@kya-os/create-mcpi-app 1.10.5 → 1.11.1

package/dist/helpers/pinned-dependencies.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Dependency versions the scaffolder forces onto every generated project.
+ *
+ * Single source of truth for the monorepo is the repository-root
+ * pinned-dependencies.json. The published CLI bundle cannot read that file,
+ * so the value is duplicated here and a test asserts the two agree
+ * (src/__tests__/helpers/pinned-dependencies.test.ts).
+ *
+ * Why json-canonicalize is pinned in generated projects, not only in our own
+ * packages: json-canonicalize@2.0.1 (2026-08-14) is a source-only publish
+ * whose `main` points at a missing bundles/index.umd.js. Our packages declare
+ * 2.0.0 exactly, but a consumer tree still reaches 2.0.1 through
+ * @kya-os/cli -> @kya-os/mcp@1.11.0 (^2.0.0): npm hoists depth-1 nodes in
+ * path order and "@kya-os/mcp" sorts before "@kya-os/mcp-i", so mcp's caret
+ * edge claims the root node_modules slot and webpack resolves mcp's
+ * canonical-json against the broken copy. pnpm does not hoist at all, so each
+ * range resolves independently. Only a package-manager override fixes both,
+ * hence all three fields below (npm, pnpm, yarn).
+ */
+export declare const PINNED_DEPENDENCY_OVERRIDES: Readonly<Record<string, string>>;
+/** The three package-manager override fields the scaffolder writes. */
+export interface PackageManagerOverrideFields {
+    /** npm */
+    overrides: Record<string, string>;
+    /** pnpm (nested under the "pnpm" key; other pnpm settings are preserved) */
+    pnpm: {
+        overrides: Record<string, string>;
+    } & Record<string, unknown>;
+    /** yarn */
+    resolutions: Record<string, string>;
+}
+/**
+ * Return a copy of `manifest` with the pinned overrides merged into the npm,
+ * pnpm, and yarn override fields. Existing user entries are kept; for a
+ * pinned name the pin wins, since the pin exists to defeat a broken upstream
+ * publish.
+ */
+export declare function applyPinnedDependencyOverrides<T extends object>(manifest: T): T & PackageManagerOverrideFields;
+//# sourceMappingURL=pinned-dependencies.d.ts.map

package/dist/helpers/pinned-dependencies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-dependencies.d.ts","sourceRoot":"","sources":["../../src/helpers/pinned-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAExE,CAAC;AAEF,uEAAuE;AACvE,MAAM,WAAW,4BAA4B;IAC3C,UAAU;IACV,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,4EAA4E;IAC5E,IAAI,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtE,WAAW;IACX,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACrC;AAQD;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,SAAS,MAAM,EAC7D,QAAQ,EAAE,CAAC,GACV,CAAC,GAAG,4BAA4B,CAkBlC"}

