@redocly/realm 0.136.0-next.8 → 0.136.0

package/dist/server/plugins/mcp/codemode/sandbox/polyfills/url.js

@@ -0,0 +1,239 @@
+const t=`
+  // Collapses '.' and '..'. A backslash separates path segments, the way the host parser reads
+  // one, so it is folded into '/' first \u2014 otherwise the two disagree about where the host name
+  // ends in 'https://a.example\\@b.example/', and guest code reads a host the gateway never calls.
+  const normalizePath = (rawPath) => {
+    const path = rawPath.replace(/\\\\/g, '/');
+    const out = [];
+    for (const segment of path.split('/')) {
+      if (segment === '.') continue;
+      if (segment === '..') { if (out.length > 1) out.pop(); continue; }
+      out.push(segment);
+    }
+    let joined = out.join('/');
+    if ((path.endsWith('/.') || path.endsWith('/..')) && !joined.endsWith('/')) joined += '/';
+    return joined;
+  };
+
+  const DEFAULT_PORTS = { 'http:': '80', 'https:': '443', 'ws:': '80', 'wss:': '443', 'ftp:': '21' };
+
+  // Percent-encode what cannot travel literally in a url, so a hand-assembled path or query
+  // reaches the host parser as the caller meant it. Non-ASCII goes out as UTF-8, in runs, so a
+  // surrogate pair is encoded as the one character it stands for.
+  const encodeLiterals = (value) =>
+    value.replace(/[\\s"<>\\\`{}\\\\^]|[^\\x00-\\x7F]+/g, (chunk) => {
+      try { return encodeURIComponent(chunk); } catch (error) { return chunk; }
+    });
+
+  // A non-ASCII host name is lower-cased but not punycoded \u2014 that needs an IDNA table this sandbox
+  // does not carry. The host re-parses the url before it fetches, so the request still goes to the
+  // punycoded name; only what guest code reads back differs.
+  const parseHostPort = (hostport, scheme) => {
+    let hostname = hostport;
+    let port = '';
+    if (hostport.startsWith('[')) {
+      const close = hostport.indexOf(']');
+      hostname = hostport.slice(0, close + 1);
+      const after = hostport.slice(close + 1);
+      if (after.startsWith(':')) port = after.slice(1);
+    } else {
+      const colon = hostport.lastIndexOf(':');
+      if (colon !== -1) { hostname = hostport.slice(0, colon); port = hostport.slice(colon + 1); }
+    }
+    if (port !== '' && !/^[0-9]+$/.test(port)) return null;
+    if (hostname === '') return null;
+    return {
+      hostname: hostname.toLowerCase(),
+      port: DEFAULT_PORTS[scheme] === port ? '' : port,
+      // A host written without a port leaves the port alone, rather than clearing it.
+      hasPort: port !== '',
+    };
+  };
+
+  const ABSOLUTE_RE = /^([A-Za-z][A-Za-z0-9+\\-.]*):(\\/\\/)?([\\s\\S]*)$/;
+
+  const parseAuthorityUrl = (scheme, rest) => {
+    const cut = rest.search(/[/\\\\?#]/);
+    const authority = cut === -1 ? rest : rest.slice(0, cut);
+    let tail = cut === -1 ? '' : rest.slice(cut);
+    let username = '';
+    let password = '';
+    let hostport = authority;
+    const at = authority.lastIndexOf('@');
+    if (at !== -1) {
+      const credentials = authority.slice(0, at);
+      hostport = authority.slice(at + 1);
+      const colon = credentials.indexOf(':');
+      username = colon === -1 ? credentials : credentials.slice(0, colon);
+      password = colon === -1 ? '' : credentials.slice(colon + 1);
+    }
+    const hostPort = parseHostPort(hostport, scheme);
+    if (!hostPort) return null;
+    let hash = '';
+    const hashAt = tail.indexOf('#');
+    if (hashAt !== -1) { hash = tail.slice(hashAt); tail = tail.slice(0, hashAt); }
+    let search = '';
+    const queryAt = tail.indexOf('?');
+    if (queryAt !== -1) { search = tail.slice(queryAt); tail = tail.slice(0, queryAt); }
+    let pathname = tail === '' ? '/' : tail;
+    if (!/^[/\\\\]/.test(pathname)) pathname = '/' + pathname;
+    return {
+      protocol: scheme,
+      username,
+      password,
+      hostname: hostPort.hostname,
+      port: hostPort.port,
+      pathname: encodeLiterals(normalizePath(pathname)),
+      search: encodeLiterals(search === '?' ? '' : search),
+      hash: encodeLiterals(hash === '#' ? '' : hash),
+    };
+  };
+
+  const parseUrl = (input, base) => {
+    // A tab or newline inside a url is dropped, not encoded \u2014 the host parser does the same, and
+    // a url copied out of a wrapped response body is the usual way one gets in here.
+    const str = String(input).trim().replace(/[\\t\\n\\r]/g, '');
+    const matched = ABSOLUTE_RE.exec(str);
+    // A scheme with no \`//\` (mailto:, data:) is not a fetch target, so it is not resolved.
+    if (matched) return matched[2] ? parseAuthorityUrl(matched[1].toLowerCase() + ':', matched[3]) : null;
+    if (base === undefined) return null;
+    const resolved = parseUrl(base, undefined);
+    if (!resolved) return null;
+    if (/^[/\\\\]{2}/.test(str)) return parseAuthorityUrl(resolved.protocol, str.slice(2));
+    const parts = { ...resolved };
+    if (str.startsWith('#')) {
+      parts.hash = encodeLiterals(str === '#' ? '' : str);
+      return parts;
+    }
+    let rest = str;
+    let hash = '';
+    const hashAt = rest.indexOf('#');
+    if (hashAt !== -1) { hash = rest.slice(hashAt); rest = rest.slice(0, hashAt); }
+    let search = '';
+    const queryAt = rest.indexOf('?');
+    if (queryAt !== -1) { search = rest.slice(queryAt); rest = rest.slice(0, queryAt); }
