@redocly/realm 0.138.0-next.15 → 0.138.0-next.16

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth-scheme.js

@@ -0,0 +1,2 @@
+import{getApiDescriptionFromFs as k}from"../docs-mcp/tools/openapi/utils.js";import{OPERATION_METHODS as b}from"../docs-mcp/tools/openapi/constants.js";import{basePathPrefix as S,operationHttpMethod as A,pathPattern as C}from"./route-pattern.js";const P=120,l="default",j={kind:"raw"},y=["oauth2ClientCredentials","bearer","apiKey","cookie","raw"],E=new Set(b);function c(){return{schemes:{[l]:j},defaultScheme:l,routes:[],credentialQueryParams:[]}}async function q(e,n,t=k){const r=Object.values(e.apiDescriptionsMap??{}).find(o=>o.relativePath===n);if(!r)return c();try{const o=await t({relativePath:r.relativePath,outdir:e.outdir||"",user:e.user,rbac:e.config?.access?.rbac||{},requiresLogin:!!e.config?.access?.requiresLogin});return o?w(o,r.servers??[]):c()}catch{return c()}}function w(e,n){const t=K(e),r=Object.keys(t),o=g(e);if(r.length===0)return{...c(),credentialQueryParams:o};const s=h(e.security,t)[0]??a(r,t)[0],i=v(e,r);return{schemes:t,defaultScheme:s,routes:T(e,t,n),credentialQueryParams:o,...Object.keys(i).length>0?{descriptions:i}:{}}}function g(e){const n=new Set;for(const t of Object.values(e.components?.securitySchemes??{}))f(t)&&t.type==="apiKey"&&t.in==="query"&&t.name&&n.add(t.name);return[...n]}function L(e){return[...new Set(Object.values(e).map(H))]}function R(e){return a(Object.keys(e),e)}function N(e,n){const t=new Set;for(const r of e.routes)r.schemes.includes(n)&&t.add(`${r.method} ${r.path}`);return[...t]}function H(e){return e.kind==="apiKey"?e.header:e.kind==="cookie"?"Cookie":"Authorization"}function v(e,n){const t={};for(const r of n){const o=e.components?.securitySchemes?.[r],s=f(o)?o.description:void 0;if(typeof s!="string")continue;const i=s.split(`
+`)[0].trim();i&&(t[r]=i.slice(0,P))}return t}function K(e){const n={};for(const[t,r]of Object.entries(e.components?.securitySchemes??{})){if(!f(r))continue;const o=M(r);o&&(n[t]=o)}return n}function M(e){if(e.type==="oauth2"){const n=e.flows?.clientCredentials;return n?{kind:"oauth2ClientCredentials",tokenUrl:n.tokenUrl,scopes:Object.keys(n.scopes??{})}:{kind:"bearer"}}if(e.type==="openIdConnect")return{kind:"bearer"};if(e.type==="http"&&e.scheme?.toLowerCase()==="bearer")return{kind:"bearer"};if(e.type==="apiKey"&&e.in==="header")return{kind:"apiKey",header:e.name||"X-Api-Key"};if(e.type==="apiKey"&&e.in==="cookie"&&e.name)return{kind:"cookie",name:e.name}}function a(e,n){return[...e].sort((t,r)=>y.indexOf(n[t].kind)-y.indexOf(n[r].kind)||e.indexOf(t)-e.indexOf(r))}function h(e,n){const t=[];for(const r of e??[])for(const o of Object.keys(r))n[o]&&!t.includes(o)&&t.push(o);return t}function T(e,n,t){const r=S(t),o=[];for(const[s,i]of Object.entries(e.paths??{})){if(!i||typeof i!="object")continue;const p=C(r,s);if(p)for(const[d,O]of Object.entries(i)){if(!E.has(d.toLowerCase()))continue;const u=O?.security??e.security;if(u===void 0)continue;const m=h(u,n);m.length===0&&u.length>0||o.push({pattern:p,path:s,method:A(d),schemes:a(m,n)})}}return o}function f(e){return typeof e=="object"&&e!==null&&"type"in e}export{l as DEFAULT_SCHEME_NAME,L as credentialHeadersOf,N as operationsForScheme,R as orderedSchemesOf,q as resolveUpstreamApiAuth};

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.d.ts

@@ -0,0 +1,21 @@
+import type { CallToolResult } from '@modelcontextprotocol/server';
+export declare const UPSTREAM_AUTH_REQUIRED_META = "com.redocly/upstream-auth-required";
+export type UpstreamAuthRequiredEvent = {
+    api: string;
+    name: string;
+    status: number;
+    scheme?: string;
+    schemes?: string[];
+    /** Scheme whose stored credential the bridge actually sent; absent when nothing was injected. */
+    sentScheme?: string;
+    /** The upstream's own explanation of the failure, taken from the response body. */
+    detail?: string;
+};
+export declare function upstreamAuthKey(event: {
+    api: string;
+    scheme?: string;
+}): string;
+export declare function withAuthRequiredMeta(result: CallToolResult, events: UpstreamAuthRequiredEvent[]): CallToolResult;
+export declare function readAuthRequiredMeta(result: CallToolResult): UpstreamAuthRequiredEvent[];
+export declare function stripAuthRequiredMeta(result: CallToolResult): CallToolResult;
+//# sourceMappingURL=upstream-auth.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.js

@@ -0,0 +1 @@
+const i="com.redocly/upstream-auth-required";function f(e){return`${e.api}\0${e.scheme??""}`}function m(e,n){const t=new Map;for(const a of n){const s=f(a),o=t.get(s);(!o||u(a)>u(o))&&t.set(s,a)}const r=[...t.values()];return r.length===0?e:{...e,_meta:{...e._meta,[i]:r}}}function u(e){return e.status!==401?0:e.sentScheme?2:1}function h(e){const n=e._meta?.[i];return Array.isArray(n)?n.filter(t=>typeof t?.api=="string"&&typeof t?.name=="string"&&typeof t?.status=="number").map(t=>{const r=Array.isArray(t.schemes)?t.schemes.filter(p=>typeof p=="string"):[],{schemes:a,sentScheme:s,detail:o,...c}=t;return{...c,...r.length>0?{schemes:r}:{},...typeof s=="string"?{sentScheme:s}:{},...typeof o=="string"?{detail:o}:{}}}):[]}function y(e){if(!e._meta||!(i in e._meta))return e;const{[i]:n,...t}=e._meta,r={...e};return Object.keys(t).length>0?r._meta=t:delete r._meta,r}export{i as UPSTREAM_AUTH_REQUIRED_META,h as readAuthRequiredMeta,y as stripAuthRequiredMeta,f as upstreamAuthKey,m as withAuthRequiredMeta};

package/dist/server/plugins/mcp/handlers/credentials-page/constants.d.ts

@@ -0,0 +1,7 @@
+export declare const FORM_ACTIONS: {
+    readonly save: 'save';
+    readonly remove: 'remove';
+    readonly removeAll: 'remove-all';
+    readonly decline: 'decline';
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/constants.js

@@ -0,0 +1 @@
+const e={save:"save",remove:"remove",removeAll:"remove-all",decline:"decline"};export{e as FORM_ACTIONS};

package/dist/server/plugins/mcp/handlers/credentials-page/form-contract.d.ts

@@ -0,0 +1,5 @@
+import type { ElicitationScheme, ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { SchemeField } from './types.js';
+export declare function schemeFieldName(field: SchemeField, schemeIndex: number): string;
+export declare function credentialSchemesOf(target: ElicitationTarget): ElicitationScheme[];
+//# sourceMappingURL=form-contract.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/form-contract.js

@@ -0,0 +1 @@
+function c(e,n){return`${e}__${n}`}function h(e){return e.schemes??[{name:e.scheme,auth:e.auth}]}export{h as credentialSchemesOf,c as schemeFieldName};

package/dist/server/plugins/mcp/handlers/credentials-page/form-page.d.ts

@@ -0,0 +1,14 @@
+import type { ElicitationTarget, StoredSchemes } from '../../gateway-mcp/secret-store.js';
+import type { FormError, PageContent, PageSite } from './types.js';
+type FormPageInput = {
+    site: PageSite;
+    target: ElicitationTarget;
+    token: string;
+    stored: StoredSchemes;
+    error?: FormError;
+    /** Client IDs to put back into the OAuth2 fields after a rejected submission, by scheme index. */
+    clientIds?: readonly string[];
+};
+export declare function formPage(input: FormPageInput): PageContent;
+export {};
+//# sourceMappingURL=form-page.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/form-page.js

