@frontmcp/adapters 1.1.2 → 1.2.0

package/index.js

@@ -32,19 +32,371 @@ __export(index_exports, {
   OpenAPIFetchError: () => OpenAPIFetchError,
   OpenApiSpecPoller: () => OpenApiSpecPoller,
   OpenapiAdapter: () => OpenapiAdapter,
+  applyAdditionalHeaders: () => applyAdditionalHeaders,
+  buildRequest: () => buildRequest,
+  createSecurityContextFromAuth: () => createSecurityContextFromAuth,
+  extractSecuritySchemes: () => extractSecuritySchemes,
   forceJwtSecurity: () => forceJwtSecurity,
-  removeSecurityFromOperations: () => removeSecurityFromOperations
+  parseResponse: () => parseResponse,
+  removeSecurityFromOperations: () => removeSecurityFromOperations,
+  resolveToolSecurity: () => resolveToolSecurity,
+  validateSecurityConfiguration: () => validateSecurityConfiguration
 });
 module.exports = __toCommonJS(index_exports);
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-var import_sdk4 = require("@frontmcp/sdk");
 var import_mcp_from_openapi2 = require("mcp-from-openapi");
+var import_sdk4 = require("@frontmcp/sdk");
+
+// libs/adapters/src/openapi/openapi-spec-poller.ts
+var import_utils = require("@frontmcp/utils");
+
+// libs/adapters/src/openapi/openapi.errors.ts
+var import_sdk = require("@frontmcp/sdk");
+var OpenAPIFetchError = class extends import_sdk.InternalMcpError {
+  constructor(url, status, statusText) {
+    super(`OpenAPI spec fetch failed from "${url}": ${status} ${statusText}`, "OPENAPI_FETCH_FAILED");
+  }
+};
+
+// libs/adapters/src/openapi/openapi-spec-poller.ts
+var DEFAULT_RETRY = {
+  maxRetries: 3,
+  initialDelayMs: 1e3,
+  maxDelayMs: 1e4,
+  backoffMultiplier: 2
+};
+var OpenApiSpecPoller = class {
+  url;
+  intervalMs;
+  fetchTimeoutMs;
+  changeDetection;
+  retry;
+  unhealthyThreshold;
+  headers;
+  callbacks;
+  intervalTimer = null;
+  lastHash = null;
+  lastEtag = null;
+  lastModified = null;
+  consecutiveFailures = 0;
+  isPolling = false;
+  wasUnhealthy = false;
+  health = "unknown";
+  constructor(url, options = {}, callbacks = {}) {
+    this.url = url;
+    this.intervalMs = options.intervalMs ?? 6e4;
+    this.fetchTimeoutMs = options.fetchTimeoutMs ?? 1e4;
+    this.changeDetection = options.changeDetection ?? "auto";
+    this.retry = { ...DEFAULT_RETRY, ...options.retry };
+    this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
+    this.headers = options.headers ?? {};
+    this.callbacks = callbacks;
+  }
+  /**
+   * Start polling for changes.
+   */
+  start() {
+    if (this.intervalTimer) return;
+    this.poll().catch(() => {
+    });
+    this.intervalTimer = setInterval(() => {
+      this.poll().catch(() => {
+      });
+    }, this.intervalMs);
+  }
+  /**
+   * Stop polling.
+   */
+  stop() {
+    if (this.intervalTimer) {
+      clearInterval(this.intervalTimer);
+      this.intervalTimer = null;
+    }
+  }
+  /**
+   * Get current stats.
+   */
+  getStats() {
+    return {
+      hash: this.lastHash,
+      consecutiveFailures: this.consecutiveFailures,
+      health: this.health,
+      isRunning: this.intervalTimer !== null
+    };
+  }
+  /**
+   * Perform a single poll cycle.
