@frontmcp/adapters 1.9.1-rc.3 → 1.9.2

package/esm/index.mjs

@@ -10,7 +10,10 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
+import {
+  normalizeSsrfOptions as normalizeSsrfOptions2,
+  OpenAPIToolGenerator
+} from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
@@ -605,7 +608,7 @@ async function resolveInputSecurity(tool2, input, options, securityResolver) {
 
 // libs/adapters/src/openapi/openapi.tool.ts
 import { z as z2 } from "@frontmcp/lazy-zod";
-import { tool } from "@frontmcp/sdk";
+import { InvalidInputError, tool } from "@frontmcp/sdk";
 import { isRedirectResponse } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.frontmcp-schema.ts
@@ -1005,6 +1008,7 @@ function createOpenApiTool(openapiTool, options, logger) {
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1022,11 +1026,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1034,7 +1042,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1074,6 +1085,13 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return tool(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(input);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
@@ -1287,6 +1305,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1314,6 +1390,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1332,9 +1420,14 @@ var OpenapiAdapter = class extends DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1358,6 +1451,8 @@ var OpenapiAdapter = class extends DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1443,28 +1538,31 @@ var OpenapiAdapter = class extends DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/esm/openapi/index.mjs

@@ -10,7 +10,10 @@ var __decorateClass = (decorators, target, key, kind) => {
 };
 
 // libs/adapters/src/openapi/openapi.adapter.ts
-import { normalizeSsrfOptions as normalizeSsrfOptions2, OpenAPIToolGenerator } from "mcp-from-openapi";
+import {
+  normalizeSsrfOptions as normalizeSsrfOptions2,
+  OpenAPIToolGenerator
+} from "mcp-from-openapi";
 import { Adapter, DynamicAdapter } from "@frontmcp/sdk";
 
 // libs/adapters/src/openapi/openapi-spec-poller.ts
@@ -605,7 +608,7 @@ async function resolveInputSecurity(tool2, input, options, securityResolver) {
 
 // libs/adapters/src/openapi/openapi.tool.ts
 import { z as z2 } from "@frontmcp/lazy-zod";
-import { tool } from "@frontmcp/sdk";
+import { InvalidInputError, tool } from "@frontmcp/sdk";
 import { isRedirectResponse } from "@frontmcp/utils";
 
 // libs/adapters/src/openapi/openapi.frontmcp-schema.ts
@@ -1005,6 +1008,7 @@ function createOpenApiTool(openapiTool, options, logger) {
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1022,11 +1026,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1034,7 +1042,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1074,6 +1085,13 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return tool(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(input);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
@@ -1287,6 +1305,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1314,6 +1390,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1332,9 +1420,14 @@ var OpenapiAdapter = class extends DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1358,6 +1451,8 @@ var OpenapiAdapter = class extends DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1443,28 +1538,31 @@ var OpenapiAdapter = class extends DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.9.1-rc.3",
+  "version": "1.9.2",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.9.1-rc.3",
-    "@frontmcp/di": "1.9.1-rc.3",
-    "@frontmcp/sdk": "1.9.1-rc.3",
-    "@frontmcp/utils": "1.9.1-rc.3",
+    "@frontmcp/auth": "1.9.2",
+    "@frontmcp/di": "1.9.2",
+    "@frontmcp/sdk": "1.9.2",
+    "@frontmcp/utils": "1.9.2",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.8.0",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1-rc.3"
+    "@frontmcp/lazy-zod": "1.9.2"
   }
 }

