@knitli/openapi-mcp 0.0.0

package/dist/release/reference-map.js

@@ -0,0 +1,347 @@
+import { createHash } from "node:crypto";
+import { constants } from "node:fs";
+import { open, realpath } from "node:fs/promises";
+import { extname, isAbsolute, posix, relative, resolve, sep } from "node:path";
+import { sha256 } from "../runtime/digest.js";
+import { parseJsonStrict } from "../runtime/strict-json.js";
+import { DEFAULT_COMPILER_LIMITS, parseDocumentBytesV4, readFileBoundedV4, readOpenedFileBoundedV4, requireOpenedFileV4, } from "./load-v4.js";
+import { capturePathIdentity, samePathIdentity, } from "./publish.js";
+const digestPattern = /^[0-9a-f]{64}$/;
+const unreserved = /^[A-Za-z0-9._~-]$/;
+function normalizeEscapes(value) {
+    let output = "";
+    for (let index = 0; index < value.length; index += 1) {
+        if (value[index] !== "%") {
+            output += value[index];
+            continue;
+        }
+        const pair = value.slice(index + 1, index + 3);
+        if (!/^[0-9A-Fa-f]{2}$/.test(pair))
+            throw new Error("URI contains an invalid percent escape");
+        const character = String.fromCharCode(Number.parseInt(pair, 16));
+        output += unreserved.test(character) ? character : `%${pair.toUpperCase()}`;
+        index += 2;
+    }
+    return output;
+}
+export function normalizeHttpsUri(value) {
+    if (value.length > 2048 || !/^[\x21-\x7e]+$/.test(value))
+        throw new Error("source URI is invalid");
+    normalizeEscapes(value);
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error("source URI is invalid");
+    }
+    if (url.protocol !== "https:" ||
+        url.username !== "" ||
+        url.password !== "" ||
+        url.search !== "" ||
+        url.hash !== "")
+        throw new Error("source URI must be credential-free HTTPS without query or fragment");
+    url.pathname = normalizeEscapes(url.pathname || "/");
+    return url.href;
+}
+export function sourceUriFromLabel(label) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(label) ||
+        label === "." ||
+        label === "..") {
+        throw new Error("source label is invalid");
+    }
+    return `urn:openapi-source:${label}`;
+}
+function normalizeRelativeGraphUri(value, base) {
+    if (value.startsWith("/") ||
+        value.startsWith("//") ||
+        value.includes("?") ||
+        value.includes("#")) {
+        throw new Error("relative reference-map URI is invalid");
+    }
+    const joined = base === undefined ? value : posix.join(posix.dirname(base), value);
+    const normalized = normalizeEscapes(joined);
+    if (!normalized ||
+        normalized.startsWith("/") ||
+        normalized
+            .split("/")
+            .some((part) => part === "." || part === ".." || part === "")) {
+        throw new Error("relative reference-map URI traverses or is noncanonical");
+    }
+    return normalized;
+}
+export function normalizeGraphUri(value, baseUri) {
+    if (/^[A-Za-z][A-Za-z0-9+.-]*:/.test(value))
+        return normalizeHttpsUri(value);
+    if (value.startsWith("//"))
+        throw new Error("network-path references are unsupported");
+    if (baseUri.startsWith("https:"))
+        return normalizeHttpsUri(new URL(value, baseUri).href);
+    return normalizeRelativeGraphUri(value, baseUri.startsWith("urn:") ? undefined : baseUri);
+}
+function exactObject(value, keys, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        throw new Error(`${label} must be an object`);
+    const actual = Object.keys(value).sort();
+    const expected = [...keys].sort();
+    if (actual.length !== expected.length ||
+        actual.some((key, index) => key !== expected[index]))
+        throw new Error(`${label} shape is invalid`);
+    return value;
+}
+export async function loadReferenceMap(mapPath, sourceUri, limits = DEFAULT_COMPILER_LIMITS) {
+    let text;
+    try {
+        const bytes = await readFileBoundedV4(mapPath, Math.min(limits.maxSourceBytes, 8 * 1024 * 1024), "reference map");
+        text = new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+    }
