@redocly/realm 0.136.0-next.9 → 0.137.0-next.0

package/dist/server/plugins/mcp/constants.d.ts

@@ -14,5 +14,7 @@ export declare const SSE_KEEPALIVE_INTERVAL_MS = 15000;
 export declare const MAX_DOCUMENTS_PER_CATEGORY = 3;
 export declare const MCP_NOT_ALLOWED_TEMPLATE_ID = "mcp-not-allowed";
 export declare const DEFAULT_DOCS_MCP_SERVER_NAME = "Docs MCP server";
+export declare const SUPPORTED_MCP_SCOPES: readonly ['openid', 'profile', 'email', 'offline_access'];
 export declare const CREATE_ANONYMOUS_SESSION_TOOL_NAME = "createAnonymousSession";
+export declare const MANAGE_API_CREDENTIALS_TOOL_NAME = "manageApiCredentials";
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/constants.js

@@ -1 +1 @@
-import{LATEST_PROTOCOL_VERSION as o}from"@modelcontextprotocol/server";const E={Docs:"docs"},e={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},t=o,_=3e4,O=15e3,s=3,n="mcp-not-allowed",T="Docs MCP server",S="createAnonymousSession";export{S as CREATE_ANONYMOUS_SESSION_TOOL_NAME,_ as DEFAULT_CONNECTION_TIMEOUT_MS,T as DEFAULT_DOCS_MCP_SERVER_NAME,s as MAX_DOCUMENTS_PER_CATEGORY,n as MCP_NOT_ALLOWED_TEMPLATE_ID,t as MCP_PROTOCOL_VERSION,e as McpErrorCodes,E as McpServerType,O as SSE_KEEPALIVE_INTERVAL_MS};
+import{LATEST_PROTOCOL_VERSION as o}from"@modelcontextprotocol/server";const E={Docs:"docs"},r={InternalError:-32603,ServerError:-32e3,InvalidRequest:-32600,MethodNotFound:-32601,InvalidParams:-32602},_=o,t=3e4,O=15e3,n=3,s="mcp-not-allowed",S="Docs MCP server",T=["openid","profile","email","offline_access"],c="createAnonymousSession",A="manageApiCredentials";export{c as CREATE_ANONYMOUS_SESSION_TOOL_NAME,t as DEFAULT_CONNECTION_TIMEOUT_MS,S as DEFAULT_DOCS_MCP_SERVER_NAME,A as MANAGE_API_CREDENTIALS_TOOL_NAME,n as MAX_DOCUMENTS_PER_CATEGORY,s as MCP_NOT_ALLOWED_TEMPLATE_ID,_ as MCP_PROTOCOL_VERSION,r as McpErrorCodes,E as McpServerType,O as SSE_KEEPALIVE_INTERVAL_MS,T as SUPPORTED_MCP_SCOPES};

package/dist/server/plugins/mcp/docs-mcp/tool-schemas.js

@@ -1 +1 @@
-import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as m}from"../constants.js";import{GRAPHQL_TYPE_KINDS as o,GRAPHQL_LIST_SCOPES as h}from"./tools/graphql/constants.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},f={codemodeType:"OpenApiOperation & { path: string; method: string }"},g={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"API name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},b={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0}}},S={type:"object",required:[],additionalProperties:!1,properties:{}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function I(e){const t=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:g,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i,version:i,servers:r}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:b,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:f,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:i,version:i,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},q(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&t.push({name:"whoami",description:"Get information about the currently authenticated user",schema:S,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...T()),e.elicitationEnabled&&t.push({name:m,description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:v,annotations:{title:"Create anonymous session",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...o],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...h],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},P={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},A={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function T(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:L,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:P,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:A,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function q(e,t){const c=e&&e.length>0,u=t&&t.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:t,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as getDefaultToolSchemas};
+import{shouldHandleMcpAuth as d}from"../auth/auth-handlers.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as m}from"../constants.js";import{GRAPHQL_TYPE_KINDS as o,GRAPHQL_LIST_SCOPES as h}from"./tools/graphql/constants.js";import{OPERATION_METHODS as p}from"./tools/openapi/constants.js";const i={type:"string",nullable:!0},n={limit:{type:"number"},total:{type:"number"},page:{type:"number"},totalPages:{type:"number"}},r={codemodeType:"OpenApiServer[]"},s={codemodeType:"OpenApiSecurityRequirement[]"},l={codemodeType:"Record<string, OpenApiSecurityScheme>"},y={codemodeType:"OpenApiDocument"},f={codemodeType:"OpenApiOperation & { path: string; method: string }"},g={type:"object",additionalProperties:!1,required:[],properties:{filter:{type:"string",description:"Matches part of an API name, or of a description when no name matches",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of APIs per page. Default is 300",minimum:1,default:300,nullable:!0}}},a={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it",minLength:1},version:{type:"string",description:"API version",nullable:!0},filePath:{type:"string",description:"API definition file path",nullable:!0}}},b={type:"object",required:["name","path","method"],additionalProperties:!1,properties:{name:{type:"string",description:"API name, or a unique part of it",minLength:1},path:{type:"string",description:"Endpoint path (e.g. /api/v1/users)",minLength:1},method:{type:"string",description:"HTTP method (GET, POST, PUT, DELETE, etc.)",enum:[...p.map(e=>e.toUpperCase()),...p],minLength:1},version:{type:"string",description:"API version (required when multiple APIs share the same name but differ by version)",nullable:!0},filePath:{type:"string",description:"API definition file path",nullable:!0}}},S={type:"object",required:[],additionalProperties:!1,properties:{}},v={type:"object",required:[],additionalProperties:!1,properties:{}};function I(e){const t=[{name:"list-apis",description:"Lists available APIs with their context and purpose",schema:g,annotations:{title:"List APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i,version:i,servers:r,filePath:{type:"string",description:"API definition file path"}}}},...n}}},{name:"get-endpoints",description:"Get all endpoints for a specific API",schema:a,annotations:{title:"Get Endpoints",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoints:{type:"array",items:{type:"object",properties:{path:{type:"string"},method:{type:"string"},summary:i,description:i,security:s}}}}}},{name:"get-endpoint-info",description:"Get comprehensive information about specific endpoint including parameters, security, and examples",schema:b,annotations:{title:"Get Endpoint Info",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},servers:r,endpoint:f,globalSecurity:s,securitySchemes:l}}},{name:"get-security-schemes",description:"Get the security schemes for a specific API",schema:a,annotations:{title:"Get Security Schemes",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:i,version:i,securitySchemes:l,security:s}}},{name:"get-full-api-description",description:"Get the complete OpenAPI description",schema:a,annotations:{title:"Get Full API Description",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{api:{type:"string"},version:{type:"string"},definition:y}}},q(e.products,e.locales)];return d(e.requiresLogin,e.rbac)&&t.push({name:"whoami",description:"Get information about the currently authenticated user",schema:S,annotations:{title:"Who Am I",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{email:{type:"string"},name:{type:"string"},subject:{type:"string"},clientId:{type:"string"},scope:{type:"string"},issuedAt:{type:"string"},expiresAt:{type:"string"}}}}),e.hasGraphqlApis&&t.push(...T()),e.elicitationEnabled&&t.push({name:m,description:"Create an anonymous session handle for storing upstream API credentials. Pass the returned sessionHandle to execute when an API needs credentials and the caller is not signed in. Treat it as a secret and reuse it across calls.",schema:v,annotations:{title:"Create anonymous session",readOnlyHint:!1,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"object",required:["sessionHandle"],properties:{sessionHandle:{type:"string"}}}}),t}const H={type:"object",required:[],additionalProperties:!1,properties:{filter:{type:"string",description:"GraphQL schema name (or part of it)",minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},P={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},kind:{type:"string",description:'Optional: return only a single category of schema members. With scope "fields", restricts to the fields of that parent category ("objects", "interfaces", or "inputs" only).',enum:[...o],nullable:!0},scope:{type:"string",description:'Optional: what each list item is. "members" (default) lists top-level types and operations. "fields" flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions \u2014 combine with `filter` to search nested fields anywhere in the schema.',enum:[...h],nullable:!0},filter:{type:"string",description:'Optional: only members whose name or description contains this substring, case-insensitive (e.g. "custom tags")',minLength:1,nullable:!0},referencesType:{type:"string",description:'Optional: only members that reference this type directly or transitively (via return, field, argument, union-member or input-field types). Finds cross-cutting members that never name it \u2014 e.g. referencesType "Book" surfaces a search query returning a union that includes Book.',minLength:1,nullable:!0},page:{type:"number",description:"Page number",minimum:1,default:1,nullable:!0},limit:{type:"number",description:"Number of results per page. Default is 300",minimum:1,default:300,nullable:!0}}},A={type:"object",required:["name","type"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1},type:{type:"string",description:"Name of the type, operation, or directive",minLength:1},includeReferencedTypes:{type:"boolean",description:"Also include the SDL of every type referenced transitively. Gives the whole subgraph at once, but can be large for highly-connected types.",default:!1,nullable:!0}}},L={type:"object",required:["name"],additionalProperties:!1,properties:{name:{type:"string",description:"GraphQL schema name",minLength:1}}};function T(){return[{name:"list-graphql-apis",description:"Lists available GraphQL schemas with their context and purpose",schema:H,annotations:{title:"List GraphQL APIs",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{items:{type:"array",items:{type:"object",properties:{name:{type:"string"},description:i}}},...n}}},{name:"get-graphql-type-list",description:'List all operations and types in a GraphQL schema as a flat, paginated list. Each item is tagged with its kind (query, object, enum, \u2026) and carries a one-line description; operations also include their return type and argument signature \u2014 use it to decide which members to fetch in detail. Narrow the result with `kind` (one category), `filter` (case-insensitive substring of the member name or description, e.g. "book"), or `referencesType` (only members that use a given type, directly or transitively) to explore a domain cheaply instead of pulling the full schema. To search nested fields \u2014 not just type names \u2014 set scope "fields": it flattens every field of every object/interface/input type into "ParentType.fieldName" entries with their descriptions, so `filter` finds things like an input field whose docstring mentions your keyword.',schema:P,annotations:{title:"Get GraphQL Type List",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"object",properties:{name:{type:"string"},items:{type:"array",items:{type:"object",properties:{kind:{type:"string",enum:o},name:{type:"string"},description:i,type:{type:"string"},args:{type:"string"},directives:{type:"string"}}}},...n}}},{name:"get-graphql-type",description:'Get the SDL for a single GraphQL type, operation (query/mutation/subscription field), or directive. Without includeReferencedTypes, the SDL is followed by a one-level manifest of every directly referenced type\'s field names (e.g. "input ActionOperationInput { addTags, removeTags }"), so you can see what nested types contain before fetching them. Set includeReferencedTypes to instead pull in the full SDL of every type it references transitively \u2014 the whole structural subgraph in one call, ideal for complete exploration of an entity (e.g. Book and all the types it touches). That traversal only follows what the target depends on; to go the other direction and find the members that use a type, call get-graphql-type-list with `referencesType`.',schema:A,annotations:{title:"Get GraphQL Type",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}},{name:"get-graphql-schema",description:"Get the complete GraphQL schema as SDL \u2014 the whole type graph in one call. Returns everything, so it can be very large and token-expensive for big schemas; prefer get-graphql-type-list (filter/paginate) plus targeted get-graphql-type calls, and reach for this only for small schemas or when you truly need the full SDL.",schema:L,annotations:{title:"Get GraphQL Schema",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!0,openWorldHint:!1},outputSchema:{type:"string"}}]}function q(e,t){const c=e&&e.length>0,u=t&&t.length>0;return{name:"search",description:"Search across the documentation to fetch relevant content for a given query",schema:{type:"object",required:["query"],additionalProperties:!1,properties:{query:{type:"string",description:"Search query. Should be a single word or that phrase that is presented in a documentation.",minLength:1},...c?{product:{type:"string",description:"Optional product name to filter search results by specific product.",enum:e,nullable:!0}}:{},...u?{locale:{type:"string",description:"Optional locale code to filter search results by documentation language (e.g. 'en', 'ja'). Use the locale matching the language of the user's request. Defaults to the project's default locale.",enum:t,nullable:!0}}:{}}},annotations:{title:"Search Documentation",readOnlyHint:!0,destructiveHint:!1,idempotentHint:!1,openWorldHint:!1},outputSchema:{type:"string"}}}export{I as getDefaultToolSchemas};

