@redocly/realm 0.138.0-next.11 → 0.138.0-next.13

package/dist/server/plugins/mcp/handlers/credentials-page/outcome-pages.js

@@ -0,0 +1,11 @@
+import{ELICITATION_TTL_MINUTES as p}from"../../gateway-mcp/secret-store.js";import{credentialSchemesOf as $}from"./form-contract.js";import{ICONS as a,code as f,escapeHtml as r,targetTitle as k}from"./layout.js";const v={success:a.check,danger:a.cross,neutral:a.cross,warning:a.clock};function y(n,{action:e,schemes:o,stored:t}){const s=e==="saved",i=$(n).length>1,c=r(n.name),d=t.filter(m=>!o.includes(m)),g=i?`We ${e} ${u(o)} for ${c}.`:`We ${e} your credentials for ${r(k(n))}.`,h=t.length===0?`Calls to ${c} now go without credentials.`:d.length>0?`${s?"Also stored":"Still stored"}: ${u(d)}.`:"";return l(s?"success":"danger",s?"Credentials saved":"Credentials removed",[g,h,s?"Go back to your AI client and tell it that you saved them.":""])}function S(){return l("neutral","Link declined",["We saved nothing, and this link no longer works.","If you did not ask for this link, tell your AI client to stop."])}function A(){return l("warning","This link no longer works",[`The link is not valid, was already used, or is older than ${p} minutes.`,"Ask your AI client for a new link."])}function l(n,e,o){const t=o.filter(Boolean).map(i=>`<p>${i}</p>`).join(`
+`),s=n==="warning"?"":'<p class="muted small">You can close this tab.</p>';return{title:e,body:`<div class="page narrow">
+<main class="card outcome">
+<span class="status-icon ${n}">${v[n]}</span>
+<h1>${r(e)}</h1>
+<div class="message">
+${t}
+${s}
+</div>
+</main>
+</div>`}}function u(n){const e=n.map(f);return e.length>1?`${e.slice(0,-1).join(", ")} and ${e.at(-1)}`:e.join("")}export{S as declinedPage,A as expiredPage,y as outcomePage,l as statusPage};

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.d.ts

@@ -0,0 +1,10 @@
+import type { RedoclyConfig } from '@redocly/config';
+import type { GlobalData } from '../../../../../types/index.js';
+import type { SiteBranding } from './types.js';
+/** `logo` is the resolved theme logo from global data, whose paths point at served assets. */
+export declare function resolveSiteBranding({ seo, logo, colorMode, }: {
+    seo?: RedoclyConfig['seo'];
+    logo?: GlobalData['logo'];
+    colorMode?: RedoclyConfig['colorMode'];
+}): SiteBranding;
+//# sourceMappingURL=site-branding.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.js

@@ -0,0 +1 @@
+import{parseSrcSet as h}from"../../../../utils/attribute-parser.js";function o({seo:t,logo:e,colorMode:d}){const n=t?.title||t?.projectTitle||e?.altText||void 0,i=e?.srcSet?h(e.srcSet):new Map,r=s(i.get("light")??e?.image),a=s(i.get("dark")),c=f(d);return{...n?{name:n}:{},...r?{logo:{light:r,...a?{dark:a}:{}}}:{},...c?{colorScheme:c}:{}}}function f(t){if(t?.hide)return"light";if(t?.ignoreDetection)return t.modes?.[0]==="dark"?"dark":"light"}function s(t){return t?.startsWith("/")&&!t.startsWith("//")?t:void 0}export{o as resolveSiteBranding};

package/dist/server/plugins/mcp/handlers/credentials-page/styles.d.ts

@@ -0,0 +1,4 @@
+import type { PageColorScheme } from './types.js';
+/** The page CSS. Without a fixed color scheme, the page follows the system setting. */
+export declare function pageStyles(colorScheme: PageColorScheme | undefined): string;
+//# sourceMappingURL=styles.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/styles.js