package/dist/helpers/pinned-dependencies.js

@@ -0,0 +1,46 @@
+/**
+ * Dependency versions the scaffolder forces onto every generated project.
+ *
+ * Single source of truth for the monorepo is the repository-root
+ * pinned-dependencies.json. The published CLI bundle cannot read that file,
+ * so the value is duplicated here and a test asserts the two agree
+ * (src/__tests__/helpers/pinned-dependencies.test.ts).
+ *
+ * Why json-canonicalize is pinned in generated projects, not only in our own
+ * packages: json-canonicalize@2.0.1 (2026-08-14) is a source-only publish
+ * whose `main` points at a missing bundles/index.umd.js. Our packages declare
+ * 2.0.0 exactly, but a consumer tree still reaches 2.0.1 through
+ * @kya-os/cli -> @kya-os/mcp@1.11.0 (^2.0.0): npm hoists depth-1 nodes in
+ * path order and "@kya-os/mcp" sorts before "@kya-os/mcp-i", so mcp's caret
+ * edge claims the root node_modules slot and webpack resolves mcp's
+ * canonical-json against the broken copy. pnpm does not hoist at all, so each
+ * range resolves independently. Only a package-manager override fixes both,
+ * hence all three fields below (npm, pnpm, yarn).
+ */
+export const PINNED_DEPENDENCY_OVERRIDES = {
+    "json-canonicalize": "2.0.0",
+};
+/**
+ * Return a copy of `manifest` with the pinned overrides merged into the npm,
+ * pnpm, and yarn override fields. Existing user entries are kept; for a
+ * pinned name the pin wins, since the pin exists to defeat a broken upstream
+ * publish.
+ */
+export function applyPinnedDependencyOverrides(manifest) {
+    const existing = manifest;
+    const existingPnpm = existing.pnpm ?? {};
+    const existingPnpmOverrides = existing.pnpm?.overrides ?? {};
+    return {
+        ...manifest,
+        overrides: { ...(existing.overrides ?? {}), ...PINNED_DEPENDENCY_OVERRIDES },
+        pnpm: {
+            ...existingPnpm,
+            overrides: { ...existingPnpmOverrides, ...PINNED_DEPENDENCY_OVERRIDES },
+        },
+        resolutions: {
+            ...(existing.resolutions ?? {}),
+            ...PINNED_DEPENDENCY_OVERRIDES,
+        },
+    };
+}
+//# sourceMappingURL=pinned-dependencies.js.map

package/dist/helpers/pinned-dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinned-dependencies.js","sourceRoot":"","sources":["../../src/helpers/pinned-dependencies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAqC;IAC3E,mBAAmB,EAAE,OAAO;CAC7B,CAAC;AAkBF;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAC5C,QAAW;IAEX,MAAM,QAAQ,GAAG,QAAsC,CAAC;IACxD,MAAM,YAAY,GAA4B,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;IAClE,MAAM,qBAAqB,GACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,IAAI,EAAE,CAAC;IAEjC,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,GAAG,2BAA2B,EAAE;QAC5E,IAAI,EAAE;YACJ,GAAG,YAAY;YACf,SAAS,EAAE,EAAE,GAAG,qBAAqB,EAAE,GAAG,2BAA2B,EAAE;SACxE;QACD,WAAW,EAAE;YACX,GAAG,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC;YAC/B,GAAG,2BAA2B;SAC/B;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kya-os/create-mcpi-app",
-  "version": "1.10.5",
+  "version": "1.11.1",
   "description": "Scaffold a new MCP-I application",
   "type": "module",
   "main": "./dist/helpers/index.js",
@@ -22,14 +22,6 @@
       "types": "./dist/helpers/openapi-ingestion.d.ts",
       "import": "./dist/helpers/openapi-ingestion.js"
     },
-    "./helpers/generate-openapi-tools": {
-      "types": "./dist/helpers/generate-openapi-tools.d.ts",
-      "import": "./dist/helpers/generate-openapi-tools.js"
-    },
-    "./helpers/generate-openapi-project": {
-      "types": "./dist/helpers/generate-openapi-project.d.ts",
-      "import": "./dist/helpers/generate-openapi-project.js"
-    },
     "./helpers/generate-identity": {
       "types": "./dist/helpers/generate-identity.d.ts",
       "import": "./dist/helpers/generate-identity.js"
@@ -55,11 +47,11 @@
   },
   "dependencies": {
     "@apidevtools/swagger-parser": "^10.1.1",
-    "@kya-os/cli": "^1.6.3",
+    "@kya-os/cli": "^1.7.0",
     "@kya-os/cli-effects": "^1.0.19",
-    "@kya-os/contracts": "^1.9.2",
-    "@kya-os/mcp-i": "^1.7.13",
-    "@kya-os/mcp-i-cloudflare": "^1.12.3",
+    "@kya-os/contracts": "^1.12.1",
+    "@kya-os/mcp-i": "^1.12.2",
+    "@kya-os/mcp-i-cloudflare": "^1.13.6",
     "base-x": "^5.0.0",
     "chalk": "^4.1.2",
     "commander": "^12.1.0",

