@redocly/revel 0.138.0-next.9 → 0.138.0

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-counter-repository.js

@@ -0,0 +1,13 @@
+import{sql as t}from"drizzle-orm";import{createDatabaseRepositoryInstance as s}from"../../../../../providers/database/instance-cache-resolver.js";import{KvRepository as u}from"../../../../../persistence/kv/repositories/kv-repository.js";import{createKvDbRecord as _}from"../../../../../persistence/kv/mappers/create-kv-db-record.js";class o extends u{static create(a){return s(a,"fetch counter",o)}async incrementBelowLimits(a){const d=t.join(a.map(({key:c,limit:n,ttlInSeconds:r})=>{const e=_({key:c,value:{count:1},ttlInSeconds:r});return t`(${e.encodedKey}, ${e.value}, ${e.expiresAt}, ${e.createdAt}, ${e.updatedAt}, ${n})`}),t`, `);return(await this.databaseClient.dbClient.all(t`
+      WITH slot (encoded_key, value, expires_at, created_at, updated_at, max_count) AS (VALUES ${d})
+      INSERT INTO kv (encoded_key, value, expires_at, created_at, updated_at)
+      SELECT encoded_key, value, expires_at, created_at, updated_at FROM slot
+      WHERE NOT EXISTS (
+        SELECT 1 FROM slot AS s JOIN kv ON kv.encoded_key = s.encoded_key
+        WHERE json_extract(kv.value, '$.count') >= s.max_count
+      )
+      ON CONFLICT (encoded_key) DO UPDATE SET
+        value = json_object('count', json_extract(kv.value, '$.count') + 1),
+        updated_at = excluded.updated_at
+      RETURNING encoded_key
+    `)).length>0}}export{o as FetchCounterRepository};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/{limits.d.ts → fetch-limiter/fetch-limits.d.ts}

@@ -4,4 +4,4 @@ export type GatewayFetchLimits = {
     budgetPerExec: number;
 };
 export declare function resolveGatewayFetchLimits(): GatewayFetchLimits;
-//# sourceMappingURL=limits.d.ts.map
+//# sourceMappingURL=fetch-limits.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/fetch-limiter/fetch-limits.js

@@ -0,0 +1 @@
+import{FEATURE as e,GATEWAY_FETCH_LIMIT_DEFAULTS as t}from"../../../../../../constants/common.js";import{readEntitlementNumber as r}from"../../../../../utils/entitlements/read-entitlement-number.js";function i(){return{ratePerMin:r(e.gatewayFetchRatePerMin,t.ratePerMin),quotaPerDay:r(e.gatewayFetchQuotaPerDay,t.quotaPerDay),budgetPerExec:r(e.gatewayFetchBudgetPerExec,t.budgetPerExec)}}export{i as resolveGatewayFetchLimits};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/{apply-edge-rate-limit.d.ts → request-limiter/apply-edge-rate-limit.d.ts}

@@ -1,3 +1,3 @@
-import type { Store } from '../../../../store.js';
+import type { Store } from '../../../../../store.js';
 export declare function applyEdgeRateLimit(request: Request, store: Store): Promise<Response | undefined>;
 //# sourceMappingURL=apply-edge-rate-limit.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/apply-edge-rate-limit.js

@@ -0,0 +1 @@
+import{envConfig as o}from"../../../../../config/env-config.js";import{isRealmOrReef as s}from"../../../../../utils/is-realm-or-reef.js";import{KvRepository as m}from"../../../../../persistence/kv/repositories/kv-repository.js";import{logger as p}from"../../../../../tools/notifiers/logger.js";import{ipRateLimitKey as f}from"../utils/ip-key.js";import{checkEdgeRateLimit as c}from"./edge-limiter.js";import{resolveMcpRequestLimits as d}from"./request-limits.js";import{reportMcpRateLimited as l}from"./rate-limit-telemetry.js";async function w(n,a){if(!s())return;const i=f(n);if(!i)return;let e,r;try{const t=await m.create({baseDbDir:a.serverOutDir,sqldRemoteDatabaseUrl:o.SQLD_REMOTE_DATABASE_URL,sqldRemoteDatabaseAuthToken:o.SQLD_REMOTE_DATABASE_AUTH_TOKEN});r=d(),e=await c({kv:t,ip:i,limits:r,now:Date.now()})}catch(t){p.warn(`gateway rate-limit init error, failing open: ${String(t)}`);return}if(!e.allowed)return l({scope:e.scope,retryAfterSeconds:e.retryAfterSeconds,limit:e.scope==="rate"?r.ratePerMin:r.quotaPerDay}),new Response(JSON.stringify({jsonrpc:"2.0",error:{code:-32029,message:`Rate limit exceeded (${e.scope}); retry after ${e.retryAfterSeconds}s`},id:null}),{status:429,headers:{"Content-Type":"application/json","Retry-After":String(e.retryAfterSeconds)}})}export{w as applyEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/{edge-limiter.d.ts → request-limiter/edge-limiter.d.ts}

@@ -1,5 +1,5 @@
-import type { KvRepository } from '../../../../persistence/kv/repositories/kv-repository.js';
-import type { GatewayFetchLimits } from './limits.js';
+import type { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
+import type { McpRequestLimits } from './request-limits.js';
 export type EdgeDecision = {
     allowed: true;
 } | {
@@ -10,7 +10,7 @@ export type EdgeDecision = {
 export declare function checkEdgeRateLimit(params: {
     kv: KvRepository;
     ip: string;
-    limits: GatewayFetchLimits;
+    limits: McpRequestLimits;
     now: number;
 }): Promise<EdgeDecision>;
 //# sourceMappingURL=edge-limiter.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/edge-limiter.js

@@ -0,0 +1 @@
+import{checkAndIncrement as c}from"../utils/window-counter.js";const s=60,d=86400;async function w(i){const{kv:e,ip:t,limits:o,now:r}=i;await e.sync();const n=await c({kv:e,ip:t,windowSeconds:s,limit:o.ratePerMin,now:r});if(!n.allowed)return{allowed:!1,retryAfterSeconds:n.retryAfterSeconds,scope:"rate"};const a=await c({kv:e,ip:t,windowSeconds:d,limit:o.quotaPerDay,now:r});return a.allowed?{allowed:!0}:{allowed:!1,retryAfterSeconds:a.retryAfterSeconds,scope:"quota"}}export{w as checkEdgeRateLimit};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/rate-limit-telemetry.js

@@ -0,0 +1 @@
+import{telemetry as o}from"../../../../../telemetry/index.js";import{logger as i}from"../../../../../tools/notifiers/logger.js";import{McpServerType as m}from"../../../constants.js";import{serverAttributes as p}from"../../../utils/telemetry-attributes.js";function d({scope:e,retryAfterSeconds:r,limit:t}){try{o.sendMcpRateLimitedMessage([{...p(m.Docs),scope:e,retry_after_seconds:r,limit:t}])}catch{}i.warn(`Gateway MCP rate limited [scope=${e}] retryAfterSeconds=${r} limit=${t}`)}export{d as reportMcpRateLimited};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/request-limits.d.ts