@@ -0,0 +1,62 @@
+import{withPathPrefix as D}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as R}from"../../../../constants/mcp.js";import{ELICITATION_TTL_MS as _}from"../../gateway-mcp/secret-store.js";import{secretTtlSeconds as I}from"../../gateway-mcp/subject.js";import{FORM_ACTIONS as $}from"./constants.js";import{credentialSchemesOf as F,schemeFieldName as M}from"./form-contract.js";import{ICONS as v,code as h,escapeHtml as r,siteHeader as N,targetTitle as A}from"./layout.js";const S=10,g="form-error",T=new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"short",year:"numeric",timeZone:"UTC"}),P={bearer:{title:"API token",noun:"API token",placeholder:"Paste your API token"},apiKey:{title:"API key",noun:"API key",placeholder:"Paste your API key"},cookie:{title:"Cookie",noun:"cookie value",placeholder:"Paste the cookie value"},oauth2ClientCredentials:{title:"OAuth2",noun:"access token",placeholder:"Paste an access token"},raw:{title:"Authorization header",noun:"header value",placeholder:"Bearer <token>"}};function te(e){const{site:t,target:n,token:o,error:s}=e,a=D(R),u=F(n),i=u.length>1,c=L(e,u),l=c.some(f=>f.isStored),d=i&&l,m=c.map(f=>i?U(f):B(f)).join(""),p=d?'<button class="text-danger" type="submit" form="remove-all">Remove all credentials</button>':"",O=s?`<div class="banner" role="alert" id="${g}">${v.alert}<p>${r(s.message)}</p></div>`:"";return{title:`Credentials for ${A(n)}`,body:`<div class="page">
+<main class="card">
+${N(t)}
+<h1>${l?"Update":"Add"} credentials for ${r(A(n))}</h1>
+<p class="lede">${i?"This API accepts more than one kind of credential. Fill in the one that you have.":"This API needs one credential to authenticate your calls."}</p>
+${O}
+<form class="credentials" method="post" action="${a}" autocomplete="off">
+${y(o,$.save)}
+<div class="schemes">${m}</div>
+<div class="actions">
+<div class="actions-row">${p}<button class="primary" type="submit">Save credentials</button></div>
+<p class="decline small">Did not ask for this link? <button class="link-button" type="submit" form="decline">Decline it</button></p>
+</div>
+</form>
+${H(a,o,c,d)}
+</main>
+${W(n,t.host)}
+</div>`}}function L(e,t){const{target:n,stored:o,error:s,clientIds:a}=e,u=n.acceptedSchemes??[n.scheme],i=s?.schemeIndex??Math.max(0,t.findIndex(({name:l})=>u.includes(l))),c=t.length>1;return t.map((l,d)=>{const m=o[l.name],p=s?.schemeIndex===d?s:void 0;return{scheme:l,index:d,isMulti:c,title:c?l.name:P[l.auth.kind].title,savedAt:m?.savedAt,deletedAt:m?.savedAt===void 0?void 0:m.savedAt+I(n.subject)*1e3,isStored:m!==void 0,isOpen:d===i||u.includes(l.name)||m!==void 0,error:p,clientId:a?.[d]??"",autofocusField:d===i?p?.field??"secret":void 0}})}function B(e){return`<section class="scheme" aria-labelledby="scheme-${e.index}-title">
+<div class="scheme-body">
+<div class="scheme-head">
+<h2 id="scheme-${e.index}-title">${r(e.title)}</h2>
+<p>${E(e.scheme.auth)}</p>
+</div>
+${C(e)}
+</div>
+</section>`}function U(e){const t=e.isStored?'<span class="tag stored">Stored</span>':'<span class="tag">Not set</span>';return`<details class="scheme" aria-labelledby="scheme-${e.index}-title"${e.isOpen?" open":""}>
+<summary><span class="summary-title" id="scheme-${e.index}-title">${r(e.title)}</span><span class="summary-tag">${t}</span><span class="summary-line">${E(e.scheme.auth)}</span>${e.scheme.label?`<span class="summary-line">${r(e.scheme.label)}</span>`:""}</summary>
+<div class="scheme-body">
+${C(e)}
+</div>
+</details>`}function C(e){const t=e.isStored?j(e):"",n=e.isMulti?K(e.scheme.operations):"";return e.scheme.auth.kind==="oauth2ClientCredentials"?`${t}${x(e,!1)}${n}${z(e)}`:`${t}${x(e,!e.isMulti&&!e.isStored)}${n}`}function j({savedAt:e,deletedAt:t,index:n,title:o}){return`<div class="stored-box">
+<div>${e===void 0||t===void 0?"<p>A credential is stored for this scheme.</p>":`<p>Saved on ${T.format(e)}</p><p class="muted small">Kept until ${T.format(t)} at ${b(t)} UTC</p>`}</div>
+<button class="text-danger small" type="submit" form="remove-${n}" aria-label="Remove the stored ${r(o)} credential">Remove</button>
+</div>`}function x(e,t){const{auth:n}=e.scheme,{noun:o,placeholder:s}=P[n.kind];return k({view:e,field:"secret",type:"password",label:e.isStored?`Replace the ${o}`:Y(o),placeholder:e.isStored&&e.isMulti?"Leave empty to keep the stored value":s,hint:q(n),isRequired:t})}function z(e){return`<hr class="divider">
+<div class="scheme-head">
+<p class="strong">No token yet?</p>
+<p>We exchange your client ID and secret for a token and store only the token.</p>
+</div>
+<div class="field-row">
+${k({view:e,field:"client_id",type:"text",label:"Client ID",placeholder:"Enter the client ID",value:e.clientId})}
+${k({view:e,field:"client_secret",type:"password",label:"Client secret",placeholder:"Enter the client secret"})}
+</div>`}function k({view:e,field:t,type:n,label:o,placeholder:s,hint:a,value:u,isRequired:i}){const c=M(t,e.index),l=e.error!==void 0&&e.error.field===t,d=`${c}-hint`,m=[a?d:"",l?g:""].filter(Boolean).join(" "),p=[`type="${n}"`,`id="${c}"`,`name="${c}"`,`placeholder="${r(s)}"`,'autocomplete="off"','autocapitalize="off"','spellcheck="false"',u?`value="${r(u)}"`:"",m?`aria-describedby="${m}"`:"",l?'aria-invalid="true"':"",i?"required":"",e.autofocusField===t?"autofocus":""].filter(Boolean);return`<div class="field">
+<label for="${c}">${r(o)}</label>
+<input ${p.join(" ")}>
+${a?`<p class="muted small" id="${d}">${a}</p>`:""}
+</div>`}function K(e){if(!e||e.length===0)return"";const t=e.slice(0,S).map(s=>`<li>${h(s)}</li>`).join(""),n=e.length-S,o=n>0?`<li class="muted">and ${n} more</li>`:"";return`<details class="operations"><summary>Which operations use it</summary><ul>${t}${o}</ul></details>`}function W({name:e,subject:t,expiresAt:n},o){const s=`${v.shield}What happens to your credentials`,a=`<ol class="steps">
+<li>Sent straight to ${r(o)}, never through your AI client</li>
+<li>Stored encrypted and never shown again</li>
+<li>Added only to calls to ${r(e)} from the AI client that asked for this link</li>
+<li>You can delete them anytime</li>
+</ol>`;return`<aside class="panel" aria-labelledby="panel-title">
+<div class="panel-steps"><h2 id="panel-title">${s}</h2>${a}</div>
+<details class="panel-steps-toggle"><summary><h2>${s}</h2></summary>${a}</details>
+<div class="link-facts">
+<p>Link requested at ${b(n-_)} UTC</p>
+<span class="pill">Open until ${b(n)} UTC</span>
+<p>This link works one time.</p>
+<p>Kept for ${V(I(t))} after you save them.</p>
+<p>To delete them, ask your AI client for a new link.</p>
+</div>
+</aside>`}function H(e,t,n,o){const s=n.filter(i=>i.isStored).map(i=>`<form id="remove-${i.index}" method="post" action="${e}">${y(t,$.remove)}<input type="hidden" name="scheme" value="${i.index}"></form>`),a=o?`<form id="remove-all" method="post" action="${e}">${y(t,$.removeAll)}</form>`:"",u=`<form id="decline" method="post" action="${e}">${y(t,$.decline)}</form>`;return[...s,a,u].join(`
+`)}function y(e,t){return`<input type="hidden" name="token" value="${r(e)}"><input type="hidden" name="action" value="${t}">`}function E(e){return e.kind==="apiKey"?`Sent to the API as the ${h(e.header)} header.`:e.kind==="cookie"?`Sent to the API as the ${h(e.name)} cookie.`:`Sent to the API as the ${h("Authorization")} header.`}function q(e){if(e.kind==="cookie")return`Paste only the value. We send it as ${h(`${e.name}=<value>`)}.`;if(e.kind==="raw")return`Paste the full header value, for example ${h("Bearer <token>")}.`}function b(e){return new Date(e).toISOString().slice(11,16)}function V(e){const t=e/86400;return Number.isInteger(t)&&t>1?`${t} days`:`${Math.round(e/3600)} hours`}function Y(e){return e.charAt(0).toUpperCase()+e.slice(1)}export{te as formPage};

package/dist/server/plugins/mcp/handlers/credentials-page/layout.d.ts

@@ -0,0 +1,17 @@
+import type { ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { PageColorScheme, PageContent, PageSite } from './types.js';
+export declare function escapeHtml(value: string): string;
+/** The API name, plus the scheme when the link names one scheme of a multi-scheme API. */
+export declare function targetTitle({ name, schemeLabel, schemes }: ElicitationTarget): string;
+export declare function code(value: string): string;
+export declare function htmlDocument({ title, body }: PageContent, colorScheme: PageColorScheme | undefined): string;
+export declare function siteHeader({ name, logo, host, colorScheme }: PageSite): string;
+export declare const ICONS: {
+    readonly shield: '<svg width="20" height="20" viewBox="0 0 20 20" fill="none" aria-hidden="true"><path d="M10 2.5 3.75 4.8v4.7c0 3.9 2.6 6.9 6.25 8 3.65-1.1 6.25-4.1 6.25-8V4.8L10 2.5Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="m7.3 10 1.9 1.9 3.6-3.8" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+    readonly alert: '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><circle cx="8" cy="8" r="6.25" stroke="currentColor" stroke-width="1.5"/><path d="m3.8 12.2 8.4-8.4" stroke="currentColor" stroke-width="1.5"/></svg>';
+    readonly warning: '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M8 2.2 1.9 13h12.2L8 2.2Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="M8 6.5v3" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><circle cx="8" cy="11.3" r=".8" fill="currentColor"/></svg>';
+    readonly check: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m4.5 9.2 3 3 6-6.4" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+    readonly cross: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m5.5 5.5 7 7m0-7-7 7" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"/></svg>';
+    readonly clock: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><circle cx="9" cy="9" r="5.75" stroke="currentColor" stroke-width="1.6"/><path d="M9 6v3.2l2 1.3" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+};
+//# sourceMappingURL=layout.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/layout.js