package/esm/skills/index.mjs

@@ -843,7 +843,7 @@ var SaasPullSource = class {
         bundle = await this.loadCache();
         if (!bundle) {
           throw new Error(
-            `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`,
+            `[saas-source] initial pull failed and no cached bundle is available ${this.cacheLocation()}: ${e.message}`,
             { cause: e }
           );
         }
@@ -989,6 +989,10 @@ var SaasPullSource = class {
       trimmed.startsWith("{") || trimmed.startsWith("[") ? { kind: "json", content: body } : { kind: "yaml", content: body }
     );
   }
+  /** Where the last-good bundle is kept, for messages: an injected store (a Worker's KV) has no file path. */
+  cacheLocation() {
+    return this.deps.cache ? "in the injected bundle cache" : `at ${this.cachePath()}`;
+  }
   cachePath() {
     const dir = this.cacheDir ?? DEFAULT_CACHE_DIR;
     return pathResolve(dir, `${this.options.expectedAudience.replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`);

package/index.js

@@ -1037,6 +1037,7 @@ function createOpenApiTool(openapiTool, options, logger) {
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1054,11 +1055,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1066,7 +1071,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1106,6 +1114,13 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return (0, import_sdk4.tool)(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(input);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new import_sdk4.InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
@@ -1319,6 +1334,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1346,6 +1419,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1364,9 +1449,14 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1390,6 +1480,8 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1475,28 +1567,31 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/openapi/index.js

@@ -1037,6 +1037,7 @@ function createOpenApiTool(openapiTool, options, logger) {
   const frontmcpValidation = validateFrontMcpExtension(metadata.frontmcp, openapiTool.name, logger);
   const frontmcpExt = frontmcpValidation.data;
   const schemaResult = getZodSchemaFromJsonSchema(openapiTool.inputSchema, openapiTool.name, logger);
+  const argumentCheck = schemaResult.conversionFailed ? void 0 : getZodSchemaFromJsonSchema(toArgumentJsonSchema(openapiTool), openapiTool.name, logger);
   let wrappedOutputSchema;
   if (openapiTool.outputSchema !== void 0) {
     const baseOutputSchema = openapiTool.outputSchema ?? { type: "string" };
@@ -1054,11 +1055,15 @@ function createOpenApiTool(openapiTool, options, logger) {
   const toolMetadata = {
     id: openapiTool.name,
     name: openapiTool.name,
+    ...openapiTool.title && { title: openapiTool.title },
     description: openapiTool.description,
     inputSchema: schemaResult.schema.shape || {},
     rawInputSchema: openapiTool.inputSchema,
     // Add output schema for tool/list to expose (only if not moved to description)
-    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema }
+    ...wrappedOutputSchema && { rawOutputSchema: wrappedOutputSchema },
+    ...openapiTool.annotations && { annotations: { ...openapiTool.annotations } },
+    ...openapiTool.icons?.length && { icons: openapiTool.icons.map((icon) => ({ ...icon })) },
+    ...openapiTool._meta && { _meta: { ...openapiTool._meta } }
   };
   if (schemaResult.conversionFailed) {
     toolMetadata["_schemaConversionFailed"] = true;
@@ -1066,7 +1071,10 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   if (frontmcpExt) {
