@redocly/redoc-reef 0.138.0-next.14 → 0.138.0-next.16

package/dist/server/utils/redirects/build-wildcard-redirects-tree.d.ts

@@ -0,0 +1,21 @@
+import type { RedirectsConfig } from '@redocly/config';
+import type { WildcardRedirectsTree } from '../../types';
+/**
+ * Builds a tree structure from the redirects configuration for easy wildcard redirect lookup.
+ * Does not include direct redirects, only wildcard redirects.
+ *
+ * @param redirects - The redirects configuration object.
+ * @returns The tree structure representing the wildcard redirects.
+ *
+ * @example
+ * // Building a tree from wildcard redirects
+ * buildWildcardRedirectsTree({ '/docs/*': { to: '/documentation/*' } });
+ * // Returns: { docs: { '*': '/docs/*' } }
+ *
+ * @example
+ * // Building a tree from wildcard redirects with multiple levels
+ * buildWildcardRedirectsTree({ '/docs/*': { to: '/documentation/*' }, '/blog/*': { to: '/new-blog/*' } });
+ * // Returns: { docs: { '*': '/docs/*' }, blog: { '*': '/blog/*' } }
+ */
+export declare function buildWildcardRedirectsTree(redirects: RedirectsConfig): WildcardRedirectsTree;
+//# sourceMappingURL=build-wildcard-redirects-tree.d.ts.map

package/dist/server/utils/redirects/build-wildcard-redirects-tree.js

@@ -0,0 +1 @@
+import{addWildcardRedirectToTree as i}from"./add-wildcard-redirect-to-tree.js";function c(t){const e={};for(const[r,o]of Object.entries(t))!r.endsWith("*")||!o.to||i(e,r);return e}export{c as buildWildcardRedirectsTree};

package/dist/server/utils/redirects/find-redirect.d.ts

@@ -0,0 +1,16 @@
+import type { RedirectConfig, RedirectsConfig } from '@redocly/config';
+import type { WildcardRedirectsTree } from '../../types';
+/**
+ * Looks up a redirect rule for a slug
+ *
+ * **IMPORTANT:** The `slug` parameter must be normalized before passing to this function.
+ *
+ * - For wildcard rules whose target ends with `*`, the remainder of the path is preserved.
+ * - `from` is the matched config key (path or pattern); exposed for `followRedirectChain` rule tracking.
+ *
+ * @returns Redirect config with resolved `to`, plus `from`, or `null` if no rule matches or the rule would not change the slug.
+ */
+export declare function findRedirect(slug: string, redirects: RedirectsConfig, wildcardRedirectsTree: WildcardRedirectsTree): (WithRequired<RedirectConfig, 'to'> & {
+    from: string;
+}) | null;
+//# sourceMappingURL=find-redirect.d.ts.map

package/dist/server/utils/redirects/find-redirect.js

@@ -0,0 +1 @@
+import{normalizeRouteSlug as a}from"../../../utils/path/normalize-route-slug.js";import{removeLeadingSlash as d}from"../../../utils/url/remove-leading-slash.js";function m(t,o,f){const r=o[t];if(r?.to){const i=r.to;return a(i).toLowerCase()===t?null:{to:i,type:r.type,from:t}}const e=u(t,f);if(!e)return null;const c=o[e],l=c?.to;if(!l)return null;let n=l;if(n.endsWith("*")){const i=e.split("*")[0];n=n.replace(/\*$/,t.substring(i.length))}return a(n).toLowerCase()===t?null:{...c,to:n,from:e}}function u(t,o){const f=d(t).split("/");let r=o;for(const e of f){if(!r[e])break;r=r[e]}return r["*"]||null}export{m as findRedirect};

package/dist/server/utils/redirects/follow-redirect-chain.d.ts

@@ -0,0 +1,9 @@
+import type { RedirectsConfig } from '@redocly/config';
+import type { FollowRedirectChainResult, WildcardRedirectsTree } from '../../types';
+/**
+ * Follows the redirect chain from startSlug. Returns when:
+ * - A cycle is detected (revisiting a slug or redirect rule) -> { type: 'cycle', cycle }
+ * - No redirect / external / wildcard -> { type: 'no-cycle' }
+ */
+export declare function followRedirectChain(startSlug: string, initialChain: string[], redirects: RedirectsConfig, wildcardRedirectsTree: WildcardRedirectsTree, resolveWildcards?: boolean): FollowRedirectChainResult;
+//# sourceMappingURL=follow-redirect-chain.d.ts.map

package/dist/server/utils/redirects/follow-redirect-chain.js

@@ -0,0 +1 @@
+import{normalizeRouteSlug as a}from"../../../utils/path/normalize-route-slug.js";import{isLocalLink as p}from"../../../utils/path/is-local-link.js";import{findRedirect as u}from"./find-redirect.js";function x(r,n,c,y,d=!0){const f=new Set(n),i=new Set,e=[...n];function l(o){if(f.has(o)){const m=e.indexOf(o);return{type:"cycle",cycle:m>=0?e.slice(m).concat(o):[]}}f.add(o),e.push(o);const t=d?u(o,c,y):c[o]?.to?{to:c[o].to,from:o}:null;if(!t?.to||!p(t.to))return{type:"no-cycle"};if(t.from){if(i.has(t.from))return{type:"cycle",cycle:[...e,t.from,t.to,t.from]};i.add(t.from)}const s=a(t.to).toLowerCase();return s.endsWith("*")?{type:"no-cycle"}:l(s)}return l(r)}export{x as followRedirectChain};

package/dist/server/utils/redirects/validate-redirects.d.ts

@@ -0,0 +1,8 @@
+import type { Store } from '../../store';
+/**
+ * Validates redirects configuration: detects self-redirects, circular redirects,
+ * and redirects that point to a non-existent page. Reports each issue
+ * via the link checker so they appear in validation output.
+ */
+export declare function validateRedirects(store: Store): void;
+//# sourceMappingURL=validate-redirects.d.ts.map

package/dist/server/utils/redirects/validate-redirects.js

@@ -0,0 +1 @@
+import h from"node:path";import{existsSync as R,lstatSync as y,readdirSync as N}from"node:fs";import{CONFIG_FILE_NAME as w}from"../../../constants/common.js";import{PUBLIC_STATIC_FOLDER as F}from"../../constants/common.js";import{normalizeRouteSlug as s}from"../../../utils/path/normalize-route-slug.js";import{isLocalLink as C}from"../../../utils/path/is-local-link.js";import{reporter as T}from"../../tools/notifiers/reporter.js";import{followRedirectChain as k}from"./follow-redirect-chain.js";function D(e){const i=e.getConfig().redirects;if(!i)return;const o=e.getGlobalConfig("wildcardRedirectsTree")??{},c=e.getGlobalConfig("originalRedirectSources");for(const[r,l]of Object.entries(i)){const t=l?.to;if(!t||c&&!c.includes(r))continue;const d=r.toLowerCase(),L=t.toLowerCase(),m=r.endsWith("*"),f=t.endsWith("*");if(f)continue;const u=a=>{T.reportBrokenLink({type:"BROKEN_LINK",brokenLinkType:"LINK",sourceFileRelativePath:w,sourceFileLocation:{line:0},title:r,link:t,rawLink:t,message:a})};if(z(r,t,m,f)){u(`Redirect from "${r}" points to the same page. This causes an infinite redirect loop.`);continue}if(m&&!f&&C(t)){const a=s(r.split("*")[0]).toLowerCase(),p=s(L);if(a===p){u(`Circular redirect: "${r}" points to the same base path "${t}", causing an infinite redirect loop.`);continue}}if(!m&&!f&&C(t)){const a=s(d),p=s(L),g=k(p,[a],i,o,!1);if(g.type==="cycle"&&g.cycle.length>0){u(`Circular redirect: ${g.cycle.join(" \u2192 ")}.`);continue}}C(t)&&I(t,e)&&u(`Redirect target "${t}" does not exist. Check that the page or route exists.`)}}function z(e,n,i,o){if(!i&&!o){const c=s(e).toLowerCase(),r=s(n).toLowerCase();return c===r}return!1}function I(e,n){const i=s(e);return n.hasRouteOrRedirectBySlug(i)?!1:!v(e,n)}function v(e,n){const o=decodeURI(e.split("?")[0].split("#")[0]).replace(/^\/+/,"");if(!o)return!1;const c=n.contentDir;return c?S(c,o)||S(h.join(c,F),o):!1}function S(e,n){const i=x(e,n);return i?P(i):!1}function x(e,n){const i=n.split("/").filter(Boolean);let o=e;for(const c of i){const r=h.join(o,c);if(R(r)){o=r;continue}let l;try{l=N(o)}catch{return null}const t=l.find(d=>d.toLowerCase()===c.toLowerCase());if(!t)return null;o=h.join(o,t)}return o}function P(e){if(!R(e))return!1;try{return y(e).isFile()}catch{return!1}}export{D as validateRedirects};

