@redocly/realm 0.137.0-next.0 → 0.137.0-next.2

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.js

@@ -1,4 +1,4 @@
-import{secretStore as s,ELICITATION_TTL_MS as x}from"../gateway-mcp/secret-store.js";import{buildAllowedHostMatchers as P}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as _}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as E,getDefaultAgent as T}from"../gateway-mcp/fetch/fetch-bridge.js";const p={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'"},R=3e4,z=64*1024;let $=fetch;function Q(e){$=e}const F=async(e,t)=>{const n=await t.getKv();if(e.method==="GET"){const o=new URL(e.url).searchParams.get("token")??"",r=await s.peekElicitation(n,o);return r?new Response(j(r,o),{status:200,headers:p}):u()}if(e.method==="POST"){const o=await e.formData(),r=String(o.get("token")??""),m=String(o.get("mode")??"token");return m==="client-credentials"?M(n,o,r):m==="clear"?B(n,r):O(n,o,r)}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function O(e,t,n){const o=String(t.get("secret")??"");if(!o)return u();const r=await s.consumeElicitation(e,n);return r?(await s.setSecret(e,r.subject,r.api,H(r.auth,o)),new Response(A(r.name),{status:200,headers:p})):u()}async function B(e,t){const n=await s.consumeElicitation(e,t);return n?(await s.deleteSecret(e,n.subject,n.api),new Response(D(n.name),{status:200,headers:p})):u()}async function M(e,t,n){const o=String(t.get("client_id")??"").trim(),r=String(t.get("client_secret")??"").trim();if(!o||!r)return u();const m=await s.peekElicitation(e,n);if(!m||m.auth.kind!=="oauth2ClientCredentials")return u();const i=await s.consumeElicitation(e,n);if(!i||i.auth.kind!=="oauth2ClientCredentials")return u();const b=i.auth;try{const S=P([{url:b.tokenUrl}]),C=_(b.tokenUrl,S),k=new AbortController,I=setTimeout(()=>k.abort(),R);let g;try{g=await $(C,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:o,client_secret:r,...b.scopes.length>0?{scope:b.scopes.join(" ")}:{}}),redirect:"manual",signal:k.signal,dispatcher:T()})}finally{clearTimeout(I)}if(!g.ok)return f(i.name);let v;try{v=await E(g,z)}catch{return f(i.name)}let h;try{h=JSON.parse(v)}catch{return f(i.name)}const w=typeof h=="object"&&h!==null&&"access_token"in h?h.access_token:void 0;return typeof w!="string"||!w?f(i.name):(await s.setSecret(e,i.subject,i.api,{header:"Authorization",value:`Bearer ${w}`}),new Response(A(i.name),{status:200,headers:p}))}catch{return f(i.name)}}function H(e,t){return e.kind==="apiKey"?{header:e.header,value:t}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:N(t)}:{header:"Authorization",value:t}}function N(e){const t=e.trim();return t.toLowerCase().startsWith("bearer")?t:`Bearer ${t}`}function a(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function c(e){return`<!doctype html>
+import{secretStore as c,ELICITATION_TTL_MS as C}from"../gateway-mcp/secret-store.js";import{rejectCredential as z}from"../gateway-mcp/credential-validation.js";import{buildAllowedHostMatchers as F}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as O}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as j,getDefaultAgent as B}from"../gateway-mcp/fetch/fetch-bridge.js";const p={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'"},M=3e4,q=64*1024;let I=fetch;function re(e){I=e}const H=async(e,t)=>{const n=await t.getKv();if(e.method==="GET"){const o=new URL(e.url).searchParams.get("token")??"",r=await c.peekElicitation(n,o);return r?new Response(S(r,o),{status:200,headers:p}):m()}if(e.method==="POST"){const o=await e.formData(),r=f(o,"token"),s=f(o,"mode")||"token";return s==="client-credentials"?G(n,o,r):s==="clear"?D(n,r):U(n,o,r)}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function U(e,t,n){const o=f(t,"secret").trim(),r=await c.peekElicitation(e,n);if(!r)return m();const s=z(r.auth,o);if(s)return P(r,n,s);const a=await c.consumeElicitation(e,n);return a?