package/dist/server/plugins/mcp/docs-mcp/tools/core/search.js

@@ -1,6 +1,6 @@
-import{withPathPrefix as f}from"@redocly/theme/core/utils";import{ServerRoutes as d}from"../../../../../../constants/api.js";import{DEFAULT_LOCALE_PLACEHOLDER as m}from"../../../../../../constants/common.js";const y=async(i,t)=>{const{query:c,product:l,locale:u}=i,p=t.config.l10n?.defaultLocale||m,h=JSON.stringify({query:c,product:l,locale:u||p});let e=`${t.baseUrl}${f(d.SEMANTIC_SEARCH)}`;e.startsWith("http://")&&(e=e.replace(/^http:\/\//,"https://"));const o=t.accessToken?`authorization=${String(t.accessToken).replace(/^Bearer /,"")}`:"";try{const s=await fetch(e,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json",...o?{Cookie:o}:{}},body:h});if(!s.ok)return{content:[{type:"text",text:"Error retrieving search results."}],isError:!0};const r=await s.json();if(!r||r.length===0)return{content:[{type:"text",text:"No results found."}]};const a=r.map(n=>`### [${n.title}](${new URL(n.url,t.baseUrl).toString()})
+import{removeTrailingSlash as y,withPathPrefix as g,withoutPathPrefix as E}from"@redocly/theme/core/utils";import{ServerRoutes as L}from"../../../../../../constants/api.js";import{DEFAULT_LOCALE_PLACEHOLDER as S}from"../../../../../../constants/common.js";const w=async(n,t)=>{const{query:e,product:i,locale:l}=n,u=t.config.l10n?.defaultLocale||S,h=JSON.stringify({query:e,product:i,locale:l||u}),f=`${t.baseUrl}${g(L.SEMANTIC_SEARCH)}`,o=t.accessToken?`authorization=${String(t.accessToken).replace(/^Bearer /,"")}`:"";try{const s=await fetch(f,{method:"POST",credentials:"include",headers:{"Content-Type":"application/json",...o?{Cookie:o}:{}},body:h});if(!s.ok)return{content:[{type:"text",text:"Error retrieving search results."}],isError:!0};const p=await s.json(),d=new Set(t.searchIgnoredRoutes??[]),a=(p||[]).filter(r=>!R(r.url,d));if(a.length===0)return{content:[{type:"text",text:"No results found."}]};const m=r=>{try{return new URL(r,t.baseUrl).toString()}catch{return r}},c=a.map(r=>`### [${r.title}](${m(r.url)})
 
-${n.content}
+${r.content}
 `).join(`
 
-`).trim();return{content:[{type:"text",text:a.length?a:"No results found."}]}}catch{return{content:[{type:"text",text:"Error retrieving search results."}],isError:!0}}};var C={search:y};export{C as default};
+`).trim();return{content:[{type:"text",text:c.length?c:"No results found."}]}}catch{return{content:[{type:"text",text:"Error retrieving search results."}],isError:!0}}};function R(n,t){if(t.size===0)return!1;let e;try{e=new URL(n,"https://relative.invalid").pathname}catch{return!1}e=y(E(e));try{e=decodeURI(e)}catch{}return t.has(e)}var k={search:w};export{k as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/constants.d.ts

@@ -1,2 +1,3 @@
 export declare const OPERATION_METHODS: readonly ['get', 'put', 'post', 'delete', 'options', 'head', 'patch', 'trace', 'query', 'x-query'];
+export declare const HTTP_METHODS: Set<string>;
 //# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/constants.js

@@ -1 +1 @@
-const e=["get","put","post","delete","options","head","patch","trace","query","x-query"];export{e as OPERATION_METHODS};
+const e=["get","put","post","delete","options","head","patch","trace","query","x-query"],t=new Set(e);export{t as HTTP_METHODS,e as OPERATION_METHODS};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/endpoint-suggestions.d.ts

@@ -0,0 +1,11 @@
+import type { OpenAPIDefinition } from '@redocly/api-docs';
+import type { McpMode } from '../../../types.js';
+/** Methods documented and visible at `path`, uppercased. */
+export declare function visibleMethodsAt(definition: OpenAPIDefinition, path: string): string[];
+/** Paths with at least one visible operation. */
+export declare function visiblePaths(definition: OpenAPIDefinition): string[];
+/** Message for a path the definition does not document, or documents only behind `x-mcp`. */
+export declare function describePathMiss(definition: OpenAPIDefinition, apiTitle: string, path: string, mcpMode?: McpMode): string;
+/** Message for a visible path that does not document the requested method, or hides it. */
+export declare function describeMethodMiss(definition: OpenAPIDefinition, apiTitle: string, path: string, method: string): string;
+//# sourceMappingURL=endpoint-suggestions.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/endpoint-suggestions.js

@@ -0,0 +1 @@
+import{isEndpointHidden as s}from"../../../utils/xmcp-utils.js";import{formatCandidates as i}from"../../utils/api-name-matching.js";import{HTTP_METHODS as p}from"./constants.js";import{isMcpEndpoint as a}from"./utils.js";function d(t,r){const e=t.paths?.[r];return!e||s(e,"docs")?[]:Object.entries(e).filter(([n,o])=>p.has(n.toLowerCase())&&a(o)&&!s(o,"docs")).map(([n])=>n.toUpperCase()).sort()}function f(t){return Object.keys(t.paths??{}).filter(r=>d(t,r).length>0).sort()}function $(t,r,e,n){const o=f(t);if(o.length===0)return"Endpoint not found";const h=n==="code"?"Call tools.getEndpoints for the full list, or tools.search with a keyword from the request.":"Call get-endpoints for the full list, or search with a keyword from the request.";return`No path "${e}" in "${r}". Documented paths: ${i(o)}. ${h}`}function b(t,r,e,n){const o=d(t,e);return o.length===0?"Endpoint not found":`"${e}" in "${r}" documents no ${n.toUpperCase()}. Available methods: ${i(o)}.`}export{b as describeMethodMiss,$ as describePathMiss,d as visibleMethodsAt,f as visiblePaths};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-endpoint-info.js

@@ -1 +1 @@
-import{resolveParameters as h,resolveRequestBody as v,resolveResponses as x}from"../../utils.js";import{isMcpEndpoint as E}from"./utils.js";import{loadApiDescription as g}from"./load-api-description.js";import{checkEndpointAndDeleteXMcp as P}from"../../../utils/xmcp-utils.js";const S=async(s,i)=>{const{name:p,path:o,method:n,version:a}=s;let t;try{t=await g(p,i,a)}catch(y){return{content:[{type:"text",text:y.message}],isError:!0}}const c=o.startsWith("/")?o:`/${o}`,{title:d=""}=t.info||{},r=t.paths?.[c],m=n.toLowerCase();if(!r)return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const e=r[m];if(!E(e)||!P(e,"docs"))return{content:[{type:"text",text:"Endpoint not found"}],isError:!0};const u=r?.parameters||[],l=e.parameters||[],f={...e,parameters:h({pathParams:u,opParams:l,definition:t}),requestBody:v(e.requestBody,t),responses:x(e.responses,t)};return{content:[{type:"text",text:JSON.stringify({api:d,version:t.info?.version||"",servers:t.servers||[],endpoint:{path:o,method:n.toUpperCase(),...f},globalSecurity:t.security||[],securitySchemes:t.components?.securitySchemes||{}},null,2)}]}};var M={"get-endpoint-info":S};export{M as default};
+import{resolveParameters as l,resolveRequestBody as f,resolveResponses as y}from"../../utils/resolve-refs.js";import{isMcpEndpoint as x}from"./utils.js";import{describeMethodMiss as v,describePathMiss as E,visibleMethodsAt as M}from"./endpoint-suggestions.js";import{loadApiDescription as g}from"./load-api-description.js";import{checkEndpointAndDeleteXMcp as P}from"../../../utils/xmcp-utils.js";const b=async(p,a)=>{const{path:r,method:o}=p;if(!r||!o)return{content:[{type:"text",text:'Both "path" and "method" are required (e.g. path: "/tickets", method: "GET").'}],isError:!0};let e;try{e=await g(p,a)}catch(u){return{content:[{type:"text",text:u.message}],isError:!0}}const s=r.startsWith("/")?r:`/${r}`,{title:n=""}=e.info||{},i=e.paths?.[s],c=o.toLowerCase();if(!i||M(e,s).length===0)return{content:[{type:"text",text:E(e,n,s,a.mcpMode)}],isError:!0};const t=i[c];if(!x(t)||!P(t,"docs"))return{content:[{type:"text",text:v(e,n,s,o)}],isError:!0};const d=i?.parameters||[],m=t.parameters||[],h={...t,parameters:l({pathParams:d,opParams:m,definition:e}),requestBody:f(t.requestBody,e),responses:y(t.responses,e)};return{content:[{type:"text",text:JSON.stringify({api:n,version:e.info?.version||"",servers:e.servers||[],endpoint:{path:r,method:o.toUpperCase(),...h},globalSecurity:e.security||[],securitySchemes:e.components?.securitySchemes||{}},null,2)}]}};var C={"get-endpoint-info":b};export{C as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-endpoints.js

@@ -1 +1 @@
-import{loadApiDescription as p}from"./load-api-description.js";import{getEndpointsFromPaths as c}from"./utils.js";const a=async(n,r)=>{const{name:o,version:i}=n;let t;try{t=await p(o,r,i)}catch(s){return{content:[{type:"text",text:s.message}],isError:!0}}const e=c(t);return e.length===0?{content:[{type:"text",text:"No endpoints found"}]}:{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",servers:t.servers||[],endpoints:e},null,2)}]}};var l={"get-endpoints":a};export{l as default};
+import{loadApiDescription as i}from"./load-api-description.js";import{getEndpointsFromPaths as s}from"./utils.js";const p=async(n,r)=>{let t;try{t=await i(n,r)}catch(o){return{content:[{type:"text",text:o.message}],isError:!0}}const e=s(t);return e.length===0?{content:[{type:"text",text:"No endpoints found"}]}:{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",servers:t.servers||[],endpoints:e},null,2)}]}};var d={"get-endpoints":p};export{d as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-full-api-description.js

