@agent-proxy-kit/puraroute-mcp-server 0.0.0-stage → 0.1.1

package/dist/catalog/operations.js

@@ -0,0 +1,83 @@
+export const HTTP_METHODS = [
+    "get",
+    "post",
+    "put",
+    "patch",
+    "delete",
+];
+const obj = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : {};
+export function collectOperations(document, basePath, version) {
+    if (document.webhooks !== undefined)
+        throw new Error("webhooks are unsupported in the customer business catalog");
+    const paths = obj(document.paths);
+    const operations = [];
+    const seen = new Set();
+    for (const [path, pathValue] of Object.entries(paths)) {
+        const item = obj(pathValue);
+        for (const method of ["head", "options", "trace"]) {
+            if (item[method] !== undefined)
+                throw new Error(`${method.toUpperCase()} ${path}: unsupported HTTP method`);
+        }
+        if (item.servers !== undefined)
+            throw new Error(`${path}: path-level servers are unsupported`);
+        const effective = `${basePath}${path}`;
+        if (!effective.startsWith("/gin/open-api/v1/") ||
+            path.includes("..") ||
+            path.includes("?") ||
+            path.includes("#")) {
+            throw new Error(`${path}: operation path is outside /gin/open-api/v1/`);
+        }
+        for (const method of HTTP_METHODS) {
+            if (item[method] === undefined)
+                continue;
+            const raw = obj(item[method]);
+            const label = `${method.toUpperCase()} ${path}`;
+            if (raw.servers !== undefined)
+                throw new Error(`${label}: operation-level servers are unsupported`);
+            if (raw.callbacks !== undefined)
+                throw new Error(`${label}: callbacks are unsupported`);
+            const operationId = raw.operationId;
+            if (typeof operationId !== "string" ||
+                !/^[A-Za-z][A-Za-z0-9_-]*$/.test(operationId)) {
+                throw new Error(`${label}: missing or invalid operationId`);
+            }
+            if (seen.has(operationId))
+                throw new Error(`${operationId}: duplicate operationId`);
+            seen.add(operationId);
+            const summary = raw.summary;
+            if (typeof summary !== "string" || !summary.trim())
+                throw new Error(`${operationId}: missing useful summary`);
+            const parameters = [
+                ...(Array.isArray(item.parameters) ? item.parameters : []),
+                ...(Array.isArray(raw.parameters) ? raw.parameters : []),
+            ];
+            const responses = obj(raw.responses);
+            const schemaOf = (value) => obj(obj(obj(value).content)["application/json"]).schema;
+            const success = Object.entries(responses).find(([status, value]) => /^2\d\d$/.test(status) && schemaOf(value) !== undefined);
+            const successResponseSchema = success
+                ? obj(schemaOf(success[1]))
+                : undefined;
+            operations.push({
+                operationId,
+                method,
+                pathTemplate: effective,
+                summary,
+                description: typeof raw.description === "string" ? raw.description : "",
+                inputSchema: {
+                    type: "object",
+                    properties: {},
+                    additionalProperties: false,
+                },
+                ...(successResponseSchema ? { successResponseSchema } : {}),
+                parameters: parameters.map(obj),
+                ...(raw.requestBody !== undefined
+                    ? { requestBody: obj(raw.requestBody) }
+                    : {}),
+                openapiVersion: version,
+            });
+        }
+    }
+    return operations.sort((a, b) => a.operationId.localeCompare(b.operationId, "en"));
+}