+    catch {
+        throw new Error("reference map could not be read");
+    }
+    const root = exactObject(parseJsonStrict(text, {
+        maxBytes: Math.min(limits.maxSourceBytes, 8 * 1024 * 1024),
+        maxDepth: limits.maxJsonDepth,
+        maxKeys: limits.maxDocumentKeys,
+    }), ["entries", "version"], "reference map");
+    if (root.version !== 1 || !Array.isArray(root.entries))
+        throw new Error("reference map version or entries are invalid");
+    if (root.entries.length > limits.maxReferencedDocuments)
+        throw new Error("referenced document count exceeds limit");
+    const seen = new Set();
+    const entries = root.entries.map((raw, index) => {
+        const entry = exactObject(raw, ["file", "sha256", "uri"], `reference map entry ${index}`);
+        if (typeof entry.uri !== "string" ||
+            typeof entry.file !== "string" ||
+            typeof entry.sha256 !== "string" ||
+            !digestPattern.test(entry.sha256)) {
+            throw new Error(`reference map entry ${index} is invalid`);
+        }
+        const uri = normalizeGraphUri(entry.uri, sourceUri);
+        if (seen.has(uri))
+            throw new Error("duplicate normalized reference-map URI");
+        seen.add(uri);
+        if (isAbsolute(entry.file) ||
+            entry.file.includes("\\") ||
+            entry.file
+                .split("/")
+                .some((part) => part === "" || part === "." || part === "..")) {
+            throw new Error("reference-map file must be a contained POSIX-relative path");
+        }
+        return { uri, file: entry.file, sha256: entry.sha256 };
+    });
+    entries.sort((left, right) => left.uri < right.uri ? -1 : left.uri > right.uri ? 1 : 0);
+    return { version: 1, entries };
+}
+export async function referenceGraphDigest(map) {
+    return sha256("knitli.openapi-mcp.reference-graph.v1", map.entries.map(({ uri, sha256: digest }) => ({
+        uri,
+        sha256: digest,
+    })));
+}
+async function requireReferenceRoot(root, identity) {
+    const current = await capturePathIdentity(root, "directory").catch(() => null);
+    if (!current || !samePathIdentity(current, identity))
+        throw new Error("reference root identity was lost");
+}
+function requireContainedReference(root, actual) {
+    const relation = relative(root, actual);
+    if (relation === "" ||
+        relation === ".." ||
+        relation.startsWith(`..${sep}`) ||
+        isAbsolute(relation))
+        throw new Error("reference-map file escapes reference root");
+}
+async function captureReferenceDirectories(root, path) {
+    const relation = relative(root, path);
+    const directories = [];
+    let current = root;
+    for (const component of relation.split(sep).slice(0, -1)) {
+        current = resolve(current, component);
+        const identity = await capturePathIdentity(current, "directory").catch(() => {
+            throw new Error("referenced document directory identity was lost");
+        });
+        directories.push({ path: current, identity });
+    }
+    return directories;
+}
+async function requireReferenceDirectories(directories) {
+    for (const directory of directories) {
+        const current = await capturePathIdentity(directory.path, "directory").catch(() => null);
+        if (!current || !samePathIdentity(current, directory.identity))
+            throw new Error("referenced document directory identity was lost");
+    }
+}
+async function captureReferencePath(root, path) {
+    const directories = await captureReferenceDirectories(root, path);
+    const leaf = await capturePathIdentity(path, "file").catch(() => {
+        throw new Error("referenced document could not be read");
+    });
+    return { directories, leaf };
+}
+async function requireReferencePath(path, expected) {
+    await requireReferenceDirectories(expected.directories);
+    const current = await capturePathIdentity(path, "file").catch(() => null);
+    if (!current || !samePathIdentity(current, expected.leaf))