@@ -0,0 +1,6 @@
+export type McpRequestLimits = {
+    ratePerMin: number;
+    quotaPerDay: number;
+};
+export declare function resolveMcpRequestLimits(): McpRequestLimits;
+//# sourceMappingURL=request-limits.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/request-limiter/request-limits.js

@@ -0,0 +1 @@
+import{FEATURE as e,MCP_REQUEST_LIMIT_DEFAULTS as r}from"../../../../../../constants/common.js";import{readEntitlementNumber as t}from"../../../../../utils/entitlements/read-entitlement-number.js";function i(){return{ratePerMin:t(e.mcpRequestRatePerMin,r.ratePerMin),quotaPerDay:t(e.mcpRequestQuotaPerDay,r.quotaPerDay)}}export{i as resolveMcpRequestLimits};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/ip-key.js

@@ -0,0 +1 @@
+import{isIP as l}from"node:net";import{getFeedbackClientIp as a}from"../../../../../web-server/utils/feedback-ip.js";import{extractMappedIpv4 as c}from"../../../../../web-server/utils/ssrf-blocklist.js";function I(t){const n=a(t);if(n)return f(n)}function f(t){if(l(t)===6){const n=c(t);return n||`${u(t)}::/64`}return t}function u(t){const n=t.split("%")[0],[e,i=""]=n.split("::"),r=e?e.split(":"):[],o=i?i.split(":"):[],s=8-r.length-o.length;return[...r,...Array(Math.max(0,s)).fill("0"),...o].slice(0,4).map(p=>parseInt(p||"0",16).toString(16)).join(":")}export{I as ipRateLimitKey};

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/{window-counter.d.ts → utils/window-counter.d.ts}

@@ -1,4 +1,4 @@
-import type { KvRepository } from '../../../../persistence/kv/repositories/kv-repository.js';
+import type { KvRepository } from '../../../../../persistence/kv/repositories/kv-repository.js';
 export type WindowCheck = {
     allowed: false;
     retryAfterSeconds: number;

package/dist/server/plugins/mcp/gateway-mcp/rate-limit/utils/window-counter.js

@@ -0,0 +1 @@
+import{logger as d}from"../../../../../tools/notifiers/logger.js";function g(e,t,r){return["mcp","request-rl",e,String(t),String(r)]}async function S(e){const{kv:t,ip:r,windowSeconds:n,limit:l,now:w}=e,o=Math.floor(w/1e3),c=Math.floor(o/n),i=g(r,n,c);try{const s=(await t.get(i))?.count??0;if(s>=l){const u=(c+1)*n-o;return{allowed:!1,retryAfterSeconds:Math.max(1,u)}}return await t.set(i,{count:s+1},{ttlInSeconds:n}),{allowed:!0}}catch(a){return d.warn(`gateway rate-limit store error, failing open: ${String(a)}`),{allowed:!0}}}export{S as checkAndIncrement};

package/dist/server/plugins/mcp/gateway-mcp/route-pattern.d.ts

@@ -0,0 +1,18 @@
+import type { OpenAPIServer } from '@redocly/api-docs';
+/** Regex for request pathnames of the OpenAPI `path` below the base path that `prefix` matches. */
+export declare function pathPattern(prefix: string, path: string): RegExp | undefined;
+/**
+ * Regex group matching any of the servers' base paths: required when every server has one,
+ * optional when some server has none, `''` when none has one.
+ */
+export declare function basePathPrefix(servers: readonly OpenAPIServer[]): string;
+/** Number of `{variable}` segments in an OpenAPI path; fewer means a more specific path. */
+export declare function pathVariableCount(path: string): number;
+/**
+ * Identity of an OpenAPI path template for comparison: variable names and a trailing slash do not
+ * change which requests the path matches, so `/users/{id}/` and `/users/{userId}` are equal.
+ */
+export declare function pathTemplateKey(path: string): string;
+/** The upper-case HTTP method sent for an OpenAPI operation key or a request method; `x-query` sends `QUERY`. */
+export declare function operationHttpMethod(key: string): string;
+//# sourceMappingURL=route-pattern.d.ts.map

package/dist/server/plugins/mcp/gateway-mcp/route-pattern.js

@@ -0,0 +1 @@
+const r=/\{(?<!\{[^}]*?\{)[^}]*\}/g;function u(e,t){if(t.startsWith("/"))return new RegExp(`^${e}${a(t)}/?$`)}function s(e){const t=e.map(c=>p(c.url)),n=[...new Set(t.filter(Boolean).map(a))];if(n.length===0)return"";const o=`(?:${n.join("|")})`;return t.every(Boolean)?o:`${o}?`}function l(e){return e.match(r)?.length??0}function f(e){return e.replace(r,"{}").replace(/(?<!\/)\/+$/,"")||"/"}function h(e){const t=e.toUpperCase();return t==="X-QUERY"?"QUERY":t}function a(e){return e.split(r).map(i).join("[^/]+").replace(/(?<!\/)\/+$/,"")}function p(e){if(!e)return"";const t=e.replace(/^[a-z][a-z0-9+.-]*:\/\//i,""),n=t.indexOf("/");return n===-1?"":t.slice(n).split(/[?#]/)[0].replace(/(?<!\/)\/+$/,"")}function i(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}export{s as basePathPrefix,h as operationHttpMethod,u as pathPattern,f as pathTemplateKey,l as pathVariableCount};

package/dist/server/plugins/mcp/gateway-mcp/secret-store.d.ts

@@ -1,5 +1,6 @@
 import type { KvService } from '@redocly/config';
 import type { UpstreamAuthScheme } from './upstream-auth-scheme.js';
+export declare const ELICITATION_TTL_MINUTES = 15;
 export declare const ELICITATION_TTL_MS: number;
 export type StoredSecret = {
     header: string;
@@ -11,7 +12,6 @@ export type ElicitationScheme = {
     name: string;
     label?: string;
     auth: UpstreamAuthScheme;
-    hasExistingSecret: boolean;
     operations?: string[];
 };
 export type ElicitationTarget = {
@@ -21,17 +21,23 @@ export type ElicitationTarget = {
     scheme: string;
     schemeLabel?: string;
     auth: UpstreamAuthScheme;
-    hasExistingSecret?: boolean;
     schemes?: ElicitationScheme[];
+    /** The schemes the failing operation accepts, when it accepts more than one. */
+    acceptedSchemes?: string[];
+    expiresAt: number;
 };
+export type StoredSchemes = Record<string, {
+    savedAt?: number;
+}>;
 export declare class SecretStore {
     #private;
     setSecret(kv: KvService, subject: string, api: string, scheme: string, secret: StoredSecret): Promise<void>;
     getSecretsForSubject(kv: KvService, subject: string): Promise<UpstreamSecrets>;
+    getStoredSchemes(kv: KvService, subject: string, api: string): Promise<StoredSchemes>;
     hasSecret(kv: KvService, subject: string, api: string, scheme: string): Promise<boolean>;
     deleteSecret(kv: KvService, subject: string, api: string, scheme: string): Promise<void>;
     deleteSubject(kv: KvService, subject: string): Promise<void>;
-    createElicitation(kv: KvService, target: ElicitationTarget): Promise<string>;
+    createElicitation(kv: KvService, target: Omit<ElicitationTarget, 'expiresAt'>): Promise<string>;
     peekElicitation(kv: KvService, token: string): Promise<ElicitationTarget | undefined>;
     consumeElicitation(kv: KvService, token: string): Promise<ElicitationTarget | undefined>;
 }

