@frontmcp/adapters 1.0.4 → 1.1.0-beta.1

package/openapi/index.js

@@ -42,156 +42,248 @@ var import_sdk4 = require("@frontmcp/sdk");
 var import_mcp_from_openapi2 = require("mcp-from-openapi");
 
 // libs/adapters/src/openapi/openapi.tool.ts
-var import_zod2 = require("zod");
-var import_sdk2 = require("@frontmcp/sdk");
 var import_zod_from_json_schema = require("zod-from-json-schema");
+var import_lazy_zod2 = require("@frontmcp/lazy-zod");
+var import_sdk2 = require("@frontmcp/sdk");
 
-// libs/adapters/src/openapi/openapi.utils.ts
-var import_utils = require("@frontmcp/utils");
-var import_sdk = require("@frontmcp/sdk");
-function coerceToString(value, paramName, location) {
-  if (value === null || value === void 0) {
-    return "";
+// libs/adapters/src/openapi/openapi.frontmcp-schema.ts
+var import_lazy_zod = require("@frontmcp/lazy-zod");
+var FRONTMCP_SCHEMA_VERSION = "1.0";
+var SUPPORTED_VERSIONS = ["1.0"];
+var FrontMcpAnnotationsSchema = import_lazy_zod.z.object({
+  /** Human-readable title for the tool */
+  title: import_lazy_zod.z.string().optional(),
+  /** If true, the tool does not modify its environment */
+  readOnlyHint: import_lazy_zod.z.boolean().optional(),
+  /** If true, the tool may perform destructive updates */
+  destructiveHint: import_lazy_zod.z.boolean().optional(),
+  /** If true, calling repeatedly with same args has no additional effect */
+  idempotentHint: import_lazy_zod.z.boolean().optional(),
+  /** If true, tool may interact with external entities */
+  openWorldHint: import_lazy_zod.z.boolean().optional()
+});
+var FrontMcpCacheSchema = import_lazy_zod.z.object({
+  /** Time-to-live in seconds for cached responses */
+  ttl: import_lazy_zod.z.number().int().positive().optional(),
+  /** If true, cache window slides on each access */
+  slideWindow: import_lazy_zod.z.boolean().optional()
+});
+var FrontMcpCodeCallSchema = import_lazy_zod.z.object({
+  /** Whether this tool can be used via CodeCall */
+  enabledInCodeCall: import_lazy_zod.z.boolean().optional(),
+  /** If true, stays visible in list_tools when CodeCall is active */
+  visibleInListTools: import_lazy_zod.z.boolean().optional()
+});
+var FrontMcpExampleSchema = import_lazy_zod.z.object({
+  /** Description of the example */
+  description: import_lazy_zod.z.string(),
+  /** Example input values */
+  input: import_lazy_zod.z.record(import_lazy_zod.z.string(), import_lazy_zod.z.any()),
+  /** Expected output (optional) */
+  output: import_lazy_zod.z.any().optional()
+});
+var KNOWN_EXTENSION_FIELDS = /* @__PURE__ */ new Set([
+  "version",
+  "annotations",
+  "cache",
+  "codecall",
+  "tags",
+  "hideFromDiscovery",
+  "examples"
+]);
+var KNOWN_ANNOTATION_FIELDS = /* @__PURE__ */ new Set([
+  "title",
+  "readOnlyHint",
+  "destructiveHint",
+  "idempotentHint",
+  "openWorldHint"
+]);
+var KNOWN_CACHE_FIELDS = /* @__PURE__ */ new Set(["ttl", "slideWindow"]);
+var KNOWN_CODECALL_FIELDS = /* @__PURE__ */ new Set(["enabledInCodeCall", "visibleInListTools"]);
+function validateFrontMcpExtension(rawData, toolName, logger) {
+  const warnings = [];
+  if (rawData === null || rawData === void 0) {
+    return { success: true, data: null, warnings: [] };
   }
-  if (typeof value === "object") {
-    if (Array.isArray(value)) {
-      if (location === "query") {
-        return value.map(String).join(",");
-      }
-      throw new Error(`${location} parameter '${paramName}' cannot be an array. Received: ${JSON.stringify(value)}`);
-    }
-    throw new Error(`${location} parameter '${paramName}' cannot be an object. Received: ${JSON.stringify(value)}`);
+  if (typeof rawData !== "object" || Array.isArray(rawData)) {
+    warnings.push(`x-frontmcp must be an object, got ${Array.isArray(rawData) ? "array" : typeof rawData}`);
+    logger.warn(`[${toolName}] Invalid x-frontmcp extension: ${warnings[0]}`);
+    return { success: false, data: null, warnings };
   }
-  return String(value);
-}
-function appendCookie(headers, name, value) {
-  if (!/^[\w!#$%&'*+\-.^`|~]+$/.test(name)) {
-    throw new Error(`Invalid cookie name: '${name}'. Cookie names must be valid tokens.`);
+  const data = rawData;
+  const version = typeof data["version"] === "string" ? data["version"] : FRONTMCP_SCHEMA_VERSION;
+  if (!SUPPORTED_VERSIONS.includes(version)) {