+        throw new Error("referenced document identity was lost");
+}
+let referenceReadTestCheckpoint;
+async function readContainedReference(root, rootIdentity, candidate, maxBytes) {
+    await requireReferenceRoot(root, rootIdentity);
+    const actual = await realpath(candidate).catch(() => {
+        throw new Error("reference-map file is unavailable");
+    });
+    requireContainedReference(root, actual);
+    const candidatePath = await captureReferencePath(root, candidate);
+    const actualPath = await captureReferencePath(root, actual);
+    if (!samePathIdentity(candidatePath.leaf, actualPath.leaf))
+        throw new Error("referenced document path identity was lost");
+    await requireReferenceRoot(root, rootIdentity);
+    await requireReferencePath(candidate, candidatePath);
+    await requireReferencePath(actual, actualPath);
+    await referenceReadTestCheckpoint?.beforeOpen();
+    if (typeof constants.O_NOFOLLOW !== "number" || constants.O_NOFOLLOW === 0)
+        throw new Error("referenced document requires O_NOFOLLOW support");
+    const handle = await open(actual, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    try {
+        await requireOpenedFileV4(handle, actualPath.leaf, "referenced document").catch(() => {
+            throw new Error("referenced document descriptor identity was lost");
+        });
+        await requireReferenceRoot(root, rootIdentity);
+        await requireReferencePath(candidate, candidatePath);
+        await requireReferencePath(actual, actualPath);
+        referenceReadTestCheckpoint?.onRead();
+        const bytes = await readOpenedFileBoundedV4(handle, actualPath.leaf, maxBytes, "referenced document");
+        await requireReferenceRoot(root, rootIdentity);
+        await requireReferencePath(candidate, candidatePath);
+        const currentActual = await realpath(candidate).catch(() => {
+            throw new Error("referenced document identity was lost");
+        });
+        if (currentActual !== actual)
+            throw new Error("referenced document path identity was lost");
+        requireContainedReference(root, currentActual);
+        await requireReferencePath(actual, actualPath);
+        await requireReferenceRoot(root, rootIdentity);
+        await requireReferencePath(candidate, candidatePath);
+        await requireReferencePath(actual, actualPath);
+        return bytes;
+    }
+    finally {
+        await handle.close();
+    }
+}
+export class ReferenceGraphV4 {
+    sourceUri;
+    map;
+    #entries;
+    #cache = new Map();
+    #root;
+    #rootIdentity;
+    #resolver;
+    #limits;
+    #bytesUsed;
+    /** @internal Test-only hook; this module is not exported by the package. */
+    static setReferenceReadCheckpointForTesting(checkpoint) {
+        referenceReadTestCheckpoint = checkpoint;
+    }
+    constructor(sourceUri, map, root, rootIdentity, resolver, limits, rootBytes) {
+        this.sourceUri = sourceUri;
+        this.map = map;
+        this.#entries = new Map(map.entries.map((entry) => [entry.uri, entry]));
+        this.#root = root;
+        this.#rootIdentity = rootIdentity;
+        this.#resolver = resolver;
+        this.#limits = limits;
+        this.#bytesUsed = rootBytes;
+    }
+    static async create(options) {
+        const map = options.mapPath
+            ? await loadReferenceMap(options.mapPath, options.sourceUri, options.limits)
+            : { version: 1, entries: [] };
+        if ((map.entries.length > 0 || options.resolver) &&
+            !options.referenceRoot &&
+            !options.resolver) {
+            throw new Error("reference root is required for a reference map");
+        }
+        const root = options.referenceRoot
+            ? await realpath(options.referenceRoot).catch(() => {
+                throw new Error("reference root is invalid");
+            })
+            : null;
+        const rootIdentity = root
+            ? await capturePathIdentity(root, "directory").catch(() => {
+                throw new Error("reference root is invalid");
+            })