(await c.setSecret(e,a.subject,a.api,a.scheme,K(a.auth,o)),new Response(E(a),{status:200,headers:p})):m()}async function D(e,t){const n=await c.consumeElicitation(e,t);return n?(await c.deleteSecret(e,n.subject,n.api,n.scheme),new Response(V(n),{status:200,headers:p})):m()}async function G(e,t,n){const o=f(t,"client_id").trim(),r=f(t,"client_secret").trim(),s=await c.peekElicitation(e,n);if(!s||s.auth.kind!=="oauth2ClientCredentials")return m();if(!o||!r)return P(s,n,"Enter both the client ID and the client secret before saving.");const a=await c.consumeElicitation(e,n);if(!a||a.auth.kind!=="oauth2ClientCredentials")return m();const g=a.auth;try{const T=F([{url:g.tokenUrl}]),_=O(g.tokenUrl,T),w=new AbortController,R=setTimeout(()=>w.abort(),M);let v;try{v=await I(_,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:o,client_secret:r,...g.scopes.length>0?{scope:g.scopes.join(" ")}:{}}),redirect:"manual",signal:w.signal,dispatcher:B()})}finally{clearTimeout(R)}if(!v.ok)return y(a.name);let $;try{$=await j(v,q)}catch{return y(a.name)}let h;try{h=JSON.parse($)}catch{return y(a.name)}const x=typeof h=="object"&&h!==null&&"access_token"in h?h.access_token:void 0,A=typeof x=="string"?x.trim():"";return A?(await c.setSecret(e,a.subject,a.api,a.scheme,{header:"Authorization",value:`Bearer ${A}`}),new Response(E(a),{status:200,headers:p})):y(a.name)}catch{return y(a.name)}}function f(e,t){const n=e.get(t);return typeof n=="string"?n:""}function P(e,t,n){return new Response(S(e,t,n),{status:400,headers:p})}function K(e,t){return e.kind==="apiKey"?{header:e.header,value:t}:e.kind==="cookie"?{header:"Cookie",value:`${e.name}=${t}`}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:L(t)}:{header:"Authorization",value:t}}function L(e){const t=e.trim();return t.toLowerCase().startsWith("bearer")?t:`Bearer ${t}`}function i(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}function d(e){return`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -14,6 +14,7 @@ h1{font-size:1.25rem;margin:0 0 .5rem}
 .section{margin-top:1.5rem;padding-top:1.5rem;border-top:1px solid #e5e7eb}
 .section h2{font-size:1rem;margin:0 0 .5rem}
 p.hint{color:#6b7280;font-size:.875rem;line-height:1.4}
+p.error{margin:1rem 0 0;padding:.75rem;border:1px solid #fecaca;border-radius:.5rem;background:#fef2f2;color:#991b1b;font-size:.875rem;line-height:1.4}
 label{display:block;margin:1rem 0 .25rem;font-weight:600;font-size:.875rem}
 input[type=password],input[type=text]{width:100%;padding:.625rem .75rem;font-size:1rem;border:1px solid #d1d5db;border-radius:.5rem;background:#fff;color:#111827}
 input:focus{outline:none;border-color:#4f46e5;box-shadow:0 0 0 3px rgba(79,70,229,.2)}
@@ -30,6 +31,7 @@ body{background:#0b0f19;color:#e5e7eb}
 .card{background:#111827;box-shadow:0 10px 25px -5px rgba(0,0,0,.4)}
 .section{border-top-color:#1f2937}
 p.hint{color:#9ca3af}
+p.error{border-color:#7f1d1d;background:#2a1215;color:#fca5a5}
 input[type=password],input[type=text]{background:#0b0f19;border-color:#374151;color:#e5e7eb}
 code{background:#1f2937}
 footer{border-top-color:#1f2937;color:#6b7280}
@@ -37,20 +39,21 @@ footer{border-top-color:#1f2937;color:#6b7280}
 </style>
 </head>
 <body><div class="card">${e}</div></body>
