q.HS256);const{payload:e}=S.decode(r);if(e.type!=="mcp_context")throw new Error("Invalid context token type");return e}function Re(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="GET")return s(e,{error:"Method not allowed"},405,{Allow:"GET"});const n=L(e);return s(e,{resource:`${n}${I("/mcp")}`,authorization_servers:[n,R].filter(Boolean),bearer_methods_supported:["header"],resource_documentation:`${n}${T.MCP_OAUTH_AUTHORIZATION_SERVER}`,scopes_supported:[...E],bearer_token_types_supported:["Bearer"]})}}function Ue(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=L(e);return s(e,{issuer:R||"",authorization_endpoint:`${n}${I(T.MCP_AUTHORIZATION)}`,token_endpoint:`${n}${I(T.MCP_TOKEN_PORTAL)}`,jwks_uri:`${R||""}/.well-known/jwks.json`,scopes_supported:[...E],registration_endpoint:`${n}${I(T.MCP_DYNAMIC_CLIENT_REGISTRATION)}`,response_types_supported:["code"],grant_types_supported:[...$],subject_types_supported:["public"],id_token_signing_alg_values_supported:["RS256"],code_challenge_methods_supported:["S256"],token_endpoint_auth_methods_supported:["none"],client_id_metadata_document_supported:!0})}}function Oe(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{return s(e,{client_id:D.OAUTH_CLIENT_ID||"",client_name:"MCP Client",redirect_uris:[],grant_types:[...$],response_types:["code"],scope:E.join(" "),subject_type:"public",token_endpoint_auth_method:"none",created_at:new Date().toISOString(),updated_at:new Date().toISOString()},201)}catch(n){return s(e,{error:"invalid_request",error_description:n?.message||"Unable to register client"},500)}}}function B(r){const e=r||{},n=Object.keys(e),i=n.find(o=>v(e[o])&&Z(e[o])),c=n.find(o=>v(e[o]));return i||c||n[0]}function De(r){return async e=>{if(!P(r))return s(e,{error:"not_found"},404);const n=new URL(e.req.url),{searchParams:i}=n,c=i.get("redirect_uri"),o=i.get("client_id"),a=i.get("code_challenge"),t=i.get("code_challenge_method"),p=Y();if(a&&!j.has(t||""))return s(e,{error:"invalid_request",error_description:`Unsupported code_challenge_method. Supported: ${[...j].join(", ")}`},400);if(N(o)&&!a)return s(e,{error:"invalid_request",error_description:"code_challenge is required for client_id_metadata_document clients"},400);if(N(o)&&c)try{const d=await oe(o),l=o===se;if(!ie(c,d.redirect_uris,{ignorePort:l}))return s(e,{error:"invalid_request",error_description:"redirect_uri is not registered for this client"},400)}catch(d){const l=d instanceof Error?d.message:String(d);return s(e,{error:"invalid_client",error_description:`Unable to resolve client metadata document: ${l}`},400)}M.sendMcpAuthorizationStartedMessage([{...y(p),redirect_uri:c||null}]);const f=L(e),_={isMcpFlow:!0,originalRedirectUri:c,mcpClientId:o,mcpState:i.get("state"),mcpSessionId:p,mcpCodeChallenge:a,mcpCodeChallengeMethod:a?t:null,timestamp:Date.now()};try{const d=await de(_),l=new URL(I(T.IDP_LOGIN),f);l.searchParams.set("redirectTo",`${T.MCP_CALLBACK}/${d}`);const k=B(r.getConfig().ssoDirect);return k?(l.searchParams.set("idpId",k),e.redirect(l.toString())):s(e,{error:"not_found"},404)}catch(d){const l=d instanceof Error?d.message:String(d),k=d instanceof Error?d.stack:String(d);M.sendMcpAuthorizationFailedMessage([{...y(p),error:l,error_details:k}]);const C=new URL(I(`${R}/oauth2/auth`));return C.search=i.toString(),e.redirect(C.toString())}}}async function K(r){const e=Math.floor(Date.now()/1e3),n=await S.sign({...r.claims,...r.idpId?