@redocly/redoc-reef 0.140.0-next.5 → 0.140.0-next.7

package/dist/server/workers/mcp-tool-worker-methods.d.ts

@@ -0,0 +1,7 @@
+import type { WorkerParams } from './types.js';
+import { MCP_TOOL_AVAILABILITY_KEY, MCP_TOOL_WORKER_KEY } from './mcp-tool-worker-pool.js';
+export declare const mcpToolWorkerMethods: {
+    executeMcpTool: (params: WorkerParams<typeof MCP_TOOL_WORKER_KEY>[0]) => Promise<import("../plugins/mcp/types.js").McpToolWorkerResponse>;
+    mcpToolAvailability: (params: WorkerParams<typeof MCP_TOOL_AVAILABILITY_KEY>[0]) => Promise<Record<string, boolean>>;
+};
+//# sourceMappingURL=mcp-tool-worker-methods.d.ts.map

package/dist/server/workers/mcp-tool-worker-methods.js

@@ -0,0 +1 @@
+import{executeMcpTool as e,mcpToolAvailability as r}from"../plugins/mcp/workers/execute-mcp-tool.js";import{fromWorkerContext as t}from"../plugins/mcp/workers/worker-context.js";import{MCP_TOOL_AVAILABILITY_KEY as c,MCP_TOOL_WORKER_KEY as m}from"./mcp-tool-worker-pool.js";const T={[m]:o=>e({...o,context:t(o.context)}),[c]:o=>r({...o,context:t(o.context)})};export{T as mcpToolWorkerMethods};

package/dist/server/workers/mcp-tool-worker-pool.d.ts

@@ -1,6 +1,5 @@
 import { WorkerPool } from './worker-pool.js';
 export declare const MCP_TOOL_WORKER_KEY = "executeMcpTool";
-export declare const MCP_TOOL_IS_AVAILABLE_KEY = "isMcpToolAvailable";
 export declare const MCP_TOOL_AVAILABILITY_KEY = "mcpToolAvailability";
 export declare const mcpToolWorkers: WorkerPool;
 //# sourceMappingURL=mcp-tool-worker-pool.d.ts.map

package/dist/server/workers/mcp-tool-worker-pool.js

@@ -1 +1 @@
-import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",l="isMcpToolAvailable",c="mcpToolAvailability",e=5,i=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0,sandbox:!0});export{c as MCP_TOOL_AVAILABILITY_KEY,l as MCP_TOOL_IS_AVAILABLE_KEY,p as MCP_TOOL_WORKER_KEY,i as mcpToolWorkers};
+import{getAllowedEnvs as o}from"../utils/envs/get-api-route-allowed-env-variables.js";import{WorkerPool as r}from"./worker-pool.js";const p="executeMcpTool",c="mcpToolAvailability",e=5,l=new r({workerScript:"./mcp-tool-worker",minWorkers:1,maxWorkers:e,workerType:"process",forkOpts:{stdio:"inherit"},resolveForkEnv:o,lazy:!0,sandbox:!0});export{c as MCP_TOOL_AVAILABILITY_KEY,p as MCP_TOOL_WORKER_KEY,l as mcpToolWorkers};

package/dist/server/workers/mcp-tool-worker.js

@@ -1 +1 @@
-import o from"workerpool";import{executeMcpTool as r,isMcpToolAvailable as _,mcpToolAvailability as i}from"../plugins/mcp/workers/execute-mcp-tool.js";import{MCP_TOOL_AVAILABILITY_KEY as l,MCP_TOOL_IS_AVAILABLE_KEY as A,MCP_TOOL_WORKER_KEY as m}from"./mcp-tool-worker-pool.js";o.worker({[m]:r,[A]:_,[l]:i});
+import o from"workerpool";import{mcpToolWorkerMethods as r}from"./mcp-tool-worker-methods.js";o.worker(r);

