@redocly/realm 0.138.0-next.1 → 0.138.0-next.3

package/dist/server/plugins/consent/build-consent-script.js

@@ -0,0 +1,230 @@
+import{buildZoneModes as a,groupZones as r}from"./zone-modes.js";const i=365,o="dataLayer";function c(e,t={}){const n=e.mode==="auto"?r(a().optOut):{};return`(function(){
+var cfg=${JSON.stringify({mode:e.mode,expires:e.expires??i,dataLayer:t.dataLayerName||o,optOut:n}).replace(/</g,"\\u003c")};
+var COOKIE='redocly_consent';
+var tcfState=null;
+var adapters={
+  onetrust:{
+    ready:function(){return !!window.OneTrust&&typeof window.OnetrustActiveGroups==='string';},
+    read:function(){
+      var raw=window.OnetrustActiveGroups||'';
+      var groups=','+raw+',';
+      var decided=!!(window.OneTrust.IsAlertBoxClosed&&window.OneTrust.IsAlertBoxClosed());
+      var ids=raw.split(',');
+      for(var i=0;i<ids.length;i++){if(ids[i]&&ids[i]!=='C0001'){decided=true;}}
+      return {analytics:groups.indexOf(',C0002,')>-1,marketing:groups.indexOf(',C0004,')>-1,decided:decided};
+    },
+    subscribe:function(read){
+      if(window.OneTrust.OnConsentChanged){window.OneTrust.OnConsentChanged(function(){read();});}
+      var previous=window.OptanonWrapper;
+      window.OptanonWrapper=function(){
+        if(typeof previous==='function'){previous();}
+        read();
+      };
+    },
+    open:function(){window.OneTrust.ToggleInfoDisplay();return true;}
+  },
+  cookiebot:{
+    ready:function(){return !!(window.Cookiebot&&window.Cookiebot.consent);},
+    read:function(){
+      var cb=window.Cookiebot;
+      return {analytics:cb.consent.statistics===true,marketing:cb.consent.marketing===true,decided:cb.consented===true||cb.declined===true};
+    },
+    subscribe:function(read){
+      var events=['CookiebotOnConsentReady','CookiebotOnAccept','CookiebotOnDecline'];
+      for(var i=0;i<events.length;i++){window.addEventListener(events[i],function(){read();});}
+    },
+    open:function(){window.Cookiebot.renew();return true;}
+  },
+  trustarc:{
+    ready:function(){return !!(window.truste&&window.truste.cma&&typeof window.truste.cma.callApi==='function');},
+    read:function(){
+      var d=window.truste.cma.callApi('getConsentDecision',window.location.host)||{};
+      var buckets=d.consentDecision||[];
+      var decided=d.source==='asserted';
+      for(var i=0;i<buckets.length;i++){if(buckets[i]!==0){decided=true;}}
+      return {analytics:buckets.indexOf(2)>-1,marketing:buckets.indexOf(3)>-1,decided:decided};
+    },
+    subscribe:function(read){
+      window.addEventListener('message',function(event){
+        if(typeof event.data!=='string'||event.data.indexOf('PrivacyManager:')!==0){return;}
+        var payload=null;
+        try{payload=JSON.parse(event.data.slice('PrivacyManager:'.length));}catch(e){return;}
+        if(payload&&payload.source==='preference_manager'&&payload.message==='submit_preferences'){read();}
+      });
+      window.addEventListener('load',function(){read();});
+    },
+    open:function(){
+      if(!window.truste.eu||typeof window.truste.eu.clickListener!=='function'){return false;}
+      window.truste.eu.clickListener();return true;
+    }
+  },
+  tcf:{
+    ready:function(){return typeof window.__tcfapi==='function';},
+    read:function(){return tcfState;},
+    subscribe:function(read){
+      window.__tcfapi('addEventListener',2,function(tcData,success){
+        if(!success||!tcData){return;}
+        if(tcData.eventStatus!=='tcloaded'&&tcData.eventStatus!=='useractioncomplete'){return;}
+        var consents=(tcData.purpose&&tcData.purpose.consents)||{};
+        var base=consents[1]===true;
+        tcfState={
+          analytics:base&&(consents[8]===true||consents[9]===true||consents[10]===true),
+          marketing:base&&(consents[2]===true||consents[3]===true||consents[4]===true),
+          decided:true
+        };
+        read();
+      });
+    },
+    open:function(){
+      if(window.Didomi&&window.Didomi.preferences&&typeof window.Didomi.preferences.show==='function'){window.Didomi.preferences.show();return true;}
+      if(window.UC_UI&&typeof window.UC_UI.showSecondLayer==='function'){window.UC_UI.showSecondLayer();return true;}
+      return false;
+    }
+  }
+};
+var adapter=adapters[cfg.mode]||null;
+function readCookie(){
+  var m=document.cookie.match(/(?:^|; )redocly_consent=([^;]*)/);
+  if(!m){return null;}
+  try{return JSON.parse(decodeURIComponent(m[1]));}catch(e){return null;}
+}
+function writeCookie(s){
+  var v=encodeURIComponent(JSON.stringify({v:1,analytics:s.analytics,marketing:s.marketing,ts:Date.now()}));
+  document.cookie=COOKIE+'='+v+'; Max-Age='+(cfg.expires*86400)+'; Path=/; SameSite=Lax'+(location.protocol==='https:'?'; Secure':'');
+}
+function detectRegion(){
+  var tz=null;
+  try{tz=Intl.DateTimeFormat().resolvedOptions().timeZone||null;}catch(e){}
+  if(!tz){return {mode:null,source:'none',timeZone:null};}
+  var slash=tz.indexOf('/');
+  var group=slash===-1?'':tz.slice(0,slash);
+  var rest=slash===-1?tz:tz.slice(slash+1);
+  var zones=Object.prototype.hasOwnProperty.call(cfg.optOut,group)?cfg.optOut[group]:[];
+  if(zones.indexOf(rest)>-1){return {mode:'opt-out',source:'timezone',timeZone:tz};}
+  return {mode:'opt-in',source:'timezone',timeZone:tz};
+}
+var region=adapter?{mode:cfg.mode,source:'provider',timeZone:null}:(cfg.mode==='auto'?detectRegion():{mode:cfg.mode,source:'config',timeZone:null});
+var mode=region.mode||'opt-in';
+var gpc=navigator.globalPrivacyControl===true;
+var saved=adapter?null:readCookie();
+var state={necessary:true,analytics:mode==='opt-out',marketing:mode==='opt-out'&&!gpc};
+if(saved){state.analytics=!!saved.analytics;state.marketing=!!saved.marketing&&!gpc;}
+var listeners=[];
+function emit(name){
+  var snapshot={necessary:true,analytics:state.analytics,marketing:state.marketing};
+  for(var i=0;i<listeners.length;i++){if(listeners[i].name===name){try{listeners[i].fn(snapshot);}catch(e){}}}
+}
+function gtagConsent(command){
+  if(adapter){return;}
+  window[cfg.dataLayer]=window[cfg.dataLayer]||[];
+  var a=state.analytics?'granted':'denied';
+  var m=state.marketing?'granted':'denied';
+  window[cfg.dataLayer].push(makeArgs(['consent',command,{analytics_storage:a,ad_storage:m,ad_user_data:m,ad_personalization:m}]));
+}
+function makeArgs(list){
+  return (function(){return arguments;}).apply(null,list);
+}
+function activate(){
+  var nodes=document.querySelectorAll('script[type="text/plain"][data-consent]');
+  for(var i=0;i<nodes.length;i++){
+    var node=nodes[i];
+    var category=node.getAttribute('data-consent');
+    if(!state[category]||node.getAttribute('data-consent-loaded')){continue;}
+    var script=document.createElement('script');
+    for(var j=0;j<node.attributes.length;j++){
+      var attr=node.attributes[j];
+      if(attr.name==='type'||attr.name==='data-consent'||attr.name==='data-consent-type'){continue;}
+      script.setAttribute(attr.name,attr.value);
+    }
+    if(!node.hasAttribute('async')){script.async=false;}
+    if(typeof node.nonce==='string'&&node.nonce){script.nonce=node.nonce;}
+    var originalType=node.getAttribute('data-consent-type');
+    if(originalType){script.setAttribute('type',originalType);}
+    if(!node.getAttribute('src')){script.text=node.text;}
+    node.setAttribute('data-consent-loaded','true');
+    node.parentNode.insertBefore(script,node.nextSibling);
+  }
+}
+function close(){
+  api.dialogOpen=false;
+  emit('close');
+}
+function save(next){
+  if(adapter){console.warn('Consent is managed by '+cfg.mode+'.');return;}
+  var revoked=!!next&&((state.analytics&&next.analytics===false)||(state.marketing&&next.marketing===false));
+  if(next&&typeof next.analytics==='boolean'){state.analytics=next.analytics;}
+  if(next&&typeof next.marketing==='boolean'){state.marketing=next.marketing&&!gpc;}
+  writeCookie(state);
+  api.decided=true;
+  api.state={necessary:true,analytics:state.analytics,marketing:state.marketing};
+  gtagConsent('update');
+  activate();
+  emit('change');
+  close();
+  if(revoked){api.reload();}
+}
+function applyProvider(next){
+  if(!next){return;}
+  var analytics=!!next.analytics;
+  var marketing=!!next.marketing&&!gpc;
+  var decided=api.decided||!!next.decided;
+  var changed=analytics!==state.analytics||marketing!==state.marketing||decided!==api.decided;
+  state.analytics=analytics;
+  state.marketing=marketing;
+  api.decided=decided;
+  api.state={necessary:true,analytics:analytics,marketing:marketing};
+  activate();
+  if(changed){emit('change');}
+}
+function readProvider(){
+  applyProvider(adapter.read());
+}
+function listenProvider(){
+  adapter.subscribe(readProvider);
+  readProvider();
+}
+function startProvider(){
+  if(adapter.ready()){listenProvider();return;}
+  var waited=0;
+  var timer=setInterval(function(){
+    if(adapter.ready()){clearInterval(timer);listenProvider();return;}
+    waited+=250;
+    if(waited>=15000){
+      clearInterval(timer);
+      console.warn('Consent provider '+cfg.mode+' did not load. Analytics stays off.');
+    }
+  },250);
+}
+var api={
+  configuredMode:cfg.mode,
+  mode:mode,
+  state:{necessary:true,analytics:state.analytics,marketing:state.marketing},
+  decided:!!saved,
+  gpc:gpc,
+  dialogOpen:false,
+  region:{source:region.source,timeZone:region.timeZone},
+  accept:function(){save({analytics:true,marketing:true});},
+  reject:function(){save({analytics:false,marketing:false});},
+  save:save,
+  open:function(){
+    if(adapter){
+      if(!adapter.ready()){console.warn('Consent provider '+cfg.mode+' is not loaded yet.');return;}
+      if(adapter.open()===false){console.warn('Consent provider '+cfg.mode+' has no preference center hook. Add your own trigger.');}
+      return;
+    }
+    api.dialogOpen=true;emit('open');
+  },
+  close:close,
+  reload:function(){window.location.reload();},
+  on:function(name,fn){
+    var entry={name:name,fn:fn};
+    listeners.push(entry);
+    return function(){var i=listeners.indexOf(entry);if(i>-1){listeners.splice(i,1);}};
+  }
+};
+window.redocly=window.redocly||{};
+window.redocly.consent=api;
+gtagConsent('default');
+if(adapter){startProvider();}
+if(document.readyState==='loading'){document.addEventListener('DOMContentLoaded',activate);}else{activate();}
+})();`}export{c as buildConsentScript};

package/dist/server/plugins/consent/gate-ssr-components.d.ts

@@ -0,0 +1,5 @@
+import type { JSX } from 'react';
+import type { ConsentConfig } from '@redocly/config';
+export type GatedConsentCategory = 'analytics' | 'marketing';
+export declare function gateSsrComponents(components: JSX.Element[], category: GatedConsentCategory, consent?: ConsentConfig): JSX.Element[];
+//# sourceMappingURL=gate-ssr-components.d.ts.map

package/dist/server/plugins/consent/gate-ssr-components.js

@@ -0,0 +1 @@
+import e from"react";import{isConsentEnabled as i}from"./is-consent-enabled.js";function c(r,p,o){return i(o)?r.filter(t=>t.type!=="noscript").map(t=>{if(t.type!=="script")return t;const n=t.props.type;return e.cloneElement(t,{type:"text/plain","data-consent":p,...n?{"data-consent-type":n}:{}})}):r}export{c as gateSsrComponents};

package/dist/server/plugins/consent/index.d.ts

@@ -0,0 +1,3 @@
+import type { LifecyclePluginInstance } from '../../types';
+export declare function consentPlugin(): Promise<LifecyclePluginInstance>;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/consent/index.js

