@redocly/realm 0.136.0-next.5 → 0.136.0-next.7

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.d.ts

@@ -5,5 +5,6 @@ export declare function getDefaultToolSchemas(config: {
     requiresLogin: boolean;
     rbac?: Record<string, unknown>;
     hasGraphqlApis?: boolean;
+    elicitationEnabled?: boolean;
 }): McpToolSchema[];
 //# sourceMappingURL=tool-schemas.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{shouldHandleMcpAuth as m}from"../auth/auth-handlers.js";import{GRAPHQL_TYPE_KINDS as o}from"./tools/graphql/types.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const t={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},d={codemodeType:"OpenApiDocument"},h={codemodeType:"OpenApiOperation & { path: string; method: string }"},y={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},g={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},f={type:"object",required:[],additionalProperties:!1,properties:{}};function T(e){const i=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:y,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t,version:t,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:t,description:t,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:g,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:h,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:t,version:t,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:d}}},P(e.products,e.locales)];return m(e.requiresLogin,e.rbac)&&i.push({name:"whoami",description:"Get information about the currently authenticated user",schema:f,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&i.push(...L()),i}const b={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},S={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:"Optional: return only a single category of schema members",enum:[...o],nullable:!0},filter:{type:"string",description:'Optional: only members whose name contains this substring (e.g. "book")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},v={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},H={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function L(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:b,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:t}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (member-name substring, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema.',schema:S,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:t,type:{type:"string"},args:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:"Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Set includeReferencedTypes to also pull in every type it references transitively \u2014 the full structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.",schema:v,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:H,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function P(e,i){const c=e&&e.length>0,u=i&&i.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:i,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{T as getDefaultToolSchemas};
+import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as m}from"../constants.js";import{GRAPHQL_TYPE_KINDS as o,GRAPHQL_LIST_SCOPES as h}from"./tools/graphql/constants.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},f={codemodeType:"OpenApiOperation & { path: string; method: string }"},g={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},b={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},S={type:"object",required:[],additionalProperties:!1,properties:{}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function I(e){const t=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:g,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i,version:i,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:b,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:f,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:i,version:i,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},q(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&t.push({name:"whoami",description:"Get information about the currently authenticated user",schema:S,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...T()),e.elicitationEnabled&&t.push({name:m,description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:v,annotations:{title:"Create anonymous session",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...o],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...h],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},P={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},A={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function T(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:L,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:P,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:A,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function q(e,t){const c=e&&e.length>0,u=t&&t.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:t,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/core/create-anonymous-session.d.ts

@@ -0,0 +1,11 @@
+import type { McpToolContext, McpToolHandler } from '../../../types.js';
+export type CreateAnonymousSessionArgs = Record<string, never>;
+export declare function isAnonymousSessionToolAvailable(context: McpToolContext): boolean;
+declare const _default: {
+    createAnonymousSession: {
+        execute: McpToolHandler<CreateAnonymousSessionArgs>;
+        isAvailable: typeof isAnonymousSessionToolAvailable;
+    };
+};
+export default _default;
+//# sourceMappingURL=create-anonymous-session.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/core/create-anonymous-session.js

@@ -0,0 +1 @@
+import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as t}from"../../../constants.js";import{createSessionHandle as n}from"../../../gateway-mcp/subject.js";const o=async()=>({content:[{type:"text",text:JSON.stringify({sessionHandle:n()})}],isError:!1});function i(e){return!!e.elicitationEnabled&&!e.user?.isAuthenticated}var a={[t]:{execute:o,isAvailable:i}};export{a as default,i as isAnonymousSessionToolAvailable};

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const GRAPHQL_TYPE_KINDS: readonly ['queries', 'mutations', 'subscriptions', 'objects', 'interfaces', 'unions', 'enums', 'inputs', 'scalars', 'directives'];
+export declare const GRAPHQL_LIST_SCOPES: readonly ['members', 'fields'];
+export declare const FIELD_SCOPE_KINDS: readonly ['objects', 'interfaces', 'inputs'];
+//# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/constants.js

@@ -0,0 +1 @@
+const s=["queries","mutations","subscriptions","objects","interfaces","unions","enums","inputs","scalars","directives"],e=["members","fields"],t=["objects","interfaces","inputs"];export{t as FIELD_SCOPE_KINDS,e as GRAPHQL_LIST_SCOPES,s as GRAPHQL_TYPE_KINDS};

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/get-graphql-type-list.js

@@ -1 +1 @@
-import{GRAPHQL_TYPE_KINDS as g}from"./types.js";import{respondWithGraphqlSchema as d,paginate as u}from"./tool-helpers.js";import{groupSchemaTypes as y,filterMembersReferencingType as h}from"./utils.js";const T=(i,a)=>d(i.name,a,({name:f,schema:o})=>{const{kind:p,filter:n,referencesType:l,page:s=1,limit:m=300}=i,c=y(o);let e=(p?[p]:g).flatMap(t=>c[t].map(r=>({kind:t,...r})));if(l&&(e=h(o,e,l)),n){const t=n.toLowerCase();e=e.filter(r=>r.name.toLowerCase().includes(t))}return JSON.stringify({name:f,...u(e,s,m)},null,2)});var G={"get-graphql-type-list":T};export{G as default};
+import{FIELD_SCOPE_KINDS as n,GRAPHQL_TYPE_KINDS as u}from"./constants.js";import{respondWithGraphqlSchema as g,paginate as d}from"./tool-helpers.js";import{groupSchemaTypes as h,fieldMembers as y,filterMembersReferencingType as S,matchesFilter as b}from"./utils.js";function T(r,p,t){if(p==="fields"){if(t&&!n.some(e=>e===t))throw new Error(`scope "fields" lists the fields of object, interface, and input types; kind must be ${n.map(e=>`"${e}"`).join(", ")}, or omitted.`);return y(r,t)}const o=h(r);return(t?[t]:u).flatMap(e=>o[e].map(s=>({kind:e,...s})))}const E=(r,p)=>g(r.name,p,({name:t,schema:o})=>{const{kind:e,scope:s="members",filter:f,referencesType:l,page:m=1,limit:a=300}=r;let i=T(o,s,e);return l&&(i=S(o,i,l)),f&&(i=i.filter(c=>b(c,f))),JSON.stringify({name:t,...d(i,m,a)},null,2)});var D={"get-graphql-type-list":E};export{D as default};

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/get-graphql-type.js

@@ -1,7 +1,10 @@
-import{respondWithGraphqlSchema as d}from"./tool-helpers.js";import{printTypeOrField as y,printTypeOrFieldWithReferences as f}from"./utils.js";const l=(n,p)=>d(n.name,p,({name:r,schema:t})=>{const{type:e,includeReferencedTypes:i}=n;if(i){const{sdl:o,referencedCount:c}=f(t,e);return`# Schema: ${r}
-# Type: ${e} (+ ${c} referenced types)
+import{respondWithGraphqlSchema as d}from"./tool-helpers.js";import{printTypeOrField as y,printTypeOrFieldWithReferences as a,referencedTypeManifest as $}from"./utils.js";const m=(r,c)=>d(r.name,c,({name:p,schema:n})=>{const{type:e,includeReferencedTypes:l}=r;if(l){const{sdl:t,referencedCount:s}=a(n,e);return`# Schema: ${p}
+# Type: ${e} (+ ${s} referenced types)
 
-${o}`}return`# Schema: ${r}
+${t}`}const o=`# Schema: ${p}
 # Type: ${e}
 
-${y(t,e)}`});var m={"get-graphql-type":l};export{m as default};
+${y(n,e)}`,f=$(n,e);if(f.length===0)return o;const i=["# Referenced types (one level, names only; fetch a type or set includeReferencedTypes for full SDL):",...f.map(t=>`# ${t}`)].join(`
+`);return`${o}
+
+${i}`});var h={"get-graphql-type":m};export{h as default};