+    warnings.push(`Unsupported x-frontmcp version '${version}'. Supported versions: ${SUPPORTED_VERSIONS.join(", ")}`);
+    logger.warn(`[${toolName}] ${warnings[0]}`);
+    return { success: false, data: null, warnings };
   }
-  const existing = headers.get("Cookie") || "";
-  const cookiePair = `${name}=${encodeURIComponent(coerceToString(value, name, "cookie"))}`;
-  const combined = existing ? `${existing}; ${cookiePair}` : cookiePair;
-  headers.set("Cookie", combined);
+  const validData = extractValidFields(data, version, warnings);
+  if (warnings.length > 0) {
+    logger.warn(`[${toolName}] x-frontmcp extension has invalid fields that were ignored:`);
+    warnings.forEach((w) => logger.warn(`  - ${w}`));
+  }
+  return {
+    success: true,
+    data: validData,
+    warnings
+  };
 }
-function buildRequest(tool2, input, security, baseUrl) {
-  const rawBaseUrl = tool2.metadata.servers?.[0]?.url || baseUrl;
-  (0, import_utils.validateBaseUrl)(rawBaseUrl);
-  const apiBaseUrl = rawBaseUrl.replace(/\/+$/, "");
-  let path = tool2.metadata.path;
-  const queryParams = new URLSearchParams();
-  const headers = new Headers({
-    accept: "application/json",
-    ...security.headers
-  });
-  let body;
-  for (const mapper of tool2.mapper) {
-    if (mapper.security) continue;
-    const value = input[mapper.inputKey];
-    if (value === void 0 || value === null) {
-      if (mapper.required) {
-        throw new Error(
-          `Required ${mapper.type} parameter '${mapper.key}' (input: '${mapper.inputKey}') is missing for operation '${tool2.name}'`
-        );
-      }
-      continue;
+function extractValidFields(data, version, warnings) {
+  const result = {
+    version
+  };
+  for (const key of Object.keys(data)) {
+    if (!KNOWN_EXTENSION_FIELDS.has(key)) {
+      warnings.push(`Unknown field '${key}' in x-frontmcp (will be ignored)`);
     }
-    switch (mapper.type) {
-      case "path":
-        path = path.replaceAll(`{${mapper.key}}`, encodeURIComponent(coerceToString(value, mapper.key, "path")));
-        break;
-      case "query":
-        queryParams.set(mapper.key, coerceToString(value, mapper.key, "query"));
-        break;
-      case "header": {
-        const headerValue = coerceToString(value, mapper.key, "header");
-        if (/[\r\n\x00\f\v]/.test(headerValue)) {
-          throw new import_sdk.PublicMcpError(
-            `Invalid header value for '${mapper.key}': contains control characters (possible header injection attack)`,
-            "INVALID_HEADER_VALUE",
-            400
-          );
-        }
-        headers.set(mapper.key, headerValue);
-        break;
-      }
-      case "cookie":
-        appendCookie(headers, mapper.key, value);
-        break;
-      case "body":
-        if (!body) body = {};
-        body[mapper.key] = value;
-        break;
-      default:
-        throw new Error(
-          `Unknown mapper type '${mapper.type}' for parameter '${mapper.key}' in operation '${tool2.name}'`
-        );
+  }
+  if (data["annotations"] !== void 0) {
+    const annotationsResult = FrontMcpAnnotationsSchema.safeParse(data["annotations"]);
+    if (annotationsResult.success) {
+      result.annotations = annotationsResult.data;
+    } else {
+      const issues = formatZodIssues(annotationsResult.error.issues, "annotations");
+      warnings.push(...issues);
+      result.annotations = extractValidAnnotations(data["annotations"], warnings);
     }
   }
-  Object.entries(security.query).forEach(([key, value]) => {
-    if (queryParams.has(key)) {
-      throw new Error(
-        `Query parameter collision: '${key}' is provided both as user input and security parameter. This could indicate a security misconfiguration in operation '${tool2.name}'.`
-      );
+  if (data["cache"] !== void 0) {
+    const cacheResult = FrontMcpCacheSchema.safeParse(data["cache"]);
+    if (cacheResult.success) {
+      result.cache = cacheResult.data;
+    } else {
+      const issues = formatZodIssues(cacheResult.error.issues, "cache");
+      warnings.push(...issues);
+      result.cache = extractValidCache(data["cache"], warnings);
     }
-    queryParams.set(key, coerceToString(value, key, "security query"));
-  });
-  if (security.cookies && Object.keys(security.cookies).length > 0) {
-    Object.entries(security.cookies).forEach(([key, value]) => {
-      appendCookie(headers, key, value);