     if (frontmcpExt.annotations) {
-      toolMetadata["annotations"] = { ...frontmcpExt.annotations };
+      toolMetadata["annotations"] = {
+        ...toolMetadata["annotations"] || {},
+        ...frontmcpExt.annotations
+      };
     }
     if (frontmcpExt.tags) {
       toolMetadata["tags"] = [...frontmcpExt.tags];
@@ -1106,6 +1114,13 @@ function createOpenApiTool(openapiTool, options, logger) {
   }
   return (0, import_sdk4.tool)(toolMetadata)(async (input, toolCtx) => {
     const ctx = toolCtx.context;
+    if (argumentCheck && !argumentCheck.conversionFailed) {
+      const validation = argumentCheck.schema.safeParse(input);
+      if (!validation.success) {
+        const problems = validation.error.issues.map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`);
+        throw new import_sdk4.InvalidInputError(`Invalid arguments for tool '${openapiTool.name}': ${problems.join("; ")}`);
+      }
+    }
     const transformContext = {
       ctx,
       env: process.env,
@@ -1319,6 +1334,64 @@ async function injectTransformedValues(input, transforms, ctx) {
   }
   return result;
 }
+var SUBSCHEMA_KEYWORDS = [
+  "items",
+  "additionalProperties",
+  "not",
+  "if",
+  "then",
+  "else",
+  "contains",
+  "propertyNames",
+  "unevaluatedItems",
+  "unevaluatedProperties"
+];
+var SUBSCHEMA_LIST_KEYWORDS = ["allOf", "anyOf", "prefixItems"];
+var SUBSCHEMA_MAP_KEYWORDS = ["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"];
+function toArgumentJsonSchema(openapiTool) {
+  const argumentSchema = relaxSchema(openapiTool.inputSchema);
+  const credentialKeys = new Set(
+    openapiTool.mapper.filter((mapper) => mapper.security).map((mapper) => mapper.inputKey)
+  );
+  const required = argumentSchema["required"];
+  if (Array.isArray(required)) {
+    argumentSchema["required"] = required.filter((key) => !credentialKeys.has(key));
+  }
+  return argumentSchema;
+}
+function relaxSchema(schema) {
+  if (Array.isArray(schema)) return schema.map(relaxSchema);
+  if (typeof schema !== "object" || schema === null) return schema;
+  const relaxed = { ...schema };
+  delete relaxed["format"];
+  for (const keyword of SUBSCHEMA_KEYWORDS) {
+    if (keyword in relaxed) relaxed[keyword] = relaxSchema(relaxed[keyword]);
+  }
+  for (const keyword of SUBSCHEMA_LIST_KEYWORDS) {
+    const subschemas = relaxed[keyword];
+    if (Array.isArray(subschemas)) relaxed[keyword] = subschemas.map(relaxSchema);
+  }
+  for (const keyword of SUBSCHEMA_MAP_KEYWORDS) {
+    const subschemasByName = relaxed[keyword];
+    if (typeof subschemasByName === "object" && subschemasByName !== null) {
+      relaxed[keyword] = Object.fromEntries(
+        Object.entries(subschemasByName).map(([name, subschema]) => [name, relaxSchema(subschema)])
+      );
+    }
+  }
+  const exclusiveBranches = relaxed["oneOf"];
+  if (Array.isArray(exclusiveBranches)) {
+    delete relaxed["oneOf"];
+    const branches = exclusiveBranches.map(relaxSchema);
+    if (Array.isArray(relaxed["anyOf"])) {
+      const allOf = Array.isArray(relaxed["allOf"]) ? relaxed["allOf"] : [];
+      relaxed["allOf"] = [...allOf, { anyOf: branches }];
+    } else {
+      relaxed["anyOf"] = branches;
+    }
+  }
+  return relaxed;
+}
 function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
   if (typeof jsonSchema !== "object" || jsonSchema === null) {
     logger.warn(`[${toolName}] No valid JSON schema provided, using permissive schema`);
@@ -1346,6 +1419,18 @@ function getZodSchemaFromJsonSchema(jsonSchema, toolName, logger) {
 