package/dist/server/plugins/mcp/gateway-mcp/secret-store.js

@@ -1 +1 @@
-import{createCipheriv as h,createDecipheriv as m,createHash as d,hkdfSync as o,randomBytes as l,randomUUID as p}from"node:crypto";import{JWT_SECRET_KEY as f}from"../../../constants/common.js";import{assertHeaderSafe as y}from"./credential-validation.js";import{secretTtlSeconds as S}from"./subject.js";const g=900*1e3,I="mcp-upstream-secrets",T="mcp-elicitation",w="mcp-elicitation";class A{async setSecret(t,e,r,s,i){y(i.header,i.value);const n={...i,savedAt:Date.now()},a={api:r,scheme:s,...this.#o(this.#c(e),n,this.#n(r,s))};await t.set(this.#t(e,r,s),a,{ttlInSeconds:S(e)})}async getSecretsForSubject(t,e){const r=this.#c(e),{items:s}=await t.list({prefix:this.#i(e)}),i={};for(const n of s){if(!n.value?.scheme)continue;const{api:a,scheme:c}=n.value;try{const u=this.#s(r,n.value,this.#n(a,c));i[a]={...i[a],[c]:u}}catch{continue}}return i}async hasSecret(t,e,r,s){return!!await t.get(this.#t(e,r,s))}async deleteSecret(t,e,r,s){await t.delete(this.#t(e,r,s))}async deleteSubject(t,e){const{items:r}=await t.list({prefix:this.#i(e)}),s=r.flatMap(i=>i.value?[i.key]:[]);s.length!==0&&await t.transaction(async i=>{for(const n of s)await i.delete(n)})}async createElicitation(t,e){const r=p();return await t.set(this.#e(r),this.#o(this.#r(),e),{ttlInSeconds:g/1e3}),r}async peekElicitation(t,e){const r=await t.get(this.#e(e));if(r)try{return this.#s(this.#r(),r)}catch{return}}async consumeElicitation(t,e){const r=this.#e(e),s=await t.transaction(async i=>{const n=await i.get(r);return n&&await i.delete(r),n});if(s)try{return this.#s(this.#r(),s)}catch{return}}#i(t){return["mcp","secret",this.#a(t)]}#t(t,e,r){return["mcp","secret",this.#a(t),e,r]}#n(t,e){return`${t}\0${e}`}#e(t){return["mcp","elicitation",t]}#a(t){return d("sha256").update(t).digest("hex")}#c(t){return Buffer.from(o("sha256",f,t,I,32))}#r(){return Buffer.from(o("sha256",f,w,T,32))}#o(t,e,r){const s=l(12),i=h("aes-256-gcm",t,s);r&&i.setAAD(Buffer.from(r,"utf8"));const n=Buffer.concat([i.update(JSON.stringify(e),"utf8"),i.final()]);return{iv:s.toString("base64"),tag:i.getAuthTag().toString("base64"),data:n.toString("base64")}}#s(t,e,r){const s=m("aes-256-gcm",t,Buffer.from(e.iv,"base64"));r&&s.setAAD(Buffer.from(r,"utf8")),s.setAuthTag(Buffer.from(e.tag,"base64"));const i=Buffer.concat([s.update(Buffer.from(e.data,"base64")),s.final()]).toString("utf8");return JSON.parse(i)}}const N=new A;export{g as ELICITATION_TTL_MS,A as SecretStore,N as secretStore};
+import{createCipheriv as d,createDecipheriv as l,createHash as p,hkdfSync as f,randomBytes as y,randomUUID as S}from"node:crypto";import{JWT_SECRET_KEY as u}from"../../../constants/common.js";import{assertHeaderSafe as I}from"./credential-validation.js";import{secretTtlSeconds as T}from"./subject.js";const g=15,h=g*60*1e3,w="mcp-upstream-secrets",A="mcp-elicitation",E="mcp-elicitation";class v{async setSecret(t,e,r,s,n){I(n.header,n.value);const i={...n,savedAt:Date.now()},a={api:r,scheme:s,...this.#f(this.#o(e),i,this.#a(r,s))};await t.set(this.#e(e,r,s),a,{ttlInSeconds:T(e)})}async getSecretsForSubject(t,e){return this.#i(t,e,this.#t(e))}async getStoredSchemes(t,e,r){const s=[...this.#t(e),r],n=(await this.#i(t,e,s))[r]??{};return Object.fromEntries(Object.entries(n).map(([i,{savedAt:a}])=>[i,{savedAt:a}]))}async#i(t,e,r){const s=this.#o(e),{items:n}=await t.list({prefix:r}),i={};for(const a of n){if(!a.value?.scheme)continue;const{api:c,scheme:o}=a.value;try{const m=this.#n(s,a.value,this.#a(c,o));i[c]={...i[c],[o]:m}}catch{continue}}return i}async hasSecret(t,e,r,s){return!!await t.get(this.#e(e,r,s))}async deleteSecret(t,e,r,s){await t.delete(this.#e(e,r,s))}async deleteSubject(t,e){const{items:r}=await t.list({prefix:this.#t(e)}),s=r.flatMap(n=>n.value?[n.key]:[]);s.length!==0&&await t.transaction(async n=>{for(const i of s)await n.delete(i)})}async createElicitation(t,e){const r=S(),s={...e,expiresAt:Date.now()+h};return await t.set(this.#r(r),this.#f(this.#s(),s),{ttlInSeconds:h/1e3}),r}async peekElicitation(t,e){const r=await t.get(this.#r(e));if(r)try{return this.#n(this.#s(),r)}catch{return}}async consumeElicitation(t,e){const r=this.#r(e),s=await t.transaction(async n=>{const i=await n.get(r);return i&&await n.delete(r),i});if(s)try{return this.#n(this.#s(),s)}catch{return}}#t(t){return["mcp","secret",this.#c(t)]}#e(t,e,r){return["mcp","secret",this.#c(t),e,r]}#a(t,e){return`${t}\0${e}`}#r(t){return["mcp","elicitation",t]}#c(t){return p("sha256").update(t).digest("hex")}#o(t){return Buffer.from(f("sha256",u,t,w,32))}#s(){return Buffer.from(f("sha256",u,E,A,32))}#f(t,e,r){const s=y(12),n=d("aes-256-gcm",t,s);r&&n.setAAD(Buffer.from(r,"utf8"));const i=Buffer.concat([n.update(JSON.stringify(e),"utf8"),n.final()]);return{iv:s.toString("base64"),tag:n.getAuthTag().toString("base64"),data:i.toString("base64")}}#n(t,e,r){const s=l("aes-256-gcm",t,Buffer.from(e.iv,"base64"));r&&s.setAAD(Buffer.from(r,"utf8")),s.setAuthTag(Buffer.from(e.tag,"base64"));const n=Buffer.concat([s.update(Buffer.from(e.data,"base64")),s.final()]).toString("utf8");return JSON.parse(n)}}const K=new v;export{g as ELICITATION_TTL_MINUTES,h as ELICITATION_TTL_MS,v as SecretStore,K as secretStore};