@@ -0,0 +1,186 @@
+const e=`
+--font-family-base:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
+--page-bg:#f7f7f9;
+--page-dot:#e3e4ea;
+--bg-color:#ffffff;
+--border-color-primary:#dcdde5;
+--panel-bg:#f3f3f6;
+--layer-color:#fbfbfc;
+--input-border-color:#dcdde5;
+--border-color-secondary:#ededf2;
+--stored-bg:#ededf2;
+--text-color-primary:#1a1c21;
+--text-color-secondary:#3b3c45;
+--text-color-description:#555761;
+--placeholder:#9b9ca8;
+--input-bg-color:#ffffff;
+--primary-bg:#1a1c21;
+--primary-hover:#3b3c45;
+--primary-text:#ffffff;
+--focus:#4561db;
+--code-bg:#ededf2;
+--code-text:#2a2b33;
+--tag-bg:#ededf2;
+--tag-text:#3b3c45;
+--tag-stored-bg:#f0f4ff;
+--tag-stored-text:#4561db;
+--danger:#c8174f;
+--danger-bg:#fff1f5;
+--danger-border:#f7a8c0;
+--success:#1f9d55;
+--success-glow:rgba(31,157,85,.18);
+--warning:#e08a00;
+--warning-glow:rgba(224,138,0,.18);
+--warning-bg:#fff8eb;
+--warning-border:#f5c97a;
+--danger-icon:#f9316d;
+--danger-glow:rgba(249,49,109,.18);
+--neutral-glow:rgba(85,87,97,.14);
+`,o=`
+--page-bg:#1a1b20;
+--page-dot:#2c2e36;
+--bg-color:#22242b;
+--border-color-primary:#555761;
+--panel-bg:#2a2b33;
+--layer-color:#2a2b33;
+--input-border-color:#3b3c45;
+--border-color-secondary:#3b3c45;
+--stored-bg:#32343e;
+--text-color-primary:#fbfbfc;
+--text-color-secondary:#c4c6d1;
+--text-color-description:#9b9ca8;
+--placeholder:#6e6f7a;
+--input-bg-color:#22242b;
+--primary-bg:#fbfbfc;
+--primary-hover:#dcdde5;
+--primary-text:#1a1c21;
+--focus:#8fa6ff;
+--code-bg:#3b3c45;
+--code-text:#c4c6d1;
+--tag-bg:#3b3c45;
+--tag-text:#c4c6d1;
+--tag-stored-bg:#1f2a4d;
+--tag-stored-text:#8fa6ff;
+--danger:#ff6b95;
+--danger-bg:#3a1822;
+--danger-border:#7a2b44;
+--success:#3ccf74;
+--success-glow:rgba(60,207,116,.2);
+--warning:#f5a524;
+--warning-glow:rgba(245,165,36,.2);
+--warning-bg:#33260f;
+--warning-border:#7a5a1e;
+--danger-icon:#ff6b95;
+--danger-glow:rgba(255,107,149,.2);
+--neutral-glow:rgba(155,156,168,.16);
+`,r=`
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;padding:48px 24px;font-family:var(--font-family-base);font-size:14px;line-height:22px;color:var(--text-color-primary);background-color:var(--page-bg);background-image:radial-gradient(var(--page-dot) 1px,transparent 1px);background-size:16px 16px}
+.page{display:grid;grid-template-columns:minmax(0,692px) minmax(0,348px);gap:16px;justify-content:center;min-height:calc(100vh - 96px);margin:0 auto}
+.page.narrow{grid-template-columns:minmax(0,864px)}
+.card{display:flex;flex-direction:column;background:var(--bg-color);border:1px solid var(--border-color-primary);border-radius:24px;padding:40px 48px 24px}
+.panel{display:flex;flex-direction:column;gap:16px;background:var(--panel-bg);border:1px solid var(--border-color-primary);border-radius:24px;padding:32px 24px 24px}
+.site{display:flex;align-items:center;justify-content:space-between;gap:16px;padding-bottom:24px;margin-bottom:24px;border-bottom:1px solid var(--border-color-secondary)}
+.site-name{font-size:18px;line-height:24px;font-weight:600;overflow-wrap:anywhere}
+.site-host{font-size:16px;line-height:24px;color:var(--text-color-secondary);overflow-wrap:anywhere;text-align:right}
+.site-logo{display:block;max-height:32px;max-width:200px;width:auto}
+h1{margin:0;font-size:20px;line-height:28px;font-weight:600}
+h2{margin:0;font-size:16px;line-height:24px;font-weight:600}
+p{margin:0}
+.lede{margin-top:12px}
+.muted{color:var(--text-color-description)}
+.small{font-size:12px;line-height:20px}
+.strong{font-weight:600}
+code{font:inherit;background:var(--code-bg);color:var(--code-text);padding:1px 8px;border-radius:6px;overflow-wrap:anywhere}
+.banner{display:flex;gap:8px;align-items:flex-start;margin-top:24px;padding:12px 16px;border:1px solid var(--danger-border);border-radius:8px;background:var(--danger-bg);color:var(--text-color-primary)}
+.banner svg{flex:none;margin-top:3px;color:var(--danger)}
+.banner.warning{border-color:var(--warning-border);background:var(--warning-bg)}
+.banner.warning svg{color:var(--warning)}
+form.credentials{display:flex;flex-direction:column;flex:1}
+.schemes{display:flex;flex-direction:column;gap:12px;margin-top:24px}
+.scheme{background:var(--layer-color);border:1px solid var(--border-color-secondary);border-radius:16px;padding:24px 32px 24px 24px}
+.info-card{margin-top:24px;padding:8px 24px;background:var(--layer-color);border:1px solid var(--border-color-secondary);border-radius:16px}
+.info-card section{display:flex;flex-direction:column;gap:2px;padding:16px 0}
+.info-card section+section{border-top:1px solid var(--border-color-secondary)}
+.info-card h2{font-size:14px;line-height:22px;font-weight:500;color:var(--text-color-secondary)}
+.scheme-body{display:flex;flex-direction:column;gap:16px}
+details.scheme>.scheme-body{margin-top:16px;padding-left:24px}
+details.scheme>summary{display:grid;grid-template-columns:16px minmax(0,1fr) auto;column-gap:8px;row-gap:4px;cursor:pointer;list-style:none}
+details.scheme>summary::-webkit-details-marker{display:none}
+details.scheme>summary::before,details.operations>summary::before{content:"";flex:none;width:6px;height:6px;margin:8px 0 0 4px;border-right:1.5px solid var(--text-color-secondary);border-bottom:1.5px solid var(--text-color-secondary);transform:rotate(-45deg);transition:transform .15s}
+details[open]>summary::before{transform:rotate(45deg);margin-top:6px}
+details.scheme>summary:focus-visible{outline:2px solid var(--focus);outline-offset:4px;border-radius:4px}
+.summary-title{grid-column:2;font-size:16px;line-height:24px;font-weight:600;overflow-wrap:anywhere}
+.summary-tag{grid-column:3;grid-row:1}
+.summary-line{grid-column:2/4}
+.scheme-head{display:flex;flex-direction:column;gap:4px}
+.tag{display:inline-block;padding:1px 8px;border-radius:4px;font-size:14px;line-height:22px;background:var(--tag-bg);color:var(--tag-text);white-space:nowrap}
+.tag.stored{background:var(--tag-stored-bg);color:var(--tag-stored-text)}
+.tags{display:flex;flex-wrap:wrap;align-items:center;gap:4px 8px}
+.stored-box{display:flex;align-items:center;justify-content:space-between;gap:16px;padding:12px 16px;border-radius:8px;background:var(--stored-bg)}
+.field{display:flex;flex-direction:column;gap:4px;min-width:0}
+.field-row{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px}
+label{font-weight:500;color:var(--text-color-secondary)}
+input[type=text],input[type=password]{width:100%;height:34px;padding:0 12px;font-family:var(--font-family-base);font-size:14px;color:var(--text-color-primary);background:var(--input-bg-color);border:1px solid var(--input-border-color);border-radius:8px}
+input::placeholder{color:var(--placeholder)}
+input:focus{outline:2px solid transparent;border-color:var(--focus);box-shadow:0 0 0 1px var(--focus)}
+input[aria-invalid=true]{border-color:var(--danger)}
+input[aria-invalid=true]:focus{box-shadow:0 0 0 3px var(--danger-border)}
+.divider{border:0;border-top:1px solid var(--border-color-secondary);margin:0}
+details.operations>summary{display:flex;gap:8px;cursor:pointer;list-style:none;width:max-content;max-width:100%}
+details.operations>summary::-webkit-details-marker{display:none}
+details.operations>summary:focus-visible{outline:2px solid var(--focus);outline-offset:2px;border-radius:4px}
+details.operations ul{margin:8px 0 0;padding-left:20px;display:flex;flex-direction:column;gap:4px}
+.actions{margin-top:auto;padding-top:40px}
+.actions-row{display:flex;align-items:center;gap:16px;padding-top:24px;border-top:1px solid var(--border-color-secondary)}
+.actions-row .primary{flex:1}
+button{font-family:var(--font-family-base);font-size:16px;line-height:24px;font-weight:400;cursor:pointer;border-radius:12px}
+button:focus-visible{outline:2px solid var(--focus);outline-offset:2px}
+.primary{height:40px;padding:0 20px;border:0;background:var(--primary-bg);color:var(--primary-text)}
+.primary:hover{background:var(--primary-hover)}
+.secondary{height:40px;padding:0 20px;border:0;box-shadow:inset 0 0 0 1px var(--border-color-primary);background:var(--bg-color);color:var(--text-color-primary)}
+.actions-row .secondary{flex:1}
+.secondary:hover{background:var(--panel-bg)}
+.text-danger{padding:0 20px;height:40px;border:0;background:none;color:var(--danger)}
+.text-danger.small{height:auto;padding:0 8px;font-size:14px;line-height:22px}
+.text-danger:hover{text-decoration:underline}
+.link-button{padding:0;border:0;background:none;color:var(--text-color-secondary);font-size:12px;line-height:20px;text-decoration:underline;text-underline-offset:2px}
+.decline{margin-top:12px;text-align:center;color:var(--text-color-secondary)}
+.panel h2{display:flex;align-items:center;gap:12px;font-weight:500}
+.panel-steps{display:flex;flex-direction:column;gap:16px}
+.panel-steps-toggle{display:none}
+.panel-steps-toggle>summary{display:flex;align-items:center;justify-content:space-between;gap:12px;cursor:pointer;list-style:none}
+.panel-steps-toggle>summary::-webkit-details-marker{display:none}
+.panel-steps-toggle>summary::after{content:"";flex:none;width:7px;height:7px;margin:0 4px 4px 0;border-right:1.5px solid var(--text-color-secondary);border-bottom:1.5px solid var(--text-color-secondary);transform:rotate(45deg);transition:transform .15s}
+.panel-steps-toggle[open]>summary::after{transform:rotate(-135deg);margin:4px 4px 0 0}
+.panel-steps-toggle>summary:focus-visible{outline:2px solid var(--focus);outline-offset:4px;border-radius:4px}
+.panel-steps-toggle>.steps{margin-top:16px}
+.steps{margin:0;padding:0;list-style:none;display:flex;flex-direction:column;gap:16px;counter-reset:step}
+.steps li{display:grid;grid-template-columns:20px minmax(0,1fr);gap:12px;counter-increment:step;font-size:16px;line-height:24px}
+.steps li::before{content:counter(step);display:flex;align-items:center;justify-content:center;height:20px;margin-top:2px;border-radius:5px;background:var(--bg-color);font-size:14px;line-height:16px}
+.link-facts{display:flex;flex-direction:column;gap:8px;margin-top:auto;padding-top:32px;border-top:1px solid var(--border-color-primary);color:var(--text-color-secondary)}
+.pill{display:inline-flex;align-items:center;gap:8px;width:max-content;max-width:100%;padding:1px 8px;border-radius:999px;background:var(--bg-color);font-size:12px;line-height:20px}
+.pill::before{content:"";flex:none;width:6px;height:6px;border-radius:50%;background:var(--success)}
+.outcome{display:flex;flex-direction:column;align-items:center;text-align:center;gap:24px;padding:56px 0}
+.status-icon{display:flex;align-items:center;justify-content:center;width:40px;height:40px;border-radius:50%;color:#ffffff}
+.status-icon.success{background:var(--success);box-shadow:0 0 16px 10px var(--success-glow)}
+.status-icon.warning{background:var(--warning);box-shadow:0 0 16px 10px var(--warning-glow)}
+.status-icon.danger{background:var(--danger-icon);box-shadow:0 0 16px 10px var(--danger-glow)}
+.status-icon.neutral{background:var(--text-color-description);box-shadow:0 0 16px 10px var(--neutral-glow)}
+.message{display:flex;flex-direction:column;gap:8px;width:100%;max-width:640px;padding:24px 32px;border:1px solid var(--border-color-secondary);border-radius:12px;background:var(--layer-color)}
+@media (max-width:960px){
+body{padding:16px}
+.page{grid-template-columns:minmax(0,1fr);min-height:0}
+.card{padding:24px}
+.site{flex-direction:column;align-items:flex-start;gap:0}
+.site-host{text-align:left}
+.panel-steps{display:none}
+.panel-steps-toggle{display:block}
+.link-facts{padding-top:16px}
+.scheme{padding:16px}
+.info-card{padding:4px 16px}
+.field-row{grid-template-columns:minmax(0,1fr)}
+.outcome{padding:32px 0}
+.message{padding:16px}
+}
+`;function t(a){switch(a){case"light":return`:root{color-scheme:light;${e}}${r}`;case"dark":return`:root{color-scheme:dark;${e}${o}}${r}`;default:return`:root{color-scheme:light dark;${e}}@media (prefers-color-scheme:dark){:root{${o}}}${r}`}}export{t as pageStyles};

package/dist/server/plugins/mcp/handlers/credentials-page/types.d.ts

@@ -0,0 +1,32 @@
+export type SiteBranding = {
+    name?: string;
+    logo?: {
+        light: string;
+        dark?: string;
+    };
+    /** Set when the portal always shows one color mode. */
+    colorScheme?: PageColorScheme;
+};
+export type PageColorScheme = 'light' | 'dark';
+export type PageSite = SiteBranding & {
+    host: string;
+};
+/** One page, before the shared document shell wraps it. */
+export type PageContent = {
+    title: string;
+    body: string;
+};
+export type SchemeField = 'secret' | 'client_id' | 'client_secret';
+/** A rejected submission. `schemeIndex` and `field` name the input to mark, when there is one. */
+export type FormError = {
+    message: string;
+    schemeIndex?: number;
+    field?: SchemeField;
+};
+/** What one submission changed, and the schemes that hold a credential after it. */
+export type CredentialsOutcome = {
+    action: 'saved' | 'removed';
+    schemes: readonly string[];
+    stored: readonly string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.d.ts

@@ -1,5 +1,4 @@
 import type { ApiRoutesHandler } from '@redocly/config';
-export declare function setCredentialsFetchImpl(impl: typeof fetch): void;
 declare const mcpCredentialsHandler: ApiRoutesHandler;
 export default mcpCredentialsHandler;
 //# sourceMappingURL=mcp-credentials-handler.d.ts.map