@@ -0,0 +1 @@
+import r from"react";import{buildConsentScript as a}from"./build-consent-script.js";import{isConsentEnabled as s}from"./is-consent-enabled.js";async function d(){return{id:"Consent",async processContent(n){const t=n.getConfig(),e=t?.consent;if(!s(e))return;const o=t?.analytics?.gtm?.dataLayerName||"dataLayer";n.addSsrComponents([r.createElement("script",{key:"redocly-consent",dangerouslySetInnerHTML:{__html:a(e,{dataLayerName:o})}})],"head")}}}export{d as consentPlugin};

package/dist/server/plugins/consent/is-consent-enabled.d.ts

@@ -0,0 +1,8 @@
+import type { ConsentConfig } from '@redocly/config';
+export declare const PROVIDER_MODES: readonly ['onetrust', 'cookiebot', 'trustarc', 'tcf'];
+export type ConsentProviderMode = (typeof PROVIDER_MODES)[number];
+export declare function isConsentEnabled(consent?: ConsentConfig): consent is ConsentConfig & {
+    mode: 'auto' | 'opt-in' | 'opt-out' | ConsentProviderMode;
+};
+export declare function isProviderMode(mode?: ConsentConfig['mode']): mode is ConsentProviderMode;
+//# sourceMappingURL=is-consent-enabled.d.ts.map

package/dist/server/plugins/consent/is-consent-enabled.js

@@ -0,0 +1 @@
+const e=["onetrust","cookiebot","trustarc","tcf"];function t(o){return!!o?.mode&&o?.mode!=="none"}function n(o){return e.includes(o)}export{e as PROVIDER_MODES,t as isConsentEnabled,n as isProviderMode};

package/dist/server/plugins/consent/zone-modes.d.ts

@@ -0,0 +1,8 @@
+export type ZoneMode = 'opt-in' | 'opt-out';
+export declare function resolveZoneMode(zone: string): ZoneMode | undefined;
+export declare function buildZoneModes(): {
+    optIn: string[];
+    optOut: string[];
+};
+export declare function groupZones(zones: string[]): Record<string, string[]>;
+//# sourceMappingURL=zone-modes.d.ts.map

package/dist/server/plugins/consent/zone-modes.js

@@ -0,0 +1 @@
+import{OPT_IN_COUNTRIES as c,TZ_COUNTRIES as s}from"../../constants/plugins/consent.js";function p(e){const t=s[e];if(!(!t||t.length===0))return t.some(o=>c.has(o))?"opt-in":"opt-out"}function f(){const e=[],t=[];for(const o of Object.keys(s)){const n=p(o);n==="opt-in"&&e.push(o),n==="opt-out"&&t.push(o)}return{optIn:e,optOut:t}}function d(e){const t={};for(const o of e){const n=o.indexOf("/"),r=n===-1?"":o.slice(0,n),u=n===-1?o:o.slice(n+1);(t[r]||=[]).push(u)}return t}export{f as buildZoneModes,d as groupZones,p as resolveZoneMode};