+    if (rest !== '') {
+      const absolute = /^[/\\\\]/.test(rest)
+        ? rest
+        : resolved.pathname.slice(0, resolved.pathname.lastIndexOf('/') + 1) + rest;
+      parts.pathname = encodeLiterals(normalizePath(absolute));
+    }
+    // An empty reference with no query of its own keeps the base query (RFC 3986 section 5.3).
+    parts.search = rest === '' && search === '' ? resolved.search : encodeLiterals(search === '?' ? '' : search);
+    parts.hash = encodeLiterals(hash === '#' ? '' : hash);
+    return parts;
+  };
+
+  const URL = class URL {
+    constructor(input, base) {
+      const parsed = parseUrl(input, base === undefined ? undefined : String(base));
+      if (!parsed) throw new TypeError('Invalid URL: ' + String(input));
+      this._parts = parsed;
+      this._params = undefined;
+      this._edited = false;
+    }
+    // The query stays exactly as it arrived until searchParams edits it, so reading a url apart
+    // and putting it back together does not re-encode what the server sent.
+    _applyParams() {
+      if (this._edited && this._params) {
+        const query = this._params.toString();
+        this._parts.search = query ? '?' + query : '';
+        this._edited = false;
+      }
+    }
+    // Every part a caller can read, it can also write. Guest code runs sloppy, so a missing
+    // setter would swallow \`url.host = \u2026\` and fetch the address the caller meant to replace.
+    get protocol() { return this._parts.protocol; }
+    set protocol(value) {
+      const next = String(value).toLowerCase().replace(/:$/, '') + ':';
+      // Only a scheme that carries an authority can replace one, the way the host parser reads it.
+      if (DEFAULT_PORTS[next] !== undefined) this._parts.protocol = next;
+    }
+    get username() { return this._parts.username; }
+    set username(value) { this._parts.username = String(value); }
+    get password() { return this._parts.password; }
+    set password(value) { this._parts.password = String(value); }
+    get hostname() { return this._parts.hostname; }
+    set hostname(value) { this._parts.hostname = String(value).toLowerCase(); }
+    get port() { return this._parts.port; }
+    set port(value) {
+      const port = String(value);
+      if (port !== '' && !/^[0-9]+$/.test(port)) return;
+      this._parts.port = DEFAULT_PORTS[this._parts.protocol] === port ? '' : port;
+    }
+    get host() {
+      return this._parts.port ? this._parts.hostname + ':' + this._parts.port : this._parts.hostname;
+    }
+    set host(value) {
+      const parsed = parseHostPort(String(value), this._parts.protocol);
+      if (!parsed) return;
+      this._parts.hostname = parsed.hostname;
+      if (parsed.hasPort) this._parts.port = parsed.port;
+    }
+    get origin() { return this._parts.protocol + '//' + this.host; }
+    get pathname() { return this._parts.pathname; }
+    set pathname(value) {
+      const path = String(value);
+      this._parts.pathname = encodeLiterals(path.startsWith('/') ? path : '/' + path);
+    }
+    get search() {
+      this._applyParams();
+      return this._parts.search;
+    }
+    set search(value) {
+      const query = String(value);
+      const body = query.startsWith('?') ? query.slice(1) : query;
+      this._parts.search = body ? encodeLiterals('?' + body) : '';
+      this._params = undefined;
+      this._edited = false;
+    }
+    get searchParams() {
+      if (!this._params) {
+        const params = new URLSearchParams(this._parts.search);
+        const url = this;
+        // Every method that can change the parameters has to mark the query for re-serialization.
+        for (const method of ['append', 'set', 'delete', 'sort']) {
+          const original = params[method];
+          params[method] = function (...args) {
+            url._edited = true;
+            return original.apply(params, args);
+          };
+        }
+        this._params = params;
+      }
+      return this._params;
+    }
+    get hash() { return this._parts.hash; }
+    set hash(value) {
+      const fragment = String(value);
+      this._parts.hash = fragment === ''
+        ? ''
+        : encodeLiterals(fragment.startsWith('#') ? fragment : '#' + fragment);
+    }
+    get href() {
+      this._applyParams();
+      const credentials = this._parts.username
+        ? this._parts.username + (this._parts.password ? ':' + this._parts.password : '') + '@'
+        : '';
+      return this._parts.protocol + '//' + credentials + this.host +
+        this._parts.pathname + this._parts.search + this._parts.hash;
+    }
+    set href(value) {
+      const parsed = parseUrl(value, undefined);
+      if (!parsed) throw new TypeError('Invalid URL: ' + String(value));
+      this._parts = parsed;
+      this._params = undefined;
+      this._edited = false;
+    }
+    toString() { return this.href; }
+    toJSON() { return this.href; }
+    static canParse(input, base) {
+      return parseUrl(input, base === undefined ? undefined : String(base)) !== null;
+    }
+    static parse(input, base) {
+      const parsed = parseUrl(input, base === undefined ? undefined : String(base));
+      return parsed ? new URL(input, base) : null;
+    }
+  };
+  globalThis.URL = URL;
+`;export{t as URL_POLYFILL};