@@ -1 +1 @@
-import{loadApiDescription as s}from"./load-api-description.js";const p=async(e,i)=>{const{name:n,version:r}=e;let t;try{t=await s(n,i,r)}catch(o){return{content:[{type:"text",text:o.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",definition:t},null,2)}]}};var a={"get-full-api-description":p};export{a as default};
+import{loadApiDescription as n}from"./load-api-description.js";const o=async(e,i)=>{let t;try{t=await n(e,i)}catch(r){return{content:[{type:"text",text:r.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({api:t.info?.title||"",version:t.info?.version||"",definition:t},null,2)}]}};var s={"get-full-api-description":o};export{s as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/get-security-schemes.js

@@ -1 +1 @@
-import{loadApiDescription as c}from"./load-api-description.js";const o=async(t,r)=>{const{name:s,version:i}=t;let e;try{e=await c(s,r,i)}catch(n){return{content:[{type:"text",text:n.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({name:e.info?.title,version:e.info?.version,securitySchemes:e.components?.securitySchemes||{},security:e.security||[]},null,2)}]}};var y={"get-security-schemes":o};export{y as default};
+import{loadApiDescription as s}from"./load-api-description.js";const c=async(t,r)=>{let e;try{e=await s(t,r)}catch(i){return{content:[{type:"text",text:i.message}],isError:!0}}return{content:[{type:"text",text:JSON.stringify({name:e.info?.title,version:e.info?.version,securitySchemes:e.components?.securitySchemes||{},security:e.security||[]},null,2)}]}};var o={"get-security-schemes":c};export{o as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/list-apis.js

@@ -1 +1 @@
-import{filterApiDescriptionsByName as f}from"../../utils.js";const g=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=f(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),r=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:h,fetchEligible:x,...p})=>p),limit:e,total:r,page:n,totalPages:c})}]}};var u={"list-apis":g};export{u as default};
+import{filterApiDescriptionsByName as g}from"../../utils/api-name-matching.js";const h=async(l,a)=>{const{filter:i,page:n=1,limit:e=300}=l;let t=Object.values(a.apiDescriptionsMap);i&&(t=g(t,i));const s=(n-1)*e,o=s+e,c=Math.ceil(t.length/e),p=t.length;return t=t.slice(s,o),t.length===0?{content:[{type:"text",text:"No APIs available"}]}:{content:[{type:"text",text:JSON.stringify({items:t.map(({relativePath:r,fetchEligible:x,...f})=>({filePath:r,...f})),limit:e,total:p,page:n,totalPages:c})}]}};var u={"list-apis":h};export{u as default};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/load-api-description.d.ts

@@ -1,4 +1,8 @@
 import type { OpenAPIDefinition } from '@redocly/api-docs';
 import type { McpToolContext } from '../../../types.js';
-export declare function loadApiDescription(name: string, context: McpToolContext, version?: string): Promise<OpenAPIDefinition>;
+export declare function loadApiDescription({ name, version, filePath }: {
+    name: string;
+    version?: string;
+    filePath?: string;
+}, context: McpToolContext): Promise<OpenAPIDefinition>;
 //# sourceMappingURL=load-api-description.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/load-api-description.js

@@ -1 +1 @@
-import{findApiDescriptionByNameAndVersion as t}from"../../utils.js";import{getApiDescriptionFromFs as a}from"./utils.js";async function u(r,i,s){const o=t(i.apiDescriptionsMap,r,s);if(!o)throw new Error(`No API found matching "${r}".`);const e=!!i?.config?.access?.requiresLogin,c=i?.config?.access?.rbac||{},n=await a({relativePath:o.relativePath||"",outdir:i.outdir||"",user:i.user,rbac:c,requiresLogin:e});if(!n)throw new Error(`No API found matching "${r}".`);return n}export{u as loadApiDescription};
+import{describeAvailableApis as c,findApiDescriptionByNameAndVersion as u}from"../../utils/api-name-matching.js";import{getApiDescriptionFromFs as d}from"./utils.js";async function l({name:r,version:n,filePath:o},i){const e=o?Object.values(i.apiDescriptionsMap).find(s=>s.relativePath===o):u(i.apiDescriptionsMap,r,n);if(!e){if(o)throw new Error(`No API found with filePath "${o}". File paths are returned by the list-apis tool.`);const s=c(i.apiDescriptionsMap,r);throw new Error(s?`No API found matching "${r}". Available APIs: ${s}.`:`No API found matching "${r}".`)}const t=!!i?.config?.access?.requiresLogin,p=i?.config?.access?.rbac||{},a=await d({relativePath:e.relativePath||"",outdir:i.outdir||"",user:i.user,rbac:p,requiresLogin:t});if(!a)throw new Error(`No API found matching "${o||r}".`);return a}export{l as loadApiDescription};

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/types.d.ts

@@ -6,11 +6,13 @@ export type ListApisArgs = {
 export type ApiNameVersionArgs = {
     name: string;
     version?: string;
+    filePath?: string;
 };
 export type GetEndpointInfoArgs = {
     name: string;
     path: string;
     method: string;
     version?: string;
+    filePath?: string;
 };
 //# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/tools/openapi/utils.js

@@ -1 +1 @@
-import a from"node:path";import{existsSync as f}from"node:fs";import{readFile as d}from"node:fs/promises";import{replaceFileExtension as h}from"../../../../../plugins/openapi-docs/store-definition-bundles";import{PUBLIC_API_DEFINITIONS_FOLDER as u}from"../../../../../constants/common";import{filterDataByAccessDeep as l}from"../../../../../utils/rbac";import{checkEndpointAndDeleteXMcp as c}from"../../../utils/xmcp-utils.js";import{OPERATION_METHODS as E}from"./constants.js";function T(t){return typeof t=="object"&&t!==null&&"responses"in t&&typeof t.responses=="object"}const D=new Set(E);function b(t){const{paths:n={}}=t,e=[];for(const[r,i]of Object.entries(n)){const s=!c(i,"docs");for(const[p,o]of Object.entries(i))D.has(p.toLowerCase())&&(s||!c(o,"docs")||e.push({path:r,method:p.toUpperCase(),summary:o.summary,description:o.description,security:o.security}))}return e}async function _({relativePath:t,outdir:n,user:e,rbac:r={},requiresLogin:i=!1}){const s=a.join(n||"",u,h(t,".json"));if(!f(s))return;const o=await d(s,"utf-8"),m=JSON.parse(o);return l(m,{isAuthenticated:e?.isAuthenticated,email:e?.email,teams:e?.teams},r,i)}export{_ as getApiDescriptionFromFs,b as getEndpointsFromPaths,T as isMcpEndpoint};
+import a from"node:path";import{existsSync as f}from"node:fs";import{readFile as d}from"node:fs/promises";import{replaceFileExtension as h}from"../../../../../plugins/openapi-docs/store-definition-bundles";import{PUBLIC_API_DEFINITIONS_FOLDER as u}from"../../../../../constants/common";import{filterDataByAccessDeep as l}from"../../../../../utils/rbac";import{checkEndpointAndDeleteXMcp as c}from"../../../utils/xmcp-utils.js";import{HTTP_METHODS as y}from"./constants.js";function P(t){return typeof t=="object"&&t!==null&&"responses"in t&&typeof t.responses=="object"}function S(t){const{paths:n={}}=t,e=[];for(const[r,i]of Object.entries(n)){const s=!c(i,"docs");for(const[p,o]of Object.entries(i))y.has(p.toLowerCase())&&(s||!c(o,"docs")||e.push({path:r,method:p.toUpperCase(),summary:o.summary,description:o.description,security:o.security}))}return e}async function T({relativePath:t,outdir:n,user:e,rbac:r={},requiresLogin:i=!1}){const s=a.join(n||"",u,h(t,".json"));if(!f(s))return;const o=await d(s,"utf-8"),m=JSON.parse(o);return l(m,{isAuthenticated:e?.isAuthenticated,email:e?.email,teams:e?.teams},r,i)}export{T as getApiDescriptionFromFs,S as getEndpointsFromPaths,P as isMcpEndpoint};

package/dist/server/plugins/mcp/docs-mcp/utils/api-name-matching.d.ts

@@ -0,0 +1,8 @@
+import type { ApiDescriptionInfo } from '../../types.js';
+export declare const MAX_LISTED_CANDIDATES = 15;
+export declare function formatCandidates(items: string[]): string;
+/** Every API name in the catalog, closest to `name` first. Used to make a miss recoverable. */
+export declare function describeAvailableApis(apiDescriptionsMap: Record<string, ApiDescriptionInfo>, name: string): string;
+export declare function findApiDescriptionByNameAndVersion(apiDescriptionsMap: Record<string, ApiDescriptionInfo>, name: string, version?: string): ApiDescriptionInfo | undefined;
+export declare function filterApiDescriptionsByName(apiDescriptions: ApiDescriptionInfo[], filter: string): ApiDescriptionInfo[];
+//# sourceMappingURL=api-name-matching.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils/api-name-matching.js

@@ -0,0 +1 @@
+const $=15,p=new Set(["api","apis","rest","restful","openapi","graphql","spec","specification","service","services"]);function w(s){return s.toLowerCase().split(/[^a-z0-9_]+/).filter(Boolean)}function f(s){return new Set(w(s).filter(t=>!p.has(t)))}function d(s,t){return s.size===t.size&&[...s].every(n=>t.has(n))}function h(s){const t=s.slice(0,15),n=s.length-t.length;return n>0?`${t.join(", ")} (+${n} more)`:t.join(", ")}function v(s,t){const n=f(t);return[...new Set(s.map(e=>e.name))].map(e=>({name:e,score:[...f(e)].filter(r=>n.has(r)).length})).sort((e,r)=>r.score-e.score||e.name.localeCompare(r.name)).map(({name:e})=>e)}function g(s,t){const n=Object.values(s);return n.length===0?"":h(v(n,t).map(e=>`"${e}"`))}function T(s,t){const n=t.trim().toLowerCase();if(!n)return{matches:[],isExactTitle:!1};const e=s.map(a=>({api:a,title:a.name.trim().toLowerCase()})),r=a=>a.map(({api:o})=>o),i=e.filter(({title:a})=>a===n);if(i.length>0)return{matches:r(i),isExactTitle:!0};const l=e.filter(({title:a})=>a.includes(n));if(l.length>0)return{matches:r(l),isExactTitle:!1};const m=f(n);if(m.size===0)return{matches:[],isExactTitle:!1};const u=e.filter(({title:a})=>{const o=f(a);return o.size>0&&d(o,m)});return{matches:r(u),isExactTitle:!1}}function A(s,t,n){if(!t)return;const{matches:e,isExactTitle:r}=T(Object.values(s),t);if(e.length===0)return;if(!r){const o=[...new Set(e.map(({name:c})=>c))];if(o.length>1)throw new Error(`"${t}" matches ${o.length} APIs: ${h(o.map(c=>`"${c}"`))}. Pass one of those names exactly, or the "filePath" parameter from list-apis.`)}const i=n?e.filter(o=>o.version===n):e;if(i.length===0){const o=[...new Set(e.map(({version:c})=>c||"(no version)"))];throw new Error(`"${e[0].name||t}" has no version "${n}". Available versions: ${h(o)}.`)}if(i.length===1)return i[0];const l=i[0].name||t;if(new Set(i.map(({version:o})=>o||"")).size>1){const o=i.map(({version:c})=>c||"(no version)").join(", ");throw new Error(`Multiple versions of "${l}" found: ${o}. Specify a version to disambiguate.`)}const u=i.map(({relativePath:o})=>`"${o||"(unknown path)"}"`).join(", "),a=i[0].version?` at version "${i[0].version}"`:"";throw new Error(`Multiple APIs are titled "${l}"${a}. Pass the "filePath" parameter to select one of: ${u}.`)}function E(s,t){const n=t.trim().toLowerCase();if(!n)return s;const e=s.filter(({name:r})=>r.toLowerCase().includes(n));return e.length>0?e:s.filter(({description:r})=>!!r?.toLowerCase().includes(n))}export{$ as MAX_LISTED_CANDIDATES,g as describeAvailableApis,E as filterApiDescriptionsByName,A as findApiDescriptionByNameAndVersion,h as formatCandidates};