package/dist/server/plugins/lifecycle.js

@@ -1,2 +1,2 @@
-import B from"@redocly/portal-plugin-mock-server";import{REDOCLY_ROUTE_RBAC as x}from"@redocly/config";import{combineUrls as E,withPathPrefix as L}from"@redocly/theme/core/utils";import{VERSION_SEPARATOR as k}from"../constants/common.js";import{removeTrailingSlash as N}from"../../utils/url/remove-trailing-slash.js";import{removeLeadingSlash as j}from"../../utils/url/remove-leading-slash.js";import{isTruthy as $}from"../../utils/guards/is-truthy.js";import{normalizeRouteSlug as D}from"../../utils/path/normalize-route-slug.js";import{parsePathVersions as V}from"../../utils/path/parse-path-versions.js";import{reporter as v}from"../tools/notifiers/reporter.js";import{logger as P}from"../tools/notifiers/logger.js";import{envConfig as S}from"../config/env-config.js";import{shaDirPathShort as M}from"../utils/crypto/sha-dir-path-short.js";import{writeServerRebuildTrigger as _,generateBrowserPluginsModule as q,generateClientRoutes as z,generateTemplatesModule as H}from"../esbuild/generate.js";import{customPagesPlugin as U}from"../../server/plugins/pages/index.js";import{apiDocsPlugin as G}from"../../server/plugins/api-docs/index.js";import{configParserPlugin as I}from"./config-parser/index.js";import{createSlugify as W}from"./create-slugify.js";import{markdownPlugin as K}from"./markdown/index.js";import{searchPlugin as Y}from"./search/index.js";import{skillsPlugin as J}from"./skills/index.js";import{defaultThemePlugin as Q}from"./default-theme/index.js";import{apiKeyMgmtPlugin as X}from"./dev-onboarding/index.js";import{apiFunctionsPlugin as Z}from"./api-functions/index.js";import{scorecardClassicPlugin as ee}from"./scorecard-classic/index.js";import{lintPlugin as te}from"./lint/index.js";import{resolveExternalPlugins as oe}from"../external-plugins/resolve-external-plugins.js";import{sidebarsPlugin as ie}from"./sidebars/index.js";import{l10nPlugin as re}from"./l10n/index.js";import{validateRedirects as ne}from"../utils/redirects/validate-redirects.js";import{analyticsPlugins as se}from"./analytics/index.js";import{sitemapPlugin as ae}from"./sitemap/index.js";import{entitlementsPlugin as le}from"./entitlements/index.js";import{getBilledPagesCount as ce}from"../utils/index.js";import{telemetry as ue}from"../../cli/telemetry/index.js";import{telemetryTraceStep as b}from"../../cli/telemetry/helpers/trace-step.js";import{EntitlementsProvider as A}from"../entitlements/entitlements-provider.js";import{enforceLoginPlugin as fe}from"./enforce-login/index.js";import{ssoPlugin as me}from"./sso/index.js";import{Cache as de}from"../fs/cache.js";import{ContentFs as ge}from"../fs/content-fs.js";import{findProductBySlug as pe}from"../utils/product.js";import{isRouteReserved as Pe}from"./get-reserved-routes.js";import{catalogClassicPlugin as ye}from"./catalog-classic/index.js";import{arazzoDocsPlugin as he}from"./arazzo-docs/index.js";const Re=[I,fe,me,Q,re,K,G,he,ee,te,Z,U,X,ye,{importPath:"./catalog-entities/plugin.js",loadCondition:()=>S.NEW_CATALOG_ENABLED??!1},{importPath:"./scorecards/plugin.js",loadCondition:()=>S.NEW_SCORECARDS_ENABLED??!1},{importPath:"./mcp/index.js",loadCondition:()=>A.instance().canAccessFeature("mcp")},ie,ae,le,Y,J,B,...se];async function gt(t,e=Re){return await b("com.redocly.build.pluginsInit",async()=>{const r=[],R=A.instance(),y={};for(const s of e){let u;if("loadCondition"in s){if(!s.loadCondition())continue;const i=await import(s.importPath);if(!i.default||typeof i.default!="function"){await v.panicOnBuild(`Dynamic plugin ${s.importPath} does not export a default export or it is not a function`);continue}u=i.default}else u=s;const h=await u(t);for(const[i,f]of Object.entries(h.loaders||{}))y[i]&&await v.panicOnBuild(`Duplicate loader with name ${i}`),y[i]=f;(!h.requiredEntitlements||h.requiredEntitlements?.every(i=>R.canAccessFeature(i)))&&r.push(h)}const l=new ge(t.contentDir);await l.ready;const c=new de(l);return c.setLoaders(y),P.verbose("All plugins instantiated"),{pluginInstances:r,lifecycleContext:we(l,c)}})}function O(t){P.verbose("Generating templates"),b("com.redocly.build.writeClientEntries",()=>{H(t),q(t),z(t)})}async function Ce(t){const e=t.getAllRoutes();ce(e)||await v.panicOnBuild("No routes created by plugins. Please check your project configuration.")}async function pt(t,e,r,R={}){const y=A.instance();try{await b("com.redocly.build.pluginsRun",async()=>{e.startPluginsRun();const l=S.isDevelopMode&&e.buildRevision>0,c=l?F(e):"";let s=[];await b("com.redocly.build.pluginsProcessContent",async i=>{for(const o of t){const a=P.startTiming();await o.processContent?.(e,r),P.verboseTime(a,`processContent for ${o.id}`)}s=(await oe(e.contentDir,e.config.plugins)).map(o=>o.lifecyclePlugin).filter(o=>$(o)&&(!o.requiredEntitlements||o.requiredEntitlements?.every(a=>y.canAccessFeature(a)))),r.cache.setLoaders(Object.fromEntries(s.flatMap(o=>Object.entries(o.loaders||{}))));for(const o of s){const a=P.startTiming();await o.processContent?.(e,r),P.verboseTime(a,`processContent for ${o.id}`)}i?.setAttribute("externalPluginsProcessed",s.length.toString())});const u=await ve(e,r),h=[...t,...s];O(e),S.isDevelopMode?await e.userCodeReady:e.buildRevision++,await b("com.redocly.build.pluginsAfterRoutesCreated",async()=>{for(const i of h){const f=P.startTiming();await i.afterRoutesCreated?.(e,u),P.verboseTime(f,`afterRoutesCreated for ${i.id}`)}}),ne(e),await e.reportUnsetEnvVars(),await Ce(e),O(e),l&&c!==F(e)&&(e.markRequestHandlersEntryOutdated(),_(e.serverOutDir))})}catch(l){const c="Unhandled error in plugin. "+l.message+`
-`+l.stack;ue.sendCliErrorCaughtMessage([{id:"cli",object:"error",uri:"urn:redocly:realm:cli:error:cli",message:c}]),R.failFast?await v.panic(c):await v.panicOnBuild(c)}finally{e.finishPluginsRun()}}async function ve(t,e){const{cache:r,fs:R}=e,y=await e.getConfig(),l=Object.values(y.products||{}),c=(await r.load("versions-config","versions-config")).data,s=(await r.load("content-slugs","content-slugs")).data,u=W(s);for(const{duplicateInAllLocales:i,slugSuffix:f,sharedData:o=[],redirectFrom:a=[],...d}of t.newRoutes){const w=D(d.slug?d.slug:u(d.fsPath)),g=N(f?E(w,f):w),n={...d,[x]:{slug:g,fsPath:d.fsPath},slug:g,baseSlug:w,versions:h(d.fsPath,f),product:pe(l,g,u)};Pe(g,y)&&await v.panicOnBuildContentError(`Route "${g}" is reserved and cannot be used. Please choose a different slug for "${d.fsPath}".`),t.routesByFsPath.set(n.fsPath,n.slug),t.routesBySlug.set(n.slug,n);for(const{key:p,id:m}of o)t.addRouteSharedData(n.slug,p,m);for(const p of a)t.addRedirect(p.from,{type:p.type,to:n.slug});if(i)for(const p of R.localeFolders){const m={...n,slug:"/"+p.toLowerCase()+n.slug};t.routesByFsPath.set(m.fsPath,m.slug),t.routesBySlug.set(m.slug,m);for(const{key:C,id:T}of o)t.addRouteSharedData(m.slug,C,T);for(const C of a){const T=E(R.localizationFolder,p,C.from);t.addRedirect(T,{type:C.type,to:m.slug},{trackOriginalSource:!1})}}}return t.newRoutes=[],{...e,slugify:u};function h(i,f=""){const o=V(i);if(!o?.versionName)return;const{versionFolderPath:a,filePathInVersion:d,versionName:w}=o,g=c.get(a);if(g)return g.versions.map(n=>{const p=g.defaultVersion===n.version,m=j(E(a,k+n.version,d)),C=u(m);return{version:n.version,label:n.name||n.version,link:D(E(C,f)),default:p,active:w===n.version,folderId:M(`${a}`)}})}}function we(t,e){return{fs:t,cache:e,getConfig:async(r=".")=>(await e.load(r,"nearest-redocly-config",t.localeFolders)).data,isPathIgnored:async r=>(await e.load(r,"is-ignored")).data,withPathPrefix:L,logger:P}}function F(t){return[...t.apiRoutesRequestHandlers.keys(),...t.getMcpTools().map(e=>`${e.name}:${e.importPath}`)].sort().join(",")}export{Re as INTERNAL_PLUGINS,we as createLifecycleContext,gt as initPlugins,pt as runPlugins,O as writeClientEntries};
+import B from"@redocly/portal-plugin-mock-server";import{REDOCLY_ROUTE_RBAC as x}from"@redocly/config";import{combineUrls as E,withPathPrefix as L}from"@redocly/theme/core/utils";import{VERSION_SEPARATOR as k}from"../constants/common.js";import{removeTrailingSlash as N}from"../../utils/url/remove-trailing-slash.js";import{removeLeadingSlash as j}from"../../utils/url/remove-leading-slash.js";import{isTruthy as $}from"../../utils/guards/is-truthy.js";import{normalizeRouteSlug as D}from"../../utils/path/normalize-route-slug.js";import{parsePathVersions as V}from"../../utils/path/parse-path-versions.js";import{reporter as v}from"../tools/notifiers/reporter.js";import{logger as P}from"../tools/notifiers/logger.js";import{envConfig as S}from"../config/env-config.js";import{shaDirPathShort as M}from"../utils/crypto/sha-dir-path-short.js";import{writeServerRebuildTrigger as _,generateBrowserPluginsModule as q,generateClientRoutes as z,generateTemplatesModule as H}from"../esbuild/generate.js";import{customPagesPlugin as U}from"../../server/plugins/pages/index.js";import{apiDocsPlugin as G}from"../../server/plugins/api-docs/index.js";import{configParserPlugin as I}from"./config-parser/index.js";import{createSlugify as W}from"./create-slugify.js";import{markdownPlugin as K}from"./markdown/index.js";import{searchPlugin as Y}from"./search/index.js";import{skillsPlugin as J}from"./skills/index.js";import{defaultThemePlugin as Q}from"./default-theme/index.js";import{apiKeyMgmtPlugin as X}from"./dev-onboarding/index.js";import{apiFunctionsPlugin as Z}from"./api-functions/index.js";import{scorecardClassicPlugin as ee}from"./scorecard-classic/index.js";import{lintPlugin as te}from"./lint/index.js";import{resolveExternalPlugins as oe}from"../external-plugins/resolve-external-plugins.js";import{sidebarsPlugin as ie}from"./sidebars/index.js";import{l10nPlugin as re}from"./l10n/index.js";import{validateRedirects as ne}from"../utils/redirects/validate-redirects.js";import{analyticsPlugins as se}from"./analytics/index.js";import{consentPlugin as ae}from"./consent/index.js";import{sitemapPlugin as le}from"./sitemap/index.js";import{entitlementsPlugin as ce}from"./entitlements/index.js";import{getBilledPagesCount as ue}from"../utils/index.js";import{telemetry as fe}from"../../cli/telemetry/index.js";import{telemetryTraceStep as b}from"../../cli/telemetry/helpers/trace-step.js";import{EntitlementsProvider as A}from"../entitlements/entitlements-provider.js";import{enforceLoginPlugin as me}from"./enforce-login/index.js";import{ssoPlugin as de}from"./sso/index.js";import{Cache as ge}from"../fs/cache.js";import{ContentFs as pe}from"../fs/content-fs.js";import{findProductBySlug as Pe}from"../utils/product.js";import{isRouteReserved as ye}from"./get-reserved-routes.js";import{catalogClassicPlugin as he}from"./catalog-classic/index.js";import{arazzoDocsPlugin as Re}from"./arazzo-docs/index.js";const Ce=[I,me,de,Q,re,K,G,Re,ee,te,Z,U,X,he,{importPath:"./catalog-entities/plugin.js",loadCondition:()=>S.NEW_CATALOG_ENABLED??!1},{importPath:"./scorecards/plugin.js",loadCondition:()=>S.NEW_SCORECARDS_ENABLED??!1},{importPath:"./mcp/index.js",loadCondition:()=>A.instance().canAccessFeature("mcp")},ie,le,ce,Y,J,B,ae,...se];async function Pt(t,e=Ce){return await b("com.redocly.build.pluginsInit",async()=>{const r=[],R=A.instance(),y={};for(const s of e){let u;if("loadCondition"in s){if(!s.loadCondition())continue;const i=await import(s.importPath);if(!i.default||typeof i.default!="function"){await v.panicOnBuild(`Dynamic plugin ${s.importPath} does not export a default export or it is not a function`);continue}u=i.default}else u=s;const h=await u(t);for(const[i,f]of Object.entries(h.loaders||{}))y[i]&&await v.panicOnBuild(`Duplicate loader with name ${i}`),y[i]=f;(!h.requiredEntitlements||h.requiredEntitlements?.every(i=>R.canAccessFeature(i)))&&r.push(h)}const l=new pe(t.contentDir);await l.ready;const c=new ge(l);return c.setLoaders(y),P.verbose("All plugins instantiated"),{pluginInstances:r,lifecycleContext:be(l,c)}})}function O(t){P.verbose("Generating templates"),b("com.redocly.build.writeClientEntries",()=>{H(t),q(t),z(t)})}async function ve(t){const e=t.getAllRoutes();ue(e)||await v.panicOnBuild("No routes created by plugins. Please check your project configuration.")}async function yt(t,e,r,R={}){const y=A.instance();try{await b("com.redocly.build.pluginsRun",async()=>{e.startPluginsRun();const l=S.isDevelopMode&&e.buildRevision>0,c=l?F(e):"";let s=[];await b("com.redocly.build.pluginsProcessContent",async i=>{for(const o of t){const a=P.startTiming();await o.processContent?.(e,r),P.verboseTime(a,`processContent for ${o.id}`)}s=(await oe(e.contentDir,e.config.plugins)).map(o=>o.lifecyclePlugin).filter(o=>$(o)&&(!o.requiredEntitlements||o.requiredEntitlements?.every(a=>y.canAccessFeature(a)))),r.cache.setLoaders(Object.fromEntries(s.flatMap(o=>Object.entries(o.loaders||{}))));for(const o of s){const a=P.startTiming();await o.processContent?.(e,r),P.verboseTime(a,`processContent for ${o.id}`)}i?.setAttribute("externalPluginsProcessed",s.length.toString())});const u=await we(e,r),h=[...t,...s];O(e),S.isDevelopMode?await e.userCodeReady:e.buildRevision++,await b("com.redocly.build.pluginsAfterRoutesCreated",async()=>{for(const i of h){const f=P.startTiming();await i.afterRoutesCreated?.(e,u),P.verboseTime(f,`afterRoutesCreated for ${i.id}`)}}),ne(e),await e.reportUnsetEnvVars(),await ve(e),O(e),l&&c!==F(e)&&(e.markRequestHandlersEntryOutdated(),_(e.serverOutDir))})}catch(l){const c="Unhandled error in plugin. "+l.message+`
+`+l.stack;fe.sendCliErrorCaughtMessage([{id:"cli",object:"error",uri:"urn:redocly:realm:cli:error:cli",message:c}]),R.failFast?await v.panic(c):await v.panicOnBuild(c)}finally{e.finishPluginsRun()}}async function we(t,e){const{cache:r,fs:R}=e,y=await e.getConfig(),l=Object.values(y.products||{}),c=(await r.load("versions-config","versions-config")).data,s=(await r.load("content-slugs","content-slugs")).data,u=W(s);for(const{duplicateInAllLocales:i,slugSuffix:f,sharedData:o=[],redirectFrom:a=[],...d}of t.newRoutes){const w=D(d.slug?d.slug:u(d.fsPath)),g=N(f?E(w,f):w),n={...d,[x]:{slug:g,fsPath:d.fsPath},slug:g,baseSlug:w,versions:h(d.fsPath,f),product:Pe(l,g,u)};ye(g,y)&&await v.panicOnBuildContentError(`Route "${g}" is reserved and cannot be used. Please choose a different slug for "${d.fsPath}".`),t.routesByFsPath.set(n.fsPath,n.slug),t.routesBySlug.set(n.slug,n);for(const{key:p,id:m}of o)t.addRouteSharedData(n.slug,p,m);for(const p of a)t.addRedirect(p.from,{type:p.type,to:n.slug});if(i)for(const p of R.localeFolders){const m={...n,slug:"/"+p.toLowerCase()+n.slug};t.routesByFsPath.set(m.fsPath,m.slug),t.routesBySlug.set(m.slug,m);for(const{key:C,id:T}of o)t.addRouteSharedData(m.slug,C,T);for(const C of a){const T=E(R.localizationFolder,p,C.from);t.addRedirect(T,{type:C.type,to:m.slug},{trackOriginalSource:!1})}}}return t.newRoutes=[],{...e,slugify:u};function h(i,f=""){const o=V(i);if(!o?.versionName)return;const{versionFolderPath:a,filePathInVersion:d,versionName:w}=o,g=c.get(a);if(g)return g.versions.map(n=>{const p=g.defaultVersion===n.version,m=j(E(a,k+n.version,d)),C=u(m);return{version:n.version,label:n.name||n.version,link:D(E(C,f)),default:p,active:w===n.version,folderId:M(`${a}`)}})}}function be(t,e){return{fs:t,cache:e,getConfig:async(r=".")=>(await e.load(r,"nearest-redocly-config",t.localeFolders)).data,isPathIgnored:async r=>(await e.load(r,"is-ignored")).data,withPathPrefix:L,logger:P}}function F(t){return[...t.apiRoutesRequestHandlers.keys(),...t.getMcpTools().map(e=>`${e.name}:${e.importPath}`)].sort().join(",")}export{Ce as INTERNAL_PLUGINS,be as createLifecycleContext,Pt as initPlugins,yt as runPlugins,O as writeClientEntries};