package/dist/helpers/generate-openapi-project.d.ts

@@ -1,36 +0,0 @@
-/**
- * OpenAPI Project File Generator
- *
- * Generates a complete Cloudflare Workers MCP-I project from an OpenAPI spec.
- * Follows the same patterns as generate-cloudflare-files.ts.
- *
- * @module @kya-os/create-mcpi-app/helpers/generate-openapi-project
- */
-import type { OperationModel, SecuritySchemeMap } from "../types/openapi-generator.js";
-import type { GeneratedIdentity } from "./generate-identity.js";
-/**
- * Generate a complete MCP-I Cloudflare Workers project from OpenAPI operations.
- *
- * Creates the following structure:
- *   package.json
- *   tsconfig.json
- *   .gitignore
- *   src/index.ts
- *   src/agent.ts
- *   src/auth.ts
- *   src/mcpi-runtime-config.ts
- *   src/tools/<toolName>.ts
- *   wrangler.toml
- *   .dev.vars.example
- *   README.md
- *
- * The private key is placed ONLY in .dev.vars.example (not in wrangler.toml).
- * The DID is placed in wrangler.toml [vars] as MCP_IDENTITY_AGENT_DID.
- *
- * @param operations      - Operations from ingestOpenAPI
- * @param securitySchemes - Security scheme map
- * @param targetDir       - Absolute path to project output directory
- * @param identity        - Generated agent identity
- */
-export declare function generateOpenAPIProjectFiles(operations: OperationModel[], securitySchemes: SecuritySchemeMap, targetDir: string, identity: GeneratedIdentity): Promise<void>;
-//# sourceMappingURL=generate-openapi-project.d.ts.map

package/dist/helpers/generate-openapi-project.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-openapi-project.d.ts","sourceRoot":"","sources":["../../src/helpers/generate-openapi-project.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAClB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAQhE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,2BAA2B,CAC/C,UAAU,EAAE,cAAc,EAAE,EAC5B,eAAe,EAAE,iBAAiB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/helpers/generate-openapi-project.js