package/dist/server/plugins/mcp/codemode/tools/describe-tools.d.ts

@@ -1,7 +1,6 @@
-import type { ToolCallback } from '@redocly/mcp-typescript-sdk/server/mcp.js';
 import type { McpToolSchema } from '../../../../types';
-import type { McpToolContext } from '../../types.js';
+import type { McpToolCallback, McpToolContext } from '../../types.js';
 import { type SandboxCapability } from '../capabilities/index.js';
 export declare function describeToolsSchema(tools: McpToolSchema[], capabilities: SandboxCapability[]): Record<string, unknown>;
-export declare function describeTools(tools: McpToolSchema[], isToolAvailable: (toolName: string) => Promise<boolean>, capabilities: SandboxCapability[], context: McpToolContext): ToolCallback<Record<string, unknown>>;
+export declare function describeTools(tools: McpToolSchema[], isToolAvailable: (toolName: string) => Promise<boolean>, capabilities: SandboxCapability[], context: McpToolContext): McpToolCallback;
 //# sourceMappingURL=describe-tools.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/describe-tools.js

@@ -1 +1 @@
-import{renderDescribeToolsOutput as w}from"../capabilities/index.js";import{sanitizeToolName as o}from"../build-tool-type-declarations.js";function g(i,l){const n=[...new Set([...i.map(s=>o(s.name)),...l.map(s=>o(s.id))])];return{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${n.join(", ")}. Omit to describe everything.`,items:{type:"string"},nullable:!0}}}}function v(i,l,n,s){const r=new Map(i.map(t=>[o(t.name),t])),c=new Map(n.map(t=>[o(t.id),t]));return async t=>{const a=[...new Set((t.tools??[]).map(o))],p=a.length===0,m=a.filter(e=>!r.has(e)&&!c.has(e));if(m.length>0){const e=[...r.keys(),...c.keys()];throw new Error(`Unknown tool(s): ${m.join(", ")}. Valid tools: ${e.join(", ")}.`)}const u=p?n:n.filter(e=>a.includes(o(e.id))),d=p?i:a.filter(e=>r.has(e)).map(e=>r.get(e)),y=await Promise.all(d.map(e=>l(e.name))),f=d.filter((e,b)=>y[b]);return{content:[{type:"text",text:w(f,u,s)}]}}}export{v as describeTools,g as describeToolsSchema};
+import{renderDescribeToolsOutput as k}from"../capabilities/index.js";import{McpServerType as h}from"../../constants.js";import{reportMcpToolCalled as E,reportMcpToolError as S}from"../../workers/mcp-tool-telemetry.js";import{DESCRIBE_TOOLS_TOOL_NAME as w}from"../constants.js";import{sanitizeToolName as s}from"../build-tool-type-declarations.js";import{UnknownToolError as T}from"./tool-errors.js";function x(i,l){const r=[...new Set([...i.map(n=>s(n.name)),...l.map(n=>s(n.id))])];return{type:"object",required:[],additionalProperties:!1,properties:{tools:{type:"array",description:`Tool names to describe: ${r.join(", ")}. Omit to describe everything.`,items:r.length>0?{type:"string",enum:r}:{type:"string"},nullable:!0}}}}function L(i,l,r,n){const c=new Map(i.map(t=>[s(t.name),t])),p=new Map(r.map(t=>[s(t.id),t]));return async t=>{const m=performance.now(),d=n.mcpMode??"code";try{const o=[...new Set((t.tools??[]).map(s))],a=o.length===0,f=o.filter(e=>!c.has(e)&&!p.has(e));if(f.length>0){const e=[...c.keys(),...p.keys()];throw new T(`Unknown tool(s): ${f.join(", ")}. Valid tools: ${e.join(", ")}.`)}const g=a?r:r.filter(e=>o.includes(s(e.id))),u=a?i:o.filter(e=>c.has(e)).map(e=>c.get(e)),M=await Promise.all(u.map(e=>l(e.name))),b=u.filter((e,v)=>M[v]),y=k(b,g,n);return E({tool:w,mode:d,serverType:h.Docs,durationMs:Math.round(performance.now()-m),outputLength:y.length}),{content:[{type:"text",text:y}]}}catch(o){const a=o instanceof T;throw S({tool:w,mode:d,serverType:h.Docs,durationMs:Math.round(performance.now()-m),message:o instanceof Error?o.message:String(o),stack:!a&&o instanceof Error&&o.stack||"",errorClass:a?"tool_error":"server_error"}),o}}}export{L as describeTools,x as describeToolsSchema};

package/dist/server/plugins/mcp/codemode/tools/execute-schema.d.ts

@@ -1,4 +1,4 @@
-import type { ToolAnnotations } from '@redocly/mcp-typescript-sdk/types.js';
+import type { ToolAnnotations } from '@modelcontextprotocol/server';
 import type { McpToolSchema } from '../../../../types';
 export declare const EXECUTE_BASE_ANNOTATIONS: ToolAnnotations;
 export declare const EXECUTE_TOOL_SCHEMA: McpToolSchema;

package/dist/server/plugins/mcp/codemode/tools/execute.js

@@ -1 +1 @@
-import{mcpToolHandlers as l}from"../../../../../client/mcp-tool-handlers-entry.js";import{runInSandbox as m}from"../../../../sandbox/sandbox.js";import{isMcpToolAvailable as u}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as f,isFetchCapable as p}from"../../gateway-mcp/fetch-capability.js";import{withAuthRequiredMeta as d}from"../../gateway-mcp/upstream-auth.js";import{CODE_MODE_TOOL_NAMES as b,EXECUTE_TOOL_NAME as h}from"../constants.js";import{sanitizeToolName as E}from"../build-tool-type-declarations.js";import{invokeTool as T}from"../invoke-tool.js";import{createSandboxSetup as O}from"../sandbox/create-sandbox-setup.js";const A=async(e,t,i)=>{const o=await v(t,i),r=[],n=p(t)?f(t,c=>r.push(c)):void 0,{result:a,error:s}=await m(e.code,{setupContext:O(o,n)});return d({content:[{type:"text",text:JSON.stringify({result:a,error:s})}],isError:s!==void 0},r)};async function v(e,t){const i={};for(const o of Object.keys(l))b.has(o)||!await u({toolName:o,context:e}).catch(()=>!1)||(i[E(o)]=n=>T(o,n,e,t));return i}var F={[h]:A};export{F as default};
+import{mcpToolHandlers as l}from"../../../../../client/mcp-tool-handlers-entry.js";import{runInSandbox as p}from"../../../../sandbox/sandbox.js";import{isMcpToolAvailable as h}from"../../workers/execute-mcp-tool.js";import{buildExecuteHostFetch as b,isFetchCapable as E}from"../../gateway-mcp/fetch-capability.js";import{withAuthRequiredMeta as T}from"../../gateway-mcp/upstream-auth.js";import{CODE_MODE_TOOL_NAMES as C,EXECUTE_TOOL_NAME as O}from"../constants.js";import{sanitizeToolName as A}from"../build-tool-type-declarations.js";import{invokeTool as w}from"../invoke-tool.js";import{createSandboxSetup as x}from"../sandbox/create-sandbox-setup.js";import{auditCode as y}from"../code-audit.js";import{reportCodeExecuted as M}from"../code-execution-telemetry.js";import{logCodeExecutionAudit as N}from"../code-execution-audit.js";const v=async(e,t,r)=>{const o=await F(t,r),n=[],i=E(t)?b(t,c=>n.push(c)):void 0;let a=0;const u=i?c=>(a+=1,i(c)):void 0,d=y(e.code);N({audit:d,code:e.code,description:e.description,sessionHandle:e.sessionHandle,toolNames:Object.keys(o),fetchBudget:t.gatewayFetchBudgetPerExec,fetchCapable:i!==void 0});const m=Date.now(),{result:f,error:s}=await p(e.code,{setupContext:x(o,u)});return M({audit:d,fetchCount:a,outcome:s===void 0?"ok":"error",durationMs:Date.now()-m}),T({content:[{type:"text",text:JSON.stringify({result:f,error:s})}],isError:s!==void 0},n)};async function F(e,t){const r={};for(const o of Object.keys(l))C.has(o)||!await h({toolName:o,context:e}).catch(()=>!1)||(r[A(o)]=i=>w(o,i,e,t));return r}var J={[O]:v};export{J as default};

package/dist/server/plugins/mcp/codemode/tools/manage-credentials.d.ts

@@ -0,0 +1,19 @@
+import type { CallToolResult, InputRequiredResult } from '@modelcontextprotocol/server';
+import type { McpToolSchema } from '../../../../types';
+import type { McpToolContext } from '../../types.js';
+import type { KvService } from '@redocly/config';
+export type ManageApiCredentialsDeps = {
+    getClientCapabilities: () => {
+        elicitation?: {
+            url?: unknown;
+        };
+    } | undefined;
+    getKv: () => Promise<KvService>;
+};
+export declare function isManageApiCredentialsToolAvailable(context: McpToolContext): boolean;
+export declare function manageApiCredentialsSchema(context: McpToolContext): McpToolSchema;
+export declare function manageApiCredentials(context: McpToolContext, deps: ManageApiCredentialsDeps): (args: {
+    api?: unknown;
+    sessionHandle?: unknown;
+}) => Promise<CallToolResult | InputRequiredResult>;
+//# sourceMappingURL=manage-credentials.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/manage-credentials.js