package/dist/server/plugins/mcp/gateway-mcp/subject.js

@@ -1 +1 @@
-import{randomBytes as r}from"node:crypto";const i=32,S=/^[A-Za-z0-9_-]{43}$/,c=1440*60,u=720*60*60,s="anon:",d="user:",f="This API requires credentials and the caller is anonymous; call createAnonymousSession first, then retry with sessionHandle",a="The sessionHandle is not a valid handle; call createAnonymousSession to obtain one";function N(){return r(i).toString("base64url")}function E(e){return S.test(e)}function l(e){if(!e?.isAuthenticated)return;const n=e.claims,o=(typeof n?.sub=="string"&&n.sub?n.sub:void 0)??(e.email||void 0);if(o)return`${d}${e.idpId??"local"}:${o}`}function A(e,n){const t=l(e);return t?{kind:"resolved",subject:t}:n===void 0?{kind:"anonymous"}:E(n)?{kind:"resolved",subject:`${s}${n}`}:{kind:"invalid",message:a}}function T(e){return e.startsWith(s)?c:u}export{s as ANONYMOUS_SUBJECT_PREFIX,a as MALFORMED_SESSION_HANDLE_MESSAGE,f as MISSING_SESSION_HANDLE_MESSAGE,d as USER_SUBJECT_PREFIX,N as createSessionHandle,E as isValidSessionHandle,A as resolveSecretSubject,T as secretTtlSeconds,l as userSubject};
+import{randomBytes as r}from"node:crypto";const i=32,S=/^[A-Za-z0-9_-]{43}$/,c=1440*60,u=10080*60,s="anon:",d="user:",f="This API requires credentials and the caller is anonymous; call createAnonymousSession first, then retry with sessionHandle",a="The sessionHandle is not a valid handle; call createAnonymousSession to obtain one";function N(){return r(i).toString("base64url")}function E(e){return S.test(e)}function l(e){if(!e?.isAuthenticated)return;const n=e.claims,o=(typeof n?.sub=="string"&&n.sub?n.sub:void 0)??(e.email||void 0);if(o)return`${d}${e.idpId??"local"}:${o}`}function A(e,n){const t=l(e);return t?{kind:"resolved",subject:t}:n===void 0?{kind:"anonymous"}:E(n)?{kind:"resolved",subject:`${s}${n}`}:{kind:"invalid",message:a}}function T(e){return e.startsWith(s)?c:u}export{s as ANONYMOUS_SUBJECT_PREFIX,a as MALFORMED_SESSION_HANDLE_MESSAGE,f as MISSING_SESSION_HANDLE_MESSAGE,d as USER_SUBJECT_PREFIX,N as createSessionHandle,E as isValidSessionHandle,A as resolveSecretSubject,T as secretTtlSeconds,l as userSubject};

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth-scheme.d.ts

@@ -26,6 +26,8 @@ export type UpstreamApiAuth = {
     defaultScheme: string;
     routes: UpstreamAuthRoute[];
     descriptions?: Record<string, string>;
+    /** Query parameter names of the `apiKey` schemes with `in: query`. */
+    credentialQueryParams: string[];
 };
 type SecuritySchemeLoader = typeof getApiDescriptionFromFs;
 export declare const DEFAULT_SCHEME_NAME = "default";