package/dist/server/utils/report-all-errors.d.ts

@@ -0,0 +1,3 @@
+import type { LifecycleContext } from '../types';
+export declare function reportAllErrors(context: LifecycleContext): Promise<void>;
+//# sourceMappingURL=report-all-errors.d.ts.map

package/dist/server/utils/report-all-errors.js

@@ -0,0 +1 @@
+import{envConfig as p}from"../config/env-config.js";import{logger as l}from"../tools/notifiers/logger.js";import{reporter as r}from"../tools/notifiers/reporter.js";import{isMarkdocError as d}from"../plugins/markdown/errors.js";import{telemetryTraceStep as g}from"../../cli/telemetry/helpers/trace-step.js";import{writeProblemsReport as u}from"./write-problems-report.js";async function M(e){await g("com.redocly.build.validationErrors",async o=>{let t=0;for(const[c,f]of e.cache.errors.entries()){const m=c.split(":")[1];for(const i of f)d(i)?(r.reportMarkdocProblem(i),i.type!=="BROKEN_LINK"&&t++):await r.panicOnBuild(i.message,m)}const a=await e.getConfig();if(!p.isBuildMode)return;const n=r.getPageRenderProblems().length;o?.setAttribute("markdocErrors",t.toString()),o?.setAttribute("pageRenderErrors",n.toString()),t>0&&!a?.reunite?.ignoreMarkdocErrors?await s(`Need to fix ${t} Markdoc issue(s) or set the \`ignoreMarkdocErrors\` option to \`true\` in the \`reunite\` section of your \`redocly.yaml\``):n>0&&await s(`Need to fix ${n} runtime error(s) in React pages`)})}async function s(e){r.printErrors();try{u()}catch(o){l.warn("Failed to write the problems report: "+o.message)}await r.panic(e)}export{M as reportAllErrors};

package/dist/server/utils/resolve-asset-path.d.ts

@@ -0,0 +1,7 @@
+import type { ContentFs } from '../fs/content-fs';
+export declare function resolveAssetPath(assetRelativePath: string, fs: ContentFs, options: {
+    fromFileRelativePath: string;
+    contentDir: string;
+    outdir: string;
+}): Promise<string | undefined>;
+//# sourceMappingURL=resolve-asset-path.d.ts.map

package/dist/server/utils/resolve-asset-path.js

@@ -0,0 +1 @@
+import t from"node:path";import{withPathPrefix as f}from"@redocly/theme/core/utils";import{PUBLIC_STATIC_FOLDER as e}from"../constants/common.js";import{isLocalLink as p}from"../../utils/path/is-local-link.js";import{copyStaticFile as u,FileNotFoundError as x}from"./fs.js";async function h(r,o,i){if(!p(r))return r;const n=r.startsWith("/")?t.posix.join(e,r):void 0;if(n&&await o.exists(n))return f(r);const c=r.startsWith("/")?r.slice(1):t.posix.join(t.dirname(i.fromFileRelativePath),r),m=await o.exists(c)?await o.getFileInfo(c):null;if(!m)throw new x(`Cannot resolve asset path: ${r}`,r);return u(i.contentDir,m.realRelativePath,i.outdir)}export{h as resolveAssetPath};

package/dist/server/utils/resolve-src-set.d.ts

@@ -0,0 +1,7 @@
+import type { ContentFs } from '../fs/content-fs.js';
+export declare function resolveSrcSet(srcSet: string, fs: ContentFs, options: {
+    fromFileRelativePath: string;
+    contentDir: string;
+    outdir: string;
+}): Promise<string | undefined>;
+//# sourceMappingURL=resolve-src-set.d.ts.map

package/dist/server/utils/resolve-src-set.js

@@ -0,0 +1 @@
+import{parseSrcSet as i}from"./attribute-parser.js";import{resolveAssetPath as c}from"./resolve-asset-path.js";async function u(t,r,o){if(!t)return;const n=i(t),e=[];for(const[s,a]of n.entries()){const p=await c(a,r,o);e.push(`${p} ${s}`)}return e.join(", ")}export{u as resolveSrcSet};

package/dist/server/utils/safe-parse.d.ts

@@ -0,0 +1,6 @@
+export declare function safeParse(value: string): {
+    value: unknown;
+} | {
+    error: Error;
+};
+//# sourceMappingURL=safe-parse.d.ts.map

package/dist/server/utils/safe-parse.js

@@ -0,0 +1 @@
+function t(r){try{return{value:JSON.parse(r)}}catch(e){return{error:e}}}export{t as safeParse};

package/dist/server/utils/sandbox-context.d.ts

@@ -0,0 +1,21 @@
+type Registration = {
+    serverOutDir: string;
+    readRoots?: string[];
+};
+export declare const REGISTRATION_KEY: unique symbol;
+export declare class SandboxContext {
+    #private;
+    readonly serverOutDir: string;
+    static register(registration: Registration): void;
+    static resolve(fallbackServerOutDir: string): SandboxContext;
+    private constructor();
+    get tmpDir(): string;
+    get execArgv(): string[];
+    get env(): {
+        TMPDIR: string;
+        TMP: string;
+        TEMP: string;
+    };
+}
+export {};
+//# sourceMappingURL=sandbox-context.d.ts.map

package/dist/server/utils/sandbox-context.js

@@ -0,0 +1 @@
+import{existsSync as a}from"node:fs";import{dirname as l,join as m}from"node:path";const c=Symbol.for("redocly.realm.sandboxContext"),d=globalThis;class s{serverOutDir;static register(t){d[c]=t}static resolve(t){const e=d[c];return e?new s(e.serverOutDir,e.readRoots):new s(t)}#t;constructor(t,e=[]){this.serverOutDir=t,this.#t=s.#o(t,e)}get tmpDir(){return`${this.serverOutDir}/.data/tmp`}get execArgv(){return["--permission",...this.#t.map(t=>`--allow-fs-read=${t}/*`),`--allow-fs-write=${this.serverOutDir}/.data/*`,"--allow-addons"]}get env(){return{TMPDIR:this.tmpDir,TMP:this.tmpDir,TEMP:this.tmpDir}}static#e(t){if(!t)return t;const r=t.indexOf("/node_modules/");return r!==-1?t.slice(0,r):s.#r(t)??s.#s(t)??t}static#r(t){let e=t;for(;;){if(a(m(e,"node_modules",".pnpm")))return e;const r=l(e);if(r===e)return;e=r}}static#s(t){let e=t;for(;;){if(a(m(e,"node_modules")))return e;const r=l(e);if(r===e)return;e=r}}static#o(t,e){const r=[s.#e(t),...e].filter(Boolean).map(o=>o.replace(/(?<!\/)\/+$/,"")).filter(Boolean),i=[...new Set(r)];return i.filter(o=>!i.some(n=>n!==o&&o.startsWith(`${n}/`)))}}export{c as REGISTRATION_KEY,s as SandboxContext};

package/dist/server/utils/sanitize-windows-filename.d.ts

@@ -0,0 +1,2 @@
+export declare const sanitizeWindowsFilename: (filename: string) => string;
+//# sourceMappingURL=sanitize-windows-filename.d.ts.map