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.js

@@ -1 +1 @@
-import{secretStore as u}from"../gateway-mcp/secret-store.js";import{rejectCredential as b}from"../gateway-mcp/credential-validation.js";import{buildAllowedHostMatchers as A}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as j}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as v,getDefaultAgent as O}from"../gateway-mcp/fetch/fetch-bridge.js";import{logger as F}from"../../../tools/notifiers/logger.js";import{clearedPage as I,formPage as x,multiOutcomePage as N,notFoundPage as D,successPage as $}from"./mcp-credentials-page.js";const g={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'"},B=3e4,M=64*1024,U=/^bearer\s+/i;let P=fetch;function ee(e){P=e}const G=async(e,i)=>{const t=await i.getKv();if(e.method==="GET"){const n=new URL(e.url).searchParams.get("token")??"",o=await u.peekElicitation(t,n);return o?new Response(x(o,n),{status:200,headers:g}):m()}if(e.method==="POST"){const n=await e.formData(),o=d(n,"token"),s=d(n,"mode")||"token";return s==="multi"?z(t,n,o):s==="client-credentials"?K(t,n,o):s==="clear"?X(t,o):H(t,n,o)}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function H(e,i,t){const n=d(i,"secret").trim(),o=await u.peekElicitation(e,t);if(!o)return m();const s=b(o.auth,n);if(s)return h(o,t,s);const l=await u.consumeElicitation(e,t);return l?(await u.setSecret(e,l.subject,l.api,l.scheme,S(l.auth,n)),new Response($(l),{status:200,headers:g})):m()}async function X(e,i){const t=await u.consumeElicitation(e,i);return t?(await u.deleteSecret(e,t.subject,t.api,t.scheme),new Response(I(t),{status:200,headers:g})):m()}async function z(e,i,t){const n=await u.peekElicitation(e,t);if(!n?.schemes||n.schemes.length<=1)return m();const o=n.schemes,s=[];for(let r=0;r<o.length;r++){const a=o[r],p=d(i,`secret__${r}`).trim(),E=d(i,`client_id__${r}`).trim(),_=d(i,`client_secret__${r}`).trim();if(a.hasExistingSecret&&d(i,`remove__${r}`)){if(p||E||_)return h(n,t,`${a.name}: enter a new value or tick "Remove the stored credential", not both.`);s.push({kind:"remove",scheme:a.name});continue}if(a.auth.kind==="oauth2ClientCredentials"){if(p){const C=b(a.auth,p);if(C)return h(n,t,`${a.name}: ${C}`);s.push({kind:"set",scheme:a.name,secret:S(a.auth,p)})}else if(E&&_)s.push({kind:"exchange",scheme:a.name,auth:a.auth,clientId:E,clientSecret:_});else if(E||_)return h(n,t,`${a.name}: enter both the client ID and the client secret, or leave both blank.`);continue}if(!p)continue;const y=b(a.auth,p);if(y)return h(n,t,`${a.name}: ${y}`);s.push({kind:"set",scheme:a.name,secret:S(a.auth,p)})}if(s.length===0)return h(n,t,"Fill in at least one credential, or check a box to remove one, before saving.");const l=[];for(const r of s){if(r.kind!=="exchange"){l.push(r);continue}const a=await R(r.auth,r.clientId,r.clientSecret);if(!a.ok)return T(n,t,a.reason,r.scheme);l.push({kind:"set",scheme:r.scheme,secret:a.secret})}const c=await u.consumeElicitation(e,t);if(!c)return m();for(const r of l)r.kind==="remove"?await u.deleteSecret(e,c.subject,c.api,r.scheme):await u.setSecret(e,c.subject,c.api,r.scheme,r.secret);const k=await u.getSecretsForSubject(e,c.subject),f={saved:l.filter(r=>r.kind==="set").map(r=>r.scheme),removed:l.filter(r=>r.kind==="remove").map(r=>r.scheme),stored:Object.keys(k[c.api]??{})};return new Response(N(c,f),{status:200,headers:g})}async function K(e,i,t){const n=d(i,"client_id").trim(),o=d(i,"client_secret").trim(),s=await u.peekElicitation(e,t);if(!s||s.auth.kind!=="oauth2ClientCredentials")return m();if(!n||!o)return h(s,t,"Enter both the client ID and the client secret before saving.");const l=await R(s.auth,n,o);if(!l.ok)return T(s,t,l.reason);const c=await u.consumeElicitation(e,t);return c?(await u.setSecret(e,c.subject,c.api,c.scheme,l.secret),new Response($(c),{status:200,headers:g})):m()}async function R(e,i,t){try{const n=A([{url:e.tokenUrl}]),o=j(e.tokenUrl,n),s=new AbortController,l=setTimeout(()=>s.abort(),B);let c;try{c=await P(o,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:i,client_secret:t}),redirect:"manual",signal:s.signal,dispatcher:O()})}finally{clearTimeout(l)}if(!c.ok)return w(`token endpoint returned ${c.status}`);let k;try{k=await v(c,M)}catch{return w("token response exceeded the size cap")}let f;try{f=JSON.parse(k)}catch{return w("token response was not valid JSON")}const r=typeof f=="object"&&f!==null&&"access_token"in f?f.access_token:void 0,a=typeof r=="string"?r.trim():"";return a?b(e,a)?w("token response had an access_token that cannot be sent in a header"):{ok:!0,secret:{header:"Authorization",value:`Bearer ${a}`}}:w("token response had no access_token")}catch(n){return w(n instanceof Error?n.message:String(n))}}function w(e){return{ok:!1,reason:e}}function T(e,i,t,n){return F.warn(`gateway oauth2 client_credentials exchange failed for ${e.api}: ${t}`),h(e,i,`${n?`${n}: we`:"We"} could not exchange those client credentials for a token. Check the client ID and secret, then try again.`)}function d(e,i){const t=e.get(i);return typeof t=="string"?t:""}function h(e,i,t){return new Response(x(e,i,t),{status:400,headers:g})}function m(){return new Response(D(),{status:404,headers:g})}function S(e,i){return e.kind==="apiKey"?{header:e.header,value:i}:e.kind==="cookie"?{header:"Cookie",value:`${e.name}=${i}`}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:J(i)}:{header:"Authorization",value:i}}function J(e){return`Bearer ${e.trim().replace(U,"")}`}var te=G;export{te as default,ee as setCredentialsFetchImpl};
+import{secretStore as d}from"../gateway-mcp/secret-store.js";import{rejectCredential as _}from"../gateway-mcp/credential-validation.js";import{buildAllowedHostMatchers as C}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as A}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as T,getDefaultAgent as P}from"../gateway-mcp/fetch/fetch-bridge.js";import{logger as x}from"../../../tools/notifiers/logger.js";import{FORM_ACTIONS as k}from"./credentials-page/constants.js";import{credentialSchemesOf as w,schemeFieldName as f}from"./credentials-page/form-contract.js";import{formPage as N}from"./credentials-page/form-page.js";import{htmlDocument as O}from"./credentials-page/layout.js";import{declinedPage as R,expiredPage as I,outcomePage as j}from"./credentials-page/outcome-pages.js";const D={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"},$=3e4,F=64*1024,M=/^bearer\s+/i,U=/^\d+$/,B=async(e,t,o)=>{const n=await t.getKv(),r=L(e,t.baseUrl,o);if(e.method==="GET"){const i=new URL(e.url).searchParams.get("token")??"",c=await d.peekElicitation(n,i);return c?S({kv:n,site:r,token:i,target:c},{},200):p(r)}if(e.method==="POST"){const i=await e.formData(),c=u(i,"token"),a=await d.peekElicitation(n,c);if(!a)return p(r);const s={kv:n,site:r,token:c,target:a,form:i};switch(u(i,"action")){case k.remove:return b(s,z(a,u(i,"scheme")));case k.removeAll:return b(s,w(a));case k.decline:return K(s);default:return H(s)}}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function H(e){const{target:t,form:o}=e,n=w(t),r=n.map((s,l)=>u(o,f("client_id",l)).trim()),i=s=>S(e,{error:s,clientIds:r},400),c=X(n,o);if("error"in c)return i(c.error);if(c.writes.length===0)return i(G(n));const a=[];for(const s of c.writes){if(s.kind!=="exchange"){a.push(s);continue}const l=await J(s.auth,s.clientId,s.clientSecret);if(!l.ok)return x.warn(`gateway oauth2 client_credentials exchange failed for ${t.api}: ${l.reason}`),i(E(n,s.schemeIndex,"client_id","We could not exchange those client credentials for a token. Check the client ID and secret, then try again."));a.push({kind:"set",scheme:s.scheme,secret:l.secret})}return v(e,a)}function X(e,t){const o=[];for(const[n,r]of e.entries()){const i=u(t,f("secret",n)).trim();if(i){const s=_(r.auth,i);if(s)return{error:E(e,n,"secret",s)};o.push({kind:"set",scheme:r.name,secret:W(r.auth,i)});continue}if(r.auth.kind!=="oauth2ClientCredentials")continue;const c=u(t,f("client_id",n)).trim(),a=u(t,f("client_secret",n)).trim();if(c&&a)o.push({kind:"exchange",scheme:r.name,schemeIndex:n,auth:r.auth,clientId:c,clientSecret:a});else if(c||a)return{error:E(e,n,c?"client_secret":"client_id","Enter both the client ID and the client secret, or leave both blank.")}}return{writes:o}}function G(e){return e.length>1?{message:"Fill in at least one credential before saving."}:{message:e[0].auth.kind==="oauth2ClientCredentials"?"Enter an access token, or the client ID and the client secret, before saving.":"Enter a value before saving.",schemeIndex:0,field:"secret"}}function E(e,t,o,n){return{message:e.length>1?`${e[t].name}: ${n}`:n,schemeIndex:t,field:o}}async function b(e,t){const{kv:o,target:n}=e,r=await d.getStoredSchemes(o,n.subject,n.api),i=t.filter(c=>r[c.name]).map(c=>({kind:"remove",scheme:c.name}));return i.length===0?S(e,{error:{message:"No credential is stored there, so there is nothing to remove."}},400):v(e,i)}function z(e,t){const o=U.test(t)?w(e)[Number(t)]:void 0;return o?[o]:[]}async function K({kv:e,site:t,token:o}){return await d.consumeElicitation(e,o)?h(t,R(),200):p(t)}async function v({kv:e,site:t,token:o},n){const r=await d.consumeElicitation(e,o);if(!r)return p(t);for(const a of n)a.kind==="remove"?await d.deleteSecret(e,r.subject,r.api,a.scheme):await d.setSecret(e,r.subject,r.api,a.scheme,a.secret);const i=await d.getStoredSchemes(e,r.subject,r.api),c={action:n.some(a=>a.kind==="set")?"saved":"removed",schemes:n.map(a=>a.scheme),stored:Object.keys(i).sort()};return h(t,j(r,c),200)}async function S({kv:e,site:t,token:o,target:n},r,i){const c=await d.getStoredSchemes(e,n.subject,n.api);return h(t,N({site:t,target:n,token:o,stored:c,...r}),i)}function L(e,t,o){const n=o?.props?.branding??{},r=t&&URL.canParse(t)?t:e.url;return{...n,host:new URL(r).host}}async function J(e,t,o){try{const n=C([{url:e.tokenUrl}]),r=A(e.tokenUrl,n),i=new AbortController,c=setTimeout(()=>i.abort(),$);let a;try{a=await fetch(r,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:t,client_secret:o}),redirect:"manual",signal:i.signal,dispatcher:P()})}finally{clearTimeout(c)}if(!a.ok)return m(`token endpoint returned ${a.status}`);let s;try{s=await T(a,F)}catch{return m("token response exceeded the size cap")}let l;try{l=JSON.parse(s)}catch{return m("token response was not valid JSON")}const y=typeof l=="object"&&l!==null&&"access_token"in l?l.access_token:void 0,g=typeof y=="string"?y.trim():"";return g?_(e,g)?m("token response had an access_token that cannot be sent in a header"):{ok:!0,secret:{header:"Authorization",value:`Bearer ${g}`}}:m("token response had no access_token")}catch(n){return m(n instanceof Error?n.message:String(n))}}function m(e){return{ok:!1,reason:e}}function u(e,t){const o=e.get(t);return typeof o=="string"?o:""}function h(e,t,o){return new Response(O(t,e.colorScheme),{status:o,headers:D})}function p(e){return h(e,I(),404)}function W(e,t){return e.kind==="apiKey"?{header:e.header,value:t}:e.kind==="cookie"?{header:"Cookie",value:`${e.name}=${t}`}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:Y(t)}:{header:"Authorization",value:t}}function Y(e){return`Bearer ${e.replace(M,"")}`}var ie=B;export{ie as default};