 // libs/adapters/src/openapi/openapi.adapter.ts
 var RESERVED_KEYS2 = ["__proto__", "constructor", "prototype"];
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete", "head", "options", "trace"];
+function normalizeMethods(adapterName, optionName, methods) {
+  return methods?.map((method) => {
+    const lowerMethod = method.toLowerCase();
+    if (!HTTP_METHODS.includes(lowerMethod)) {
+      throw new Error(
+        `[OpenAPI Adapter: ${adapterName}] generateOptions.${optionName} lists "${method}", which is not an HTTP method; use one of ${HTTP_METHODS.join(", ")}.`
+      );
+    }
+    return lowerMethod;
+  });
+}
 function createConsoleLogger(prefix) {
   const formatMessage = (level, msg) => `[${prefix}] ${level}: ${msg}`;
   return {
@@ -1364,9 +1449,14 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
   poller = null;
   updateCallbacks = /* @__PURE__ */ new Set();
   rebuildChain = Promise.resolve();
+  methodFilters;
   constructor(options) {
     super();
     this.options = options;
+    this.methodFilters = {
+      includeMethods: normalizeMethods(options.name, "includeMethods", options.generateOptions?.includeMethods),
+      excludeMethods: normalizeMethods(options.name, "excludeMethods", options.generateOptions?.excludeMethods)
+    };
     this.logger = options.logger ?? createConsoleLogger(`openapi:${options.name}`);
     if (options.polling?.enabled && !("url" in options)) {
       throw new Error(
@@ -1390,6 +1480,8 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
     const generateOptions = this.options.generateOptions;
     let openapiTools = await this.generator.generateTools({
       ...generateOptions,
+      ...this.methodFilters,
+      filterFn: this.operationFilter(),
       preferredStatusCodes: generateOptions?.preferredStatusCodes ?? [200, 201, 202, 204],
       includeDeprecated: generateOptions?.includeDeprecated ?? false,
       includeAllResponses: generateOptions?.includeAllResponses ?? true,
@@ -1475,28 +1567,31 @@ var OpenapiAdapter = class extends import_sdk5.DynamicAdapter {
   resolveRefResolution() {
     return this.options.loadOptions?.refResolution ?? { allowedProtocols: [] };
   }
+  /**
+   * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+   * generator lets an operation with no `operationId` through that list.
+   */
+  operationFilter() {
+    const { includeOperations, filterFn } = this.options.generateOptions ?? {};
+    if (!includeOperations) return filterFn;
+    return (operation) => operation.operationId !== void 0 && includeOperations.includes(operation.operationId) && (filterFn?.(operation) ?? true);
+  }
   async initializeGenerator() {
-    const refResolution = this.resolveRefResolution();
+    const loadOptions = {
+      ...this.options.loadOptions,
+      baseUrl: this.options.baseUrl,
+      validate: this.options.loadOptions?.validate ?? true,
+      dereference: this.options.loadOptions?.dereference ?? true,
+      // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
+      // internal target would otherwise be fetched. With mcp-from-openapi
+      // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
+      followRedirects: this.options.loadOptions?.followRedirects ?? false,
+      refResolution: this.resolveRefResolution()
+    };
     if ("url" in this.options) {
-      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        headers: this.options.loadOptions?.headers,
-        timeout: this.options.loadOptions?.timeout,
-        // SECURITY: do not follow spec-URL redirects by default — a 3xx to an
-        // internal target would otherwise be fetched. With mcp-from-openapi
-        // ≥ 2.5.0 each hop is re-validated; opt in with loadOptions.followRedirects.
-        followRedirects: this.options.loadOptions?.followRedirects ?? false,
-        refResolution
-      });
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromURL(this.options.url, loadOptions);
     } else if ("spec" in this.options) {
-      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, {
-        baseUrl: this.options.baseUrl,
-        validate: this.options.loadOptions?.validate ?? true,
-        dereference: this.options.loadOptions?.dereference ?? true,
-        refResolution
-      });
+      return await import_mcp_from_openapi3.OpenAPIToolGenerator.fromJSON(this.options.spec, loadOptions);
     } else {
       throw new Error("Either url or spec must be provided in OpenApiAdapterOptions");
     }