+   */
+  async poll() {
+    if (this.isPolling) return;
+    this.isPolling = true;
+    try {
+      await this.fetchWithRetry();
+    } finally {
+      this.isPolling = false;
+    }
+  }
+  async fetchWithRetry() {
+    const { maxRetries, initialDelayMs, maxDelayMs, backoffMultiplier } = this.retry;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+      try {
+        await this.doFetch();
+        if (this.consecutiveFailures > 0) {
+          this.consecutiveFailures = 0;
+          if (this.wasUnhealthy) {
+            this.wasUnhealthy = false;
+            this.health = "healthy";
+            this.callbacks.onRecovered?.();
+          }
+        }
+        this.health = "healthy";
+        return;
+      } catch (error) {
+        if (attempt === maxRetries) {
+          this.consecutiveFailures++;
+          this.callbacks.onError?.(error instanceof Error ? error : new Error(String(error)));
+          if (this.consecutiveFailures >= this.unhealthyThreshold && !this.wasUnhealthy) {
+            this.wasUnhealthy = true;
+            this.health = "unhealthy";
+            this.callbacks.onUnhealthy?.(this.consecutiveFailures);
+          }
+          return;
+        }
+        const delay = Math.min(initialDelayMs * Math.pow(backoffMultiplier, attempt), maxDelayMs);
+        await new Promise((r) => setTimeout(r, delay));
+      }
+    }
+  }
+  async doFetch() {
+    const headers = { ...this.headers };
+    if (this.changeDetection !== "content-hash") {
+      if (this.lastEtag) {
+        headers["If-None-Match"] = this.lastEtag;
+      }
+      if (this.lastModified) {
+        headers["If-Modified-Since"] = this.lastModified;
+      }
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
+    try {
+      const response = await fetch(this.url, {
+        headers,
+        signal: controller.signal
+      });
+      if (response.status === 304) {
+        this.callbacks.onUnchanged?.();
+        return;
+      }
+      if (!response.ok) {
+        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
+      }
+      const etag = response.headers.get("etag");
+      const lastModified = response.headers.get("last-modified");
+      if (etag) this.lastEtag = etag;
+      if (lastModified) this.lastModified = lastModified;
+      const body = await response.text();
+      const hash = (0, import_utils.sha256Hex)(body);
+      if (this.lastHash && this.lastHash === hash) {
+        this.callbacks.onUnchanged?.();
+        return;
+      }
+      this.lastHash = hash;
+      this.callbacks.onChanged?.(body, hash);
+    } finally {
+      clearTimeout(timeout);
+    }
+  }
+  /**
+   * Dispose the poller and release resources.
+   */
+  dispose() {
+    this.stop();
+  }
+};
+
+// libs/adapters/src/openapi/openapi.security.ts
+var import_mcp_from_openapi = require("mcp-from-openapi");
+async function createSecurityContextFromAuth(tool2, ctx, options) {
+  if (options.securityResolver) {
+    return await options.securityResolver(tool2, ctx);
+  }
+  if (options.authProviderMapper) {
+    const context = (0, import_mcp_from_openapi.createSecurityContext)({});
+    const securitySchemes = /* @__PURE__ */ new Set();
+    for (const mapper of tool2.mapper) {
+      if (mapper.security?.scheme) {
+        securitySchemes.add(mapper.security.scheme);
+      }
+    }
+    for (const scheme of securitySchemes) {
+      const authExtractor = options.authProviderMapper[scheme];
+      if (authExtractor) {
+        try {
+          const token = authExtractor(ctx);
+          if (token !== void 0 && token !== null && typeof token !== "string") {
+            throw new Error(
+              `authProviderMapper['${scheme}'] must return a string or undefined, but returned: ${typeof token}`
+            );
+          }
+          if (token === "") {
+            throw new Error(
+              `authProviderMapper['${scheme}'] returned empty string. Return undefined/null if no token is available, or provide a valid token.`
+            );
+          }
+          if (token) {
+            const schemeMapper = tool2.mapper.find((m) => m.security?.scheme === scheme);
+            const schemeType = schemeMapper?.security?.type?.toLowerCase();
+            const httpScheme = schemeMapper?.security?.httpScheme?.toLowerCase();
+            if (schemeType === "apikey") {
+              if (!context.apiKey) {
+                context.apiKey = token;
+              }
+            } else if (schemeType === "http" && httpScheme === "basic") {
+              if (!context.basic) {
+                context.basic = token;
+              }