+            : null;
+        return new ReferenceGraphV4(options.sourceUri, map, root, rootIdentity, options.resolver, options.limits, options.rootBytes);
+    }
+    async resolve(rawRef, fromUri, depth) {
+        if (Buffer.byteLength(rawRef) > this.#limits.maxRefLength)
+            throw new Error("reference exceeds ref length limit");
+        if (depth > this.#limits.maxJsonDepth)
+            throw new Error("reference depth exceeds limit");
+        const hashIndex = rawRef.indexOf("#");
+        const rawDocument = hashIndex < 0 ? rawRef : rawRef.slice(0, hashIndex);
+        const pointer = hashIndex < 0 ? "#" : `#${rawRef.slice(hashIndex + 1)}`;
+        if (rawDocument === "")
+            throw new Error("local reference must be resolved against its current document");
+        const uri = normalizeGraphUri(rawDocument, fromUri);
+        const entry = this.#entries.get(uri);
+        if (!entry)
+            throw new Error("external reference is absent from the reference map");
+        let resolved = this.#cache.get(uri);
+        if (!resolved) {
+            let bytes;
+            let mediaType;
+            if (this.#resolver) {
+                const result = await this.#resolver.resolve(uri);
+                if (result.bytes.byteLength >
+                    this.#limits.maxSourceBytes - this.#bytesUsed)
+                    throw new Error("aggregate source bytes exceed limit");
+                bytes = new Uint8Array(result.bytes);
+                mediaType = result.mediaType;
+            }
+            else {
+                if (!this.#root || !this.#rootIdentity)
+                    throw new Error("reference root is required");
+                const candidate = resolve(this.#root, ...entry.file.split("/"));
+                bytes = await readContainedReference(this.#root, this.#rootIdentity, candidate, this.#limits.maxSourceBytes - this.#bytesUsed).catch((error) => {
+                    if (error instanceof Error &&
+                        error.message.includes("exceeds byte limit"))
+                        throw new Error("aggregate source bytes exceed limit");
+                    if (error instanceof Error &&
+                        (/^reference root identity was lost$/.test(error.message) ||
+                            /^reference-map file escapes reference root$/.test(error.message) ||
+                            /^referenced document (path |directory |descriptor )?identity was lost$/.test(error.message)))
+                        throw error;
+                    throw new Error("referenced document could not be read");
+                });
+                const extension = extname(entry.file).toLowerCase();
+                mediaType =
+                    extension === ".json"
+                        ? "json"
+                        : extension === ".yaml" || extension === ".yml"
+                            ? "yaml"
+                            : (() => {
+                                throw new Error("unsupported referenced media type");
+                            })();
+            }
+            const actualDigest = createHash("sha256").update(bytes).digest("hex");
+            if (actualDigest !== entry.sha256)
+                throw new Error("reference-map content digest mismatch");
+            if (this.#bytesUsed + bytes.byteLength > this.#limits.maxSourceBytes)
+                throw new Error("aggregate source bytes exceed limit");
+            this.#bytesUsed += bytes.byteLength;
+            const document = parseDocumentBytesV4(bytes, mediaType, {
+                ...this.#limits,
+                maxSourceBytes: bytes.byteLength,
+            });
+            if (typeof document !== "object" ||
+                document === null ||
+                Array.isArray(document))
+                throw new Error("referenced document must be an object");
+            resolved = { uri, document: document };
+            this.#cache.set(uri, resolved);
+        }
+        return { uri, pointer, document: resolved.document };
+    }
+}

