@mcpmake/core 0.2.0

package/dist/utils/fail.js

@@ -0,0 +1,223 @@
+/**
+ * Centralized failure exit with opt-in, redacted error reporting.
+ *
+ * Why a shared helper instead of wrapping citty's `runMain`: the commands don't
+ * `throw` on user-facing failures — they call `logger.error(...)` and then
+ * `process.exit(1)` directly. `process.exit()` terminates the event loop
+ * synchronously and bypasses every `try/catch` (including citty's `runMain`
+ * handler), so a wrapper around `runMain` would never observe these exits. The
+ * only reliable place to hook reporting is the failure site itself, so each
+ * command calls `await fail(...)` where it used to log-and-exit.
+ *
+ * Telemetry is strictly opt-in (consent modes `prompt` | `auto` | `off`), never
+ * blocks or breaks the CLI (timeout + swallowed errors, mirroring
+ * `fetchPricing`), and auto-degrades to `off` in non-TTY / CI environments so it
+ * can never hang a pipeline waiting for input.
+ */
+import os from 'node:os';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { consola } from 'consola';
+import { logger } from './logger.js';
+import { loadConfig, globalConfig } from '../config/mcpmake-config.js';
+import { DEFAULT_PRICING_SERVER } from '../pricing.js';
+/**
+ * Read this package's version from its own package.json at runtime so the
+ * reported version never drifts from the published one. `package.json` always
+ * sits two levels up from the compiled `dist/utils/fail.js` (and from this
+ * source file), and npm always ships it. Best-effort: this runs on the failure
+ * path, so any read/parse error degrades to `'unknown'` rather than throwing.
+ */
+function readCliVersion() {
+    try {
+        const pkgPath = fileURLToPath(new URL('../../package.json', import.meta.url));
+        const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+        return typeof pkg.version === 'string' ? pkg.version : 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+const CLI_VERSION = readCliVersion();
+/** How long to wait for the report POST before giving up (never blocks longer). */
+const REPORT_TIMEOUT_MS = 4_000;
+/** Server-side caps — fields are truncated to these lengths before sending. */
+const CAPS = {
+    command: 200,
+    errorMessage: 2000,
+    stack: 16_000,
+    cliVersion: 40,
+    platform: 60,
+    nodeVersion: 40,
+};
+// --- Redaction helpers -----------------------------------------------------
+/** Replace the user's home directory (and generic /Users|/home/<name>) with `~`. */
+function redactHomePaths(input) {
+    let out = input;
+    const home = os.homedir();
+    if (home) {
+        out = out.split(home).join('~');
+    }
+    // Catch home dirs other than the current user's (e.g. paths from logs/CI).
+    out = out.replace(/\/(?:Users|home)\/[^/\s]+/g, '~');
+    return out;
+}
+/** Strip bearer tokens: `Bearer <token>` → `Bearer [redacted]`. */
+function redactBearerTokens(input) {
+    return input.replace(/Bearer\s+\S+/g, 'Bearer [redacted]');
+}
+/** Strip mcpmake-style tokens (`mf_<hex>`). */
+function redactMfTokens(input) {
+    return input.replace(/mf_[a-f0-9]+/g, 'mf_[redacted]');
+}
+/** Strip URL query strings (`?foo=bar` → `?[redacted]`) so creds in URLs don't leak. */
+function redactQueryStrings(input) {
+    return input.replace(/\?[^\s'"]+/g, '?[redacted]');
+}
+/**
+ * Apply every redaction pass. Run on both errorMessage and stack before use.
+ *
+ * Exported (as `redactText`) so the redaction contract can be unit-tested
+ * directly without invoking `fail()` (which calls `process.exit`).
+ */
+export function redactText(input) {
+    return redactQueryStrings(redactMfTokens(redactBearerTokens(redactHomePaths(input))));
+}
+/** @deprecated internal alias — prefer the exported `redactText`. */
+const redact = redactText;
+function truncate(input, max) {
+    return input.length > max ? input.slice(0, max) : input;
+}
+// --- Payload assembly ------------------------------------------------------
+/**
+ * Best-effort command name from argv, e.g. `from openapi` or `deploy`. Joins the
+ * first one or two non-flag tokens (subcommands like `from openapi` need two).