package/dist/server/utils/sanitize-windows-filename.js

@@ -0,0 +1 @@
+const a=t=>{if(!t)return"_empty_";let e=t;const r=[{pattern:/</g,replacement:"_lt_"},{pattern:/>/g,replacement:"_gt_"},{pattern:/:/g,replacement:"-"},{pattern:/"/g,replacement:"_qt_"},{pattern:/\//g,replacement:"-"},{pattern:/\\/g,replacement:"-"},{pattern:/\|/g,replacement:"-"},{pattern:/\?/g,replacement:"_q_"},{pattern:/\*/g,replacement:"_ast_"}];for(const n of r)e=e.replace(n.pattern,n.replacement);return e};export{a as sanitizeWindowsFilename};

package/dist/server/utils/search/highlight-text-for-search.d.ts

@@ -0,0 +1,3 @@
+export declare function highlightTextForSearch(query: string, text: string): string;
+export declare function markMatchedValue(query: string, value: string): string | undefined;
+//# sourceMappingURL=highlight-text-for-search.d.ts.map

package/dist/server/utils/search/highlight-text-for-search.js

@@ -0,0 +1 @@
+import{HIGHLIGHTED_TEXT_MAX_LENGTH as f}from"../../constants/plugins/search.js";import{MIN_INFIX_MATCH_LENGTH as h,MIN_QUERY_WORD_LENGTH as g,isWordChar as c,matchableQueryWords as m}from"./text-match.js";function w(t,e){if(!e)return"";const r=p(t);if(!r.length)return e;const n=f+t.length;if(e.length<=n)return u(r,e);const o=M(l(r,e),n)??{start:0,end:0},{start:s,end:d}=_(e,o,n),a=u(r,e.slice(s,d));return`${s>0?"...":""}${a}${d<e.length?"...":""}`}function I(t,e){if(!e)return;const r=w(t,e);return r.includes("<mark>")?r:void 0}function p(t){return m(t).sort((e,r)=>r.length-e.length)}function l(t,e){const r=e.toLowerCase(),n=[];for(const o of t)for(let s=r.indexOf(o);s!==-1;s=r.indexOf(o,s+1)){const d=!c(r[s-1]);if(!d&&o.length<h||o.length<g&&c(r[s+o.length]))continue;let a=s+o.length;if(d)for(;c(r[a]);)a++;n.push({start:s,end:a,word:o})}return n.sort((o,s)=>o.start-s.start||o.end-s.end)}function M(t,e){let r;for(let n=0;n<t.length;n++){const o=new Set;let s=t[n].end;for(let a=n;a<t.length&&t[a].end-t[n].start<=e;a++)o.has(t[a].word)||(o.add(t[a].word),s=t[a].end);const d=s-t[n].start;(!r||o.size>r.count||o.size===r.count&&d<r.end-r.start)&&(r={start:t[n].start,end:s,count:o.size})}return r&&{start:r.start,end:r.end}}function _(t,e,r){const n=Math.max(r,e.end-e.start),o=n-(e.end-e.start),s=Math.min(t.length,Math.max(0,Math.floor(e.start-o/2))+n),d=Math.max(0,s-n);return{start:H(t,d,e.start),end:T(t,s,e.end)}}function H(t,e,r){let n=e;if(n>0&&!i(t[n-1]))for(;n<r&&!i(t[n]);)n++;for(;n<r&&i(t[n]);)n++;return n}function T(t,e,r){let n=e;if(n<t.length&&!i(t[n]))for(;n>r&&!i(t[n]);)n--;for(;n>r&&i(t[n-1]);)n--;return n}function i(t){return t!==void 0&&/\s/.test(t)}function u(t,e){const r=l(t,e);if(!r.length)return e;const n=[];for(const d of r){const a=n[n.length-1];a&&(d.start<=a.end||!e.slice(a.end,d.start).trim())?a.end=Math.max(a.end,d.end):n.push({start:d.start,end:d.end})}let o="",s=0;for(const d of n)o+=`${e.slice(s,d.start)}<mark>${e.slice(d.start,d.end)}</mark>`,s=d.end;return o+e.slice(s)}export{w as highlightTextForSearch,I as markMatchedValue};

package/dist/server/utils/search/text-match.d.ts

@@ -0,0 +1,6 @@
+export declare const MIN_QUERY_WORD_LENGTH = 2;
+export declare const MIN_INFIX_MATCH_LENGTH = 3;
+export declare function isWordChar(char: string | undefined): boolean;
+export declare function matchableQueryWords(query: string): string[];
+export declare function containsQueryWord(lowered: string, word: string): boolean;
+//# sourceMappingURL=text-match.d.ts.map

package/dist/server/utils/search/text-match.js

@@ -0,0 +1 @@
+const i=2,o=3,r=/[\p{L}\p{N}_-]/u;function _(t){return t!==void 0&&r.test(t)}function s(t){const n=[...new Set(t.toLowerCase().split(/\s+/g).filter(Boolean))];return n.some(e=>e.length>=2)?n:[]}function u(t,n){if(n.length>=3)return t.includes(n);for(let e=t.indexOf(n);e!==-1;e=t.indexOf(n,e+1))if(!_(t[e-1])&&(n.length>=2||!_(t[e+n.length])))return!0;return!1}export{o as MIN_INFIX_MATCH_LENGTH,i as MIN_QUERY_WORD_LENGTH,u as containsQueryWord,_ as isWordChar,s as matchableQueryWords};

package/dist/server/utils/set-execution-mode.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Must run before any module that reads envConfig.
+ */
+declare const command: string;
+//# sourceMappingURL=set-execution-mode.d.ts.map

package/dist/server/utils/set-execution-mode.js

@@ -0,0 +1 @@
+const e=process.argv[2];e==="prepare"||e==="build"?process.env.REDOCLY_EXECUTION_MODE="build":e==="develop"&&(process.env.REDOCLY_EXECUTION_MODE="develop");

package/dist/server/utils/shared-data.d.ts

@@ -0,0 +1,3 @@
+export declare const writeSharedData: (sharedDataId: string, sharedDataStr: string, outDir: string) => Promise<void>;
+export declare const readSharedData: (sharedDataId: string, outDir: string) => Promise<unknown | undefined>;
+//# sourceMappingURL=shared-data.d.ts.map

package/dist/server/utils/shared-data.js

@@ -0,0 +1 @@
+import s from"path";import{readFile as l,writeFileSync as p}from"fs";import{stat as u}from"fs/promises";import{LRUCache as w}from"lru-cache";import{getSharedDataUrl as z}from"../../utils/url/get-shared-data-url.js";import{logger as D}from"../tools/notifiers/logger.js";import{ensureDir as S}from"./fs.js";const o={},h=new w({max:64,maxSize:192*1024*1024,sizeCalculation:a=>Math.max(a.size,1)}),R=async(a,n,e)=>{const i=c(a,e);await o[i],h.delete(i),p(S(i),n,{encoding:"utf-8",flush:!0})},C=async(a,n)=>{try{const e=c(a,n),i=o[e];if(i)return i;const t=await u(e).catch(()=>{});if(t){const r=h.get(e);if(r&&r.mtimeMs===t.mtimeMs&&r.size===t.size)return r.data}const d=new Promise(r=>l(e,"utf-8",(m,f)=>{r(m?void 0:JSON.parse(f))}));return o[e]=d,d.finally(()=>{delete o[e]}).then(r=>(t&&r!==void 0&&h.set(e,{mtimeMs:t.mtimeMs,size:t.size,data:r},{size:Math.max(t.size,1)}),r))}catch(e){D.warnProd(`Failed to read shared data ${a} with error: ${e instanceof Error?e.message:"Unknown error"}`);return}},c=(a,n)=>{const e=s.join(n,z(a)),i=s.resolve(n,"page-data/shared"),t=s.resolve(n,e);if(s.relative(i,t).startsWith(".."))throw new Error(`Invalid shared data id: ${a}`);return t};export{C as readSharedData,R as writeSharedData};

package/dist/server/utils/skills/can-access-skill.d.ts

@@ -0,0 +1,9 @@
+import type { RbacConfig } from '@redocly/config';
+import type { Skill } from '../../types/plugins/skills.js';
+export type SkillAccessUser = {
+    isAuthenticated?: boolean;
+    email?: string;
+    teams?: string[];
+};
+export declare function canAccessSkill(skill: Skill, user?: SkillAccessUser, rbacConfig?: RbacConfig, requiresLogin?: boolean): boolean;
+//# sourceMappingURL=can-access-skill.d.ts.map