package/openapi/openapi.adapter.d.ts

@@ -7,6 +7,7 @@ export default class OpenapiAdapter extends DynamicAdapter<OpenApiAdapterOptions
     private poller;
     private updateCallbacks;
     private rebuildChain;
+    private readonly methodFilters;
     constructor(options: OpenApiAdapterOptions);
     /**
      * Receive the SDK logger. Called by the SDK before fetch().
@@ -29,6 +30,11 @@ export default class OpenapiAdapter extends DynamicAdapter<OpenApiAdapterOptions
      * @private
      */
     private resolveRefResolution;
+    /**
+     * `generateOptions.filterFn`, and with `includeOperations` set, only the operations it names: the
+     * generator lets an operation with no `operationId` through that list.
+     */
+    private operationFilter;
     private initializeGenerator;
     /**
      * Apply description mode to generate description from summary/description

package/openapi/openapi.adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.adapter.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.adapter.ts"],"names":[],"mappings":"AAEA,OAAO,EAAW,cAAc,EAAE,KAAK,uBAAuB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAS3G,OAAO,EAIL,KAAK,qBAAqB,EAQ3B,MAAM,iBAAiB,CAAC;AAwBzB,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,qBAAqB,CAAC;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAuB;IACzC,OAAO,CAAC,MAAM,CAAiB;IACxB,OAAO,EAAE,qBAAqB,CAAC;IACtC,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,YAAY,CAAoC;gBAE5C,OAAO,EAAE,qBAAqB;IAc1C;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIjC,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAoH/C;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;YAId,mBAAmB;IA4BjC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA0C5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IAMtB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAoD5B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA0D7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAoBpC;;;;OAIG;YACW,wBAAwB;IAiFtC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAgBlC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IA+BlD;;;OAGG;IACH,OAAO,CAAC,2CAA2C;IAyCnD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI;IAO3E;;;;OAIG;IACH,YAAY,IAAI,IAAI;IA6CpB;;OAEG;IACH,WAAW,IAAI,IAAI;CAOpB"}
+{"version":3,"file":"openapi.adapter.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.adapter.ts"],"names":[],"mappings":"AAOA,OAAO,EAAW,cAAc,EAAE,KAAK,uBAAuB,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAS3G,OAAO,EAIL,KAAK,qBAAqB,EAQ3B,MAAM,iBAAiB,CAAC;AA6CzB,MAAM,CAAC,OAAO,OAAO,cAAe,SAAQ,cAAc,CAAC,qBAAqB,CAAC;IAC/E,OAAO,CAAC,SAAS,CAAC,CAAuB;IACzC,OAAO,CAAC,MAAM,CAAiB;IACxB,OAAO,EAAE,qBAAqB,CAAC;IACtC,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,eAAe,CAA0D;IACjF,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAmE;gBAErF,OAAO,EAAE,qBAAqB;IAkB1C;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,cAAc,GAAG,IAAI;IAIjC,KAAK,IAAI,OAAO,CAAC,uBAAuB,CAAC;IAsH/C;;;OAGG;IACH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,oBAAoB;IAI5B;;;OAGG;IACH,OAAO,CAAC,eAAe;YAST,mBAAmB;IAuBjC;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IA0C5B;;;OAGG;IACH,OAAO,CAAC,cAAc;IAMtB;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IA6D7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAsC3B;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IAwBhC;;;;;OAKG;IACH,OAAO,CAAC,oBAAoB;IAoD5B;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IA0D7B;;;;OAIG;IACH,OAAO,CAAC,qBAAqB;IA0C7B;;;OAGG;IACH,OAAO,CAAC,2BAA2B;IAkBnC;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAoBpC;;;;OAIG;YACW,wBAAwB;IAiFtC;;;OAGG;IACH,OAAO,CAAC,0BAA0B;IAgBlC;;;OAGG;IACH,OAAO,CAAC,0CAA0C;IA+BlD;;;OAGG;IACH,OAAO,CAAC,2CAA2C;IAyCnD;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAuB7B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAiB3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,uBAAuB,KAAK,IAAI,GAAG,MAAM,IAAI;IAO3E;;;;OAIG;IACH,YAAY,IAAI,IAAI;IA6CpB;;OAEG;IACH,WAAW,IAAI,IAAI;CAOpB"}