{idpId:r.idpId}:{},...r.idpAccessTokenEnc?{idp_access_token:r.idpAccessTokenEnc}:{},...r.ttlSec?{iat:e,exp:e+r.ttlSec}:{}},m,q.HS256,r.kid),i=r.ttlSec??(typeof r.claims.exp=="number"?Math.max(r.claims.exp-e,0):b);return{accessToken:n,expiresIn:i}}async function pe(r,e,n){const i=g=>s(r,{error:"invalid_grant",error_description:g},400),c=r.get("logger"),o=n.get("refresh_token"),a=n.get("client_id")||void 0;if(!o)return s(r,{error:"invalid_request",error_description:"refresh_token is required"},400);let t;try{t=await X(o)}catch(g){return c?.warn("MCP refresh token rejected: %s",g instanceof Error?g.message:String(g)),i("Invalid refresh token")}if(a&&a!==t.client_id)return i("Client mismatch");const p=t.idp_id?e.getConfig().ssoDirect?.[t.idp_id]:void 0;let f,_,d=t.idp_access_token_enc,l=t.idp_refresh_token_enc;if(t.idp_refresh_token_enc){let g;try{g=ne(t.idp_refresh_token_enc,m)}catch{return i("Invalid refresh token")}if(!t.idp_id||!v(p))return i("Unknown identity provider");let u;try{const h=await re(t.idp_id,p);if(!h?.token_endpoint)return i("Identity provider has no token endpoint");u=await ee(h.token_endpoint,g,p)}catch(h){return c?.warn("MCP refresh failed to reach the IdP token endpoint: %s",h instanceof Error?h.message:String(h)),s(r,{error:"server_error",error_description:"Failed to refresh session"},500)}if(u.error||!(u.id_token||u.access_token))return c?.warn("MCP refresh rejected by IdP: %s",u.error||"empty token response"),i("Refresh rejected by identity provider");if(u.refresh_token&&(l=G(u.refresh_token,m)),u.access_token&&(d=H(u.access_token,m)),u.id_token)try{const h=S.decode(u.id_token);f=h.payload,_=h.header.kid}catch{return i("Invalid token response from identity provider")}}const k=v(p)&&p.tokenExpirationTime||b,C=f??t.claims,w=await K({claims:C,kid:_,idpId:t.idp_id,idpAccessTokenEnc:d,ttlSec:f?void 0:k}),O=await z({clientId:t.client_id,idpId:t.idp_id,claims:C,idpAccessTokenEnc:d,idpRefreshTokenEnc:l,sessionExp:t.session_exp});return s(r,{access_token:w.accessToken,token_type:"Bearer",expires_in:w.expiresIn,refresh_token:O,scope:E.join(" ")},200,{"Cache-Control":"no-store",Pragma:"no-cache"})}function qe(r){return async e=>{if(e.req.method!=="POST")return s(e,{error:"Method not allowed"},405);try{const n=await e.req.formData(),i=n.get("grant_type"),c=n.get("code"),o=n.get("redirect_uri")||void 0,a=n.get("code_verifier")||void 0;if(!$.includes(i))return s(e,{error:"invalid_request",error_description:"Invalid grant type"},400);if(i==="refresh_token")return await pe(e,r,n);if(!c)return s(e,{error:"invalid_request",error_description:"Missing authorization code"},400);try{const t=await Q(c);if(o&&o!==t.redirect_uri)return s(e,{error:"invalid_grant",error_description:"redirect_uri mismatch"},400);if(t.code_challenge){if(!a)return s(e,{error:"invalid_grant",error_description:"code_verifier required"},400);if(!ce(t.code_challenge,t.code_challenge_method,a))return s(e,{error:"invalid_grant",error_description:"code_verifier mismatch"},400)}if(D.OAUTH_CLIENT_ID&&t.client_id&&!N(t.client_id)&&t.client_id!