@@ -0,0 +1,2 @@
+import{MANAGE_API_CREDENTIALS_TOOL_NAME as m}from"../../constants.js";import{buildUpstreamCredentialFallback as h,buildUpstreamCredentialInputRequired as f}from"../../gateway-mcp/elicitation.js";import{getCallableApis as o,isFetchCapable as g}from"../../gateway-mcp/fetch-capability.js";import{secretStore as A}from"../../gateway-mcp/secret-store.js";import{MISSING_SESSION_HANDLE_MESSAGE as v,resolveSecretSubject as b}from"../../gateway-mcp/subject.js";import{resolveUpstreamAuthScheme as y}from"../../gateway-mcp/upstream-auth-scheme.js";function k(e){return!!e.elicitationEnabled&&g(e)}function j(e){const t=o(e).map(n=>n.relativePath);return{name:m,description:["Get a secure link where the user sets, replaces, or removes the credentials this server sends to a documented API.","Call it when the user wants to change or clear an API key, or when a tool result tells you the stored credentials were rejected.","It returns a link for the user to open - never ask for the secret in the conversation and never pass it as an argument."].join(`
+`),annotations:{title:"Manage API credentials",readOnlyHint:!1,openWorldHint:!1},schema:{type:"object",required:["api"],additionalProperties:!1,properties:{api:{type:"string",description:`The API to manage credentials for.${t.length>0?` One of: ${t.join(", ")}.`:""}`,minLength:1,...t.length>0?{enum:t}:{}},sessionHandle:{type:"string",description:"Handle returned by createAnonymousSession. Required while the caller is anonymous, so the credentials are stored against the same subject the API calls use.",minLength:1}}}}}function H(e,i){return async t=>{const n=b(e.user,typeof t.sessionHandle=="string"?t.sessionHandle:void 0);if(n.kind==="invalid")return l(n.message);if(n.kind==="anonymous")return l(v);const{subject:u}=n,s=typeof t.api=="string"?t.api:"",r=o(e).find(a=>a.relativePath===s||a.name===s);if(!r){const a=o(e).map(d=>d.relativePath).join(", ");return l(`Unknown api "${s}". Credentials can only be managed for the APIs this server can call: ${a||"none"}.`)}const c=await i.getKv(),p={subject:u,baseUrl:e.baseUrl??"",target:{api:r.relativePath,name:r.name},auth:await y(e,r.relativePath),kv:c,hasExistingSecret:await A.hasSecret(c,u,r.relativePath),reason:{kind:"requested"}};return i.getClientCapabilities()?.elicitation?.url?await f(p):{content:[{type:"text",text:await h(p)}],isError:!1}}}function l(e){return{content:[{type:"text",text:e}],isError:!0}}export{k as isManageApiCredentialsToolAvailable,H as manageApiCredentials,j as manageApiCredentialsSchema};

package/dist/server/plugins/mcp/codemode/tools/tool-errors.d.ts

@@ -0,0 +1,4 @@
+export declare class UnknownToolError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=tool-errors.d.ts.map

package/dist/server/plugins/mcp/codemode/tools/tool-errors.js

@@ -0,0 +1 @@
+class n extends Error{constructor(r){super(r),this.name="UnknownToolError"}}export{n as UnknownToolError};

package/dist/server/plugins/mcp/constants.d.ts

@@ -8,11 +8,12 @@ export declare const McpErrorCodes: {
     readonly MethodNotFound: -32601;
     readonly InvalidParams: -32602;
 };
-export declare const MCP_PROTOCOL_VERSION = "2025-06-18";
+export declare const MCP_PROTOCOL_VERSION = "2025-11-25";
 export declare const DEFAULT_CONNECTION_TIMEOUT_MS = 30000;
 export declare const SSE_KEEPALIVE_INTERVAL_MS = 15000;
 export declare const MAX_DOCUMENTS_PER_CATEGORY = 3;
 export declare const MCP_NOT_ALLOWED_TEMPLATE_ID = "mcp-not-allowed";
 export declare const DEFAULT_DOCS_MCP_SERVER_NAME = "Docs MCP server";
 export declare const CREATE_ANONYMOUS_SESSION_TOOL_NAME = "createAnonymousSession";
+export declare const MANAGE_API_CREDENTIALS_TOOL_NAME = "manageApiCredentials";
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/constants.js