package/dist/server/plugins/mcp/index.js

@@ -1 +1 @@
-import{fileURLToPath as U}from"node:url";import{dirname as $,join as h}from"node:path";import{MCP_ROUTE as k,PUBLIC_MCP_ROUTE as D}from"@redocly/theme/core/constants/mcp";import{logger as c}from"../../tools/notifiers/logger.js";import{reporter as F}from"../../tools/notifiers/reporter.js";import{isDefined as B}from"../../../utils/guards/is-defined.js";import{MCP_CREDENTIALS_HANDLER_ID as P,MCP_CREDENTIALS_ROUTE as x,MCP_DOCS_SERVER_HANDLER_ID as E,MCP_NOT_ALLOWED_TEMPLATE_ID as V}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as J,bundledGraphqlDocumentsToMcpOpenApi as W,buildGraphqlDescriptions as X,collectIgnoredRoutes as z,filterIgnoredApiDescriptions as A,getCleanedUpApiDescriptions as K,isMcpInRedirects as Q}from"./utils.js";import{getMcpMode as R,isMcpElicitationEnabled as Y,isMcpGatewayEnabled as Z}from"./utils/mode.js";import{getPublicMcpEndpointStatus as _}from"./utils/public-endpoint.js";import{findGatedToolNames as ee}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as te}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as oe}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as ie,isGatewayEligible as re}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as se}from"./gateway-mcp/rate-limit/limits.js";import{resetCustomMcpTools as ne,scanCustomMcpTools as ae}from"./custom-tools/scan-custom-tools.js";import{telemetryTraceStep as ce}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"./constants.js";const M=$(U(import.meta.url));async function pe(){let i;const l={registeredToolNames:[],warnedNoOutputSchemaTools:new Set};let m=0,u=!1;return{id:"mcp",async processContent(e,n){await ce("com.redocly.build.plugin.mcp",async s=>{const o=await n.getConfig(),{mcp:r,redirects:f}=o;if(s?.setAttribute("config",JSON.stringify(r||{})),s?.setAttribute("mcpMode",R()),s?.setAttribute("mcpGateway",String(Z())),r?.hide||r?.docs?.hide){ne(e,l);return}Q(f)&&await F.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(V,"@redocly/theme/layouts/McpNotAllowed");const p=!!o?.access?.requiresLogin,b=o?.access?.rbac||{},g=R(),d=Y(),{budgetPerExec:T}=se();if(!i){c.info("Configuring MCP servers...");const w=J(await e.loadApiDocuments(n)),O=W(await e.loadApiDocuments(n)),v=r?.docs?.ignore||[],L=K(A(w,v)),q=ie(r),C=new Map;for(const t of L){const H=t.definition.info?.title||"",j=t.definition.info?.version||"";C.set(t.relativePath,{name:H,description:typeof t.definition.info?.description=="string"?t.definition.info.description:"",version:j,servers:t.definition.servers||[],relativePath:t.relativePath,...q&&re(t.definition.info,t.relativePath,b)?{fetchEligible:!0}:{}})}const y=X(A(O,v)),I=Object.values(o.products||{}).map(t=>t?.name).filter(B),N=o.l10n?.locales?.map(t=>t.code)??n.fs.localeFolders,G=te({products:I,locales:N,requiresLogin:p,rbac:b,hasGraphqlApis:y.length>0,elicitationEnabled:d,hasCallableApis:C.values().some(t=>t.fetchEligible),feedbackHidden:o.feedback?.hide===!0});e.addMcpTools(h(M,"./docs-mcp/tools/index.js"),G),g==="code"&&e.addMcpTools(h(M,"./codemode/tools/execute.js"),[oe]),i={apiDescriptionsMap:Object.fromEntries(C),graphqlDescriptions:y}}const a=await ae(e,n,l);s?.setAttribute("customToolsCount",String(a)),a!==m&&(m=a,a>0&&c.info(`Registered ${a} custom MCP tool${a===1?"":"s"} from @mcp folders`)),await de({actions:e,handlerPath:h(M,"./handlers/docs-mcp-handler.js"),apiDescriptionsMap:i.apiDescriptionsMap,graphqlDescriptions:i.graphqlDescriptions,mcpConfig:r,mcpMode:g,elicitationEnabled:d,gatewayFetchBudgetPerExec:T,publicEndpointStatus:_(o)}),u||(c.info("Registered Docs MCP Server endpoint at /mcp"),u=!0)})},async afterRoutesCreated(e,n){const s=await n.getConfig(),{mcp:o}=s,r=!o?.hide&&!o?.docs?.hide;e.markGatedMcpTools(await ee(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:r,name:o?.docs?.name||S,publicEndpoint:_(s)==="served"}}})}}}var Se=pe;async function de({actions:i,handlerPath:l,apiDescriptionsMap:m,graphqlDescriptions:u,mcpConfig:e,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:o,publicEndpointStatus:r}){i.createRequestHandler(E,l);const f=p=>async(b,g)=>{const d=z(g.getAllRoutes(),e?.docs?.ignore||[]);return d.length>0&&c.verbose(`mcp.docs.ignore: hiding ${d.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:m,graphqlDescriptions:u,mcpDocsServerName:e?.docs?.name||S,mcpMode:n,elicitationEnabled:s,gatewayFetchBudgetPerExec:o,searchIgnoredRoutes:d,...p?{isPublicEndpoint:p}:{}},serverOutDir:i.serverOutDir,tools:i.getMcpTools().map(({importPath:T,...a})=>a)}}};if(i.addApiRoute({slug:k,requestHandlerId:E,httpMethod:"all",getStaticData:f(!1)}),r==="no-protected-content"?c.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${D}.`):r==="anonymous-denied"?c.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${D}.`):r==="served"&&(i.addApiRoute({slug:D,requestHandlerId:E,httpMethod:"all",getStaticData:f(!0)}),c.verbose(`Registered public Docs MCP Server endpoint at ${D}`)),s){const p=h(M,"./handlers/mcp-credentials-handler.js");i.createRequestHandler(P,p),i.addApiRoute({slug:x,requestHandlerId:P,httpMethod:"all",getStaticData:async()=>({props:{}})}),c.verbose("Registered MCP credentials endpoint at /mcp/credentials")}}export{Se as default,pe as mcpServerPlugin};
+import{fileURLToPath as U}from"node:url";import{dirname as $,join as M}from"node:path";import{MCP_ROUTE as k,PUBLIC_MCP_ROUTE as b}from"@redocly/theme/core/constants/mcp";import{logger as p}from"../../tools/notifiers/logger.js";import{reporter as F}from"../../tools/notifiers/reporter.js";import{isDefined as B}from"../../../utils/guards/is-defined.js";import{MCP_CREDENTIALS_HANDLER_ID as P,MCP_CREDENTIALS_ROUTE as V,MCP_DOCS_SERVER_HANDLER_ID as T,MCP_NOT_ALLOWED_TEMPLATE_ID as x}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as J,bundledGraphqlDocumentsToMcpOpenApi as W,buildGraphqlDescriptions as X,collectIgnoredRoutes as z,filterIgnoredApiDescriptions as A,getCleanedUpApiDescriptions as K,isMcpInRedirects as Q}from"./utils.js";import{getMcpMode as R,isMcpElicitationEnabled as Y,isMcpGatewayEnabled as Z}from"./utils/mode.js";import{getPublicMcpEndpointStatus as _}from"./utils/public-endpoint.js";import{findGatedToolNames as ee}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as oe}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as te}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as ie,isGatewayEligible as re}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as se}from"./gateway-mcp/rate-limit/limits.js";import{resetCustomMcpTools as ne,scanCustomMcpTools as ae}from"./custom-tools/scan-custom-tools.js";import{resolveSiteBranding as ce}from"./handlers/credentials-page/site-branding.js";import{telemetryTraceStep as pe}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"./constants.js";const C=$(U(import.meta.url));async function de(){let i;const m={registeredToolNames:[],warnedNoOutputSchemaTools:new Set};let u=0,f=!1;return{id:"mcp",async processContent(e,a){await pe("com.redocly.build.plugin.mcp",async s=>{const t=await a.getConfig(),{mcp:r,redirects:g}=t;if(s?.setAttribute("config",JSON.stringify(r||{})),s?.setAttribute("mcpMode",R()),s?.setAttribute("mcpGateway",String(Z())),r?.hide||r?.docs?.hide){ne(e,m);return}Q(g)&&await F.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(x,"@redocly/theme/layouts/McpNotAllowed");const l=!!t?.access?.requiresLogin,h=t?.access?.rbac||{},d=R(),c=Y(),{budgetPerExec:D}=se();if(!i){p.info("Configuring MCP servers...");const w=J(await e.loadApiDocuments(a)),O=W(await e.loadApiDocuments(a)),v=r?.docs?.ignore||[],L=K(A(w,v)),q=ie(r),E=new Map;for(const o of L){const H=o.definition.info?.title||"",j=o.definition.info?.version||"";E.set(o.relativePath,{name:H,description:typeof o.definition.info?.description=="string"?o.definition.info.description:"",version:j,servers:o.definition.servers||[],relativePath:o.relativePath,...q&&re(o.definition.info,o.relativePath,h)?{fetchEligible:!0}:{}})}const y=X(A(O,v)),G=Object.values(t.products||{}).map(o=>o?.name).filter(B),I=t.l10n?.locales?.map(o=>o.code)??a.fs.localeFolders,N=oe({products:G,locales:I,requiresLogin:l,rbac:h,hasGraphqlApis:y.length>0,elicitationEnabled:c,hasCallableApis:E.values().some(o=>o.fetchEligible),feedbackHidden:t.feedback?.hide===!0});e.addMcpTools(M(C,"./docs-mcp/tools/index.js"),N),d==="code"&&e.addMcpTools(M(C,"./codemode/tools/execute.js"),[te]),i={apiDescriptionsMap:Object.fromEntries(E),graphqlDescriptions:y}}const n=await ae(e,a,m);s?.setAttribute("customToolsCount",String(n)),n!==u&&(u=n,n>0&&p.info(`Registered ${n} custom MCP tool${n===1?"":"s"} from @mcp folders`)),await le({actions:e,handlerPath:M(C,"./handlers/docs-mcp-handler.js"),apiDescriptionsMap:i.apiDescriptionsMap,graphqlDescriptions:i.graphqlDescriptions,mcpConfig:r,mcpMode:d,elicitationEnabled:c,gatewayFetchBudgetPerExec:D,publicEndpointStatus:_(t)}),f||(p.info("Registered Docs MCP Server endpoint at /mcp"),f=!0)})},async afterRoutesCreated(e,a){const s=await a.getConfig(),{mcp:t}=s,r=!t?.hide&&!t?.docs?.hide;e.markGatedMcpTools(await ee(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:r,name:t?.docs?.name||S,publicEndpoint:_(s)==="served"}}})}}}var Oe=de;async function le({actions:i,handlerPath:m,apiDescriptionsMap:u,graphqlDescriptions:f,mcpConfig:e,mcpMode:a,elicitationEnabled:s,gatewayFetchBudgetPerExec:t,publicEndpointStatus:r}){i.createRequestHandler(T,m);const g=l=>async(h,d)=>{const c=z(d.getAllRoutes(),e?.docs?.ignore||[]);return c.length>0&&p.verbose(`mcp.docs.ignore: hiding ${c.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:u,graphqlDescriptions:f,mcpDocsServerName:e?.docs?.name||S,mcpMode:a,elicitationEnabled:s,gatewayFetchBudgetPerExec:t,searchIgnoredRoutes:c,...l?{isPublicEndpoint:l}:{}},serverOutDir:i.serverOutDir,tools:i.getMcpTools().map(({importPath:D,...n})=>n)}}};if(i.addApiRoute({slug:k,requestHandlerId:T,httpMethod:"all",getStaticData:g(!1)}),r==="no-protected-content"?p.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${b}.`):r==="anonymous-denied"?p.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${b}.`):r==="served"&&(i.addApiRoute({slug:b,requestHandlerId:T,httpMethod:"all",getStaticData:g(!0)}),p.verbose(`Registered public Docs MCP Server endpoint at ${b}`)),s){const l=M(C,"./handlers/mcp-credentials-handler.js");i.createRequestHandler(P,l),i.addApiRoute({slug:V,requestHandlerId:P,httpMethod:"all",getStaticData:async(h,d)=>{const{seo:c,colorMode:D}=d.getConfig(),{logo:n}=d.getGlobalData();return{props:{branding:ce({seo:c,logo:n,colorMode:D})}}}}),p.verbose("Registered MCP credentials endpoint at /mcp/credentials")}}export{Oe as default,de as mcpServerPlugin};