@@ -0,0 +1,11 @@
+import{pageStyles as l}from"./styles.js";function o(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}function a({name:e,schemeLabel:r,schemes:t}){return t&&t.length>1?e:r?`${e} (${r})`:e}function h(e){return`<code>${o(e)}</code>`}function u({title:e,body:r},t){return`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${o(e)}</title>
+<style>${l(t)}</style>
+</head>
+<body>${r}</body>
+</html>`}function k({name:e,logo:r,host:t,colorScheme:i}){const n=r?d(r,e??t,i):`<span class="site-name">${o(e??t)}</span>`,s=r||e?`<span class="site-host">${o(t)}</span>`:"";return`<header class="site">${n}${s}</header>`}function d(e,r,t){const i=n=>`<img class="site-logo" src="${o(n)}" alt="${o(r)}">`;return!e.dark||t==="light"?i(e.light):t==="dark"?i(e.dark):`<picture><source srcset="${o(e.dark)}" media="(prefers-color-scheme: dark)">${i(e.light)}</picture>`}const p={shield:'<svg width="20" height="20" viewBox="0 0 20 20" fill="none" aria-hidden="true"><path d="M10 2.5 3.75 4.8v4.7c0 3.9 2.6 6.9 6.25 8 3.65-1.1 6.25-4.1 6.25-8V4.8L10 2.5Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="m7.3 10 1.9 1.9 3.6-3.8" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>',alert:'<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><circle cx="8" cy="8" r="6.25" stroke="currentColor" stroke-width="1.5"/><path d="m3.8 12.2 8.4-8.4" stroke="currentColor" stroke-width="1.5"/></svg>',warning:'<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M8 2.2 1.9 13h12.2L8 2.2Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="M8 6.5v3" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><circle cx="8" cy="11.3" r=".8" fill="currentColor"/></svg>',check:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m4.5 9.2 3 3 6-6.4" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg>',cross:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m5.5 5.5 7 7m0-7-7 7" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"/></svg>',clock:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><circle cx="9" cy="9" r="5.75" stroke="currentColor" stroke-width="1.6"/><path d="M9 6v3.2l2 1.3" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>'};export{p as ICONS,h as code,o as escapeHtml,u as htmlDocument,k as siteHeader,a as targetTitle};

package/dist/server/plugins/mcp/handlers/credentials-page/outcome-pages.d.ts

@@ -0,0 +1,10 @@
+import type { ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { CredentialsOutcome, PageContent } from './types.js';
+type Tone = 'success' | 'danger' | 'neutral' | 'warning';
+export declare function outcomePage(target: ElicitationTarget, { action, schemes, stored }: CredentialsOutcome): PageContent;
+export declare function declinedPage(): PageContent;
+export declare function expiredPage(): PageContent;
+/** A centered status card; `lines` are trusted HTML. */
+export declare function statusPage(tone: Tone, title: string, lines: readonly string[]): PageContent;
+export {};
+//# sourceMappingURL=outcome-pages.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/outcome-pages.js

@@ -0,0 +1,11 @@
+import{ELICITATION_TTL_MINUTES as p}from"../../gateway-mcp/secret-store.js";import{credentialSchemesOf as $}from"./form-contract.js";import{ICONS as a,code as f,escapeHtml as r,targetTitle as k}from"./layout.js";const v={success:a.check,danger:a.cross,neutral:a.cross,warning:a.clock};function y(n,{action:e,schemes:o,stored:t}){const s=e==="saved",i=$(n).length>1,c=r(n.name),d=t.filter(m=>!o.includes(m)),g=i?`We ${e} ${u(o)} for ${c}.`:`We ${e} your credentials for ${r(k(n))}.`,h=t.length===0?`Calls to ${c} now go without credentials.`:d.length>0?`${s?"Also stored":"Still stored"}: ${u(d)}.`:"";return l(s?"success":"danger",s?"Credentials saved":"Credentials removed",[g,h,s?"Go back to your AI client and tell it that you saved them.":""])}function S(){return l("neutral","Link declined",["We saved nothing, and this link no longer works.","If you did not ask for this link, tell your AI client to stop."])}function A(){return l("warning","This link no longer works",[`The link is not valid, was already used, or is older than ${p} minutes.`,"Ask your AI client for a new link."])}function l(n,e,o){const t=o.filter(Boolean).map(i=>`<p>${i}</p>`).join(`
+`),s=n==="warning"?"":'<p class="muted small">You can close this tab.</p>';return{title:e,body:`<div class="page narrow">
+<main class="card outcome">
+<span class="status-icon ${n}">${v[n]}</span>
+<h1>${r(e)}</h1>
+<div class="message">
+${t}
+${s}
+</div>
+</main>
+</div>`}}function u(n){const e=n.map(f);return e.length>1?`${e.slice(0,-1).join(", ")} and ${e.at(-1)}`:e.join("")}export{S as declinedPage,A as expiredPage,y as outcomePage,l as statusPage};

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.d.ts

@@ -0,0 +1,10 @@
+import type { RedoclyConfig } from '@redocly/config';
+import type { GlobalData } from '../../../../../types/index.js';
+import type { SiteBranding } from './types.js';
+/** `logo` is the resolved theme logo from global data, whose paths point at served assets. */
+export declare function resolveSiteBranding({ seo, logo, colorMode, }: {
+    seo?: RedoclyConfig['seo'];
+    logo?: GlobalData['logo'];
+    colorMode?: RedoclyConfig['colorMode'];
+}): SiteBranding;
+//# sourceMappingURL=site-branding.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.js

@@ -0,0 +1 @@
+import{parseSrcSet as h}from"../../../../utils/attribute-parser.js";function o({seo:t,logo:e,colorMode:d}){const n=t?.title||t?.projectTitle||e?.altText||void 0,i=e?.srcSet?h(e.srcSet):new Map,r=s(i.get("light")??e?.image),a=s(i.get("dark")),c=f(d);return{...n?{name:n}:{},...r?{logo:{light:r,...a?{dark:a}:{}}}:{},...c?{colorScheme:c}:{}}}function f(t){if(t?.hide)return"light";if(t?.ignoreDetection)return t.modes?.[0]==="dark"?"dark":"light"}function s(t){return t?.startsWith("/")&&!t.startsWith("//")?t:void 0}export{o as resolveSiteBranding};

package/dist/server/plugins/mcp/handlers/credentials-page/styles.d.ts

@@ -0,0 +1,4 @@
+import type { PageColorScheme } from './types.js';
+/** The page CSS. Without a fixed color scheme, the page follows the system setting. */
+export declare function pageStyles(colorScheme: PageColorScheme | undefined): string;
+//# sourceMappingURL=styles.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/styles.js