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/types.d.ts

@@ -1,10 +1,15 @@
-export declare const GRAPHQL_TYPE_KINDS: readonly ['queries', 'mutations', 'subscriptions', 'objects', 'interfaces', 'unions', 'enums', 'inputs', 'scalars', 'directives'];
+import type { GRAPHQL_LIST_SCOPES, GRAPHQL_TYPE_KINDS } from './constants.js';
 export type GraphqlTypeKind = (typeof GRAPHQL_TYPE_KINDS)[number];
+export type GraphqlListScope = (typeof GRAPHQL_LIST_SCOPES)[number];
 export type SchemaMember = {
     name: string;
     description?: string;
     type?: string;
     args?: string;
+    directives?: string;
+};
+export type SchemaMemberWithKind = SchemaMember & {
+    kind: GraphqlTypeKind;
 };
 export type GroupedSchemaTypes = Record<GraphqlTypeKind, SchemaMember[]>;
 export type ListGraphqlApisArgs = {
@@ -15,6 +20,7 @@ export type ListGraphqlApisArgs = {
 export type GetGraphqlTypeListArgs = {
     name: string;
     kind?: GraphqlTypeKind;
+    scope?: GraphqlListScope;
     filter?: string;
     referencesType?: string;
     page?: number;

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/types.js

@@ -1 +0,0 @@
-const s=["queries","mutations","subscriptions","objects","interfaces","unions","enums","inputs","scalars","directives"];export{s as GRAPHQL_TYPE_KINDS};

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/utils.d.ts

@@ -1,14 +1,18 @@
 import type { GraphQLSchema } from 'graphql';
 import type { GraphqlDescriptionInfo } from '../../../types.js';
-import type { GraphqlTypeKind, GroupedSchemaTypes } from './types.js';
+import type { GraphqlTypeKind, GroupedSchemaTypes, SchemaMember, SchemaMemberWithKind } from './types.js';
 export declare function findGraphqlSchemaByName(graphqlDescriptions: GraphqlDescriptionInfo[], name: string): GraphqlDescriptionInfo | undefined;
 export declare function groupSchemaTypes(schema: GraphQLSchema): GroupedSchemaTypes;
+export declare function fieldMembers(schema: GraphQLSchema, kind?: GraphqlTypeKind): SchemaMemberWithKind[];
+/** Case-insensitive substring match against the member's name or description. */
+export declare function matchesFilter(member: SchemaMember, filter: string): boolean;
 export declare function filterMembersReferencingType<T extends {
     kind: GraphqlTypeKind;
     name: string;
 }>(schema: GraphQLSchema, members: T[], targetName: string): T[];
 export declare function referencedTypeClosure(schema: GraphQLSchema, name: string): string[];
 export declare function printTypeOrField(schema: GraphQLSchema, name: string): string;
+export declare function referencedTypeManifest(schema: GraphQLSchema, name: string): string[];
 export declare function printTypeOrFieldWithReferences(schema: GraphQLSchema, name: string): {
     sdl: string;
     referencedCount: number;

package/dist/server/plugins/mcp/docs-mcp/tools/graphql/utils.js

@@ -1,3 +1,5 @@
-import{getNamedType as p,isEnumType as v,isInputObjectType as y,isInterfaceType as g,isIntrospectionType as u,isObjectType as T,isScalarType as m,isSpecifiedScalarType as S,isUnionType as b,print as c,printType as N,specifiedDirectives as O}from"graphql";const j=new Set(["queries","mutations","subscriptions"]);function C(e,r){const t=r.toLowerCase();return e.find(i=>i.name.toLowerCase().includes(t))}function a(e,r){return e.getQueryType()?.getFields()[r]??e.getMutationType()?.getFields()[r]??e.getSubscriptionType()?.getFields()[r]}function w(e){return[p(e.type).name,...e.args.map(r=>p(r.type).name)]}function d(e){const r=new Set;if(T(e)||g(e)){for(const t of Object.values(e.getFields())){r.add(p(t.type).name);for(const i of t.args)r.add(p(i.type).name)}for(const t of e.getInterfaces())r.add(t.name)}else if(b(e))for(const t of e.getTypes())r.add(t.name);else if(y(e))for(const t of Object.values(e.getFields()))r.add(p(t.type).name);return r}function $(e){const r=new Set([e.getQueryType(),e.getMutationType(),e.getSubscriptionType()].filter(n=>!!n).map(n=>n.name)),t={queries:l(e.getQueryType()),mutations:l(e.getMutationType()),subscriptions:l(e.getSubscriptionType()),objects:[],interfaces:[],unions:[],enums:[],inputs:[],scalars:[],directives:[]};for(const n of Object.values(e.getTypeMap())){if(u(n)||r.has(n.name))continue;const o={name:n.name,description:n.description??void 0};m(n)?S(n)||t.scalars.push(o):T(n)?t.objects.push(o):g(n)?t.interfaces.push(o):b(n)?t.unions.push(o):v(n)?t.enums.push(o):y(n)&&t.inputs.push(o)}const i=new Set(O.map(n=>n.name));return t.directives=e.getDirectives().filter(n=>!i.has(n.name)).map(n=>({name:n.name,description:n.description??void 0})),t}function l(e){return e?Object.values(e.getFields()).map(r=>({name:r.name,description:r.description??void 0,type:r.type.toString(),args:r.args.length?`(${r.args.map(t=>{const i=t.astNode?.defaultValue?` = ${c(t.astNode.defaultValue)}`:"";return`${t.name}: ${t.type}${i}`}).join(", ")})`:void 0})):[]}function q(e,r,t){const i=h(e,t);if(!i)return[];const n=new Set([i,...x(e,i)]);return r.filter(o=>{if(!j.has(o.kind))return n.has(o.name);const s=a(e,o.name);return s?w(s).some(f=>n.has(f)):!1})}function F(e,r){const t=new Set,i=[...M(e,r)];for(let n=0;n<i.length;n+=1){const o=i[n];if(t.has(o))continue;t.add(o);const s=e.getType(o);if(s)for(const f of d(s))t.has(f)||i.push(f)}return[...t].filter(n=>n!==r&&D(e,n))}function M(e,r){const t=e.getType(r);if(t)return d(t);const i=a(e,r);if(i)return new Set(w(i));const n=e.getDirective(r);return n?new Set(n.args.map(o=>p(o.type).name)):new Set}function x(e,r){const t=new Map;for(const o of Object.values(e.getTypeMap()))if(!u(o))for(const s of d(o)){let f=t.get(s);f||(f=new Set,t.set(s,f)),f.add(o.name)}const i=new Set,n=[r];for(let o=0;o<n.length;o+=1)for(const s of t.get(n[o])??[])i.has(s)||(i.add(s),n.push(s));return i}function h(e,r){const t=r.toLowerCase();return Object.keys(e.getTypeMap()).find(i=>i.toLowerCase()===t)}function D(e,r){const t=e.getType(r);return!t||u(t)?!1:!(m(t)&&S(t))}function I(e,r){const t=e.getType(r);if(t)return N(t);const i=a(e,r);if(i?.astNode)return c(i.astNode);const n=e.getDirective(r);if(n?.astNode)return c(n.astNode);throw new Error(`No GraphQL type, operation, or directive named "${r}" found.`)}function L(e,r){const t=I(e,r),i=F(e,r).map(n=>e.getType(n)).filter(n=>!!n).map(n=>N(n));return{sdl:[t,...i].join(`
+import{getNamedType as u,isEnumType as j,isInputObjectType as d,isInterfaceType as p,isIntrospectionType as l,isObjectType as g,isScalarType as y,isSpecifiedScalarType as v,isUnionType as T,print as a,printType as L,specifiedDirectives as I}from"graphql";const D=new Set(["queries","mutations","subscriptions"]);function w(e){return e.toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)}function V(e,n){const t=n.toLowerCase(),r=e.find(s=>s.name.toLowerCase().includes(t));if(r)return r;const i=new Set(w(t));let o,f=0;for(const s of e){const c=w(s.name);c.length>f&&c.every(k=>i.has(k))&&(o=s,f=c.length)}return o}function m(e,n){return e.getQueryType()?.getFields()[n]??e.getMutationType()?.getFields()[n]??e.getSubscriptionType()?.getFields()[n]}function N(e){return[u(e.type).name,...(e.args??[]).map(n=>u(n.type).name)]}function S(e){const n=new Set;if(g(e)||p(e)){for(const t of Object.values(e.getFields())){n.add(u(t.type).name);for(const r of t.args)n.add(u(r.type).name)}for(const t of e.getInterfaces())n.add(t.name)}else if(T(e))for(const t of e.getTypes())n.add(t.name);else if(d(e))for(const t of Object.values(e.getFields()))n.add(u(t.type).name);return n}function O(e){return new Set([e.getQueryType(),e.getMutationType(),e.getSubscriptionType()].filter(n=>!!n).map(n=>n.name))}function A(e){const n=O(e),t={queries:b(e.getQueryType()),mutations:b(e.getMutationType()),subscriptions:b(e.getSubscriptionType()),objects:[],interfaces:[],unions:[],enums:[],inputs:[],scalars:[],directives:[]};for(const i of Object.values(e.getTypeMap())){if(l(i)||n.has(i.name))continue;const o=$(i);o&&t[o].push({name:i.name,description:i.description??void 0})}const r=new Set(I.map(i=>i.name));return t.directives=e.getDirectives().filter(i=>!r.has(i.name)).map(i=>({name:i.name,description:i.description??void 0})),t}function $(e){if(y(e))return v(e)?void 0:"scalars";if(g(e))return"objects";if(p(e))return"interfaces";if(T(e))return"unions";if(j(e))return"enums";if(d(e))return"inputs"}function F(e){return g(e)||p(e)||d(e)?e:void 0}function x(e){const n=e.astNode?.directives;return n?.length?n.map(t=>a(t)).join(" "):void 0}function b(e){return e?Object.values(e.getFields()).map(n=>({name:n.name,description:n.description??void 0,type:n.type.toString(),args:n.args.length?`(${n.args.map(t=>{const r=t.astNode?.defaultValue?` = ${a(t.astNode.defaultValue)}`:"";return`${t.name}: ${t.type}${r}`}).join(", ")})`:void 0,directives:x(n)})):[]}function G(e,n){const t=O(e),r=[];for(const i of Object.values(e.getTypeMap())){if(l(i)||t.has(i.name))continue;const o=F(i);if(!o)continue;const f=$(o);if(!(!f||n&&n!==f))for(const s of Object.values(o.getFields()))r.push({kind:f,name:`${o.name}.${s.name}`,description:s.description??void 0,type:s.type.toString(),directives:x(s)})}return r}function K(e,n){const t=n.toLowerCase();return e.name.toLowerCase().includes(t)||(e.description?.toLowerCase().includes(t)??!1)}function R(e,n){const t=n.indexOf(".");return t===-1?void 0:F(e.getType(n.slice(0,t)))?.getFields()[n.slice(t+1)]}function _(e,n,t){const r=B(e,t);if(!r)return[];const i=new Set([r,...q(e,r)]);return n.filter(o=>{if(o.name.includes(".")){const s=R(e,o.name);return s?N(s).some(c=>i.has(c)):!1}if(!D.has(o.kind))return i.has(o.name);const f=m(e,o.name);return f?N(f).some(s=>i.has(s)):!1})}function z(e,n){const t=new Set,r=[...M(e,n)];for(let i=0;i<r.length;i+=1){const o=r[i];if(t.has(o))continue;t.add(o);const f=e.getType(o);if(f)for(const s of S(f))t.has(s)||r.push(s)}return[...t].filter(i=>i!==n&&h(e,i))}function M(e,n){const t=e.getType(n);if(t)return S(t);const r=m(e,n);if(r)return new Set(N(r));const i=e.getDirective(n);return i?new Set(i.args.map(o=>u(o.type).name)):new Set}function q(e,n){const t=new Map;for(const o of Object.values(e.getTypeMap()))if(!l(o))for(const f of S(o)){let s=t.get(f);s||(s=new Set,t.set(f,s)),s.add(o.name)}const r=new Set,i=[n];for(let o=0;o<i.length;o+=1)for(const f of t.get(i[o])??[])r.has(f)||(r.add(f),i.push(f));return r}function B(e,n){const t=n.toLowerCase();return Object.keys(e.getTypeMap()).find(r=>r.toLowerCase()===t)}function h(e,n){const t=e.getType(n);return!t||l(t)?!1:!(y(t)&&v(t))}function C(e){return e.astNode?[e.astNode,...e.extensionASTNodes??[]].map(n=>a(n)).join(`
 