package/dist/release/schema-v4.d.ts

@@ -0,0 +1,5 @@
+import type { DatabaseSync } from "node:sqlite";
+/** Compatibility-era schema name for immutable v4/v5 SQLite and D1 transport. */
+export declare const RELEASE_SCHEMA_V4 = "\nPRAGMA foreign_keys = ON;\n\nCREATE TABLE release_metadata (\n  catalog_id TEXT NOT NULL COLLATE BINARY,\n  release_id TEXT NOT NULL COLLATE BINARY,\n  format INTEGER NOT NULL CHECK (format IN (4, 5)),\n  contract INTEGER NOT NULL CHECK (contract = 1),\n  generation INTEGER NOT NULL CHECK (generation >= 0),\n  issuer TEXT NOT NULL COLLATE BINARY,\n  key_id TEXT NOT NULL COLLATE BINARY,\n  policy_id TEXT NOT NULL COLLATE BINARY,\n  allowed_origins_json TEXT NOT NULL,\n  compiled_at TEXT NOT NULL,\n  compiler_version TEXT NOT NULL,\n  source_uri TEXT NOT NULL,\n  source_revision TEXT NOT NULL,\n  source_content_sha256 TEXT NOT NULL CHECK (\n    length(source_content_sha256) = 64\n    AND source_content_sha256 NOT GLOB '*[^0-9a-f]*'\n  ),\n  reference_graph_digest TEXT NOT NULL CHECK (\n    length(reference_graph_digest) = 64\n    AND reference_graph_digest NOT GLOB '*[^0-9a-f]*'\n  ),\n  manifest_json TEXT NOT NULL,\n  signature_algorithm TEXT NOT NULL CHECK (signature_algorithm = 'Ed25519'),\n  signature_key_id TEXT NOT NULL COLLATE BINARY,\n  signature TEXT NOT NULL,\n  PRIMARY KEY (catalog_id, release_id)\n) WITHOUT ROWID;\n\nCREATE TABLE operations (\n  catalog_id TEXT NOT NULL COLLATE BINARY,\n  release_id TEXT NOT NULL COLLATE BINARY,\n  record_id TEXT NOT NULL COLLATE BINARY CHECK (\n    record_id GLOB 'operation:*' AND length(record_id) <= 651\n  ),\n  record_json TEXT NOT NULL,\n  logical_digest TEXT NOT NULL CHECK (\n    length(logical_digest) = 64\n    AND logical_digest NOT GLOB '*[^0-9a-f]*'\n  ),\n  api TEXT NOT NULL COLLATE BINARY,\n  operation_id TEXT NOT NULL COLLATE BINARY,\n  summary TEXT,\n  path TEXT NOT NULL,\n  search_text TEXT NOT NULL,\n  PRIMARY KEY (catalog_id, release_id, record_id),\n  FOREIGN KEY (catalog_id, release_id)\n    REFERENCES release_metadata(catalog_id, release_id)\n    ON UPDATE RESTRICT ON DELETE RESTRICT\n);\n\nCREATE INDEX operations_release_api\n  ON operations (catalog_id, release_id, api, record_id);\n\nCREATE VIRTUAL TABLE operations_fts USING fts5(\n  record_id, operation_id, summary, path, api, search_text,\n  content='operations', content_rowid='rowid'\n);\n\nCREATE TABLE schemas (\n  catalog_id TEXT NOT NULL COLLATE BINARY,\n  release_id TEXT NOT NULL COLLATE BINARY,\n  record_id TEXT NOT NULL COLLATE BINARY CHECK (\n    record_id GLOB 'schema:*' AND length(record_id) <= 669\n  ),\n  record_json TEXT NOT NULL,\n  logical_digest TEXT NOT NULL CHECK (\n    length(logical_digest) = 64\n    AND logical_digest NOT GLOB '*[^0-9a-f]*'\n  ),\n  PRIMARY KEY (catalog_id, release_id, record_id),\n  FOREIGN KEY (catalog_id, release_id)\n    REFERENCES release_metadata(catalog_id, release_id)\n    ON UPDATE RESTRICT ON DELETE RESTRICT\n) WITHOUT ROWID;\n";
+export declare function createReleaseSchemaV4(database: DatabaseSync): void;
+export declare function populateOperationsFtsV4(database: DatabaseSync): void;