-    });
   }
-  if (path.includes("{")) {
-    throw new Error(`Failed to resolve all path parameters in ${path} for operation ${tool2.name}`);
+  if (data["codecall"] !== void 0) {
+    const codecallResult = FrontMcpCodeCallSchema.safeParse(data["codecall"]);
+    if (codecallResult.success) {
+      result.codecall = codecallResult.data;
+    } else {
+      const issues = formatZodIssues(codecallResult.error.issues, "codecall");
+      warnings.push(...issues);
+      result.codecall = extractValidCodeCall(data["codecall"], warnings);
+    }
   }
-  const queryString = queryParams.toString();
-  const url = `${apiBaseUrl}${path}${queryString ? `?${queryString}` : ""}`;
-  return { url, headers, body };
+  if (data["tags"] !== void 0) {
+    const tagsSchema = import_lazy_zod.z.array(import_lazy_zod.z.string());
+    const tagsResult = tagsSchema.safeParse(data["tags"]);
+    if (tagsResult.success) {
+      result.tags = tagsResult.data;
+    } else {
+      warnings.push(`Invalid 'tags': expected array of strings`);
+      result.tags = extractValidTags(data["tags"]);
+    }
+  }
+  if (data["hideFromDiscovery"] !== void 0) {
+    if (typeof data["hideFromDiscovery"] === "boolean") {
+      result.hideFromDiscovery = data["hideFromDiscovery"];
+    } else {
+      warnings.push(`Invalid 'hideFromDiscovery': expected boolean, got ${typeof data["hideFromDiscovery"]}`);
+    }
+  }
+  if (data["examples"] !== void 0) {
+    const examplesSchema = import_lazy_zod.z.array(FrontMcpExampleSchema);
+    const examplesResult = examplesSchema.safeParse(data["examples"]);
+    if (examplesResult.success) {
+      result.examples = examplesResult.data;
+    } else {
+      warnings.push(`Invalid 'examples': some examples have invalid format`);
+      result.examples = extractValidExamples(data["examples"], warnings);
+    }
+  }
+  return result;
 }
-function applyAdditionalHeaders(headers, additionalHeaders) {
-  if (!additionalHeaders) return;
-  Object.entries(additionalHeaders).forEach(([key, value]) => {
-    headers.set(key, value);
-  });
+function extractValidAnnotations(data, warnings) {
+  if (typeof data !== "object" || data === null) return void 0;
+  const obj = data;
+  const result = {};
+  for (const field of KNOWN_ANNOTATION_FIELDS) {
+    if (obj[field] !== void 0) {
+      if (field === "title" && typeof obj[field] === "string") {
+        result.title = obj[field];
+      } else if (field !== "title" && typeof obj[field] === "boolean") {
+        result[field] = obj[field];
+      }
+    }
+  }
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_ANNOTATION_FIELDS.has(key)) {
+      warnings.push(`Unknown field 'annotations.${key}' (will be ignored)`);
+    }
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
 }
-var DEFAULT_MAX_RESPONSE_SIZE = 10 * 1024 * 1024;
-async function parseResponse(response, options) {
-  const maxSize = options?.maxResponseSize ?? DEFAULT_MAX_RESPONSE_SIZE;
-  const contentLength = response.headers.get("content-length");
-  if (contentLength) {
-    const length = parseInt(contentLength, 10);
-    if (!isNaN(length) && isFinite(length) && length > maxSize) {
-      throw new Error(`Response size (${length} bytes) exceeds maximum allowed (${maxSize} bytes)`);
+function extractValidCache(data, warnings) {
+  if (typeof data !== "object" || data === null) return void 0;
+  const obj = data;
+  const result = {};
+  if (typeof obj["ttl"] === "number" && Number.isInteger(obj["ttl"]) && obj["ttl"] > 0) {
+    result.ttl = obj["ttl"];
+  } else if (obj["ttl"] !== void 0) {
+    warnings.push(`Invalid 'cache.ttl': expected positive integer`);
+  }
+  if (typeof obj["slideWindow"] === "boolean") {
+    result.slideWindow = obj["slideWindow"];
+  } else if (obj["slideWindow"] !== void 0) {
+    warnings.push(`Invalid 'cache.slideWindow': expected boolean`);
+  }
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_CACHE_FIELDS.has(key)) {
+      warnings.push(`Unknown field 'cache.${key}' (will be ignored)`);
     }
   }
-  const text = await response.text();
-  const byteSize = new TextEncoder().encode(text).length;
-  if (byteSize > maxSize) {
-    throw new Error(`Response size (${byteSize} bytes) exceeds maximum allowed (${maxSize} bytes)`);
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function extractValidCodeCall(data, warnings) {