@@ -1 +1 @@
-const o={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},E="2025-06-18",e=3e4,t=15e3,_=3,s="mcp-not-allowed",n="Docs MCP server",O="createAnonymousSession";export{O as CREATE_ANONYMOUS_SESSION_TOOL_NAME,e as DEFAULT_CONNECTION_TIMEOUT_MS,n as DEFAULT_DOCS_MCP_SERVER_NAME,_ as MAX_DOCUMENTS_PER_CATEGORY,s as MCP_NOT_ALLOWED_TEMPLATE_ID,E as MCP_PROTOCOL_VERSION,r as McpErrorCodes,o as McpServerType,t as SSE_KEEPALIVE_INTERVAL_MS};
+import{LATEST_PROTOCOL_VERSION as o}from"@modelcontextprotocol/server";const r={Docs:"docs"},e={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},_=o,t=3e4,O=15e3,n=3,s="mcp-not-allowed",A="Docs MCP server",T="createAnonymousSession",M="manageApiCredentials";export{T as CREATE_ANONYMOUS_SESSION_TOOL_NAME,t as DEFAULT_CONNECTION_TIMEOUT_MS,A as DEFAULT_DOCS_MCP_SERVER_NAME,M as MANAGE_API_CREDENTIALS_TOOL_NAME,n as MAX_DOCUMENTS_PER_CATEGORY,s as MCP_NOT_ALLOWED_TEMPLATE_ID,_ as MCP_PROTOCOL_VERSION,e as McpErrorCodes,r as McpServerType,O as SSE_KEEPALIVE_INTERVAL_MS};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as m}from"../constants.js";import{GRAPHQL_TYPE_KINDS as o,GRAPHQL_LIST_SCOPES as h}from"./tools/graphql/constants.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},f={codemodeType:"OpenApiOperation & { path: string; method: string }"},g={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},b={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},S={type:"object",required:[],additionalProperties:!1,properties:{}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function I(e){const t=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:g,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i,version:i,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:b,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:f,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:i,version:i,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},q(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&t.push({name:"whoami",description:"Get information about the currently authenticated user",schema:S,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...T()),e.elicitationEnabled&&t.push({name:m,description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:v,annotations:{title:"Create anonymous session",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...o],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...h],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},P={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},A={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function T(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:L,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:P,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:A,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function q(e,t){const c=e&&e.length>0,u=t&&t.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:t,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as getDefaultToolSchemas};
+import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as m}from"../constants.js";import{GRAPHQL_TYPE_KINDS as o,GRAPHQL_LIST_SCOPES as h}from"./tools/graphql/constants.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},f={codemodeType:"OpenApiOperation & { path: string; method: string }"},g={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version",nullable:!0},filePath:{type:"string",description:"API definition file path",nullable:!0}}},b={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0},filePath:{type:"string",description:"API definition file path",nullable:!0}}},S={type:"object",required:[],additionalProperties:!1,properties:{}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function I(e){const t=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:g,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i,version:i,servers:r,filePath:{type:"string",description:"API definition file path"}}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:b,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:f,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:i,version:i,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},G(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&t.push({name:"whoami",description:"Get information about the currently authenticated user",schema:S,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...T()),e.elicitationEnabled&&t.push({name:m,description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:v,annotations:{title:"Create anonymous session",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},P={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...o],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...h],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},A={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function T(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:P,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:A,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:L,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function G(e,t){const c=e&&e.length>0,u=t&&t.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:t,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-endpoint-info.js

@@ -1 +1 @@
-import{resolveParameters as h,resolveRequestBody as v,resolveResponses as x}from"../../utils.js";import{isMcpEndpoint as E}from"./utils.js";import{loadApiDescription as g}from"./load-api-description.js";import{checkEndpointAndDeleteXMcp as P}from"../../../utils/xmcp-utils.js";const S=async(s,i)=>{const{name:p,path:o,method:n,version:a}=s;let t;try{t=await g(p,i,a)}catch(y){return{content:[{type:"text",text:y.message}],isError:!0}}const c=o.startsWith("/")?o:`/${o}`,{title:d=""}=t.info||{},r=t.paths?.[c],m=n.toLowerCase();if(!r)return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const e=r[m];if(!E(e)||!P(e,"docs"))return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const u=r?.parameters||[],l=e.parameters||[],f={...e,parameters:h({pathParams:u,opParams:l,definition:t}),requestBody:v(e.requestBody,t),responses:x(e.responses,t)};return{content:[{type:"text",text:JSON.stringify({api:d,version:t.info?.version||"",servers:t.servers||[],endpoint:{path:o,method:n.toUpperCase(),...f},globalSecurity:t.security||[],securitySchemes:t.components?.securitySchemes||{}},null,2)}]}};var M={"get-endpoint-info":S};export{M as default};
+import{resolveParameters as f,resolveRequestBody as l,resolveResponses as y}from"../../utils.js";import{isMcpEndpoint as x}from"./utils.js";import{loadApiDescription as E}from"./load-api-description.js";import{checkEndpointAndDeleteXMcp as v}from"../../../utils/xmcp-utils.js";const g=async(s,i)=>{const{path:o,method:r}=s;if(!o||!r)return{content:[{type:"text",text:'Both "path" and "method" are required (e.g. path: "/tickets", method: "GET").'}],isError:!0};let t;try{t=await E(s,i)}catch(h){return{content:[{type:"text",text:h.message}],isError:!0}}const p=o.startsWith("/")?o:`/${o}`,{title:a=""}=t.info||{},n=t.paths?.[p],c=r.toLowerCase();if(!n)return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const e=n[c];if(!x(e)||!v(e,"docs"))return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const d=n?.parameters||[],m=e.parameters||[],u={...e,parameters:f({pathParams:d,opParams:m,definition:t}),requestBody:l(e.requestBody,t),responses:y(e.responses,t)};return{content:[{type:"text",text:JSON.stringify({api:a,version:t.info?.version||"",servers:t.servers||[],endpoint:{path:o,method:r.toUpperCase(),...u},globalSecurity:t.security||[],securitySchemes:t.components?.securitySchemes||{}},null,2)}]}};var w={"get-endpoint-info":g};export{w as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-endpoints.js

@@ -1 +1 @@
-import{loadApiDescription as p}from"./load-api-description.js";import{getEndpointsFromPaths as c}from"./utils.js";const a=async(n,r)=>{const{name:o,version:i}=n;let t;try{t=await p(o,r,i)}catch(s){return{content:[{type:"text",text:s.message}],isError:!0}}const e=c(t);return e.length===0?{content:[{type:"text",text:"No endpoints found"}]}:{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",servers:t.servers||[],endpoints:e},null,2)}]}};var l={"get-endpoints":a};export{l as default};
+import{loadApiDescription as i}from"./load-api-description.js";import{getEndpointsFromPaths as s}from"./utils.js";const p=async(n,r)=>{let t;try{t=await i(n,r)}catch(o){return{content:[{type:"text",text:o.message}],isError:!0}}const e=s(t);return e.length===0?{content:[{type:"text",text:"No endpoints found"}]}:{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",servers:t.servers||[],endpoints:e},null,2)}]}};var d={"get-endpoints":p};export{d as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-full-api-description.js

@@ -1 +1 @@
-import{loadApiDescription as s}from"./load-api-description.js";const p=async(e,i)=>{const{name:n,version:r}=e;let t;try{t=await s(n,i,r)}catch(o){return{content:[{type:"text",text:o.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",definition:t},null,2)}]}};var a={"get-full-api-description":p};export{a as default};
+import{loadApiDescription as n}from"./load-api-description.js";const o=async(e,i)=>{let t;try{t=await n(e,i)}catch(r){return{content:[{type:"text",text:r.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",definition:t},null,2)}]}};var s={"get-full-api-description":o};export{s as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-security-schemes.js