package/dist/server/utils/skills/can-access-skill.js

@@ -0,0 +1 @@
+import{REDOCLY_ROUTE_RBAC as s,REDOCLY_TEAMS_RBAC as t}from"@redocly/config";import{canAccessResource as a}from"../../utils/rbac.js";function n(c,r={},e={},o=!1){return a({[t]:c.rbac,[s]:{fsPath:c.fsPath}},r,e,o)}export{n as canAccessSkill};

package/dist/server/utils/skills/get-accessible-skills.d.ts

@@ -0,0 +1,5 @@
+import type { RbacConfig } from '@redocly/config';
+import type { Skill } from '../../types/plugins/skills.js';
+import { type SkillAccessUser } from './can-access-skill.js';
+export declare function getAccessibleSkills(skills: Skill[], user?: SkillAccessUser, rbacConfig?: RbacConfig, requiresLogin?: boolean): Skill[];
+//# sourceMappingURL=get-accessible-skills.d.ts.map

package/dist/server/utils/skills/get-accessible-skills.js

@@ -0,0 +1 @@
+import{canAccessSkill as s}from"./can-access-skill.js";function f(e,l={},c={},i=!1){return e.filter(r=>s(r,l,c,i))}export{f as getAccessibleSkills};

package/dist/server/utils/skills/get-skill-url.d.ts

@@ -0,0 +1,2 @@
+export declare function getSkillUrl(baseUrl: string, skillSlug: string): string;
+//# sourceMappingURL=get-skill-url.d.ts.map

package/dist/server/utils/skills/get-skill-url.js

@@ -0,0 +1 @@
+import{combineUrls as t,withPathPrefix as e}from"@redocly/theme/core/utils";import{AGENT_SKILLS_BASE as i,USER_SKILL_FILENAME as n}from"../../../constants/common.js";function E(o,r){return t(o,e(`${i}/${encodeURIComponent(r)}/${n}`))}export{E as getSkillUrl};

package/dist/server/utils/static-data.d.ts

@@ -0,0 +1,4 @@
+import type { PageStaticData } from '@redocly/config';
+export declare const writeStaticData: (routeSlug: string, data: PageStaticData, outDir: string) => void;
+export declare const readStaticData: (routeSlug: string, outDir: string) => Promise<PageStaticData>;
+//# sourceMappingURL=static-data.d.ts.map

package/dist/server/utils/static-data.js

@@ -0,0 +1 @@
+import o from"path";import{stat as n,readFile as s}from"fs/promises";import{writeFileSync as c}from"fs";import{removeTrailingSlash as m}from"../../utils/url/remove-trailing-slash.js";import{STATIC_DATA_FOLDER as f}from"../constants/common.js";import{ensureDir as p}from"./fs.js";import{sanitizeWindowsFilename as u}from"./sanitize-windows-filename.js";const F=(t,a,r)=>{const i=e(t,r);c(p(i),JSON.stringify(a),"utf-8")},T=async(t,a)=>{const r=e(t,a);return await l(r)?s(r,"utf-8").then(i=>JSON.parse(i)):{}},e=(t,a)=>{const r=m(t.slice(1)),i=process.platform==="win32"?u(r):r;return o.join(a,f,`${i}.json`)};async function l(t){try{return await n(t),!0}catch{return!1}}export{T as readStaticData,F as writeStaticData};

package/dist/server/utils/system-routes.d.ts

@@ -0,0 +1,2 @@
+export declare function isSystemRouteSlug(slug: string): boolean;
+//# sourceMappingURL=system-routes.d.ts.map

package/dist/server/utils/system-routes.js

@@ -0,0 +1 @@
+import{DEV_LOGIN_SLUG as S,INVITE_SLUG as o}from"../../constants/common.js";const e=[S,o];function r(t){return e.includes(t)}export{r as isSystemRouteSlug};

package/dist/server/utils/time/with-timestamp.d.ts

@@ -0,0 +1,57 @@
+type TimestampField = 'createdAt' | 'updatedAt' | 'archivedAt';
+type TimestampFieldsOptions = {
+    fields?: TimestampField[];
+    dates?: {
+        createdAt?: Date;
+        updatedAt?: Date;
+        archivedAt?: Date;
+    };
+};
+type TimestampFieldsMap = {
+    createdAt: string;
+    updatedAt: string;
+    archivedAt: string;
+};
+type WithTimestampResult<T, F extends TimestampField[]> = T & Pick<TimestampFieldsMap, F[number]>;
+/**
+ * Adds timestamp fields (createdAt, updatedAt, and/or archivedAt) to an object.
+ *
+ * @param data - The object to add timestamps to
+ * @param options - Optional configuration object
+ * @param options.fields - Array of timestamp fields to include. Defaults to ['createdAt', 'updatedAt']
+ * @param options.dates - Optional custom dates for specific timestamp fields
+ * @returns A new object containing all properties from the input data plus the specified timestamp fields in ISO format
+ *
+ * @example
+ * ```ts
+ * // Add current timestamps (default: createdAt and updatedAt)
+ * const result = withTimestamp({ id: 1, name: 'Test' });
+ * // Returns { id: 1, name: 'Test', updatedAt: '2025-10-21T10:00:00.000Z', createdAt: '2025-10-21T10:00:00.000Z' }
+ *
+ * // Only add updatedAt when updating data
+ * const result = withTimestamp({ id: 1, name: 'Updated' }, { fields: ['updatedAt'] });
+ * // Returns { id: 1, name: 'Updated', updatedAt: '2025-10-21T10:00:00.000Z' }
+ *
+ * // Only add archivedAt when archiving data
+ * const result = withTimestamp({ id: 1 }, { fields: ['archivedAt'] });
+ * // Returns { id: 1, archivedAt: '2025-10-21T10:00:00.000Z' }
+ *
+ * // Use custom dates
+ * const customDate = new Date('2025-01-01');
+ * const result = withTimestamp({ id: 1 }, {
+ *   fields: ['createdAt', 'updatedAt'],
+ *   dates: { createdAt: customDate, updatedAt: customDate }
+ * });
+ * // Returns { id: 1, updatedAt: '2025-01-01T00:00:00.000Z', createdAt: '2025-01-01T00:00:00.000Z' }
+ *
+ * // Add all three timestamps
+ * const result = withTimestamp({ id: 1 }, { fields: ['createdAt', 'updatedAt', 'archivedAt'] });
+ * // Returns { id: 1, createdAt: '...', updatedAt: '...', archivedAt: '...' }
+ * ```
+ */
+export declare function withTimestamp<T extends Record<string, unknown>>(data: T, options?: TimestampFieldsOptions): WithTimestampResult<T, ['createdAt', 'updatedAt']>;
+export declare function withTimestamp<T extends Record<string, unknown>, F extends TimestampField[]>(data: T, options: {
+    fields: F;
+} & TimestampFieldsOptions): WithTimestampResult<T, F>;
+export {};
+//# sourceMappingURL=with-timestamp.d.ts.map

package/dist/server/utils/time/with-timestamp.js

@@ -0,0 +1 @@
+function s(i,n){const d=new Date,a=n?.fields??["createdAt","updatedAt"],c=n?.dates??{},e={...i};if(a.includes("createdAt")){const t=c.createdAt??d;e.createdAt=t.toISOString()}if(a.includes("updatedAt")){const t=c.updatedAt??d;e.updatedAt=t.toISOString()}if(a.includes("archivedAt")){const t=c.archivedAt??d;e.archivedAt=t.toISOString()}return e}export{s as withTimestamp};

package/dist/server/utils/validate-and-sanitize-string.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Options for validating a string parameter
+ */
+type IsValidSanitizedStringOptions = {
+    /**
+     * Regular expression pattern that the string must match
+     */
+    pattern: RegExp;
+    /**
+     * Maximum allowed length (default: 1000)
+     */
+    maxLength?: number;
+    /**
+     * Whether empty strings are allowed (default: false)
+     */
+    allowEmpty?: boolean;
+};
+/**
+ * Validates if a string parameter is valid according to the provided options.
+ * Can be undefined/null or a string.
+ * If it's a string, it must match the provided pattern and length constraints.
+ *
+ * @param value - The string parameter from query string (can be undefined, null, or string)
+ * @param options - Validation options including pattern, maxLength, etc.
+ * @returns true if the value is valid (or undefined/null), false otherwise
+ */
+export declare function isValidSanitizedString(value: string | undefined | null, options: IsValidSanitizedStringOptions): boolean;
+export {};
+//# sourceMappingURL=validate-and-sanitize-string.d.ts.map