@@ -1,114 +0,0 @@
-/**
- * OpenAPI Project File Generator
- *
- * Generates a complete Cloudflare Workers MCP-I project from an OpenAPI spec.
- * Follows the same patterns as generate-cloudflare-files.ts.
- *
- * @module @kya-os/create-mcpi-app/helpers/generate-openapi-project
- */
-import { writeFile, mkdir } from "fs/promises";
-import { join } from "path";
-import { generateToolFiles } from "./generate-openapi-tools.js";
-import { getPackageVersions } from "./get-package-versions.js";
-// ============================================================================
-// Public API
-// ============================================================================
-/**
- * Generate a complete MCP-I Cloudflare Workers project from OpenAPI operations.
- *
- * Creates the following structure:
- *   package.json
- *   tsconfig.json
- *   .gitignore
- *   src/index.ts
- *   src/agent.ts
- *   src/auth.ts
- *   src/mcpi-runtime-config.ts
- *   src/tools/<toolName>.ts
- *   wrangler.toml
- *   .dev.vars.example
- *   README.md
- *
- * The private key is placed ONLY in .dev.vars.example (not in wrangler.toml).
- * The DID is placed in wrangler.toml [vars] as MCP_IDENTITY_AGENT_DID.
- *
- * @param operations      - Operations from ingestOpenAPI
- * @param securitySchemes - Security scheme map
- * @param targetDir       - Absolute path to project output directory
- * @param identity        - Generated agent identity
- */
-export async function generateOpenAPIProjectFiles(operations, securitySchemes, targetDir, identity) {
-    // Ensure directory exists
-    await mkdir(targetDir, { recursive: true });
-    // Get package versions from scaffolder's package.json
-    const versions = await getPackageVersions();
-    const mcpICloudflareVersion = versions["@kya-os/mcp-i-cloudflare"];
-    // 1. package.json
-    await writeFile(join(targetDir, "package.json"), JSON.stringify(generatePackageJson(mcpICloudflareVersion), null, 2), "utf-8");
-    // 2. tsconfig.json
-    await writeFile(join(targetDir, "tsconfig.json"), JSON.stringify(generateTsConfig(), null, 2), "utf-8");
-    // 3. .gitignore
-    await writeFile(join(targetDir, ".gitignore"), generateGitignore(), "utf-8");
-    // 4. src/mcpi-runtime-config.ts is written by generateToolFiles below,
-    //    which handles it for both standalone and project-scaffolding callers.
-    //    Writing it here again would be a redundant double-write.
-    // 5. All tool files, agent.ts, index.ts, auth.ts, wrangler.toml,
-    //    .dev.vars.example, README.md (delegated to generate-openapi-tools)
-    await generateToolFiles(operations, securitySchemes, targetDir, identity);
-}
-// ============================================================================
-// File content generators
-// ============================================================================
-function generatePackageJson(mcpICloudflareVersion) {
-    return {
-        name: "openapi-agent",
-        version: "0.1.0",
-        private: true,
-        scripts: {
-            deploy: "wrangler deploy",
-            dev: "wrangler dev",
-            start: "wrangler dev",
-            test: "vitest",
-            "cf-typegen": "wrangler types",
-        },
-        dependencies: {
-            "@kya-os/mcp-i-cloudflare": mcpICloudflareVersion,
-            "@modelcontextprotocol/sdk": "1.25.2",
-            agents: "0.3.6",
-            hono: "4.12.4",
-        },
-        devDependencies: {
-            "@cloudflare/vitest-pool-workers": "^0.5.41",
-            "@cloudflare/workers-types": "^4.20251126.0",
-            "@types/node": "^20.8.3",
-            typescript: "^5.5.2",
-            vitest: "^2.0.5",
-            wrangler: "^4.53.0",
-        },
-    };
-}
-function generateTsConfig() {
-    return {
-        compilerOptions: {
-            target: "esnext",
-            module: "esnext",
-            moduleResolution: "bundler",
-            types: ["@cloudflare/workers-types", "vitest/globals"],
-            strict: true,
-            skipLibCheck: true,
-            noEmit: true,
-        },
-        include: ["src/**/*"],
-        exclude: ["node_modules"],
-    };
-}
-function generateGitignore() {
-    return `node_modules/
-dist/
-.wrangler/
-.dev.vars
-*.log
-.DS_Store
-`;
-}
-//# sourceMappingURL=generate-openapi-project.js.map

package/dist/helpers/generate-openapi-project.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-openapi-project.js","sourceRoot":"","sources":["../../src/helpers/generate-openapi-project.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAM5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,UAA4B,EAC5B,eAAkC,EAClC,SAAiB,EACjB,QAA2B;IAE3B,0BAA0B;IAC1B,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE5C,sDAAsD;IACtD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC5C,MAAM,qBAAqB,GAAG,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAEnE,kBAAkB;IAClB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,EAC/B,IAAI,CAAC,SAAS,CACZ,mBAAmB,CAAC,qBAAqB,CAAC,EAC1C,IAAI,EACJ,CAAC,CACF,EACD,OAAO,CACR,CAAC;IAEF,mBAAmB;IACnB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,EAChC,IAAI,CAAC,SAAS,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,EAC3C,OAAO,CACR,CAAC;IAEF,gBAAgB;IAChB,MAAM,SAAS,CACb,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,EAC7B,iBAAiB,EAAE,EACnB,OAAO,CACR,CAAC;IAEF,uEAAuE;IACvE,2EAA2E;IAC3E,8DAA8D;IAE9D,iEAAiE;IACjE,wEAAwE;IACxE,MAAM,iBAAiB,CAAC,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AAC5E,CAAC;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,SAAS,mBAAmB,CAAC,qBAA6B;IACxD,OAAO;QACL,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE;YACP,MAAM,EAAE,iBAAiB;YACzB,GAAG,EAAE,cAAc;YACnB,KAAK,EAAE,cAAc;YACrB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE,gBAAgB;SAC/B;QACD,YAAY,EAAE;YACZ,0BAA0B,EAAE,qBAAqB;YACjD,2BAA2B,EAAE,QAAQ;YACrC,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,QAAQ;SACf;QACD,eAAe,EAAE;YACf,iCAAiC,EAAE,SAAS;YAC5C,2BAA2B,EAAE,eAAe;YAC5C,aAAa,EAAE,SAAS;YACxB,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,SAAS;SACpB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,eAAe,EAAE;YACf,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,gBAAgB,EAAE,SAAS;YAC3B,KAAK,EAAE,CAAC,2BAA2B,EAAE,gBAAgB,CAAC;YACtD,MAAM,EAAE,IAAI;YACZ,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,IAAI;SACb;QACD,OAAO,EAAE,CAAC,UAAU,CAAC;QACrB,OAAO,EAAE,CAAC,cAAc,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO;;;;;;CAMR,CAAC;AACF,CAAC"}