package/dist/server/plugins/mcp/docs-mcp/{utils.d.ts → utils/resolve-refs.d.ts}

@@ -1,7 +1,4 @@
 import type { OpenAPISchema, OpenAPIParameter, OpenAPIResponse, OpenAPIRequestBody, Referenced, OpenAPIDefinition } from '@redocly/api-docs';
-import type { ApiDescriptionInfo } from '../types.js';
-export declare function findApiDescriptionByNameAndVersion(apiDescriptionsMap: Record<string, ApiDescriptionInfo>, name: string, version?: string): ApiDescriptionInfo | undefined;
-export declare function filterApiDescriptionsByName(apiDescriptionsMap: ApiDescriptionInfo[], filter: string): ApiDescriptionInfo[];
 export declare function resolveRef<T>(ref: string, def?: OpenAPIDefinition): T | undefined;
 type ResolveSchemaRefsParams = {
     schema: Referenced<OpenAPISchema> | undefined;
@@ -20,4 +17,4 @@ export declare function resolveParameters({ pathParams, opParams, definition, }:
 export declare function resolveRequestBody(requestBody: Referenced<OpenAPIRequestBody> | undefined, definition: OpenAPIDefinition): OpenAPIRequestBody | undefined;
 export declare function resolveResponses(responses: Record<string, Referenced<OpenAPIResponse>>, definition: OpenAPIDefinition): Record<string, OpenAPIResponse>;
 export {};
-//# sourceMappingURL=utils.d.ts.map
+//# sourceMappingURL=resolve-refs.d.ts.map

package/dist/server/plugins/mcp/docs-mcp/utils/resolve-refs.js

@@ -0,0 +1 @@
+function $(e,o){if(!o||!e?.startsWith("#/"))return;const n=e.slice(2).split("/");let t=o;for(const r of n)if(typeof t=="object"&&t!==null&&r in t)t=t[r];else return;return t}function m(e,o){const n=Object.fromEntries(Object.entries(e).filter(([t,r])=>t!=="$ref"&&r!==void 0));return{...o,...n}}function l({schema:e,definition:o,visitedRefs:n=new Set,maxDepth:t=50,currentDepth:r=0}){if(!e)return;if(r>=t)return{type:"object",description:`Maximum resolution depth exceeded (${t})`};if("$ref"in e&&e.$ref){if(n.has(e.$ref))return{type:"object",description:`Circular reference detected: ${e.$ref}`,"x-circular-ref":e.$ref};const f=new Set(n);f.add(e.$ref);const i=$(e.$ref,o);if(!i)return{type:"object",description:`Could not resolve reference: ${e.$ref}`,"x-unresolved-ref":e.$ref};const u=l({schema:i,definition:o,visitedRefs:f,maxDepth:t,currentDepth:r+1});return u&&m(e,u)}const s={...e};if(s.properties){const f={};for(const[i,u]of Object.entries(s.properties)){const d=l({schema:u,definition:o,visitedRefs:new Set(n),maxDepth:t,currentDepth:r+1});f[i]=d||u}s.properties=f}if(s.items&&typeof s.items=="object")if(Array.isArray(s.items))s.items=s.items.map(f=>l({schema:f,definition:o,visitedRefs:new Set(n),maxDepth:t,currentDepth:r+1})||f);else{const f=l({schema:s.items,definition:o,visitedRefs:new Set(n),maxDepth:t,currentDepth:r+1});f&&(s.items=f)}return["allOf","anyOf","oneOf"].forEach(f=>{const i=s[f];Array.isArray(i)&&(s[f]=i.reduce((u,d)=>{const p=l({schema:d,definition:o,visitedRefs:new Set(n),maxDepth:t,currentDepth:r+1});return p&&u.push(p),u},[]))}),s}function a({pathParams:e,opParams:o,definition:n}){return[...e,...o].reduce((t,r)=>{if(!r)return t;if("$ref"in r&&r.$ref){const s=$(r.$ref,n);if(!s)return t;const c=m(r,s);return t.push({...c,schema:"schema"in c&&c.schema?l({schema:c.schema,definition:n}):void 0}),t}return t.push({...r,schema:"schema"in r&&r.schema?l({schema:r.schema,definition:n}):void 0}),t},[])}function v(e,o){const n={...e};if(e.example!==void 0&&(n.example=e.example),!e.examples)return n;const t={};for(const[r,s]of Object.entries(e.examples))if("$ref"in s){const c=$(s.$ref,o);c&&(t[r]=c)}else t[r]=s;return n.examples=t,n}function h(e,o){if(!e)return;const n="$ref"in e&&e.$ref?$(e.$ref,o):e;if(!n)return;const t=m(e,n),r={...t};if("content"in t&&t.content){const s={};for(const[c,f]of Object.entries(t.content))s[c]={...v(f,o),schema:f.schema?l({schema:f.schema,definition:o}):void 0};r.content=s}return r}function b(e,o){return Object.entries(e).reduce((n,[t,r])=>{const s="$ref"in r&&r.$ref?$(r.$ref,o):r;if(!s)return n;const c=m(r,s),f={...c};if("content"in c&&c.content){const i={};for(const[u,d]of Object.entries(c.content))i[u]={...v(d,o),schema:d.schema?l({schema:d.schema,definition:o}):void 0};f.content=i}return n[t]=f,n},{})}export{a as resolveParameters,$ as resolveRef,h as resolveRequestBody,b as resolveResponses,l as resolveSchemaRefs};

package/dist/server/plugins/mcp/gateway-mcp/elicitation.d.ts

@@ -3,26 +3,46 @@ import type { UpstreamAuthRequiredEvent } from './upstream-auth.js';
 import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
 import type { KvService } from '@redocly/config';
 export declare const CREDENTIALS_INPUT_REQUEST_KEY = "credentials";
+export type CredentialTarget = {
+    api: string;
+    name: string;
+};
+/**
+ * Why the prompt is being raised. `authFailure` is the automatic path behind an upstream 401;
+ * `requested` is the model calling the credentials tool on the user's behalf.
+ */
+export type CredentialElicitationReason = {
+    kind: 'authFailure';
+    status: number;
+    otherApiNames?: string[];
+} | {
+    kind: 'requested';
+};
+type CredentialElicitationRequest = {
+    subject: string;
+    baseUrl: string;
+    target: CredentialTarget;
+    auth: UpstreamAuthScheme;
+    kv: KvService;
+    hasExistingSecret: boolean;
+    reason: CredentialElicitationReason;
+};
 export declare function isCredentialElicitationDeclined(inputResponses: Record<string, unknown> | undefined): boolean;
+export declare function targetOf(event: UpstreamAuthRequiredEvent): CredentialTarget;
 /**
  * The 2026-07-28-era credentials prompt: the tool call returns an input-required result the
  * client fulfils and retries, with no push `elicitation/create` and no session behind it.
  * Nothing has to survive the round trip - the secrets are keyed by `subject`, which is
  * recomputed from the caller's identity on every request.
  */
-export declare function buildUpstreamCredentialInputRequired({ subject, baseUrl, events, auth, kv, }: {
-    subject: string;
-    baseUrl: string;
-    events: UpstreamAuthRequiredEvent[];
-    auth: UpstreamAuthScheme;
-    kv: KvService;
-}): Promise<InputRequiredResult>;
-/** Fallback text for a 2026-07-28-era client without URL-elicitation support. */
-export declare function buildUpstreamCredentialFallback({ subject, baseUrl, events, auth, kv, }: {
-    subject: string;
-    baseUrl: string;
-    events: UpstreamAuthRequiredEvent[];
-    auth: UpstreamAuthScheme;
-    kv: KvService;
-}): Promise<string>;
+export declare function buildUpstreamCredentialInputRequired(request: CredentialElicitationRequest): Promise<InputRequiredResult>;
+/** Fallback text for a client without URL-elicitation support. */
+export declare function buildUpstreamCredentialFallback(request: CredentialElicitationRequest): Promise<string>;
+/**
+ * Text for an authorization failure we deliberately do NOT prompt for: a stored secret the
+ * upstream rejected, or a 403/407 that is more likely a permissions problem than a missing key.
+ * Minting another link here is what produced the credentials-link loop.
+ */
+export declare function buildCredentialsToolHint(event: UpstreamAuthRequiredEvent): string;
+export {};
 //# sourceMappingURL=elicitation.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/elicitation.js