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth-scheme.js

@@ -1,2 +1,2 @@
-import{getApiDescriptionFromFs as S}from"../docs-mcp/tools/openapi/utils.js";import{OPERATION_METHODS as b}from"../docs-mcp/tools/openapi/constants.js";const A=120,l="default",g={kind:"raw"},h=["oauth2ClientCredentials","bearer","apiKey","cookie","raw"],E=new Set(b),j=/\{(?<!\{[^}]*?\{)[^}]*\}/g;function c(){return{schemes:{[l]:g},defaultScheme:l,routes:[]}}async function L(e,t,n=S){const r=Object.values(e.apiDescriptionsMap??{}).find(i=>i.relativePath===t);if(!r)return c();try{const i=await n({relativePath:r.relativePath,outdir:e.outdir||"",user:e.user,rbac:e.config?.access?.rbac||{},requiresLogin:!!e.config?.access?.requiresLogin});return i?w(i,r.servers??[]):c()}catch{return c()}}function w(e,t){const n=x(e),r=Object.keys(n);if(r.length===0)return c();const i=m(e.security,n)[0]??a(r,n)[0],o=P(e,r);return{schemes:n,defaultScheme:i,routes:H(e,n,t),...Object.keys(o).length>0?{descriptions:o}:{}}}function M(e){return[...new Set(Object.values(e).map(C))]}function N(e){return a(Object.keys(e),e)}function U(e,t){const n=new Set;for(const r of e.routes)r.schemes.includes(t)&&n.add(`${r.method} ${r.path}`);return[...n]}function C(e){return e.kind==="apiKey"?e.header:e.kind==="cookie"?"Cookie":"Authorization"}function P(e,t){const n={};for(const r of t){const i=e.components?.securitySchemes?.[r],o=k(i)?i.description:void 0;if(typeof o!="string")continue;const s=o.split(`
-`)[0].trim();s&&(n[r]=s.slice(0,A))}return n}function x(e){const t={};for(const[n,r]of Object.entries(e.components?.securitySchemes??{})){if(!k(r))continue;const i=T(r);i&&(t[n]=i)}return t}function T(e){if(e.type==="oauth2"){const t=e.flows?.clientCredentials;return t?{kind:"oauth2ClientCredentials",tokenUrl:t.tokenUrl,scopes:Object.keys(t.scopes??{})}:{kind:"bearer"}}if(e.type==="openIdConnect")return{kind:"bearer"};if(e.type==="http"&&e.scheme?.toLowerCase()==="bearer")return{kind:"bearer"};if(e.type==="apiKey"&&e.in==="header")return{kind:"apiKey",header:e.name||"X-Api-Key"};if(e.type==="apiKey"&&e.in==="cookie"&&e.name)return{kind:"cookie",name:e.name}}function a(e,t){return[...e].sort((n,r)=>h.indexOf(t[n].kind)-h.indexOf(t[r].kind)||e.indexOf(n)-e.indexOf(r))}function m(e,t){const n=[];for(const r of e??[])for(const i of Object.keys(r))t[i]&&!n.includes(i)&&n.push(i);return n}function H(e,t,n){const r=_(n),i=[];for(const[o,s]of Object.entries(e.paths??{})){if(!s||typeof s!="object")continue;const f=R(r,o);if(f)for(const[p,O]of Object.entries(s)){if(!E.has(p.toLowerCase()))continue;const u=O?.security??e.security;if(u===void 0)continue;const d=m(u,t);d.length===0&&u.length>0||i.push({pattern:f,path:o,method:p.toUpperCase(),schemes:a(d,t)})}}return i}function R(e,t){if(t.startsWith("/"))return new RegExp(`^${e}${y(t)}/?$`)}function y(e){return e.split(j).map(v).join("[^/]+").replace(/(?<!\/)\/+$/,"")}function _(e){const t=[...new Set(e.map(n=>$(n.url)).filter(Boolean).map(y))];return t.length>0?`(?:${t.join("|")})?`:""}function $(e){if(!e)return"";const t=e.replace(/^[a-z][a-z0-9+.-]*:\/\//i,""),n=t.indexOf("/");return n===-1?"":t.slice(n).split(/[?#]/)[0].replace(/(?<!\/)\/+$/,"")}function v(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function k(e){return typeof e=="object"&&e!==null&&"type"in e}export{l as DEFAULT_SCHEME_NAME,M as credentialHeadersOf,U as operationsForScheme,N as orderedSchemesOf,L as resolveUpstreamApiAuth};
+import{getApiDescriptionFromFs as k}from"../docs-mcp/tools/openapi/utils.js";import{OPERATION_METHODS as b}from"../docs-mcp/tools/openapi/constants.js";import{basePathPrefix as S,operationHttpMethod as A,pathPattern as C}from"./route-pattern.js";const P=120,l="default",j={kind:"raw"},y=["oauth2ClientCredentials","bearer","apiKey","cookie","raw"],E=new Set(b);function c(){return{schemes:{[l]:j},defaultScheme:l,routes:[],credentialQueryParams:[]}}async function q(e,n,t=k){const r=Object.values(e.apiDescriptionsMap??{}).find(o=>o.relativePath===n);if(!r)return c();try{const o=await t({relativePath:r.relativePath,outdir:e.outdir||"",user:e.user,rbac:e.config?.access?.rbac||{},requiresLogin:!!e.config?.access?.requiresLogin});return o?w(o,r.servers??[]):c()}catch{return c()}}function w(e,n){const t=K(e),r=Object.keys(t),o=g(e);if(r.length===0)return{...c(),credentialQueryParams:o};const s=h(e.security,t)[0]??a(r,t)[0],i=v(e,r);return{schemes:t,defaultScheme:s,routes:T(e,t,n),credentialQueryParams:o,...Object.keys(i).length>0?{descriptions:i}:{}}}function g(e){const n=new Set;for(const t of Object.values(e.components?.securitySchemes??{}))f(t)&&t.type==="apiKey"&&t.in==="query"&&t.name&&n.add(t.name);return[...n]}function L(e){return[...new Set(Object.values(e).map(H))]}function R(e){return a(Object.keys(e),e)}function N(e,n){const t=new Set;for(const r of e.routes)r.schemes.includes(n)&&t.add(`${r.method} ${r.path}`);return[...t]}function H(e){return e.kind==="apiKey"?e.header:e.kind==="cookie"?"Cookie":"Authorization"}function v(e,n){const t={};for(const r of n){const o=e.components?.securitySchemes?.[r],s=f(o)?o.description:void 0;if(typeof s!="string")continue;const i=s.split(`
+`)[0].trim();i&&(t[r]=i.slice(0,P))}return t}function K(e){const n={};for(const[t,r]of Object.entries(e.components?.securitySchemes??{})){if(!f(r))continue;const o=M(r);o&&(n[t]=o)}return n}function M(e){if(e.type==="oauth2"){const n=e.flows?.clientCredentials;return n?{kind:"oauth2ClientCredentials",tokenUrl:n.tokenUrl,scopes:Object.keys(n.scopes??{})}:{kind:"bearer"}}if(e.type==="openIdConnect")return{kind:"bearer"};if(e.type==="http"&&e.scheme?.toLowerCase()==="bearer")return{kind:"bearer"};if(e.type==="apiKey"&&e.in==="header")return{kind:"apiKey",header:e.name||"X-Api-Key"};if(e.type==="apiKey"&&e.in==="cookie"&&e.name)return{kind:"cookie",name:e.name}}function a(e,n){return[...e].sort((t,r)=>y.indexOf(n[t].kind)-y.indexOf(n[r].kind)||e.indexOf(t)-e.indexOf(r))}function h(e,n){const t=[];for(const r of e??[])for(const o of Object.keys(r))n[o]&&!t.includes(o)&&t.push(o);return t}function T(e,n,t){const r=S(t),o=[];for(const[s,i]of Object.entries(e.paths??{})){if(!i||typeof i!="object")continue;const p=C(r,s);if(p)for(const[d,O]of Object.entries(i)){if(!E.has(d.toLowerCase()))continue;const u=O?.security??e.security;if(u===void 0)continue;const m=h(u,n);m.length===0&&u.length>0||o.push({pattern:p,path:s,method:A(d),schemes:a(m,n)})}}return o}function f(e){return typeof e=="object"&&e!==null&&"type"in e}export{l as DEFAULT_SCHEME_NAME,L as credentialHeadersOf,N as operationsForScheme,R as orderedSchemesOf,q as resolveUpstreamApiAuth};

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.d.ts

@@ -8,8 +8,6 @@ export type UpstreamAuthRequiredEvent = {
     schemes?: string[];
     /** Scheme whose stored credential the bridge actually sent; absent when nothing was injected. */
     sentScheme?: string;
-    /** Lower-cased credential header the sandbox code set itself, which suppressed the injection. */
-    callerHeader?: string;
     /** The upstream's own explanation of the failure, taken from the response body. */
     detail?: string;
 };

package/dist/server/plugins/mcp/gateway-mcp/upstream-auth.js

@@ -1 +1 @@
-const i="com.redocly/upstream-auth-required";function m(e){return`${e.api}\0${e.scheme??""}`}function h(e,n){const t=new Map;for(const o of n){const s=m(o),a=t.get(s);(!a||u(o)>u(a))&&t.set(s,o)}const r=[...t.values()];return r.length===0?e:{...e,_meta:{...e._meta,[i]:r}}}function u(e){return e.status!==401?0:e.sentScheme?2:1}function y(e){const n=e._meta?.[i];return Array.isArray(n)?n.filter(t=>typeof t?.api=="string"&&typeof t?.name=="string"&&typeof t?.status=="number").map(t=>{const r=Array.isArray(t.schemes)?t.schemes.filter(f=>typeof f=="string"):[],{schemes:o,sentScheme:s,callerHeader:a,detail:c,...p}=t;return{...p,...r.length>0?{schemes:r}:{},...typeof s=="string"?{sentScheme:s}:{},...typeof a=="string"?{callerHeader:a}:{},...typeof c=="string"?{detail:c}:{}}}):[]}function d(e){if(!e._meta||!(i in e._meta))return e;const{[i]:n,...t}=e._meta,r={...e};return Object.keys(t).length>0?r._meta=t:delete r._meta,r}export{i as UPSTREAM_AUTH_REQUIRED_META,y as readAuthRequiredMeta,d as stripAuthRequiredMeta,m as upstreamAuthKey,h as withAuthRequiredMeta};
+const i="com.redocly/upstream-auth-required";function f(e){return`${e.api}\0${e.scheme??""}`}function m(e,n){const t=new Map;for(const a of n){const s=f(a),o=t.get(s);(!o||u(a)>u(o))&&t.set(s,a)}const r=[...t.values()];return r.length===0?e:{...e,_meta:{...e._meta,[i]:r}}}function u(e){return e.status!==401?0:e.sentScheme?2:1}function h(e){const n=e._meta?.[i];return Array.isArray(n)?n.filter(t=>typeof t?.api=="string"&&typeof t?.name=="string"&&typeof t?.status=="number").map(t=>{const r=Array.isArray(t.schemes)?t.schemes.filter(p=>typeof p=="string"):[],{schemes:a,sentScheme:s,detail:o,...c}=t;return{...c,...r.length>0?{schemes:r}:{},...typeof s=="string"?{sentScheme:s}:{},...typeof o=="string"?{detail:o}:{}}}):[]}function y(e){if(!e._meta||!(i in e._meta))return e;const{[i]:n,...t}=e._meta,r={...e};return Object.keys(t).length>0?r._meta=t:delete r._meta,r}export{i as UPSTREAM_AUTH_REQUIRED_META,h as readAuthRequiredMeta,y as stripAuthRequiredMeta,f as upstreamAuthKey,m as withAuthRequiredMeta};