-`),referencedCount:i.length}}export{q as filterMembersReferencingType,C as findGraphqlSchemaByName,$ as groupSchemaTypes,I as printTypeOrField,L as printTypeOrFieldWithReferences,F as referencedTypeClosure};
+`):L(e)}function Q(e,n){const t=e.getType(n);if(t)return C(t);const r=m(e,n);if(r?.astNode)return a(r.astNode);const i=e.getDirective(n);if(i?.astNode)return a(i.astNode);throw new Error(`No GraphQL type, operation, or directive named "${n}" found.`)}function P(e,n){const t=[];for(const r of M(e,n)){if(r===n||!h(e,r))continue;const i=e.getType(r);g(i)?t.push(`type ${r} { ${Object.keys(i.getFields()).join(", ")} }`):p(i)?t.push(`interface ${r} { ${Object.keys(i.getFields()).join(", ")} }`):d(i)?t.push(`input ${r} { ${Object.keys(i.getFields()).join(", ")} }`):j(i)?t.push(`enum ${r} { ${i.getValues().map(o=>o.name).join(", ")} }`):T(i)?t.push(`union ${r} = ${i.getTypes().map(o=>o.name).join(" | ")}`):y(i)&&t.push(`scalar ${r}`)}return t}function U(e,n){const t=Q(e,n),r=z(e,n).map(i=>e.getType(i)).filter(i=>!!i).map(i=>C(i));return{sdl:[t,...r].join(`
+
+`),referencedCount:r.length}}export{G as fieldMembers,_ as filterMembersReferencingType,V as findGraphqlSchemaByName,A as groupSchemaTypes,K as matchesFilter,Q as printTypeOrField,U as printTypeOrFieldWithReferences,z as referencedTypeClosure,P as referencedTypeManifest};

package/dist/server/plugins/mcp/docs-mcp/tools/index.d.ts

@@ -1,4 +1,8 @@
 declare const _default: {
+    createAnonymousSession: {
+        execute: import("../../types.js").McpToolHandler<import("./core/create-anonymous-session.js").CreateAnonymousSessionArgs>;
+        isAvailable: typeof import("./core/create-anonymous-session.js").isAnonymousSessionToolAvailable;
+    };
     'list-apis': import("../../types.js").McpToolHandler<import("./openapi/types.js").ListApisArgs>;
     'get-endpoints': import("../../types.js").McpToolHandler<import("./openapi/types.js").ApiNameVersionArgs>;
     'get-endpoint-info': import("../../types.js").McpToolHandler<import("./openapi/types.js").GetEndpointInfoArgs>;

package/dist/server/plugins/mcp/docs-mcp/tools/index.js

@@ -1 +1 @@
-import r from"./openapi/list-apis.js";import o from"./openapi/get-endpoints.js";import t from"./openapi/get-endpoint-info.js";import m from"./openapi/get-security-schemes.js";import p from"./openapi/get-full-api-description.js";import i from"./core/search.js";import e from"./core/whoami.js";import f from"./graphql/list-graphql-apis.js";import l from"./graphql/get-graphql-type-list.js";import s from"./graphql/get-graphql-type.js";import a from"./graphql/get-graphql-schema.js";var E={...r,...o,...t,...m,...p,...i,...e,...f,...l,...s,...a};export{E as default};
+import o from"./openapi/list-apis.js";import r from"./openapi/get-endpoints.js";import t from"./openapi/get-endpoint-info.js";import m from"./openapi/get-security-schemes.js";import i from"./openapi/get-full-api-description.js";import p from"./core/search.js";import e from"./core/whoami.js";import f from"./core/create-anonymous-session.js";import s from"./graphql/list-graphql-apis.js";import a from"./graphql/get-graphql-type-list.js";import l from"./graphql/get-graphql-type.js";import n from"./graphql/get-graphql-schema.js";var w={...o,...r,...t,...m,...i,...p,...e,...f,...s,...a,...l,...n};export{w as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/load-api-description.d.ts