==D.OAUTH_CLIENT_ID)return s(e,{error:"invalid_client",error_description:"Client mismatch"},400);const p=t.id_token;if(typeof p!="string"||p.length===0)return s(e,{error:"invalid_grant",error_description:"Missing id_token in authorization code"},400);const f=t.idp_access_token_enc??(t.idp_access_token?H(t.idp_access_token,m):void 0),_=S.decode(p),{accessToken:d,expiresIn:l}=await K({claims:_.payload,kid:_.header.kid,idpId:t.idp_id,idpAccessTokenEnc:f}),C=Math.floor(Date.now()/1e3)+W,w=await z({clientId:t.client_id,idpId:t.idp_id,claims:_.payload,idpAccessTokenEnc:f,idpRefreshTokenEnc:t.idp_refresh_token_enc,sessionExp:C}),O={access_token:d,token_type:"Bearer",expires_in:l,refresh_token:w,scope:E.join(" "),id_token:p};return s(e,O,200,{"Cache-Control":"no-store",Pragma:"no-cache"})}catch(t){return e.get("logger")?.warn("MCP token exchange failed: %s",t instanceof Error?t.message:String(t)),s(e,{error:"invalid_grant",error_description:"Invalid authorization code"},400)}}catch(n){const i=n instanceof Error?n.message:String(n);return s(e,{error:"server_error",error_description:"Failed to process token request",error_details:i},500)}}}async function le(r,e){try{const{payload:n,header:i}=S.decode(r);if(typeof n.idpId=="string"&&n.idpId)return n.idpId;if(i.kid){F.jwks[i.kid]==null&&await te(e||{});const c=F.jwks[i.kid];if(c?.idpId)return c.idpId}}catch{}return B(e)}function Le(r){return async e=>{const n=new URL(e.req.url);let i=n.searchParams.get("context");if(!i&&n.pathname.startsWith(I(`${T.MCP_CALLBACK}/`))){const o=n.pathname.split("/");i=o[o.length-1]}if(!i)return M.sendMcpAuthorizationFailedMessage([{...y(null),error:"Missing context parameter",error_details:null}]),e.text("Missing context parameter",400);let c=null;try{const o=await ae(i);if(c=o.mcpSessionId||null,!o.isMcpFlow||!o.originalRedirectUri)throw new Error("Invalid MCP context");const a=A(e,U.IDP_ID_TOKEN)||A(e,U.AUTHORIZATION),t=A(e,U.IDP_ACCESS_TOKEN),p=A(e,U.IDP_REFRESH_TOKEN);if(!a)return M.sendMcpAuthorizationFailedMessage([{...y(c),error:"Authentication required",error_details:null}]),e.text("Authentication required",401);const f=await x({idToken:a,idpId:await le(a,r.getConfig().ssoDirect),idpAccessTokenEnc:t?H(t,m):void 0,idpRefreshTokenEnc:p?G(p,m):void 0,clientId:o.mcpClientId||"",redirectUri:o.originalRedirectUri,codeChallenge:o.mcpCodeChallenge||void 0,codeChallengeMethod:o.mcpCodeChallengeMethod||void 0,ttlSec:600}),_=new URL(o.originalRedirectUri);return _.searchParams.set("code",f),o.mcpState&&_.searchParams.set("state",o.mcpState),M.sendMcpAuthorizationCompletedMessage([{...y(c),redirect_uri:o.originalRedirectUri||null}]),e.redirect(_.toString())}catch(o){const a=o instanceof Error?o.message:String(o),t=o instanceof Error?o.stack:String(o);return M.sendMcpAuthorizationFailedMessage([{...y(c),error:a,error_details:t}]),e.text(`Invalid MCP callback: ${a}`,400)}}}export{$ as SUPPORTED_MCP_GRANT_TYPES,de as createMcpContextToken,De as mcpAuthorizationHandler,Le as mcpCallbackHandler,Oe as mcpDynamicClientRegistrationHandler,Ue as mcpOAuthAuthorizationServerHandler,Re as mcpOAuthProtectedResourceHandler,qe as mcpTokenPortalHandler,B as resolveMcpIdpId,ae as verifyAndParseMcpContextToken,ce as verifyPkce};