@@ -1 +1 @@
-import{loadApiDescription as c}from"./load-api-description.js";const o=async(t,r)=>{const{name:s,version:i}=t;let e;try{e=await c(s,r,i)}catch(n){return{content:[{type:"text",text:n.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({name:e.info?.title,version:e.info?.version,securitySchemes:e.components?.securitySchemes||{},security:e.security||[]},null,2)}]}};var y={"get-security-schemes":o};export{y as default};
+import{loadApiDescription as s}from"./load-api-description.js";const c=async(t,r)=>{let e;try{e=await s(t,r)}catch(i){return{content:[{type:"text",text:i.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({name:e.info?.title,version:e.info?.version,securitySchemes:e.components?.securitySchemes||{},security:e.security||[]},null,2)}]}};var o={"get-security-schemes":c};export{o as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{filterApiDescriptionsByName as f}from"../../utils.js";const g=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),r=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:h,fetchEligible:x,...p})=>p),limit:e,total:r,page:n,totalPages:c})}]}};var u={"list-apis":g};export{u as default};
+import{filterApiDescriptionsByName as g}from"../../utils.js";const h=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=g(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),p=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:r,fetchEligible:x,...f})=>({filePath:r,...f})),limit:e,total:p,page:n,totalPages:c})}]}};var u={"list-apis":h};export{u as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/load-api-description.d.ts

@@ -1,4 +1,8 @@
 import type { OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpToolContext } from '../../../types.js';
-export declare function loadApiDescription(name: string, context: McpToolContext, version?: string): Promise<OpenAPIDefinition>;
+export declare function loadApiDescription({ name, version, filePath }: {
+    name: string;
+    version?: string;
+    filePath?: string;
+}, context: McpToolContext): Promise<OpenAPIDefinition>;
 //# sourceMappingURL=load-api-description.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/load-api-description.js

@@ -1 +1 @@
-import{findApiDescriptionByNameAndVersion as t}from"../../utils.js";import{getApiDescriptionFromFs as a}from"./utils.js";async function u(r,i,s){const o=t(i.apiDescriptionsMap,r,s);if(!o)throw new Error(`No API found matching "${r}".`);const e=!!i?.config?.access?.requiresLogin,c=i?.config?.access?.rbac||{},n=await a({relativePath:o.relativePath||"",outdir:i.outdir||"",user:i.user,rbac:c,requiresLogin:e});if(!n)throw new Error(`No API found matching "${r}".`);return n}export{u as loadApiDescription};
+import{findApiDescriptionByNameAndVersion as p}from"../../utils.js";import{getApiDescriptionFromFs as u}from"./utils.js";async function g({name:o,version:n,filePath:r},i){const s=r?Object.values(i.apiDescriptionsMap).find(c=>c.relativePath===r):p(i.apiDescriptionsMap,o,n);if(!s)throw new Error(r?`No API found with filePath "${r}". File paths are returned by the list-apis tool.`:`No API found matching "${o}".`);const t=!!i?.config?.access?.requiresLogin,a=i?.config?.access?.rbac||{},e=await u({relativePath:s.relativePath||"",outdir:i.outdir||"",user:i.user,rbac:a,requiresLogin:t});if(!e)throw new Error(`No API found matching "${r||o}".`);return e}export{g as loadApiDescription};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/types.d.ts

@@ -6,11 +6,13 @@ export type ListApisArgs = {
 export type ApiNameVersionArgs = {
     name: string;
     version?: string;
+    filePath?: string;
 };
 export type GetEndpointInfoArgs = {
     name: string;
     path: string;
     method: string;
     version?: string;
+    filePath?: string;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils.js