@@ -1,2 +1,3 @@
-import{inputRequired as s,inputResponse as p}from"@modelcontextprotocol/server";import{secretStore as h,ELICITATION_TTL_MS as m}from"./secret-store.js";import{ANONYMOUS_SUBJECT_PREFIX as c}from"./subject.js";const l="credentials";function k(e){const t=p(e,l);return t.kind==="elicit"&&(t.action==="decline"||t.action==="cancel")}async function v({subject:e,baseUrl:t,events:n,auth:a,kv:r}){const{url:i}=await u(r,e,t,n,a);return s({inputRequests:{[l]:s.elicitUrl({message:T(n[0].name),url:i})}})}async function A({subject:e,baseUrl:t,events:n,auth:a,kv:r}){const{url:i}=await u(r,e,t,n,a);return E(n,i,f(e))}async function u(e,t,n,a,r){const i=a[0],o=await h.createElicitation(e,{subject:t,api:i.api,name:i.name,auth:r});return{token:o,url:g(n,o)}}function f(e){return e.startsWith(c)?e.slice(c.length):void 0}function T(e){return`The "${e}" API requires credentials. Open the link to provide them securely; they never pass through the chat.`}function g(e,t){if(!e)return`/mcp/credentials?token=${t}`;try{const n=new URL("/mcp/credentials",e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}/mcp/credentials?token=${t}`}}function E(e,t,n){const[a,...r]=e,i=[`The upstream API "${a.name}" returned 401 Unauthorized.`,"",`**Action required: show the user the link below and ask them to open it in a browser to provide the API credentials (valid ${Math.round(m/6e4)} minutes):**`,"",t,"",n?`Then call this tool again with sessionHandle: "${n}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Then call this tool again - the credentials are applied server-side and never appear in the conversation."];if(r.length>0){const o=r.map(d=>`"${d.name}"`).join(", ");i.push("",`The remaining APIs (${o}) will prompt for credentials on subsequent calls.`)}return i.join(`
-`)}export{l as CREDENTIALS_INPUT_REQUEST_KEY,A as buildUpstreamCredentialFallback,v as buildUpstreamCredentialInputRequired,k as isCredentialElicitationDeclined};
+import{inputRequired as c,inputResponse as f}from"@modelcontextprotocol/server";import{MANAGE_API_CREDENTIALS_TOOL_NAME as T}from"../constants.js";import{secretStore as $,ELICITATION_TTL_MS as A}from"./secret-store.js";import{ANONYMOUS_SUBJECT_PREFIX as l}from"./subject.js";const h="credentials";function C(e){const t=f(e,h);return t.kind==="elicit"&&(t.action==="decline"||t.action==="cancel")}function _(e){return{api:e.api,name:e.name}}async function b(e){const{url:t}=await d(e);return c({inputRequests:{[h]:c.elicitUrl({message:P(e.target.name,e.hasExistingSecret),url:t})}})}async function O(e){const{url:t}=await d(e);return y(e,t,I(e.subject))}function R(e){return[e.status===401?`The stored credentials for "${e.name}" were rejected (HTTP 401).`:`The "${e.name}" API rejected the request with HTTP ${e.status}.`,"",`Do not retry the same call. Call \`${T}\` with api: "${e.api}" to get a link the user has to open in a browser to replace or remove the stored credentials, then retry once they confirm they saved them.`].join(`
+`)}async function d({kv:e,subject:t,baseUrl:n,target:i,auth:a,hasExistingSecret:o}){const r=await $.createElicitation(e,{subject:t,api:i.api,name:i.name,auth:a,hasExistingSecret:o});return{token:r,url:g(n,r)}}function I(e){return e.startsWith(l)?e.slice(l.length):void 0}function P(e,t){const n=`The link works for ${u()} minutes.`;return t?`Open this page in a browser to replace or remove the stored credentials for the "${e}" API. They go straight to the API and never enter the chat. ${n}`:`The "${e}" API needs credentials. Open this page in a browser to paste them - they go straight to the API and never enter the chat. ${n}`}function u(){return Math.round(A/6e4)}function g(e,t){if(!e)return`/mcp/credentials?token=${t}`;try{const n=new URL("/mcp/credentials",e);return n.searchParams.set("token",t),n.toString()}catch{return`${e}/mcp/credentials?token=${t}`}}function y({target:e,reason:t,hasExistingSecret:n},i,a){const r=[`**Stop and show the user this link. They have to open it in a browser to ${n?`replace or remove the stored credentials for the "${e.name}" API`:`add credentials for the "${e.name}" API`} - nothing continues until they do.**`,"",i,"",`The link is valid ${u()} minutes and opens a form on this site. Credentials go straight to the API from there: never ask for them in the conversation and never pass them as a tool argument.`,"",t.kind==="authFailure"?`The upstream API "${e.name}" returned ${t.status} and needs credentials.`:n?`Credentials are already stored for the "${e.name}" API; the link lets the user replace or remove them.`:`The "${e.name}" API needs credentials.`,a?`Once the user confirms they saved them, call this tool again with sessionHandle: "${a}" - the credentials are stored against that handle, applied server-side, and never appear in the conversation.`:"Once the user confirms they saved them, call this tool again - the credentials are applied server-side and never appear in the conversation."],s=t.kind==="authFailure"?t.otherApiNames??[]:[];if(s.length>0){const p=s.map(m=>`"${m}"`).join(", ");r.push("",`The remaining APIs (${p}) will prompt for credentials on subsequent calls.`)}return r.join(`
+`)}export{h as CREDENTIALS_INPUT_REQUEST_KEY,R as buildCredentialsToolHint,O as buildUpstreamCredentialFallback,b as buildUpstreamCredentialInputRequired,C as isCredentialElicitationDeclined,_ as targetOf};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.d.ts

@@ -0,0 +1,24 @@
+import type { GatewayFetchOutcome } from './fetch-telemetry.js';
+type GatewayFetchAuditRecord = {
+    rawUrl: string;
+    method: string;
+    host: string;
+    outcome: GatewayFetchOutcome;
+    durationMs: number;
+    injectedSecretValues: readonly string[];
+    path?: string;
+    api?: string;
+    status?: number;
+    requestHeaders?: Record<string, string>;
+    requestBody?: string;
+    responseHeaders?: Record<string, string>;
+    responseBody?: string;
+};
+/**
+ * One outbound gateway fetch. `host`, `method` and `path` repeat the `mcpServer.gatewayFetch`
+ * telemetry event verbatim so a Grafana row joins onto this line; `url_sha256` identifies the
+ * request itself, since the telemetry event's `path` is deliberately normalized.
+ */
+export declare function logGatewayFetchAudit({ rawUrl, method, host, outcome, durationMs, injectedSecretValues, path, api, status, requestHeaders, requestBody, responseHeaders, responseBody, }: GatewayFetchAuditRecord): void;
+export {};
+//# sourceMappingURL=fetch-audit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-audit.js

@@ -0,0 +1 @@
+import{auditHeaderNames as u,auditInput as g,auditOutputDigest as c,auditSha256 as b,auditUrl as l,logAuditRecord as y}from"../../audit/audit-log.js";function D({rawUrl:e,method:n,host:i,outcome:r,durationMs:o,injectedSecretValues:t,path:_,api:h,status:f,requestHeaders:p,requestBody:d,responseHeaders:m,responseBody:a}){const s=a===void 0?void 0:c(a);y("Record gateway fetch",{url_sha256:b(e),host:i,method:n,path:_,api:h,outcome:r,status:f,duration_ms:o,url:l(e,t),request_header_names:u(p),request_body:d===void 0?void 0:g(d,t),response_header_names:u(m),response_sha256:s?.sha256,response_bytes:s?.bytes})}export{D as logGatewayFetchAudit};