@@ -0,0 +1,186 @@
+const e=`
+--font-family-base:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif;
+--page-bg:#f7f7f9;
+--page-dot:#e3e4ea;
+--bg-color:#ffffff;
+--border-color-primary:#dcdde5;
+--panel-bg:#f3f3f6;
+--layer-color:#fbfbfc;
+--input-border-color:#dcdde5;
+--border-color-secondary:#ededf2;
+--stored-bg:#ededf2;
+--text-color-primary:#1a1c21;
+--text-color-secondary:#3b3c45;
+--text-color-description:#555761;
+--placeholder:#9b9ca8;
+--input-bg-color:#ffffff;
+--primary-bg:#1a1c21;
+--primary-hover:#3b3c45;
+--primary-text:#ffffff;
+--focus:#4561db;
+--code-bg:#ededf2;
+--code-text:#2a2b33;
+--tag-bg:#ededf2;
+--tag-text:#3b3c45;
+--tag-stored-bg:#f0f4ff;
+--tag-stored-text:#4561db;
+--danger:#c8174f;
+--danger-bg:#fff1f5;
+--danger-border:#f7a8c0;
+--success:#1f9d55;
+--success-glow:rgba(31,157,85,.18);
+--warning:#e08a00;
+--warning-glow:rgba(224,138,0,.18);
+--warning-bg:#fff8eb;
+--warning-border:#f5c97a;
+--danger-icon:#f9316d;
+--danger-glow:rgba(249,49,109,.18);
+--neutral-glow:rgba(85,87,97,.14);
+`,o=`
+--page-bg:#1a1b20;
+--page-dot:#2c2e36;
+--bg-color:#22242b;
+--border-color-primary:#555761;
+--panel-bg:#2a2b33;
+--layer-color:#2a2b33;
+--input-border-color:#3b3c45;
+--border-color-secondary:#3b3c45;
+--stored-bg:#32343e;
+--text-color-primary:#fbfbfc;
+--text-color-secondary:#c4c6d1;
+--text-color-description:#9b9ca8;
+--placeholder:#6e6f7a;
+--input-bg-color:#22242b;
+--primary-bg:#fbfbfc;
+--primary-hover:#dcdde5;
+--primary-text:#1a1c21;
+--focus:#8fa6ff;
+--code-bg:#3b3c45;
+--code-text:#c4c6d1;
+--tag-bg:#3b3c45;
+--tag-text:#c4c6d1;
+--tag-stored-bg:#1f2a4d;
+--tag-stored-text:#8fa6ff;
+--danger:#ff6b95;
+--danger-bg:#3a1822;
+--danger-border:#7a2b44;
+--success:#3ccf74;
+--success-glow:rgba(60,207,116,.2);
+--warning:#f5a524;
+--warning-glow:rgba(245,165,36,.2);
+--warning-bg:#33260f;
+--warning-border:#7a5a1e;
+--danger-icon:#ff6b95;
+--danger-glow:rgba(255,107,149,.2);
+--neutral-glow:rgba(155,156,168,.16);
+`,r=`
+*{box-sizing:border-box}
+body{margin:0;min-height:100vh;padding:48px 24px;font-family:var(--font-family-base);font-size:14px;line-height:22px;color:var(--text-color-primary);background-color:var(--page-bg);background-image:radial-gradient(var(--page-dot) 1px,transparent 1px);background-size:16px 16px}
+.page{display:grid;grid-template-columns:minmax(0,692px) minmax(0,348px);gap:16px;justify-content:center;min-height:calc(100vh - 96px);margin:0 auto}
+.page.narrow{grid-template-columns:minmax(0,864px)}
+.card{display:flex;flex-direction:column;background:var(--bg-color);border:1px solid var(--border-color-primary);border-radius:24px;padding:40px 48px 24px}
+.panel{display:flex;flex-direction:column;gap:16px;background:var(--panel-bg);border:1px solid var(--border-color-primary);border-radius:24px;padding:32px 24px 24px}
+.site{display:flex;align-items:center;justify-content:space-between;gap:16px;padding-bottom:24px;margin-bottom:24px;border-bottom:1px solid var(--border-color-secondary)}
+.site-name{font-size:18px;line-height:24px;font-weight:600;overflow-wrap:anywhere}
+.site-host{font-size:16px;line-height:24px;color:var(--text-color-secondary);overflow-wrap:anywhere;text-align:right}
+.site-logo{display:block;max-height:32px;max-width:200px;width:auto}
+h1{margin:0;font-size:20px;line-height:28px;font-weight:600}
+h2{margin:0;font-size:16px;line-height:24px;font-weight:600}
+p{margin:0}
+.lede{margin-top:12px}
+.muted{color:var(--text-color-description)}
+.small{font-size:12px;line-height:20px}
+.strong{font-weight:600}
+code{font:inherit;background:var(--code-bg);color:var(--code-text);padding:1px 8px;border-radius:6px;overflow-wrap:anywhere}
+.banner{display:flex;gap:8px;align-items:flex-start;margin-top:24px;padding:12px 16px;border:1px solid var(--danger-border);border-radius:8px;background:var(--danger-bg);color:var(--text-color-primary)}
+.banner svg{flex:none;margin-top:3px;color:var(--danger)}
+.banner.warning{border-color:var(--warning-border);background:var(--warning-bg)}
+.banner.warning svg{color:var(--warning)}
+form.credentials{display:flex;flex-direction:column;flex:1}
+.schemes{display:flex;flex-direction:column;gap:12px;margin-top:24px}
+.scheme{background:var(--layer-color);border:1px solid var(--border-color-secondary);border-radius:16px;padding:24px 32px 24px 24px}
+.info-card{margin-top:24px;padding:8px 24px;background:var(--layer-color);border:1px solid var(--border-color-secondary);border-radius:16px}
+.info-card section{display:flex;flex-direction:column;gap:2px;padding:16px 0}
+.info-card section+section{border-top:1px solid var(--border-color-secondary)}
+.info-card h2{font-size:14px;line-height:22px;font-weight:500;color:var(--text-color-secondary)}
+.scheme-body{display:flex;flex-direction:column;gap:16px}
+details.scheme>.scheme-body{margin-top:16px;padding-left:24px}
+details.scheme>summary{display:grid;grid-template-columns:16px minmax(0,1fr) auto;column-gap:8px;row-gap:4px;cursor:pointer;list-style:none}
+details.scheme>summary::-webkit-details-marker{display:none}
+details.scheme>summary::before,details.operations>summary::before{content:"";flex:none;width:6px;height:6px;margin:8px 0 0 4px;border-right:1.5px solid var(--text-color-secondary);border-bottom:1.5px solid var(--text-color-secondary);transform:rotate(-45deg);transition:transform .15s}
+details[open]>summary::before{transform:rotate(45deg);margin-top:6px}
+details.scheme>summary:focus-visible{outline:2px solid var(--focus);outline-offset:4px;border-radius:4px}
+.summary-title{grid-column:2;font-size:16px;line-height:24px;font-weight:600;overflow-wrap:anywhere}
+.summary-tag{grid-column:3;grid-row:1}
+.summary-line{grid-column:2/4}
+.scheme-head{display:flex;flex-direction:column;gap:4px}
+.tag{display:inline-block;padding:1px 8px;border-radius:4px;font-size:14px;line-height:22px;background:var(--tag-bg);color:var(--tag-text);white-space:nowrap}
+.tag.stored{background:var(--tag-stored-bg);color:var(--tag-stored-text)}
+.tags{display:flex;flex-wrap:wrap;align-items:center;gap:4px 8px}
+.stored-box{display:flex;align-items:center;justify-content:space-between;gap:16px;padding:12px 16px;border-radius:8px;background:var(--stored-bg)}
+.field{display:flex;flex-direction:column;gap:4px;min-width:0}
+.field-row{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));gap:12px}
+label{font-weight:500;color:var(--text-color-secondary)}
+input[type=text],input[type=password]{width:100%;height:34px;padding:0 12px;font-family:var(--font-family-base);font-size:14px;color:var(--text-color-primary);background:var(--input-bg-color);border:1px solid var(--input-border-color);border-radius:8px}
+input::placeholder{color:var(--placeholder)}
+input:focus{outline:2px solid transparent;border-color:var(--focus);box-shadow:0 0 0 1px var(--focus)}
+input[aria-invalid=true]{border-color:var(--danger)}
+input[aria-invalid=true]:focus{box-shadow:0 0 0 3px var(--danger-border)}
+.divider{border:0;border-top:1px solid var(--border-color-secondary);margin:0}
+details.operations>summary{display:flex;gap:8px;cursor:pointer;list-style:none;width:max-content;max-width:100%}
+details.operations>summary::-webkit-details-marker{display:none}
+details.operations>summary:focus-visible{outline:2px solid var(--focus);outline-offset:2px;border-radius:4px}
+details.operations ul{margin:8px 0 0;padding-left:20px;display:flex;flex-direction:column;gap:4px}
+.actions{margin-top:auto;padding-top:40px}
+.actions-row{display:flex;align-items:center;gap:16px;padding-top:24px;border-top:1px solid var(--border-color-secondary)}
+.actions-row .primary{flex:1}
+button{font-family:var(--font-family-base);font-size:16px;line-height:24px;font-weight:400;cursor:pointer;border-radius:12px}
+button:focus-visible{outline:2px solid var(--focus);outline-offset:2px}
+.primary{height:40px;padding:0 20px;border:0;background:var(--primary-bg);color:var(--primary-text)}
+.primary:hover{background:var(--primary-hover)}
+.secondary{height:40px;padding:0 20px;border:0;box-shadow:inset 0 0 0 1px var(--border-color-primary);background:var(--bg-color);color:var(--text-color-primary)}
+.actions-row .secondary{flex:1}
+.secondary:hover{background:var(--panel-bg)}
+.text-danger{padding:0 20px;height:40px;border:0;background:none;color:var(--danger)}
+.text-danger.small{height:auto;padding:0 8px;font-size:14px;line-height:22px}
+.text-danger:hover{text-decoration:underline}
+.link-button{padding:0;border:0;background:none;color:var(--text-color-secondary);font-size:12px;line-height:20px;text-decoration:underline;text-underline-offset:2px}
+.decline{margin-top:12px;text-align:center;color:var(--text-color-secondary)}
+.panel h2{display:flex;align-items:center;gap:12px;font-weight:500}
+.panel-steps{display:flex;flex-direction:column;gap:16px}
+.panel-steps-toggle{display:none}
+.panel-steps-toggle>summary{display:flex;align-items:center;justify-content:space-between;gap:12px;cursor:pointer;list-style:none}
+.panel-steps-toggle>summary::-webkit-details-marker{display:none}
+.panel-steps-toggle>summary::after{content:"";flex:none;width:7px;height:7px;margin:0 4px 4px 0;border-right:1.5px solid var(--text-color-secondary);border-bottom:1.5px solid var(--text-color-secondary);transform:rotate(45deg);transition:transform .15s}
+.panel-steps-toggle[open]>summary::after{transform:rotate(-135deg);margin:4px 4px 0 0}
+.panel-steps-toggle>summary:focus-visible{outline:2px solid var(--focus);outline-offset:4px;border-radius:4px}
+.panel-steps-toggle>.steps{margin-top:16px}
+.steps{margin:0;padding:0;list-style:none;display:flex;flex-direction:column;gap:16px;counter-reset:step}
+.steps li{display:grid;grid-template-columns:20px minmax(0,1fr);gap:12px;counter-increment:step;font-size:16px;line-height:24px}
+.steps li::before{content:counter(step);display:flex;align-items:center;justify-content:center;height:20px;margin-top:2px;border-radius:5px;background:var(--bg-color);font-size:14px;line-height:16px}
+.link-facts{display:flex;flex-direction:column;gap:8px;margin-top:auto;padding-top:32px;border-top:1px solid var(--border-color-primary);color:var(--text-color-secondary)}
+.pill{display:inline-flex;align-items:center;gap:8px;width:max-content;max-width:100%;padding:1px 8px;border-radius:999px;background:var(--bg-color);font-size:12px;line-height:20px}
+.pill::before{content:"";flex:none;width:6px;height:6px;border-radius:50%;background:var(--success)}
+.outcome{display:flex;flex-direction:column;align-items:center;text-align:center;gap:24px;padding:56px 0}
+.status-icon{display:flex;align-items:center;justify-content:center;width:40px;height:40px;border-radius:50%;color:#ffffff}
+.status-icon.success{background:var(--success);box-shadow:0 0 16px 10px var(--success-glow)}
+.status-icon.warning{background:var(--warning);box-shadow:0 0 16px 10px var(--warning-glow)}
+.status-icon.danger{background:var(--danger-icon);box-shadow:0 0 16px 10px var(--danger-glow)}
+.status-icon.neutral{background:var(--text-color-description);box-shadow:0 0 16px 10px var(--neutral-glow)}
+.message{display:flex;flex-direction:column;gap:8px;width:100%;max-width:640px;padding:24px 32px;border:1px solid var(--border-color-secondary);border-radius:12px;background:var(--layer-color)}
+@media (max-width:960px){
+body{padding:16px}
+.page{grid-template-columns:minmax(0,1fr);min-height:0}
+.card{padding:24px}
+.site{flex-direction:column;align-items:flex-start;gap:0}
+.site-host{text-align:left}
+.panel-steps{display:none}
+.panel-steps-toggle{display:block}
+.link-facts{padding-top:16px}
+.scheme{padding:16px}
+.info-card{padding:4px 16px}
+.field-row{grid-template-columns:minmax(0,1fr)}
+.outcome{padding:32px 0}
+.message{padding:16px}
+}
+`;function t(a){switch(a){case"light":return`:root{color-scheme:light;${e}}${r}`;case"dark":return`:root{color-scheme:dark;${e}${o}}${r}`;default:return`:root{color-scheme:light dark;${e}}@media (prefers-color-scheme:dark){:root{${o}}}${r}`}}export{t as pageStyles};