package/dist/server/utils/validate-and-sanitize-string.js

@@ -0,0 +1 @@
+function i(t,e){if(t==null)return!0;if(typeof t!="string")return!1;const r=t.trim();if(r==="")return e.allowEmpty??!1;const n=e.maxLength??1e3;return!(r.length>n||!e.pattern.test(r))}export{i as isValidSanitizedString};

package/dist/server/utils/validate-installed-version.d.ts

@@ -0,0 +1,2 @@
+export declare function validateInstalledVersion(): Promise<void>;
+//# sourceMappingURL=validate-installed-version.d.ts.map

package/dist/server/utils/validate-installed-version.js

@@ -0,0 +1 @@
+import{readFile as r}from"node:fs/promises";import{join as n}from"node:path";import t from"semver";import{reporter as i}from"../tools/notifiers/reporter.js";import{PACKAGE_NAME as s}from"../../config/product-gates.js";import{PORTAL_VERSION as o}from"../version.js";async function k(){let e="";try{const a=await r(n(process.cwd(),"package.json"));e=JSON.parse(a.toString()).dependencies?.[s]||""}catch{return}e&&!t.valid(e)||e&&!t.satisfies(o,e)&&await i.panicOnBuildContentError(`Detected version mismatch: Installed (${o}) doesn't match package.json (${e}). Run 'npm install' to update and commit the package-lock.json.`)}export{k as validateInstalledVersion};

package/dist/server/utils/write-problems-report.d.ts

@@ -0,0 +1,3 @@
+/** Writes every reported problem to `REDOCLY_PROBLEMS_OUTPUT_FILE`; returns false without writing when it is unset. */
+export declare function writeProblemsReport(): boolean;
+//# sourceMappingURL=write-problems-report.d.ts.map

package/dist/server/utils/write-problems-report.js

@@ -0,0 +1 @@
+import{writeFileSync as e}from"node:fs";import{envConfig as t}from"../config/env-config.js";import{reporter as o}from"../tools/notifiers/reporter.js";import{ensureDir as i}from"./fs.js";function u(){const r=t.REDOCLY_PROBLEMS_OUTPUT_FILE;return r?(e(i(r),JSON.stringify(o.getProblems()),"utf-8"),!0):!1}export{u as writeProblemsReport};

package/dist/server/version.d.ts

@@ -0,0 +1,2 @@
+export declare const PORTAL_VERSION: any;
+//# sourceMappingURL=version.d.ts.map

package/dist/server/version.js

@@ -0,0 +1 @@
+import{createRequire as o}from"module";import{envConfig as r}from"./config/env-config.js";const i=r.REDOCLY_INTERNAL_DEV?"local":o(import.meta.url)("../../package.json").version;export{i as PORTAL_VERSION};

package/dist/server/web-server/auth.d.ts

@@ -0,0 +1,178 @@
+import '../node-crypto-polyfill.js';
+import { AuthProviderType } from '@redocly/config';
+import type { AuthProviderConfig, OidcIssuerMetadata, OidcProviderConfig, RbacConfig, Saml2ProviderConfig, SsoConfig } from '@redocly/config';
+import type { UserIDToken } from '../types';
+import { InternalTokenTypes } from './jwt/token-types.js';
+export type AuthProviderLoginParams = OidcLoginParams | Saml2LoginParams;
+export type OidcJwk = {
+    kty?: string;
+    n: string;
+    e: string;
+    crv?: string;
+    x?: string;
+    y?: string;
+    kid: string;
+    alg: string;
+    use: string;
+};
+export type OidcLoginParams = {
+    type: AuthProviderType.OIDC;
+    name: string;
+    idpId: string;
+    authorizationEndpoint?: string;
+    clientId?: string;
+    responseType: 'code';
+    scope: string;
+    extraParams: Record<string, string | undefined>;
+    pkce?: boolean;
+};
+export type Saml2LoginParams = {
+    type: AuthProviderType.SAML2;
+    name: string;
+    idpId: string;
+    issuerId: string;
+    entityId: string;
+    ssoUrl: string;
+    extraParams?: Record<string, string | undefined>;
+};
+export declare function isOidcProviderConfig(providerConfig: AuthProviderConfig | undefined): providerConfig is OidcProviderConfig;
+export declare function isSaml2ProviderConfig(providerConfig: AuthProviderConfig | undefined): providerConfig is Saml2ProviderConfig;
+export declare function getAuthProviderLoginParams(idpId: string, providerConfig: AuthProviderConfig): Promise<AuthProviderLoginParams | undefined>;
+export declare function getOidcLoginParams(idpId: string, providerConfig: OidcProviderConfig): Promise<OidcLoginParams>;
+export declare function getSaml2LoginParams(idpId: string, providerConfig: Saml2ProviderConfig): Saml2LoginParams;
+export type OidcTokenResponse = {
+    access_token?: string;
+    id_token?: string;
+    refresh_token?: string;
+    expires_in?: number;
+    error?: string;
+    error_description?: string;
+};
+export declare function oidcExchangeCodeForToken(tokenUrl: string, code: string, redirectUri: string, idpConfig: OidcProviderConfig, extraParams?: Record<string, string>): Promise<OidcTokenResponse>;
+export declare function oidcRefreshTokenGrant(tokenUrl: string, refreshToken: string, idpConfig: OidcProviderConfig): Promise<OidcTokenResponse>;
+export declare function buildOidcLoginUrl(origin: string, { authorizationEndpoint, clientId, responseType, scope, extraParams, idpId, pkce, }: Partial<OidcLoginParams>, redirectTo: string | null, inviteCode?: string, options?: {
+    redirectUriOverride?: string;
+    sourceOverride?: 'portal' | 'mcp';
+    branchOverride?: string | undefined;
+    uiLocales?: string;
+}): {
+    loginUrl?: string;
+    cookies?: Record<string, {
+        value: string;
+        options: object;
+    }>;
+};
+export declare function buildOidcLogoutUrl(endSessionEndpoint: string, postLogoutUrl: string, idTokenHint: string | undefined, state?: string): string;
+/**
+ * True when the provider sets no `audience`, or the token's `aud` or alternative
+ * audience claim names one of its non-empty values.
+ */
+export declare function idTokenAudienceIsAllowed(tokenPayload: Record<string, unknown>, idpConfig: {
+    audience?: string | string[];
+} | undefined): boolean;
+/** False when an OIDC token fails the `audience` or the Redocly SSO `clientId` check of its IdP. */
+export declare function idTokenIsForThisProject(tokenPayload: Record<string, unknown>, idpConfig: AuthProviderConfig | undefined): boolean;
+export declare function isIdpIssuedToken(token: string | undefined): boolean;
+type McpAuthorizationCodePayload = {
+    client_id: string;
+    redirect_uri: string;
+    id_token: string;
+    idp_id?: string;
+    idp_access_token_enc?: string;
+    idp_refresh_token_enc?: string;
+    code_challenge?: string;
+    code_challenge_method?: string;
+    iat: number;
+    exp: number;
+};
+export declare function createMcpAuthorizationCode(params: {
+    idToken: string;
+    idpId?: string;
+    idpAccessTokenEnc?: string;
+    idpRefreshTokenEnc?: string;
+    clientId: string;
+    redirectUri: string;
+    codeChallenge?: string;
+    codeChallengeMethod?: string;
+    ttlSec?: number;
+}): Promise<string>;
+export declare function verifyMcpAuthorizationCode(code: string): Promise<McpAuthorizationCodePayload>;
+export type McpRefreshTokenPayload = {
+    type: typeof InternalTokenTypes.MCP_REFRESH_TOKEN;
+    client_id: string;
+    idp_id?: string;
+    claims: Record<string, unknown>;
+    idp_access_token_enc?: string;
+    idp_refresh_token_enc?: string;
+    session_exp: number;
+    iat: number;
+    exp: number;
+};
+export declare function createMcpRefreshToken(params: {
+    clientId: string;
+    idpId?: string;
+    claims: Record<string, unknown>;
+    idpAccessTokenEnc?: string;
+    idpRefreshTokenEnc?: string;
+    sessionExp: number;
+}): Promise<string>;
+export declare function verifyMcpRefreshToken(token: string): Promise<McpRefreshTokenPayload>;
+export declare function createMcpSessionResource(sessionId: string | null | undefined): {
+    id: string;
+    object: 'mcpSession';
+    uri: string;
+};
+export declare function rewritePreviewAuthRedirectUri(redirectUri: string): string;
+export declare function parsePreviewBranch(origin: string): string | undefined;
+export declare function buildLoginUrl(idpLoginParams: AuthProviderLoginParams, redirectOrigin: string, redirectTo: string | null, inviteCode?: string, uiLocales?: string): {
+    loginUrl?: string;
+    cookies?: Record<string, {
+        value: string;
+        options: object;
+    }>;
+};
+export declare function buildSAML2LoginUrl(origin: string, idpLoginParams: Saml2LoginParams, redirectTo: string | null, inviteCode?: string, uiLocales?: string): {
+    loginUrl: string;
+};
+export declare function encodeSAML2(samlRequest: string): string;
+export declare function decodeSamlResponse(samlResponse: string): string;
+export declare function parseOidcState(state?: string): Record<string, unknown>;
+export declare function parseSamlResponse(responseXml: string): {
+    uid: string;
+    success: boolean;
+    expiresAt: number;
+    issuerId: string | undefined;
+    entityId: string | undefined;
+    attrs: {
+        [k: string]: string;
+    };
+    cert: string;
+    nameFormat: string;
+    destination: string;
+};
+export declare const oidcMetadataCache: Record<string, OidcIssuerMetadata>;
+export declare const oidcJwksCache: {
+    jwks: Record<string, (OidcJwk & {
+        idpIds: string[];
+    }) | null>;
+};
+export declare function getOidcMetadata(idpId: string, providerConfig: OidcProviderConfig): Promise<OidcIssuerMetadata>;
+export declare function discoverJwks(ssoConfig: SsoConfig): Promise<void>;
+export declare function getRedoclyTokenPayload(token: string): Promise<Record<string, unknown>>;
+export declare function isRedoclySso(config: OidcProviderConfig): boolean;
+export declare function verifySAMLResponse(responseXml: string, cert: string): Promise<boolean>;
+export declare function orderTeamsRbacFirst(teams: string[], rbacConfig: RbacConfig | undefined, teamsMapping: Record<string, string> | undefined): string[];
+export declare function signTokenWithinCookieSizeLimit(tokenPayload: Record<string, unknown>, idpId: string, teamsClaimName: string | undefined, options?: {
+    rbacConfig?: RbacConfig;
+    teamsMapping?: Record<string, string>;
+}): Promise<{
+    token: string;
+    teamsTotal: number;
+    teamsKept: number;
+    droppedTeams: string[];
+} | null>;
+export declare function extractUserClaims(uid: string, nameFormat: string, attrs: Record<string, string>, teamsJWTClaimName?: string): UserIDToken;
+export declare function getUserParamsFromCookies(ssoConfig: SsoConfig, cookies: Record<string, string>): Promise<Record<string, any>>;
+export declare function getUsernameFromPayload(token: any): any;
+export {};
+//# sourceMappingURL=auth.d.ts.map