package/dist/server/plugins/mcp/servers/mcp-server.js

@@ -1,3 +1,3 @@
-import{McpServer as C}from"@modelcontextprotocol/server";import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as O,MCP_TOOL_WORKER_KEY as _}from"../../../workers/mcp-tool-worker-pool.js";import{secretStore as L}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as D,stripAuthRequiredMeta as E,upstreamAuthKey as b}from"../gateway-mcp/upstream-auth.js";import{acceptedCredentialsLink as K,buildCredentialsAcceptedHint as j,buildCredentialsToolHint as F,buildUpstreamCredentialFallback as q,buildUpstreamCredentialInputRequired as v,credentialElicitationAnswer as H,dedupeElicitation as N,isStatelessRequest as P,schemeLabelOf as $,supportsUrlElicitation as B}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as y,resolveUpstreamApiAuth as G}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as V,resolveSecretSubject as W}from"../gateway-mcp/subject.js";const Y=6e4;function ue(e,t){return new C({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}})}function le(e,t){return r=>async(n,s)=>{S.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,c=P(s.mcpReq),a=i?W(e.user,n.sessionHandle):{kind:"anonymous"},o=a.kind==="resolved"?a.subject:void 0;if(a.kind==="invalid")return{content:[{type:"text",text:a.message}],isError:!0};const u=async()=>{if(!(!i||!o||!t?.getKv))try{const m=await t.getKv();return await L.getSecretsForSubject(m,o)}catch(m){S.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let l;const p=async()=>{l=await u();const m={toolName:r,args:n,context:{...e,upstreamSecrets:l},extra:ee(s)};return await O.exec(_,[m],{timeout:Y})};let d=await p();const f=D(d);if(f.length>0&&i&&!o)return E(I(d,[{type:"text",text:V}]));if(f.length>0&&i&&o&&t?.getKv){S.info(`gateway mcp credentials prompt: era=${c?"2026-07-28":"2025"} clientElicitation=${J(t)}`);const m=await t.getKv(),h=await Q(e,f),w=f.map(U=>X(U,h)),k=Z(l),g=c?await x(e,s,w,o,m,k,h,t):await z(e,w,o,m,k,h);switch(g.kind){case"inputRequired":return g.result;case"retry":d=await p();break;case"prependText":d=I(d,[{type:"text",text:g.text},...d.content]);break;case"none":break}}return E(d)}}function I(e,t){const{structuredContent:r,...n}=e;return{...n,content:t,isError:!0}}function J(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}async function Q(e,t){const r=new Map;for(const n of new Set(t.map(s=>s.api)))r.set(n,await G(e,n));return r}function X(e,t){const r=t.get(e.api);if(!r)return{...e,scheme:e.scheme??y};const n=e.scheme&&r.schemes[e.scheme]?e.scheme:r.defaultScheme;return{...e,scheme:n}}function Z(e){const t=new Set;for(const[r,n]of Object.entries(e??{}))for(const s of Object.keys(n))t.add(b({api:r,scheme:s}));return t}function R(e,t){return e.status===401&&!t.has(b(e))}function T(e,t){const r=t.get(e.api),n=e.sentScheme??e.scheme;return r&&n?$(r.schemes,n):void 0}function M(e,t){return e.map(r=>F(r,T(r,t))).join(`
+import{McpServer as C}from"@modelcontextprotocol/server";import{logger as S}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as _,MCP_TOOL_WORKER_KEY as O}from"../../../workers/mcp-tool-worker-pool.js";import{secretStore as L}from"../gateway-mcp/secret-store.js";import{readAuthRequiredMeta as D,stripAuthRequiredMeta as E,upstreamAuthKey as b}from"../gateway-mcp/upstream-auth.js";import{acceptedCredentialsLink as K,buildCredentialsAcceptedHint as j,buildCredentialsToolHint as F,buildUpstreamCredentialFallback as q,buildUpstreamCredentialInputRequired as v,credentialElicitationAnswer as H,dedupeElicitation as N,isStatelessRequest as P,schemeLabelOf as $,supportsUrlElicitation as B}from"../gateway-mcp/elicitation.js";import{DEFAULT_SCHEME_NAME as y,resolveUpstreamApiAuth as G}from"../gateway-mcp/upstream-auth-scheme.js";import{MISSING_SESSION_HANDLE_MESSAGE as V,resolveSecretSubject as W}from"../gateway-mcp/subject.js";const Y=6e4;function ue(e,t){return new C({name:e,version:new Date().toISOString().slice(0,10)},{capabilities:{logging:{}},...t?{instructions:t}:{}})}function le(e,t){return r=>async(n,s)=>{S.info(`MCP tool called: ${r}`);const i=e.elicitationEnabled??!1,u=P(s.mcpReq),a=i?W(e.user,n.sessionHandle):{kind:"anonymous"},o=a.kind==="resolved"?a.subject:void 0;if(a.kind==="invalid")return{content:[{type:"text",text:a.message}],isError:!0};const c=async()=>{if(!(!i||!o||!t?.getKv))try{const m=await t.getKv();return await L.getSecretsForSubject(m,o)}catch(m){S.warn(`gateway mcp secret store error, continuing unauthenticated: ${String(m)}`);return}};let l;const d=async()=>{l=await c();const m={toolName:r,args:n,context:{...e,upstreamSecrets:l},extra:ee(s)};return await _.exec(O,[m],{timeout:Y})};let p=await d();const f=D(p);if(f.length>0&&i&&!o)return E(I(p,[{type:"text",text:V}]));if(f.length>0&&i&&o&&t?.getKv){S.info(`gateway mcp credentials prompt: era=${u?"2026-07-28":"2025"} clientElicitation=${J(t)}`);const m=await t.getKv(),h=await Q(e,f),w=f.map(U=>X(U,h)),k=Z(l),g=u?await x(e,s,w,o,m,k,h,t):await z(e,w,o,m,k,h);switch(g.kind){case"inputRequired":return g.result;case"retry":p=await d();break;case"prependText":p=I(p,[{type:"text",text:g.text},...p.content]);break;case"none":break}}return E(p)}}function I(e,t){const{structuredContent:r,...n}=e;return{...n,content:t,isError:!0}}function J(e){const t=e?.getClientCapabilities()?.elicitation;if(!t)return"none";const r=[t.form?"form":void 0,t.url?"url":void 0].filter(Boolean);return r.length>0?r.join("+"):"none"}async function Q(e,t){const r=new Map;for(const n of new Set(t.map(s=>s.api)))r.set(n,await G(e,n));return r}function X(e,t){const r=t.get(e.api);if(!r)return{...e,scheme:e.scheme??y};const n=e.scheme&&r.schemes[e.scheme]?e.scheme:r.defaultScheme;return{...e,scheme:n}}function Z(e){const t=new Set;for(const[r,n]of Object.entries(e??{}))for(const s of Object.keys(n))t.add(b({api:r,scheme:s}));return t}function R(e,t){return e.status===401&&!t.has(b(e))}function T(e,t){const r=t.get(e.api),n=e.sentScheme??e.scheme;return r&&n?$(r.schemes,n):void 0}function M(e,t){return e.map(r=>F(r,T(r,t))).join(`
 