+            } else if (schemeType === "oauth2") {
+              if (!context.oauth2Token) {
+                context.oauth2Token = token;
+              }
+            } else {
+              if (!context.jwt) {
+                context.jwt = token;
+              }
+            }
+          }
+        } catch (err) {
+          if (err instanceof Error && err.message.includes("authProviderMapper")) {
+            throw err;
+          }
+          const errorMessage = err instanceof Error ? err.message : String(err);
+          throw new Error(`authProviderMapper['${scheme}'] threw an error: ${errorMessage}`);
+        }
+      }
+    }
+    const hasAnyAuth = context.jwt || context.apiKey || context.basic || context.oauth2Token;
+    const authToken = ctx.authInfo?.token;
+    if (!hasAnyAuth && authToken) {
+      if (typeof authToken !== "string") {
+        throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
+      }
+      context.jwt = authToken;
+    }
+    return context;
+  }
+  if (options.staticAuth) {
+    return (0, import_mcp_from_openapi.createSecurityContext)(options.staticAuth);
+  }
+  return (0, import_mcp_from_openapi.createSecurityContext)({
+    jwt: ctx.authInfo?.token
+  });
+}
+function extractSecuritySchemes(tools) {
+  const schemes = /* @__PURE__ */ new Set();
+  for (const tool2 of tools) {
+    for (const mapper of tool2.mapper) {
+      if (mapper.security?.scheme) {
+        schemes.add(mapper.security.scheme);
+      }
+    }
+  }
+  return schemes;
+}
+function validateSecurityConfiguration(tools, options) {
+  const result = {
+    valid: true,
+    missingMappings: [],
+    warnings: [],
+    securityRiskScore: "low"
+  };
+  const securitySchemes = extractSecuritySchemes(tools);
+  const includeSecurityInInput = options.generateOptions?.includeSecurityInInput ?? false;
+  if (includeSecurityInInput) {
+    result.securityRiskScore = "high";
+    result.warnings.push(
+      "SECURITY WARNING: includeSecurityInInput is enabled. Users will provide authentication directly in tool inputs. This increases security risk as credentials may be logged or exposed."
+    );
+    return result;
+  }
+  if (options.securityResolver) {
+    result.securityRiskScore = "low";
+    result.warnings.push(
+      "INFO: Using custom securityResolver. Ensure your resolver properly validates and secures credentials from context."
+    );
+    return result;
+  }
+  if (options.staticAuth && Object.keys(options.staticAuth).length > 0) {
+    result.securityRiskScore = "medium";
+    result.warnings.push(
+      "SECURITY INFO: Using staticAuth with hardcoded credentials. Ensure credentials are stored securely (environment variables, secrets manager)."
+    );
+    return result;
+  }
+  const schemesInInput = new Set(options.securitySchemesInInput || []);
+  if (options.authProviderMapper || schemesInInput.size > 0) {
+    result.securityRiskScore = schemesInInput.size > 0 ? "medium" : "low";
+    if (schemesInInput.size > 0) {
+      result.warnings.push(
+        `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
+      );
+    }
+    for (const scheme of securitySchemes) {
+      if (schemesInInput.has(scheme)) {
+        continue;
+      }
+      if (!options.authProviderMapper?.[scheme]) {
+        result.valid = false;
+        result.missingMappings.push(scheme);
+      }
+    }
+    if (!result.valid) {
+      result.warnings.push(
+        `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
+      );
+    }
+    return result;
+  }
+  if (securitySchemes.size > 0) {
+    result.securityRiskScore = "medium";
+    result.warnings.push(
+      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
+        securitySchemes
+      ).join(", ")}`
+    );
+    result.warnings.push(
+      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
+    );
+  }
+  return result;
+}
+async function resolveToolSecurity(tool2, ctx, options) {
+  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
+  const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
+  const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
+  const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
+  if (requiresSecurity && !hasAuth) {
+    const requiredSchemes = tool2.mapper.filter((m) => m.security && m.required === true).map((m) => m.security?.scheme ?? "unknown");
+    const uniqueSchemes = [...new Set(requiredSchemes)];
+    const schemesStr = uniqueSchemes.join(", ") || "unknown";
+    const firstScheme = uniqueSchemes[0] || "BearerAuth";
+    throw new Error(
+      `Authentication required for tool '${tool2.name}' but no auth configuration found.