@@ -1 +1 @@
-function v(t,o,n){if(!o)return;const s=o.toLowerCase(),r=Object.values(t).filter(({name:i})=>i.toLowerCase()===s);if(r.length===0)return;const e=n?r.filter(i=>i.version===n):r;if(e.length===0)return;if(e.length===1)return e[0];if(new Set(e.map(({version:i})=>i||"")).size>1){const i=e.map(({version:d})=>d||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${i}. Specify a version to disambiguate.`)}const c=e.map(({relativePath:i})=>i||"(unknown path)").join(", "),u=e[0].version?` at version "${e[0].version}"`:"";throw new Error(`Multiple APIs are titled "${o}"${u} (${c}). Give them a distinct info.title or info.version so they can be addressed individually.`)}function $(t,o){return Object.values(t).filter(({name:n})=>n.toLowerCase().includes(o.toLowerCase()))}function a(t,o){if(!o||!t?.startsWith("#/"))return;const n=t.slice(2).split("/");let s=o;for(const r of n)if(typeof s=="object"&&s!==null&&r in s)s=s[r];else return;return s}function l({schema:t,definition:o,visitedRefs:n=new Set,maxDepth:s=50,currentDepth:r=0}){if(!t)return;if(r>=s)return{type:"object",description:`Maximum resolution depth exceeded (${s})`};if("$ref"in t&&t.$ref){if(n.has(t.$ref))return{type:"object",description:`Circular reference detected: ${t.$ref}`,"x-circular-ref":t.$ref};const c=new Set(n);c.add(t.$ref);const u=a(t.$ref,o);return u?l({schema:u,definition:o,visitedRefs:c,maxDepth:s,currentDepth:r+1}):{type:"object",description:`Could not resolve reference: ${t.$ref}`,"x-unresolved-ref":t.$ref}}const e={...t};if(e.properties){const c={};for(const[u,i]of Object.entries(e.properties)){const d=l({schema:i,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c[u]=d||i}e.properties=c}if(e.items&&typeof e.items=="object")if(Array.isArray(e.items))e.items=e.items.map(c=>l({schema:c,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1})||c);else{const c=l({schema:e.items,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});c&&(e.items=c)}return["allOf","anyOf","oneOf"].forEach(c=>{const u=e[c];Array.isArray(u)&&(e[c]=u.reduce((i,d)=>{const p=l({schema:d,definition:o,visitedRefs:new Set(n),maxDepth:s,currentDepth:r+1});return p&&i.push(p),i},[]))}),e}function h({pathParams:t,opParams:o,definition:n}){return[...t,...o].reduce((s,r)=>{if(!r)return s;if("$ref"in r&&r.$ref){const e=a(r.$ref,n);return e&&s.push({...e,schema:"schema"in e&&e.schema?l({schema:e.schema,definition:n}):void 0}),s}return s.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:n}):void 0}),s},[])}function m(t,o){const n={...t};if(t.example!==void 0&&(n.example=t.example),!t.examples)return n;const s={};for(const[r,e]of Object.entries(t.examples))if("$ref"in e){const f=a(e.$ref,o);f&&(s[r]=f)}else s[r]=e;return n.examples=s,n}function w(t,o){if(!t)return;const n="$ref"in t&&t.$ref?a(t.$ref,o):t;if(!n)return;const s={...n};if("content"in n&&n.content){const r={};for(const[e,f]of Object.entries(n.content))r[e]={...m(f,o),schema:f.schema?l({schema:f.schema,definition:o}):void 0};s.content=r}return s}function b(t,o){return Object.entries(t).reduce((n,[s,r])=>{const e="$ref"in r&&r.$ref?a(r.$ref,o):r;if(!e)return n;const f={...e};if("content"in e&&e.content){const c={};for(const[u,i]of Object.entries(e.content))c[u]={...m(i,o),schema:i.schema?l({schema:i.schema,definition:o}):void 0};f.content=c}return n[s]=f,n},{})}export{$ as filterApiDescriptionsByName,v as findApiDescriptionByNameAndVersion,h as resolveParameters,a as resolveRef,w as resolveRequestBody,b as resolveResponses,l as resolveSchemaRefs};
+function v(e,o,s){if(!o)return;const r=o.toLowerCase(),t=Object.values(e).filter(({name:f})=>f.toLowerCase()===r);if(t.length===0)return;const n=s?t.filter(f=>f.version===s):t;if(n.length===0)return;if(n.length===1)return n[0];if(new Set(n.map(({version:f})=>f||"")).size>1){const f=n.map(({version:l})=>l||"(no version)").join(", ");throw new Error(`Multiple versions of "${o}" found: ${f}. Specify a version to disambiguate.`)}const i=n.map(({relativePath:f})=>`"${f||"(unknown path)"}"`).join(", "),u=n[0].version?` at version "${n[0].version}"`:"";throw new Error(`Multiple APIs are titled "${o}"${u}. Pass the "filePath" parameter to select one of: ${i}.`)}function h(e,o){return Object.values(e).filter(({name:s})=>s.toLowerCase().includes(o.toLowerCase()))}function d(e,o){if(!o||!e?.startsWith("#/"))return;const s=e.slice(2).split("/");let r=o;for(const t of s)if(typeof r=="object"&&r!==null&&t in r)r=r[t];else return;return r}function p(e,o){const s=Object.fromEntries(Object.entries(e).filter(([r,t])=>r!=="$ref"&&t!==void 0));return{...o,...s}}function a({schema:e,definition:o,visitedRefs:s=new Set,maxDepth:r=50,currentDepth:t=0}){if(!e)return;if(t>=r)return{type:"object",description:`Maximum resolution depth exceeded (${r})`};if("$ref"in e&&e.$ref){if(s.has(e.$ref))return{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref};const i=new Set(s);i.add(e.$ref);const u=d(e.$ref,o);if(!u)return{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref};const f=a({schema:u,definition:o,visitedRefs:i,maxDepth:r,currentDepth:t+1});return f&&p(e,f)}const n={...e};if(n.properties){const i={};for(const[u,f]of Object.entries(n.properties)){const l=a({schema:f,definition:o,visitedRefs:new Set(s),maxDepth:r,currentDepth:t+1});i[u]=l||f}n.properties=i}if(n.items&&typeof n.items=="object")if(Array.isArray(n.items))n.items=n.items.map(i=>a({schema:i,definition:o,visitedRefs:new Set(s),maxDepth:r,currentDepth:t+1})||i);else{const i=a({schema:n.items,definition:o,visitedRefs:new Set(s),maxDepth:r,currentDepth:t+1});i&&(n.items=i)}return["allOf","anyOf","oneOf"].forEach(i=>{const u=n[i];Array.isArray(u)&&(n[i]=u.reduce((f,l)=>{const m=a({schema:l,definition:o,visitedRefs:new Set(s),maxDepth:r,currentDepth:t+1});return m&&f.push(m),f},[]))}),n}function w({pathParams:e,opParams:o,definition:s}){return[...e,...o].reduce((r,t)=>{if(!t)return r;if("$ref"in t&&t.$ref){const n=d(t.$ref,s);if(!n)return r;const c=p(t,n);return r.push({...c,schema:"schema"in c&&c.schema?a({schema:c.schema,definition:s}):void 0}),r}return r.push({...t,schema:"schema"in t&&t.schema?a({schema:t.schema,definition:s}):void 0}),r},[])}function $(e,o){const s={...e};if(e.example!==void 0&&(s.example=e.example),!e.examples)return s;const r={};for(const[t,n]of Object.entries(e.examples))if("$ref"in n){const c=d(n.$ref,o);c&&(r[t]=c)}else r[t]=n;return s.examples=r,s}function b(e,o){if(!e)return;const s="$ref"in e&&e.$ref?d(e.$ref,o):e;if(!s)return;const r=p(e,s),t={...r};if("content"in r&&r.content){const n={};for(const[c,i]of Object.entries(r.content))n[c]={...$(i,o),schema:i.schema?a({schema:i.schema,definition:o}):void 0};t.content=n}return t}function j(e,o){return Object.entries(e).reduce((s,[r,t])=>{const n="$ref"in t&&t.$ref?d(t.$ref,o):t;if(!n)return s;const c=p(t,n),i={...c};if("content"in c&&c.content){const u={};for(const[f,l]of Object.entries(c.content))u[f]={...$(l,o),schema:l.schema?a({schema:l.schema,definition:o}):void 0};i.content=u}return s[r]=i,s},{})}export{h as filterApiDescriptionsByName,v as findApiDescriptionByNameAndVersion,w as resolveParameters,d as resolveRef,b as resolveRequestBody,j as resolveResponses,a as resolveSchemaRefs};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -1,27 +1,48 @@
+import type { InputRequiredResult } from '@modelcontextprotocol/server';
 import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