package/dist/catalog/project-schema.js

@@ -0,0 +1,192 @@
+import { newInputValidator } from "./input-validator.js";
+const obj = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : {};
+export const FORBIDDEN_HEADERS = new Set([
+    "x-api-key",
+    "authorization",
+    "host",
+    "cookie",
+    "traceparent",
+    "tracestate",
+    "x-request-id",
+    "x-trace-id",
+    "content-length",
+    "connection",
+    "transfer-encoding",
+    "proxy-authorization",
+]);
+export function ignoredOptionalTransportHeader(parameter) {
+    return (parameter.in === "header" &&
+        typeof parameter.name === "string" &&
+        parameter.name.toLowerCase() === "x-trace-id" &&
+        parameter.required !== true);
+}
+function projectSchema(value, version, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${label}: schema must be an object`);
+    const source = value;
+    if ("$ref" in source)
+        throw new Error(`${label}: unresolved $ref`);
+    if (source.format === "binary" || source.format === "byte")
+        throw new Error(`${label}: file upload schema is unsupported`);
+    const output = {};
+    for (const [key, item] of Object.entries(source)) {
+        if (key === "nullable" && version.startsWith("3.0."))
+            continue;
+        if (["properties", "patternProperties", "$defs", "definitions"].includes(key)) {
+            output[key] = Object.fromEntries(Object.entries(obj(item)).map(([name, child]) => [
+                name,
+                projectSchema(child, version, `${label}.${name}`),
+            ]));
+        }
+        else if (["items", "additionalProperties", "not"].includes(key) &&
+            typeof item === "object" &&
+            item !== null) {
+            output[key] = projectSchema(item, version, `${label}.${key}`);
+        }
+        else if (["allOf", "anyOf", "oneOf"].includes(key) &&
+            Array.isArray(item)) {
+            output[key] = item.map((child, index) => projectSchema(child, version, `${label}.${key}[${index}]`));
+        }
+        else if (version.startsWith("3.0.") &&
+            (key === "exclusiveMinimum" || key === "exclusiveMaximum") &&
+            typeof item === "boolean") {
+            if (item) {
+                const bound = key === "exclusiveMinimum" ? source.minimum : source.maximum;
+                if (typeof bound !== "number")
+                    throw new Error(`${label}: ${key} needs a numeric bound`);
+                output[key] = bound;
+            }
+        }
+        else if (version.startsWith("3.0.") &&
+            ((key === "minimum" && source.exclusiveMinimum === true) ||
+                (key === "maximum" && source.exclusiveMaximum === true))) {
+            continue;
+        }
+        else {
+            output[key] = item;
+        }
+    }
+    if (version.startsWith("3.0.") && source.nullable === true) {
+        if (typeof output.type === "string")
+            output.type = [output.type, "null"];
+        else
+            output.anyOf = [
+                ...(Array.isArray(output.anyOf)
+                    ? output.anyOf
+                    : [
+                        Object.fromEntries(Object.entries(output).filter(([key]) => key !== "anyOf")),
+                    ]),
+                { type: "null" },
+            ];
+    }
+    return output;
+}
+function groupSchema(properties, required) {
+    return {
+        type: "object",
+        properties,
+        additionalProperties: false,
+        ...(required.length ? { required } : {}),
+    };
+}
+export function projectOperationSchema(operation) {
+    const groups = {
+        path: {},
+        query: {},
+        headers: {},
+    };
+    const required = {
+        path: [],
+        query: [],
+        headers: [],
+    };
+    const seen = new Set();
+    for (const parameter of operation.parameters) {
+        const name = parameter.name;
+        const location = parameter.in;
+        if (typeof name !== "string" ||
+            !name ||
+            !["path", "query", "header"].includes(String(location))) {
+            throw new Error(`${operation.operationId}: unsupported ${String(location)} parameter`);