package/dist/release/schema-v4.js

@@ -0,0 +1,91 @@
+/** Compatibility-era schema name for immutable v4/v5 SQLite and D1 transport. */
+export const RELEASE_SCHEMA_V4 = `
+PRAGMA foreign_keys = ON;
+
+CREATE TABLE release_metadata (
+  catalog_id TEXT NOT NULL COLLATE BINARY,
+  release_id TEXT NOT NULL COLLATE BINARY,
+  format INTEGER NOT NULL CHECK (format IN (4, 5)),
+  contract INTEGER NOT NULL CHECK (contract = 1),
+  generation INTEGER NOT NULL CHECK (generation >= 0),
+  issuer TEXT NOT NULL COLLATE BINARY,
+  key_id TEXT NOT NULL COLLATE BINARY,
+  policy_id TEXT NOT NULL COLLATE BINARY,
+  allowed_origins_json TEXT NOT NULL,
+  compiled_at TEXT NOT NULL,
+  compiler_version TEXT NOT NULL,
+  source_uri TEXT NOT NULL,
+  source_revision TEXT NOT NULL,
+  source_content_sha256 TEXT NOT NULL CHECK (
+    length(source_content_sha256) = 64
+    AND source_content_sha256 NOT GLOB '*[^0-9a-f]*'
+  ),
+  reference_graph_digest TEXT NOT NULL CHECK (
+    length(reference_graph_digest) = 64
+    AND reference_graph_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  manifest_json TEXT NOT NULL,
+  signature_algorithm TEXT NOT NULL CHECK (signature_algorithm = 'Ed25519'),
+  signature_key_id TEXT NOT NULL COLLATE BINARY,
+  signature TEXT NOT NULL,
+  PRIMARY KEY (catalog_id, release_id)
+) WITHOUT ROWID;
+
+CREATE TABLE operations (
+  catalog_id TEXT NOT NULL COLLATE BINARY,
+  release_id TEXT NOT NULL COLLATE BINARY,
+  record_id TEXT NOT NULL COLLATE BINARY CHECK (
+    record_id GLOB 'operation:*' AND length(record_id) <= 651
+  ),
+  record_json TEXT NOT NULL,
+  logical_digest TEXT NOT NULL CHECK (
+    length(logical_digest) = 64
+    AND logical_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  api TEXT NOT NULL COLLATE BINARY,
+  operation_id TEXT NOT NULL COLLATE BINARY,
+  summary TEXT,
+  path TEXT NOT NULL,
+  search_text TEXT NOT NULL,
+  PRIMARY KEY (catalog_id, release_id, record_id),
+  FOREIGN KEY (catalog_id, release_id)
+    REFERENCES release_metadata(catalog_id, release_id)
+    ON UPDATE RESTRICT ON DELETE RESTRICT
+);
+
+CREATE INDEX operations_release_api
+  ON operations (catalog_id, release_id, api, record_id);
+
+CREATE VIRTUAL TABLE operations_fts USING fts5(
+  record_id, operation_id, summary, path, api, search_text,
+  content='operations', content_rowid='rowid'
+);
+
+CREATE TABLE schemas (
+  catalog_id TEXT NOT NULL COLLATE BINARY,
+  release_id TEXT NOT NULL COLLATE BINARY,
+  record_id TEXT NOT NULL COLLATE BINARY CHECK (
+    record_id GLOB 'schema:*' AND length(record_id) <= 669
+  ),
+  record_json TEXT NOT NULL,
+  logical_digest TEXT NOT NULL CHECK (
+    length(logical_digest) = 64
+    AND logical_digest NOT GLOB '*[^0-9a-f]*'
+  ),
+  PRIMARY KEY (catalog_id, release_id, record_id),
+  FOREIGN KEY (catalog_id, release_id)
+    REFERENCES release_metadata(catalog_id, release_id)
+    ON UPDATE RESTRICT ON DELETE RESTRICT
+) WITHOUT ROWID;
+`;
+export function createReleaseSchemaV4(database) {
+    database.exec(RELEASE_SCHEMA_V4);
+}
+export function populateOperationsFtsV4(database) {
+    database.exec(`
+    INSERT INTO operations_fts
+      (rowid, record_id, operation_id, summary, path, api, search_text)
+    SELECT rowid, record_id, operation_id, summary, path, api, search_text
+    FROM operations
+  `);
+}

package/dist/runtime/action-permit.d.ts

@@ -0,0 +1,11 @@
+declare const actionDispatchPermitBrand: unique symbol;
+/**
+ * Engine-private proof that an exact authorized action was consumed.
+ *
+ * This module deliberately exposes no constructor or issuer. Runtime identity
+ * is held by the authorization boundary that created the permit.
+ */
+export type ActionDispatchPermit = Readonly<{
+    readonly [actionDispatchPermitBrand]: never;
+}>;
+export {};

package/dist/runtime/action-permit.js

@@ -0,0 +1 @@
+export {};

package/dist/runtime/classify.d.ts

@@ -0,0 +1,16 @@
+import type { ActionCardinality, ActionKind, JsonObject, OperationRecordV4, SchemaRecordV4 } from "./types.ts";
+/** A runtime-derived classification; no value is read from record advisory data. */
+export interface OperationClassification {
+    readonly safety: "read" | "action";
+    readonly actionKind: ActionKind | null;
+    readonly cardinality: ActionCardinality | null;
+    /** Whether the kind always requires a fresh, per-call confirmation. */
+    readonly dangerous: boolean;
+    /** Whether the action must be treated as high-risk by the authorizer. */
+    readonly highRisk: boolean;
+}
+/**
+ * Recompute safety, action kind, cardinality, and risk from verified records.
+ * Compiler-supplied advisory fields intentionally do not participate.
+ */
+export declare function classifyOperation(operation: OperationRecordV4, schemas?: readonly SchemaRecordV4[], normalizedArguments?: JsonObject): OperationClassification;