@@ -1,4 +1,4 @@
-import type { OpenAPIDefinition } from '@redocly/openapi-docs';
+import type { OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpToolContext } from '../../../types.js';
 export declare function loadApiDescription(name: string, context: McpToolContext, version?: string): Promise<OpenAPIDefinition>;
 //# sourceMappingURL=load-api-description.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.d.ts

@@ -1,4 +1,4 @@
-import type { OpenAPIDefinition, OpenAPIOperation } from '@redocly/openapi-docs';
+import type { OpenAPIDefinition, OpenAPIOperation } from '@redocly/api-docs';
 import type { ApiFunctionsUser, RbacConfig } from '@redocly/config';
 import type { McpEndpoint } from '../../../types';
 export declare function isMcpEndpoint(value: unknown): value is McpEndpoint;

package/dist/server/plugins/mcp/docs-mcp/utils.d.ts

@@ -1,4 +1,4 @@
-import type { OpenAPISchema, OpenAPIParameter, OpenAPIResponse, OpenAPIRequestBody, Referenced, OpenAPIDefinition } from '@redocly/openapi-docs/lib/types/open-api.js';
+import type { OpenAPISchema, OpenAPIParameter, OpenAPIResponse, OpenAPIRequestBody, Referenced, OpenAPIDefinition } from '@redocly/api-docs';
 import type { ApiDescriptionInfo } from '../types.js';
 export declare function findApiDescriptionByNameAndVersion(apiDescriptionsMap: Record<string, ApiDescriptionInfo>, name: string, version?: string): ApiDescriptionInfo | undefined;
 export declare function filterApiDescriptionsByName(apiDescriptionsMap: ApiDescriptionInfo[], filter: string): ApiDescriptionInfo[];

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -1,5 +1,6 @@
 import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
 import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
+import type { KvService } from '@redocly/config';
 export declare const ELICITATION_TIMEOUT_MS = 300000;
 export type SendElicitRequest = (request: object, resultSchema: unknown, options: {
     timeout: number;
@@ -14,12 +15,13 @@ export type ElicitationOutcome = {
 } | {
     status: 'skipped';
 };
-export declare function runUpstreamCredentialElicitation({ sendRequest, clientSupportsElicitation, sessionId, baseUrl, events, auth, }: {
+export declare function runUpstreamCredentialElicitation({ sendRequest, clientSupportsElicitation, subject, baseUrl, events, auth, kv, }: {
     sendRequest: SendElicitRequest;
     clientSupportsElicitation: boolean;
-    sessionId: string;
+    subject: string;
     baseUrl: string;
     events: UpstreamAuthRequiredEvent[];
     auth: UpstreamAuthScheme;
+    kv: KvService;
 }): Promise<ElicitationOutcome>;
 //# sourceMappingURL=elicitation.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,2 +1,2 @@
-import{ElicitResultSchema as m}from"@redocly/mcp-typescript-sdk/types.js";import{logger as d}from"../../../tools/notifiers/logger.js";import{secretStore as p,ELICITATION_TTL_MS as h}from"./secret-store.js";const f=3e5;async function $({sendRequest:e,clientSupportsElicitation:t,sessionId:r,baseUrl:i,events:n,auth:s}){const a=n[0],l=p.createElicitation({sessionId:r,api:a.api,name:a.name,auth:s}),c=g(i,l);if(!t)return{status:"fallback",text:u(n,c)};try{return(await e({method:"elicitation/create",params:{mode:"url",message:`The "${a.name}" API requires credentials. Open the link to provide them securely; they never pass through the chat.`,url:c,elicitationId:l}},m,{timeout:f})).action==="accept"?{status:"accepted"}:{status:"skipped"}}catch(o){return d.warn(`URL-mode elicitation failed, falling back to markdown link: ${o instanceof Error?o.message:String(o)}`),{status:"fallback",text:u(n,c)}}}function g(e,t){if(!e)return`/mcp/credentials?token=${t}`;try{const r=new URL("/mcp/credentials",e);return r.searchParams.set("token",t),r.toString()}catch{return`${e}/mcp/credentials?token=${t}`}}function u(e,t){const[r,...i]=e,n=[`The upstream API "${r.name}" returned 401 Unauthorized.`,"",`**Action required: show the user the link below and ask them to open it in a browser to provide the API credentials (valid ${Math.round(h/6e4)} minutes):**`,"",t,"","Then call this tool again - the credentials are applied server-side and never appear in the conversation."];if(i.length>0){const s=i.map(a=>`"${a.name}"`).join(", ");n.push("",`The remaining APIs (${s}) will prompt for credentials on subsequent calls.`)}return n.join(`
-`)}export{f as ELICITATION_TIMEOUT_MS,$ as runUpstreamCredentialElicitation};
+import{ElicitResultSchema as p}from"@redocly/mcp-typescript-sdk/types.js";import{logger as f}from"../../../tools/notifiers/logger.js";import{secretStore as g,ELICITATION_TTL_MS as T}from"./secret-store.js";import{ANONYMOUS_SUBJECT_PREFIX as h}from"./subject.js";const I=3e5;async function A({sendRequest:t,clientSupportsElicitation:n,subject:e,baseUrl:s,events:r,auth:a,kv:c}){const i=e.startsWith(h)?e.slice(h.length):void 0,l=r[0],u=await g.createElicitation(c,{subject:e,api:l.api,name:l.name,auth:a}),d=k(s,u);if(!n)return{status:"fallback",text:m(r,d,i)};try{return(await t({method:"elicitation/create",params:{mode:"url",message:`The "${l.name}" API requires credentials. Open the link to provide them securely; they never pass through the chat.`,url:d,elicitationId:u}},p,{timeout:I})).action==="accept"?{status:"accepted"}:{status:"skipped"}}catch(o){return f.warn(`URL-mode elicitation failed, falling back to markdown link: ${o instanceof Error?o.message:String(o)}`),{status:"fallback",text:m(r,d,i)}}}function k(t,n){if(!t)return`/mcp/credentials?token=${n}`;try{const e=new URL("/mcp/credentials",t);return e.searchParams.set("token",n),e.toString()}catch{return`${t}/mcp/credentials?token=${n}`}}function m(t,n,e){const[s,...r]=t,a=[`The upstream API "${s.name}" returned 401 Unauthorized.`,"",`**Action required: show the user the link below and ask them to open it in a browser to provide the API credentials (valid ${Math.round(T/6e4)} minutes):**`,"",n,"",e?`Then call this tool again with sessionHandle: "${e}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Then call this tool again - the credentials are applied server-side and never appear in the conversation."];if(r.length>0){const c=r.map(i=>`"${i.name}"`).join(", ");a.push("",`The remaining APIs (${c}) will prompt for credentials on subsequent calls.`)}return a.join(`
+`)}export{I as ELICITATION_TIMEOUT_MS,A as runUpstreamCredentialElicitation};

package/dist/server/plugins/mcp/gateway-mcp/eligibility.d.ts

@@ -1,5 +1,4 @@
-import type { OpenAPIDefinition } from '@redocly/openapi-docs';
-import type { OpenAPIMcp } from '@redocly/openapi-docs/lib/types/open-api.js';
+import type { OpenAPIDefinition, OpenAPIMcp } from '@redocly/api-docs';
 import type { RbacConfig, RedoclyConfig } from '@redocly/config';
 /** Whether the gateway fetch capability is on: the feature flag plus none of mcp/docs hidden. */
 export declare function isGatewayCapabilityEnabled(mcp?: RedoclyConfig['mcp']): boolean;

package/dist/server/plugins/mcp/gateway-mcp/fetch/allowed-hosts.d.ts

@@ -1,4 +1,4 @@
-import type { OpenAPIServer } from '@redocly/openapi-docs/lib/types/open-api.js';
+import type { OpenAPIServer } from '@redocly/api-docs';
 /**
  * Build case-insensitive host matchers from an API's server URL templates. A server URL host
  * may contain server-variable placeholders (e.g. a tenant `{subdomain}`); each placeholder