+  if (typeof data !== "object" || data === null) return void 0;
+  const obj = data;
+  const result = {};
+  if (typeof obj["enabledInCodeCall"] === "boolean") {
+    result.enabledInCodeCall = obj["enabledInCodeCall"];
+  } else if (obj["enabledInCodeCall"] !== void 0) {
+    warnings.push(`Invalid 'codecall.enabledInCodeCall': expected boolean`);
   }
-  const contentType = response.headers.get("content-type");
-  let data;
-  if (contentType?.toLowerCase().includes("application/json")) {
-    try {
-      data = JSON.parse(text);
-    } catch {
-      data = text;
+  if (typeof obj["visibleInListTools"] === "boolean") {
+    result.visibleInListTools = obj["visibleInListTools"];
+  } else if (obj["visibleInListTools"] !== void 0) {
+    warnings.push(`Invalid 'codecall.visibleInListTools': expected boolean`);
+  }
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_CODECALL_FIELDS.has(key)) {
+      warnings.push(`Unknown field 'codecall.${key}' (will be ignored)`);
     }
-  } else {
-    data = text;
   }
-  if (!response.ok) {
-    return {
-      status: response.status,
-      ok: false,
-      data,
-      error: typeof data === "object" && data !== null && "message" in data ? String(data.message) : typeof data === "string" ? data : `HTTP ${response.status} error`
-    };
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function extractValidTags(data) {
+  if (!Array.isArray(data)) return void 0;
+  const validTags = data.filter((item) => typeof item === "string");
+  return validTags.length > 0 ? validTags : void 0;
+}
+function extractValidExamples(data, warnings) {
+  if (!Array.isArray(data)) return void 0;
+  const validExamples = [];
+  for (let i = 0; i < data.length; i++) {
+    const item = data[i];
+    const result = FrontMcpExampleSchema.safeParse(item);
+    if (result.success) {
+      validExamples.push(result.data);
+    } else {
+      warnings.push(
+        `Invalid example at index ${i}: ${formatZodIssues(result.error.issues, `examples[${i}]`).join(", ")}`
+      );
+    }
   }
-  return {
-    status: response.status,
-    ok: true,
-    data
-  };
+  return validExamples.length > 0 ? validExamples : void 0;
+}
+function formatZodIssues(issues, prefix) {
+  return issues.map((issue) => {
+    const path = issue.path.length > 0 ? `${prefix}.${issue.path.join(".")}` : prefix;
+    return `Invalid '${path}': ${issue.message}`;
+  });
 }
 
 // libs/adapters/src/openapi/openapi.security.ts
@@ -316,301 +408,209 @@ function validateSecurityConfiguration(tools, options) {
   if (options.authProviderMapper || schemesInInput.size > 0) {
     result.securityRiskScore = schemesInInput.size > 0 ? "medium" : "low";
     if (schemesInInput.size > 0) {
-      result.warnings.push(
-        `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
-      );
-    }
-    for (const scheme of securitySchemes) {
-      if (schemesInInput.has(scheme)) {
-        continue;
-      }
-      if (!options.authProviderMapper?.[scheme]) {
-        result.valid = false;
-        result.missingMappings.push(scheme);
-      }
-    }
-    if (!result.valid) {
-      result.warnings.push(
-        `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
-      );
-    }
-    return result;
-  }
-  if (securitySchemes.size > 0) {
-    result.securityRiskScore = "medium";
-    result.warnings.push(
-      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
-        securitySchemes
-      ).join(", ")}`
-    );
-    result.warnings.push(
-      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
-    );
-  }
-  return result;
-}
-async function resolveToolSecurity(tool2, ctx, options) {
-  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
-  const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
-  const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
-  const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
-  if (requiresSecurity && !hasAuth) {
-    const requiredSchemes = tool2.mapper.filter((m) => m.security && m.required === true).map((m) => m.security?.scheme ?? "unknown");
-    const uniqueSchemes = [...new Set(requiredSchemes)];
-    const schemesStr = uniqueSchemes.join(", ") || "unknown";
-    const firstScheme = uniqueSchemes[0] || "BearerAuth";
-    throw new Error(
-      `Authentication required for tool '${tool2.name}' but no auth configuration found.
