@knitli/openapi-mcp 0.0.0

package/dist/permissions.d.ts

@@ -0,0 +1,31 @@
+import type { OperationRecord, PermConfidence } from "./types.ts";
+export interface PermissionsDataset {
+    permissions: Record<string, {
+        schemes?: Record<string, {
+            privilegeLevel?: number;
+        }>;
+        pathSets?: Array<{
+            methods?: string[];
+            paths?: Record<string, unknown>;
+        }>;
+    }>;
+}
+export interface PermissionMatch {
+    permissions: string[];
+    privilegeLevel: number | null;
+    confidence: PermConfidence;
+}
+export interface PermissionIndex {
+    /** method -> normalised path -> permission names */
+    byMethod: Map<string, Map<string, Set<string>>>;
+    privilege: Map<string, number>;
+}
+export declare function buildPermissionIndex(dataset: PermissionsDataset): PermissionIndex;
+/**
+ * Three strategies in order: exact, OData-suffix-stripped, then longest
+ * prefix. Prefix matches are a heuristic and are marked as such — a child
+ * path can require a broader permission than its parent.
+ */
+export declare function lookupPermissions(index: PermissionIndex, path: string, method: string): PermissionMatch | null;
+/** Annotates records in place and recomputes risk now that privilege is known. */
+export declare function applyPermissions(ops: OperationRecord[], index: PermissionIndex): void;

package/dist/permissions.js

@@ -0,0 +1,89 @@
+import { riskFor } from "./safety.js";
+/** Parameter names differ between the two Microsoft datasets; erase them. */
+function normalise(path) {
+    return path
+        .replace(/\{[^}]*\}/g, "{}")
+        .replace(/\/+$/, "")
+        .toLowerCase();
+}
+const ODATA_SUFFIX = /\/(\$count|\$ref|\$value|microsoft\.graph\.[a-z0-9.]+)$/;
+export function buildPermissionIndex(dataset) {
+    const byMethod = new Map();
+    const privilege = new Map();
+    for (const [name, body] of Object.entries(dataset.permissions ?? {})) {
+        const level = body.schemes?.DelegatedWork?.privilegeLevel;
+        if (typeof level === "number")
+            privilege.set(name, level);
+        for (const set of body.pathSets ?? []) {
+            for (const method of set.methods ?? []) {
+                const key = method.toUpperCase();
+                let table = byMethod.get(key);
+                if (!table) {
+                    table = new Map();
+                    byMethod.set(key, table);
+                }
+                for (const path of Object.keys(set.paths ?? {})) {
+                    const n = normalise(path);
+                    let names = table.get(n);
+                    if (!names) {
+                        names = new Set();
+                        table.set(n, names);
+                    }
+                    names.add(name);
+                }
+            }
+        }
+    }
+    return { byMethod, privilege };
+}
+function finish(index, names, confidence) {
+    const permissions = [...names].sort();
+    // Several permissions can authorise one operation; the strictest bounds risk.
+    const levels = permissions
+        .map((p) => index.privilege.get(p))
+        .filter((l) => typeof l === "number");
+    return {
+        permissions,
+        privilegeLevel: levels.length ? Math.max(...levels) : null,
+        confidence,
+    };
+}
+/**
+ * Three strategies in order: exact, OData-suffix-stripped, then longest
+ * prefix. Prefix matches are a heuristic and are marked as such — a child
+ * path can require a broader permission than its parent.
+ */
+export function lookupPermissions(index, path, method) {
+    const table = index.byMethod.get(method.toUpperCase());
+    if (!table)
+        return null;
+    const exact = normalise(path);
+    const hitExact = table.get(exact);
+    if (hitExact)
+        return finish(index, hitExact, "exact");
+    const stripped = exact.replace(ODATA_SUFFIX, "");
+    if (stripped !== exact) {
+        const hitSuffix = table.get(stripped);
+        if (hitSuffix)
+            return finish(index, hitSuffix, "suffix");
+    }
+    const parts = stripped.split("/");
+    for (let i = parts.length - 1; i > 1; i--) {
+        const hitPrefix = table.get(parts.slice(0, i).join("/"));
+        if (hitPrefix)
+            return finish(index, hitPrefix, "prefix");
+    }
+    return null;
+}
+/** Annotates records in place and recomputes risk now that privilege is known. */
+export function applyPermissions(ops, index) {
+    for (const op of ops) {
+        const match = lookupPermissions(index, op.path, op.method);
+        if (match) {
+            op.permissions = match.permissions;
+            op.permConfidence = match.confidence;
+            op.privilegeLevel = match.privilegeLevel;
+        }
+        op.risk = riskFor(op.safety, op.privilegeLevel, op.path);
+    }
+}

package/dist/release/compile-release.d.ts

@@ -0,0 +1,33 @@
+import { type CompilerLimits } from "./load-v4.ts";
+import { type CompiledRelease, type CompiledReleasePaths } from "./publish.ts";
+import { type ReferenceResolver } from "./reference-map.ts";
+type Provenance = {
+    readonly sourceUri: string;
+    readonly sourceLabel?: never;
+} | {
+    readonly sourceLabel: string;
+    readonly sourceUri?: never;
+};
+export type CompileReleaseOptions = Provenance & {
+    readonly specPath: string;
+    readonly sourceRevision: string;
+    readonly catalogId: string;
+    readonly releaseId: string;
+    readonly generation: number;
+    readonly issuer: string;
+    readonly keyId: string;
+    readonly policyId: string;
+    readonly allowedOrigins: readonly string[];
+    readonly outDir: string;
+    readonly privateKeyPem: string;
+    readonly permissionsPath?: string;
+    readonly referenceRoot?: string;
+    readonly referenceMapPath?: string;
+    readonly referenceResolver?: ReferenceResolver;
+    readonly limits?: CompilerLimits;
+};
+export type ConstructionCheckpoint = "before-sqlite-created" | "before-signature-created" | "before-manifest-created" | "after-sqlite-opened" | "after-sqlite-emitted" | "before-sqlite-snapshot-read" | "after-signature-opened" | "after-manifest-opened";
+type ConstructionHook = (checkpoint: ConstructionCheckpoint, paths: CompiledReleasePaths) => void | Promise<void>;
+export declare function compileReleaseWithCheckpoint(options: CompileReleaseOptions, checkpoint?: ConstructionHook): Promise<CompiledRelease>;
+export declare function compileRelease(options: CompileReleaseOptions): Promise<CompiledRelease>;
+export {};