package/dist/server/plugins/mcp/handlers/credentials-page/types.d.ts

@@ -0,0 +1,32 @@
+export type SiteBranding = {
+    name?: string;
+    logo?: {
+        light: string;
+        dark?: string;
+    };
+    /** Set when the portal always shows one color mode. */
+    colorScheme?: PageColorScheme;
+};
+export type PageColorScheme = 'light' | 'dark';
+export type PageSite = SiteBranding & {
+    host: string;
+};
+/** One page, before the shared document shell wraps it. */
+export type PageContent = {
+    title: string;
+    body: string;
+};
+export type SchemeField = 'secret' | 'client_id' | 'client_secret';
+/** A rejected submission. `schemeIndex` and `field` name the input to mark, when there is one. */
+export type FormError = {
+    message: string;
+    schemeIndex?: number;
+    field?: SchemeField;
+};
+/** What one submission changed, and the schemes that hold a credential after it. */
+export type CredentialsOutcome = {
+    action: 'saved' | 'removed';
+    schemes: readonly string[];
+    stored: readonly string[];
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.d.ts

@@ -0,0 +1,4 @@
+import type { ApiRoutesHandler } from '@redocly/config';
+declare const docsMcpHandler: ApiRoutesHandler;
+export default docsMcpHandler;
+//# sourceMappingURL=docs-mcp-handler.d.ts.map

package/dist/server/plugins/mcp/handlers/docs-mcp-handler.js

@@ -0,0 +1 @@
+import{logger as h}from"../../../tools/notifiers/logger.js";import{getFeedbackClientIp as F}from"../../../web-server/utils/feedback-ip.js";import{getForwardedOrigin as A,getInternalOrigin as N}from"../../../web-server/utils/get-request-origin.js";import{GATEWAY_FETCH_LIMIT_DEFAULTS as v,DEFAULT_ANONYMOUS_VISITOR_TEAM as B,RbacFeatures as L}from"../../../../constants/common.js";import{isObject as H}from"../../../../utils/guards/is-object.js";import{getAccessibleSkills as V}from"../../../utils/skills/get-accessible-skills.js";import{getSkillUrl as $}from"../../../utils/skills/get-skill-url.js";import{createMcpHandler as j}from"@modelcontextprotocol/server";import{createDocsMcpServer as G}from"../servers/docs-server.js";import{filterApiDescriptionsByRbac as J,filterGraphqlDescriptionsByRbac as K}from"../utils.js";import{McpClientInputError as Y,createMethodNotAllowedError as z,withErrorHandling as W}from"./errors.js";import{constructForbiddenResponse as X,constructInvalidTokenResponse as Q,constructUnauthorizedResponse as Z,handleMcpAuth as q}from"../auth/auth-handlers.js";import{isAssistantAnonymousToken as x}from"../auth/assistant-anonymous-token.js";import{shouldHandleMcpAuth as ee}from"../../../utils/rbac/should-handle-mcp-auth.js";import{extractTokenFromAuthHeader as re}from"../utils/jwt.js";import{resolveMcpClient as oe}from"../utils/mcp-client.js";import{randomUUID as se}from"../../../utils/crypto/random-uuid.js";import{getPublicMcpEndpointStatus as ne}from"../utils/public-endpoint.js";import{narrowMcpConfigForCaller as ie}from"../gateway-mcp/caller-api-calls.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as te,SSE_KEEPALIVE_INTERVAL_MS as ce}from"../constants.js";import{withPathPrefix as ae}from"@redocly/theme/core/utils";import{PUBLIC_MCP_ROUTE as pe}from"@redocly/theme/core/constants/mcp";import{canAccessFeature as de}from"../../../utils/rbac.js";import{ANONYMOUS_AUTH_DETAILS as le}from"../../../constants/rbac.js";const M="X-Redocly-AI-Metadata";function me(r){if(r)try{const e=JSON.parse(r);if(H(e))return e;h.warn(`Ignoring ${M} header: not a JSON object.`)}catch{h.warn(`Ignoring ${M} header: invalid JSON.`)}}function b(){return{...le,email:"",idpAccessToken:void 0,idpId:void 0}}const fe=async(r,e,i)=>{const t=!!e?.config?.access?.requiresLogin,c=e?.config?.access?.rbac||{},E=i?.props?.config?.mcpMode??"tools",y=i?.props?.config?.gatewayFetchBudgetPerExec??v.budgetPerExec,S=i?.props?.config?.searchIgnoredRoutes??[],s=i,U=!!s?.props?.config?.isPublicEndpoint;let f;const T=r.headers.get("Authorization");if(U)e.user=b();else if(ee(t,c)){const{isAuthenticated:n,isTokenValid:p,isFirstPartyAnonymous:u,currentUser:d,accessToken:g}=await q(r,e);if(u)e.user=b();else if(n)d&&(e.user=d),f=g;else{const a=A(r),l=ne(e.config)==="served"?`${a}${ae(pe)}`:void 0;return p===!1?Q(a,l):Z(a,l)}}else if(T){const n=re(T)??void 0;f=(n?await x(n):!1)?void 0:n}const w={isAuthenticated:!!e.user?.isAuthenticated,teams:e.user?.teams||[B],claims:e.user?.claims??{}};return de(L.MCP,w,c,t)?await W(async()=>{const n=i?.props?.config?.elicitationEnabled??!1;if(r.method==="GET")return new Response(JSON.stringify({error:"Method Not Allowed",message:`In order to use this MCP server, you need to register it in your MCP client (VS Code, Cursor, Claude Code, etc.) using this URL: ${r.url}`}),{status:405,headers:{"Content-Type":"application/json"}});if(r.method!=="POST")return z();const p=s?.props?.config?.apiDescriptionsMap||{},u=s?.props?.config?.graphqlDescriptions||[],d=s?.props?.config?.mcpDocsServerName||te,{config:{mcp:g={}}}=e,a=J(p,e.user,c,t),l=K(u,e.user,c,t),C=e.config.products?Object.values(e.config.products).map(o=>o?.name):[],D=g.docs?.name||d,m=me(r.headers.get(M)),P=s?.props?.tools||[],R=s?.props?.skillsBaseUrl||A(r),_=V(s?.props?.skills||[],e.user,c,t).map(o=>({slug:o.slug,name:o.name,description:o.description,content:o.content,uri:$(R,o.slug)})),I=await ue(r),O={name:D,tools:P,skills:_,context:{...e,config:{...e.config,mcp:ie(e.config.mcp,m)},accessToken:f,outdir:e.outdir||"",baseUrl:e.baseUrl||A(r),internalBaseUrl:N(r),apiDescriptionsMap:a,graphqlDescriptions:l,products:C,metadata:m,mcpMode:E,elicitationEnabled:n,gatewayFetchBudgetPerExec:y,searchIgnoredRoutes:S,clientIp:F(r),...oe(r),requestId:se(),messageId:typeof m?.messageId=="string"?m.messageId:void 0}},k=await G({...O,getKv:e.getKv});return await j(async()=>k,{keepAliveMs:ce,onerror:o=>h.warn(`MCP handler: ${o.message}`)}).fetch(r,I!==void 0?{parsedBody:I}:void 0)},E):X()};async function ue(r){try{return await r.json()}catch(e){throw new Y(e instanceof Error?e.message:String(e),{cause:e})}}var Ve=fe;export{Ve as default};