+        }
+        const place = location === "header" ? "headers" : location;
+        const key = `${location}:${name.toLowerCase()}`;
+        if (seen.has(key))
+            throw new Error(`${operation.operationId}: duplicate ${location} parameter ${name}`);
+        seen.add(key);
+        if (location === "header" && FORBIDDEN_HEADERS.has(name.toLowerCase())) {
+            if (ignoredOptionalTransportHeader(parameter))
+                continue;
+            throw new Error(`${operation.operationId}: forbidden header ${name}`);
+        }
+        if (parameter.content !== undefined)
+            throw new Error(`${operation.operationId}: parameter content is unsupported`);
+        const style = parameter.style ?? (location === "query" ? "form" : "simple");
+        if (style !== (location === "query" ? "form" : "simple") ||
+            parameter.allowReserved === true) {
+            throw new Error(`${operation.operationId}: unsupported parameter style for ${name}`);
+        }
+        if (location !== "query" && parameter.explode === true)
+            throw new Error(`${operation.operationId}: unsupported explode for ${name}`);
+        const schema = projectSchema(parameter.schema, operation.openapiVersion, `${operation.operationId}.${name}`);
+        const type = schema.type;
+        const scalar = typeof type === "string" &&
+            ["string", "integer", "number", "boolean"].includes(type);
+        const array = location === "query" &&
+            type === "array" &&
+            ["string", "integer", "number", "boolean"].includes(String(obj(schema.items).type));
+        const nullableScalar = Array.isArray(type) &&
+            type.length === 2 &&
+            type.includes("null") &&
+            type.some((part) => ["string", "integer", "number", "boolean"].includes(String(part)));
+        if (!scalar && !array && !nullableScalar)
+            throw new Error(`${operation.operationId}: unsupported parameter schema for ${name}`);
+        groups[place][name] = schema;
+        if (parameter.required === true || location === "path")
+            required[place].push(name);
+        if (location === "path" && !operation.pathTemplate.includes(`{${name}}`))
+            throw new Error(`${operation.operationId}: unmatched path parameter ${name}`);
+    }
+    for (const match of operation.pathTemplate.matchAll(/\{([^}]+)\}/g)) {
+        if (!Object.hasOwn(groups.path, match[1]))
+            throw new Error(`${operation.operationId}: missing path parameter ${match[1]}`);
+    }
+    const properties = {};
+    const topRequired = [];
+    for (const place of ["path", "query", "headers"]) {
+        if (Object.keys(groups[place]).length) {
+            properties[place] = groupSchema(groups[place], required[place]);
+            if (required[place].length)
+                topRequired.push(place);
+        }
+    }
+    if (operation.requestBody) {
+        const content = obj(operation.requestBody.content);
+        if (Object.keys(content).length !== 1 || !("application/json" in content))
+            throw new Error(`${operation.operationId}: only application/json request bodies are supported`);
+        properties.body = projectSchema(obj(content["application/json"]).schema, operation.openapiVersion, `${operation.operationId}.body`);
+        if (operation.requestBody.required === true)
+            topRequired.push("body");
+    }
+    const schema = groupSchema(properties, topRequired);
+    if (operation.inputConstraints)
+        schema.allOf = [operation.inputConstraints];
+    return schema;
+}
+export function projectCatalogSchemas(operations) {
+    const schemas = operations.map(projectOperationSchema);
+    const validator = newInputValidator();
+    schemas.forEach((schema, index) => {
+        try {
+            validator.compile(schema);
+        }
+        catch {
+            throw new Error(`${operations[index].operationId}: projected JSON Schema is invalid`);
+        }
+    });
+    operations.forEach((operation, index) => {
+        operation.inputSchema = schemas[index];
+    });
+}