+Required security schemes: ${schemesStr}
+Solutions:
+  1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
+  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
+  3. Add staticAuth: { jwt: process.env.API_TOKEN }
+  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
+    );
+  }
+  return await securityResolver.resolve(tool2.mapper, securityContext);
+}
 
 // libs/adapters/src/openapi/openapi.tool.ts
-var import_zod_from_json_schema = require("zod-from-json-schema");
 var import_lazy_zod2 = require("@frontmcp/lazy-zod");
-var import_sdk2 = require("@frontmcp/sdk");
+var import_sdk3 = require("@frontmcp/sdk");
 
 // libs/adapters/src/openapi/openapi.frontmcp-schema.ts
 var import_lazy_zod = require("@frontmcp/lazy-zod");
@@ -247,226 +599,48 @@ function extractValidCodeCall(data, warnings) {
     warnings.push(`Invalid 'codecall.enabledInCodeCall': expected boolean`);
   }
   if (typeof obj["visibleInListTools"] === "boolean") {
-    result.visibleInListTools = obj["visibleInListTools"];
-  } else if (obj["visibleInListTools"] !== void 0) {
-    warnings.push(`Invalid 'codecall.visibleInListTools': expected boolean`);
-  }
-  for (const key of Object.keys(obj)) {
-    if (!KNOWN_CODECALL_FIELDS.has(key)) {
-      warnings.push(`Unknown field 'codecall.${key}' (will be ignored)`);
-    }
-  }
-  return Object.keys(result).length > 0 ? result : void 0;
-}
-function extractValidTags(data) {
-  if (!Array.isArray(data)) return void 0;
-  const validTags = data.filter((item) => typeof item === "string");
-  return validTags.length > 0 ? validTags : void 0;
-}
-function extractValidExamples(data, warnings) {
-  if (!Array.isArray(data)) return void 0;
-  const validExamples = [];
-  for (let i = 0; i < data.length; i++) {
-    const item = data[i];
-    const result = FrontMcpExampleSchema.safeParse(item);
-    if (result.success) {
-      validExamples.push(result.data);
-    } else {
-      warnings.push(
-        `Invalid example at index ${i}: ${formatZodIssues(result.error.issues, `examples[${i}]`).join(", ")}`
-      );
-    }
-  }
-  return validExamples.length > 0 ? validExamples : void 0;
-}
-function formatZodIssues(issues, prefix) {
-  return issues.map((issue) => {
-    const path = issue.path.length > 0 ? `${prefix}.${issue.path.join(".")}` : prefix;
-    return `Invalid '${path}': ${issue.message}`;
-  });
-}
-
-// libs/adapters/src/openapi/openapi.security.ts
-var import_mcp_from_openapi = require("mcp-from-openapi");
-async function createSecurityContextFromAuth(tool2, ctx, options) {
-  if (options.securityResolver) {
-    return await options.securityResolver(tool2, ctx);
-  }
-  if (options.authProviderMapper) {
-    const context = (0, import_mcp_from_openapi.createSecurityContext)({});
-    const securitySchemes = /* @__PURE__ */ new Set();
-    for (const mapper of tool2.mapper) {
-      if (mapper.security?.scheme) {
-        securitySchemes.add(mapper.security.scheme);
-      }
-    }
-    for (const scheme of securitySchemes) {
-      const authExtractor = options.authProviderMapper[scheme];
-      if (authExtractor) {
-        try {
-          const token = authExtractor(ctx);
-          if (token !== void 0 && token !== null && typeof token !== "string") {
-            throw new Error(
-              `authProviderMapper['${scheme}'] must return a string or undefined, but returned: ${typeof token}`
-            );
-          }
-          if (token === "") {
-            throw new Error(