package/dist/server/web-server/routes/mcp-routes/mcp-routes.js

@@ -1 +1 @@
-import{corsMiddleware as p}from"../../middleware/corsMiddleware.js";import{ServerRoutes as i}from"../../../../constants/api.js";import{EntitlementsProvider as C}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as n}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as l,A2A_SLUG as m,MCP_SERVER_CARD_SLUG as A}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as d,mcpOAuthAuthorizationServerHandler as r,mcpDynamicClientRegistrationHandler as _,mcpAuthorizationHandler as s,mcpTokenPortalHandler as R,mcpCallbackHandler as o}from"./mcp-oauth.js";import{mcpServerCardHandler as E}from"./mcp-server-card.js";import{agentCardHandler as P}from"./agent-card.js";import{a2aHandler as T}from"./a2a.js";function N(e,t){const a=t.getConfig().mcp,c=C.instance().canAccessFeature("mcp");!a?.hide&&!a?.docs?.hide&&c&&(e.get(n(A),E(t)),e.get(n(l),P(t)),e.use(n(m),p({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(n(m),T(t)),e.get(`${i.MCP_OAUTH_PROTECTED_RESOURCE}${n("/mcp")}`,d(t)),e.get(i.MCP_OAUTH_AUTHORIZATION_SERVER,r(t)),e.post(n(i.MCP_DYNAMIC_CLIENT_REGISTRATION),_(t)),e.get(n(i.MCP_AUTHORIZATION),s(t)),e.post(n(i.MCP_TOKEN_PORTAL),R()),e.get(n(i.MCP_CALLBACK),o()),e.get(n(`${i.MCP_CALLBACK}/*`),o()))}export{N as installMcpRoutes};
+import{corsMiddleware as o}from"../../middleware/corsMiddleware.js";import{ServerRoutes as a}from"../../../../constants/api.js";import{EntitlementsProvider as C}from"../../../entitlements/entitlements-provider.js";import{withPathPrefix as i}from"@redocly/theme/core/utils";import{AGENT_CARD_SLUG as l,A2A_SLUG as t,MCP_SERVER_CARD_SLUG as A}from"../../../../constants/common.js";import{mcpOAuthProtectedResourceHandler as d,mcpOAuthAuthorizationServerHandler as _,mcpDynamicClientRegistrationHandler as r,mcpAuthorizationHandler as R,mcpTokenPortalHandler as E,mcpCallbackHandler as c}from"./mcp-oauth.js";import{mcpServerCardHandler as P}from"./mcp-server-card.js";import{agentCardHandler as T}from"./agent-card.js";import{a2aHandler as s}from"./a2a.js";function N(e,n){const m=n.getConfig().mcp,p=C.instance().canAccessFeature("mcp");!m?.hide&&!m?.docs?.hide&&p&&(e.get(i(A),P(n)),e.get(i(l),T(n)),e.use(i(t),o({allowMethods:["POST"],exposeHeaders:["Link"]})),e.post(i(t),s(n)),e.get(`${a.MCP_OAUTH_PROTECTED_RESOURCE}${i("/mcp")}`,d(n)),e.get(a.MCP_OAUTH_AUTHORIZATION_SERVER,_(n)),e.post(i(a.MCP_DYNAMIC_CLIENT_REGISTRATION),r(n)),e.get(i(a.MCP_AUTHORIZATION),R(n)),e.post(i(a.MCP_TOKEN_PORTAL),E(n)),e.get(i(a.MCP_CALLBACK),c(n)),e.get(i(`${a.MCP_CALLBACK}/*`),c(n)))}export{N as installMcpRoutes};

package/dist/types/entitlements.d.ts

@@ -35,9 +35,11 @@ export type PlanGates = {
     [FEATURE.aiSearchLimit]: number;
     [FEATURE.kvStorageLimit]: number;
     [FEATURE.mcp]: boolean;
+    [FEATURE.mcpGateway]: boolean;
+    [FEATURE.mcpMode]: 'tools' | 'code';
 };
 export type Entitlements = {
-    [key in Feature]: boolean | number;
+    [key in Feature]: boolean | number | string;
 };
 export type ProductPlan = 'pro' | 'enterprise';
 //# sourceMappingURL=entitlements.d.ts.map

package/dist/utils/l10n/build-i18n-config.d.ts

@@ -0,0 +1,24 @@
+import type { InitOptions } from 'i18next';
+import type { GlobalData } from '../../types/index.js';
+/**
+ * Builds the i18next init config shared by the client runtime (`initL10n`) and the
+ * build-time translate used in `renderForLlms` (`createBuildTranslate`), so both
+ * resolve translations identically: same default-translation merge, same locale
+ * fallback chain.
+ *
+ * @param l10n - The project's l10n data (`defaultLocale`, configured `locales`, and
+ * `translations` overrides), or `undefined` for a project with no l10n config.
+ * @param locale - The `lng` to set on the resulting config (the instance's `resources`
+ * still cover every configured locale, so a fixed translator for any other locale can
+ * still be derived from the same config via `i18next.getFixedT(otherLocale)`).
+ * @returns An i18next `InitOptions` object with merged default + project translations
+ * and a `code → langPart → defaultLocale` fallback chain.
+ *
+ * @example
+ * ```ts
+ * const config = await buildI18nConfig(l10n, 'ja');
+ * await i18next.init(config);
+ * ```
+ */
+export declare function buildI18nConfig(l10n: GlobalData['l10n'], locale: InitOptions['lng']): Promise<InitOptions>;
+//# sourceMappingURL=build-i18n-config.d.ts.map