-</html>`}function d(e){return`<h1>\u{1F512} ${a(e)}</h1>`}function l(){return"<footer>Secured by Redocly &middot; credentials never enter the AI conversation</footer>"}function y(){return`<p class="hint">This link expires ${Math.round(x/6e4)} minutes after it was issued. If it stops working, ask your AI client for a new one.</p>`}function j(e,t){const n=e.hasExistingSecret?q(t):"";switch(e.auth.kind){case"bearer":return L(e.name,t,n);case"apiKey":return U(e.name,t,e.auth.header,n);case"oauth2ClientCredentials":return G(e.name,t,e.auth.scopes,n);default:return K(e.name,t,n)}}function q(e){return`
+</html>`}function l(e){return`<h1>\u{1F512} ${i(e)}</h1>`}function u(){return"<footer>Secured by Redocly &middot; credentials never enter the AI conversation</footer>"}function b(){return`<p class="hint">This link expires ${Math.round(C/6e4)} minutes after it was issued. If it stops working, ask your AI client for a new one.</p>`}function S(e,t,n){const o=e.hasExistingSecret?N(t):"",r=n?`<p class="error">${i(n)}</p>`:"",s=k(e);switch(e.auth.kind){case"bearer":return W(s,t,o,r);case"apiKey":return X(s,t,e.auth.header,o,r);case"cookie":return Y(s,t,e.auth.name,o,r);case"oauth2ClientCredentials":return J(s,t,e.auth.scopes,o,r);default:return Q(s,t,o,r)}}function k({name:e,schemeLabel:t}){return t?`${e} (${t})`:e}function N(e){return`
 <div class="section">
 <h2>Remove stored credentials</h2>
 <p class="hint">This API already has credentials stored. Save above to replace them, or remove them to make calls anonymous again.</p>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(e)}">
+<input type="hidden" name="token" value="${i(e)}">
 <input type="hidden" name="mode" value="clear">
 <button class="danger" type="submit">Remove credentials</button>
 </form>
-</div>`}function L(e,t,n){return c(`
-${d(`Credentials for ${e}`)}
+</div>`}function W(e,t,n,o){return d(`
+${l(`Credentials for ${e}`)}
+${o}
 <p class="hint">Stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and sent to the API as the <code>Authorization</code> header. It never passes through the AI conversation.</p>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(t)}">
+<input type="hidden" name="token" value="${i(t)}">
 <input type="hidden" name="mode" value="token">
 <label for="secret">API token</label>
 <input type="password" id="secret" name="secret" placeholder="your API token" required autofocus>
@@ -58,26 +61,42 @@ ${d(`Credentials for ${e}`)}
 <button type="submit">Save credentials</button>
 </form>
 ${n}
-${y()}
-${l()}`)}function U(e,t,n,o){return c(`
-${d(`Credentials for ${e}`)}
-<p class="hint">Stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and sent to the API as the <code>${a(n)}</code> header. It never passes through the AI conversation.</p>
+${b()}
+${u()}`)}function X(e,t,n,o,r){return d(`
+${l(`Credentials for ${e}`)}
+${r}
+<p class="hint">Stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and sent to the API as the <code>${i(n)}</code> header. It never passes through the AI conversation.</p>
+<form method="post" action="/mcp/credentials" autocomplete="off">
+<input type="hidden" name="token" value="${i(t)}">
+<input type="hidden" name="mode" value="token">
+<label for="secret">${i(n)} value</label>
+<input type="password" id="secret" name="secret" placeholder="value" required autofocus>
+<button type="submit">Save credentials</button>
+</form>
+${o}
+${b()}
+${u()}`)}function Y(e,t,n,o,r){return d(`
+${l(`Credentials for ${e}`)}
+${r}