-              `authProviderMapper['${scheme}'] returned empty string. Return undefined/null if no token is available, or provide a valid token.`
-            );
-          }
-          if (token) {
-            const schemeMapper = tool2.mapper.find((m) => m.security?.scheme === scheme);
-            const schemeType = schemeMapper?.security?.type?.toLowerCase();
-            const httpScheme = schemeMapper?.security?.httpScheme?.toLowerCase();
-            if (schemeType === "apikey") {
-              if (!context.apiKey) {
-                context.apiKey = token;
-              }
-            } else if (schemeType === "http" && httpScheme === "basic") {
-              if (!context.basic) {
-                context.basic = token;
-              }
-            } else if (schemeType === "oauth2") {
-              if (!context.oauth2Token) {
-                context.oauth2Token = token;
-              }
-            } else {
-              if (!context.jwt) {
-                context.jwt = token;
-              }
-            }
-          }
-        } catch (err) {
-          if (err instanceof Error && err.message.includes("authProviderMapper")) {
-            throw err;
-          }
-          const errorMessage = err instanceof Error ? err.message : String(err);
-          throw new Error(`authProviderMapper['${scheme}'] threw an error: ${errorMessage}`);
-        }
-      }
-    }
-    const hasAnyAuth = context.jwt || context.apiKey || context.basic || context.oauth2Token;
-    const authToken = ctx.authInfo?.token;
-    if (!hasAnyAuth && authToken) {
-      if (typeof authToken !== "string") {
-        throw new Error(`authInfo.token must be a string, but got: ${typeof authToken}`);
-      }
-      context.jwt = authToken;
-    }
-    return context;
-  }
-  if (options.staticAuth) {
-    return (0, import_mcp_from_openapi.createSecurityContext)(options.staticAuth);
-  }
-  return (0, import_mcp_from_openapi.createSecurityContext)({
-    jwt: ctx.authInfo?.token
-  });
-}
-function extractSecuritySchemes(tools) {
-  const schemes = /* @__PURE__ */ new Set();
-  for (const tool2 of tools) {
-    for (const mapper of tool2.mapper) {
-      if (mapper.security?.scheme) {
-        schemes.add(mapper.security.scheme);
-      }
-    }
-  }
-  return schemes;
-}
-function validateSecurityConfiguration(tools, options) {
-  const result = {
-    valid: true,
-    missingMappings: [],
-    warnings: [],
-    securityRiskScore: "low"
-  };
-  const securitySchemes = extractSecuritySchemes(tools);
-  const includeSecurityInInput = options.generateOptions?.includeSecurityInInput ?? false;
-  if (includeSecurityInInput) {
-    result.securityRiskScore = "high";
-    result.warnings.push(
-      "SECURITY WARNING: includeSecurityInInput is enabled. Users will provide authentication directly in tool inputs. This increases security risk as credentials may be logged or exposed."
-    );
-    return result;
-  }
-  if (options.securityResolver) {
-    result.securityRiskScore = "low";
-    result.warnings.push(
-      "INFO: Using custom securityResolver. Ensure your resolver properly validates and secures credentials from context."
-    );
-    return result;
-  }
-  if (options.staticAuth && Object.keys(options.staticAuth).length > 0) {
-    result.securityRiskScore = "medium";
-    result.warnings.push(
-      "SECURITY INFO: Using staticAuth with hardcoded credentials. Ensure credentials are stored securely (environment variables, secrets manager)."