package/dist/server/workers/types.d.ts

@@ -1,11 +1,11 @@
 import type { ApiRoutesWorkerParams, ApiRoutesWorkerResponse } from '../types/plugins/api-routes.js';
 import type { RenderPayload } from '../../types/ssr.js';
 import type { ScorecardsWorkerParams, ScorecardsWorkerResponse } from '../types/plugins/scorecards.js';
-import type { McpToolContext, McpToolExecutionParams, McpToolWorkerResponse } from '../plugins/mcp/types.js';
+import type { McpToolWorkerContext, McpToolWorkerParams, McpToolWorkerResponse } from '../plugins/mcp/types.js';
 import type { SCORECARDS_WORKER_KEY } from './scorecards-worker-pool.js';
 import type { API_ROUTES_WORKER_KEY } from './api-routes-worker-pool.js';
 import type { SSR_WORKER_KEY } from './ssr-worker-pool.js';
-import type { MCP_TOOL_AVAILABILITY_KEY, MCP_TOOL_IS_AVAILABLE_KEY, MCP_TOOL_WORKER_KEY } from './mcp-tool-worker-pool.js';
+import type { MCP_TOOL_AVAILABILITY_KEY, MCP_TOOL_WORKER_KEY } from './mcp-tool-worker-pool.js';
 export type SsrWorkerResponse = {
     html: string;
     statusCode: 200 | 500;
@@ -25,17 +25,13 @@ export type WorkerTypeMapping = {
         response: ScorecardsWorkerResponse;
     };
     [MCP_TOOL_WORKER_KEY]: {
-        params: [McpToolExecutionParams];
+        params: [McpToolWorkerParams];
         response: McpToolWorkerResponse;
     };
-    [MCP_TOOL_IS_AVAILABLE_KEY]: {
-        params: [Omit<McpToolExecutionParams, 'args' | 'extra'>];
-        response: boolean;
-    };
     [MCP_TOOL_AVAILABILITY_KEY]: {
         params: [{
             toolNames: string[];
-            context: McpToolContext;
+            context: McpToolWorkerContext;
         }];
         response: Record<string, boolean>;
     };

package/dist/server/workers/worker-config.d.ts

@@ -0,0 +1,33 @@
+import type { RedoclyConfig } from '@redocly/config';
+type ConfigFileRef = {
+    path: string;
+    env: Record<string, string>;
+};
+/**
+ * The store config file of a build output, and the env values that resolve its placeholders in a
+ * worker. `env` has no variable that the worker env excludes: those placeholders stay unresolved.
+ * Main process only: `config` is the store config that was loaded from the file.
+ */
+export type StoreConfigFile = ConfigFileRef & {
+    config: RedoclyConfig;
+};
+/** The config as it crosses to a worker: the config file entries, overridden by `entries`. */
+export type WorkerConfig = {
+    file: ConfigFileRef;
+    entries: Partial<RedoclyConfig>;
+} | {
+    file?: undefined;
+    entries: RedoclyConfig;
+};
+/**
+ * Sends only the top-level entries of `config` that are not the same values as in the config file.
+ * Without a config file (`develop`), sends all of `config`.
+ */
+export declare function toWorkerConfig(config: RedoclyConfig, configFile: StoreConfigFile | undefined): WorkerConfig;
+/**
+ * Worker side. Returns a config that the call owns: a change to it, at any depth, is not seen by
+ * other calls. Throws when the config file cannot be read.
+ */
+export declare function readWorkerConfig(workerConfig: WorkerConfig): RedoclyConfig;
+export {};
+//# sourceMappingURL=worker-config.d.ts.map