package/dist/server/plugins/markdown/markdoc/markdoc-options.d.ts

@@ -4,6 +4,8 @@ export declare function getMarkdocOptions(serverOutDir?: string, _templateId?: s
         heading: import("@markdoc/markdoc").Schema;
         fence: import("@markdoc/markdoc").Schema;
         table: import("@markdoc/markdoc").Schema;
+        td: import("@markdoc/markdoc").Schema;
+        th: import("@markdoc/markdoc").Schema;
         text: import("@markdoc/markdoc").Schema;
         strong: {
             render?: string | undefined;

package/dist/server/plugins/markdown/search/get-ai-search-documents.js

@@ -1,9 +1,9 @@
-import _ from"@markdoc/markdoc";import D from"node:path";import{AI_SEARCH_CHUNK_SIZE as b,AI_SEARCH_DOCUMENT_CHUNK_SIZE as E}from"../../../constants/plugins/search.js";import{slugger as M}from"../../../../utils/slugger.js";import{joinSectionContent as P}from"./join-section-content.js";import{toMarkdown as U}from"./to-markdown.js";import{AstToSearchNodeTransformer as x}from"./walk-sections.js";import{createRenderTagFn as I}from"./create-render-tag-fn.js";import{getBuildTranslateContext as y}from"../../../utils/l10n/get-build-translate-context.js";import{getLocaleFromRelativePath as L}from"../../../fs/utils/get-locale-from-relative-path.js";import{HeadingNode as H}from"./nodes/heading-node.js";import{extractDocumentSearchFacets as K}from"./search-facets.js";import{formatDocumentMetadata as N}from"../../search/utils.js";import{TagNode as R}from"./nodes/tag-node.js";import{MARKDOC_PARTIALS_DATA_KEY as j}from"../../../constants/common.js";const w=Symbol(),rt=(n,o)=>async(e,r,i,c)=>{if(o?.excludeFromSearch)return;M.reset();const l=await e.getNavText?.()||D.basename(e.fsPath),f=_.Ast.fromJSON(r.ast),{locale:d,translate:C}=await y(e.slug,c.getGlobalData?.().l10n),s=new x({partials:c.getGlobalConfig(j)||{},renderTag:I(c.markdocOptions.tags,d,C),getInnerContent:U,ast:f,skipConditionals:!0}),g=Array.from(s.transform());return{async getLLMsTxts(){const u=o?.seo,t=u&&typeof u=="object"&&"description"in u?String(u.description):void 0,a=P(g);return[{title:l,description:t,slug:e.slug,fsPath:e.fsPath,content:a,includeInLLMsTxt:!0}]},async getSearchDocuments(){return F(e,g,n,l)}}};function F(n,o,e,r){const i=n.slug,c=new Map,l=n.metadata||{},f=K(l,e),d=N(l),C=d?`Metadata:
-${d}
-`:"";let s=[];for(const t of o)if(t instanceof H){s.splice(t.attributes.level-1,6);const a=t.attributes.level>2,m=s[s.length-1]?.title,S=s[s.length-1]?.url,T=a&&m?m:$(r,t),A=a&&S?S:t.getUrl(i),h={title:T,content:"",url:A,level:t.attributes.level,toc:s.map(v=>p(v.section)).join(`
-`)};(t.attributes.level>1||p(t)!==r)&&(h.content+=h.content?`
-`:"",h.content+=t.content.trimEnd()),c.set(t.id,h),s.push({section:t,title:T,url:A})}else if(t instanceof R)c.set(t.id,{title:t.content,content:t.content,url:t.getUrl(i),level:t.attributes.level+1,toc:s.map(a=>p(a.section)).concat(t.content).join(`
-`)});else{const a=t.parentNode?.id??w,m=c.get(a)??{title:r,content:"",url:i,level:1/0,toc:""};m.content+=m.content?`
-`:"",m.content+=t.content.trimEnd(),c.set(a,m)}const g=O(Array.from(c.values())),u=L(n.fsPath);return g.filter(t=>t.content).map(t=>({title:t.title,url:t.url,content:[C,t.toc||`# ${r}`,t.content].filter(Boolean).join(`
-`),fsPath:n.fsPath,locale:u,product:n.product?.name,facets:f}))}function k(n){return n.length/4}function O(n){if(n.length===0)return[];const o=[];let e=n[0];for(let r=1;r<n.length;r++){const i=n[r],c=k(e.content),l=k(i.content),f=r===n.length-1;l<b&&(c<E||f)&&i.level>e.level?e.content+=`
-`+i.content:(o.push(e),e=i)}return o.push(e),o}function $(n,o){return o.content===n?n:`${n} \u2192 ${p(o)}`}function p(n){return n.content.replace(/^#+/,"").trim()}export{rt as getAiDocumentsStore};
+import M from"@markdoc/markdoc";import D from"node:path";import{AI_SEARCH_CHUNK_SIZE as R,AI_SEARCH_DOCUMENT_CHUNK_SIZE as v}from"../../../constants/plugins/search.js";import{slugger as I}from"../../../../utils/slugger.js";import{joinSectionContent as N}from"./join-section-content.js";import{toMarkdown as P}from"./to-markdown.js";import{AstToSearchNodeTransformer as w}from"./walk-sections.js";import{createRenderTagFn as x}from"./create-render-tag-fn.js";import{getBuildTranslateContext as K}from"../../../utils/l10n/get-build-translate-context.js";import{getLocaleFromRelativePath as L}from"../../../fs/utils/get-locale-from-relative-path.js";import{HeadingNode as b}from"./nodes/heading-node.js";import{extractDocumentSearchFacets as U}from"./search-facets.js";import{formatDocumentMetadata as y}from"../../search/utils.js";import{TagNode as H}from"./nodes/tag-node.js";import{MARKDOC_PARTIALS_DATA_KEY as O}from"../../../constants/common.js";const j=Symbol(),at=(n,o)=>async(e,r,i,c)=>{if(o?.excludeFromSearch)return;I.reset();const l=await e.getNavText?.()||D.basename(e.fsPath),f=M.Ast.fromJSON(r.ast),{locale:g,translate:A}=await K(e.slug,c.getGlobalData?.().l10n),s=new w({partials:c.getGlobalConfig(O)||{},renderTag:x(c.markdocOptions.tags,g,A),getInnerContent:P,ast:f,skipConditionals:!0}),d=Array.from(s.transform());return{async getLLMsTxts(){const u=o?.seo,t=u&&typeof u=="object"&&"description"in u?String(u.description):void 0,a=N(d);return[{title:l,description:t,slug:e.slug,fsPath:e.fsPath,content:a,includeInLLMsTxt:!0}]},async getSearchDocuments(){return F(e,d,n,l)}}};function F(n,o,e,r){const i=n.slug,c=new Map,l=n.metadata||{},f=U(l,e),g=y(l),A=g?`Metadata:
+${g}
+`:"";let s=[];for(const t of o)if(t instanceof b){s.splice(t.attributes.level-1,6);const a=t.attributes.level>2,m=s[s.length-1]?.title,T=s[s.length-1]?.url,C=a&&m?m:W(r,t),S=a&&T?T:t.getUrl(i),p={title:C,content:"",url:S,level:t.attributes.level,toc:s.map(E=>h(E.section)).join(`
+`)};(t.attributes.level>1||h(t)!==r)&&(p.content+=p.content?`
+`:"",p.content+=t.content.trimEnd()),c.set(t.id,p),s.push({section:t,title:C,url:S})}else if(t instanceof H)c.set(t.id,{title:t.content,content:t.content,url:t.getUrl(i),level:t.attributes.level+1,toc:s.map(a=>h(a.section)).concat(t.content).join(`
+`)});else{const a=t.parentNode?.id??j,m=c.get(a)??{title:r,content:"",url:i,level:1/0,toc:""};m.content+=m.content?`
+`:"",m.content+=t.content.trimEnd(),c.set(a,m)}const d=$(Array.from(c.values())),u=L(n.fsPath);return d.filter(t=>t.content).map(t=>({title:t.title,url:t.url,content:[A,t.toc||`# ${r}`,t.content].filter(Boolean).join(`
+`),fsPath:n.fsPath,locale:u,product:n.product?.name,facets:f}))}function _(n){return n.length/4}function $(n){if(n.length===0)return[];const o=[];let e=n[0];for(let r=1;r<n.length;r++){const i=n[r],c=_(e.content),l=_(i.content),f=r===n.length-1;l<R&&(c<v||f)&&i.level>e.level?e.content+=`
+`+i.content:(o.push(e),e=i)}return o.push(e),o}const k=String.raw`\((?:[^()]|\([^()]*\))*\)`,G=new RegExp(String.raw`!\[[^\]]*\]`+k,"g"),z=new RegExp(String.raw`\[([^\]]*)\]`+k,"g");function W(n,o){const e=h(o);return o.content===n||!e?n:`${n} \u2192 ${e}`}function h(n){return B(n.content.replace(/^#+/,""))}function B(n){return n.replace(G,"").replace(z,"$1").trim()}export{at as getAiDocumentsStore};

package/dist/server/plugins/markdown/search/nodes/tag-node.d.ts

@@ -1,5 +1,5 @@
 import { SectionNode, type SectionNodeParams } from './section-node.js';
-export declare const TAG_TITLE_ATTRIBUTES: readonly ['title', 'alt', 'name', 'label'];
+export declare const TAG_TITLE_ATTRIBUTES: readonly ['title', 'name', 'label'];
 declare const TagNode_base: typeof SectionNode;
 export declare class TagNode extends TagNode_base {
     constructor(params: SectionNodeParams);