package/dist/server/plugins/mcp/handlers/errors.d.ts

@@ -0,0 +1,25 @@
+import type { McpErrorCodeTypes, McpMode } from '../types.js';
+export type McpErrorData = {
+    readonly code: McpErrorCodeTypes;
+    readonly message: string;
+    readonly data?: unknown;
+    readonly requestId?: string | number | null;
+};
+export declare class McpError extends Error {
+    readonly code: McpErrorCodeTypes;
+    readonly data?: unknown;
+    readonly requestId?: string | number | null;
+    constructor(code: McpErrorCodeTypes, message: string, data?: unknown, requestId?: string | number | null);
+    createErrorResponse(): Response;
+}
+export declare class McpClientInputError extends Error {
+    constructor(message: string, options?: {
+        cause?: unknown;
+    });
+}
+export declare function createMethodNotAllowedError(requestId?: string | number | null): Response;
+export declare function createInternalServerError(error: Error | string, requestId?: string | number | null): Response;
+export declare function createInvalidRequestError(message?: string, requestId?: string | number | null): Response;
+export declare function createInvalidParamsError(message?: string, requestId?: string | number | null): Response;
+export declare function withErrorHandling<T>(operation: () => Promise<T>, mode?: McpMode): Promise<T | Response>;
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/plugins/mcp/handlers/errors.js

@@ -0,0 +1 @@
+import{telemetry as c}from"../../../telemetry/index.js";import{McpErrorCodes as o,McpServerType as i}from"../constants.js";import{serverAttributes as d}from"../utils/telemetry-attributes.js";class s extends Error{code;data;requestId;constructor(e,t,n,a){super(t),this.name="McpError",this.code=e,this.data=n,this.requestId=a}createErrorResponse(){const e={jsonrpc:"2.0",error:{code:this.code,message:this.message,...this.data?{data:this.data}:{}},id:this.requestId??null},t=p(this.code);return new Response(JSON.stringify(e),{status:t,headers:{"Content-Type":"application/json"}})}}class u extends Error{constructor(e,t){super(e,t),this.name="McpClientInputError"}}function p(r){switch(r){case o.InvalidRequest:case o.InvalidParams:return 400;case o.MethodNotFound:return 404;case o.ServerError:return 405;case o.InternalError:default:return 500}}function I(r){return new s(o.ServerError,"Method not allowed",void 0,r).createErrorResponse()}function l(r,e){const t=r instanceof Error?r.message:String(r);return new s(o.InternalError,"Internal server error mcp",t,e).createErrorResponse()}function f(r="Invalid request",e){return new s(o.InvalidRequest,r,void 0,e).createErrorResponse()}function v(r="Invalid parameters",e){return new s(o.InvalidParams,r,void 0,e).createErrorResponse()}async function M(r,e="tools"){try{return await r()}catch(t){return c.sendMcpErrorMessage([{...d(i.Docs),message:t?.message||"",stack:t?.stack||"",error_class:t instanceof u?"client_error":"server_error",mode:e}]),l(t)}}export{u as McpClientInputError,s as McpError,l as createInternalServerError,v as createInvalidParamsError,f as createInvalidRequestError,I as createMethodNotAllowedError,M as withErrorHandling};

package/dist/server/plugins/mcp/handlers/handle-mcp-request.d.ts

@@ -0,0 +1,5 @@
+import type { Context } from 'hono';
+import type { ApiRoute } from '../../../types';
+import type { Store } from '../../../store.js';
+export declare function handleMcpRequest(route: ApiRoute, ctx: Context, store: Store): Promise<Response>;
+//# sourceMappingURL=handle-mcp-request.d.ts.map

package/dist/server/plugins/mcp/handlers/handle-mcp-request.js

@@ -0,0 +1 @@
+import{withPathPrefix as g}from"@redocly/theme/core/utils";import{importApiRoutesHandler as D}from"../../../api-routes/import-api-routes-handlers.js";import{enhanceContext as h}from"../../../api-routes/helpers/enhance-context.js";import{telemetry as A}from"../../../telemetry/index.js";import{KvService as E}from"../../../persistence/kv/services/kv-service.js";import{envConfig as l}from"../../../config/env-config.js";import{acceptsHtml as R}from"../../../utils/ai-agent-detection.js";import{handleErrorPageRender as T}from"../../../web-server/utils.js";import{MCP_DOCS_SERVER_HANDLER_ID as _,MCP_NOT_ALLOWED_TEMPLATE_ID as w}from"../../../constants/mcp.js";import{resolvePublicBaseUrl as S}from"../../../web-server/utils/resolve-public-base-url.js";import{getForwardedOrigin as q}from"../../../web-server/utils/get-request-origin.js";import{applyEdgeRateLimit as O}from"../gateway-mcp/rate-limit/apply-edge-rate-limit.js";async function N(a,t,e){const n=t.req.raw;if(a.requestHandlerId===_&&n.method==="GET"&&R(n.headers.get("accept"))&&e.globalData.mcpData?.docs?.enabled)return T(t,e,{slug:a.slug},405,w);const r=t.get("auth"),s=await O(n,e);if(s)return s;const o=await e.resolveRouteStaticData(a)||{},m=g(a.slug),{requestHandlers:c}=await D(e.serverOutDir),p=c[a.requestHandlerId],d=(await p()).default,u=async()=>await E.getInstance({baseDbDir:e.serverOutDir,sqldRemoteDatabaseUrl:l.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:l.SQLD_REMOTE_DATABASE_AUTH_TOKEN}),f=h({honoCtx:t,ctx:{user:{teams:r.teams,email:r.claims.email,claims:r.claims,idpAccessToken:r.idpAccessToken,idpId:r.claims.idpId,isAuthenticated:r.isAuthenticated},config:e.config,outdir:e.outdir,baseUrl:q(t.req.raw)},telemetry:A,getKv:u}),i=await d(t.req.raw,f,{...o,props:{...o.props,routeSlug:m,outdir:e.outdir,skills:e.config.skills?.hide===!0?[]:e.getSkills(),skillsBaseUrl:S(e,t)}});return i instanceof Response?i:typeof i=="string"?new Response(i,{headers:{"Content-Type":"text/plain"}}):new Response(JSON.stringify(i),{headers:{"Content-Type":"application/json"}})}export{N as handleMcpRequest};

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.d.ts

@@ -0,0 +1,4 @@
+import type { ApiRoutesHandler } from '@redocly/config';
+declare const mcpCredentialsHandler: ApiRoutesHandler;
+export default mcpCredentialsHandler;
+//# sourceMappingURL=mcp-credentials-handler.d.ts.map