package/dist/server/workers/worker-config.js

@@ -0,0 +1 @@
+import{readFileSync as a}from"node:fs";import{MARKDOC_PARTIALS_DATA_KEY as f}from"../constants/common.js";import{resolveStoreConfig as l}from"../store-config.js";let s;function m(n,e){if(!e)return{entries:n};const o=e.config;return{file:{path:e.path,env:e.env},entries:Object.fromEntries(Object.entries(n).filter(([t,r])=>o[t]!==r))}}function j(n){const{file:e,entries:o}=n;if(!e)return o;const t=d(e),r=Object.fromEntries(Object.keys(t).map(i=>[i,()=>structuredClone(t[i])]));return r[f]=()=>u(e)[f],O(r,o)}function d(n){const e=JSON.stringify([n.path,n.env]);if(s?.key!==e){const{[f]:o,...t}=u(n);s={key:e,config:t}}return s.config}function u({path:n,env:e}){let o;try{o=JSON.parse(a(n,"utf8"))}catch(t){throw new Error(`Could not read the store config file "${n}": ${String(t)}`)}return l(o,t=>e[t]).config}function O(n,e){const o={},t=(r,i)=>{Object.defineProperty(o,r,{value:i,writable:!0,enumerable:!0,configurable:!0})};for(const[r,i]of Object.entries(n)){if(Object.hasOwn(e,r)){t(r,e[r]);continue}Object.defineProperty(o,r,{enumerable:!0,configurable:!0,get:()=>{const c=i();return t(r,c),c},set:c=>t(r,c)})}for(const[r,i]of Object.entries(e))Object.hasOwn(o,r)||t(r,i);return o}export{j as readWorkerConfig,m as toWorkerConfig};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/redoc-reef",
-  "version": "0.140.0-next.5",
+  "version": "0.140.0-next.7",
   "description": "",
   "type": "module",
   "bin": {
@@ -21,7 +21,7 @@
     "@jitl/quickjs-singlefile-mjs-release-sync": "0.32.0",
     "@libsql/client": "0.17.3",
     "@markdoc/markdoc": "npm:@redocly/markdoc@0.7.0-beta.2",
-    "@modelcontextprotocol/server": "2.0.0",
+    "@modelcontextprotocol/server": "2.3.1",
     "@opentelemetry/api": "1.9.1",
     "@opentelemetry/context-zone": "2.0.1",
     "@opentelemetry/core": "2.8.0",
@@ -33,14 +33,14 @@
     "@opentelemetry/sdk-trace-web": "2.8.0",
     "@opentelemetry/semantic-conventions": "1.40.0",
     "@redocly/ajv": "8.18.0",
-    "@redocly/api-docs": "0.5.0-next.3",
-    "@redocly/config": "0.67.0",
+    "@redocly/api-docs": "0.5.0-next.5",
+    "@redocly/config": "0.69.0",
     "@redocly/markdoc": "0.7.0-beta.2",
-    "@redocly/openapi-core": "2.66.0",
+    "@redocly/openapi-core": "2.72.1",
     "@redocly/portal-legacy-ui": "0.19.0",
-    "@redocly/portal-plugin-mock-server": "0.25.0-next.0",
+    "@redocly/portal-plugin-mock-server": "0.25.0-next.2",
     "@redocly/realm-asyncapi-sdk": "0.17.0",
-    "@redocly/theme": "0.72.0-next.2",
+    "@redocly/theme": "0.72.0-next.4",
     "@shikijs/transformers": "3.21.0",
     "@tanstack/react-query": "5.62.3",
     "@tanstack/react-table": "8.21.3",
@@ -98,7 +98,7 @@
     "xml-crypto": "6.1.0",
     "xpath": "0.0.34",
     "yaml-ast-parser": "0.0.43",
-    "zod": "^3.25.76"
+    "zod": "^4.6.6"
   },
   "peerDependencies": {
     "react": "^19.2.7",

package/dist/server/plugins/mcp/utils/available-sandbox-tools.d.ts

@@ -1,4 +0,0 @@
-import type { McpToolSchema } from '../../../types';
-import type { McpToolContext } from '../types.js';
-export declare function availableSandboxTools(candidates: McpToolSchema[], context: McpToolContext): Promise<McpToolSchema[]>;
-//# sourceMappingURL=available-sandbox-tools.d.ts.map

package/dist/server/plugins/mcp/utils/available-sandbox-tools.js

@@ -1 +0,0 @@
-import{logger as a}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as n,MCP_TOOL_AVAILABILITY_KEY as m}from"../../../workers/mcp-tool-worker-pool.js";async function p(t,l){if(t.length===0)return t;const e=t.map(o=>o.name);let r;try{r=await n.exec(m,[{toolNames:e,context:l}],{timeout:1e4})}catch(o){return i(t,o instanceof Error?o.message:String(o))}return!r||typeof r!="object"?i(t,"the worker returned no availability map"):t.filter(o=>r[o.name]!==!1)}function i(t,l){const e=t.filter(r=>r.hasAvailabilityGate);return e.length===0?t:(a.warn(`MCP tool availability is unknown (${l}); the sandbox tool list drops the gated tools: ${e.map(r=>r.name).join(", ")}.`),t.filter(r=>!r.hasAvailabilityGate))}export{p as availableSandboxTools};