package/dist/cli.js

@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+import { access, readFile } from "node:fs/promises";
+import { createHash } from "node:crypto";
+import { dirname, isAbsolute, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { readBrandProfile } from "./brand.js";
+import { loadCatalog } from "./catalog/load.js";
+import { projectCatalogSchemas } from "./catalog/project-schema.js";
+import { readConfig } from "./config.js";
+import { startStdio } from "./transports/stdio.js";
+const ownDir = dirname(fileURLToPath(import.meta.url));
+async function bundleContract(bundleDir) {
+    const found = [];
+    for (const name of ["business-openapi.yaml", "business-openapi.json"]) {
+        const candidate = join(bundleDir, name);
+        try {
+            await access(candidate);
+            found.push(candidate);
+        }
+        catch {
+            /* try next supported format */
+        }
+    }
+    if (found.length !== 1)
+        throw new Error("Bundle requires exactly one business OpenAPI file");
+    return found[0];
+}
+async function verifyBundleManifest(bundleDir, contractSha256, operations, brandVersion, runtimeVersion) {
+    let manifest;
+    try {
+        manifest = JSON.parse(await readFile(join(bundleDir, "bundle-manifest.json"), "utf8"));
+    }
+    catch {
+        throw new Error("Missing or invalid bundle-manifest.json");
+    }
+    if (!manifest ||
+        typeof manifest !== "object" ||
+        Array.isArray(manifest) ||
+        Object.keys(manifest).sort().join(",") !==
+            [
+                "bundleVersion",
+                "contractSha256",
+                "operations",
+                "runtimeVersion",
+                "toolSchemasSha256",
+            ]
+                .sort()
+                .join(","))
+        throw new Error("Invalid bundle-manifest.json");
+    const toolHash = createHash("sha256")
+        .update(JSON.stringify(operations.map((op) => [op.operationId, op.inputSchema])))
+        .digest("hex");
+    if (manifest.bundleVersion !== brandVersion ||
+        manifest.runtimeVersion !== runtimeVersion ||
+        manifest.contractSha256 !== contractSha256 ||
+        manifest.toolSchemasSha256 !== toolHash ||
+        JSON.stringify(manifest.operations) !==
+            JSON.stringify(operations.map((op) => op.operationId)))
+        throw new Error("Bundle manifest mismatch");
+}
+async function readPolicy(contractPath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(join(dirname(contractPath), "adapter-policy.json"), "utf8"));
+    }
+    catch {
+        throw new Error("Missing or invalid adapter-policy.json beside the contract");
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        throw new Error("Invalid adapter policy");
+    const policy = parsed;
+    const envelope = policy.envelope;
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope))
+        throw new Error("Invalid adapter policy envelope");
+    const fields = envelope;
+    if (!["code", "message", "data", "next"].every((name) => typeof fields[name] === "string" && fields[name].length > 0))
+        throw new Error("Invalid adapter policy envelope fields");
+    if (!Array.isArray(policy.successCodes) ||
+        policy.successCodes.length === 0 ||
+        !policy.successCodes.every((value) => typeof value === "string" || typeof value === "number"))
+        throw new Error("Invalid adapter policy success codes");
+    if (policy.successHttpStatuses !== undefined &&
+        (!Array.isArray(policy.successHttpStatuses) ||
+            !policy.successHttpStatuses.every((value) => Number.isInteger(value) && value >= 200 && value < 300)))
+        throw new Error("Invalid adapter policy success HTTP statuses");
+    if (policy.requiredResponseFields !== undefined &&
+        (!Array.isArray(policy.requiredResponseFields) ||
+            !policy.requiredResponseFields.every((value) => typeof value === "string")))
+        throw new Error("Invalid adapter policy required response fields");
+    return parsed;
+}
+async function main() {
+    const check = process.argv[2] === "--check-contract";
+    if (check) {
+        const path = process.argv[3];
+        if (!path || !isAbsolute(path) || process.argv.length !== 4)
+            throw new Error("--check-contract requires one absolute local file path");
+        const catalog = await loadCatalog(path);
+        projectCatalogSchemas(catalog.operations);
+        process.stdout.write(`OpenAPI ${catalog.openapiVersion}\nSHA-256 ${catalog.contractSha256}\nOperations ${catalog.operations.length}\n${catalog.operations.map((op) => op.operationId).join("\n")}\n`);
+        return;
+    }
+    if (process.argv.length !== 2)
+        throw new Error("Unknown CLI argument");
+    const bundleDir = process.env.PROXY_AGENT_BUNDLE_DIR;
+    if (!bundleDir || !isAbsolute(bundleDir))
+        throw new Error("PROXY_AGENT_BUNDLE_DIR must be an absolute directory");
+    const brand = await readBrandProfile(bundleDir);
+    const contractPath = await bundleContract(bundleDir);
+    let catalog;
+    try {
+        catalog = await loadCatalog(contractPath);
+        projectCatalogSchemas(catalog.operations);
+    }
+    catch {
+        throw new Error("Invalid business OpenAPI in bundle");
+    }
+    const adapterPolicy = await readPolicy(contractPath);
+    const config = readConfig(process.env, contractPath, adapterPolicy);
+    let packageJson;
+    try {
+        packageJson = JSON.parse(await readFile(join(ownDir, "..", "package.json"), "utf8"));
+    }
+    catch {
+        throw new Error("Invalid runtime installation");
+    }
+    await verifyBundleManifest(bundleDir, catalog.contractSha256, catalog.operations, brand.version, packageJson.runtimeVersion ?? packageJson.version);
+    startStdio({ catalog, config }, packageJson.version, brand.serverName);
+}
+main().catch((error) => {
+    const message = error instanceof Error ? error.message : "Unexpected startup failure";
+    const key = process.env.PROXY_AGENT_API_KEY;
+    process.stderr.write(`${key ? message.replaceAll(key, "[REDACTED]") : message}\n`);
+    process.exitCode = 1;
+});