package/dist/server/plugins/mcp/handlers/mcp-credentials-handler.js

@@ -0,0 +1 @@
+import{secretStore as d}from"../gateway-mcp/secret-store.js";import{rejectCredential as _}from"../gateway-mcp/credential-validation.js";import{buildAllowedHostMatchers as C}from"../gateway-mcp/fetch/allowed-hosts.js";import{assertUrlAllowed as A}from"../gateway-mcp/fetch/ssrf-guard.js";import{readCappedBody as T,getDefaultAgent as P}from"../gateway-mcp/fetch/fetch-bridge.js";import{logger as x}from"../../../tools/notifiers/logger.js";import{FORM_ACTIONS as k}from"./credentials-page/constants.js";import{credentialSchemesOf as w,schemeFieldName as f}from"./credentials-page/form-contract.js";import{formPage as N}from"./credentials-page/form-page.js";import{htmlDocument as O}from"./credentials-page/layout.js";import{declinedPage as R,expiredPage as I,outcomePage as j}from"./credentials-page/outcome-pages.js";const D={"Content-Type":"text/html; charset=utf-8","Cache-Control":"no-store","X-Frame-Options":"DENY","Referrer-Policy":"no-referrer","Content-Security-Policy":"default-src 'none'; style-src 'unsafe-inline'; img-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"},$=3e4,F=64*1024,M=/^bearer\s+/i,U=/^\d+$/,B=async(e,t,o)=>{const n=await t.getKv(),r=L(e,t.baseUrl,o);if(e.method==="GET"){const i=new URL(e.url).searchParams.get("token")??"",c=await d.peekElicitation(n,i);return c?S({kv:n,site:r,token:i,target:c},{},200):p(r)}if(e.method==="POST"){const i=await e.formData(),c=u(i,"token"),a=await d.peekElicitation(n,c);if(!a)return p(r);const s={kv:n,site:r,token:c,target:a,form:i};switch(u(i,"action")){case k.remove:return b(s,z(a,u(i,"scheme")));case k.removeAll:return b(s,w(a));case k.decline:return K(s);default:return H(s)}}return new Response("Method Not Allowed",{status:405,headers:{Allow:"GET, POST"}})};async function H(e){const{target:t,form:o}=e,n=w(t),r=n.map((s,l)=>u(o,f("client_id",l)).trim()),i=s=>S(e,{error:s,clientIds:r},400),c=X(n,o);if("error"in c)return i(c.error);if(c.writes.length===0)return i(G(n));const a=[];for(const s of c.writes){if(s.kind!=="exchange"){a.push(s);continue}const l=await J(s.auth,s.clientId,s.clientSecret);if(!l.ok)return x.warn(`gateway oauth2 client_credentials exchange failed for ${t.api}: ${l.reason}`),i(E(n,s.schemeIndex,"client_id","We could not exchange those client credentials for a token. Check the client ID and secret, then try again."));a.push({kind:"set",scheme:s.scheme,secret:l.secret})}return v(e,a)}function X(e,t){const o=[];for(const[n,r]of e.entries()){const i=u(t,f("secret",n)).trim();if(i){const s=_(r.auth,i);if(s)return{error:E(e,n,"secret",s)};o.push({kind:"set",scheme:r.name,secret:W(r.auth,i)});continue}if(r.auth.kind!=="oauth2ClientCredentials")continue;const c=u(t,f("client_id",n)).trim(),a=u(t,f("client_secret",n)).trim();if(c&&a)o.push({kind:"exchange",scheme:r.name,schemeIndex:n,auth:r.auth,clientId:c,clientSecret:a});else if(c||a)return{error:E(e,n,c?"client_secret":"client_id","Enter both the client ID and the client secret, or leave both blank.")}}return{writes:o}}function G(e){return e.length>1?{message:"Fill in at least one credential before saving."}:{message:e[0].auth.kind==="oauth2ClientCredentials"?"Enter an access token, or the client ID and the client secret, before saving.":"Enter a value before saving.",schemeIndex:0,field:"secret"}}function E(e,t,o,n){return{message:e.length>1?`${e[t].name}: ${n}`:n,schemeIndex:t,field:o}}async function b(e,t){const{kv:o,target:n}=e,r=await d.getStoredSchemes(o,n.subject,n.api),i=t.filter(c=>r[c.name]).map(c=>({kind:"remove",scheme:c.name}));return i.length===0?S(e,{error:{message:"No credential is stored there, so there is nothing to remove."}},400):v(e,i)}function z(e,t){const o=U.test(t)?w(e)[Number(t)]:void 0;return o?[o]:[]}async function K({kv:e,site:t,token:o}){return await d.consumeElicitation(e,o)?h(t,R(),200):p(t)}async function v({kv:e,site:t,token:o},n){const r=await d.consumeElicitation(e,o);if(!r)return p(t);for(const a of n)a.kind==="remove"?await d.deleteSecret(e,r.subject,r.api,a.scheme):await d.setSecret(e,r.subject,r.api,a.scheme,a.secret);const i=await d.getStoredSchemes(e,r.subject,r.api),c={action:n.some(a=>a.kind==="set")?"saved":"removed",schemes:n.map(a=>a.scheme),stored:Object.keys(i).sort()};return h(t,j(r,c),200)}async function S({kv:e,site:t,token:o,target:n},r,i){const c=await d.getStoredSchemes(e,n.subject,n.api);return h(t,N({site:t,target:n,token:o,stored:c,...r}),i)}function L(e,t,o){const n=o?.props?.branding??{},r=t&&URL.canParse(t)?t:e.url;return{...n,host:new URL(r).host}}async function J(e,t,o){try{const n=C([{url:e.tokenUrl}]),r=A(e.tokenUrl,n),i=new AbortController,c=setTimeout(()=>i.abort(),$);let a;try{a=await fetch(r,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"client_credentials",client_id:t,client_secret:o}),redirect:"manual",signal:i.signal,dispatcher:P()})}finally{clearTimeout(c)}if(!a.ok)return m(`token endpoint returned ${a.status}`);let s;try{s=await T(a,F)}catch{return m("token response exceeded the size cap")}let l;try{l=JSON.parse(s)}catch{return m("token response was not valid JSON")}const y=typeof l=="object"&&l!==null&&"access_token"in l?l.access_token:void 0,g=typeof y=="string"?y.trim():"";return g?_(e,g)?m("token response had an access_token that cannot be sent in a header"):{ok:!0,secret:{header:"Authorization",value:`Bearer ${g}`}}:m("token response had no access_token")}catch(n){return m(n instanceof Error?n.message:String(n))}}function m(e){return{ok:!1,reason:e}}function u(e,t){const o=e.get(t);return typeof o=="string"?o:""}function h(e,t,o){return new Response(O(t,e.colorScheme),{status:o,headers:D})}function p(e){return h(e,I(),404)}function W(e,t){return e.kind==="apiKey"?{header:e.header,value:t}:e.kind==="cookie"?{header:"Cookie",value:`${e.name}=${t}`}:e.kind==="bearer"||e.kind==="oauth2ClientCredentials"?{header:"Authorization",value:Y(t)}:{header:"Authorization",value:t}}function Y(e){return`Bearer ${e.replace(M,"")}`}var ie=B;export{ie as default};

package/dist/server/plugins/mcp/index.d.ts

@@ -0,0 +1,4 @@
+import type { LifecyclePluginInstance } from '../../types';
+export declare function mcpServerPlugin(): Promise<LifecyclePluginInstance>;
+export default mcpServerPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/mcp/index.js