package/dist/server/web-server/auth.js

@@ -0,0 +1,12 @@
+import"../node-crypto-polyfill.js";import{DOMParser as j}from"@xmldom/xmldom";import{SignedXml as Z}from"xml-crypto";import ee from"xpath";import{deflateSync as te,inflateSync as ne}from"fflate";import{createHash as re}from"crypto";import{ulid as oe}from"ulid";import{AuthProviderType as f,DEFAULT_TEAM_CLAIM_NAME as U}from"@redocly/config";import{ALTERNATIVE_AUD_CLAIM_NAME as se,AUTH_URL as ie,JWT_SECRET_KEY as y,MAX_AUTH_TOKEN_COOKIE_BYTES as ae}from"../constants/common.js";import{ensureArray as R}from"../../utils/array/ensure-array.js";import{envConfig as ce}from"../config/env-config.js";import{decryptClaimValue as ue}from"../utils/crypto/decrypt-claim-value.js";import{decryptAesGcm as de}from"../utils/crypto/decrypt-aes-gcm.js";import{encryptAesGcm as le}from"../utils/crypto/encrypt-aes-gcm.js";import{getPathPrefix as me,withPathPrefix as pe,withoutPathPrefix as fe}from"@redocly/theme/core/utils";import{ServerRoutes as V}from"../../constants/api.js";import{AuthCookieNames as I,DEFAULT_AUTHENTICATED_TEAM as he,REQUIRED_OIDC_SCOPES as B}from"../../constants/common.js";import{appendQueryParams as ye}from"../../utils/url/append-query-params.js";import{parsePreviewUrl as $}from"../../utils/url/parse-preview-url.js";import{logger as O}from"../tools/notifiers/logger.js";import{randomString as Ae}from"../utils/crypto/random-string.js";import{randomUUID as M}from"../utils/crypto/random-uuid.js";import{AlgorithmTypes as d,JwtTokenExpired as we}from"./jwt/types.js";import*as m from"./jwt/jwt.js";import{InternalTokenTypes as T}from"./jwt/token-types.js";import{parseTeamClaimToArray as _e}from"../utils/index.js";import{parseTeamNameTemplate as Se}from"../utils/rbac-expand.js";import{arrayBufferToBase64 as Te,decodeBase64 as F,encodeBase64URL as xe,urlSafeBase64 as H}from"./jwt/encode.js";import{formatSamlCertificate as ge}from"./utils/format-saml-certificate.js";const Ie=new Set(Object.values(T));function x(e){return e?.type===f.OIDC}function Ee(e){return e?.type===f.SAML2}async function Rt(e,t){if(x(t))return ke(e,t);if(Ee(t))return Re(e,t)}async function ke(e,t){const n=await G(e,t),r=new Set((t.scopes||[]).concat(B)),o=t.authorizationRequestCustomParams||{};return{type:f.OIDC,idpId:e,name:"OAuth provider",authorizationEndpoint:n.authorization_endpoint,clientId:t.clientId,responseType:"code",scope:Array.from(r).join(" "),extraParams:o,pkce:t.pkce}}function Re(e,t){return{type:f.SAML2,idpId:e,name:"SAML2 provider",ssoUrl:t.ssoUrl,issuerId:t.issuerId,entityId:t.entityId||t.issuerId}}function K(e){return Array.from(new Set((e.scopes||[]).concat(B))).join(" ")}async function z(e,t,n){return await fetch(e,{method:"POST",body:new URLSearchParams({client_id:t.clientId,...t.clientSecret?{client_secret:t.clientSecret}:{},...n}).toString(),headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"}}).then(r=>r.json())}async function Ot(e,t,n,r,o={}){return await z(e,r,{scope:K(r),code:t,redirect_uri:J(n),grant_type:"authorization_code",...o})}async function Mt(e,t,n){return await z(e,n,{scope:K(n),grant_type:"refresh_token",refresh_token:t})}function Oe(e,{authorizationEndpoint:t,clientId:n,responseType:r,scope:o,extraParams:s,idpId:i,pkce:c},u,h,p){if(!t||!n||!r||!o)return{loginUrl:void 0};const a=new URL(t),w=p?.redirectUriOverride??`${e}${pe(V.OIDC_CALLBACK)}`,_={state:M(),idpId:i,redirectUri:w,redirectTo:u,branch:p?.branchOverride??Ce(e),inviteCode:h,source:p?.sourceOverride??"portal",uiLocales:p?.uiLocales},S={};if(c){const A=H(Ae(50)),E=H(re("sha256").update(A).digest("base64")),k="S256";a.searchParams.append("code_challenge",E),a.searchParams.append("code_challenge_method",k),S.code_verifier={value:A,options:{secure:!0,httpOnly:!0,expires:new Date(Date.now()+1e3*60*10),path:me()||"/"}}}a.searchParams.append("client_id",n),a.searchParams.append("scope",o),a.searchParams.append("response_type",r),a.searchParams.append("redirect_uri",J(w)),a.searchParams.append("state",xe(JSON.stringify(_))),p?.uiLocales&&a.searchParams.append("ui_locales",p.uiLocales);for(const A in s)s[A]!==void 0&&a.searchParams.append(A,s[A]);return{loginUrl:a.toString(),cookies:S}}function Lt(e,t,n,r){const o=new URL(e);return n&&(o.searchParams.append("post_logout_redirect_uri",t),r&&o.searchParams.append("state",r),o.searchParams.append("id_token_hint",n)),o.toString()}function Me(e,t){const n=R(t?.audience??[]);return!n.length||W(e,n)}function W(e,t){const n=[e.aud,e[se]].flat();return t.some(r=>r!==""&&n.includes(r))}function Le(e,t){return!t||!x(t)?!0:Me(e,t)&&Ne(e,t)}function Ne(e,t){return!x(t)||!We(t)||!t.clientId?!0:R(e.aud||[]).includes(t.clientId)}function Nt(e){if(!e)return!1;try{return m.decode(e).header.alg===d.RS256}catch{return!1}}async function Ct(e){const t=Math.floor(Date.now()/1e3),n=t+(e.ttlSec??600);return m.sign({type:T.MCP_AUTHORIZATION_CODE,client_id:e.clientId,redirect_uri:e.redirectUri,id_token_enc:le(e.idToken,y),...e.idpId?{idp_id:e.idpId}:{},...e.idpAccessTokenEnc?{idp_access_token_enc:e.idpAccessTokenEnc}:{},...e.idpRefreshTokenEnc?{idp_refresh_token_enc:e.idpRefreshTokenEnc}:{},...e.codeChallenge?{code_challenge:e.codeChallenge}:{},...e.codeChallengeMethod?{code_challenge_method:e.codeChallengeMethod}:{},iat:t,exp:n},y,d.HS256)}async function Dt(e){await m.verify(e,y,d.HS256);const{payload:t}=m.decode(e);if(t.type!