-Required security schemes: ${schemesStr}
-Solutions:
-  1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
-  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
-  3. Add staticAuth: { jwt: process.env.API_TOKEN }
-  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
-    );
-  }
-  return await securityResolver.resolve(tool2.mapper, securityContext);
-}
-
-// libs/adapters/src/openapi/openapi.frontmcp-schema.ts
-var import_zod = require("zod");
-var FRONTMCP_SCHEMA_VERSION = "1.0";
-var SUPPORTED_VERSIONS = ["1.0"];
-var FrontMcpAnnotationsSchema = import_zod.z.object({
-  /** Human-readable title for the tool */
-  title: import_zod.z.string().optional(),
-  /** If true, the tool does not modify its environment */
-  readOnlyHint: import_zod.z.boolean().optional(),
-  /** If true, the tool may perform destructive updates */
-  destructiveHint: import_zod.z.boolean().optional(),
-  /** If true, calling repeatedly with same args has no additional effect */
-  idempotentHint: import_zod.z.boolean().optional(),
-  /** If true, tool may interact with external entities */
-  openWorldHint: import_zod.z.boolean().optional()
-});
-var FrontMcpCacheSchema = import_zod.z.object({
-  /** Time-to-live in seconds for cached responses */
-  ttl: import_zod.z.number().int().positive().optional(),
-  /** If true, cache window slides on each access */
-  slideWindow: import_zod.z.boolean().optional()
-});
-var FrontMcpCodeCallSchema = import_zod.z.object({
-  /** Whether this tool can be used via CodeCall */
-  enabledInCodeCall: import_zod.z.boolean().optional(),
-  /** If true, stays visible in list_tools when CodeCall is active */
-  visibleInListTools: import_zod.z.boolean().optional()
-});
-var FrontMcpExampleSchema = import_zod.z.object({
-  /** Description of the example */
-  description: import_zod.z.string(),
-  /** Example input values */
-  input: import_zod.z.record(import_zod.z.string(), import_zod.z.any()),
-  /** Expected output (optional) */
-  output: import_zod.z.any().optional()
-});
-var KNOWN_EXTENSION_FIELDS = /* @__PURE__ */ new Set([
-  "version",
-  "annotations",
-  "cache",
-  "codecall",
-  "tags",
-  "hideFromDiscovery",
-  "examples"
-]);
-var KNOWN_ANNOTATION_FIELDS = /* @__PURE__ */ new Set([
-  "title",
-  "readOnlyHint",
-  "destructiveHint",
-  "idempotentHint",
-  "openWorldHint"
-]);
-var KNOWN_CACHE_FIELDS = /* @__PURE__ */ new Set(["ttl", "slideWindow"]);
-var KNOWN_CODECALL_FIELDS = /* @__PURE__ */ new Set(["enabledInCodeCall", "visibleInListTools"]);
-function validateFrontMcpExtension(rawData, toolName, logger) {
-  const warnings = [];
-  if (rawData === null || rawData === void 0) {
-    return { success: true, data: null, warnings: [] };
-  }
-  if (typeof rawData !== "object" || Array.isArray(rawData)) {
-    warnings.push(`x-frontmcp must be an object, got ${Array.isArray(rawData) ? "array" : typeof rawData}`);
-    logger.warn(`[${toolName}] Invalid x-frontmcp extension: ${warnings[0]}`);
-    return { success: false, data: null, warnings };
-  }
-  const data = rawData;
-  const version = typeof data["version"] === "string" ? data["version"] : FRONTMCP_SCHEMA_VERSION;
-  if (!SUPPORTED_VERSIONS.includes(version)) {
-    warnings.push(`Unsupported x-frontmcp version '${version}'. Supported versions: ${SUPPORTED_VERSIONS.join(", ")}`);
-    logger.warn(`[${toolName}] ${warnings[0]}`);
-    return { success: false, data: null, warnings };
-  }
-  const validData = extractValidFields(data, version, warnings);
-  if (warnings.length > 0) {
-    logger.warn(`[${toolName}] x-frontmcp extension has invalid fields that were ignored:`);
-    warnings.forEach((w) => logger.warn(`  - ${w}`));
-  }
-  return {
-    success: true,
-    data: validData,
-    warnings
-  };
-}
-function extractValidFields(data, version, warnings) {
-  const result = {
-    version
-  };
-  for (const key of Object.keys(data)) {
-    if (!KNOWN_EXTENSION_FIELDS.has(key)) {
-      warnings.push(`Unknown field '${key}' in x-frontmcp (will be ignored)`);
-    }
-  }
-  if (data["annotations"] !== void 0) {
-    const annotationsResult = FrontMcpAnnotationsSchema.safeParse(data["annotations"]);
-    if (annotationsResult.success) {
-      result.annotations = annotationsResult.data;
-    } else {
-      const issues = formatZodIssues(annotationsResult.error.issues, "annotations");
-      warnings.push(...issues);
-      result.annotations = extractValidAnnotations(data["annotations"], warnings);
-    }
-  }
-  if (data["cache"] !== void 0) {