package/dist/server/plugins/mcp/handlers/credentials-page/constants.d.ts

@@ -0,0 +1,7 @@
+export declare const FORM_ACTIONS: {
+    readonly save: 'save';
+    readonly remove: 'remove';
+    readonly removeAll: 'remove-all';
+    readonly decline: 'decline';
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/constants.js

@@ -0,0 +1 @@
+const e={save:"save",remove:"remove",removeAll:"remove-all",decline:"decline"};export{e as FORM_ACTIONS};

package/dist/server/plugins/mcp/handlers/credentials-page/form-contract.d.ts

@@ -0,0 +1,5 @@
+import type { ElicitationScheme, ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { SchemeField } from './types.js';
+export declare function schemeFieldName(field: SchemeField, schemeIndex: number): string;
+export declare function credentialSchemesOf(target: ElicitationTarget): ElicitationScheme[];
+//# sourceMappingURL=form-contract.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/form-contract.js

@@ -0,0 +1 @@
+function c(e,n){return`${e}__${n}`}function h(e){return e.schemes??[{name:e.scheme,auth:e.auth}]}export{h as credentialSchemesOf,c as schemeFieldName};

package/dist/server/plugins/mcp/handlers/credentials-page/form-page.d.ts

@@ -0,0 +1,14 @@
+import type { ElicitationTarget, StoredSchemes } from '../../gateway-mcp/secret-store.js';
+import type { FormError, PageContent, PageSite } from './types.js';
+type FormPageInput = {
+    site: PageSite;
+    target: ElicitationTarget;
+    token: string;
+    stored: StoredSchemes;
+    error?: FormError;
+    /** Client IDs to put back into the OAuth2 fields after a rejected submission, by scheme index. */
+    clientIds?: readonly string[];
+};
+export declare function formPage(input: FormPageInput): PageContent;
+export {};
+//# sourceMappingURL=form-page.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/form-page.js