+<p class="hint">Stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and sent to the API as the <code>${i(n)}</code> cookie. It never passes through the AI conversation.</p>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(t)}">
+<input type="hidden" name="token" value="${i(t)}">
 <input type="hidden" name="mode" value="token">
-<label for="secret">${a(n)} value</label>
+<label for="secret">${i(n)} cookie value</label>
 <input type="password" id="secret" name="secret" placeholder="value" required autofocus>
+<p class="hint">Paste only the value &mdash; we send it as <code>${i(n)}=&lt;value&gt;</code>.</p>
 <button type="submit">Save credentials</button>
 </form>
 ${o}
-${y()}
-${l()}`)}function G(e,t,n,o){const r=n.length>0?n.map(a).join(", "):"default scopes";return c(`
-${d(`Credentials for ${e}`)}
+${b()}
+${u()}`)}function J(e,t,n,o,r){const s=n.length>0?n.map(i).join(", "):"default scopes";return d(`
+${l(`Credentials for ${e}`)}
+${r}
 <p class="hint">Paste a token you already have, or let us exchange client credentials for one via OAuth2 client_credentials.</p>
 <div class="section">
 <h2>I have a token</h2>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(t)}">
+<input type="hidden" name="token" value="${i(t)}">
 <input type="hidden" name="mode" value="token">
 <label for="secret">API token</label>
 <input type="password" id="secret" name="secret" placeholder="your API token" required autofocus>
@@ -87,9 +106,9 @@ ${d(`Credentials for ${e}`)}
 </div>
 <div class="section">
 <h2>Exchange client credentials</h2>
-<p class="hint">We request a token from the API on your behalf. Scopes: ${r}.</p>
+<p class="hint">We request a token from the API on your behalf. Scopes: ${s}.</p>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(t)}">
+<input type="hidden" name="token" value="${i(t)}">
 <input type="hidden" name="mode" value="client-credentials">
 <label for="client_id">Client ID</label>
 <input type="text" id="client_id" name="client_id" required>
@@ -99,26 +118,27 @@ ${d(`Credentials for ${e}`)}
 </form>
 </div>
 ${o}
-${y()}
-${l()}`)}function K(e,t,n){return c(`
-${d(`Credentials for ${e}`)}
+${b()}
+${u()}`)}function Q(e,t,n,o){return d(`
+${l(`Credentials for ${e}`)}
+${o}
 <p class="hint">The value is stored encrypted for you only (24 hours for anonymous callers, 30 days when signed in) and is sent to the API as the <code>Authorization</code> header. It never passes through the AI conversation.</p>
 <form method="post" action="/mcp/credentials" autocomplete="off">
-<input type="hidden" name="token" value="${a(t)}">
+<input type="hidden" name="token" value="${i(t)}">
 <input type="hidden" name="mode" value="token">
 <label for="secret">Authorization header value</label>
 <input type="password" id="secret" name="secret" placeholder="Bearer &lt;your token&gt;" required autofocus>
 <button type="submit">Save credentials</button>
 </form>
 ${n}
-${y()}
-${l()}`)}function D(e){return c(`
-${d("Credentials removed")}
-<p>The stored credentials for ${a(e)} are gone. Calls to that API are anonymous again until you add new ones.</p>
-${l()}`)}function A(e){return c(`
-${d("Credentials saved")}
-<p>Credentials for ${a(e)} are saved. Go back to your AI client and ask it to retry - or confirm the prompt it left open, if there is one. You can close this tab.</p>
-${l()}`)}function f(e){return new Response(c(`
-${d("Exchange failed")}
-<p>We could not exchange your client credentials for a token for ${a(e)}. This link has been used up - go back to your AI client and request a new link, then try again.</p>