package/dist/config.js

@@ -0,0 +1,32 @@
+export function readConfig(env, contractPath, adapterPolicy) {
+    const originText = env.PROXY_AGENT_API_ORIGIN;
+    if (!originText)
+        throw new Error("Missing PROXY_AGENT_API_ORIGIN");
+    let apiOrigin;
+    try {
+        apiOrigin = new URL(originText);
+    }
+    catch {
+        throw new Error("Invalid API origin");
+    }
+    if (apiOrigin.protocol !== "https:")
+        throw new Error("API origin must use HTTPS");
+    if (apiOrigin.pathname !== "/" ||
+        apiOrigin.search ||
+        apiOrigin.hash ||
+        apiOrigin.username ||
+        apiOrigin.password) {
+        throw new Error("API origin must contain only a scheme and host");
+    }
+    const apiKey = env.PROXY_AGENT_API_KEY;
+    if (!apiKey?.trim())
+        throw new Error("Missing PROXY_AGENT_API_KEY");
+    const timeoutText = env.PROXY_AGENT_REQUEST_TIMEOUT_MS;
+    const requestTimeoutMs = timeoutText === undefined ? 15_000 : Number(timeoutText);
+    if (!Number.isSafeInteger(requestTimeoutMs) ||
+        requestTimeoutMs < 100 ||
+        requestTimeoutMs > 120_000) {
+        throw new Error("Invalid request timeout");
+    }
+    return { apiOrigin, apiKey, contractPath, requestTimeoutMs, adapterPolicy };
+}