-    );
-    return result;
+    result.visibleInListTools = obj["visibleInListTools"];
+  } else if (obj["visibleInListTools"] !== void 0) {
+    warnings.push(`Invalid 'codecall.visibleInListTools': expected boolean`);
   }
-  const schemesInInput = new Set(options.securitySchemesInInput || []);
-  if (options.authProviderMapper || schemesInInput.size > 0) {
-    result.securityRiskScore = schemesInInput.size > 0 ? "medium" : "low";
-    if (schemesInInput.size > 0) {
-      result.warnings.push(
-        `INFO: Per-scheme security control enabled. Schemes in input: ${Array.from(schemesInInput).join(", ")}`
-      );
-    }
-    for (const scheme of securitySchemes) {
-      if (schemesInInput.has(scheme)) {
-        continue;
-      }
-      if (!options.authProviderMapper?.[scheme]) {
-        result.valid = false;
-        result.missingMappings.push(scheme);
-      }
+  for (const key of Object.keys(obj)) {
+    if (!KNOWN_CODECALL_FIELDS.has(key)) {
+      warnings.push(`Unknown field 'codecall.${key}' (will be ignored)`);
     }
-    if (!result.valid) {
-      result.warnings.push(
-        `ERROR: Missing auth provider mappings for security schemes: ${result.missingMappings.join(", ")}`
+  }
+  return Object.keys(result).length > 0 ? result : void 0;
+}
+function extractValidTags(data) {
+  if (!Array.isArray(data)) return void 0;
+  const validTags = data.filter((item) => typeof item === "string");
+  return validTags.length > 0 ? validTags : void 0;
+}
+function extractValidExamples(data, warnings) {
+  if (!Array.isArray(data)) return void 0;
+  const validExamples = [];
+  for (let i = 0; i < data.length; i++) {
+    const item = data[i];
+    const result = FrontMcpExampleSchema.safeParse(item);
+    if (result.success) {
+      validExamples.push(result.data);
+    } else {
+      warnings.push(
+        `Invalid example at index ${i}: ${formatZodIssues(result.error.issues, `examples[${i}]`).join(", ")}`
       );
     }
-    return result;
-  }
-  if (securitySchemes.size > 0) {
-    result.securityRiskScore = "medium";
-    result.warnings.push(
-      `INFO: No auth configuration provided. Using default ctx.authInfo.token for all security schemes: ${Array.from(
-        securitySchemes
-      ).join(", ")}`
-    );
-    result.warnings.push(
-      "RECOMMENDATION: For multiple auth providers, use authProviderMapper or securityResolver to map each security scheme to the correct auth provider."
-    );
   }
-  return result;
+  return validExamples.length > 0 ? validExamples : void 0;
 }
-async function resolveToolSecurity(tool2, ctx, options) {
-  const securityResolver = new import_mcp_from_openapi.SecurityResolver();
-  const securityContext = await createSecurityContextFromAuth(tool2, ctx, options);
-  const hasAuth = securityContext.jwt || securityContext.apiKey || securityContext.basic || securityContext.oauth2Token || securityContext.apiKeys && Object.keys(securityContext.apiKeys).length > 0 || securityContext.customHeaders && Object.keys(securityContext.customHeaders).length > 0;
-  const requiresSecurity = tool2.mapper.some((m) => m.security && m.required === true);
-  if (requiresSecurity && !hasAuth) {
-    const requiredSchemes = tool2.mapper.filter((m) => m.security && m.required === true).map((m) => m.security?.scheme ?? "unknown");
-    const uniqueSchemes = [...new Set(requiredSchemes)];
-    const schemesStr = uniqueSchemes.join(", ") || "unknown";
-    const firstScheme = uniqueSchemes[0] || "BearerAuth";
-    throw new Error(
-      `Authentication required for tool '${tool2.name}' but no auth configuration found.