-${l()}`),{status:502,headers:p})}function u(){return new Response(c(`${d("Link expired")}<p>This credentials link is invalid, already used, or older than ${Math.round(x/6e4)} minutes. Retry the request in your AI client to get a fresh link.</p>${l()}`),{status:404,headers:p})}var V=F;export{V as default,Q as setCredentialsFetchImpl};
+${b()}
+${u()}`)}function V(e){return d(`
+${l("Credentials removed")}
+<p>The stored credentials for ${i(k(e))} are gone. Calls to that API are anonymous again until you add new ones.</p>
+${u()}`)}function E(e){return d(`
+${l("Credentials saved")}
+<p>Credentials for ${i(k(e))} are saved. Go back to your AI client and ask it to retry - or confirm the prompt it left open, if there is one. You can close this tab.</p>
+${u()}`)}function y(e){return new Response(d(`
+${l("Exchange failed")}
+<p>We could not exchange your client credentials for a token for ${i(e)}. This link has been used up - go back to your AI client and request a new link, then try again.</p>
+${u()}`),{status:502,headers:p})}function m(){return new Response(d(`${l("Link expired")}<p>This credentials link is invalid, already used, or older than ${Math.round(C/6e4)} minutes. Retry the request in your AI client to get a fresh link.</p>${u()}`),{status:404,headers:p})}var ae=H;export{ae as default,re as setCredentialsFetchImpl};

package/dist/server/plugins/mcp/servers/mcp-server.js

@@ -1,3 +1,5 @@
-import{McpServer as T,WebStandardStreamableHTTPServerTransport as q}from"@modelcontextprotocol/server";import{logger as g}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as I,MCP_TOOL_WORKER_KEY as v}from"../../../workers/mcp-tool-worker-pool.js";import{SSE_KEEPALIVE_INTERVAL_MS as R}from"../constants.js";import{secretStore as _}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as A,stripAuthRequiredMeta as b}from"../gateway-mcp/upstream-auth.js";import{buildCredentialsToolHint as O,buildUpstreamCredentialFallback as w,buildUpstreamCredentialInputRequired as U,isCredentialElicitationDeclined as C,targetOf as D}from"../gateway-mcp/elicitation.js";import{resolveUpstreamAuthScheme as j}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as K,resolveSecretSubject as P}from"../gateway-mcp/subject.js";const L=6e4,S=new Map;function $(e,t){const r=S.get(e);if(r)return r;const n=t().finally(()=>{S.delete(e)});return S.set(e,n),n}function ee(e,t){const r=new T({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}}),n=new q({keepAliveMs:R,sessionIdGenerator:void 0});return{server:r,transport:n}}async function te(e,t){return await e.connect(t),{server:e,transport:t,cleanup:async()=>{t.close()}}}function re(e,t){return r=>async(n,a)=>{g.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,s=a.mcpReq.envelope!==void 0,c=i?P(e.user,n.sessionHandle):{kind:"anonymous"},o=c.kind==="resolved"?c.subject:void 0;if(c.kind==="invalid")return{content:[{type:"text",text:c.message}],isError:!0};const d=async()=>{if(!(!i||!o||!t?.getKv))try{const u=await t.getKv();return await _.getSecretsForSubject(u,o)}catch(u){g.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(u)}`);return}};let m;const E=async()=>{m=await d();const u={toolName:r,args:n,context:{...e,upstreamSecrets:m},extra:N(a)};return await I.exec(v,[u],{timeout:L})};let p=await E();const l=A(p);if(l.length>0&&i&&!o)return b({...p,content:[{type:"text",text:K}],isError:!0});if(l.length>0&&i&&o&&t?.getKv){g.info(`gateway mcp credentials prompt: era=${s?"2026-07-28":"2025"} clientElicitation=${H(t)}`);const u=await t.getKv(),h=new Set(Object.keys(m??{})),f=s?await x(e,a,l,o,u,h,t):await B(e,l,o,u,h);switch(f.kind){case"inputRequired":return f.result;case"retry":p=await E();break;case"prependText":p={...p,content:[{type:"text",text:f.text},...p.content],isError:!0};break;case"none":break}}return b(p)}}function F(e){return!!e?.getClientCapabilities()?.elicitation?.url}function H(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}function k(e,t){return e.status===401&&!t.has(e.api)}function y(e){return e.map(O).join(`