package/dist/runtime/execute-operation.js

@@ -0,0 +1,161 @@
+import { LosslessNumber, parse } from "lossless-json";
+import { newInputValidator } from "../catalog/input-validator.js";
+import { FORBIDDEN_HEADERS, ignoredOptionalTransportHeader, projectOperationSchema, } from "../catalog/project-schema.js";
+import { adaptResponse, toolError } from "./response.js";
+import { safeIdentifier } from "./secrets.js";
+const obj = (value) => value !== null && typeof value === "object" && !Array.isArray(value)
+    ? value
+    : {};
+const writeMethod = (method) => method !== "get";
+function ordinaryJson(value) {
+    if (value instanceof LosslessNumber) {
+        const numeric = Number(value.value);
+        return /^-?(?:0|[1-9]\d*)$/.test(value.value) &&
+            Number.isSafeInteger(numeric)
+            ? numeric
+            : value.value;
+    }
+    if (Array.isArray(value))
+        return value.map(ordinaryJson);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([key, child]) => [
+            key,
+            ordinaryJson(child),
+        ]));
+    }
+    return value;
+}
+function redactAccountKey(value, apiKey) {
+    if (typeof value === "string")
+        return value.replaceAll(apiKey, "[REDACTED]");
+    if (Array.isArray(value))
+        return value.map((item) => redactAccountKey(item, apiKey));
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([name]) => !["api_key", "apikey", "x-api-key"].includes(name.toLowerCase()))
+            .map(([name, item]) => [name, redactAccountKey(item, apiKey)]));
+    }
+    return value;
+}
+function validatedArgs(operation, args) {
+    const validator = newInputValidator();
+    const valid = validator.compile(projectOperationSchema(operation));
+    return valid(args) ? args : undefined;
+}
+function requestUrl(operation, args, config) {
+    if (!operation.pathTemplate.startsWith("/gin/open-api/v1/") ||
+        operation.pathTemplate.includes("..") ||
+        operation.pathTemplate.includes("\\") ||
+        operation.pathTemplate.includes("//")) {
+        throw new Error("Unsafe approved operation path");
+    }
+    const pathArgs = obj(args.path);
+    const path = operation.pathTemplate.replace(/\{([^}]+)\}/g, (_match, name) => {
+        const value = pathArgs[name];
+        if (value === undefined ||
+            value === null ||
+            value === "." ||
+            value === ".." ||
+            String(value).includes("/") ||
+            String(value).includes("\\"))
+            throw new Error("Unsafe path argument");
+        return encodeURIComponent(String(value));
+    });
+    if (path.includes("{") || path.includes("}"))
+        throw new Error("Unresolved path template");
+    const url = new URL(path, config.apiOrigin);
+    if (url.origin !== config.apiOrigin.origin ||
+        !url.pathname.startsWith("/gin/open-api/v1/"))
+        throw new Error("Unsafe target URL");
+    const query = obj(args.query);
+    for (const parameter of operation.parameters.filter((item) => item.in === "query")) {
+        const name = String(parameter.name);
+        const value = query[name];
+        if (value === undefined || value === null)
+            continue;
+        if (Array.isArray(value)) {
+            if (parameter.explode === false)
+                url.searchParams.append(name, value.map(String).join(","));
+            else
+                value.forEach((item) => url.searchParams.append(name, String(item)));
+        }
+        else
+            url.searchParams.append(name, String(value));
+    }
+    return url;
+}
+export async function executeOperation(operation, args, config) {
+    const isHttps = config.apiOrigin.protocol === "https:";
+    const isLoopback = config.apiOrigin.protocol === "http:" &&
+        ["127.0.0.1", "localhost", "[::1]"].includes(config.apiOrigin.hostname);
+    if (!isHttps && !isLoopback)
+        return toolError("configuration_error", "API origin must use HTTPS");
+    const input = validatedArgs(operation, args);
+    if (!input)
+        return toolError("input_error", `Invalid arguments for ${operation.operationId}`);
+    let url;
+    try {
+        url = requestUrl(operation, input, config);
+    }
+    catch {
+        return toolError("input_error", `Unsafe URL composition for ${operation.operationId}`);
+    }
+    const headers = new Headers({
+        "X-API-Key": config.apiKey,
+        Accept: "application/json",
+    });
+    for (const parameter of operation.parameters.filter((item) => item.in === "header")) {
+        if (ignoredOptionalTransportHeader(parameter))
+            continue;
+        const name = String(parameter.name);
+        if (FORBIDDEN_HEADERS.has(name.toLowerCase()))
+            return toolError("input_error", `Forbidden header for ${operation.operationId}`);
+        const value = obj(input.headers)[name];
+        if (value !== undefined && value !== null)
+            headers.set(name, String(value));
+    }
+    let body;
+    if (input.body !== undefined) {
+        body = JSON.stringify(input.body);
+        headers.set("Content-Type", "application/json");
+    }
+    const candidateRequestNo = safeIdentifier(obj(input.body).request_no);
+    const requestNo = candidateRequestNo === config.apiKey ? undefined : candidateRequestNo;
+    let response;
+    try {
+        response = await fetch(url, {
+            method: operation.method.toUpperCase(),
+            headers,
+            ...(body === undefined ? {} : { body }),
+            redirect: "manual",
+            signal: AbortSignal.timeout(config.requestTimeoutMs),
+        });
+    }
+    catch (error) {
+        const timeout = error instanceof Error &&
+            (error.name === "TimeoutError" || error.name === "AbortError");
+        if (timeout && writeMethod(operation.method)) {
+            return toolError("uncertain_write_result", `The ${operation.operationId} request timed out after submission. Check orders or resources with a read-only lookup before another write.${requestNo ? ` Request number: ${requestNo}.` : ""}`, requestNo
+                ? { operationId: operation.operationId, requestNo }
+                : { operationId: operation.operationId });
+        }
+        return toolError(timeout ? "timeout" : "network_error", timeout
+            ? `Request timed out for ${operation.operationId}`
+            : `Network request failed for ${operation.operationId}`);
+    }
+    const traceId = response.headers.get("x-request-id") ??
+        response.headers.get("x-trace-id") ??
+        undefined;
+    if (response.status >= 300 && response.status < 400)
+        return toolError("redirect_blocked", `Redirect blocked for ${operation.operationId}`);
+    if (!response.ok)
+        return adaptResponse(response.status, undefined, traceId, config.adapterPolicy);
+    let parsed;
+    try {
+        parsed = redactAccountKey(ordinaryJson(parse(await response.text())), config.apiKey);
+    }
+    catch {
+        return toolError("malformed_json", `Invalid JSON response for ${operation.operationId}`);
+    }
+    return adaptResponse(response.status, parsed, traceId, config.adapterPolicy);
+}

