@knitli/openapi-mcp 0.0.0

package/dist/safety.js

@@ -0,0 +1,60 @@
+const READ_METHODS = new Set(["GET", "HEAD"]);
+/**
+ * Operation-id suffixes that are POSTs by protocol but reads by semantics,
+ * keyed by the API they were derived from. Scoping is load-bearing, not
+ * tidiness: `preview` and `query` are generic enough that another mounted API
+ * will have a genuinely mutating `POST .../query`, and a global list would
+ * classify it `read` — reachable through the no-approval read tool. An API
+ * with no entry here gets no overrides, so mutating methods stay `write`.
+ *
+ * This table is engine code, not artifact data: the server recomputes safety
+ * at load and honours a stored `read` on a mutating method only if the same
+ * `(api, suffix)` pair appears here.
+ */
+export const READ_OVERRIDES = {
+    graph: [
+        "getByIds",
+        "getMemberGroups",
+        "getMemberObjects",
+        "checkMemberGroups",
+        "checkMemberObjects",
+        "getAvailableExtensionProperties",
+        "findMeetingTimes",
+        "getSchedule",
+        "translateExchangeIds",
+        "preview",
+        "query",
+    ],
+};
+/** A batch endpoint bundles arbitrary sub-request methods, so it is never a read. */
+export function isBatch(path) {
+    return path === "/$batch" || path.endsWith("/$batch");
+}
+/**
+ * Classifies an operation as read or write. Method is the default; the
+ * API's own override list corrects semantically-read POSTs. `$batch` always
+ * wins, and an unrecognised API never gets an override.
+ */
+export function classifySafety(method, path, operationId, api) {
+    if (isBatch(path))
+        return "write";
+    if (READ_METHODS.has(method.toUpperCase()))
+        return "read";
+    const tail = operationId.split(".").pop() ?? "";
+    const overrides = READ_OVERRIDES[api] ?? [];
+    return overrides.some((s) => s === tail) ? "read" : "write";
+}
+/**
+ * Risk tier drives which write tool an operation is reachable through.
+ * Unknown privilege is treated as high: 22% of Graph has no permission
+ * mapping, and unmapped must not silently mean "safe".
+ */
+export function riskFor(safety, privilegeLevel, path) {
+    if (isBatch(path))
+        return "high";
+    if (safety === "read")
+        return "routine";
+    if (privilegeLevel === null)
+        return "high";
+    return privilegeLevel >= 4 ? "high" : "routine";
+}

package/dist/schema.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseSync } from "node:sqlite";
+/** Bumped when the artifact layout changes incompatibly. Servers refuse unknown versions. */
+export declare const LEGACY_FORMAT_VERSION = 3;
+/** Creates every table, index, and virtual table the artifact needs. */
+export declare function createSchema(db: DatabaseSync): void;

package/dist/schema.js

@@ -0,0 +1,52 @@
+/** Bumped when the artifact layout changes incompatibly. Servers refuse unknown versions. */
+export const LEGACY_FORMAT_VERSION = 3;
+// `fts5` MUST be lower-case: D1 rejects `FTS5` as "not authorized".
+const DDL = `
+CREATE TABLE operations (
+  qualified_id    TEXT PRIMARY KEY,
+  api             TEXT NOT NULL,
+  operation_id    TEXT NOT NULL,
+  method          TEXT NOT NULL,
+  path            TEXT NOT NULL,
+  safety          TEXT NOT NULL CHECK (safety IN ('read','write')),
+  risk            TEXT NOT NULL CHECK (risk IN ('routine','high')),
+  operation_type  TEXT,
+  pageable        INTEGER NOT NULL DEFAULT 0,
+  deprecated      INTEGER NOT NULL DEFAULT 0,
+  permissions     TEXT,
+  perm_confidence TEXT,
+  privilege_level INTEGER,
+  summary         TEXT,
+  tags            TEXT,
+  params_json     TEXT NOT NULL,
+  search_text     TEXT NOT NULL,
+  body_ref        TEXT,
+  body_schema     TEXT,
+  body_media_type TEXT,
+  server_url      TEXT NOT NULL
+);
+
+CREATE INDEX operations_api ON operations (api);
+CREATE INDEX operations_safety ON operations (api, safety, risk);
+
+CREATE VIRTUAL TABLE operations_fts USING fts5(
+  qualified_id, operation_id, summary, path, tags, api, search_text,
+  content='operations', content_rowid='rowid'
+);
+
+CREATE TABLE schemas (
+  api  TEXT NOT NULL,
+  name TEXT NOT NULL,
+  json TEXT NOT NULL,
+  PRIMARY KEY (api, name)
+);
+
+CREATE TABLE meta (
+  key   TEXT PRIMARY KEY,
+  value TEXT NOT NULL
+);
+`;
+/** Creates every table, index, and virtual table the artifact needs. */
+export function createSchema(db) {
+    db.exec(DDL);
+}

package/dist/schemas.d.ts

@@ -0,0 +1,9 @@
+import type { OpenApiDoc } from "./load.ts";
+import type { SchemaRecord } from "./types.ts";
+/**
+ * Stores each component schema exactly as written, with `$ref`s intact.
+ * Resolution happens at request time against one operation's closure;
+ * eager dereferencing of Microsoft Graph exceeds 342 MB and, resolved per
+ * `$ref` hop rather than per nesting level, does not terminate at all.
+ */
+export declare function extractSchemas(doc: OpenApiDoc, api: string): SchemaRecord[];