@@ -0,0 +1 @@
+import{fileURLToPath as U}from"node:url";import{dirname as $,join as D}from"node:path";import{MCP_ROUTE as k,PUBLIC_MCP_ROUTE as M}from"@redocly/theme/core/constants/mcp";import{logger as p}from"../../tools/notifiers/logger.js";import{reporter as F}from"../../tools/notifiers/reporter.js";import{isDefined as B}from"../../../utils/guards/is-defined.js";import{MCP_CREDENTIALS_HANDLER_ID as A,MCP_CREDENTIALS_ROUTE as V,MCP_DOCS_SERVER_HANDLER_ID as T,MCP_NOT_ALLOWED_TEMPLATE_ID as x}from"../../constants/mcp.js";import{bundledOpenApiDocumentsToMcpOpenApi as J,bundledGraphqlDocumentsToMcpOpenApi as W,buildGraphqlDescriptions as X,collectIgnoredRoutes as z,filterIgnoredApiDescriptions as P,getCleanedUpApiDescriptions as K,isMcpInRedirects as Q}from"./utils.js";import{getMcpMode as R,isMcpElicitationEnabled as Y,isMcpGatewayEnabled as Z}from"./utils/mode.js";import{getPublicMcpEndpointStatus as _}from"./utils/public-endpoint.js";import{findGatedToolNames as ee}from"./utils/find-gated-tool-names.js";import{getDefaultToolSchemas as oe}from"./docs-mcp/tool-schemas.js";import{EXECUTE_TOOL_SCHEMA as te}from"./codemode/tools/execute-schema.js";import{isGatewayCapabilityEnabled as ie,isGatewayEligible as re}from"./gateway-mcp/eligibility.js";import{resolveGatewayFetchLimits as se}from"./gateway-mcp/rate-limit/limits.js";import{resetCustomMcpTools as ne,scanCustomMcpTools as ae}from"./custom-tools/scan-custom-tools.js";import{resolveSiteBranding as ce}from"./handlers/credentials-page/site-branding.js";import{telemetryTraceStep as pe}from"../../../cli/telemetry/helpers/trace-step.js";import{DEFAULT_DOCS_MCP_SERVER_NAME as S}from"./constants.js";const b=$(U(import.meta.url));async function de(){let i;const m={registeredToolNames:[],warnedNoOutputSchemaTools:new Set};let u=0,f=!1;return{id:"mcp",async processContent(e,a){await pe("com.redocly.build.plugin.mcp",async s=>{const t=await a.getConfig(),{mcp:r,redirects:g}=t;if(s?.setAttribute("config",JSON.stringify(r||{})),s?.setAttribute("mcpMode",R()),s?.setAttribute("mcpGateway",String(Z())),r?.hide||r?.docs?.hide){ne(e,m);return}Q(g)&&await F.panicOnBuildContentError('The reserved route "/mcp" cannot be used in redirect configuration. Please remove any redirects involving "/mcp" from your redocly.yaml config.'),e.createTemplate(x,"@redocly/theme/layouts/McpNotAllowed");const l=!!t?.access?.requiresLogin,C=t?.access?.rbac||{},d=R(),c=Y(),{budgetPerExec:h}=se();if(!i){p.info("Configuring MCP servers...");const w=J(await e.loadApiDocuments(a)),O=W(await e.loadApiDocuments(a)),v=r?.docs?.ignore||[],L=K(P(w,v)),q=ie(r),E=new Map;for(const o of L){const H=o.definition.info?.title||"",j=o.definition.info?.version||"";E.set(o.relativePath,{name:H,description:typeof o.definition.info?.description=="string"?o.definition.info.description:"",version:j,servers:o.definition.servers||[],relativePath:o.relativePath,...q&&re(o.definition.info)?{fetchEligible:!0}:{}})}const y=X(P(O,v)),G=Object.values(t.products||{}).map(o=>o?.name).filter(B),I=t.l10n?.locales?.map(o=>o.code)??a.fs.localeFolders,N=oe({products:G,locales:I,requiresLogin:l,rbac:C,hasGraphqlApis:y.length>0,elicitationEnabled:c,hasCallableApis:E.values().some(o=>o.fetchEligible),feedbackHidden:t.feedback?.hide===!0});e.addMcpTools(D(b,"./docs-mcp/tools/index.js"),N),d==="code"&&e.addMcpTools(D(b,"./codemode/tools/execute.js"),[te]),i={apiDescriptionsMap:Object.fromEntries(E),graphqlDescriptions:y}}const n=await ae(e,a,m);s?.setAttribute("customToolsCount",String(n)),n!==u&&(u=n,n>0&&p.info(`Registered ${n} custom MCP tool${n===1?"":"s"} from @mcp folders`)),await le({actions:e,handlerPath:D(b,"./handlers/docs-mcp-handler.js"),apiDescriptionsMap:i.apiDescriptionsMap,graphqlDescriptions:i.graphqlDescriptions,mcpConfig:r,mcpMode:d,elicitationEnabled:c,gatewayFetchBudgetPerExec:h,publicEndpointStatus:_(t)}),f||(p.info("Registered Docs MCP Server endpoint at /mcp"),f=!0)})},async afterRoutesCreated(e,a){const s=await a.getConfig(),{mcp:t}=s,r=!t?.hide&&!t?.docs?.hide;e.markGatedMcpTools(await ee(e.getMcpTools())),e.setGlobalData({mcpData:{docs:{enabled:r,name:t?.docs?.name||S,publicEndpoint:_(s)==="served"}}})}}}var Oe=de;async function le({actions:i,handlerPath:m,apiDescriptionsMap:u,graphqlDescriptions:f,mcpConfig:e,mcpMode:a,elicitationEnabled:s,gatewayFetchBudgetPerExec:t,publicEndpointStatus:r}){i.createRequestHandler(T,m);const g=l=>async(C,d)=>{const c=z(d.getAllRoutes(),e?.docs?.ignore||[]);return c.length>0&&p.verbose(`mcp.docs.ignore: hiding ${c.length} page routes from MCP search`),{props:{config:{apiDescriptionsMap:u,graphqlDescriptions:f,mcpDocsServerName:e?.docs?.name||S,mcpMode:a,elicitationEnabled:s,gatewayFetchBudgetPerExec:t,searchIgnoredRoutes:c,...l?{isPublicEndpoint:l}:{}},serverOutDir:i.serverOutDir,tools:i.getMcpTools().map(({importPath:h,...n})=>n)}}};if(i.addApiRoute({slug:k,requestHandlerId:T,httpMethod:"all",getStaticData:g(!1)}),r==="no-protected-content"?p.info(`mcp.docs.publicEndpoint is enabled, but the project has no protected content - /mcp already serves anonymous users, skipping ${M}.`):r==="anonymous-denied"?p.info(`mcp.docs.publicEndpoint is enabled, but anonymous users are denied the MCP feature (rbac.features.mcp or requiresLogin) - skipping ${M}.`):r==="served"&&(i.addApiRoute({slug:M,requestHandlerId:T,httpMethod:"all",getStaticData:g(!0)}),p.verbose(`Registered public Docs MCP Server endpoint at ${M}`)),s){const l=D(b,"./handlers/mcp-credentials-handler.js");i.createRequestHandler(A,l),i.addApiRoute({slug:V,requestHandlerId:A,httpMethod:"all",getStaticData:async(C,d)=>{const{seo:c,colorMode:h}=d.getConfig(),{logo:n}=d.getGlobalData();return{props:{branding:ce({seo:c,logo:n,colorMode:h})}}}}),p.verbose("Registered MCP credentials endpoint at /mcp/credentials")}}export{Oe as default,de as mcpServerPlugin};

package/dist/server/plugins/mcp/servers/docs-server.d.ts

@@ -0,0 +1,12 @@
+import type { McpServer } from '@modelcontextprotocol/server';
+import type { McpToolSchema } from '../../../types';
+import type { McpToolContext, SkillMcpResource } from '../types.js';
+import type { KvService } from '@redocly/config';
+export declare function createDocsMcpServer({ name, tools, context, skills, getKv, }: {
+    name: string;
+    tools: McpToolSchema[];
+    context: McpToolContext;
+    skills?: SkillMcpResource[];
+    getKv: () => Promise<KvService>;
+}): Promise<McpServer>;
+//# sourceMappingURL=docs-server.d.ts.map

package/dist/server/plugins/mcp/servers/docs-server.js

@@ -0,0 +1 @@
+import{logger as v}from"../../../tools/notifiers/logger.js";import{mcpToolWorkers as L,MCP_TOOL_IS_AVAILABLE_KEY as k}from"../../../workers/mcp-tool-worker-pool.js";import{CREATE_ANONYMOUS_SESSION_TOOL_NAME as C,MANAGE_API_CREDENTIALS_TOOL_NAME as y}from"../constants.js";import{isAnonymousSessionToolAvailable as D}from"../docs-mcp/tools/core/create-anonymous-session.js";import{isManageApiCredentialsToolAvailable as N,manageApiCredentials as w,manageApiCredentialsSchema as x}from"../codemode/tools/manage-credentials.js";import{EXECUTE_TOOL_SCHEMA as _}from"../codemode/tools/execute-schema.js";import{EXECUTE_TOOL_NAME as I,CODE_MODE_TOOL_NAMES as H,FETCH_TOOL_NAME as P}from"../codemode/constants.js";import{buildCodeModeInstructions as R,buildExecuteDescription as U}from"../codemode/prompts.js";import{toToolListEntries as F}from"../codemode/build-tool-list.js";import{composeExecuteAnnotations as z,getActiveCapabilities as B}from"../codemode/capabilities/index.js";import{describeToolsSchema as W,describeTools as X}from"../codemode/tools/describe-tools.js";import{availableSandboxTools as Y}from"../utils/available-sandbox-tools.js";import{isToolDisabledByCaller as S}from"../utils/disabled-tools.js";import{toRegisterToolConfig as h}from"../utils/tool-registration.js";import{createMcpServer as $,createToolDispatch as j,extractSerializableContext as G}from"./mcp-server.js";function O(r,a){const o=a.schema;if(r)return o;const{sessionHandle:T,...p}=o.properties;return{...o,properties:p}}function K(r){return Object.fromEntries(r.map(a=>[a.name,a.schema]))}async function me({name:r,tools:a,context:o,skills:T=[],getKv:p}){const n=G(o),s=o.mcpMode==="code",l=s?B(o):[],b=l.some(e=>e.id===P),c=s?await Y(a.filter(e=>!H.has(e.name)),n):[],E=F(c,l),d=D(o)&&!S(C,o.metadata),g=s&&N(o)&&!S(y,o.metadata),m=$(r,s?R(b,E):void 0),u={getClientCapabilities:()=>m.server.getClientCapabilities(),getKv:p},f=j(s?{...n,sandboxToolSchemas:K(c)}:n,u),A=async e=>{try{return await L.exec(k,[{toolName:e,context:n}],{timeout:1e4})}catch(i){return v.error(`Failed to check MCP tool availability for "${e}": ${i instanceof Error?i.message:String(i)}`),!1}};if(s){const e=[{tool:{..._,description:U(b,E),schema:O(d,_),annotations:z(c,l,o.config?.mcp)},callback:f(I)},{tool:W(c,l),callback:X(c,A,l,o)}],i=a.find(t=>t.name===C);if(i&&d&&e.push({tool:i,callback:f(i.name)}),g){const t=x(o);e.push({tool:{...t,schema:O(d,t)},callback:w(n,u)})}for(const{tool:t,callback:M}of e)m.registerTool(t.name,h(t),M)}else await Promise.all(a.map(async e=>{const i=m.registerTool(e.name,h({...e,outputSchema:void 0}),f(e.name));await A(e.name)||i.disable()}));for(const e of T)m.registerResource(e.slug,e.uri,{title:e.name,description:e.description,mimeType:"text/markdown"},async()=>({contents:[{uri:e.uri,mimeType:"text/markdown",text:e.content}]}));return m}export{me as createDocsMcpServer};