package/dist/runtime/register-openapi.js

@@ -0,0 +1,12 @@
+import { fromJsonSchema, } from "@modelcontextprotocol/server";
+import { projectCatalogSchemas } from "../catalog/project-schema.js";
+import { executeOperation } from "./execute-operation.js";
+export function registerOpenApiTools(server, catalog, config, executor = executeOperation) {
+    projectCatalogSchemas(catalog.operations);
+    for (const operation of catalog.operations) {
+        server.registerTool(operation.operationId, {
+            description: operation.description || operation.summary,
+            inputSchema: fromJsonSchema(operation.inputSchema),
+        }, async (args) => executor(operation, args, config));
+    }
+}

package/dist/runtime/register-tools.js

@@ -0,0 +1,4 @@
+import { registerOpenApiTools } from "./register-openapi.js";
+export function registerTools(server, context) {
+    registerOpenApiTools(server, context.catalog, context.config);
+}

package/dist/runtime/response.js

@@ -0,0 +1,44 @@
+import { safeIdentifier } from "./secrets.js";
+export function toolError(kind, message, details = {}) {
+    const structuredContent = { error: kind, message, ...details };
+    return {
+        isError: true,
+        structuredContent,
+        content: [{ type: "text", text: `${kind}: ${message}` }],
+    };
+}
+export function adaptResponse(status, body, traceId, policy) {
+    const safeTrace = safeIdentifier(traceId);
+    if (status < 200 || status >= 300)
+        return toolError("http_error", `HTTP ${status}`, safeTrace ? { traceId: safeTrace } : {});
+    if (policy.successHttpStatuses &&
+        !policy.successHttpStatuses.includes(status))
+        return toolError("http_error", `Unexpected HTTP ${status}`);
+    if (!body || typeof body !== "object" || Array.isArray(body))
+        return toolError("malformed_json", "Expected a JSON object");
+    const record = body;
+    if (policy.requiredResponseFields?.some((field) => !Object.hasOwn(record, field)))
+        return toolError("malformed_json", "Missing required response envelope field");
+    const code = record[policy.envelope.code];
+    const structuredContent = {
+        ...record,
+        ...(safeTrace ? { traceId: safeTrace } : {}),
+    };
+    const success = policy.successCodes.some((item) => item === code);
+    if (!success) {
+        return {
+            isError: true,
+            structuredContent,
+            content: [
+                {
+                    type: "text",
+                    text: `business_error: code ${String(code ?? "missing")}`,
+                },
+            ],
+        };
+    }
+    return {
+        structuredContent,
+        content: [{ type: "text", text: JSON.stringify(structuredContent) }],
+    };
+}

package/dist/runtime/secrets.js

@@ -0,0 +1,5 @@
+export function safeIdentifier(value) {
+    if (typeof value !== "string" || !/^[A-Za-z0-9._:-]{1,128}$/.test(value))
+        return undefined;
+    return value;
+}