-    const cacheResult = FrontMcpCacheSchema.safeParse(data["cache"]);
-    if (cacheResult.success) {
-      result.cache = cacheResult.data;
-    } else {
-      const issues = formatZodIssues(cacheResult.error.issues, "cache");
-      warnings.push(...issues);
-      result.cache = extractValidCache(data["cache"], warnings);
-    }
-  }
-  if (data["codecall"] !== void 0) {
-    const codecallResult = FrontMcpCodeCallSchema.safeParse(data["codecall"]);
-    if (codecallResult.success) {
-      result.codecall = codecallResult.data;
-    } else {
-      const issues = formatZodIssues(codecallResult.error.issues, "codecall");
-      warnings.push(...issues);
-      result.codecall = extractValidCodeCall(data["codecall"], warnings);
-    }
-  }
-  if (data["tags"] !== void 0) {
-    const tagsSchema = import_zod.z.array(import_zod.z.string());
-    const tagsResult = tagsSchema.safeParse(data["tags"]);
-    if (tagsResult.success) {
-      result.tags = tagsResult.data;
-    } else {
-      warnings.push(`Invalid 'tags': expected array of strings`);
-      result.tags = extractValidTags(data["tags"]);
-    }
-  }
-  if (data["hideFromDiscovery"] !== void 0) {
-    if (typeof data["hideFromDiscovery"] === "boolean") {
-      result.hideFromDiscovery = data["hideFromDiscovery"];
-    } else {
-      warnings.push(`Invalid 'hideFromDiscovery': expected boolean, got ${typeof data["hideFromDiscovery"]}`);
-    }
-  }
-  if (data["examples"] !== void 0) {
-    const examplesSchema = import_zod.z.array(FrontMcpExampleSchema);
-    const examplesResult = examplesSchema.safeParse(data["examples"]);
-    if (examplesResult.success) {
-      result.examples = examplesResult.data;
-    } else {
-      warnings.push(`Invalid 'examples': some examples have invalid format`);
-      result.examples = extractValidExamples(data["examples"], warnings);
+      result.warnings.push(
+        `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
+      );
     }
-  }
-  return result;
-}
-function extractValidAnnotations(data, warnings) {
-  if (typeof data !== "object" || data === null) return void 0;
-  const obj = data;
-  const result = {};
-  for (const field of KNOWN_ANNOTATION_FIELDS) {
-    if (obj[field] !== void 0) {
-      if (field === "title" && typeof obj[field] === "string") {
-        result.title = obj[field];
-      } else if (field !== "title" && typeof obj[field] === "boolean") {
-        result[field] = obj[field];
+    for (const scheme of securitySchemes) {
+      if (schemesInInput.has(scheme)) {
+        continue;
+      }
+      if (!options.authProviderMapper?.[scheme]) {
+        result.valid = false;
+        result.missingMappings.push(scheme);
       }
     }
-  }
-  for (const key of Object.keys(obj)) {
-    if (!KNOWN_ANNOTATION_FIELDS.has(key)) {
-      warnings.push(`Unknown field 'annotations.${key}' (will be ignored)`);
+    if (!result.valid) {
+      result.warnings.push(
+        `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
+      );
     }
+    return result;
   }
-  return Object.keys(result).length > 0 ? result : void 0;
+  if (securitySchemes.size > 0) {
+    result.securityRiskScore = "medium";
+    result.warnings.push(
+      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
+        securitySchemes
+      ).join(", ")}`
+    );
+    result.warnings.push(
+      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
+    );
+  }
+  return result;
 }
-function extractValidCache(data, warnings) {
-  if (typeof data !== "object" || data === null) return void 0;
-  const obj = data;
-  const result = {};
-  if (typeof obj["ttl"] === "number" && Number.isInteger(obj["ttl"]) && obj["ttl"] > 0) {
-    result.ttl = obj["ttl"];
-  } else if (obj["ttl"] !== void 0) {
-    warnings.push(`Invalid 'cache.ttl': expected positive integer`);
+async function resolveToolSecurity(tool2, ctx, options) {
+  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
+  const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
+  const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
+  const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
+  if (requiresSecurity && !hasAuth) {
+    const requiredSchemes = tool2.mapper.filter((m) => m.security && m.required === true).map((m) => m.security?.scheme ?? "unknown");
+    const uniqueSchemes = [...new Set(requiredSchemes)];
+    const schemesStr = uniqueSchemes.join(", ") || "unknown";
+    const firstScheme = uniqueSchemes[0] || "BearerAuth";
+    throw new Error(
+      `Authentication required for tool '${tool2.name}' but no auth configuration found.