-`)}function A(e,t,r,n,s){const[i,...c]=t,a=s.get(i.api),o=i.scheme??a?.defaultScheme??y,l=(i.schemes?.length??0)<=1?T(i,s):void 0;return{subject:r,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:o,...l?{schemeLabel:l}:{}},auth:a?.schemes[o]??{kind:"raw"},...a?{apiAuth:a}:{},kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,...i.detail?{detail:i.detail}:{},otherApiNames:c.map(p=>p.name)}}}async function x(e,t,r,n,s,i,c,a){const o=H(t.mcpReq.inputResponses);if(o==="declined")return{kind:"none"};const u=r.filter(p=>R(p,i));if(u.length===0)return{kind:"prependText",text:M(r,c)};if(o==="accepted"){const p=await K(t.mcpReq.requestState(),{kv:s,subject:n,baseUrl:e.baseUrl??"",apis:u.map(f=>f.api)}),d=p?.apiName??u[0].name;return{kind:"prependText",text:j(d,p?.url)}}const l=A(e,u,n,s,c);return B(a?.getClientCapabilities())?{kind:"inputRequired",result:await v(l)}:{kind:"prependText",text:await q(l)}}async function z(e,t,r,n,s,i){const c=t.filter(u=>R(u,s));if(c.length===0)return{kind:"prependText",text:M(t,i)};const a=A(e,c,r,n,i);return{kind:"prependText",text:await N(`${r}:${b(c[0])}`,()=>q(a))}}function ee(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function pe(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,client:e.client,clientVersion:e.clientVersion,requestId:e.requestId,messageId:e.messageId,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes,internalBaseUrl:e.internalBaseUrl,sandboxToolSchemas:e.sandboxToolSchemas,fs:void 0}}export{ue as createMcpServer,le as createToolDispatch,pe as extractSerializableContext};
+`)}function A(e,t,r,n,s){const[i,...u]=t,a=s.get(i.api),o=i.scheme??a?.defaultScheme??y,c=i.schemes&&i.schemes.length>1?i.schemes:void 0,l=c?void 0:T(i,s);return{subject:r,baseUrl:e.baseUrl??"",target:{api:i.api,name:i.name,scheme:o,...l?{schemeLabel:l}:{},...c?{acceptedSchemes:c}:{}},auth:a?.schemes[o]??{kind:"raw"},...a?{apiAuth:a}:{},kv:n,hasExistingSecret:!1,reason:{kind:"authFailure",status:i.status,...i.detail?{detail:i.detail}:{},otherApiNames:u.map(d=>d.name)}}}async function x(e,t,r,n,s,i,u,a){const o=H(t.mcpReq.inputResponses);if(o==="declined")return{kind:"none"};const c=r.filter(d=>R(d,i));if(c.length===0)return{kind:"prependText",text:M(r,u)};if(o==="accepted"){const d=await K(t.mcpReq.requestState(),{kv:s,subject:n,baseUrl:e.baseUrl??"",apis:c.map(f=>f.api)}),p=d?.apiName??c[0].name;return{kind:"prependText",text:j(p,d?.url)}}const l=A(e,c,n,s,u);return B(a?.getClientCapabilities())?{kind:"inputRequired",result:await v(l)}:{kind:"prependText",text:await q(l)}}async function z(e,t,r,n,s,i){const u=t.filter(c=>R(c,s));if(u.length===0)return{kind:"prependText",text:M(t,i)};const a=A(e,u,r,n,i);return{kind:"prependText",text:await N(`${r}:${b(u[0])}`,()=>q(a))}}function ee(e){return{sessionId:e.sessionId,authInfo:e.http?.authInfo,requestId:e.mcpReq.id,_meta:e.mcpReq._meta}}function de(e){return{user:e.user,config:e.config,outdir:e.outdir,baseUrl:e.baseUrl,params:e.params,query:e.query,cookies:e.cookies,apiDescriptionsMap:e.apiDescriptionsMap,graphqlDescriptions:e.graphqlDescriptions,products:e.products,accessToken:e.accessToken,metadata:e.metadata,upstreamAuthorization:e.upstreamAuthorization,mcpMode:e.mcpMode,elicitationEnabled:e.elicitationEnabled,gatewayFetchBudgetPerExec:e.gatewayFetchBudgetPerExec,clientIp:e.clientIp,client:e.client,clientVersion:e.clientVersion,requestId:e.requestId,messageId:e.messageId,upstreamSecrets:e.upstreamSecrets,searchIgnoredRoutes:e.searchIgnoredRoutes,internalBaseUrl:e.internalBaseUrl,sandboxToolSchemas:e.sandboxToolSchemas,fs:void 0}}export{ue as createMcpServer,le as createToolDispatch,de as extractSerializableContext};

package/dist/server/plugins/mcp/types.d.ts

@@ -5,6 +5,7 @@ import type { McpErrorCodes, McpServerType } from './constants';
 import type { McpToolSchema } from '../../types';
 import type { Skill } from '../../types/plugins/skills.js';
 import type { UpstreamSecrets } from './gateway-mcp/secret-store.js';
+import type { SiteBranding } from './handlers/credentials-page/types.js';
 type ObjectValues<T> = T[keyof T];
 export type McpServerType = ObjectValues<typeof McpServerType>;
 export type McpErrorCodeTypes = ObjectValues<typeof McpErrorCodes>;
@@ -40,6 +41,11 @@ export type McpDocsStaticData = PageStaticData & {
         skillsBaseUrl?: string;
     };
 };
+export type CredentialsPageStaticData = PageStaticData & {
+    props?: {
+        branding?: SiteBranding;
+    };
+};
 export type SkillMcpResource = {
     slug: string;
     name: string;

package/dist/server/plugins/mcp/utils/mode.d.ts

@@ -10,7 +10,10 @@ import type { McpMode } from '../types.js';
  * data / McpToolContext instead (see docs-mcp-handler / execute-mcp-tool).
  */
 export declare function isMcpCodeModeEnabled(): boolean;
-/** The gateway capability — a guarded `fetch` in the `execute` sandbox. Requires code mode. */
+/**
+ * The gateway capability: a guarded `fetch` in the `execute` sandbox. Requires code mode and a
+ * project database.
+ */
 export declare function isMcpGatewayEnabled(): boolean;
 export declare function isMcpElicitationEnabled(): boolean;
 export declare function getMcpMode(): McpMode;