==T.MCP_AUTHORIZATION_CODE)throw new Error("Invalid authorization code type");if(!t.client_id||!t.redirect_uri)throw new Error("Authorization code missing required claims");if(typeof t.exp=="number"&&Date.now()>=t.exp*1e3)throw new Error("Authorization code expired");if(typeof t.id_token_enc!="string")throw new Error("Authorization code missing session");return{...t,id_token:de(t.id_token_enc,y)}}async function bt(e){const t=Math.floor(Date.now()/1e3);return m.sign({type:T.MCP_REFRESH_TOKEN,client_id:e.clientId,...e.idpId?{idp_id:e.idpId}:{},claims:e.claims,...e.idpAccessTokenEnc?{idp_access_token_enc:e.idpAccessTokenEnc}:{},...e.idpRefreshTokenEnc?{idp_refresh_token_enc:e.idpRefreshTokenEnc}:{},session_exp:e.sessionExp,iat:t,exp:e.sessionExp,jti:M()},y,d.HS256)}async function Pt(e){await m.verify(e,y,d.HS256);const{payload:t}=m.decode(e);if(t.type!==T.MCP_REFRESH_TOKEN)throw new Error("Invalid refresh token type");if(!t.client_id||typeof t.claims!="object"||t.claims===null)throw new Error("Refresh token missing required claims");if(typeof t.session_exp!="number")throw new Error("Refresh token missing session expiry");return t}function vt(e){const t=e||oe(),n=t.startsWith("mcp_")?t:`mcp_${t}`;return{id:n,object:"mcpSession",uri:`urn:redocly:realm:mcp:session:${n}`}}function J(e){const t=$(e);if(!t)return e;const n=De(t.hostname);if(n)return t.hostname=`previewauth--${n.previewBranch}${n.after}`,q(e,t);const r=Y(t.hostname);return r?(t.hostname=`${r.projectSlug}.previewauth.${r.after}`,q(e,t)):e}function Ce(e){const t=$(e);if(t)return Y(t.hostname)?.previewBranch}function q(e,t){const n=e.replace(/^https?:\/\/[^/?#]+/i,"");return`${t.protocol}//${t.host}${fe(n)}`}function Y(e){const t=e.split(".preview.",2);if(t.length<2)return null;const[n,r]=t,o=n.indexOf("--");if(o===-1)return null;const s=n.slice(0,o),i=n.slice(o+2);return!s||!i||i.includes(".")?null:{projectSlug:s,previewBranch:i,after:r}}function De(e){const t=e.indexOf("."),n=t===-1?e:e.slice(0,t);if(!n.startsWith("preview-"))return null;const r=n.indexOf("--");if(r===-1)return null;const o=n.slice(r+2);if(!o)return null;const s=t===-1?"":e.slice(t);return{previewBranch:o,after:s}}function be(e){return e.type===f.OIDC}function Pe(e){return e.type===f.SAML2}function jt(e,t,n,r,o){return be(e)?Oe(t,e,n,r,{uiLocales:o}):Pe(e)?ve(t,e,n,r,o):{}}function ve(e,t,n,r,o){const i=`<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    Version="2.0"
+    ID="_${M()}"
+    IssueInstant="${new Date().toISOString()}"
+    AssertionConsumerServiceURL="${e}${V.SAML_CALLBACK}"
+    AttributeConsumingServiceIndex="0">
+    <saml:Issuer>${t.entityId}</saml:Issuer>
+    <samlp:NameIDPolicy
+      AllowCreate="true"
+      Format="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"/>
+  </samlp:AuthnRequest>`,c=je(i);return{loginUrl:ye(t.ssoUrl,{SAMLRequest:c,RelayState:JSON.stringify({idpId:t.idpId,redirectTo:n,inviteCode:r,source:"portal",uiLocales:o})})}}function je(e){return Te(te(new TextEncoder().encode(e)).buffer)}function Ut(e){const t=F(e);if(t.startsWith("<samlp:Response")||t.indexOf("<saml2p:Response")>-1)return t;const n=ne(new Uint8Array(atob(e).split("").map(r=>r.charCodeAt(0))));return new TextDecoder().decode(n)}function Vt(e){try{return JSON.parse(F(e||""))}catch{throw new Error("Invalid OAuth2 state")}}function Bt(e){const t=new j().parseFromString(e,"application/xml"),r=l(t,"//*[local-name(.)='StatusCode']/@Value")[0]?.nodeValue?.endsWith("Success")||!1,s=l(t,"//*[local-name(.)='Response']/@Destination")[0]?.nodeValue||"",i=l(t,"//*[local-name(.)='Assertion']//*[local-name(.)='Issuer']/text()")[0],c=i&&i.nodeValue||void 0,u=l(t,"//*[local-name(.)='Audience']/text()")[0],h=u&&u.nodeValue||void 0,a=l(t,"//*[local-name(.)='Assertion']//*[local-name(.)='X509Certificate']/text()")[0]?.nodeValue||"",w=l(t,"//*[local-name(.)='Subject']//*[local-name(.)='NameID']/text()")[0],_=w&&w.nodeValue||"",S=l(t,"//*[local-name(.)='Subject']//*[local-name(.)='NameID']/@Format")[0],A=S&&S.nodeValue||"",E=l(t,"//*[local-name(.)='Conditions']/@NotOnOrAfter")[0],k=Ue(E),C={},D=l(t,"//*[local-name(.)='AttributeStatement']//*[local-name(.)='Attribute']");if(D.length)for(const b of D){const P=l(b,"./@Name")[0];if(P.nodeValue){const v=l(b,"./*[local-name(.)='AttributeValue']/text()")[0];v?.nodeValue&&(C[P.nodeValue]=v.nodeValue)}}return{uid:_,success:r,expiresAt:k,issuerId:c,entityId:h,attrs:C,cert:a,nameFormat:A,destination:s}}function Ue(e){const t=typeof e?.nodeValue=="string"&&L(Date.parse(e.nodeValue)),n=L(Date.now()),r=L(Date.now()+720*60*1e3);return t?t>n&&t<r?r:t:n}function L(e){return Math.floor(e/1e3)}const N={},g={jwks:{}};async function G(e,t){if(!N[e]){const n=t.configurationUrl?await Q(t.configurationUrl):t.configuration;N[e]=Ve()?$e(n):n}return N[e]}function Ve(){const e=ce.REDOCLY_ENFORCE_RESIDENCY;return!!e&&e.includes("host.docker.internal")}const Be=["authorization_endpoint","end_session_endpoint"];function $e(e){if(typeof e!="object"||e===null)return e;const t={...e};for(const n of Object.keys(t)){if(Be.includes(String(n)))continue;const r=t[n];typeof r=="string"&&r.includes("://localhost")&&(t[n]=r.replace("://localhost","://host.docker.internal"))}return t}const Fe=["kty","n","e","crv","x","y"];function He(e,t){return Fe.every(n=>e[n]===t[n])}async function Ke(e){const t={};for(const n of Object.keys(e)){const r=e[n];if(!x(r))continue;const o=await G(n,r);if(o.jwks_uri){const s=await Q(o.jwks_uri);for(const i of s.keys){const c=t[i.kid],u=c&&He(c,i)?[...c.idpIds,n]:[n];t[i.kid]={...i,idpIds:u},g.jwks[i.kid]=t[i.kid]}}}}function ze(e,t,n){const r=g.jwks[e]?.idpIds??