-Required security schemes: ${schemesStr}
-Solutions:
-  1. Add authProviderMapper: { '${firstScheme}': (ctx) => ctx.authInfo.user?.token }
-  2. Add securityResolver: (tool, ctx) => ({ jwt: ctx.authInfo.token })
-  3. Add staticAuth: { jwt: process.env.API_TOKEN }
-  4. Set generateOptions.includeSecurityInInput: true (not recommended for production)`
-    );
-  }
-  return await securityResolver.resolve(tool2.mapper, securityContext);
+function formatZodIssues(issues, prefix) {
+  return issues.map((issue) => {
+    const path = issue.path.length > 0 ? `${prefix}.${issue.path.join(".")}` : prefix;
+    return `Invalid '${path}': ${issue.message}`;
+  });
 }
 
 // libs/adapters/src/openapi/openapi.utils.ts
-var import_utils = require("@frontmcp/utils");
-var import_sdk = require("@frontmcp/sdk");
+var import_sdk2 = require("@frontmcp/sdk");
+var import_utils2 = require("@frontmcp/utils");
 function coerceToString(value, paramName, location) {
   if (value === null || value === void 0) {
     return "";
@@ -493,8 +667,8 @@ function appendCookie(headers, name, value) {
 }
 function buildRequest(tool2, input, security, baseUrl) {
   const rawBaseUrl = tool2.metadata.servers?.[0]?.url || baseUrl;
-  (0, import_utils.validateBaseUrl)(rawBaseUrl);
-  const apiBaseUrl = rawBaseUrl.replace(/\/+$/, "");
+  (0, import_utils2.validateBaseUrl)(rawBaseUrl);
+  const apiBaseUrl = (0, import_utils2.trimTrailing)(rawBaseUrl, "/");
   let path = tool2.metadata.path;
   const queryParams = new URLSearchParams();
   const headers = new Headers({
@@ -523,7 +697,7 @@ function buildRequest(tool2, input, security, baseUrl) {
       case "header": {
         const headerValue = coerceToString(value, mapper.key, "header");
         if (/[\r\n\x00\f\v]/.test(headerValue)) {
-          throw new import_sdk.PublicMcpError(
+          throw new import_sdk2.PublicMcpError(
             `Invalid header value for '${mapper.key}': contains control characters (possible header injection attack)`,
             "INVALID_HEADER_VALUE",
             400
@@ -688,7 +862,7 @@ function createOpenApiTool(openapiTool, options, logger) {
   if (toolTransform.ui) {
     toolMetadata["ui"] = toolTransform.ui;
   }
-  return (0, import_sdk2.tool)(toolMetadata)(async (input, toolCtx) => {
+  return (0, import_sdk3.tool)(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
     const transformContext = {
       ctx,
@@ -877,7 +1051,12 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
     return { schema: import_lazy_zod2.z.looseObject({}), conversionFailed: true, error: "No valid JSON schema" };
   }
   try {
-    const zodSchema = (0, import_zod_from_json_schema.convertJsonSchemaToZod)(jsonSchema);
+    const zodSchema = import_lazy_zod2.z.fromJSONSchema(
+      jsonSchema,
+      {
+        defaultTarget: "draft-2020-12"
+      }
+    );
     if (typeof zodSchema?.parse !== "function") {
       throw new Error("Conversion did not produce a valid Zod schema.");
     }
@@ -891,174 +1070,6 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   }
 }
 
-// libs/adapters/src/openapi/openapi-spec-poller.ts
-var import_utils2 = require("@frontmcp/utils");
-
-// libs/adapters/src/openapi/openapi.errors.ts
-var import_sdk3 = require("@frontmcp/sdk");
-var OpenAPIFetchError = class extends import_sdk3.InternalMcpError {
-  constructor(url, status, statusText) {
-    super(`OpenAPI spec fetch failed from "${url}": ${status} ${statusText}`, "OPENAPI_FETCH_FAILED");
-  }
-};
-
-// libs/adapters/src/openapi/openapi-spec-poller.ts
-var DEFAULT_RETRY = {
-  maxRetries: 3,
-  initialDelayMs: 1e3,
-  maxDelayMs: 1e4,
-  backoffMultiplier: 2
-};
-var OpenApiSpecPoller = class {
-  url;
-  intervalMs;
-  fetchTimeoutMs;
-  changeDetection;
-  retry;
-  unhealthyThreshold;
-  headers;
-  callbacks;
-  intervalTimer = null;
-  lastHash = null;
-  lastEtag = null;
-  lastModified = null;
-  consecutiveFailures = 0;
-  isPolling = false;
-  wasUnhealthy = false;
-  health = "unknown";
-  constructor(url, options = {}, callbacks = {}) {
-    this.url = url;
-    this.intervalMs = options.intervalMs ?? 6e4;
-    this.fetchTimeoutMs = options.fetchTimeoutMs ?? 1e4;
-    this.changeDetection = options.changeDetection ?? "auto";
-    this.retry = { ...DEFAULT_RETRY, ...options.retry };
-    this.unhealthyThreshold = options.unhealthyThreshold ?? 3;
-    this.headers = options.headers ?? {};
-    this.callbacks = callbacks;
-  }
-  /**
-   * Start polling for changes.