package/dist/server/plugins/mcp/utils/mode.js

@@ -1 +1 @@
-import{EntitlementsProvider as e}from"../../../entitlements/entitlements-provider.js";function t(){return e.instance().entitlements?.mcpMode==="code"}function n(){return!!e.instance().canAccessFeature("mcpGateway")&&t()}function c(){return n()}function r(){return t()?"code":"tools"}export{r as getMcpMode,t as isMcpCodeModeEnabled,c as isMcpElicitationEnabled,n as isMcpGatewayEnabled};
+import{EntitlementsProvider as e}from"../../../entitlements/entitlements-provider.js";import{hasProjectDatabase as n}from"../../../providers/database/has-project-database.js";function t(){return e.instance().entitlements?.mcpMode==="code"}function o(){return!!e.instance().canAccessFeature("mcpGateway")&&t()&&n()}function i(){return o()}function a(){return t()?"code":"tools"}export{a as getMcpMode,t as isMcpCodeModeEnabled,i as isMcpElicitationEnabled,o as isMcpGatewayEnabled};

package/dist/server/plugins/scorecard-classic/template/components.js

@@ -1 +1 @@
-import*as t from"react";import{useState as i}from"react";import{getScorecardColorVariable as s}from"@redocly/theme/core/utils";import{Button as m}from"@redocly/theme/components/Button/Button";import{SubtractIcon as u}from"@redocly/theme/icons/SubtractIcon/SubtractIcon";import{AddIcon as p}from"@redocly/theme/icons/AddIcon/AddIcon";import{Gauge as E}from"./Gauge";import{Code as f,Dot as o,FilePreview as d,InstanceControlsWrap as v,InstanceMessage as x,InstanceReference as C,InstanceWrap as I,ContentWithDotWrap as a,EmojiWrap as b}from"./index.styles";import{SEVERITY_TO_COLOR as g,severityColor as S,severityIcon as R}from"./utils";function D({level:e,colorVariable:r}){return t.createElement(a,null,t.createElement(o,{colorVariable:r}),t.createElement("span",null,e))}function L({summary:e}){const r=Object.keys(e.levels).length;return t.createElement(E,{chunks:Object.entries(e.levels).map(([l,n],c)=>({share:n/e.total*100,colorVariable:s(c,r),title:`${n} ${l}`}))})}function P({severity:e}){return t.createElement(o,{colorVariable:g[e]})}function A({errors:e,warnings:r}){return t.createElement(a,null,t.createElement(o,{colorVariable:`--scorecard-color-${e>0?"error":r>0?"warning":"success"}`}),e>0?"Problem":r>0?"Warning":"Normal")}function N({errors:e,warnings:r}){return t.createElement(o,{colorVariable:`--scorecard-color-${e>0?"error":r>0?"warning":"success"}`})}function V({problem:e}){const[r,l]=i(!1);return t.createElement(v,{onClick:()=>l(n=>!n),className:r?"expanded":""},t.createElement(m,{variant:"text",size:"medium",icon:r?t.createElement(u,null):t.createElement(p,null)}),t.createElement(I,{borderColor:S(e.severity)},t.createElement("div",null,t.createElement(x,null,t.createElement(b,null,R(e.severity))," ",e.message)),r?t.createElement(d,{onClick:n=>n.stopPropagation()},t.createElement(C,null,t.createElement("strong",null,e.location.source.absoluteRef),e.location.pointer),t.createElement(f,null,e.codeframe)):null))}const T=e=>t.createElement(V,{problem:e});export{D as ApiLevel,V as Instance,P as InstanceStatus,N as LevelStatus,A as RuleStatus,L as StatusDistribution,T as renderRowSubComponent};
+import*as e from"react";import{useState as i}from"react";import{getScorecardColorVariable as s}from"@redocly/theme/core/utils";import{Button as m}from"@redocly/theme/components/Button/Button";import{SubtractIcon as u}from"@redocly/theme/icons/SubtractIcon/SubtractIcon";import{AddIcon as p}from"@redocly/theme/icons/AddIcon/AddIcon";import{Gauge as E}from"./Gauge";import{Code as f,Dot as o,FilePreview as d,InstanceControlsWrap as v,InstanceMessage as x,InstanceReference as C,InstanceWrap as I,ContentWithDotWrap as a,EmojiWrap as b}from"./index.styles";import{SEVERITY_TO_COLOR as g,severityColor as S,severityIcon as R}from"./utils";function D({level:t,colorVariable:r}){return e.createElement(a,null,e.createElement(o,{colorVariable:r}),e.createElement("span",null,t))}function L({summary:t}){const r=Object.keys(t.levels).length;return e.createElement(E,{chunks:Object.entries(t.levels).map(([l,n],c)=>({share:n/t.total*100,colorVariable:s(c,r),title:`${n} ${l}`}))})}function P({severity:t}){return e.createElement(o,{colorVariable:g[t]})}function A({errors:t,warnings:r}){return e.createElement(a,null,e.createElement(o,{colorVariable:`--scorecard-color-${t>0?"error":r>0?"warning":"success"}`}),e.createElement("span",null,t>0?"Problem":r>0?"Warning":"Normal"))}function N({errors:t,warnings:r}){return e.createElement(o,{colorVariable:`--scorecard-color-${t>0?"error":r>0?"warning":"success"}`})}function V({problem:t}){const[r,l]=i(!1);return e.createElement(v,{onClick:()=>l(n=>!n),className:r?"expanded":""},e.createElement(m,{variant:"text",size:"medium",icon:r?e.createElement(u,null):e.createElement(p,null)}),e.createElement(I,{borderColor:S(t.severity)},e.createElement("div",null,e.createElement(x,null,e.createElement(b,null,R(t.severity))," ",t.message)),r?e.createElement(d,{onClick:n=>n.stopPropagation()},e.createElement(C,null,e.createElement("strong",null,t.location.source.absoluteRef),t.location.pointer),e.createElement(f,null,t.codeframe)):null))}const T=t=>e.createElement(V,{problem:t});export{D as ApiLevel,V as Instance,P as InstanceStatus,N as LevelStatus,A as RuleStatus,L as StatusDistribution,T as renderRowSubComponent};

package/dist/server/providers/database/client.d.ts

@@ -17,6 +17,11 @@ export declare class DatabaseClient {
     static init(config: Config, options?: DatabaseClientInitOptions): Promise<DatabaseClient>;
     migrate(prefix: string, suffix?: string): Promise<void>;
     close(): Promise<void>;
+    /**
+     * Closes the client during error handling. Never throws, so the caller can rethrow
+     * the original error; a close failure is logged.
+     */
+    closeAfterFailure(): Promise<void>;
     sync(): Promise<void>;
 }
 export {};

package/dist/server/providers/database/client.js

@@ -1 +1 @@
-import a from"node:path";import{sql as o}from"drizzle-orm";import{drizzle as c}from"drizzle-orm/libsql";import{migrate as l}from"drizzle-orm/libsql/migrator";import{TransactionsManager as m}from"./transactions-manager.js";class e{dbClient;#t;constructor(t,i){this.dbClient=c(i(t)),this.#t=new m(this.dbClient)}get transactionsManager(){return this.#t}get client(){return this.#t.tx??this.dbClient}static async init(t,i){const{createClient:s}=await import("@libsql/client"),r=new e(t,s);return i?.runWithPragmaWalWriteOptimization&&await r.dbClient.run(o.raw("PRAGMA journal_mode = WAL;")),r}async migrate(t,i=""){await l(this.dbClient,{migrationsFolder:a.join(t,"migrations",i)})}async close(){this.dbClient.$client.close()}async sync(){try{await this.dbClient.$client.sync()}catch(t){if(d(t))return;throw t}}}function d(n){if(!(n instanceof Error))return!1;const t=n.message.toLowerCase();return t.includes("syncnotsupported")&&(t.includes('("file")')||t.includes('"file"'))}export{e as DatabaseClient};
+import o from"node:path";import{sql as c}from"drizzle-orm";import{drizzle as l}from"drizzle-orm/libsql";import{migrate as m}from"drizzle-orm/libsql/migrator";import{logger as d}from"../../tools/notifiers/logger.js";import{TransactionsManager as h}from"./transactions-manager.js";class n{dbClient;#t;constructor(t,r){this.dbClient=l(r(t)),this.#t=new h(this.dbClient)}get transactionsManager(){return this.#t}get client(){return this.#t.tx??this.dbClient}static async init(t,r){const{createClient:a}=await import("@libsql/client"),i=new n(t,a);if(r?.runWithPragmaWalWriteOptimization)try{await i.dbClient.run(c.raw("PRAGMA journal_mode = WAL;"))}catch(s){throw await i.closeAfterFailure(),s}return i}async migrate(t,r=""){await m(this.dbClient,{migrationsFolder:o.join(t,"migrations",r)})}async close(){this.dbClient.$client.close()}async closeAfterFailure(){try{await this.close()}catch(t){d.warn("Failed to close the database client: %s",t)}}async sync(){try{await this.dbClient.$client.sync()}catch(t){if(u(t))return;throw t}}}function u(e){if(!(e instanceof Error))return!1;const t=e.message.toLowerCase();return t.includes("syncnotsupported")&&(t.includes('("file")')||t.includes('"file"'))}export{n as DatabaseClient};