package/dist/server/plugins/mcp/gateway-mcp/fetch/fetch-bridge.js

@@ -1 +1 @@
-import{Agent as P}from"undici";import{envConfig as W}from"../../../../config/env-config.js";import{logger as C}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as H}from"./ssrf-guard.js";import{createSsrfSafeLookup as J}from"./ssrf-safe-lookup.js";import{SsrfBlockedError as U}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as $,GatewayFetchSystemError as K,GatewayFetchUserError as A}from"./fetch-errors.js";import{redactHeaders as x,redactSecretsFromString as V}from"./redact.js";import{normalizeFetchPath as X}from"./normalize-path.js";import{reportGatewayFetch as O}from"./fetch-telemetry.js";const G="x-forwarded-for",Y=3e4,z=1024*1024;let k;function I(){if(!k){const t=W.isDevelopMode;t&&C.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),k=new P({connect:{lookup:J({allowLoopback:t})}})}return k}function we({allowedHosts:t,apis:e=[],authorization:r,onAuthRequired:n,fetchImpl:s=fetch,dispatcher:u=I(),timeoutMs:c=Y,maxResponseBytes:h=z,maxFetchesPerExec:f,clientIp:m}){const v=[...t,...e.flatMap(o=>o.matchers)],N=[r,...e.map(o=>o.secret?.value)].filter(o=>!!o),D=e.map(o=>o.secret?.header).filter(o=>!!o);let F=0;return async o=>{const g=o.method??"GET",T=Date.now();let M,b,E,S={},R,L;try{if(f!==void 0){const l=Math.max(0,f);if(F+=1,F>l)throw new A(`Outbound fetch budget exceeded (max ${l} fetches per execute); split the work across calls`)}const i=H(o.url,v);M=i.hostname,b=X(i.pathname);const y=e.filter(l=>l.matchers.some(j=>j.test(i.hostname))),a=y.length===1?y[0]:void 0;E=a?.slug,S=ne(o.headers,a?.secret,r,m);const p=new AbortController;L=setTimeout(()=>p.abort(),c);const d=await s(i,{method:g,headers:S,body:o.body,redirect:"manual",signal:p.signal,dispatcher:u});R=d.status,d.status===401&&a&&n&&n({api:a.slug,name:a.name});const _=await oe(d,h);let w=ae(d.headers);if(ee(d.status)){w=x(w,D);const{location:l}=w;l&&!te(l,i,v)&&delete w.location}return O({host:i.hostname,method:g,outcome:"success",durationMs:Date.now()-T,path:b,api:E,status:d.status,bytes:Buffer.byteLength(_,"utf8")}),{status:d.status,statusText:d.statusText,ok:d.ok,headers:w,bodyText:_}}catch(i){const{outcome:y,userSafe:a}=Z(i),p=M??(a instanceof $?a.host:void 0)??q(o.url)??"invalid-url";throw O({host:p,method:g,outcome:y,durationMs:Date.now()-T,path:b,api:E,status:R}),a||(C.error(`Gateway MCP fetch failed [${g} ${p}]: ${V(re(i),N)} headers=${JSON.stringify(x(S,D))}`),new K("Upstream fetch failed due to an internal error"))}finally{L!==void 0&&clearTimeout(L)}}}function Q(t){let e=t;for(let r=0;r<5&&e instanceof Error;r++){if(e instanceof A||e instanceof U)return e;e=e.cause}}function Z(t){const e=Q(t);return{outcome:e instanceof $||e instanceof U?"blocked":e?"user_error":"system_error",userSafe:e}}function q(t){try{return new URL(t).hostname||void 0}catch{return}}function ee(t){return t>=300&&t<400}function te(t,e,r){try{return!!H(new URL(t,e).href,r)}catch{return!1}}function re(t){if(!(t instanceof Error))return String(t);const e=t.cause;return e instanceof Error?`${t.message}: ${e.message}`:t.message}async function oe(t,e){const r=Number(t.headers.get("content-length"));if(Number.isFinite(r)&&r>e)throw B(e,r);if(!t.body)return"";const n=t.body.getReader(),s=new TextDecoder;let u=0,c="";try{for(;;){const{done:h,value:f}=await n.read();if(h)break;if(u+=f.byteLength,u>e)throw B(e,u);c+=s.decode(f,{stream:!0})}return c+s.decode()}finally{await n.cancel().catch(()=>{})}}function B(t,e){return new A(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function ne(t,e,r,n){const s={},u=new Set;for(const[h,f]of Object.entries(t??{})){const m=h.toLowerCase();m==="host"||m==="content-length"||m!==G&&(u.add(m),s[h]=f)}n&&(s[G]=n);const c=e??(r?{header:"Authorization",value:r}:void 0);return c&&!u.has(c.header.toLowerCase())&&(s[c.header]=c.value),s}function ae(t){const e={};return t.forEach((r,n)=>{e[n.toLowerCase()]=r}),e}export{we as buildFetchBridge,I as getDefaultAgent,oe as readCappedBody};
+import{Agent as W}from"undici";import{envConfig as I}from"../../../../config/env-config.js";import{logger as R}from"../../../../tools/notifiers/logger.js";import{assertUrlAllowed as B}from"./ssrf-guard.js";import{createSsrfSafeLookup as J}from"./ssrf-safe-lookup.js";import{SsrfBlockedError as C}from"./ssrf-blocklist.js";import{GatewayFetchBlockedError as $,GatewayFetchSystemError as K,GatewayFetchUserError as U}from"./fetch-errors.js";import{redactHeaders as x,redactSecretsFromString as V}from"./redact.js";import{normalizeFetchPath as X}from"./normalize-path.js";import{reportGatewayFetch as G}from"./fetch-telemetry.js";import{logGatewayFetchAudit as O}from"./fetch-audit.js";const N="x-forwarded-for",Y=3e4,z=1024*1024,Q=new Set([401,403,407]);let M;function Z(){if(!M){const t=I.isDevelopMode;t&&R.warn("Gateway MCP SSRF guard: loopback upstreams are ALLOWED (develop mode only, never in runtime)."),M=new W({connect:{lookup:J({allowLoopback:t})}})}return M}function be({allowedHosts:t,apis:e=[],authorization:o,onAuthRequired:s,fetchImpl:i=fetch,dispatcher:u=Z(),timeoutMs:d=Y,maxResponseBytes:h=z,maxFetchesPerExec:f,clientIp:m}){const k=[...t,...e.flatMap(r=>r.matchers)],L=[o,...e.map(r=>r.secret?.value)].filter(r=>!!r),v=e.map(r=>r.secret?.header).filter(r=>!!r);let H=0;return async r=>{const w=r.method??"GET",A=Date.now();let _,g,b,S={},T,D;try{if(f!==void 0){const l=Math.max(0,f);if(H+=1,H>l)throw new U(`Outbound fetch budget exceeded (max ${l} fetches per execute); split the work across calls`)}const n=B(r.url,k);_=n.hostname,g=X(n.pathname);const E=e.filter(l=>l.matchers.some(P=>P.test(n.hostname))),c=E.length===1?E[0]:void 0;b=c?.slug,S=se(r.headers,c?.secret,o,m);const p=new AbortController;D=setTimeout(()=>p.abort(),d);const a=await i(n,{method:w,headers:S,body:r.body,redirect:"manual",signal:p.signal,dispatcher:u});T=a.status,Q.has(a.status)&&c&&s&&s({api:c.slug,name:c.name,status:a.status});const F=await ae(a,h);let y=ce(a.headers);if(re(a.status)){y=x(y,v);const{location:l}=y;l&&!oe(l,n,k)&&delete y.location}return G({host:n.hostname,method:w,outcome:"success",durationMs:Date.now()-A,path:g,api:b,status:a.status,bytes:Buffer.byteLength(F,"utf8")}),O({rawUrl:n.href,method:w,host:n.hostname,outcome:"success",durationMs:Date.now()-A,injectedSecretValues:L,path:g,api:b,status:a.status,requestHeaders:S,requestBody:r.body,responseHeaders:y,responseBody:F}),{status:a.status,statusText:a.statusText,ok:a.ok,headers:y,bodyText:F}}catch(n){const{outcome:E,userSafe:c}=ee(n),p=_??(c instanceof $?c.host:void 0)??te(r.url)??"invalid-url";throw G({host:p,method:w,outcome:E,durationMs:Date.now()-A,path:g,api:b,status:T}),O({rawUrl:r.url,method:w,host:p,outcome:E,durationMs:Date.now()-A,injectedSecretValues:L,path:g,api:b,status:T,requestHeaders:S,requestBody:r.body}),c||(R.error(`Gateway MCP fetch failed [${w} ${p}]: ${V(ne(n),L)} headers=${JSON.stringify(x(S,v))}`),new K("Upstream fetch failed due to an internal error"))}finally{D!==void 0&&clearTimeout(D)}}}function q(t){let e=t;for(let o=0;o<5&&e instanceof Error;o++){if(e instanceof U||e instanceof C)return e;e=e.cause}}function ee(t){const e=q(t);return{outcome:e instanceof $||e instanceof C?"blocked":e?"user_error":"system_error",userSafe:e}}function te(t){try{return new URL(t).hostname||void 0}catch{return}}function re(t){return t>=300&&t<400}function oe(t,e,o){try{return!!B(new URL(t,e).href,o)}catch{return!1}}function ne(t){if(!(t instanceof Error))return String(t);const e=t.cause;return e instanceof Error?`${t.message}: ${e.message}`:t.message}async function ae(t,e){const o=Number(t.headers.get("content-length"));if(Number.isFinite(o)&&o>e)throw j(e,o);if(!t.body)return"";const s=t.body.getReader(),i=new TextDecoder;let u=0,d="";try{for(;;){const{done:h,value:f}=await s.read();if(h)break;if(u+=f.byteLength,u>e)throw j(e,u);d+=i.decode(f,{stream:!0})}return d+i.decode()}finally{await s.cancel().catch(()=>{})}}function j(t,e){return new U(`Response is too large (over ${t} bytes, got ${e}); request less data`)}function se(t,e,o,s){const i={},u=new Set;for(const[h,f]of Object.entries(t??{})){const m=h.toLowerCase();m==="host"||m==="content-length"||m!==N&&(u.add(m),i[h]=f)}s&&(i[N]=s);const d=e??(o?{header:"Authorization",value:o}:void 0);return d&&!u.has(d.header.toLowerCase())&&(i[d.header]=d.value),i}function ce(t){const e={};return t.forEach((o,s)=>{e[s.toLowerCase()]=o}),e}export{be as buildFetchBridge,Z as getDefaultAgent,ae as readCappedBody};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/apply-edge-rate-limit.js

@@ -1 +1 @@
-import{CacheService as a}from"../../../../persistence/cache/services/cache-service.js";import{logger as s}from"../../../../tools/notifiers/logger.js";import{ipRateLimitKey as c}from"./ip-key.js";import{checkEdgeRateLimit as p}from"./edge-limiter.js";import{resolveGatewayFetchLimits as m}from"./limits.js";import{reportMcpRateLimited as d}from"./rate-limit-telemetry.js";async function S(o,n){const i=c(o);if(!i)return;let e,r;try{const t=await a.getInstance({baseDbDir:n.serverOutDir,databaseType:"local"});r=m(),e=await p({cache:t,ip:i,limits:r,now:Date.now()})}catch(t){s.warn(`gateway rate-limit init error, failing open: ${String(t)}`);return}if(!e.allowed)return d({scope:e.scope,retryAfterSeconds:e.retryAfterSeconds,limit:e.scope==="rate"?r.ratePerMin:r.quotaPerDay}),new Response(JSON.stringify({jsonrpc:"2.0",error:{code:-32029,message:`Rate limit exceeded (${e.scope}); retry after ${e.retryAfterSeconds}s`},id:null}),{status:429,headers:{"Content-Type":"application/json","Retry-After":String(e.retryAfterSeconds)}})}export{S as applyEdgeRateLimit};
+import{envConfig as o}from"../../../../config/env-config.js";import{KvRepository as s}from"../../../../persistence/kv/repositories/kv-repository.js";import{logger as m}from"../../../../tools/notifiers/logger.js";import{ipRateLimitKey as p}from"./ip-key.js";import{checkEdgeRateLimit as c}from"./edge-limiter.js";import{resolveGatewayFetchLimits as d}from"./limits.js";import{reportMcpRateLimited as f}from"./rate-limit-telemetry.js";async function S(n,a){const i=p(n);if(!i)return;let e,t;try{const r=await s.create({baseDbDir:a.serverOutDir,sqldRemoteDatabaseUrl:o.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:o.SQLD_REMOTE_DATABASE_AUTH_TOKEN});t=d(),e=await c({kv:r,ip:i,limits:t,now:Date.now()})}catch(r){m.warn(`gateway rate-limit init error, failing open: ${String(r)}`);return}if(!e.allowed)return f({scope:e.scope,retryAfterSeconds:e.retryAfterSeconds,limit:e.scope==="rate"?t.ratePerMin:t.quotaPerDay}),new Response(JSON.stringify({jsonrpc:"2.0",error:{code:-32029,message:`Rate limit exceeded (${e.scope}); retry after ${e.retryAfterSeconds}s`},id:null}),{status:429,headers:{"Content-Type":"application/json","Retry-After":String(e.retryAfterSeconds)}})}export{S as applyEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/edge-limiter.d.ts

@@ -1,4 +1,4 @@
-import type { CacheService } from '../../../../persistence/cache/services/cache-service.js';
+import type { KvRepository } from '../../../../persistence/kv/repositories/kv-repository.js';
 import type { GatewayFetchLimits } from './limits.js';
 export type EdgeDecision = {
     allowed: true;
@@ -8,7 +8,7 @@ export type EdgeDecision = {
     scope: 'rate' | 'quota';
 };
 export declare function checkEdgeRateLimit(params: {
-    cache: CacheService;
+    kv: KvRepository;
     ip: string;
     limits: GatewayFetchLimits;
     now: number;

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/edge-limiter.js

@@ -1 +1 @@
-import{checkAndIncrement as a}from"./window-counter.js";const s=60,d=86400;async function w(i){const{cache:e,ip:t,limits:o,now:r}=i,n=await a({cache:e,ip:t,windowSeconds:s,limit:o.ratePerMin,now:r});if(!n.allowed)return{allowed:!1,retryAfterSeconds:n.retryAfterSeconds,scope:"rate"};const c=await a({cache:e,ip:t,windowSeconds:d,limit:o.quotaPerDay,now:r});return c.allowed?{allowed:!0}:{allowed:!1,retryAfterSeconds:c.retryAfterSeconds,scope:"quota"}}export{w as checkEdgeRateLimit};
+import{checkAndIncrement as c}from"./window-counter.js";const s=60,d=86400;async function w(i){const{kv:e,ip:t,limits:o,now:r}=i;await e.sync();const n=await c({kv:e,ip:t,windowSeconds:s,limit:o.ratePerMin,now:r});if(!n.allowed)return{allowed:!1,retryAfterSeconds:n.retryAfterSeconds,scope:"rate"};const a=await c({kv:e,ip:t,windowSeconds:d,limit:o.quotaPerDay,now:r});return a.allowed?{allowed:!0}:{allowed:!1,retryAfterSeconds:a.retryAfterSeconds,scope:"quota"}}export{w as checkEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/window-counter.d.ts

@@ -1,4 +1,4 @@
-import type { CacheService } from '../../../../persistence/cache/services/cache-service.js';
+import type { KvRepository } from '../../../../persistence/kv/repositories/kv-repository.js';
 export type WindowCheck = {
     allowed: false;
     retryAfterSeconds: number;
@@ -6,7 +6,7 @@ export type WindowCheck = {
     allowed: true;
 };
 export declare function checkAndIncrement(params: {
-    cache: CacheService;
+    kv: KvRepository;
     ip: string;
     windowSeconds: number;
     limit: number;