package/dist/server/tools/notifiers/helpers/privacy/mask-email.d.ts

@@ -1,25 +0,0 @@
-/**
- * Masks the username part of an email address for privacy or anonymization.
- *
- * The function preserves the domain while replacing most characters in the username
- * with asterisks (`*`). It keeps the first two characters visible when the username
- * is longer than two characters. If the input is invalid or not a string containing
- * an `@` symbol, it returns the original value unchanged.
- *
- * @example
- * ```ts
- * maskEmail("john.doe@example.com");
- * // → "jo******@example.com"
- *
- * maskEmail("ab@example.com");
- * // → "ab@example.com"
- *
- * maskEmail("a@example.com");
- * // → "*@example.com"
- * ```
- *
- * @param email - The email address to mask.
- * @returns A masked version of the email, or the original value if invalid.
- */
-export declare const maskEmail: (email: string) => string;
-//# sourceMappingURL=mask-email.d.ts.map

package/dist/server/tools/notifiers/helpers/privacy/mask-email.js

@@ -1 +0,0 @@
-const r=e=>{if(!e||typeof e!="string"||!e.includes("@"))return e;const[n,t]=e.split("@");return`${n.length>2?n.slice(0,2)+"*".repeat(n.length-2):"*".repeat(n.length)}@${t}`};export{r as maskEmail};

package/dist/server/tools/notifiers/helpers/privacy/mask-subject.d.ts

@@ -1,13 +0,0 @@
-/**
- * Masks all email addresses found within a given subject string.
- *
- * This utility searches the input text for any email-like patterns and replaces
- * each one using the {@link maskEmail} function, preserving the rest of the string.
- * It is typically used to sanitize or anonymize email addresses before logging,
- * displaying, or transmitting text content.
- *
- * @param subject - The text that may contain one or more email addresses.
- * @returns A new string with all detected email addresses masked.
- */
-export declare const maskSubject: (subject: string) => string;
-//# sourceMappingURL=mask-subject.d.ts.map

package/dist/server/tools/notifiers/helpers/privacy/mask-subject.js

@@ -1 +0,0 @@
-import{maskEmail as c}from"./mask-email.js";const r=/[a-zA-Z0-9._%+-]/,m=/^[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/,d=e=>{let o="",i=0,a=0;for(;a<e.length;){const n=e.indexOf("@",a);if(n===-1)break;let t=n;for(;t>i&&r.test(e.charAt(t-1));)t--;const s=t<n?m.exec(e.slice(n+1))?.[0]:void 0;if(!s){a=n+1;continue}const l=n+1+s.length;o+=e.slice(i,t)+c(e.slice(t,l)),i=l,a=l}return o+e.slice(i)};export{d as maskSubject};

package/dist/server/tools/notifiers/helpers/privacy/remove-pii-from-url.d.ts

@@ -1,25 +0,0 @@
-/**
- * Sanitizes personally identifiable information (PII) found within a URL or query string.
- *
- * This function scans all query parameter values and removes or masks any PII using
- * the {@link removePii} function. It gracefully handles both absolute and relative URLs.
- *
- * - If the input is not a string, it is returned unchanged.
- * - If parsing as a URL fails, the function falls back to applying {@link removePii}
- *   directly on the raw string.
- * - The output preserves the original format (absolute or relative).
- *
- * @example
- * ```ts
- * removePiiFromUrl('https://example.com?email=john.doe@example.com&phone=555-123-4567');
- * // → 'https://example.com/?email=[email_removed]&phone=[phone_removed]'
- *
- * removePiiFromUrl('/profile?ssn=123-45-6789');
- * // → '/profile?ssn=[SSN_removed]'
- * ```
- *
- * @param url - The input URL string or relative path to sanitize.
- * @returns A sanitized URL string with PII masked, or the input value unchanged if not a string.
- */
-export declare function removePiiFromUrl(url: unknown): unknown;
-//# sourceMappingURL=remove-pii-from-url.d.ts.map

package/dist/server/tools/notifiers/helpers/privacy/remove-pii-from-url.js

@@ -1 +0,0 @@
-import{isString as n}from"../../../../../utils/string/is-string.js";import{removePii as e}from"./remove-pii.js";function m(t){if(!n(t))return t;try{const r=new URL(t,"http://example.com");for(const[i,s]of r.searchParams.entries()){const a=String(e(s));r.searchParams.set(i,a)}return t.startsWith("http://")||t.startsWith("https://")?r.toString():r.pathname+r.search+r.hash}catch{return String(e(t))}}export{m as removePiiFromUrl};