+Required security schemes: ${schemesStr}
+Solutions:
+  1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
+  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
+  3. Add staticAuth: { jwt: process.env.API_TOKEN }
+  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
+    );
   }
-  if (typeof obj["slideWindow"] === "boolean") {
-    result.slideWindow = obj["slideWindow"];
-  } else if (obj["slideWindow"] !== void 0) {
-    warnings.push(`Invalid 'cache.slideWindow': expected boolean`);
+  return await securityResolver.resolve(tool2.mapper, securityContext);
+}
+
+// libs/adapters/src/openapi/openapi.utils.ts
+var import_utils = require("@frontmcp/utils");
+var import_sdk = require("@frontmcp/sdk");
+function coerceToString(value, paramName, location) {
+  if (value === null || value === void 0) {
+    return "";
   }
-  for (const key of Object.keys(obj)) {
-    if (!KNOWN_CACHE_FIELDS.has(key)) {
-      warnings.push(`Unknown field 'cache.${key}' (will be ignored)`);
+  if (typeof value === "object") {
+    if (Array.isArray(value)) {
+      if (location === "query") {
+        return value.map(String).join(",");
+      }
+      throw new Error(`${location} parameter '${paramName}' cannot be an array. Received: ${JSON.stringify(value)}`);
     }
+    throw new Error(`${location} parameter '${paramName}' cannot be an object. Received: ${JSON.stringify(value)}`);
   }
-  return Object.keys(result).length > 0 ? result : void 0;
+  return String(value);
 }
-function extractValidCodeCall(data, warnings) {
-  if (typeof data !== "object" || data === null) return void 0;
-  const obj = data;
-  const result = {};
-  if (typeof obj["enabledInCodeCall"] === "boolean") {
-    result.enabledInCodeCall = obj["enabledInCodeCall"];
-  } else if (obj["enabledInCodeCall"] !== void 0) {
-    warnings.push(`Invalid 'codecall.enabledInCodeCall': expected boolean`);
-  }
-  if (typeof obj["visibleInListTools"] === "boolean") {
-    result.visibleInListTools = obj["visibleInListTools"];
-  } else if (obj["visibleInListTools"] !== void 0) {
-    warnings.push(`Invalid 'codecall.visibleInListTools': expected boolean`);
+function appendCookie(headers, name, value) {
+  if (!/^[\w!#$%&'*+\-.^`|~]+$/.test(name)) {
+    throw new Error(`Invalid cookie name: '${name}'. Cookie names must be valid tokens.`);
   }
-  for (const key of Object.keys(obj)) {
-    if (!KNOWN_CODECALL_FIELDS.has(key)) {
-      warnings.push(`Unknown field 'codecall.${key}' (will be ignored)`);
+  const existing = headers.get("Cookie") || "";
+  const cookiePair = `${name}=${encodeURIComponent(coerceToString(value, name, "cookie"))}`;
+  const combined = existing ? `${existing}; ${cookiePair}` : cookiePair;
+  headers.set("Cookie", combined);
+}
+function buildRequest(tool2, input, security, baseUrl) {
+  const rawBaseUrl = tool2.metadata.servers?.[0]?.url || baseUrl;
+  (0, import_utils.validateBaseUrl)(rawBaseUrl);
+  const apiBaseUrl = rawBaseUrl.replace(/\/+$/, "");
+  let path = tool2.metadata.path;
+  const queryParams = new URLSearchParams();
+  const headers = new Headers({
+    accept: "application/json",
+    ...security.headers
+  });
+  let body;
+  for (const mapper of tool2.mapper) {
+    if (mapper.security) continue;
+    const value = input[mapper.inputKey];
+    if (value === void 0 || value === null) {
+      if (mapper.required) {
+        throw new Error(
+          `Required ${mapper.type} parameter '${mapper.key}' (input: '${mapper.inputKey}') is missing for operation '${tool2.name}'`
+        );
+      }
+      continue;
+    }
+    switch (mapper.type) {
+      case "path":
+        path = path.replaceAll(`{${mapper.key}}`, encodeURIComponent(coerceToString(value, mapper.key, "path")));
+        break;
+      case "query":
+        queryParams.set(mapper.key, coerceToString(value, mapper.key, "query"));
+        break;
+      case "header": {
+        const headerValue = coerceToString(value, mapper.key, "header");
+        if (/[\r\n\x00\f\v]/.test(headerValue)) {
+          throw new import_sdk.PublicMcpError(
+            `Invalid header value for '${mapper.key}': contains control characters (possible header injection attack)`,
+            "INVALID_HEADER_VALUE",
+            400
+          );
+        }
+        headers.set(mapper.key, headerValue);
+        break;
+      }
+      case "cookie":
+        appendCookie(headers, mapper.key, value);
+        break;
+      case "body":
+        if (!body) body = {};
+        body[mapper.key] = value;
+        break;
+      default:
+        throw new Error(