package/dist/schemas.js

@@ -0,0 +1,16 @@
+/**
+ * Stores each component schema exactly as written, with `$ref`s intact.
+ * Resolution happens at request time against one operation's closure;
+ * eager dereferencing of Microsoft Graph exceeds 342 MB and, resolved per
+ * `$ref` hop rather than per nesting level, does not terminate at all.
+ */
+export function extractSchemas(doc, api) {
+    const schemas = doc.components?.schemas;
+    if (!schemas)
+        return [];
+    return Object.entries(schemas).map(([name, value]) => ({
+        api,
+        name: `#/components/schemas/${name}`,
+        json: JSON.stringify(value),
+    }));
+}

package/dist/sign.d.ts

@@ -0,0 +1,20 @@
+import type { ManifestSignature, ReleaseManifestV4 } from "./runtime/types.ts";
+/** Ed25519 keypair, PEM encoded. The public key ships in plugin source. */
+export declare function generateKeypair(): {
+    publicKeyPem: string;
+    privateKeyPem: string;
+};
+/** Signs the artifact's exact bytes. Returns a base64 signature. */
+export declare function signArtifact(path: string, privateKeyPem: string): Promise<string>;
+/**
+ * Verifies an artifact against a public key. Returns false rather than
+ * throwing on malformed input — callers treat any failure identically.
+ */
+export declare function verifyArtifact(path: string, signatureB64: string, publicKeyPem: string): Promise<boolean>;
+/** Sign canonical v4/v5 manifest JSON under its versioned domain separator. */
+export declare function signReleaseManifestV4(manifest: ReleaseManifestV4, keyId: string, privateKeyPem: string): {
+    manifestJson: string;
+    signature: ManifestSignature;
+};
+/** Derive the unpadded base64url SPKI used by the Worker-safe trust contract. */
+export declare function deriveReleasePublicKeyV4(privateKeyPem: string): string;

package/dist/sign.js

@@ -0,0 +1,55 @@
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign, verify, } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { canonicalJson } from "./runtime/strict-json.js";
+function manifestSignatureDomain(format) {
+    return `knitli.openapi-mcp.release-manifest.v${format}\0`;
+}
+/** Ed25519 keypair, PEM encoded. The public key ships in plugin source. */
+export function generateKeypair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    return {
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+        privateKeyPem: privateKey
+            .export({ type: "pkcs8", format: "pem" })
+            .toString(),
+    };
+}
+/** Signs the artifact's exact bytes. Returns a base64 signature. */
+export async function signArtifact(path, privateKeyPem) {
+    const bytes = await readFile(path);
+    const key = createPrivateKey(privateKeyPem);
+    return sign(null, bytes, key).toString("base64");
+}
+/**
+ * Verifies an artifact against a public key. Returns false rather than
+ * throwing on malformed input — callers treat any failure identically.
+ */
+export async function verifyArtifact(path, signatureB64, publicKeyPem) {
+    try {
+        const bytes = await readFile(path);
+        const key = createPublicKey(publicKeyPem);
+        return verify(null, bytes, key, Buffer.from(signatureB64, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+/** Sign canonical v4/v5 manifest JSON under its versioned domain separator. */
+export function signReleaseManifestV4(manifest, keyId, privateKeyPem) {
+    const manifestJson = canonicalJson(manifest);
+    const payload = Buffer.concat([
+        Buffer.from(manifestSignatureDomain(manifest.format), "utf8"),
+        Buffer.from(manifestJson, "utf8"),
+    ]);
+    const signature = sign(null, payload, createPrivateKey(privateKeyPem)).toString("base64url");
+    return {
+        manifestJson,
+        signature: { algorithm: "Ed25519", keyId, signature },
+    };
+}
+/** Derive the unpadded base64url SPKI used by the Worker-safe trust contract. */
+export function deriveReleasePublicKeyV4(privateKeyPem) {
+    return createPublicKey(createPrivateKey(privateKeyPem))
+        .export({ type: "spki", format: "der" })
+        .toString("base64url");
+}

package/dist/sqlite/auth.d.ts

@@ -0,0 +1,33 @@
+import type { CredentialBindingResolver, CredentialProvider, LocalAuthProfile, SecretStore, Sha256 } from "../runtime/types.ts";
+/** @internal Dependency seams exist only for deterministic local adapter tests. */
+export interface CredentialProviderOptions {
+    readonly manifestOrigins: readonly string[];
+    readonly secretStore?: SecretStore;
+    readonly environment?: Readonly<Record<string, string | undefined>>;
+    readonly fetch?: typeof globalThis.fetch;
+    readonly now?: () => number;
+    readonly randomBytes?: (size: number) => Uint8Array;
+    readonly authorizationDeadlineMs?: number;
+    readonly tokenDeadlineMs?: number;
+    readonly maxTokenResponseBytes?: number;
+}
+export interface LocalCredentialProvider extends CredentialProvider {
+    readonly bindingResolver: CredentialBindingResolver;
+    /**
+     * Clears process-local credentials only. To invalidate the upstream grant,
+     * use the provider account's documented revocation procedure; v1 does not
+     * invent or call a provider revocation endpoint.
+     */
+    forget(): Promise<void>;
+    close(): Promise<void>;
+}
+export declare class MemorySecretStore implements SecretStore {
+    #private;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
+/** Validate local profile semantics without resolving credentials or performing I/O. */
+export declare function validateLocalAuthProfile(profile: LocalAuthProfile): LocalAuthProfile;
+export declare function digestCredentialProfile(profile: LocalAuthProfile): Promise<Sha256>;
+export declare function createCredentialProvider(rawProfile: LocalAuthProfile, options: CredentialProviderOptions): Promise<LocalCredentialProvider>;