@@ -0,0 +1,62 @@
+import{withPathPrefix as D}from"@redocly/theme/core/utils";import{MCP_CREDENTIALS_ROUTE as R}from"../../../../constants/mcp.js";import{ELICITATION_TTL_MS as _}from"../../gateway-mcp/secret-store.js";import{secretTtlSeconds as I}from"../../gateway-mcp/subject.js";import{FORM_ACTIONS as $}from"./constants.js";import{credentialSchemesOf as F,schemeFieldName as M}from"./form-contract.js";import{ICONS as v,code as h,escapeHtml as r,siteHeader as N,targetTitle as A}from"./layout.js";const S=10,g="form-error",T=new Intl.DateTimeFormat("en-GB",{day:"numeric",month:"short",year:"numeric",timeZone:"UTC"}),P={bearer:{title:"API token",noun:"API token",placeholder:"Paste your API token"},apiKey:{title:"API key",noun:"API key",placeholder:"Paste your API key"},cookie:{title:"Cookie",noun:"cookie value",placeholder:"Paste the cookie value"},oauth2ClientCredentials:{title:"OAuth2",noun:"access token",placeholder:"Paste an access token"},raw:{title:"Authorization header",noun:"header value",placeholder:"Bearer <token>"}};function te(e){const{site:t,target:n,token:o,error:s}=e,a=D(R),u=F(n),i=u.length>1,c=L(e,u),l=c.some(f=>f.isStored),d=i&&l,m=c.map(f=>i?U(f):B(f)).join(""),p=d?'<button class="text-danger" type="submit" form="remove-all">Remove all credentials</button>':"",O=s?`<div class="banner" role="alert" id="${g}">${v.alert}<p>${r(s.message)}</p></div>`:"";return{title:`Credentials for ${A(n)}`,body:`<div class="page">
+<main class="card">
+${N(t)}
+<h1>${l?"Update":"Add"} credentials for ${r(A(n))}</h1>
+<p class="lede">${i?"This API accepts more than one kind of credential. Fill in the one that you have.":"This API needs one credential to authenticate your calls."}</p>
+${O}
+<form class="credentials" method="post" action="${a}" autocomplete="off">
+${y(o,$.save)}
+<div class="schemes">${m}</div>
+<div class="actions">
+<div class="actions-row">${p}<button class="primary" type="submit">Save credentials</button></div>
+<p class="decline small">Did not ask for this link? <button class="link-button" type="submit" form="decline">Decline it</button></p>
+</div>
+</form>
+${H(a,o,c,d)}
+</main>
+${W(n,t.host)}
+</div>`}}function L(e,t){const{target:n,stored:o,error:s,clientIds:a}=e,u=n.acceptedSchemes??[n.scheme],i=s?.schemeIndex??Math.max(0,t.findIndex(({name:l})=>u.includes(l))),c=t.length>1;return t.map((l,d)=>{const m=o[l.name],p=s?.schemeIndex===d?s:void 0;return{scheme:l,index:d,isMulti:c,title:c?l.name:P[l.auth.kind].title,savedAt:m?.savedAt,deletedAt:m?.savedAt===void 0?void 0:m.savedAt+I(n.subject)*1e3,isStored:m!==void 0,isOpen:d===i||u.includes(l.name)||m!==void 0,error:p,clientId:a?.[d]??"",autofocusField:d===i?p?.field??"secret":void 0}})}function B(e){return`<section class="scheme" aria-labelledby="scheme-${e.index}-title">
+<div class="scheme-body">
+<div class="scheme-head">
+<h2 id="scheme-${e.index}-title">${r(e.title)}</h2>
+<p>${E(e.scheme.auth)}</p>
+</div>
+${C(e)}
+</div>
+</section>`}function U(e){const t=e.isStored?'<span class="tag stored">Stored</span>':'<span class="tag">Not set</span>';return`<details class="scheme" aria-labelledby="scheme-${e.index}-title"${e.isOpen?" open":""}>
+<summary><span class="summary-title" id="scheme-${e.index}-title">${r(e.title)}</span><span class="summary-tag">${t}</span><span class="summary-line">${E(e.scheme.auth)}</span>${e.scheme.label?`<span class="summary-line">${r(e.scheme.label)}</span>`:""}</summary>
+<div class="scheme-body">
+${C(e)}
+</div>
+</details>`}function C(e){const t=e.isStored?j(e):"",n=e.isMulti?K(e.scheme.operations):"";return e.scheme.auth.kind==="oauth2ClientCredentials"?`${t}${x(e,!1)}${n}${z(e)}`:`${t}${x(e,!e.isMulti&&!e.isStored)}${n}`}function j({savedAt:e,deletedAt:t,index:n,title:o}){return`<div class="stored-box">
+<div>${e===void 0||t===void 0?"<p>A credential is stored for this scheme.</p>":`<p>Saved on ${T.format(e)}</p><p class="muted small">Kept until ${T.format(t)} at ${b(t)} UTC</p>`}</div>
+<button class="text-danger small" type="submit" form="remove-${n}" aria-label="Remove the stored ${r(o)} credential">Remove</button>
+</div>`}function x(e,t){const{auth:n}=e.scheme,{noun:o,placeholder:s}=P[n.kind];return k({view:e,field:"secret",type:"password",label:e.isStored?`Replace the ${o}`:Y(o),placeholder:e.isStored&&e.isMulti?"Leave empty to keep the stored value":s,hint:q(n),isRequired:t})}function z(e){return`<hr class="divider">
+<div class="scheme-head">
+<p class="strong">No token yet?</p>
+<p>We exchange your client ID and secret for a token and store only the token.</p>
+</div>
+<div class="field-row">
+${k({view:e,field:"client_id",type:"text",label:"Client ID",placeholder:"Enter the client ID",value:e.clientId})}
+${k({view:e,field:"client_secret",type:"password",label:"Client secret",placeholder:"Enter the client secret"})}
+</div>`}function k({view:e,field:t,type:n,label:o,placeholder:s,hint:a,value:u,isRequired:i}){const c=M(t,e.index),l=e.error!==void 0&&e.error.field===t,d=`${c}-hint`,m=[a?d:"",l?g:""].filter(Boolean).join(" "),p=[`type="${n}"`,`id="${c}"`,`name="${c}"`,`placeholder="${r(s)}"`,'autocomplete="off"','autocapitalize="off"','spellcheck="false"',u?`value="${r(u)}"`:"",m?`aria-describedby="${m}"`:"",l?'aria-invalid="true"':"",i?"required":"",e.autofocusField===t?"autofocus":""].filter(Boolean);return`<div class="field">
+<label for="${c}">${r(o)}</label>
+<input ${p.join(" ")}>
+${a?`<p class="muted small" id="${d}">${a}</p>`:""}
+</div>`}function K(e){if(!e||e.length===0)return"";const t=e.slice(0,S).map(s=>`<li>${h(s)}</li>`).join(""),n=e.length-S,o=n>0?`<li class="muted">and ${n} more</li>`:"";return`<details class="operations"><summary>Which operations use it</summary><ul>${t}${o}</ul></details>`}function W({name:e,subject:t,expiresAt:n},o){const s=`${v.shield}What happens to your credentials`,a=`<ol class="steps">
+<li>Sent straight to ${r(o)}, never through your AI client</li>
+<li>Stored encrypted and never shown again</li>
+<li>Added only to calls to ${r(e)} from the AI client that asked for this link</li>
+<li>You can delete them anytime</li>
+</ol>`;return`<aside class="panel" aria-labelledby="panel-title">
+<div class="panel-steps"><h2 id="panel-title">${s}</h2>${a}</div>
+<details class="panel-steps-toggle"><summary><h2>${s}</h2></summary>${a}</details>
+<div class="link-facts">
+<p>Link requested at ${b(n-_)} UTC</p>
+<span class="pill">Open until ${b(n)} UTC</span>
+<p>This link works one time.</p>
+<p>Kept for ${V(I(t))} after you save them.</p>
+<p>To delete them, ask your AI client for a new link.</p>
+</div>
+</aside>`}function H(e,t,n,o){const s=n.filter(i=>i.isStored).map(i=>`<form id="remove-${i.index}" method="post" action="${e}">${y(t,$.remove)}<input type="hidden" name="scheme" value="${i.index}"></form>`),a=o?`<form id="remove-all" method="post" action="${e}">${y(t,$.removeAll)}</form>`:"",u=`<form id="decline" method="post" action="${e}">${y(t,$.decline)}</form>`;return[...s,a,u].join(`
+`)}function y(e,t){return`<input type="hidden" name="token" value="${r(e)}"><input type="hidden" name="action" value="${t}">`}function E(e){return e.kind==="apiKey"?`Sent to the API as the ${h(e.header)} header.`:e.kind==="cookie"?`Sent to the API as the ${h(e.name)} cookie.`:`Sent to the API as the ${h("Authorization")} header.`}function q(e){if(e.kind==="cookie")return`Paste only the value. We send it as ${h(`${e.name}=<value>`)}.`;if(e.kind==="raw")return`Paste the full header value, for example ${h("Bearer <token>")}.`}function b(e){return new Date(e).toISOString().slice(11,16)}function V(e){const t=e/86400;return Number.isInteger(t)&&t>1?`${t} days`:`${Math.round(e/3600)} hours`}function Y(e){return e.charAt(0).toUpperCase()+e.slice(1)}export{te as formPage};

package/dist/server/plugins/mcp/handlers/credentials-page/layout.d.ts

@@ -0,0 +1,17 @@
+import type { ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { PageColorScheme, PageContent, PageSite } from './types.js';
+export declare function escapeHtml(value: string): string;
+/** The API name, plus the scheme when the link names one scheme of a multi-scheme API. */
+export declare function targetTitle({ name, schemeLabel, schemes }: ElicitationTarget): string;
+export declare function code(value: string): string;
+export declare function htmlDocument({ title, body }: PageContent, colorScheme: PageColorScheme | undefined): string;
+export declare function siteHeader({ name, logo, host, colorScheme }: PageSite): string;
+export declare const ICONS: {
+    readonly shield: '<svg width="20" height="20" viewBox="0 0 20 20" fill="none" aria-hidden="true"><path d="M10 2.5 3.75 4.8v4.7c0 3.9 2.6 6.9 6.25 8 3.65-1.1 6.25-4.1 6.25-8V4.8L10 2.5Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="m7.3 10 1.9 1.9 3.6-3.8" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+    readonly alert: '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><circle cx="8" cy="8" r="6.25" stroke="currentColor" stroke-width="1.5"/><path d="m3.8 12.2 8.4-8.4" stroke="currentColor" stroke-width="1.5"/></svg>';
+    readonly warning: '<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M8 2.2 1.9 13h12.2L8 2.2Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="M8 6.5v3" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><circle cx="8" cy="11.3" r=".8" fill="currentColor"/></svg>';
+    readonly check: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m4.5 9.2 3 3 6-6.4" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+    readonly cross: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m5.5 5.5 7 7m0-7-7 7" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"/></svg>';
+    readonly clock: '<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><circle cx="9" cy="9" r="5.75" stroke="currentColor" stroke-width="1.6"/><path d="M9 6v3.2l2 1.3" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>';
+};
+//# sourceMappingURL=layout.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/layout.js