 import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
 import type { KvService } from '@redocly/config';
-export declare const ELICITATION_TIMEOUT_MS = 300000;
-export type SendElicitRequest = (request: object, resultSchema: unknown, options: {
-    timeout: number;
-}) => Promise<{
-    action: string;
-}>;
-export type ElicitationOutcome = {
-    status: 'accepted';
-} | {
-    status: 'fallback';
-    text: string;
+export declare const CREDENTIALS_INPUT_REQUEST_KEY = "credentials";
+export type CredentialTarget = {
+    api: string;
+    name: string;
+};
+/**
+ * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;
+ * `requested` is the model calling the credentials tool on the user's behalf.
+ */
+export type CredentialElicitationReason = {
+    kind: 'authFailure';
+    status: number;
+    otherApiNames?: string[];
 } | {
-    status: 'skipped';
+    kind: 'requested';
 };
-export declare function runUpstreamCredentialElicitation({ sendRequest, clientSupportsElicitation, subject, baseUrl, events, auth, kv, }: {
-    sendRequest: SendElicitRequest;
-    clientSupportsElicitation: boolean;
+type CredentialElicitationRequest = {
     subject: string;
     baseUrl: string;
-    events: UpstreamAuthRequiredEvent[];
+    target: CredentialTarget;
     auth: UpstreamAuthScheme;
     kv: KvService;
-}): Promise<ElicitationOutcome>;
+    hasExistingSecret: boolean;
+    reason: CredentialElicitationReason;
+};
+export declare function isCredentialElicitationDeclined(inputResponses: Record<string, unknown> | undefined): boolean;
+export declare function targetOf(event: UpstreamAuthRequiredEvent): CredentialTarget;
+/**
+ * The 2026-07-28-era credentials prompt: the tool call returns an input-required result the
+ * client fulfils and retries, with no push `elicitation/create` and no session behind it.
+ * Nothing has to survive the round trip - the secrets are keyed by `subject`, which is
+ * recomputed from the caller's identity on every request.
+ */
+export declare function buildUpstreamCredentialInputRequired(request: CredentialElicitationRequest): Promise<InputRequiredResult>;
+/** Fallback text for a client without URL-elicitation support. */
+export declare function buildUpstreamCredentialFallback(request: CredentialElicitationRequest): Promise<string>;
+/**
+ * Text for an authorization failure we deliberately do NOT prompt for: a stored secret the
+ * upstream rejected, or a 403/407 that is more likely a permissions problem than a missing key.
+ * Minting another link here is what produced the credentials-link loop.
+ */
+export declare function buildCredentialsToolHint(event: UpstreamAuthRequiredEvent): string;
+export {};
 //# sourceMappingURL=elicitation.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,2 +1,3 @@
-import{ElicitResultSchema as p}from"@redocly/mcp-typescript-sdk/types.js";import{logger as f}from"../../../tools/notifiers/logger.js";import{secretStore as g,ELICITATION_TTL_MS as T}from"./secret-store.js";import{ANONYMOUS_SUBJECT_PREFIX as h}from"./subject.js";const I=3e5;async function A({sendRequest:t,clientSupportsElicitation:n,subject:e,baseUrl:s,events:r,auth:a,kv:c}){const i=e.startsWith(h)?e.slice(h.length):void 0,l=r[0],u=await g.createElicitation(c,{subject:e,api:l.api,name:l.name,auth:a}),d=k(s,u);if(!n)return{status:"fallback",text:m(r,d,i)};try{return(await t({method:"elicitation/create",params:{mode:"url",message:`The "${l.name}" API requires credentials. Open the link to provide them securely; they never pass through the chat.`,url:d,elicitationId:u}},p,{timeout:I})).action==="accept"?{status:"accepted"}:{status:"skipped"}}catch(o){return f.warn(`URL-mode elicitation failed, falling back to markdown link: ${o instanceof Error?o.message:String(o)}`),{status:"fallback",text:m(r,d,i)}}}function k(t,n){if(!t)return`/mcp/credentials?token=${n}`;try{const e=new URL("/mcp/credentials",t);return e.searchParams.set("token",n),e.toString()}catch{return`${t}/mcp/credentials?token=${n}`}}function m(t,n,e){const[s,...r]=t,a=[`The upstream API "${s.name}" returned 401 Unauthorized.`,"",`**Action required: show the user the link below and ask them to open it in a browser to provide the API credentials (valid ${Math.round(T/6e4)} minutes):**`,"",n,"",e?`Then call this tool again with sessionHandle: "${e}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Then call this tool again - the credentials are applied server-side and never appear in the conversation."];if(r.length>0){const c=r.map(i=>`"${i.name}"`).join(", ");a.push("",`The remaining APIs (${c}) will prompt for credentials on subsequent calls.`)}return a.join(`
-`)}export{I as ELICITATION_TIMEOUT_MS,A as runUpstreamCredentialElicitation};
+import{inputRequired as c,inputResponse as f}from"@modelcontextprotocol/server";import{MANAGE_API_CREDENTIALS_TOOL_NAME as T}from"../constants.js";import{secretStore as $,ELICITATION_TTL_MS as A}from"./secret-store.js";import{ANONYMOUS_SUBJECT_PREFIX as l}from"./subject.js";const h="credentials";function C(e){const t=f(e,h);return t.kind==="elicit"&&(t.action==="decline"||t.action==="cancel")}function _(e){return{api:e.api,name:e.name}}async function b(e){const{url:t}=await d(e);return c({inputRequests:{[h]:c.elicitUrl({message:P(e.target.name,e.hasExistingSecret),url:t})}})}async function O(e){const{url:t}=await d(e);return y(e,t,I(e.subject))}function R(e){return[e.status===401?`The stored credentials for "${e.name}" were rejected (HTTP 401).`:`The "${e.name}" API rejected the request with HTTP ${e.status}.`,"",`Do not retry the same call. Call \`${T}\` with api: "${e.api}" to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}async function d({kv:e,subject:t,baseUrl:n,target:i,auth:a,hasExistingSecret:o}){const r=await $.createElicitation(e,{subject:t,api:i.api,name:i.name,auth:a,hasExistingSecret:o});return{token:r,url:g(n,r)}}function I(e){return e.startsWith(l)?e.slice(l.length):void 0}function P(e,t){const n=`The link works for ${u()} minutes.`;return t?`Open this page in a browser to replace or remove the stored credentials for the "${e}" API. They go straight to the API and never enter the chat. ${n}`:`The "${e}" API needs credentials. Open this page in a browser to paste them - they go straight to the API and never enter the chat. ${n}`}function u(){return Math.round(A/6e4)}function g(e,t){if(!e)return`/mcp/credentials?token=${t}`;try{const n=new URL("/mcp/credentials",e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}/mcp/credentials?token=${t}`}}function y({target:e,reason:t,hasExistingSecret:n},i,a){const r=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u()} minutes and opens a form on this site. Credentials go straight to the API from there: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,a?`Once the user confirms they saved them, call this tool again with sessionHandle: "${a}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, call this tool again - the credentials are applied server-side and never appear in the conversation."],s=t.kind==="authFailure"?t.otherApiNames??[]:[];if(s.length>0){const p=s.map(m=>`"${m}"`).join(", ");r.push("",`The remaining APIs (${p}) will prompt for credentials on subsequent calls.`)}return r.join(`
+`)}export{h as CREDENTIALS_INPUT_REQUEST_KEY,R as buildCredentialsToolHint,O as buildUpstreamCredentialFallback,b as buildUpstreamCredentialInputRequired,C as isCredentialElicitationDeclined,_ as targetOf};