+import{McpServer as L,WebStandardStreamableHTTPServerTransport as j}from"@modelcontextprotocol/server";import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as D,MCP_TOOL_WORKER_KEY as K}from"../../../workers/mcp-tool-worker-pool.js";import{SSE_KEEPALIVE_INTERVAL_MS as x}from"../constants.js";import{secretStore as F}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as H,stripAuthRequiredMeta as M,upstreamAuthKey as b}from"../gateway-mcp/upstream-auth.js";import{buildCredentialsToolHint as P,buildSchemeChoiceHint as v,buildUpstreamCredentialFallback as T,buildUpstreamCredentialInputRequired as $,isCredentialElicitationDeclined as N,schemeLabelOf as B}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as q,resolveUpstreamApiAuth as G,schemeChoicesOf as W}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as V,resolveSecretSubject as Y}from"../gateway-mcp/subject.js";const J=6e4,E=new Map;function Q(e,t){const r=E.get(e);if(r)return r;const n=t().finally(()=>{E.delete(e)});return E.set(e,n),n}function fe(e,t){const r=new L({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}}),n=new j({keepAliveMs:x,sessionIdGenerator:void 0});return{server:r,transport:n}}async function he(e,t){return await e.connect(t),{server:e,transport:t,cleanup:async()=>{t.close()}}}function ge(e,t){return r=>async(n,s)=>{S.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,a=s.mcpReq.envelope!==void 0,u=i?Y(e.user,n.sessionHandle):{kind:"anonymous"},o=u.kind==="resolved"?u.subject:void 0;if(u.kind==="invalid")return{content:[{type:"text",text:u.message}],isError:!0};const p=async()=>{if(!(!i||!o||!t?.getKv))try{const m=await t.getKv();return await F.getSecretsForSubject(m,o)}catch(m){S.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let c;const l=async()=>{c=await p();const m={toolName:r,args:n,context:{...e,upstreamSecrets:c},extra:ie(s)};return await D.exec(K,[m],{timeout:J})};let d=await l();const f=H(d);if(f.length>0&&i&&!o)return M({...d,content:[{type:"text",text:V}],isError:!0});if(f.length>0&&i&&o&&t?.getKv){S.info(`gateway mcp credentials prompt: era=${a?"2026-07-28":"2025"} clientElicitation=${Z(t)}`);const m=await t.getKv(),h=await z(e,f),k=f.map(U=>ee(U,h)),y=te(c),g=a?await re(e,s,k,o,m,y,h,t):await ne(e,k,o,m,y,h);switch(g.kind){case"inputRequired":return g.result;case"retry":d=await l();break;case"prependText":d={...d,content:[{type:"text",text:g.text},...d.content],isError:!0};break;case"none":break}}return M(d)}}function X(e){return!!e?.getClientCapabilities()?.elicitation?.url}function Z(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}async function z(e,t){const r=new Map;for(const n of new Set(t.map(s=>s.api)))r.set(n,await G(e,n));return r}function ee(e,t){const r=t.get(e.api);if(!r)return{...e,scheme:e.scheme??q};const n=e.scheme&&r.schemes[e.scheme]?e.scheme:r.defaultScheme;return{...e,scheme:n}}function te(e){const t=new Set;for(const[r,n]of Object.entries(e??{}))for(const s of Object.keys(n))t.add(b({api:r,scheme:s}));return t}function I(e,t){return e.status===401&&!t.has(b(e))}function R(e,t){const r=t.get(e.api);return r&&e.scheme?B(r.schemes,e.scheme):void 0}function A(e,t){const r=t.get(e.api);return!r||!e.schemes?.length?[]:W(r,e.schemes)}function _(e,t){return A(e,t).length>1}function w(e,t){return e.map(r=>P(r,R(r,t))).join(`
 