@@ -0,0 +1,11 @@
+import{pageStyles as l}from"./styles.js";function o(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;").replaceAll("'","&#39;")}function a({name:e,schemeLabel:r,schemes:t}){return t&&t.length>1?e:r?`${e} (${r})`:e}function h(e){return`<code>${o(e)}</code>`}function u({title:e,body:r},t){return`<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="robots" content="noindex">
+<title>${o(e)}</title>
+<style>${l(t)}</style>
+</head>
+<body>${r}</body>
+</html>`}function k({name:e,logo:r,host:t,colorScheme:i}){const n=r?d(r,e??t,i):`<span class="site-name">${o(e??t)}</span>`,s=r||e?`<span class="site-host">${o(t)}</span>`:"";return`<header class="site">${n}${s}</header>`}function d(e,r,t){const i=n=>`<img class="site-logo" src="${o(n)}" alt="${o(r)}">`;return!e.dark||t==="light"?i(e.light):t==="dark"?i(e.dark):`<picture><source srcset="${o(e.dark)}" media="(prefers-color-scheme: dark)">${i(e.light)}</picture>`}const p={shield:'<svg width="20" height="20" viewBox="0 0 20 20" fill="none" aria-hidden="true"><path d="M10 2.5 3.75 4.8v4.7c0 3.9 2.6 6.9 6.25 8 3.65-1.1 6.25-4.1 6.25-8V4.8L10 2.5Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="m7.3 10 1.9 1.9 3.6-3.8" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/></svg>',alert:'<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><circle cx="8" cy="8" r="6.25" stroke="currentColor" stroke-width="1.5"/><path d="m3.8 12.2 8.4-8.4" stroke="currentColor" stroke-width="1.5"/></svg>',warning:'<svg width="16" height="16" viewBox="0 0 16 16" fill="none" aria-hidden="true"><path d="M8 2.2 1.9 13h12.2L8 2.2Z" stroke="currentColor" stroke-width="1.5" stroke-linejoin="round"/><path d="M8 6.5v3" stroke="currentColor" stroke-width="1.5" stroke-linecap="round"/><circle cx="8" cy="11.3" r=".8" fill="currentColor"/></svg>',check:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m4.5 9.2 3 3 6-6.4" stroke="currentColor" stroke-width="1.8" stroke-linecap="round" stroke-linejoin="round"/></svg>',cross:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><path d="m5.5 5.5 7 7m0-7-7 7" stroke="currentColor" stroke-width="1.8" stroke-linecap="round"/></svg>',clock:'<svg width="18" height="18" viewBox="0 0 18 18" fill="none" aria-hidden="true"><circle cx="9" cy="9" r="5.75" stroke="currentColor" stroke-width="1.6"/><path d="M9 6v3.2l2 1.3" stroke="currentColor" stroke-width="1.6" stroke-linecap="round" stroke-linejoin="round"/></svg>'};export{p as ICONS,h as code,o as escapeHtml,u as htmlDocument,k as siteHeader,a as targetTitle};

package/dist/server/plugins/mcp/handlers/credentials-page/outcome-pages.d.ts

@@ -0,0 +1,10 @@
+import type { ElicitationTarget } from '../../gateway-mcp/secret-store.js';
+import type { CredentialsOutcome, PageContent } from './types.js';
+type Tone = 'success' | 'danger' | 'neutral' | 'warning';
+export declare function outcomePage(target: ElicitationTarget, { action, schemes, stored }: CredentialsOutcome): PageContent;
+export declare function declinedPage(): PageContent;
+export declare function expiredPage(): PageContent;
+/** A centered status card; `lines` are trusted HTML. */
+export declare function statusPage(tone: Tone, title: string, lines: readonly string[]): PageContent;
+export {};
+//# sourceMappingURL=outcome-pages.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/outcome-pages.js

@@ -0,0 +1,11 @@
+import{ELICITATION_TTL_MINUTES as p}from"../../gateway-mcp/secret-store.js";import{credentialSchemesOf as $}from"./form-contract.js";import{ICONS as a,code as f,escapeHtml as r,targetTitle as k}from"./layout.js";const v={success:a.check,danger:a.cross,neutral:a.cross,warning:a.clock};function y(n,{action:e,schemes:o,stored:t}){const s=e==="saved",i=$(n).length>1,c=r(n.name),d=t.filter(m=>!o.includes(m)),g=i?`We ${e} ${u(o)} for ${c}.`:`We ${e} your credentials for ${r(k(n))}.`,h=t.length===0?`Calls to ${c} now go without credentials.`:d.length>0?`${s?"Also stored":"Still stored"}: ${u(d)}.`:"";return l(s?"success":"danger",s?"Credentials saved":"Credentials removed",[g,h,s?"Go back to your AI client and tell it that you saved them.":""])}function S(){return l("neutral","Link declined",["We saved nothing, and this link no longer works.","If you did not ask for this link, tell your AI client to stop."])}function A(){return l("warning","This link no longer works",[`The link is not valid, was already used, or is older than ${p} minutes.`,"Ask your AI client for a new link."])}function l(n,e,o){const t=o.filter(Boolean).map(i=>`<p>${i}</p>`).join(`
+`),s=n==="warning"?"":'<p class="muted small">You can close this tab.</p>';return{title:e,body:`<div class="page narrow">
+<main class="card outcome">
+<span class="status-icon ${n}">${v[n]}</span>
+<h1>${r(e)}</h1>
+<div class="message">
+${t}
+${s}
+</div>
+</main>
+</div>`}}function u(n){const e=n.map(f);return e.length>1?`${e.slice(0,-1).join(", ")} and ${e.at(-1)}`:e.join("")}export{S as declinedPage,A as expiredPage,y as outcomePage,l as statusPage};

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.d.ts

@@ -0,0 +1,10 @@
+import type { RedoclyConfig } from '@redocly/config';
+import type { GlobalData } from '../../../../../types/index.js';
+import type { SiteBranding } from './types.js';
+/** `logo` is the resolved theme logo from global data, whose paths point at served assets. */
+export declare function resolveSiteBranding({ seo, logo, colorMode, }: {
+    seo?: RedoclyConfig['seo'];
+    logo?: GlobalData['logo'];
+    colorMode?: RedoclyConfig['colorMode'];
+}): SiteBranding;
+//# sourceMappingURL=site-branding.d.ts.map

package/dist/server/plugins/mcp/handlers/credentials-page/site-branding.js

@@ -0,0 +1 @@
+import{parseSrcSet as h}from"../../../../utils/attribute-parser.js";function o({seo:t,logo:e,colorMode:d}){const n=t?.title||t?.projectTitle||e?.altText||void 0,i=e?.srcSet?h(e.srcSet):new Map,r=s(i.get("light")??e?.image),a=s(i.get("dark")),c=f(d);return{...n?{name:n}:{},...r?{logo:{light:r,...a?{dark:a}:{}}}:{},...c?{colorScheme:c}:{}}}function f(t){if(t?.hide)return"light";if(t?.ignoreDetection)return t.modes?.[0]==="dark"?"dark":"light"}function s(t){return t?.startsWith("/")&&!t.startsWith("//")?t:void 0}export{o as resolveSiteBranding};

package/dist/server/plugins/mcp/handlers/credentials-page/styles.d.ts

@@ -0,0 +1,4 @@
+import type { PageColorScheme } from './types.js';
+/** The page CSS. Without a fixed color scheme, the page follows the system setting. */
+export declare function pageStyles(colorScheme: PageColorScheme | undefined): string;
+//# sourceMappingURL=styles.d.ts.map