@knitli/openapi-mcp 1.2.1 → 1.3.1

package/README.md

@@ -277,6 +277,14 @@ retains its signed-envelope-only contract. Storage must preserve immutable relea
 identities. Admission does not guarantee future availability, so runtime reads
 continue verifying records at use time.
 
+For a boundary that needs strict manifest and signature authentication plus the
+logical digest without changing generation state, use
+`authenticateManifest(envelope, trust, limitOverrides?)` from
+`@knitli/openapi-mcp/runtime`. It does not verify records, decide rollback
+against current state, or admit an executable release. Callers activating a
+catalog use `admitCatalogRelease`; callers retaining reviewed authority must
+still perform that authority and admission step after authentication.
+
 ## Recover from a bad release
 
 Before release, record the prior **observed package version**, its tarball digest,

package/dist/runtime/index.d.ts

@@ -5,8 +5,8 @@ export { digestCredentialAuthorizationBinding, snapshotCredentialAuthorizationBi
 export { sha256, verifyEd25519 } from "./digest.ts";
 export type { OpenApiMcpErrorCode } from "./errors.ts";
 export { OpenApiMcpError } from "./errors.ts";
-export type { AdmittedManifest, ManifestTrust, TrustedManifestKey, } from "./manifest.ts";
-export { admitManifest } from "./manifest.ts";
+export type { AdmittedManifest, AuthenticatedManifest, ManifestTrust, TrustedManifestKey, } from "./manifest.ts";
+export { admitManifest, authenticateManifest } from "./manifest.ts";
 export { createPreparedCall, digestBytes, digestPreparedCall, type PreparedCallInput, verifyPreparedCall, } from "./prepared-call.ts";
 export { decodeOperationRef, encodeOperationRef, parseTypedRecordId, } from "./references.ts";
 export { createOpenApiRuntime, type OpenApiRuntimeOptions } from "./runtime.ts";

package/dist/runtime/index.js

@@ -3,7 +3,7 @@ export { classifyOperation, } from "./classify.js";
 export { digestCredentialAuthorizationBinding, snapshotCredentialAuthorizationBinding, } from "./credential-binding.js";
 export { sha256, verifyEd25519 } from "./digest.js";
 export { OpenApiMcpError } from "./errors.js";
-export { admitManifest } from "./manifest.js";
+export { admitManifest, authenticateManifest } from "./manifest.js";
 export { createPreparedCall, digestBytes, digestPreparedCall, verifyPreparedCall, } from "./prepared-call.js";
 export { decodeOperationRef, encodeOperationRef, parseTypedRecordId, } from "./references.js";
 export { createOpenApiRuntime } from "./runtime.js";

package/dist/runtime/manifest.d.ts

@@ -19,7 +19,14 @@ export interface AuthenticatedManifest extends AdmittedManifest {
     readonly rollback: RollbackAuthorization | undefined;
     readonly rollbackMalformed: boolean;
 }
-/** Authenticate a v4/v5 manifest without reading or mutating generation state. */
+/**
+ * Authenticate a strict v4/v5 manifest and trusted release signature, then
+ * return its domain-separated logical digest without reading or mutating
+ * generation state. This does not verify referenced inventory, validate
+ * rollback authorization against current state, admit a generation, or make a
+ * release executable; activation must use admitCatalogRelease or an equivalent
+ * authority path that performs the full inventory and state decision.
+ */
 export declare function authenticateManifest(envelope: ManifestEnvelope, trust: ManifestTrust, limitOverrides?: Partial<RuntimeLimits>): Promise<AuthenticatedManifest>;
 /** Atomically commit the generation transition for an authenticated manifest. */
 /**

package/dist/runtime/manifest.js

@@ -349,7 +349,14 @@ function deepFreeze(value) {
 function detachedManifest(manifest, limits) {
     return parseManifest(canonicalJson(manifest), limits);
 }
-/** Authenticate a v4/v5 manifest without reading or mutating generation state. */
+/**
+ * Authenticate a strict v4/v5 manifest and trusted release signature, then
+ * return its domain-separated logical digest without reading or mutating
+ * generation state. This does not verify referenced inventory, validate
+ * rollback authorization against current state, admit a generation, or make a
+ * release executable; activation must use admitCatalogRelease or an equivalent
+ * authority path that performs the full inventory and state decision.
+ */
 export async function authenticateManifest(envelope, trust, limitOverrides) {
     const limits = resolveRuntimeLimits(limitOverrides);
     if (!isObject(envelope))

package/dist/runtime/serialize.js

@@ -344,6 +344,13 @@ function validateSchema(schema, value, closure, depth, context) {
     if (schema === false || !isObject(schema))
         schemaFailure();
     for (const key of Object.keys(schema)) {
+        // OpenAPI Specification Extensions (`^x-`, OpenAPI 3.1 §4.9) are legal on a Schema Object and
+        // carry no validation semantics, so ignore the key and never walk its value -- Cloudflare's
+        // API document puts `x-auditable: true` on parameter schemas, and the compiler copies
+        // component schemas verbatim. Every other unknown keyword still fails: one with validation
+        // semantics (`pattern`, `contains`) must not be silently skipped.
+        if (key.startsWith("x-"))
+            continue;
         if (!supportedSchemaKeys.has(key))
             schemaFailure();
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@knitli/openapi-mcp",
   "private": false,
-  "version": "1.2.1",
+  "version": "1.3.1",
   "type": "module",
   "description": "Compile signed OpenAPI catalogs and serve verified search and authorized API calls over MCP.",
   "license": "MIT OR Apache-2.0",