package/dist/server/providers/database/copy-migrations.js

@@ -1 +1 @@
-import a from"node:path";import{cpSync as c,existsSync as t,mkdirSync as m}from"node:fs";import{logger as i}from"../../tools/notifiers/logger.js";import{fromCurrentDir as d}from"../../utils/index.js";import{PACKAGE_NAME as f}from"../../../config/product-gates.js";const l=["@redocly/realm","@redocly/reef","@redocly/redoc-reef","@redocly/revel-reef"],A=r=>{if(!l.includes(f))return;const o="sqlite-db",e=d(import.meta.url,`./databases/${o}/migrations`),s=a.join(r.serverOutDir,"migrations",o);if(!t(e)){i.warn(`Migrations folder not found at ${e}`);return}t(r.serverOutDir)||m(r.serverOutDir,{recursive:!0});try{c(e,s,{recursive:!0})}catch(n){i.error("Failed to copy migrations folder: %s",n)}};export{A as copyMigrationsFolder};
+import n from"node:path";import{cpSync as m,existsSync as i,mkdirSync as c}from"node:fs";import{logger as e}from"../../tools/notifiers/logger.js";import{fromCurrentDir as u}from"../../utils/index.js";import{hasProjectDatabase as f}from"./has-project-database.js";const D=r=>{if(!f())return;const o="sqlite-db",t=u(import.meta.url,`./databases/${o}/migrations`),a=n.join(r.serverOutDir,"migrations",o);if(!i(t)){e.warn(`Migrations folder not found at ${t}`);return}i(r.serverOutDir)||c(r.serverOutDir,{recursive:!0});try{m(t,a,{recursive:!0})}catch(s){e.error("Failed to copy migrations folder: %s",s)}};export{D as copyMigrationsFolder};

package/dist/server/providers/database/database-connections-manager.js

@@ -1 +1 @@
-import{logger as c}from"../../tools/notifiers/logger.js";import{SqldNotRunningError as y}from"./sqld-not-running-error.js";import{retryAsyncOperation as f}from"./utils/retry-async-operation.js";import{DatabasePathGenerator as h}from"./database-path-generator.js";import{DatabaseClient as w}from"./client.js";const m="_redocly_db_preconnect_cache_";class i{static get#t(){const t=globalThis;if(!t[m]){const n={connections:new Map,pendingConnections:new Map,failedConnections:new Set};t[m]=n}return t[m]}static get#i(){return i.#t.connections}static get#e(){return i.#t.failedConnections}static get#n(){return i.#t.pendingConnections}static async getLocalConnection(t){return i.#r(t,async()=>i.#a(t))}static async getRemoteConnection(t){return i.#r(t,async()=>i.#d(t))}static async#r(t,n){const e=i.#o(t),r=i.#i.get(e);if(r)if(r.client.dbClient.$client.closed)c.warn("Cached database client is closed. Reinitializing connection..."),i.#i.delete(e);else return r;return i.#l({key:e,initializer:n})}static#o=t=>{const n="syncUrl"in t&&typeof t.syncUrl=="string"?`|${t.syncUrl}`:"",e=t.additionalFolder??"";return`${t.baseDbDir}|${e}|${t.databaseName}${n}`};static async#l({key:t,initializer:n}){let e=i.#n.get(t);e||(i.#e.has(t)&&c.warn("Error connecting to the database, retrying..."),e=i.#s(t,n),i.#n.set(t,e));try{return await e}catch(r){return c.error("Error connecting to the database",r),i.#e.add(t),null}finally{i.#n.delete(t)}}static async#s(t,n){const e=await n();return i.#i.set(t,e),i.#e.delete(t),e}static async#a({removeExisting:t,baseDbDir:n,runWithPragmaWalWriteOptimization:e,databaseName:r,additionalFolder:a,migrationsFolder:d}){c.info("Initializing local database client...");const l=c.startTiming(),s=await i.#c({removeExisting:t,baseDbDir:n,databaseName:r,additionalFolder:a,migrationsFolder:d,runWithPragmaWalWriteOptimization:e});return c.infoTime(l,"Local database client initialized"),s}static async#d({removeExisting:t,baseDbDir:n,syncUrl:e,authToken:r,databaseName:a,additionalFolder:d,migrationsFolder:l}){c.info("Initializing remote database client...");const s=c.startTiming();return await f(async()=>{try{const o=await i.#c({removeExisting:t,baseDbDir:n,databaseName:a,additionalFolder:d,migrationsFolder:l,syncUrl:e,authToken:r});return c.infoTime(s,"Remote database client initialized"),o}catch(o){throw y.isSqldNotRunningError(o)?new y("SQLD server is not running yet, wait for production deployment",{cause:o}):o}},{maxRetries:3,retryStrategy:"exponential",delay:1e3,logger:c,messages:{retry:"Retrying remote database client initialization",maxRetriesReached:"Max retries reached, remote database client initialization failed"}})}static async#c({removeExisting:t,baseDbDir:n,databaseName:e,additionalFolder:r,migrationsFolder:a,runWithPragmaWalWriteOptimization:d,syncUrl:l,authToken:s}){const{databasePath:o}=await h.prepareDatabasePath({baseDir:n,databaseName:e,additionalFolder:r,removeExisting:t}),p=l&&s?{url:`file:${o}`,syncUrl:l,authToken:s}:{url:`file:${o}`},u=await w.init(p,{runWithPragmaWalWriteOptimization:d});return await u.migrate(n,a),{client:u,path:o}}}export{i as DatabaseConnectionsManager};
+import{logger as c}from"../../tools/notifiers/logger.js";import{SqldNotRunningError as y}from"./sqld-not-running-error.js";import{retryAsyncOperation as h}from"./utils/retry-async-operation.js";import{DatabasePathGenerator as w}from"./database-path-generator.js";import{DatabaseClient as g}from"./client.js";import{describeTransientError as z}from"./transient-sqld-error.js";const u="_redocly_db_preconnect_cache_";class i{static get#t(){const t=globalThis;if(!t[u]){const r={connections:new Map,pendingConnections:new Map,failedConnections:new Set};t[u]=r}return t[u]}static get#i(){return i.#t.connections}static get#e(){return i.#t.failedConnections}static get#r(){return i.#t.pendingConnections}static async getLocalConnection(t){return i.#n(t,async()=>i.#a(t))}static async getRemoteConnection(t){return i.#n(t,async()=>i.#d(t))}static async#n(t,r){const e=i.#o(t),n=i.#i.get(e);if(n)if(n.client.dbClient.$client.closed)c.warn("Cached database client is closed. Reinitializing connection..."),i.#i.delete(e);else return n;return i.#l({key:e,initializer:r})}static#o=t=>{const r="syncUrl"in t&&typeof t.syncUrl=="string"?`|${t.syncUrl}`:"",e=t.additionalFolder??"";return`${t.baseDbDir}|${e}|${t.databaseName}${r}`};static async#l({key:t,initializer:r}){let e=i.#r.get(t);e||(i.#e.has(t)&&c.warn("Error connecting to the database, retrying..."),e=i.#s(t,r),i.#r.set(t,e));try{return await e}catch(n){return c.error("Error connecting to the database: %s",z(n)),i.#e.add(t),null}finally{i.#r.delete(t)}}static async#s(t,r){const e=await r();return i.#i.set(t,e),i.#e.delete(t),e}static async#a({removeExisting:t,baseDbDir:r,runWithPragmaWalWriteOptimization:e,databaseName:n,additionalFolder:a,migrationsFolder:d}){c.info("Initializing local database client...");const l=c.startTiming(),s=await i.#c({removeExisting:t,baseDbDir:r,databaseName:n,additionalFolder:a,migrationsFolder:d,runWithPragmaWalWriteOptimization:e});return c.infoTime(l,"Local database client initialized"),s}static async#d({removeExisting:t,baseDbDir:r,syncUrl:e,authToken:n,databaseName:a,additionalFolder:d,migrationsFolder:l}){c.info("Initializing remote database client...");const s=c.startTiming();return await h(async()=>{try{const o=await i.#c({removeExisting:t,baseDbDir:r,databaseName:a,additionalFolder:d,migrationsFolder:l,syncUrl:e,authToken:n});return c.infoTime(s,"Remote database client initialized"),o}catch(o){throw y.isSqldNotRunningError(o)?new y("SQLD server is not running yet, wait for production deployment",{cause:o}):o}},{maxRetries:3,retryStrategy:"exponential",delay:1e3,logger:c,messages:{retry:"Retrying remote database client initialization",maxRetriesReached:"Max retries reached, remote database client initialization failed"}})}static async#c({removeExisting:t,baseDbDir:r,databaseName:e,additionalFolder:n,migrationsFolder:a,runWithPragmaWalWriteOptimization:d,syncUrl:l,authToken:s}){const{databasePath:o}=await w.prepareDatabasePath({baseDir:r,databaseName:e,additionalFolder:n,removeExisting:t}),p=l&&s?{url:`file:${o}`,syncUrl:l,authToken:s}:{url:`file:${o}`},m=await g.init(p,{runWithPragmaWalWriteOptimization:d});try{await m.migrate(r,a)}catch(f){throw await m.closeAfterFailure(),f}return{client:m,path:o}}}export{i as DatabaseConnectionsManager};

package/dist/server/providers/database/has-project-database.d.ts

@@ -0,0 +1,3 @@
+/** Whether this product ships the project database (KV, migrations). Redoc and Revel do not. */
+export declare function hasProjectDatabase(): boolean;
+//# sourceMappingURL=has-project-database.d.ts.map

package/dist/server/providers/database/has-project-database.js

@@ -0,0 +1 @@
+import{PACKAGE_NAME as e}from"../../../config/product-gates.js";const r=["@redocly/realm","@redocly/reef","@redocly/redoc-reef","@redocly/revel-reef"];function c(){return r.includes(e)}export{c as hasProjectDatabase};

package/dist/server/web-server/auth.d.ts

@@ -78,7 +78,6 @@ type McpAuthorizationCodePayload = {
     redirect_uri: string;
     id_token: string;
     idp_id?: string;
-    idp_access_token?: string;
     idp_access_token_enc?: string;
     idp_refresh_token_enc?: string;
     code_challenge?: string;