package/dist/utils/l10n/build-i18n-config.js

@@ -0,0 +1 @@
+import{DEFAULT_LOCALE_PLACEHOLDER as u}from"../../constants/common.js";import{defaultTranslationImports as c}from"../../constants/l10n/default-translations.js";async function L(s,r){const a=s?.defaultLocale||u,e=s?.translations??{},i=s?.locales?[...new Set(s.locales.flatMap(t=>[t.code,t.code.split("-")[0]]))]:[a],l={};for(const t of i){const n=await c[t]?.()||{};l[t]={translation:{...n,...e[t]?.translation}}}return{load:"currentOnly",lng:r,nonExplicitSupportedLngs:!0,fallbackLng:t=>{if(!t)return[a];const n=t.split("-")[0];if(t===a)return n!==t?[n,a]:[a];const o=[t];return n!==t&&o.push(n),o.push(a),o},interpolation:{escapeValue:!1},debug:!1,resources:{...l}}}export{L as buildI18nConfig};

package/dist/utils/l10n/create-translate.d.ts

@@ -0,0 +1,19 @@
+import type { TFunction, TOptions } from '@redocly/theme/core/types';
+/**
+ * Wraps a raw i18next `t`-like function (`useTranslate`'s `i18next.t`, or a
+ * build-time `instance.getFixedT(locale)`) with the shared value/defaultValue/options
+ * resolution used across the client and build-time translate paths.
+ *
+ * @param rawT - The underlying i18next translate function to resolve keys against.
+ * @returns A `TFunction` that resolves `value` via `rawT`, falling back to
+ * `defaultValue` (when passed as the second argument or via `options.defaultValue`)
+ * and then to `value` itself when the key is untranslated.
+ *
+ * @example
+ * ```ts
+ * const translate = createTranslate(i18next.t);
+ * translate('greeting.hello', 'Hello'); // translated string, or 'Hello' if missing
+ * ```
+ */
+export declare function createTranslate(rawT: (key: string, opts?: TOptions) => string): TFunction;
+//# sourceMappingURL=create-translate.d.ts.map

package/dist/utils/l10n/create-translate.js

@@ -0,0 +1 @@
+function u(r){return(n,t)=>{const e=typeof t=="string"?t:void 0,f=e?void 0:t;return n?r(n,{defaultValue:e,...f})||e||n||"":e??""}}export{u as createTranslate};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/realm",
-  "version": "0.136.0-next.4",
+  "version": "0.136.0-next.5",
   "description": "",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
     "@opentelemetry/semantic-conventions": "1.40.0",
     "@redocly/ajv": "8.18.0",
     "@redocly/mcp-typescript-sdk": "1.18.1",
-    "@redocly/openapi-core": "2.39.0",
+    "@redocly/openapi-core": "2.40.0",
     "@shikijs/transformers": "3.21.0",
     "@tanstack/react-query": "5.62.3",
     "@tanstack/react-table": "8.21.3",
@@ -55,11 +55,11 @@
     "fflate": "0.7.4",
     "flexsearch": "0.7.43",
     "graphql": "16.12.0",
-    "hono": "4.12.25",
+    "hono": "4.12.27",
     "htmlparser2": "8.0.2",
     "i18next": "22.4.15",
     "is-glob": "4.0.3",
-    "js-yaml": "4.2.0",
+    "js-yaml": "4.3.0",
     "lru-cache": "11.1.0",
     "minimatch": "10.2.4",
     "mri": "1.2.0",
@@ -86,6 +86,7 @@
     "tty-browserify": "0.0.1",
     "typesense": "2.1.0",
     "ulid": "^2.3.0",
+    "undici": "^6.27.0",
     "web-vitals": "3.3.1",
     "workerpool": "9.2.0",
     "ws": "^8.21.0",
@@ -93,14 +94,14 @@
     "xpath": "0.0.34",
     "yaml-ast-parser": "0.0.43",
     "zod": "^3.25.76",
-    "@redocly/asyncapi-docs": "1.13.0-next.4",
+    "@redocly/asyncapi-docs": "1.13.0-next.5",
     "@redocly/config": "0.52.0",
-    "@redocly/graphql-docs": "1.13.0-next.4",
-    "@redocly/openapi-docs": "3.24.0-next.4",
+    "@redocly/graphql-docs": "1.13.0-next.5",
+    "@redocly/openapi-docs": "3.24.0-next.5",
     "@redocly/portal-legacy-ui": "0.18.0",
-    "@redocly/portal-plugin-mock-server": "0.21.0-next.4",
+    "@redocly/portal-plugin-mock-server": "0.21.0-next.5",
     "@redocly/realm-asyncapi-sdk": "0.14.0-next.0",
-    "@redocly/theme": "0.68.0-next.2"
+    "@redocly/theme": "0.68.0-next.3"
   },
   "peerDependencies": {
     "react": "^19.2.4",