package/dist/server/plugins/markdown/search/nodes/tag-node.js

@@ -1 +1 @@
-import{SectionNode as r,WithCounterId as o}from"./section-node.js";const i=["title","alt","name","label"];class s extends o(r){constructor(t){super(t)}getUrl(t){return this.parentNode?.getUrl(t)??t}getPath(t){let e=this.parentNode?.getPath(t);return e||(e=this.content?[this.content]:[]),e}}export{i as TAG_TITLE_ATTRIBUTES,s as TagNode};
+import{SectionNode as r,WithCounterId as o}from"./section-node.js";const i=["title","name","label"];class s extends o(r){constructor(t){super(t)}getUrl(t){return this.parentNode?.getUrl(t)??t}getPath(t){let e=this.parentNode?.getPath(t);return e||(e=this.content?[this.content]:[]),e}}export{i as TAG_TITLE_ATTRIBUTES,s as TagNode};

package/dist/server/plugins/mcp/audit/audit-log.js

@@ -1 +1 @@
-import{createHash as a}from"node:crypto";import{logger as c}from"../../../tools/notifiers/logger.js";import{AUDIT_LOG_PREFIX as u}from"./constants.js";import{redactSecretsFromString as f}from"../gateway-mcp/fetch/redact.js";import{redactSecretShapes as p}from"./secret-patterns.js";import{AUDIT_LOG_PREFIX as I}from"./constants.js";const s=4096,d="redacted",m=new Set(["access_token","api-key","api_key","apikey","auth","code","id_token","key","password","refresh_token","secret","session","sig","signature","token","x-amz-credential","x-amz-security-token","x-amz-signature"]);function h(t){return a("sha256").update(t,"utf8").digest("hex")}function g(t){if(t.length<=s)return t;const e=t.slice(0,s),r=e.search(/\s\S*$/),n=r>0?e.slice(0,r):e;return`${n}\u2026[truncated: kept ${n.length} of ${t.length} chars]`}function i(t,e=[]){return p(f(g(t),e))}function S(t){return{sha256:h(t),bytes:Buffer.byteLength(t,"utf8")}}function $(t){return Object.keys(t??{}).map(e=>e.toLowerCase()).sort().join(",")}function E(t,e=[]){let r;try{r=new URL(t)}catch{return i(t,e)}for(const n of[...r.searchParams.keys()])m.has(n.toLowerCase())&&r.searchParams.set(n,d);return r.username="",r.password="",i(r.href,e)}function R(t,e){const r=Object.entries(e).filter(([,n])=>n!==void 0&&n!=="").map(([n,o])=>typeof o=="string"?`${n}=${JSON.stringify(o)}`:`${n}=${String(o)}`).join(" ");try{c.infoPreSanitized(`${u} ${t} ${r}`)}catch{}}export{s as AUDIT_FIELD_MAX_CHARS,I as AUDIT_LOG_PREFIX,$ as auditHeaderNames,i as auditInput,S as auditOutputDigest,h as auditSha256,E as auditUrl,R as logAuditRecord,g as truncateAuditField};
+import{createHash as c}from"node:crypto";import{logger as s}from"../../../tools/notifiers/logger.js";import{redactUrl as f}from"../../../utils/redact-url.js";import{AUDIT_LOG_PREFIX as p}from"./constants.js";import{redactSecretsFromString as u}from"../gateway-mcp/fetch/redact.js";import{redactSecretShapes as a}from"./secret-patterns.js";import{AUDIT_LOG_PREFIX as L}from"./constants.js";const i=4096;function d(t){return c("sha256").update(t,"utf8").digest("hex")}function m(t){if(t.length<=i)return t;const r=t.slice(0,i),o=r.search(/\s\S*$/),e=o>0?r.slice(0,o):r;return`${e}\u2026[truncated: kept ${e.length} of ${t.length} chars]`}function h(t,r=[]){return a(u(m(t),r))}function _(t){return{sha256:d(t),bytes:Buffer.byteLength(t,"utf8")}}function l(t){return Object.keys(t??{}).map(r=>r.toLowerCase()).sort().join(",")}function O(t,r=[]){return h(f(t),r)}function y(t,r){const o=Object.entries(r).filter(([,e])=>e!==void 0&&e!=="").map(([e,n])=>typeof n=="string"?`${e}=${JSON.stringify(n)}`:`${e}=${String(n)}`).join(" ");try{s.infoPreSanitized(`${p} ${t} ${o}`)}catch{}}export{i as AUDIT_FIELD_MAX_CHARS,L as AUDIT_LOG_PREFIX,l as auditHeaderNames,h as auditInput,_ as auditOutputDigest,d as auditSha256,O as auditUrl,y as logAuditRecord,m as truncateAuditField};

package/dist/server/plugins/mcp/auth/assistant-anonymous-token.d.ts

@@ -0,0 +1,10 @@
+export declare const ASSISTANT_ANONYMOUS_TOKEN_TYPE = "ai_assistant_anonymous";
+/**
+ * Mints the token the portal sends with an anonymous visitor's assistant question, so that the
+ * Reunite API reaches `/mcp` with anonymous scope instead of an OAuth challenge. Returns nothing
+ * when this portal cannot mint a token its own `/mcp` would accept.
+ */
+export declare function createAssistantAnonymousToken(): Promise<string | undefined>;
+/** Tells whether the bearer is an unexpired token this project minted for its own AI assistant. */
+export declare function isAssistantAnonymousToken(token: string): Promise<boolean>;
+//# sourceMappingURL=assistant-anonymous-token.d.ts.map

package/dist/server/plugins/mcp/auth/assistant-anonymous-token.js

@@ -0,0 +1 @@
+import{hkdfSync as f}from"node:crypto";import{FALLBACK_JWT_SECRET_KEY as m}from"../../../constants/common.js";import{envConfig as o}from"../../../config/env-config.js";import{AlgorithmTypes as i}from"../../../web-server/jwt/types.js";import*as s from"../../../web-server/jwt/jwt.js";import{toAudienceList as S}from"./token-audience.js";const a="ai_assistant_anonymous",T=600,u="ai-assistant-anonymous";function c(){const n=o.JWT_SECRET_KEY;if(!(!n||n===m||!o.PROJECT_ID))return Buffer.from(f("sha256",n,u,u,32)).toString("hex")}async function E(){const n=c();if(!n)return;const t=Math.floor(Date.now()/1e3);return s.sign({type:a,anonymous:!0,aud:o.PROJECT_ID,iat:t,exp:t+T},n,i.HS256)}async function g(n){const t=c();if(!t)return!1;try{await s.verify(n,t,i.HS256)}catch{return!1}const{payload:e}=s.decode(n),r=o.PROJECT_ID;return e.type===a&&e.anonymous===!0&&!!r&&S(e.aud).includes(r)}export{a as ASSISTANT_ANONYMOUS_TOKEN_TYPE,E as createAssistantAnonymousToken,g as isAssistantAnonymousToken};

package/dist/server/plugins/mcp/auth/auth-handlers.d.ts

@@ -1,13 +1,15 @@
 import type { ApiFunctionsContext, ApiFunctionsUser } from '@redocly/config';
 import type { Store } from '../../../store.js';
 export declare function isMcpContentProtected(store: Store): boolean;
-export declare function handleMcpAuth(request: Request, context: ApiFunctionsContext): Promise<{
+export type McpAuthResult = {
     isAuthenticated: boolean;
     isTokenValid?: boolean;
+    isFirstPartyAnonymous?: boolean;
     currentUser?: ApiFunctionsUser;
     accessToken?: string;
-}>;
+};
+export declare function handleMcpAuth(request: Request, context: ApiFunctionsContext): Promise<McpAuthResult>;
 export declare function constructUnauthorizedResponse(baseUrl: string, publicMcpUrl?: string): Response;
 export declare function constructForbiddenResponse(): Response;
-export declare function constructInvalidTokenResponse(baseUrl: string): Response;
+export declare function constructInvalidTokenResponse(baseUrl: string, publicMcpUrl?: string): Response;
 //# sourceMappingURL=auth-handlers.d.ts.map

package/dist/server/plugins/mcp/auth/auth-handlers.js

@@ -1 +1 @@
-import{extractTokenFromAuthHeader as d}from"../../../plugins/mcp/utils/jwt.js";import{SUPPORTED_MCP_SCOPES as p}from"../constants.js";import{getUserParamsFromCookies as h}from"../../../web-server/auth.js";import{ServerRoutes as c}from"../../../../constants/api.js";import{withPathPrefix as l}from"@redocly/theme/core/utils";import{shouldHandleMcpAuth as f}from"../../../utils/rbac/should-handle-mcp-auth.js";import{checkTokenAudience as m,isTokenAudienceEnforced as A,toAudienceList as T}from"./token-audience.js";import{reportMcpTokenAudienceMismatch as k}from"./token-audience-telemetry.js";function x(t){const e=t.getConfig().access;return f(!!e?.requiresLogin,e?.rbac||{})}async function E(t,e){const o=t.headers.get("Authorization");if(!o)return{isAuthenticated:!1};const i=d(o),r=e?.config?.ssoDirect||{},n=i?await h(r,{authorization:i}):{};if(!(i&&n&&n.isAuthenticated))return{isAuthenticated:!1,isTokenValid:!1};const s=n.aud;if(m(s)==="mismatch"){const a=A();if(k({audience:T(s).join(","),enforced:a}),a)return{isAuthenticated:!1,isTokenValid:!1}}return{isAuthenticated:!0,isTokenValid:!0,currentUser:{teams:n.teams||[],email:n.email||"",claims:n,isAuthenticated:!0,idpAccessToken:n.idpAccessToken||void 0,idpId:n.idpId||void 0},accessToken:i}}function u(t,e){const o=`${t}${c.MCP_OAUTH_PROTECTED_RESOURCE}${l("/mcp")}`,i=`${t}${c.MCP_OAUTH_AUTHORIZATION_SERVER}`,r=e?[`error="${e.code}"`,`error_description="${e.description}"`]:[];return r.push(`resource_metadata="${o}"`,`scope="${p.join(" ")}"`,`authorization_uri="${i}"`),`Bearer ${r.join(", ")}`}function S(t,e){const o=e?`Authentication required. A public endpoint that serves anonymous-accessible content is available at ${e}.`:"Authentication required";return new Response(JSON.stringify({error:"unauthorized",message:o}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":u(t),"Access-Control-Allow-Origin":"*"}})}function w(){return new Response(JSON.stringify({error:"forbidden",message:"You do not have access to this MCP server"}),{status:403,headers:{"Content-Type":"application/json","Access-Control-Allow-Origin":"*"}})}function y(t){return new Response(JSON.stringify({error:"invalid_token",message:"Invalid or expired token"}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":u(t,{code:"invalid_token",description:"Invalid or expired token"}),"Access-Control-Allow-Origin":"*"}})}export{w as constructForbiddenResponse,y as constructInvalidTokenResponse,S as constructUnauthorizedResponse,E as handleMcpAuth,x as isMcpContentProtected};
+import{extractTokenFromAuthHeader as p}from"../../../plugins/mcp/utils/jwt.js";import{SUPPORTED_MCP_SCOPES as f}from"../constants.js";import{getUserParamsFromCookies as h}from"../../../web-server/auth.js";import{ServerRoutes as c}from"../../../../constants/api.js";import{withPathPrefix as l}from"@redocly/theme/core/utils";import{shouldHandleMcpAuth as m}from"../../../utils/rbac/should-handle-mcp-auth.js";import{isAssistantAnonymousToken as A}from"./assistant-anonymous-token.js";import{checkTokenAudience as T,isTokenAudienceEnforced as k,toAudienceList as C}from"./token-audience.js";import{reportMcpTokenAudienceMismatch as g}from"./token-audience-telemetry.js";function x(t){const e=t.getConfig().access;return m(!!e?.requiresLogin,e?.rbac||{})}async function S(t,e){const n=t.headers.get("Authorization");if(!n)return{isAuthenticated:!1};const o=p(n);if(o&&await A(o))return{isAuthenticated:!1,isTokenValid:!0,isFirstPartyAnonymous:!0};const r=e?.config?.ssoDirect||{},i=o?await h(r,{authorization:o}):{};if(!(o&&i&&i.isAuthenticated))return{isAuthenticated:!1,isTokenValid:!1};const s=i.aud;if(T(s)==="mismatch"){const a=k();if(g({audience:C(s).join(","),enforced:a}),a)return{isAuthenticated:!1,isTokenValid:!1}}return{isAuthenticated:!0,isTokenValid:!0,currentUser:{teams:i.teams||[],email:i.email||"",claims:i,isAuthenticated:!0,idpAccessToken:i.idpAccessToken||void 0,idpId:i.idpId||void 0},accessToken:o}}function u(t,e){const n=`${t}${c.MCP_OAUTH_PROTECTED_RESOURCE}${l("/mcp")}`,o=`${t}${c.MCP_OAUTH_AUTHORIZATION_SERVER}`,r=e?[`error="${e.code}"`,`error_description="${e.description}"`]:[];return r.push(`resource_metadata="${n}"`,`scope="${f.join(" ")}"`,`authorization_uri="${o}"`),`Bearer ${r.join(", ")}`}function d(t,e){return e?`${t}. A public endpoint that serves anonymous-accessible content is available at ${e}.`:t}function U(t,e){const n=d("Authentication required",e);return new Response(JSON.stringify({error:"unauthorized",message:n}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":u(t),"Access-Control-Allow-Origin":"*"}})}function b(){return new Response(JSON.stringify({error:"forbidden",message:"You do not have access to this MCP server"}),{status:403,headers:{"Content-Type":"application/json","Access-Control-Allow-Origin":"*"}})}function H(t,e){const n=d("Invalid or expired token",e);return new Response(JSON.stringify({error:"invalid_token",message:n}),{status:401,headers:{"Content-Type":"application/json","WWW-Authenticate":u(t,{code:"invalid_token",description:"Invalid or expired token"}),"Access-Control-Allow-Origin":"*"}})}export{b as constructForbiddenResponse,H as constructInvalidTokenResponse,U as constructUnauthorizedResponse,S as handleMcpAuth,x as isMcpContentProtected};