-   */
-  start() {
-    if (this.intervalTimer) return;
-    this.poll().catch(() => {
-    });
-    this.intervalTimer = setInterval(() => {
-      this.poll().catch(() => {
-      });
-    }, this.intervalMs);
-  }
-  /**
-   * Stop polling.
-   */
-  stop() {
-    if (this.intervalTimer) {
-      clearInterval(this.intervalTimer);
-      this.intervalTimer = null;
-    }
-  }
-  /**
-   * Get current stats.
-   */
-  getStats() {
-    return {
-      hash: this.lastHash,
-      consecutiveFailures: this.consecutiveFailures,
-      health: this.health,
-      isRunning: this.intervalTimer !== null
-    };
-  }
-  /**
-   * Perform a single poll cycle.
-   */
-  async poll() {
-    if (this.isPolling) return;
-    this.isPolling = true;
-    try {
-      await this.fetchWithRetry();
-    } finally {
-      this.isPolling = false;
-    }
-  }
-  async fetchWithRetry() {
-    const { maxRetries, initialDelayMs, maxDelayMs, backoffMultiplier } = this.retry;
-    for (let attempt = 0; attempt <= maxRetries; attempt++) {
-      try {
-        await this.doFetch();
-        if (this.consecutiveFailures > 0) {
-          this.consecutiveFailures = 0;
-          if (this.wasUnhealthy) {
-            this.wasUnhealthy = false;
-            this.health = "healthy";
-            this.callbacks.onRecovered?.();
-          }
-        }
-        this.health = "healthy";
-        return;
-      } catch (error) {
-        if (attempt === maxRetries) {
-          this.consecutiveFailures++;
-          this.callbacks.onError?.(error instanceof Error ? error : new Error(String(error)));
-          if (this.consecutiveFailures >= this.unhealthyThreshold && !this.wasUnhealthy) {
-            this.wasUnhealthy = true;
-            this.health = "unhealthy";
-            this.callbacks.onUnhealthy?.(this.consecutiveFailures);
-          }
-          return;
-        }
-        const delay = Math.min(initialDelayMs * Math.pow(backoffMultiplier, attempt), maxDelayMs);
-        await new Promise((r) => setTimeout(r, delay));
-      }
-    }
-  }
-  async doFetch() {
-    const headers = { ...this.headers };
-    if (this.changeDetection !== "content-hash") {
-      if (this.lastEtag) {
-        headers["If-None-Match"] = this.lastEtag;
-      }
-      if (this.lastModified) {
-        headers["If-Modified-Since"] = this.lastModified;
-      }
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), this.fetchTimeoutMs);
-    try {
-      const response = await fetch(this.url, {
-        headers,
-        signal: controller.signal
-      });
-      if (response.status === 304) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      if (!response.ok) {
-        throw new OpenAPIFetchError(this.url, response.status, response.statusText);
-      }
-      const etag = response.headers.get("etag");
-      const lastModified = response.headers.get("last-modified");
-      if (etag) this.lastEtag = etag;
-      if (lastModified) this.lastModified = lastModified;
-      const body = await response.text();
-      const hash = (0, import_utils2.sha256Hex)(body);
-      if (this.lastHash && this.lastHash === hash) {
-        this.callbacks.onUnchanged?.();
-        return;
-      }
-      this.lastHash = hash;
-      this.callbacks.onChanged?.(body, hash);
-    } finally {
-      clearTimeout(timeout);
-    }
-  }
-  /**
-   * Dispose the poller and release resources.
-   */
-  dispose() {
-    this.stop();
-  }
-};
-
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
 function createConsoleLogger(prefix) {
@@ -1902,6 +1913,13 @@ function removeSecurityFromOperations(spec, operations) {
   OpenAPIFetchError,
   OpenApiSpecPoller,
   OpenapiAdapter,
+  applyAdditionalHeaders,
+  buildRequest,
+  createSecurityContextFromAuth,
+  extractSecuritySchemes,
   forceJwtSecurity,
-  removeSecurityFromOperations
+  parseResponse,
+  removeSecurityFromOperations,
+  resolveToolSecurity,
+  validateSecurityConfiguration
 });