package/dist/server/tools/notifiers/helpers/privacy/remove-pii.d.ts

@@ -1,36 +0,0 @@
-/**
- * Implementation of PII sanitization from @coffeeandfun/remove-pii (MIT licensed) without unnecessary methods
- */
-type PIIConfigOption = {
-    enabled: false;
-    replacement?: string;
-    pattern?: RegExp;
-} | {
-    enabled: true;
-    replacement: string;
-    pattern?: RegExp;
-};
-type PIIConfig = {
-    [key: string]: PIIConfigOption;
-};
-/**
- * Removes or masks personally identifiable information (PII) from a given text string.
- *
- * This function identifies and replaces sensitive data such as email addresses,
- * phone numbers, credit card numbers, and other personal identifiers with
- * configurable placeholder strings. It’s a lightweight implementation inspired by
- * `@coffeeandfun/remove-pii` (MIT licensed), keeping only the essential sanitization logic.
- *
- * By default, all common PII patterns (email, phone, SSN, credit card, address,
- * passport number, driver’s license, ZIP code, bank account, and date of birth)
- * are detected and replaced. Custom configuration can override or disable any pattern.
- *
- * Non-string inputs are returned unchanged.
- *
- * @param text - The input text that may contain personally identifiable information.
- * @param options - Optional configuration to enable, disable, or customize PII replacements.
- * @returns A sanitized string with PII masked or removed; if the input is not a string, returns it unchanged.
- */
-export declare function removePii(text: unknown, options?: PIIConfig): unknown;
-export {};
-//# sourceMappingURL=remove-pii.d.ts.map

package/dist/server/tools/notifiers/helpers/privacy/remove-pii.js

@@ -1 +0,0 @@
-import{isString as m}from"../../../../../utils/string/is-string.js";const s={email:{pattern:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,replacement:"[email_removed]"},phone:{pattern:/(?:\+?1[-.\s]?)?\(?([0-9]{3})\)?[-.\s]?([0-9]{3})[-.\s]?([0-9]{4})(?:\s?(?:ext|x|extension)\.?\s?(\d+))?/g,replacement:"[phone_removed]"},ssn:{pattern:/\b(?!000|666|9\d{2})\d{3}-?(?!00)\d{2}-?(?!0000)\d{4}\b/g,replacement:"[SSN_removed]"},creditCard:{pattern:/\b\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}\b/g,replacement:"[credit_card_removed]"},address:{pattern:/\b\d+\s[A-Za-z0-9\s,.-]+(?:Street|St|Avenue|Ave|Road|Rd|Boulevard|Blvd|Lane|Ln|Drive|Dr|Court|Ct|Circle|Cir|Way|Place|Pl|Parkway|Pkwy|Terrace|Ter)\b/gi,replacement:"[address_removed]"},passport:{pattern:/\b[A-Z]{2}[0-9]{7}\b/g,replacement:"[passport_number_removed]"},driversLicense:{pattern:/\b[A-Z]{1,2}[0-9]{6,9}\b/g,replacement:"[driver_license_removed]"},zipCode:{pattern:/(?<!\d-)\b\d{5}(?:-\d{4})?\b(?!-\d)/g,replacement:"[zip_code_removed]"},bankAccount:{pattern:/\b\d{8,17}\b/g,replacement:"[bank_account_removed]"},dateOfBirth:{pattern:/\b(?:0[1-9]|1[0-2])[-/](?:0[1-9]|[12][0-9]|3[01])[-/](?:19|20)\d{2}\b/g,replacement:"[date_removed]"}};function l(n={}){const e={email:{enabled:!0,replacement:"[email_removed]"},phone:{enabled:!0,replacement:"[phone_removed]"},ssn:{enabled:!0,replacement:"[SSN_removed]"},creditCard:{enabled:!0,replacement:"[credit_card_removed]"},address:{enabled:!0,replacement:"[address_removed]"},passport:{enabled:!0,replacement:"[passport_number_removed]"},driversLicense:{enabled:!0,replacement:"[driver_license_removed]"},zipCode:{enabled:!0,replacement:"[zip_code_removed]"},bankAccount:{enabled:!0,replacement:"[bank_account_removed]"},dateOfBirth:{enabled:!0,replacement:"[date_removed]"}};for(const[r,t]of Object.entries(n))e[r]?e[r]={...e[r],...t}:e[r]=t;return e}function b(n,e={}){if(!m(n))return n;const r=l(e);let t=n;for(const[c,a]of Object.entries(r)){if(!a.enabled)continue;const d=s[c],o=d?.pattern||a.pattern,p=a.replacement||d?.replacement||"[PII removed]";o&&(t=t.replace(o,p))}return t}export{b as removePii};