package/dist/server/plugins/mcp/codemode/build-tool-type-declarations.js

@@ -1,8 +1,8 @@
-const f=/^[A-Za-z_$][\w$]*$/;function y(n){const e=n.split(/[^A-Za-z0-9]+/).filter(Boolean).map((o,i)=>i===0?o:o[0].toUpperCase()+o.slice(1)).join("");return f.test(e)?e:`_${e}`}function T(n){return["```ts","declare const tools: {",n.map(e=>{const o=e.schema,i=e.outputSchema?u(e.outputSchema):"unknown",s=o.required?.length?"input":"input?";return`  /** ${l(e.description)} */
+const l=/^[A-Za-z_$][\w$]*$/;function y(n){const e=n.split(/[^A-Za-z0-9]+/).filter(Boolean).map((o,i)=>i===0?o:o[0].toUpperCase()+o.slice(1)).join("");return l.test(e)?e:`_${e}`}function w(n){return["```ts","declare const tools: {",n.map(e=>{const o=e.schema,i=e.outputSchema?u(e.outputSchema):"unknown",s=o.required?.length?"input":"input?";return`  /** ${f(e.description)} */
   ${y(e.name)}(${s}: ${u(o,"  ")}): Promise<${i}>;`}).join(`
 `),"};","```"].join(`
-`)}function l(n){return(n??"").replace(/\*\//g,"*\\/")}function u(n,r=""){if(!n||typeof n!="object")return"unknown";const e=n.nullable?" | null":"";if(typeof n.codemodeType=="string")return n.codemodeType+e;if(Array.isArray(n.enum))return n.enum.map(m).join(" | ")+e;switch(n.type){case"string":return"string"+e;case"number":case"integer":return"number"+e;case"boolean":return"boolean"+e;case"array":return`Array<${u(n.items,r)}>`+e;case"object":return b(n,r)+e;default:return"unknown"}}function m(n){return typeof n=="string"?`'${n.replace(/\\/g,"\\\\").replace(/'/g,"\\'")}'`:String(n)}function b(n,r){const e=n.properties??{},o=Object.keys(e),i=n.additionalProperties,s=i?i===!0?"unknown":u(i,r):void 0;if(o.length===0)return i===!1?"{}":`Record<string, ${s??"unknown"}>`;const $=new Set(n.required??[]),c=o.map(t=>{const p=e[t],d=$.has(t)?"":"?",g=f.test(t)?t:JSON.stringify(t);return{doc:p.description,field:`${g}${d}: ${u(p,r+"  ")}`}});if(s&&c.push({field:`[key: string]: ${s}`}),!c.some(({doc:t})=>t))return`{ ${c.map(({field:t})=>t).join("; ")} }`;const a=r+"  ";return`{
-${c.map(({doc:t,field:p})=>`${t?`${a}/** ${l(t)} */
+`)}function f(n){return(n??"").replace(/\*\//g,"*\\/")}function u(n,r=""){if(!n||typeof n!="object")return"unknown";const e=typeof n.codemodeType=="string"?[n.codemodeType]:Array.isArray(n.enum)&&n.enum.length>0?n.enum.map(b):[m(n,r)];return n.nullable&&e.push("null"),[...new Set(e)].join(" | ")}function m(n,r){switch(n.type){case"string":return"string";case"number":case"integer":return"number";case"boolean":return"boolean";case"array":return`Array<${u(n.items,r)}>`;case"object":return j(n,r);default:return"unknown"}}function b(n){return typeof n=="string"?`'${n.replace(/\\/g,"\\\\").replace(/'/g,"\\'")}'`:String(n)}function j(n,r){const e=n.properties??{},o=Object.keys(e),i=n.additionalProperties,s=i?i===!0?"unknown":u(i,r):void 0;if(o.length===0)return i===!1?"{}":`Record<string, ${s??"unknown"}>`;const $=new Set(n.required??[]),c=o.map(t=>{const p=e[t],d=$.has(t)?"":"?",g=l.test(t)?t:JSON.stringify(t);return{doc:p.description,field:`${g}${d}: ${u(p,r+"  ")}`}});if(s&&c.push({field:`[key: string]: ${s}`}),!c.some(({doc:t})=>t))return`{ ${c.map(({field:t})=>t).join("; ")} }`;const a=r+"  ";return`{
+${c.map(({doc:t,field:p})=>`${t?`${a}/** ${f(t)} */
 `:""}${a}${p};`).join(`
 `)}
-${r}}`}export{T as buildToolTypeDeclarations,y as sanitizeToolName};
+${r}}`}export{w as buildToolTypeDeclarations,y as sanitizeToolName};

package/dist/server/plugins/mcp/codemode/capabilities/types.d.ts

@@ -6,7 +6,6 @@ export type SandboxCapability = {
     purpose: string;
     /** Whether this capability is live for THIS request (RBAC/config/flag-dependent). */
     isActive(context: McpToolContext): boolean;
-    /** How this capability changes `execute`'s MCP annotations when active. */
     annotations: Partial<ToolAnnotations>;
     /**
      * The self-contained `describe-tools` section for this capability: heading, TS declaration,

package/dist/server/plugins/mcp/codemode/capabilities/utils.d.ts

@@ -3,8 +3,7 @@ import type { McpToolSchema } from '../../../../types';
 import type { McpToolContext } from '../../types.js';
 import type { SandboxCapability } from './types.js';
 export declare function getActiveCapabilities(context: McpToolContext): SandboxCapability[];
-/** `execute`'s annotations = the read-only base with every active capability's delta merged over it. */
-export declare function composeExecuteAnnotations(active: SandboxCapability[]): ToolAnnotations;
+export declare function composeExecuteAnnotations(tools: McpToolSchema[], capabilities: SandboxCapability[]): ToolAnnotations;
 /**
  * The describe-tools output: the tool signatures, the always-present
  * `execute` args note, then one self-contained section per selected capability.

package/dist/server/plugins/mcp/codemode/capabilities/utils.js

@@ -1,7 +1,7 @@
-import{buildToolTypeDeclarations as c,sanitizeToolName as p}from"../build-tool-type-declarations.js";import{EXECUTE_BASE_ANNOTATIONS as u}from"../tools/execute-schema.js";import{buildExecuteExample as m,EXECUTE_ARGS_NOTE as a,USAGE_NOTES as E}from"../prompts.js";import{FETCH_TOOL_NAME as f}from"../constants.js";import{ALL_CAPABILITIES as A}from"./registry.js";function S(n){return A.filter(e=>e.isActive(n))}function _(n){return n.reduce((e,i)=>({...e,...i.annotations}),{...u})}function x(n,e,i){const r=n.map(o=>p(o.name)),t=[];if(n.length>0){const o=c(n),s=o.includes("OpenApi")?`
+import{buildToolTypeDeclarations as p,sanitizeToolName as c}from"../build-tool-type-declarations.js";import{buildExecuteExample as u,EXECUTE_ARGS_NOTE as l,USAGE_NOTES as m}from"../prompts.js";import{FETCH_TOOL_NAME as a}from"../constants.js";import{ALL_CAPABILITIES as d}from"./registry.js";function H(t){return d.filter(o=>o.isActive(t))}function h(t,o){const r=[...t,...o].map(({annotations:e})=>e??{}),i=r.filter(e=>e.readOnlyHint!==!0);return{readOnlyHint:i.length===0,destructiveHint:i.some(e=>e.destructiveHint!==!1),idempotentHint:i.every(e=>e.idempotentHint===!0),openWorldHint:r.some(e=>e.openWorldHint!==!1)}}function O(t,o,r){const i=t.map(n=>c(n.name)),e=[];if(t.length>0){const n=p(t),s=n.includes("OpenApi")?`
 
-${E}`:"";t.push(`## Sandbox tools
+${m}`:"";e.push(`## Sandbox tools
 
-${o}${s}`)}t.push(a),n.length>0&&!e.some(o=>o.id===f)&&t.push(m(r));for(const o of e)t.push(o.renderSection(i,r));return t.join(`
+${n}${s}`)}e.push(l),t.length>0&&!o.some(n=>n.id===a)&&e.push(u(i));for(const n of o)e.push(n.renderSection(r,i));return e.join(`
 