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.d.ts

@@ -2,7 +2,7 @@ import { Agent, type Dispatcher } from 'undici';
 import type { SandboxFetch } from '../../codemode/types.js';
 import type { UpstreamAuthRequiredEvent } from '../upstream-auth.js';
 import type { StoredSecret } from '../secret-store.js';
-export declare const ssrfSafeAgent: Agent;
+export declare function getDefaultAgent(): Agent;
 export type FetchBridgeApi = {
     slug: string;
     name: string;
@@ -18,9 +18,11 @@ type FetchBridgeOptions = {
     dispatcher?: Dispatcher;
     timeoutMs?: number;
     maxResponseBytes?: number;
+    maxFetchesPerExec?: number;
+    clientIp?: string;
 };
 /** Build the host-side `fetch` the gateway sandbox calls. */
-export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, }: FetchBridgeOptions): SandboxFetch;
+export declare function buildFetchBridge({ allowedHosts, apis, authorization, onAuthRequired, fetchImpl, dispatcher, timeoutMs, maxResponseBytes, maxFetchesPerExec, clientIp, }: FetchBridgeOptions): SandboxFetch;
 export declare function readCappedBody(response: Response, maxBytes: number): Promise<string>;
 export {};
 //# sourceMappingURL=fetch-bridge.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -1 +1 @@
-import{Agent as y}from"undici";import{assertUrlAllowed as T}from"./ssrf-guard.js";import{createSsrfSafeLookup as E}from"./ssrf-safe-lookup.js";const A=3e4,L=1024*1024,S=new y({connect:{lookup:E()}});function F({allowedHosts:t,apis:e=[],authorization:r,onAuthRequired:o,fetchImpl:c=fetch,dispatcher:n=S,timeoutMs:d=A,maxResponseBytes:i=L}){const a=[...t,...e.flatMap(l=>l.matchers)];return async l=>{const h=T(l.url,a),m=e.filter(s=>s.matchers.some(f=>f.test(h.hostname))),u=m.length===1?m[0]:void 0,b=v(l.headers,u?.secret,r),g=new AbortController,p=setTimeout(()=>g.abort(),d);try{const s=await c(h,{method:l.method??"GET",headers:b,body:l.body,redirect:"manual",signal:g.signal,dispatcher:n});s.status===401&&u&&o&&o({api:u.slug,name:u.name});const f=await k(s,i);return{status:s.status,statusText:s.statusText,ok:s.ok,headers:_(s.headers),bodyText:f}}finally{clearTimeout(p)}}}async function k(t,e){const r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw w(e,r);if(!t.body)return"";const o=t.body.getReader(),c=new TextDecoder;let n=0,d="";try{for(;;){const{done:i,value:a}=await o.read();if(i)break;if(n+=a.byteLength,n>e)throw w(e,n);d+=c.decode(a,{stream:!0})}return d+c.decode()}finally{await o.cancel().catch(()=>{})}}function w(t,e){return new Error(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function v(t,e,r){const o={},c=new Set;for(const[d,i]of Object.entries(t??{})){const a=d.toLowerCase();a==="host"||a==="content-length"||(c.add(a),o[d]=i)}const n=e??(r?{header:"Authorization",value:r}:void 0);return n&&!c.has(n.header.toLowerCase())&&(o[n.header]=n.value),o}function _(t){const e={};return t.forEach((r,o)=>{e[o.toLowerCase()]=r}),e}export{F as buildFetchBridge,k as readCappedBody,S as ssrfSafeAgent};
+import{Agent as j}from"undici";import{envConfig as P}from"../../../../config/env-config.js";import{logger as _}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as C}from"./ssrf-guard.js";import{createSsrfSafeLookup as W}from"./ssrf-safe-lookup.js";import{SsrfBlockedError as H}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as U,GatewayFetchSystemError as J,GatewayFetchUserError as L}from"./fetch-errors.js";import{redactHeaders as $,redactSecretsFromString as K}from"./redact.js";import{reportGatewayFetch as x}from"./fetch-telemetry.js";const O="x-forwarded-for",V=3e4,X=1024*1024;let A;function Y(){if(!A){const t=P.isDevelopMode;t&&_.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),A=new j({connect:{lookup:W({allowLoopback:t})}})}return A}function he({allowedHosts:t,apis:e=[],authorization:r,onAuthRequired:n,fetchImpl:s=fetch,dispatcher:d=Y(),timeoutMs:c=V,maxResponseBytes:h=X,maxFetchesPerExec:f,clientIp:m}){const k=[...t,...e.flatMap(o=>o.matchers)],B=[r,...e.map(o=>o.secret?.value)].filter(o=>!!o),v=e.map(o=>o.secret?.header).filter(o=>!!o);let D=0;return async o=>{const g=o.method??"GET",T=Date.now();let F,b,E={},M,S;try{if(f!==void 0){const l=Math.max(0,f);if(D+=1,D>l)throw new L(`Outbound fetch budget exceeded (max ${l} fetches per execute); split the work across calls`)}const u=C(o.url,k);F=u.hostname;const y=e.filter(l=>l.matchers.some(N=>N.test(u.hostname))),a=y.length===1?y[0]:void 0;b=a?.slug,E=re(o.headers,a?.secret,r,m);const w=new AbortController;S=setTimeout(()=>w.abort(),c);const i=await s(u,{method:g,headers:E,body:o.body,redirect:"manual",signal:w.signal,dispatcher:d});M=i.status,i.status===401&&a&&n&&n({api:a.slug,name:a.name});const R=await te(i,h);let p=oe(i.headers);if(z(i.status)){p=$(p,v);const{location:l}=p;l&&!q(l,u,k)&&delete p.location}return x({host:u.hostname,method:g,outcome:"success",durationMs:Date.now()-T,api:b,status:i.status,bytes:Buffer.byteLength(R,"utf8")}),{status:i.status,statusText:i.statusText,ok:i.ok,headers:p,bodyText:R}}catch(u){const{outcome:y,userSafe:a}=Q(u),w=F??(a instanceof U?a.host:void 0)??Z(o.url)??"invalid-url";throw x({host:w,method:g,outcome:y,durationMs:Date.now()-T,api:b,status:M}),a||(_.error(`Gateway MCP fetch failed [${g} ${w}]: ${K(ee(u),B)} headers=${JSON.stringify($(E,v))}`),new J("Upstream fetch failed due to an internal error"))}finally{S!==void 0&&clearTimeout(S)}}}function I(t){let e=t;for(let r=0;r<5&&e instanceof Error;r++){if(e instanceof L||e instanceof H)return e;e=e.cause}}function Q(t){const e=I(t);return{outcome:e instanceof U||e instanceof H?"blocked":e?"user_error":"system_error",userSafe:e}}function Z(t){try{return new URL(t).hostname||void 0}catch{return}}function z(t){return t>=300&&t<400}function q(t,e,r){try{return!!C(new URL(t,e).href,r)}catch{return!1}}function ee(t){if(!(t instanceof Error))return String(t);const e=t.cause;return e instanceof Error?`${t.message}: ${e.message}`:t.message}async function te(t,e){const r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw G(e,r);if(!t.body)return"";const n=t.body.getReader(),s=new TextDecoder;let d=0,c="";try{for(;;){const{done:h,value:f}=await n.read();if(h)break;if(d+=f.byteLength,d>e)throw G(e,d);c+=s.decode(f,{stream:!0})}return c+s.decode()}finally{await n.cancel().catch(()=>{})}}function G(t,e){return new L(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function re(t,e,r,n){const s={},d=new Set;for(const[h,f]of Object.entries(t??{})){const m=h.toLowerCase();m==="host"||m==="content-length"||m!==O&&(d.add(m),s[h]=f)}n&&(s[O]=n);const c=e??(r?{header:"Authorization",value:r}:void 0);return c&&!d.has(c.header.toLowerCase())&&(s[c.header]=c.value),s}function oe(t){const e={};return t.forEach((r,n)=>{e[n.toLowerCase()]=r}),e}export{he as buildFetchBridge,Y as getDefaultAgent,te as readCappedBody};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-errors.d.ts