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/window-counter.js

@@ -1 +1 @@
-import{logger as f}from"../../../../tools/notifiers/logger.js";const s="gateway-fetch-rl";async function m(i){const{cache:e,ip:l,windowSeconds:t,limit:w,now:d}=i,n=Math.floor(d/1e3),o=Math.floor(n/t),r=`${l}:${t}:${o}`;try{const a=(await e.get({key:r,namespace:s}))?.count??0;if(a>=w){const u=(o+1)*t-n;return{allowed:!1,retryAfterSeconds:Math.max(1,u)}}return await e.set({key:r,namespace:s,value:{count:a+1},ttlInSeconds:t}),{allowed:!0}}catch(c){return f.warn(`gateway rate-limit store error, failing open: ${String(c)}`),{allowed:!0}}}export{m as checkAndIncrement};
+import{logger as g}from"../../../../tools/notifiers/logger.js";function u(e,t,o){return["mcp","gateway-fetch-rl",e,String(t),String(o)]}async function S(e){const{kv:t,ip:o,windowSeconds:n,limit:w,now:l}=e,r=Math.floor(l/1e3),c=Math.floor(r/n),i=u(o,n,c);try{const s=(await t.get(i))?.count??0;if(s>=w){const d=(c+1)*n-r;return{allowed:!1,retryAfterSeconds:Math.max(1,d)}}return await t.set(i,{count:s+1},{ttlInSeconds:n}),{allowed:!0}}catch(a){return g.warn(`gateway rate-limit store error, failing open: ${String(a)}`),{allowed:!0}}}export{S as checkAndIncrement};

package/dist/server/plugins/mcp/gateway-mcp/secret-store.d.ts

@@ -10,11 +10,14 @@ export type ElicitationTarget = {
     api: string;
     name: string;
     auth: UpstreamAuthScheme;
+    hasExistingSecret?: boolean;
 };
 export declare class SecretStore {
     #private;
     setSecret(kv: KvService, subject: string, api: string, secret: StoredSecret): Promise<void>;
     getSecretsForSubject(kv: KvService, subject: string): Promise<Record<string, StoredSecret>>;
+    hasSecret(kv: KvService, subject: string, api: string): Promise<boolean>;
+    deleteSecret(kv: KvService, subject: string, api: string): Promise<void>;
     deleteSubject(kv: KvService, subject: string): Promise<void>;
     createElicitation(kv: KvService, target: ElicitationTarget): Promise<string>;
     peekElicitation(kv: KvService, token: string): Promise<ElicitationTarget | undefined>;

package/dist/server/plugins/mcp/gateway-mcp/secret-store.js

@@ -1 +1 @@
-import{createCipheriv as o,createDecipheriv as f,createHash as u,hkdfSync as a,randomBytes as h,randomUUID as m}from"node:crypto";import{JWT_SECRET_KEY as c}from"../../../constants/common.js";import{secretTtlSeconds as l}from"./subject.js";const p=900*1e3,d="mcp-upstream-secrets",y="mcp-elicitation",S="mcp-elicitation";class g{async setSecret(t,e,r,n){const i={api:r,...this.#c(this.#a(e),n,r)};await t.set(this.#n(e,r),i,{ttlInSeconds:l(e)})}async getSecretsForSubject(t,e){const r=this.#a(e),{items:n}=await t.list({prefix:this.#i(e)}),i={};for(const s of n)if(s.value)try{i[s.value.api]=this.#r(r,s.value,s.value.api)}catch{continue}return i}async deleteSubject(t,e){const{items:r}=await t.list({prefix:this.#i(e)}),n=r.flatMap(i=>i.value?[this.#n(e,i.value.api)]:[]);n.length!==0&&await t.transaction(async i=>{for(const s of n)await i.delete(s)})}async createElicitation(t,e){const r=m();return await t.set(this.#t(r),this.#c(this.#e(),e),{ttlInSeconds:p/1e3}),r}async peekElicitation(t,e){const r=await t.get(this.#t(e));if(r)try{return this.#r(this.#e(),r)}catch{return}}async consumeElicitation(t,e){const r=this.#t(e),n=await t.transaction(async i=>{const s=await i.get(r);return s&&await i.delete(r),s});if(n)try{return this.#r(this.#e(),n)}catch{return}}#i(t){return["mcp","secret",this.#s(t)]}#n(t,e){return["mcp","secret",this.#s(t),e]}#t(t){return["mcp","elicitation",t]}#s(t){return u("sha256").update(t).digest("hex")}#a(t){return Buffer.from(a("sha256",c,t,d,32))}#e(){return Buffer.from(a("sha256",c,S,y,32))}#c(t,e,r){const n=h(12),i=o("aes-256-gcm",t,n);r&&i.setAAD(Buffer.from(r,"utf8"));const s=Buffer.concat([i.update(JSON.stringify(e),"utf8"),i.final()]);return{iv:n.toString("base64"),tag:i.getAuthTag().toString("base64"),data:s.toString("base64")}}#r(t,e,r){const n=f("aes-256-gcm",t,Buffer.from(e.iv,"base64"));r&&n.setAAD(Buffer.from(r,"utf8")),n.setAuthTag(Buffer.from(e.tag,"base64"));const i=Buffer.concat([n.update(Buffer.from(e.data,"base64")),n.final()]).toString("utf8");return JSON.parse(i)}}const E=new g;export{p as ELICITATION_TTL_MS,g as SecretStore,E as secretStore};
+import{createCipheriv as o,createDecipheriv as f,createHash as u,hkdfSync as a,randomBytes as h,randomUUID as l}from"node:crypto";import{JWT_SECRET_KEY as c}from"../../../constants/common.js";import{secretTtlSeconds as m}from"./subject.js";const p=900*1e3,d="mcp-upstream-secrets",y="mcp-elicitation",S="mcp-elicitation";class g{async setSecret(t,e,r,n){const i={api:r,...this.#c(this.#a(e),n,r)};await t.set(this.#t(e,r),i,{ttlInSeconds:m(e)})}async getSecretsForSubject(t,e){const r=this.#a(e),{items:n}=await t.list({prefix:this.#n(e)}),i={};for(const s of n)if(s.value)try{i[s.value.api]=this.#i(r,s.value,s.value.api)}catch{continue}return i}async hasSecret(t,e,r){return!!await t.get(this.#t(e,r))}async deleteSecret(t,e,r){await t.delete(this.#t(e,r))}async deleteSubject(t,e){const{items:r}=await t.list({prefix:this.#n(e)}),n=r.flatMap(i=>i.value?[this.#t(e,i.value.api)]:[]);n.length!==0&&await t.transaction(async i=>{for(const s of n)await i.delete(s)})}async createElicitation(t,e){const r=l();return await t.set(this.#e(r),this.#c(this.#r(),e),{ttlInSeconds:p/1e3}),r}async peekElicitation(t,e){const r=await t.get(this.#e(e));if(r)try{return this.#i(this.#r(),r)}catch{return}}async consumeElicitation(t,e){const r=this.#e(e),n=await t.transaction(async i=>{const s=await i.get(r);return s&&await i.delete(r),s});if(n)try{return this.#i(this.#r(),n)}catch{return}}#n(t){return["mcp","secret",this.#s(t)]}#t(t,e){return["mcp","secret",this.#s(t),e]}#e(t){return["mcp","elicitation",t]}#s(t){return u("sha256").update(t).digest("hex")}#a(t){return Buffer.from(a("sha256",c,t,d,32))}#r(){return Buffer.from(a("sha256",c,S,y,32))}#c(t,e,r){const n=h(12),i=o("aes-256-gcm",t,n);r&&i.setAAD(Buffer.from(r,"utf8"));const s=Buffer.concat([i.update(JSON.stringify(e),"utf8"),i.final()]);return{iv:n.toString("base64"),tag:i.getAuthTag().toString("base64"),data:s.toString("base64")}}#i(t,e,r){const n=f("aes-256-gcm",t,Buffer.from(e.iv,"base64"));r&&n.setAAD(Buffer.from(r,"utf8")),n.setAuthTag(Buffer.from(e.tag,"base64"));const i=Buffer.concat([n.update(Buffer.from(e.data,"base64")),n.final()]).toString("utf8");return JSON.parse(i)}}const B=new g;export{p as ELICITATION_TTL_MS,g as SecretStore,B as secretStore};

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.d.ts

@@ -3,6 +3,7 @@ export declare const UPSTREAM_AUTH_REQUIRED_META = "com.redocly/upstream-auth-re
 export type UpstreamAuthRequiredEvent = {
     api: string;
     name: string;
+    status: number;
 };
 export declare function withAuthRequiredMeta(result: CallToolResult, events: UpstreamAuthRequiredEvent[]): CallToolResult;
 export declare function readAuthRequiredMeta(result: CallToolResult): UpstreamAuthRequiredEvent[];

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.js

@@ -1 +1 @@
-const n="com.redocly/upstream-auth-required";function i(e,a){const t=[...new Map(a.map(r=>[r.api,r])).values()];return t.length===0?e:{...e,_meta:{...e._meta,[n]:t}}}function o(e){const a=e._meta?.[n];return Array.isArray(a)?a.filter(t=>typeof t?.api=="string"&&typeof t?.name=="string"):[]}function p(e){if(!e._meta||!(n in e._meta))return e;const{[n]:a,...t}=e._meta,r={...e};return Object.keys(t).length>0?r._meta=t:delete r._meta,r}export{n as UPSTREAM_AUTH_REQUIRED_META,o as readAuthRequiredMeta,p as stripAuthRequiredMeta,i as withAuthRequiredMeta};
+const i="com.redocly/upstream-auth-required";function u(t,n){const e=new Map;for(const a of n){const o=e.get(a.api);(!o||o.status!==401&&a.status===401)&&e.set(a.api,a)}const r=[...e.values()];return r.length===0?t:{...t,_meta:{...t._meta,[i]:r}}}function p(t){const n=t._meta?.[i];return Array.isArray(n)?n.filter(e=>typeof e?.api=="string"&&typeof e?.name=="string"&&typeof e?.status=="number"):[]}function s(t){if(!t._meta||!(i in t._meta))return t;const{[i]:n,...e}=t._meta,r={...t};return Object.keys(e).length>0?r._meta=e:delete r._meta,r}export{i as UPSTREAM_AUTH_REQUIRED_META,p as readAuthRequiredMeta,s as stripAuthRequiredMeta,u as withAuthRequiredMeta};