-`)}export{_ as composeExecuteAnnotations,S as getActiveCapabilities,x as renderDescribeToolsOutput};
+`)}export{h as composeExecuteAnnotations,H as getActiveCapabilities,O as renderDescribeToolsOutput};

package/dist/server/plugins/mcp/codemode/tools/describe-tools.js

@@ -1,3 +1,3 @@
-import{renderDescribeToolsOutput as O}from"../capabilities/index.js";import{McpServerType as M}from"../../constants.js";import{reportMcpToolCalled as _,reportMcpToolError as k}from"../../workers/mcp-tool-telemetry.js";import{DESCRIBE_TOOLS_TOOL_NAME as d}from"../constants.js";import{DESCRIBE_TOOLS_DESCRIPTION as D}from"../prompts.js";import{sanitizeToolName as n}from"../build-tool-type-declarations.js";import{UnknownToolError as v}from"./tool-errors.js";function x(i,c){const t=[...new Set([...i.map(s=>n(s.name)),...c.map(s=>n(s.id))])];return{name:d,title:"Describe tools",description:D,schema:{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${t.join(", ")}. Omit to describe everything.`,items:t.length>0?{type:"string",enum:t}:{type:"string"},nullable:!0}}}}}function P(i,c,t,s){const l=new Map(i.map(r=>[n(r.name),r])),f=new Map(t.map(r=>[n(r.id),r]));return async r=>{const u=performance.now(),h=s.mcpMode??"code";try{const o=[...new Set((r.tools??[]).map(n))],a=o.length===0,T=o.filter(e=>!l.has(e)&&!f.has(e));if(T.length>0){const e=[...l.keys(),...f.keys()];throw new v(`Unknown tool(s): ${T.join(", ")}. Valid tools: ${e.join(", ")}.`)}const E=a?t:t.filter(e=>o.includes(n(e.id))),p=a?i:o.filter(e=>l.has(e)).map(e=>l.get(e)),y=await Promise.all(p.map(e=>c(e.name))),S=p.filter((e,m)=>y[m]),w=p.filter((e,m)=>!y[m]),g=[O(S,E,s)];w.length>0&&g.push(`Not available for this request: ${w.map(e=>n(e.name)).join(", ")}`);const b=g.join(`
+import{renderDescribeToolsOutput as S}from"../capabilities/index.js";import{McpServerType as v}from"../../constants.js";import{reportMcpToolCalled as _,reportMcpToolError as k}from"../../workers/mcp-tool-telemetry.js";import{DESCRIBE_TOOLS_TOOL_NAME as d}from"../constants.js";import{DESCRIBE_TOOLS_DESCRIPTION as D}from"../prompts.js";import{sanitizeToolName as n}from"../build-tool-type-declarations.js";import{UnknownToolError as M}from"./tool-errors.js";function q(a,c){const t=[...new Set([...a.map(s=>n(s.name)),...c.map(s=>n(s.id))])];return{name:d,title:"Describe tools",description:D,annotations:{readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},schema:{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${t.join(", ")}. Omit to describe everything.`,items:t.length>0?{type:"string",enum:t}:{type:"string"},nullable:!0}}}}}function x(a,c,t,s){const l=new Map(a.map(r=>[n(r.name),r])),f=new Map(t.map(r=>[n(r.id),r]));return async r=>{const u=performance.now(),h=s.mcpMode??"code";try{const o=[...new Set((r.tools??[]).map(n))],i=o.length===0,y=o.filter(e=>!l.has(e)&&!f.has(e));if(y.length>0){const e=[...l.keys(),...f.keys()];throw new M(`Unknown tool(s): ${y.join(", ")}. Valid tools: ${e.join(", ")}.`)}const E=i?t:t.filter(e=>o.includes(n(e.id))),p=i?a:o.filter(e=>l.has(e)).map(e=>l.get(e)),T=await Promise.all(p.map(e=>c(e.name))),O=p.filter((e,m)=>T[m]),w=p.filter((e,m)=>!T[m]),g=[S(O,E,s)];w.length>0&&g.push(`Not available for this request: ${w.map(e=>n(e.name)).join(", ")}`);const b=g.join(`
 
-`);return _({tool:d,mode:h,serverType:M.Docs,durationMs:Math.round(performance.now()-u),outputLength:b.length}),{content:[{type:"text",text:b}]}}catch(o){const a=o instanceof v;throw k({tool:d,mode:h,serverType:M.Docs,durationMs:Math.round(performance.now()-u),message:o instanceof Error?o.message:String(o),stack:!a&&o instanceof Error&&o.stack||"",errorClass:a?"tool_error":"server_error"}),o}}}export{P as describeTools,x as describeToolsSchema};
+`);return _({tool:d,mode:h,serverType:v.Docs,durationMs:Math.round(performance.now()-u),outputLength:b.length}),{content:[{type:"text",text:b}]}}catch(o){const i=o instanceof M;throw k({tool:d,mode:h,serverType:v.Docs,durationMs:Math.round(performance.now()-u),message:o instanceof Error?o.message:String(o),stack:!i&&o instanceof Error&&o.stack||"",errorClass:i?"tool_error":"server_error"}),o}}}export{x as describeTools,q as describeToolsSchema};

package/dist/server/plugins/mcp/codemode/tools/execute-schema.d.ts

@@ -1,5 +1,3 @@
-import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../../types';
-export declare const EXECUTE_BASE_ANNOTATIONS: ToolAnnotations;
 export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;
 //# sourceMappingURL=execute-schema.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/execute-schema.js

@@ -1 +1 @@
-import{EXECUTE_TOOL_NAME as e}from"../constants.js";import{buildExecuteDescription as t}from"../prompts.js";const n={readOnlyHint:!0,openWorldHint:!1},r={name:e,title:"Execute code",description:t(!1),annotations:n,schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required when an API needs credentials. This parameter is only offered when createAnonymousSession is available, so pass it whenever you have called that tool.",minLength:1}}}};export{n as EXECUTE_BASE_ANNOTATIONS,r as EXECUTE_TOOL_SCHEMA};
+import{EXECUTE_TOOL_NAME as e}from"../constants.js";import{buildExecuteDescription as t}from"../prompts.js";const r={name:e,title:"Execute code",description:t(!1),schema:{type:"object",required:["code","description"],additionalProperties:!1,properties:{code:{type:"string",description:"JavaScript to run in the sandbox. Return a value to receive it as the result.",minLength:1},description:{type:"string",description:"A short, human-readable summary of what this code does.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required when an API needs credentials. This parameter is only offered when createAnonymousSession is available, so pass it whenever you have called that tool.",minLength:1}}},outputSchema:{type:"object",properties:{result:{description:"The value the code returned, as JSON"},error:{type:"string",description:"Why the code failed. Set only on a failed call"}}}};export{r as EXECUTE_TOOL_SCHEMA};

package/dist/server/plugins/mcp/codemode/tools/execute.js

@@ -1 +1 @@
-import{runInSandbox as C}from"../../../../sandbox/sandbox.js";import{SANDBOX_FAILURE as E}from"../../../../sandbox/constants/sandbox.js";import{returnLastExpression as y}from"../../../../sandbox/utils/return-last-expression.js";import{isMcpToolAvailable as g}from"../../workers/execute-mcp-tool.js";import{importMcpToolHandlers as A}from"../../workers/import-mcp-tool-handlers.js";import{isFetchCapable as M}from"../../gateway-mcp/callable-apis.js";import{buildExecuteHostFetch as S}from"../../gateway-mcp/fetch-capability.js";import{withAuthRequiredMeta as k}from"../../gateway-mcp/upstream-auth.js";import{CODE_MODE_TOOL_NAMES as v,EXECUTE_TOOL_NAME as x}from"../constants.js";import{sanitizeToolName as F}from"../build-tool-type-declarations.js";import{invokeTool as H}from"../invoke-tool.js";import{createSandboxSetup as R}from"../sandbox/create-sandbox-setup.js";import{createToolInputValidator as D}from"../sandbox/tool-input-validator.js";import{describeGuestError as j}from"../sandbox/unknown-tool-hint.js";import{auditCode as B}from"../code-audit.js";import{reportCodeExecuted as I}from"../code-execution-telemetry.js";import{logCodeExecutionAudit as L}from"../code-execution-audit.js";import{ToolResultError as N}from"./tool-errors.js";const P=async(e,t,n)=>{const i=new Map,s=await U(t,n,i),a=[],o=M(t)?await S(t,h=>a.push(h)):void 0;let f=0;const m=o?h=>(f+=1,o(h).catch(_=>{throw i.set(O(_),{reason:"runtime_error"}),_})):void 0,c=B(e.code);L({audit:c,code:e.code,description:e.description,sessionHandle:e.sessionHandle,toolNames:Object.keys(s),fetchBudget:t.gatewayFetchBudgetPerExec,fetchCapable:o!==void 0});const l=Date.now(),d=y(e.code),{result:u,error:r,failure:b,errorPosition:T}=await C(d,{setupContext:R(s,m),authoredCode:e.code}),w=r===void 0?void 0:j(d,r,T,Object.keys(s)),p=r!==void 0&&b===E.HostError?i.get(r):void 0;return I({audit:c,fetchCount:f,outcome:r===void 0?"ok":"error",durationMs:Date.now()-l,failureReason:V(b,p,w?.unknownTool),failedTool:p?.tool,client:t.client,clientVersion:t.clientVersion}),k({content:[{type:"text",text:JSON.stringify({result:u,error:w?.message})}],isError:r!==void 0,...p?.tool!==void 0?{errorClass:"tool_error"}:{}},a)};function V(e,t,n){return e===E.HostError?t?.reason??"runtime_error":e===E.RuntimeError?n===void 0?e:"unknown_tool":e}async function U(e,t,n){const i=Object.keys(await A()).filter(o=>!v.has(o)),s=await Promise.all(i.map(o=>g({toolName:o,context:e}).catch(()=>!1))),a={};return i.forEach((o,f)=>{if(!s[f])return;const m=F(o),c=e.sandboxToolSchemas?.[o],l=c?D(m,c):void 0;a[m]=d=>{const u=l?.(d);return u?(n.set(u,{tool:o,reason:"inner_tool_error"}),Promise.reject(new Error(u))):H(o,d,e,t).catch(r=>{throw n.set(O(r),{tool:o,reason:r instanceof N?"inner_tool_error":"server_error"}),r})}}),a}function O(e){return e instanceof Error?e.message:String(e)}var ae={[x]:P};export{ae as default};
+import{runInSandbox as y}from"../../../../sandbox/sandbox.js";import{SANDBOX_FAILURE as b}from"../../../../sandbox/constants/sandbox.js";import{returnLastExpression as g}from"../../../../sandbox/utils/return-last-expression.js";import{isMcpToolAvailable as A}from"../../workers/execute-mcp-tool.js";import{importMcpToolHandlers as M}from"../../workers/import-mcp-tool-handlers.js";import{isFetchCapable as S}from"../../gateway-mcp/callable-apis.js";import{buildExecuteHostFetch as k}from"../../gateway-mcp/fetch-capability.js";import{withAuthRequiredMeta as v}from"../../gateway-mcp/upstream-auth.js";import{CODE_MODE_TOOL_NAMES as x,EXECUTE_TOOL_NAME as F}from"../constants.js";import{sanitizeToolName as H}from"../build-tool-type-declarations.js";import{invokeTool as R}from"../invoke-tool.js";import{createSandboxSetup as D}from"../sandbox/create-sandbox-setup.js";import{createToolInputValidator as j}from"../sandbox/tool-input-validator.js";import{describeGuestError as B}from"../sandbox/unknown-tool-hint.js";import{auditCode as I}from"../code-audit.js";import{reportCodeExecuted as L}from"../code-execution-telemetry.js";import{logCodeExecutionAudit as N}from"../code-execution-audit.js";import{ToolResultError as P}from"./tool-errors.js";const V=async(e,t,n)=>{const i=new Map,s=await X(t,n,i),a=[],o=S(t)?await k(t,E=>a.push(E)):void 0;let f=0;const m=o?E=>(f+=1,o(E).catch(O=>{throw i.set(T(O),{reason:"runtime_error"}),O})):void 0,c=I(e.code);N({audit:c,code:e.code,description:e.description,sessionHandle:e.sessionHandle,toolNames:Object.keys(s),fetchBudget:t.gatewayFetchBudgetPerExec,fetchCapable:o!==void 0});const l=Date.now(),d=g(e.code),{result:u,error:r,failure:w,errorPosition:C}=await y(d,{setupContext:D(s,m),authoredCode:e.code}),p=r===void 0?void 0:B(d,r,C,Object.keys(s)),h=r!==void 0&&w===b.HostError?i.get(r):void 0;L({audit:c,fetchCount:f,outcome:r===void 0?"ok":"error",durationMs:Date.now()-l,failureReason:U(w,h,p?.unknownTool),failedTool:h?.tool,client:t.client,clientVersion:t.clientVersion});const _=p===void 0?{result:u}:{error:p.message};return v({content:[{type:"text",text:JSON.stringify(_)}],structuredContent:_,isError:r!==void 0,...h?.tool!==void 0?{errorClass:"tool_error"}:{}},a)};function U(e,t,n){return e===b.HostError?t?.reason??"runtime_error":e===b.RuntimeError?n===void 0?e:"unknown_tool":e}async function X(e,t,n){const i=Object.keys(await M()).filter(o=>!x.has(o)),s=await Promise.all(i.map(o=>A({toolName:o,context:e}).catch(()=>!1))),a={};return i.forEach((o,f)=>{if(!s[f])return;const m=H(o),c=e.sandboxToolSchemas?.[o],l=c?j(m,c):void 0;a[m]=d=>{const u=l?.(d);return u?(n.set(u,{tool:o,reason:"inner_tool_error"}),Promise.reject(new Error(u))):R(o,d,e,t).catch(r=>{throw n.set(T(r),{tool:o,reason:r instanceof P?"inner_tool_error":"server_error"}),r})}}),a}function T(e){return e instanceof Error?e.message:String(e)}var ce={[F]:V};export{ce as default};