@@ -0,0 +1,11 @@
+export declare class GatewayFetchUserError extends Error {
+    constructor(message: string);
+}
+export declare class GatewayFetchBlockedError extends GatewayFetchUserError {
+    readonly host?: string;
+    constructor(message: string, host?: string);
+}
+export declare class GatewayFetchSystemError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=fetch-errors.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-errors.js

@@ -0,0 +1 @@
+class s extends Error{constructor(r){super(r),this.name="GatewayFetchUserError"}}class o extends s{host;constructor(r,t){super(r),this.name="GatewayFetchBlockedError",this.host=t}}class a extends Error{constructor(r){super(r),this.name="GatewayFetchSystemError"}}export{o as GatewayFetchBlockedError,a as GatewayFetchSystemError,s as GatewayFetchUserError};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-telemetry.d.ts

@@ -0,0 +1,13 @@
+export type GatewayFetchOutcome = 'success' | 'blocked' | 'user_error' | 'system_error';
+type GatewayFetchEvent = {
+    host: string;
+    method: string;
+    outcome: GatewayFetchOutcome;
+    durationMs: number;
+    api?: string;
+    status?: number;
+    bytes?: number;
+};
+export declare function reportGatewayFetch({ host, method, outcome, durationMs, api, status, bytes, }: GatewayFetchEvent): void;
+export {};
+//# sourceMappingURL=fetch-telemetry.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-telemetry.js

@@ -0,0 +1 @@
+import{telemetry as t}from"../../../../telemetry/index.js";import{logger as m}from"../../../../tools/notifiers/logger.js";import{McpServerType as c}from"../../constants.js";import{serverAttributes as p}from"../../utils/telemetry-attributes.js";function g({host:d,method:f,outcome:o,durationMs:i,api:e,status:r,bytes:n}){t.sendMcpGatewayFetchPerformedMessage([{...p(c.Docs),host:d,method:f,outcome:o,...e!==void 0&&{api:e},...r!==void 0&&{status:r},...n!==void 0&&{bytes:n},duration_ms:i}]),m.info(`Gateway MCP fetch [${f} ${d}] outcome=${o}`+(e!==void 0?` api=${e}`:"")+(r!==void 0?` status=${r}`:"")+(n!==void 0?` bytes=${n}`:"")+` durationMs=${i}`)}export{g as reportGatewayFetch};

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.d.ts

@@ -0,0 +1,4 @@
+export declare const REDACTED = "\u00AB[redacted]\u00BB";
+export declare function redactSecretsFromString(text: string, secretValues: readonly string[]): string;
+export declare function redactHeaders(headers: Record<string, string>, extraSensitiveNames?: readonly string[]): Record<string, string>;
+//# sourceMappingURL=redact.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/redact.js

@@ -0,0 +1 @@
+const s="\xAB[redacted]\xBB",c=["authorization","proxy-authorization","cookie","set-cookie"];function a(r,n){let t=r;for(const e of n)e.trim()&&(t=t.split(e).join(s));return t}function u(r,n=[]){const t=new Set([...c,...n].map(o=>o.toLowerCase())),e={};for(const[o,i]of Object.entries(r))e[o]=t.has(o.toLowerCase())?s:i;return e}export{s as REDACTED,u as redactHeaders,a as redactSecretsFromString};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-blocklist.d.ts

@@ -2,9 +2,21 @@ export declare class SsrfBlockedError extends Error {
     code: string;
     constructor(message: string);
 }
+/**
+ * If `ip` is an IPv4-mapped IPv6 address (`::ffff:0:0/96`), returns the
+ * embedded IPv4 in dotted form. Otherwise returns undefined.
+ *
+ * Examples:
+ * - `::ffff:1.2.3.4`   -> `'1.2.3.4'`
+ * - `::ffff:a9fe:a9fe` -> `'169.254.169.254'`
+ * - `::1`              -> `undefined`
+ */
+export declare function extractMappedIpv4(ip: string): string | undefined;
 /**
  * True if `ip` (a literal IPv4/IPv6 string) is in a range unsafe to reach. Non-IP input is
  * treated as blocked (fail closed). Handles IPv4-mapped IPv6 by checking the embedded IPv4.
  */
 export declare function isBlockedIp(ip: string): boolean;
+/** True if `ip` (a literal IPv4/IPv6 string) is a loopback address. Non-IP input returns false. */
+export declare function isLoopback(ip: string): boolean;
 //# sourceMappingURL=ssrf-blocklist.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-blocklist.js

@@ -1 +1 @@
-import{BlockList as l,isIP as i}from"node:net";class E extends Error{code="SSRF_BLOCKED";constructor(t){super(t),this.name="SsrfBlockedError"}}const x=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4],["255.255.255.255",32]],h=[["::",128],["::1",128],["64:ff9b::",96],["64:ff9b:1::",48],["100::",64],["2001::",32],["2001:db8::",32],["2002::",16],["fc00::",7],["fe80::",10],["fec0::",10],["ff00::",8]],c=(()=>{const n=new l;for(const[t,r]of x)n.addSubnet(t,r,"ipv4");for(const[t,r]of h)n.addSubnet(t,r,"ipv6");return n})();function m(n){if(i(n)!==6)return;const t=S(n);if(!(t.length===8&&t[0]===0&&t[1]===0&&t[2]===0&&t[3]===0&&t[4]===0&&t[5]===65535))return;const e=t[6]??0,f=t[7]??0;return[e>>8&255,e&255,f>>8&255,f&255].join(".")}function S(n){const r=n.replace(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,(s,d,p,u,a)=>`:${((+d&255)<<8|+p&255).toString(16)}:${((+u&255)<<8|+a&255).toString(16)}`).split("::");if(r.length>2)return[];const e=r[0]?r[0].split(":"):[],f=r[1]?r[1].split(":"):[],o=r.length===2?8-e.length-f.length:0;return o<0?[]:[...e,...Array(o).fill("0"),...f].map(s=>Number.parseInt(s,16))}function B(n){const t=i(n);if(t===0||c.check(n,t===4?"ipv4":"ipv6"))return!0;if(t===6){const r=m(n);if(r&&c.check(r,"ipv4"))return!0}return!1}export{E as SsrfBlockedError,B as isBlockedIp};
+import{BlockList as c,isIP as o}from"node:net";class g extends Error{code="SSRF_BLOCKED";constructor(t){super(t),this.name="SsrfBlockedError"}}const m=[["0.0.0.0",8],["10.0.0.0",8],["100.64.0.0",10],["127.0.0.0",8],["169.254.0.0",16],["172.16.0.0",12],["192.0.0.0",24],["192.0.2.0",24],["192.168.0.0",16],["198.18.0.0",15],["198.51.100.0",24],["203.0.113.0",24],["224.0.0.0",4],["240.0.0.0",4],["255.255.255.255",32]],S=[["::",128],["::1",128],["64:ff9b::",96],["64:ff9b:1::",48],["100::",64],["2001::",32],["2001:db8::",32],["2002::",16],["fc00::",7],["fe80::",10],["fec0::",10],["ff00::",8]],d=(()=>{const r=new c;for(const[t,e]of m)r.addSubnet(t,e,"ipv4");for(const[t,e]of S)r.addSubnet(t,e,"ipv6");return r})(),p=(()=>{const r=new c;return r.addSubnet("127.0.0.0",8,"ipv4"),r.addAddress("::1","ipv6"),r})();function u(r){if(o(r)!==6)return;const t=v(r);if(!(t.length===8&&t[0]===0&&t[1]===0&&t[2]===0&&t[3]===0&&t[4]===0&&t[5]===65535))return;const n=t[6]??0,f=t[7]??0;return[n>>8&255,n&255,f>>8&255,f&255].join(".")}function v(r){const e=r.replace(/:(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,(i,a,l,x,h)=>`:${((+a&255)<<8|+l&255).toString(16)}:${((+x&255)<<8|+h&255).toString(16)}`).split("::");if(e.length>2)return[];const n=e[0]?e[0].split(":"):[],f=e[1]?e[1].split(":"):[],s=e.length===2?8-n.length-f.length:0;return s<0?[]:[...n,...Array(s).fill("0"),...f].map(i=>Number.parseInt(i,16))}function B(r){const t=o(r);if(t===0||d.check(r,t===4?"ipv4":"ipv6"))return!0;if(t===6){const e=u(r);if(e&&d.check(e,"ipv4"))return!0}return!1}function _(r){const t=o(r);if(t===0)return!1;if(p.check(r,t===4?"ipv4":"ipv6"))return!0;if(t===6){const e=u(r);if(e&&p.check(e,"ipv4"))return!0}return!1}export{g as SsrfBlockedError,u as extractMappedIpv4,B as isBlockedIp,_ as isLoopback};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-guard.js