package/openapi/openapi.tool.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.tool.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAAQ,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK1D,OAAO,KAAK,EAIV,qBAAqB,EAEtB,MAAM,iBAAiB,CAAC;AAMzB;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,cAwTpH"}
+{"version":3,"file":"openapi.tool.d.ts","sourceRoot":"","sources":["../../src/openapi/openapi.tool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGvD,OAAO,EAA2B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAK7E,OAAO,KAAK,EAIV,qBAAqB,EAEtB,MAAM,iBAAiB,CAAC;AAMzB;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,cAAc,cA2UpH"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/adapters",
-  "version": "1.9.1-rc.3",
+  "version": "1.9.2",
   "description": "Adapters for the FrontMCP framework",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -64,15 +64,15 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@frontmcp/auth": "1.9.1-rc.3",
-    "@frontmcp/di": "1.9.1-rc.3",
-    "@frontmcp/sdk": "1.9.1-rc.3",
-    "@frontmcp/utils": "1.9.1-rc.3",
+    "@frontmcp/auth": "1.9.2",
+    "@frontmcp/di": "1.9.2",
+    "@frontmcp/sdk": "1.9.2",
+    "@frontmcp/utils": "1.9.2",
     "js-yaml": "^4.1.0",
     "mcp-from-openapi": "2.8.0",
     "openapi-types": "^12.1.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.9.1-rc.3"
+    "@frontmcp/lazy-zod": "1.9.2"
   }
 }

package/skills/index.js

@@ -942,7 +942,7 @@ var SaasPullSource = class {
         bundle = await this.loadCache();
         if (!bundle) {
           throw new Error(
-            `[saas-source] initial pull failed and no cached bundle is available at ${this.cachePath()}: ${e.message}`,
+            `[saas-source] initial pull failed and no cached bundle is available ${this.cacheLocation()}: ${e.message}`,
             { cause: e }
           );
         }
@@ -1088,6 +1088,10 @@ var SaasPullSource = class {
       trimmed.startsWith("{") || trimmed.startsWith("[") ? { kind: "json", content: body } : { kind: "yaml", content: body }
     );
   }
+  /** Where the last-good bundle is kept, for messages: an injected store (a Worker's KV) has no file path. */
+  cacheLocation() {
+    return this.deps.cache ? "in the injected bundle cache" : `at ${this.cachePath()}`;
+  }
   cachePath() {
     const dir = this.cacheDir ?? DEFAULT_CACHE_DIR;
     return (0, import_utils.pathResolve)(dir, `${this.options.expectedAudience.replace(/[^a-zA-Z0-9_.-]/g, "_")}.json`);

package/skills/sources/saas-pull.source.d.ts

@@ -72,6 +72,8 @@ export declare class SaasPullSource implements SkillBundleSource {
      */
     private verifyPullToken;
     private fetchOnce;
+    /** Where the last-good bundle is kept, for messages: an injected store (a Worker's KV) has no file path. */
+    private cacheLocation;
     private cachePath;
     private persistCache;
     private loadCache;

package/skills/sources/saas-pull.source.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAMjH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IAUpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;gBAGhC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAyBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;YA2Cf,SAAS;IAkBvB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;IAkBvB,OAAO,CAAC,MAAM;CASf"}
+{"version":3,"file":"saas-pull.source.d.ts","sourceRoot":"","sources":["../../../src/skills/sources/saas-pull.source.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAGpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAMjH;;;;GAIG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AA4BD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,cAAe,YAAW,iBAAiB;IAUpD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAZvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,OAAO,CAAC,SAAS,CAAmC;IACpD,OAAO,CAAC,UAAU,CAA6B;IAC/C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAuB;gBAGhC,OAAO,EAAE,iBAAiB,EAC1B,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,MAAM,EAAE,cAAc,EACtB,IAAI,GAAE,gBAAqB;IAKxC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAwC5B,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,IAAI;IAO9C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAS3B,OAAO,CAAC,YAAY;IAcpB;;;;;;OAMG;IACG,OAAO,IAAI,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;YAatC,QAAQ;cAyBN,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAoBhH;;;;OAIG;YACW,eAAe;YA2Cf,SAAS;IAkBvB,4GAA4G;IAC5G,OAAO,CAAC,aAAa;IAIrB,OAAO,CAAC,SAAS;YAKH,YAAY;YAeZ,SAAS;IAkBvB,OAAO,CAAC,MAAM;CASf"}