+          `Unknown mapper type '${mapper.type}' for parameter '${mapper.key}' in operation '${tool2.name}'`
+        );
     }
   }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-function extractValidTags(data) {
-  if (!Array.isArray(data)) return void 0;
-  const validTags = data.filter((item) => typeof item === "string");
-  return validTags.length > 0 ? validTags : void 0;
-}
-function extractValidExamples(data, warnings) {
-  if (!Array.isArray(data)) return void 0;
-  const validExamples = [];
-  for (let i = 0; i < data.length; i++) {
-    const item = data[i];
-    const result = FrontMcpExampleSchema.safeParse(item);
-    if (result.success) {
-      validExamples.push(result.data);
-    } else {
-      warnings.push(
-        `Invalid example at index ${i}: ${formatZodIssues(result.error.issues, `examples[${i}]`).join(", ")}`
+  Object.entries(security.query).forEach(([key, value]) => {
+    if (queryParams.has(key)) {
+      throw new Error(
+        `Query parameter collision: '${key}' is provided both as user input and security parameter. This could indicate a security misconfiguration in operation '${tool2.name}'.`
       );
     }
+    queryParams.set(key, coerceToString(value, key, "security query"));
+  });
+  if (security.cookies && Object.keys(security.cookies).length > 0) {
+    Object.entries(security.cookies).forEach(([key, value]) => {
+      appendCookie(headers, key, value);
+    });
   }
-  return validExamples.length > 0 ? validExamples : void 0;
+  if (path.includes("{")) {
+    throw new Error(`Failed to resolve all path parameters in ${path} for operation ${tool2.name}`);
+  }
+  const queryString = queryParams.toString();
+  const url = `${apiBaseUrl}${path}${queryString ? `?${queryString}` : ""}`;
+  return { url, headers, body };
 }
-function formatZodIssues(issues, prefix) {
-  return issues.map((issue) => {
-    const path = issue.path.length > 0 ? `${prefix}.${issue.path.join(".")}` : prefix;
-    return `Invalid '${path}': ${issue.message}`;
+function applyAdditionalHeaders(headers, additionalHeaders) {
+  if (!additionalHeaders) return;
+  Object.entries(additionalHeaders).forEach(([key, value]) => {
+    headers.set(key, value);
   });
 }
+var DEFAULT_MAX_RESPONSE_SIZE = 10 * 1024 * 1024;
+async function parseResponse(response, options) {
+  const maxSize = options?.maxResponseSize ?? DEFAULT_MAX_RESPONSE_SIZE;
+  const contentLength = response.headers.get("content-length");
+  if (contentLength) {
+    const length = parseInt(contentLength, 10);
+    if (!isNaN(length) && isFinite(length) && length > maxSize) {
+      throw new Error(`Response size (${length} bytes) exceeds maximum allowed (${maxSize} bytes)`);
+    }
+  }
+  const text = await response.text();
+  const byteSize = new TextEncoder().encode(text).length;
+  if (byteSize > maxSize) {
+    throw new Error(`Response size (${byteSize} bytes) exceeds maximum allowed (${maxSize} bytes)`);
+  }
+  const contentType = response.headers.get("content-type");
+  let data;
+  if (contentType?.toLowerCase().includes("application/json")) {
+    try {
+      data = JSON.parse(text);
+    } catch {
+      data = text;
+    }
+  } else {
+    data = text;
+  }
+  if (!response.ok) {
+    return {
+      status: response.status,
+      ok: false,
+      data,
+      error: typeof data === "object" && data !== null && "message" in data ? String(data.message) : typeof data === "string" ? data : `HTTP ${response.status} error`
+    };
+  }
+  return {
+    status: response.status,
+    ok: true,
+    data
+  };
+}
 
 // libs/adapters/src/openapi/openapi.tool.ts
 function createOpenApiTool(openapiTool, options, logger) {
@@ -874,7 +874,7 @@ async function injectTransformedValues(input, transforms, ctx) {
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
-    return { schema: import_zod2.z.looseObject({}), conversionFailed: true, error: "No valid JSON schema" };
+    return { schema: import_lazy_zod2.z.looseObject({}), conversionFailed: true, error: "No valid JSON schema" };
   }
   try {
     const zodSchema = (0, import_zod_from_json_schema.convertJsonSchemaToZod)(jsonSchema);
@@ -887,7 +887,7 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
     logger.warn(
       `[${toolName}] Failed to generate Zod schema, using permissive schema. Tool will accept any input but may fail at API level. Error: ${errorMessage}`
     );
-    return { schema: import_zod2.z.looseObject({}), conversionFailed: true, error: errorMessage };
+    return { schema: import_lazy_zod2.z.looseObject({}), conversionFailed: true, error: errorMessage };
   }
 }