@@ -1 +1 @@
-import{isIP as n}from"node:net";import{isHostAllowed as l}from"./allowed-hosts.js";import{isBlockedIp as i}from"./ssrf-blocklist.js";function w(r,t){let o;try{o=new URL(r)}catch{throw new Error(`Invalid URL: ${r}`)}if(o.protocol!=="http:"&&o.protocol!=="https:")throw new Error(`Only http(s) URLs are allowed, got ${o.protocol}`);if(o.username||o.password)throw new Error("URLs must not contain embedded credentials");const e=s(o.hostname);if(c(e)||!l(e,t))throw new Error(`Host "${e}" is not allowed`);return o}function c(r){const t=s(r.toLowerCase()).split("%")[0];return t==="localhost"||t.endsWith(".localhost")?!0:n(t)!==0?i(t):!1}function s(r){return r.replace(/^\[|\]$/g,"")}export{w as assertUrlAllowed,c as isBlockedAddress};
+import{isIP as l}from"node:net";import{isHostAllowed as i}from"./allowed-hosts.js";import{isBlockedIp as a}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as c,GatewayFetchUserError as s}from"./fetch-errors.js";function m(o,r){let t;try{t=new URL(o)}catch{throw new s(`Invalid URL: ${o}`)}if(t.protocol!=="http:"&&t.protocol!=="https:")throw new s(`Only http(s) URLs are allowed, got ${t.protocol}`);if(t.username||t.password)throw new s("URLs must not contain embedded credentials");const e=n(t.hostname);if(d(e)||!i(e,r))throw new c(`Host "${e}" is not allowed`,e);return t}function d(o){const r=n(o.toLowerCase()).split("%")[0];return r==="localhost"||r.endsWith(".localhost")?!0:l(r)!==0?a(r):!1}function n(o){return o.replace(/^\[|\]$/g,"")}export{m as assertUrlAllowed,d as isBlockedAddress};

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-safe-lookup.d.ts

@@ -7,5 +7,7 @@ import { type LookupFunction } from 'node:net';
  * so that every socket connection — including those made while following redirects — is re-validated
  * against the blocklist at connect time.
  */
-export declare function createSsrfSafeLookup(): LookupFunction;
+export declare function createSsrfSafeLookup({ allowLoopback, }?: {
+    allowLoopback?: boolean;
+}): LookupFunction;
 //# sourceMappingURL=ssrf-safe-lookup.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/ssrf-safe-lookup.js

@@ -1 +1 @@
-import{lookup as $}from"node:dns";import{isIP as v}from"node:net";import{isBlockedIp as l,SsrfBlockedError as n}from"./ssrf-blocklist.js";function S(){return(r,p,o)=>{const f=p,s=t=>{if(f.all){o(null,t);return}const[e]=t;if(!e){o(new n(`Hostname "${r}" did not resolve`),"",0);return}o(null,e.address,e.family)},u=v(r);if(u!==0){if(l(r)){o(new n(`Hostname "${r}" is a blocked address`),"",0);return}s([{address:r,family:u}]);return}$(r,{...f,all:!0},(t,e)=>{if(t){o(t,"",0);return}const d=e.filter(({address:i})=>l(i));if(d.length>0){const i=d.map(({address:m})=>m).join(", ");o(new n(`Hostname "${r}" resolves to a blocked address: ${i}`),"",0);return}if(!e.length){o(new n(`Hostname "${r}" did not resolve`),"",0);return}s(e)})}}export{S as createSsrfSafeLookup};
+import{lookup as c}from"node:dns";import{isIP as k}from"node:net";import{isBlockedIp as v,isLoopback as w,SsrfBlockedError as n}from"./ssrf-blocklist.js";function L({allowLoopback:p=!1}={}){const f=o=>v(o)&&!(p&&w(o));return(o,m,r)=>{const s=m,l=t=>{if(s.all){r(null,t);return}const[e]=t;if(!e){r(new n(`Hostname "${o}" did not resolve`),"",0);return}r(null,e.address,e.family)},u=k(o);if(u!==0){if(f(o)){r(new n(`Hostname "${o}" is a blocked address`),"",0);return}l([{address:o,family:u}]);return}c(o,{...s,all:!0},(t,e)=>{if(t){r(t,"",0);return}const d=e.filter(({address:i})=>f(i));if(d.length>0){const i=d.map(({address:$})=>$).join(", ");r(new n(`Hostname "${o}" resolves to a blocked address: ${i}`),"",0);return}if(!e.length){r(new n(`Hostname "${o}" did not resolve`),"",0);return}l(e)})}}export{L as createSsrfSafeLookup};

package/dist/server/plugins/mcp/gateway-mcp/fetch-capability.js

@@ -1 +1 @@
-import{buildAllowedHostMatchers as i}from"./fetch/allowed-hosts.js";import{buildFetchBridge as l}from"./fetch/fetch-bridge.js";function a(e){return Object.values(e.apiDescriptionsMap??{}).filter(r=>r.fetchEligible)}function n(e){return a(e).length>0}function c(e,r){const s=a(e).map(t=>({slug:t.relativePath,name:t.name,matchers:i(t.servers??[]),secret:e.upstreamSecrets?.[t.relativePath]}));return l({allowedHosts:i([]),apis:s,authorization:e.upstreamAuthorization,onAuthRequired:r})}export{c as buildExecuteHostFetch,a as getCallableApis,n as isFetchCapable};
+import{buildAllowedHostMatchers as a}from"./fetch/allowed-hosts.js";import{buildFetchBridge as s}from"./fetch/fetch-bridge.js";function i(e){return Object.values(e.apiDescriptionsMap??{}).filter(r=>r.fetchEligible)}function u(e){return i(e).length>0}function n(e,r){const l=i(e).map(t=>({slug:t.relativePath,name:t.name,matchers:a(t.servers??[]),secret:e.upstreamSecrets?.[t.relativePath]}));return s({allowedHosts:a([]),apis:l,authorization:e.upstreamAuthorization,onAuthRequired:r,maxFetchesPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp})}export{n as buildExecuteHostFetch,i as getCallableApis,u as isFetchCapable};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/apply-edge-rate-limit.d.ts