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.js

@@ -1 +1 @@
-import{logger as g}from"../../../tools/notifiers/logger.js";import{getFeedbackClientIp as O}from"../../../web-server/utils/feedback-ip.js";import{GATEWAY_FETCH_LIMIT_DEFAULTS as v}from"../../../../constants/common.js";import{isObject as F}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as N}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as _}from"../../../utils/skills/get-skill-url.js";import{createDocsMcpServer as L}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as k,filterGraphqlDescriptionsByRbac as B}from"../utils.js";import{createMethodNotAllowedError as P,withErrorHandling as H}from"./errors.js";import{constructForbiddenResponse as j,constructInvalidTokenResponse as V,constructUnauthorizedResponse as G,handleMcpAuth as J,shouldHandleMcpAuth as $}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as z}from"../utils/jwt.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as K}from"../constants.js";import{canAccessFeature as Y}from"../../../utils/rbac.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as W,RbacFeatures as X}from"../../../../constants/common.js";const u="X-Redocly-AI-Metadata";function Q(r){if(r)try{const e=JSON.parse(r);if(F(e))return e;g.warn(`Ignoring ${u} header: not a JSON object.`)}catch{g.warn(`Ignoring ${u} header: invalid JSON.`)}}const Z=async(r,e,s)=>{const i=!!e?.config?.access?.requiresLogin,t=e?.config?.access?.rbac||{},f=s?.props?.config?.mcpMode??"tools",h=s?.props?.config?.gatewayFetchBudgetPerExec??v.budgetPerExec;let p;const m=r.headers.get("Authorization");if($(i,t)){const{isAuthenticated:d,isTokenValid:o,currentUser:c,accessToken:l}=await J(r,e);if(!d)return G(new URL(r.url).origin);if(!o)return V();c&&(e.user=c),p=l}else m&&(p=z(m||"")??void 0);const A={isAuthenticated:!!e.user?.isAuthenticated,teams:e.user?.teams||[W],claims:e.user?.claims??{}};if(!Y(X.MCP,A,t,i))return j();let a;return await H(async()=>{const d=s?.props?.config?.elicitationEnabled??!1;if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need to register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using this URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return P();const o=s,c=o?.props?.config?.apiDescriptionsMap||{},l=o?.props?.config?.graphqlDescriptions||[],M=o?.props?.config?.mcpDocsServerName||K,{config:{mcp:E={}}}=e,T=k(c,e.user,t,i),D=B(l,e.user,t,i),R=e.config.products?Object.values(e.config.products).map(n=>n?.name):[],w=E.docs?.name||M,S=Q(r.headers.get(u)),b=o?.props?.tools||[],y=o?.props?.skillsBaseUrl||new URL(r.url).origin,U=N(o?.props?.skills||[],e.user,t,i).map(n=>({slug:n.slug,name:n.name,description:n.description,content:n.content,uri:_(y,n.slug)})),C=await r.json(),I={name:w,tools:b,skills:U,context:{...e,accessToken:p,outdir:e.outdir||"",baseUrl:e.baseUrl||new URL(r.url).origin,apiDescriptionsMap:T,graphqlDescriptions:D,products:R,metadata:S,mcpMode:f,elicitationEnabled:d,gatewayFetchBudgetPerExec:h,clientIp:O(r)}};return a=await L({...I,getKv:e.getKv}),await q(r,a,C)},async()=>{a&&(await a.cleanup(),a=void 0)},f)};async function q(r,e,s){return e.transport.handleRequest(r,s!==void 0?{parsedBody:s}:void 0)}var me=Z;export{me as default};
+import{logger as A}from"../../../tools/notifiers/logger.js";import{getFeedbackClientIp as v}from"../../../web-server/utils/feedback-ip.js";import{getForwardedOrigin as f}from"../../../web-server/utils/get-request-origin.js";import{GATEWAY_FETCH_LIMIT_DEFAULTS as N}from"../../../../constants/common.js";import{isObject as _}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as k}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as B}from"../../../utils/skills/get-skill-url.js";import{createDocsMcpServer as P}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as H,filterGraphqlDescriptionsByRbac as L}from"../utils.js";import{createMethodNotAllowedError as j,withErrorHandling as V}from"./errors.js";import{constructForbiddenResponse as G,constructInvalidTokenResponse as J,constructUnauthorizedResponse as $,handleMcpAuth as z,shouldHandleMcpAuth as K}from"../auth/auth-handlers.js";import{extractTokenFromAuthHeader as Y}from"../utils/jwt.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as W}from"../constants.js";import{canAccessFeature as X}from"../../../utils/rbac.js";import{DEFAULT_ANONYMOUS_VISITOR_TEAM as Q,RbacFeatures as Z}from"../../../../constants/common.js";const m="X-Redocly-AI-Metadata";function q(r){if(r)try{const e=JSON.parse(r);if(_(e))return e;A.warn(`Ignoring ${m} header: not a JSON object.`)}catch{A.warn(`Ignoring ${m} header: invalid JSON.`)}}const x=async(r,e,o)=>{const t=!!e?.config?.access?.requiresLogin,i=e?.config?.access?.rbac||{},g=o?.props?.config?.mcpMode??"tools",M=o?.props?.config?.gatewayFetchBudgetPerExec??N.budgetPerExec,E=o?.props?.config?.searchIgnoredRoutes??[];let d;const h=r.headers.get("Authorization");if(K(t,i)){const{isAuthenticated:l,isTokenValid:s,currentUser:a,accessToken:u}=await z(r,e);if(!l){const p=f(r);return s===!1?J(p):$(p)}a&&(e.user=a),d=u}else h&&(d=Y(h||"")??void 0);const T={isAuthenticated:!!e.user?.isAuthenticated,teams:e.user?.teams||[Q],claims:e.user?.claims??{}};if(!X(Z.MCP,T,i,t))return G();let c;return await V(async()=>{const l=o?.props?.config?.elicitationEnabled??!1;if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need to register it in your MCP Client (VS Code, Cursor, Claude Code, etc.) using this URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return j();const s=o,a=s?.props?.config?.apiDescriptionsMap||{},u=s?.props?.config?.graphqlDescriptions||[],p=s?.props?.config?.mcpDocsServerName||W,{config:{mcp:b={}}}=e,D=H(a,e.user,i,t),R=L(u,e.user,i,t),S=e.config.products?Object.values(e.config.products).map(n=>n?.name):[],y=b.docs?.name||p,w=q(r.headers.get(m)),C=s?.props?.tools||[],I=s?.props?.skillsBaseUrl||f(r),O=k(s?.props?.skills||[],e.user,i,t).map(n=>({slug:n.slug,name:n.name,description:n.description,content:n.content,uri:B(I,n.slug)})),U=await r.json(),F={name:y,tools:C,skills:O,context:{...e,accessToken:d,outdir:e.outdir||"",baseUrl:e.baseUrl||f(r),apiDescriptionsMap:D,graphqlDescriptions:R,products:S,metadata:w,mcpMode:g,elicitationEnabled:l,gatewayFetchBudgetPerExec:M,searchIgnoredRoutes:E,clientIp:v(r)}};return c=await P({...F,getKv:e.getKv}),await ee(r,c,U)},async()=>{c&&(await c.cleanup(),c=void 0)},g)};async function ee(r,e,o){return e.transport.handleRequest(r,o!==void 0?{parsedBody:o}:void 0)}var Ae=x;export{Ae as default};

package/dist/server/plugins/mcp/handlers/handle-mcp-request.js

@@ -1 +1 @@
-import{withPathPrefix as g}from"@redocly/theme/core/utils";import{importApiRoutesHandler as D}from"../../../api-routes/import-api-routes-handlers.js";import{enhanceContext as h}from"../../../api-routes/helpers/enhance-context.js";import{telemetry as R}from"../../../telemetry/index.js";import{KvService as A}from"../../../persistence/kv/services/kv-service.js";import{envConfig as l}from"../../../config/env-config.js";import{acceptsHtml as E}from"../../../utils/ai-agent-detection.js";import{handleErrorPageRender as T}from"../../../web-server/utils.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as _}from"../constants.js";import{MCP_DOCS_SERVER_HANDLER_ID as w}from"../index.js";import{resolvePublicBaseUrl as S}from"../../../web-server/utils/resolve-public-base-url.js";import{applyEdgeRateLimit as q}from"../gateway-mcp/rate-limit/apply-edge-rate-limit.js";async function B(a,t,e){const n=t.req.raw;if(a.requestHandlerId===w&&n.method==="GET"&&E(n.headers.get("accept"))&&e.globalData.mcpData?.docs?.enabled)return T(t,e,{slug:a.slug},405,_);const r=t.get("auth"),s=await q(n,e);if(s)return s;const o=await e.resolveRouteStaticData(a)||{},m=g(a.slug),{requestHandlers:c}=await D(e.serverOutDir),p=c[a.requestHandlerId],d=(await p()).default,u=async()=>await A.getInstance({baseDbDir:e.serverOutDir,sqldRemoteDatabaseUrl:l.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:l.SQLD_REMOTE_DATABASE_AUTH_TOKEN}),f=h({honoCtx:t,ctx:{user:{teams:r.teams,email:r.claims.email,claims:r.claims,idpAccessToken:r.idpAccessToken,idpId:r.claims.idpId,isAuthenticated:r.isAuthenticated},config:e.config,outdir:e.outdir,baseUrl:new URL(t.req.url).origin},telemetry:R,getKv:u}),i=await d(t.req.raw,f,{...o,props:{...o.props,routeSlug:m,outdir:e.outdir,skills:e.config.skills?.hide===!0?[]:e.getSkills(),skillsBaseUrl:S(e,t)}});return i instanceof Response?i:typeof i=="string"?new Response(i,{headers:{"Content-Type":"text/plain"}}):new Response(JSON.stringify(i),{headers:{"Content-Type":"application/json"}})}export{B as handleMcpRequest};
+import{withPathPrefix as g}from"@redocly/theme/core/utils";import{importApiRoutesHandler as D}from"../../../api-routes/import-api-routes-handlers.js";import{enhanceContext as h}from"../../../api-routes/helpers/enhance-context.js";import{telemetry as A}from"../../../telemetry/index.js";import{KvService as E}from"../../../persistence/kv/services/kv-service.js";import{envConfig as l}from"../../../config/env-config.js";import{acceptsHtml as R}from"../../../utils/ai-agent-detection.js";import{handleErrorPageRender as T}from"../../../web-server/utils.js";import{MCP_NOT_ALLOWED_TEMPLATE_ID as _}from"../constants.js";import{MCP_DOCS_SERVER_HANDLER_ID as w}from"../index.js";import{resolvePublicBaseUrl as S}from"../../../web-server/utils/resolve-public-base-url.js";import{getForwardedOrigin as q}from"../../../web-server/utils/get-request-origin.js";import{applyEdgeRateLimit as O}from"../gateway-mcp/rate-limit/apply-edge-rate-limit.js";async function K(a,t,e){const n=t.req.raw;if(a.requestHandlerId===w&&n.method==="GET"&&R(n.headers.get("accept"))&&e.globalData.mcpData?.docs?.enabled)return T(t,e,{slug:a.slug},405,_);const r=t.get("auth"),o=await O(n,e);if(o)return o;const s=await e.resolveRouteStaticData(a)||{},m=g(a.slug),{requestHandlers:p}=await D(e.serverOutDir),c=p[a.requestHandlerId],d=(await c()).default,u=async()=>await E.getInstance({baseDbDir:e.serverOutDir,sqldRemoteDatabaseUrl:l.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:l.SQLD_REMOTE_DATABASE_AUTH_TOKEN}),f=h({honoCtx:t,ctx:{user:{teams:r.teams,email:r.claims.email,claims:r.claims,idpAccessToken:r.idpAccessToken,idpId:r.claims.idpId,isAuthenticated:r.isAuthenticated},config:e.config,outdir:e.outdir,baseUrl:q(t.req.raw)},telemetry:A,getKv:u}),i=await d(t.req.raw,f,{...s,props:{...s.props,routeSlug:m,outdir:e.outdir,skills:e.config.skills?.hide===!0?[]:e.getSkills(),skillsBaseUrl:S(e,t)}});return i instanceof Response?i:typeof i=="string"?new Response(i,{headers:{"Content-Type":"text/plain"}}):new Response(JSON.stringify(i),{headers:{"Content-Type":"application/json"}})}export{K as handleMcpRequest};