package/dist/helpers/generate-openapi-tools.d.ts

@@ -1,43 +0,0 @@
-/**
- * OpenAPI Tool File Generator
- *
- * Generates TypeScript tool files from OperationModel instances.
- * Each tool is a factory function that accepts environment variables
- * and returns a ToolDefinition compatible with @kya-os/mcp-i-cloudflare.
- *
- * @module @kya-os/create-mcpi-app/helpers/generate-openapi-tools
- */
-import type { OperationModel, SecuritySchemeMap } from "../types/openapi-generator.js";
-import type { GeneratedIdentity } from "./generate-identity.js";
-/**
- * Generate TypeScript source code for a single tool file.
- *
- * @param operation      - The OperationModel to generate a tool for
- * @param securitySchemes - The full security scheme map (for env type generation)
- * @returns TypeScript source string for the tool file
- */
-export declare function generateToolFile(operation: OperationModel, _securitySchemes: SecuritySchemeMap): string;
-/**
- * Generate all tool files plus supporting project files and write them to disk.
- *
- * Files generated:
- *   src/tools/<toolName>.ts    (one per operation)
- *   src/auth.ts                (auth helpers)
- *   src/agent.ts               (MCPIAgent class)
- *   src/index.ts               (createMCPIApp entry point)
- *   wrangler.toml
- *   .dev.vars.example
- *   README.md
- *
- * @param operations      - Parsed operations from ingestOpenAPI
- * @param securitySchemes - Security scheme map
- * @param targetDir       - Absolute path to output directory
- * @param identity        - Generated agent identity
- */
-export declare function generateToolFiles(operations: OperationModel[], securitySchemes: SecuritySchemeMap, targetDir: string, identity: GeneratedIdentity): Promise<void>;
-/**
- * Generate the shared AgentEnv interface imported by all generated tool files.
- * Includes API_BASE_URL, MCPI_REQUEST_TIMEOUT_MS, and scheme-specific vars.
- */
-export declare function generateAgentEnvTs(securitySchemes: SecuritySchemeMap): string;
-//# sourceMappingURL=generate-openapi-tools.d.ts.map

package/dist/helpers/generate-openapi-tools.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"generate-openapi-tools.d.ts","sourceRoot":"","sources":["../../src/helpers/generate-openapi-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,KAAK,EACV,cAAc,EACd,iBAAiB,EAIlB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAMhE;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,cAAc,EACzB,gBAAgB,EAAE,iBAAiB,GAClC,MAAM,CAkBR;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,cAAc,EAAE,EAC5B,eAAe,EAAE,iBAAiB,EAClC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAmEf;AAgOD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,eAAe,EAAE,iBAAiB,GAAG,MAAM,CAoC7E"}