package/dist/server/plugins/mcp/codemode/tools/manage-credentials.js

@@ -1,2 +1,2 @@
-import{MANAGE_API_CREDENTIALS_TOOL_NAME as P}from"../../constants.js";import{buildUpstreamCredentialFallback as b,buildUpstreamCredentialInputRequired as I,dedupeElicitation as S,isCredentialElicitationDeclined as k,isStatelessRequest as E,schemeLabelOf as w,supportsUrlElicitation as C}from"../../gateway-mcp/elicitation.js";import{getCallableApis as u,isFetchCapable as j}from"../../gateway-mcp/callable-apis.js";import{secretStore as T}from"../../gateway-mcp/secret-store.js";import{MISSING_SESSION_HANDLE_MESSAGE as q,resolveSecretSubject as $}from"../../gateway-mcp/subject.js";import{upstreamAuthKey as R}from"../../gateway-mcp/upstream-auth.js";import{resolveUpstreamApiAuth as L}from"../../gateway-mcp/upstream-auth-scheme.js";import{apiTitleKey as N,countApiTitles as O}from"../../docs-mcp/utils/api-titles.js";function W(e){return!!e.elicitationEnabled&&j(e)}function z(e){const s=u(e),t=s.map(r=>r.relativePath),a=[...t,...U(s)];return{name:P,title:"Manage API credentials",description:["Get a secure link where the user sets, replaces, or removes the credentials this server sends to a documented API.","Call it when the user wants to change or clear an API key, or when a tool result tells you the stored credentials were rejected.","The link covers every credential the API accepts, so scheme is optional - pass it only when a tool result names the scheme that was rejected.","It returns a link for the user to open - never ask for the secret in the conversation and never pass it as an argument."].join(`
-`),annotations:{readOnlyHint:!1,openWorldHint:!1},schema:{type:"object",required:["api"],additionalProperties:!1,properties:{api:{type:"string",description:`The API to manage credentials for: its \`filePath\` or the \`name\` from \`listApis\`.${t.length>0?` The file paths are: ${t.join(", ")}.`:""}`,minLength:1,...a.length>0?{enum:a}:{}},scheme:{type:"string",description:"Name of the security scheme to manage the credential for, as named in the API description (a tool result that reports a rejected credential names it). Omit it to let the link cover every scheme the API accepts.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required while the caller is anonymous, so the credentials are stored against the same subject the API calls use.",minLength:1}}}}}function U(e){const s=O(e);return e.map(t=>t.name).filter(t=>s.get(N(t))===1)}function J(e,s){return async(t,a)=>{const r=$(e.user,typeof t.sessionHandle=="string"?t.sessionHandle:void 0);if(r.kind==="invalid")return h(r.message);if(r.kind==="anonymous")return h(q);const{subject:m}=r,p=typeof t.api=="string"?t.api:"",n=u(e).find(c=>c.relativePath===p||c.name===p);if(!n){const c=u(e).map(v=>v.relativePath).join(", ");return h(`Unknown api "${p}". Credentials can only be managed for the APIs this server can call: ${c||"none"}.`)}if(k(a.mcpReq.inputResponses))return{content:[{type:"text",text:`The user declined the credentials prompt for the "${n.name}" API, so this call minted no link.`}],isError:!1};const i=await L(e,n.relativePath),l=typeof t.scheme=="string"?t.scheme:void 0,y=Object.keys(i.schemes);if(l&&!i.schemes[l])return h(`Unknown scheme "${l}" for api "${n.relativePath}". The security schemes this server can store credentials for are: ${y.join(", ")}.`);const o=l??i.defaultScheme,d=w(i.schemes,o),f=await s.getKv(),A={subject:m,baseUrl:e.baseUrl??"",target:{api:n.relativePath,name:n.name,scheme:o,...d?{schemeLabel:d}:{}},auth:i.schemes[o],apiAuth:i,kv:f,hasExistingSecret:await T.hasSecret(f,m,n.relativePath,o),reason:{kind:"requested"}};if(E(a.mcpReq)&&C(s.getClientCapabilities()))return await I(A);const g=R({api:n.relativePath,scheme:o});return{content:[{type:"text",text:await S(`${m}:${g}`,()=>b(A))}],isError:!1}}}function h(e){return{content:[{type:"text",text:e}],isError:!0}}export{W as isManageApiCredentialsToolAvailable,J as manageApiCredentials,z as manageApiCredentialsSchema};
+import{MANAGE_API_CREDENTIALS_TOOL_NAME as P}from"../../constants.js";import{buildUpstreamCredentialFallback as b,buildUpstreamCredentialInputRequired as I,dedupeElicitation as S,isCredentialElicitationDeclined as k,isStatelessRequest as E,schemeLabelOf as w,supportsUrlElicitation as C}from"../../gateway-mcp/elicitation.js";import{getCallableApis as u,isFetchCapable as j}from"../../gateway-mcp/callable-apis.js";import{secretStore as T}from"../../gateway-mcp/secret-store.js";import{MISSING_SESSION_HANDLE_MESSAGE as q,resolveSecretSubject as $}from"../../gateway-mcp/subject.js";import{upstreamAuthKey as H}from"../../gateway-mcp/upstream-auth.js";import{resolveUpstreamApiAuth as R}from"../../gateway-mcp/upstream-auth-scheme.js";import{apiTitleKey as L,countApiTitles as N}from"../../docs-mcp/utils/api-titles.js";function W(e){return!!e.elicitationEnabled&&j(e)}function z(e){const s=u(e),t=s.map(i=>i.relativePath),a=[...t,...O(s)];return{name:P,title:"Manage API credentials",description:["Get a secure link where the user sets, replaces, or removes the credentials this server sends to a documented API.","Call it when the user wants to change or clear an API key, or when a tool result tells you the stored credentials were rejected.","The link covers every credential the API accepts, so scheme is optional - pass it only when a tool result names the scheme that was rejected.","It returns a link for the user to open - never ask for the secret in the conversation and never pass it as an argument."].join(`
+`),annotations:{readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},schema:{type:"object",required:["api"],additionalProperties:!1,properties:{api:{type:"string",description:`The API to manage credentials for: its \`filePath\` or the \`name\` from \`listApis\`.${t.length>0?` The file paths are: ${t.join(", ")}.`:""}`,minLength:1,...a.length>0?{enum:a}:{}},scheme:{type:"string",description:"Name of the security scheme to manage the credential for, as named in the API description (a tool result that reports a rejected credential names it). Omit it to let the link cover every scheme the API accepts.",minLength:1},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required while the caller is anonymous, so the credentials are stored against the same subject the API calls use.",minLength:1}}}}}function O(e){const s=N(e);return e.map(t=>t.name).filter(t=>s.get(L(t))===1)}function J(e,s){return async(t,a)=>{const i=$(e.user,typeof t.sessionHandle=="string"?t.sessionHandle:void 0);if(i.kind==="invalid")return h(i.message);if(i.kind==="anonymous")return h(q);const{subject:m}=i,p=typeof t.api=="string"?t.api:"",n=u(e).find(c=>c.relativePath===p||c.name===p);if(!n){const c=u(e).map(g=>g.relativePath).join(", ");return h(`Unknown api "${p}". Credentials can only be managed for the APIs this server can call: ${c||"none"}.`)}if(k(a.mcpReq.inputResponses))return{content:[{type:"text",text:`The user declined the credentials prompt for the "${n.name}" API, so this call minted no link.`}],isError:!1};const r=await R(e,n.relativePath),l=typeof t.scheme=="string"?t.scheme:void 0,y=Object.keys(r.schemes);if(l&&!r.schemes[l])return h(`Unknown scheme "${l}" for api "${n.relativePath}". The security schemes this server can store credentials for are: ${y.join(", ")}.`);const o=l??r.defaultScheme,d=w(r.schemes,o),f=await s.getKv(),A={subject:m,baseUrl:e.baseUrl??"",target:{api:n.relativePath,name:n.name,scheme:o,...d?{schemeLabel:d}:{}},auth:r.schemes[o],apiAuth:r,kv:f,hasExistingSecret:await T.hasSecret(f,m,n.relativePath,o),reason:{kind:"requested"}};if(E(a.mcpReq)&&C(s.getClientCapabilities()))return await I(A);const v=H({api:n.relativePath,scheme:o});return{content:[{type:"text",text:await S(`${m}:${v}`,()=>b(A))}],isError:!1}}}function h(e){return{content:[{type:"text",text:e}],isError:!0}}export{W as isManageApiCredentialsToolAvailable,J as manageApiCredentials,z as manageApiCredentialsSchema};