@@ -0,0 +1,3 @@
+import type { Store } from '../../../../store.js';
+export declare function applyEdgeRateLimit(request: Request, store: Store): Promise<Response | undefined>;
+//# sourceMappingURL=apply-edge-rate-limit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/apply-edge-rate-limit.js

@@ -0,0 +1 @@
+import{CacheService as a}from"../../../../persistence/cache/services/cache-service.js";import{logger as o}from"../../../../tools/notifiers/logger.js";import{ipRateLimitKey as s}from"./ip-key.js";import{checkEdgeRateLimit as c}from"./edge-limiter.js";import{resolveGatewayFetchLimits as d}from"./limits.js";async function g(i,n){const r=s(i);if(!r)return;let e;try{const t=await a.getInstance({baseDbDir:n.serverOutDir,databaseType:"local"});e=await c({cache:t,ip:r,limits:d(),now:Date.now()})}catch(t){o.warn(`gateway rate-limit init error, failing open: ${String(t)}`);return}if(!e.allowed)return new Response(JSON.stringify({jsonrpc:"2.0",error:{code:-32029,message:`Rate limit exceeded (${e.scope}); retry after ${e.retryAfterSeconds}s`},id:null}),{status:429,headers:{"Content-Type":"application/json","Retry-After":String(e.retryAfterSeconds)}})}export{g as applyEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/edge-limiter.d.ts

@@ -0,0 +1,16 @@
+import type { CacheService } from '../../../../persistence/cache/services/cache-service.js';
+import type { GatewayFetchLimits } from './limits.js';
+export type EdgeDecision = {
+    allowed: true;
+} | {
+    allowed: false;
+    retryAfterSeconds: number;
+    scope: 'rate' | 'quota';
+};
+export declare function checkEdgeRateLimit(params: {
+    cache: CacheService;
+    ip: string;
+    limits: GatewayFetchLimits;
+    now: number;
+}): Promise<EdgeDecision>;
+//# sourceMappingURL=edge-limiter.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/edge-limiter.js

@@ -0,0 +1 @@
+import{checkAndIncrement as a}from"./window-counter.js";const s=60,d=86400;async function w(i){const{cache:e,ip:t,limits:o,now:r}=i,n=await a({cache:e,ip:t,windowSeconds:s,limit:o.ratePerMin,now:r});if(!n.allowed)return{allowed:!1,retryAfterSeconds:n.retryAfterSeconds,scope:"rate"};const c=await a({cache:e,ip:t,windowSeconds:d,limit:o.quotaPerDay,now:r});return c.allowed?{allowed:!0}:{allowed:!1,retryAfterSeconds:c.retryAfterSeconds,scope:"quota"}}export{w as checkEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/ip-key.d.ts

@@ -0,0 +1,2 @@
+export declare function ipRateLimitKey(req: Request): string | undefined;
+//# sourceMappingURL=ip-key.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/ip-key.js

@@ -0,0 +1 @@
+import{isIP as l}from"node:net";import{getFeedbackClientIp as a}from"../../../../web-server/utils/feedback-ip.js";import{extractMappedIpv4 as c}from"../fetch/ssrf-blocklist.js";function I(t){const n=a(t);if(n)return f(n)}function f(t){if(l(t)===6){const n=c(t);return n||`${u(t)}::/64`}return t}function u(t){const n=t.split("%")[0],[e,i=""]=n.split("::"),r=e?e.split(":"):[],o=i?i.split(":"):[],s=8-r.length-o.length;return[...r,...Array(Math.max(0,s)).fill("0"),...o].slice(0,4).map(p=>parseInt(p||"0",16).toString(16)).join(":")}export{I as ipRateLimitKey};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/limits.d.ts

@@ -0,0 +1,7 @@
+export type GatewayFetchLimits = {
+    ratePerMin: number;
+    quotaPerDay: number;
+    budgetPerExec: number;
+};
+export declare function resolveGatewayFetchLimits(): GatewayFetchLimits;
+//# sourceMappingURL=limits.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/limits.js

@@ -0,0 +1 @@
+import{EntitlementsProvider as u}from"../../../../entitlements/entitlements-provider.js";import{FEATURE as r,GATEWAY_FETCH_LIMIT_DEFAULTS as a}from"../../../../../constants/common.js";function n(e,i,o){const t=e.entitlements?.[i];return typeof t=="number"&&Number.isFinite(t)?t:o}function P(){const e=u.instance();return{ratePerMin:n(e,r.gatewayFetchRatePerMin,a.ratePerMin),quotaPerDay:n(e,r.gatewayFetchQuotaPerDay,a.quotaPerDay),budgetPerExec:n(e,r.gatewayFetchBudgetPerExec,a.budgetPerExec)}}export{P as resolveGatewayFetchLimits};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/window-counter.d.ts

@@ -0,0 +1,15 @@
+import type { CacheService } from '../../../../persistence/cache/services/cache-service.js';
+export type WindowCheck = {
+    allowed: false;
+    retryAfterSeconds: number;
+} | {
+    allowed: true;
+};
+export declare function checkAndIncrement(params: {
+    cache: CacheService;
+    ip: string;
+    windowSeconds: number;
+    limit: number;
+    now: number;
+}): Promise<WindowCheck>;
+//# sourceMappingURL=window-counter.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/window-counter.js

@@ -0,0 +1 @@
+import{logger as f}from"../../../../tools/notifiers/logger.js";const s="gateway-fetch-rl";async function m(i){const{cache:e,ip:l,windowSeconds:t,limit:w,now:d}=i,n=Math.floor(d/1e3),o=Math.floor(n/t),r=`${l}:${t}:${o}`;try{const a=(await e.get({key:r,namespace:s}))?.count??0;if(a>=w){const u=(o+1)*t-n;return{allowed:!1,retryAfterSeconds:Math.max(1,u)}}return await e.set({key:r,namespace:s,value:{count:a+1},ttlInSeconds:t}),{allowed:!0}}catch(c){return f.warn(`gateway rate-limit store error, failing open: ${String(c)}`),{allowed:!0}}}export{m as checkAndIncrement};

package/dist/server/plugins/mcp/gateway-mcp/secret-store.d.ts

@@ -1,3 +1,4 @@
+import type { KvService } from '@redocly/config';
 import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
 export declare const ELICITATION_TTL_MS: number;
 export type StoredSecret = {
@@ -5,20 +6,19 @@ export type StoredSecret = {
     value: string;
 };
 export type ElicitationTarget = {
-    sessionId: string;
+    subject: string;
     api: string;
     name: string;
     auth: UpstreamAuthScheme;
 };
 export declare class SecretStore {
     #private;
-    constructor();
-    setSecret(sessionId: string, api: string, secret: StoredSecret): void;
-    getSecretsForSession(sessionId: string): Record<string, StoredSecret>;
-    deleteSession(sessionId: string): void;
-    createElicitation(target: ElicitationTarget): string;
-    peekElicitation(token: string): ElicitationTarget | undefined;
-    consumeElicitation(token: string): ElicitationTarget | undefined;
+    setSecret(kv: KvService, subject: string, api: string, secret: StoredSecret): Promise<void>;
+    getSecretsForSubject(kv: KvService, subject: string): Promise<Record<string, StoredSecret>>;
+    deleteSubject(kv: KvService, subject: string): Promise<void>;
+    createElicitation(kv: KvService, target: ElicitationTarget): Promise<string>;
+    peekElicitation(kv: KvService, token: string): Promise<ElicitationTarget | undefined>;
+    consumeElicitation(kv: KvService, token: string): Promise<ElicitationTarget | undefined>;
 }
 export declare const secretStore: SecretStore;
 //# sourceMappingURL=secret-store.d.ts.map