-`)}async function M(e,t,r,n){const[a,...i]=t;return{subject:r,baseUrl:e.baseUrl??"",target:D(a),auth:await j(e,a.api),kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:a.status,otherApiNames:i.map(s=>s.name)}}}async function x(e,t,r,n,a,i,s){if(C(t.mcpReq.inputResponses))return{kind:"none"};const c=r.filter(d=>k(d,i));if(c.length===0)return{kind:"prependText",text:y(r)};const o=await M(e,c,n,a);return F(s)?{kind:"inputRequired",result:await U(o)}:{kind:"prependText",text:await w(o)}}async function B(e,t,r,n,a){const i=t.filter(o=>k(o,a));if(i.length===0)return{kind:"prependText",text:y(t)};const s=await M(e,i,r,n);return{kind:"prependText",text:await $(`${r}:${i[0].api}`,()=>w(s))}}function N(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function ne(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes}}export{te as connectMcpServer,ee as createMcpServer,re as createToolDispatch,ne as extractSerializableContext};
+`)}function C(e,t,r){const n=e.map(s=>v(s,A(s,r)));return t.length>0&&n.push(w(t,r)),n.join(`
+
+`)}function O(e,t,r,n,s){const[i,...a]=t,u=s.get(i.api),o=i.scheme??u?.defaultScheme??q,p=R(i,s);return{subject:r,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:o,...p?{schemeLabel:p}:{}},auth:u?.schemes[o]??{kind:"raw"},kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,otherApiNames:a.map(c=>c.name)}}}async function re(e,t,r,n,s,i,a,u){if(N(t.mcpReq.inputResponses))return{kind:"none"};const o=r.filter(l=>I(l,i));if(o.length===0)return{kind:"prependText",text:w(r,a)};const p=o.filter(l=>_(l,a));if(p.length>0){const l=r.filter(d=>!p.includes(d));return{kind:"prependText",text:C(p,l,a)}}const c=O(e,o,n,s,a);return X(u)?{kind:"inputRequired",result:await $(c)}:{kind:"prependText",text:await T(c)}}async function ne(e,t,r,n,s,i){const a=t.filter(c=>I(c,s));if(a.length===0)return{kind:"prependText",text:w(t,i)};const u=a.filter(c=>_(c,i));if(u.length>0){const c=t.filter(l=>!u.includes(l));return{kind:"prependText",text:C(u,c,i)}}const o=O(e,a,r,n,i);return{kind:"prependText",text:await Q(`${r}:${b(a[0])}`,()=>T(o))}}function ie(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function Se(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes}}export{he as connectMcpServer,fe as createMcpServer,ge as createToolDispatch,Se as extractSerializableContext};

package/dist/server/plugins/mcp/types.d.ts

@@ -4,7 +4,7 @@ import type { OpenAPIPath, OpenAPIServer, OpenAPIOperation } from '@redocly/api-
 import type { McpErrorCodes, McpServerType } from './constants';
 import type { McpToolSchema } from '../../types';
 import type { Skill } from '../../types/plugins/skills.js';
-import type { StoredSecret } from './gateway-mcp/secret-store.js';
+import type { UpstreamSecrets } from './gateway-mcp/secret-store.js';
 type ObjectValues<T> = T[keyof T];
 export type McpServerType = ObjectValues<typeof McpServerType>;
 export type McpErrorCodeTypes = ObjectValues<typeof McpErrorCodes>;
@@ -98,7 +98,7 @@ export type McpToolContext = Omit<ApiFunctionsContext, 'telemetry' | 'getKv' | k
     elicitationEnabled?: boolean;
     gatewayFetchBudgetPerExec?: number;
     clientIp?: string;
-    upstreamSecrets?: Record<string, StoredSecret>;
+    upstreamSecrets?: UpstreamSecrets;
     searchIgnoredRoutes?: string[];
 };
 export type McpToolHandler<TArgs extends ToolArgs = ToolArgs> = (args: TArgs, context: McpToolContext, extra: McpToolExtra) => Promise<McpToolWorkerResponse>;