[];return r.find(o=>{const s=n[o];if(!x(s))return!1;const i=R(s.audience??[]);return W(t,i.length?i:[s.clientId])})??r.at(-1)}async function Q(e){return fetch(e,{headers:{Accept:"application/json"}}).then(t=>t.json())}async function $t(e){return fetch(`${ie}/oidc/userinfo`,{headers:{Accept:"application/json",Authorization:`Bearer ${e}`}}).then(t=>t.status===200?t.json():void 0).catch(()=>{})}function We(e){if(!e.configurationUrl)return!1;const t=new URL(e.configurationUrl);return["localhost","127.0.0.1","blueharvest.cloud","bhstage.cloud","cloud.redocly.com","beta.redocly.com","cloud.eu.redocly.com","beta.eu.redocly.com"].some(r=>Je(t.hostname,r))}function Je(e,t){return e===t||e.endsWith(`.${t}`)}async function Ft(e,t){const n=new j().parseFromString(e,"application/xml"),r=l(n,"//*[local-name(.)='Signature' and namespace-uri(.)='http://www.w3.org/2000/09/xmldsig#']")[0];if(!r)throw new Error("Cannot find Signature in the SAML response");const o=ge(t),s=new Z({publicCert:o});s.loadSignature(r);try{return s.checkSignature(e)}catch{return!1}}function qe(e){const t=new Set,n=r=>{if(!(!r||typeof r!="object"||Array.isArray(r)))for(const[o,s]of Object.entries(r))typeof s=="string"?t.add(o):n(s)};return n(e),t}function Ye(e,t,n){if(!t)return e;const r=qe(t),o=s=>{const i=n?.[s]||s;return r.has(i)||!!Se(t,i)};return[...e.filter(o),...e.filter(s=>!o(s))]}async function Ht(e,t,n,r){const o=n?e[n]:void 0,s=Array.isArray(o)?Ye(o.map(String),r?.rbacConfig,r?.teamsMapping):[];let i=s.length;const c=s.length+1;for(let u=0;u<c;u++){const h={...e,idpId:t};n&&s.length&&(h[n]=s.slice(0,i));const p=await m.sign(h,y,d.HS256),a=Buffer.byteLength(p)-ae;if(a<=0)return{token:p,teamsTotal:s.length,teamsKept:i,droppedTeams:s.slice(i)};if(i===0)return null;const w=Buffer.byteLength(JSON.stringify(s.slice(0,i))),_=Math.max(1,w/i*4/3);i=Math.max(0,i-Math.max(1,Math.ceil(a/_)))}return null}function Kt(e,t,n,r){t==="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"&&(e=n["http://schemas.microsoft.com/identity/claims/objectidentifier"]);let o;(t==="urn:oasis:names:tc:SAML:2.0:nameid-format:email"||t==="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress")&&(o=e),t==="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"&&e?.match(/^.+@.+/m)&&(o=e);const s=n["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"],i=s?.match(/^.+@.+/m);return o=o||n["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]||(i?s:void 0),o=o?.toLowerCase(),{sub:e,given_name:n["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"],family_name:n["http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"],name:n["http://schemas.microsoft.com/identity/claims/displayname"]||s,email:o,email_verified:!0,teams:r?_e(n[r]):[]}}function X(e,t={}){return e.map(n=>t[n]||n)}async function zt(e,t){if(!t)return{};const n=t[I.AUTHORIZATION];if(!n)return{};try{const r=m.decode(n);if(typeof r.payload.type=="string"&&Ie.has(r.payload.type))return{};if(r.header.alg===d.RS256){g.jwks[r.header.kid]===void 0&&await Ke(e);const h=g.jwks[r.header.kid];if(!h)return g.jwks[r.header.kid]=null,{};await m.verify(n,h,d.RS256)}else await m.verify(n,y,d.HS256);const s=r.header.alg===d.RS256?ze(r.header.kid,r.payload,e):r.payload.idpId,i=e[s]||{};if(r.header.alg===d.RS256&&typeof r.payload.exp!="number")return O.warn("Rejected id_token: it has no exp claim"),{};if(r.header.alg===d.RS256&&!Le(r.payload,i))return O.warn("Rejected id_token: it was issued for another project"),{};const c=Xe(i),u=Qe(i);return{...r.payload,email:r.payload.email?.toLowerCase(),idpId:s,teams:Array.from(new Set([...X(r.payload.teams||[],u),..."defaultTeams"in i&&i.defaultTeams||[],...X("teamsClaimName"in i&&r.payload[c||""]||[],u),he])),name:Ge(r.payload),isAuthenticated:!0,idpAccessToken:ue(r.payload.idp_access_token,y)||t[I.IDP_ACCESS_TOKEN],federatedAccessToken:t[I.FEDERATED_ACCESS_TOKEN],federatedIdToken:t[I.FEDERATED_ID_TOKEN],authCookie:n}}catch(r){r instanceof we||O.error("Malformed JWT token: %s",r.message)}return{}}function Ge(e){return(e.firstName&&e.lastName?`${e.firstName} ${e.lastName}`:e.name||e.given_name||e.firstName||e.lastName)||e.email}function Qe(e){switch(e.type){case f.SAML2:return e.teamsAttributeMap;case f.OIDC:return e.teamsClaimMap;default:return}}function Xe(e){switch(e.type){case f.SAML2:return e.teamsAttributeName??U;case f.OIDC:return e.teamsClaimName;default:return U}}function l(e,t){return ee.select(t,e)||[]}export{jt as buildLoginUrl,Oe as buildOidcLoginUrl,Lt as buildOidcLogoutUrl,ve as buildSAML2LoginUrl,Ct as createMcpAuthorizationCode,bt as createMcpRefreshToken,vt as createMcpSessionResource,Ut as decodeSamlResponse,Ke as discoverJwks,je as encodeSAML2,Kt as extractUserClaims,Rt as getAuthProviderLoginParams,ke as getOidcLoginParams,G as getOidcMetadata,$t as getRedoclyTokenPayload,Re as getSaml2LoginParams,zt as getUserParamsFromCookies,Ge as getUsernameFromPayload,Me as idTokenAudienceIsAllowed,Le as idTokenIsForThisProject,Nt as isIdpIssuedToken,x as isOidcProviderConfig,We as isRedoclySso,Ee as isSaml2ProviderConfig,Ot as oidcExchangeCodeForToken,g as oidcJwksCache,N as oidcMetadataCache,Mt as oidcRefreshTokenGrant,Ye as orderTeamsRbacFirst,Vt as parseOidcState,Ce as parsePreviewBranch,Bt as parseSamlResponse,J as rewritePreviewAuthRedirectUri,Ht as signTokenWithinCookieSizeLimit,Dt as verifyMcpAuthorizationCode,Pt as verifyMcpRefreshToken,Ft as verifySAMLResponse};