package/dist/server/web-server/utils/prepare-list-response.d.ts

@@ -11,6 +11,8 @@ export type ListResponseResult<T extends {
         hasPrevPage: boolean;
         startCursor: string | null;
         endCursor: string | null;
+        nextPage: string | null;
+        previousPage: string | null;
     };
 };
 export declare function prepareListResponse<T extends {

package/dist/server/web-server/utils/prepare-list-response.js

@@ -1 +1 @@
-import{createCursor as l}from"../../providers/database/pagination/utils/create-cursor.js";import{DEFAULT_LIMIT as o}from"../../providers/database/pagination/limit.js";function c(e){return!!(e.after||e.before)}function g(e,i,r){const n=c(i),t=i.limit??o;if(n){if(i.before)return!0;if(i.after)return e.length===t}return r!==void 0&&i.skip!==void 0?i.skip+t<r:r!==void 0?t<r:e.length===t}function h(e){return!!(e.after||e.before||e.skip!==void 0&&e.skip>0)}function d({data:e,params:i,totalCount:r,nameTransformationsFromDatabase:n={},hasMore:t}){if(!e.length)return{object:"list",items:[],page:{total:0,limit:i.limit??o,hasNextPage:!1,hasPrevPage:!1,startCursor:null,endCursor:null}};const f=i.sort?.length?i.sort:[{field:"id",order:"ASC"}],s=t??g(e,i,r),u=h(i);return{object:"list",items:e,page:{total:r??0,limit:i.limit??o,hasNextPage:s,hasPrevPage:u,startCursor:l(e[0],f,n),endCursor:l(e[e.length-1],f,n)}}}export{d as prepareListResponse};
+import{createCursor as c}from"../../providers/database/pagination/utils/create-cursor.js";import{DEFAULT_LIMIT as o}from"../../providers/database/pagination/limit.js";function h(e){return!!(e.after||e.before)}function b(e,i,n){const r=h(i),t=i.limit??o;if(r){if(i.before)return!0;if(i.after)return e.length===t}return n!==void 0&&i.skip!==void 0?i.skip+t<n:n!==void 0?t<n:e.length===t}function d(e){return!!(e.after||e.before||e.skip!==void 0&&e.skip>0)}function x({data:e,params:i,totalCount:n,nameTransformationsFromDatabase:r={},hasMore:t}){if(!e.length)return{object:"list",items:[],page:{total:0,limit:i.limit??o,hasNextPage:!1,hasPrevPage:!1,startCursor:null,endCursor:null,nextPage:null,previousPage:null}};const l=i.sort?.length?i.sort:[{field:"id",order:"ASC"}],u=t??b(e,i,n),g=d(i),P=!!(i.after||i.before&&t||i.skip!==void 0&&i.skip>0),f=c(e[0],l,r),s=c(e[e.length-1],l,r);return{object:"list",items:e,page:{total:n??0,limit:i.limit??o,hasNextPage:u,hasPrevPage:g,startCursor:f,endCursor:s,nextPage:u?s:null,previousPage:P?f:null}}}export{x as prepareListResponse};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@redocly/realm",
-  "version": "0.137.0-next.0",
+  "version": "0.137.0-next.2",
   "description": "",
   "type": "module",
   "bin": {
@@ -93,15 +93,15 @@
     "xpath": "0.0.34",
     "yaml-ast-parser": "0.0.43",
     "zod": "^3.25.76",
-    "@redocly/api-docs": "0.2.0-next.0",
-    "@redocly/asyncapi-docs": "1.14.0-next.0",
+    "@redocly/api-docs": "0.2.0-next.2",
+    "@redocly/asyncapi-docs": "1.14.0-next.2",
     "@redocly/config": "0.53.1",
-    "@redocly/graphql-docs": "1.14.0-next.0",
-    "@redocly/openapi-docs": "3.25.0-next.0",
+    "@redocly/graphql-docs": "1.14.0-next.2",
+    "@redocly/openapi-docs": "3.25.0-next.2",
     "@redocly/portal-legacy-ui": "0.19.0",
-    "@redocly/portal-plugin-mock-server": "0.22.0-next.0",
-    "@redocly/realm-asyncapi-sdk": "0.14.0",
-    "@redocly/theme": "0.69.0-next.0"
+    "@redocly/portal-plugin-mock-server": "0.22.0-next.2",
+    "@redocly/realm-asyncapi-sdk": "0.15.0-next.1",
+    "@redocly/theme": "0.69.0-next.2"
   },
   "peerDependencies": {
     "react": "^19.2.7",