+ */
+function deriveCommand() {
+    const tokens = process.argv.slice(2).filter((t) => !t.startsWith('-'));
+    return tokens.slice(0, 2).join(' ');
+}
+function buildPayload(message, error) {
+    const errorMessage = error instanceof Error && error.message ? error.message : message;
+    const stack = error instanceof Error && error.stack ? error.stack : '';
+    return {
+        // Redact the command too: a positional arg can be a path or URL with creds
+        // (e.g. a mistyped `mcpmake /Users/me/secret.yaml`).
+        command: truncate(redact(deriveCommand()), CAPS.command),
+        errorMessage: truncate(redact(errorMessage), CAPS.errorMessage),
+        stack: truncate(redact(stack), CAPS.stack),
+        cliVersion: truncate(CLI_VERSION, CAPS.cliVersion),
+        platform: truncate(`${process.platform} ${process.arch}`, CAPS.platform),
+        nodeVersion: truncate(process.version, CAPS.nodeVersion),
+    };
+}
+/**
+ * Pure consent resolver: given the configured mode and the environment, decide
+ * the effective {@link ConsentMode}.
+ *
+ * Auto-degrades to `'off'` whenever there is no interactive TTY or we're in CI —
+ * otherwise the CLI could hang waiting for input that will never come. Exported
+ * so this branchy decision can be unit-tested without touching real env/config.
+ */
+export function resolveTelemetryMode(env) {
+    const value = env.configured;
+    const mode = value === 'prompt' || value === 'auto' || value === 'off' ? value : 'prompt';
+    // Critical: never prompt or block when there is no interactive TTY or we're in
+    // CI — otherwise the CLI hangs waiting for input that will never come.
+    if (!env.isTTY || env.ci) {
+        return 'off';
+    }
+    return mode;
+}
+/** Read the `telemetry` global config key; default `prompt`. Then apply env gates. */
+function resolveConsent() {
+    let configured;
+    try {
+        const loaded = loadConfig();
+        if (loaded) {
+            configured = globalConfig(loaded.data).telemetry;
+        }
+    }
+    catch {
+        // A malformed config must never block a failure exit — keep the default.
+    }
+    return resolveTelemetryMode({
+        // consola.prompt reads stdin and writes stdout, so require BOTH to be a TTY —
+        // otherwise a redirected stream could let a prompt appear (or block) wrongly.
+        configured,
+        isTTY: Boolean(process.stdout.isTTY) && Boolean(process.stdin.isTTY),
+        ci: Boolean(process.env.CI),
+    });
+}
+// --- Reporting -------------------------------------------------------------
+function reportServer() {
+    return process.env.MCPMAKE_SERVER || DEFAULT_PRICING_SERVER;
+}
+/** Multi-line preview of exactly what will be sent (already redacted). */
+function previewReport(payload) {
+    logger.info('');
+    logger.info('Opt-in error report (redacted) — exactly what would be sent:');
+    logger.info(`  command:     ${payload.command || '(none)'}`);
+    logger.info(`  errorMessage: ${payload.errorMessage}`);
+    if (payload.stack) {
+        logger.info(`  stack:       ${payload.stack.split('\n')[0]} ...`);
+    }
+    logger.info(`  cliVersion:  ${payload.cliVersion}`);
+    logger.info(`  platform:    ${payload.platform}`);
+    logger.info(`  nodeVersion: ${payload.nodeVersion}`);
+    logger.info('Not sent: no file contents, no environment variables, no secrets.');
+    logger.info('');
+}
+/**
+ * POST the report. Mirrors the AbortController + timeout + swallow-everything
+ * pattern in `fetchPricing`: this must never throw or block the CLI. The server
+ * rejects `Content-Encoding`, so we send a plain JSON body.
+ */
+async function sendReport(payload) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), REPORT_TIMEOUT_MS);
+    try {
+        const base = reportServer().replace(/\/+$/, '');
+        await fetch(`${base}/api/telemetry/report`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(payload),
+            signal: controller.signal,
+        });
+    }
+    catch {
+        // Reporting is best-effort; a failure here must never affect the CLI.
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Log a user-facing failure message, optionally report it (consent permitting),
+ * then exit with code 1. Never throws; always exits.
+ */
+export async function fail(message, error) {
+    logger.error(message);
+    const consent = resolveConsent();
+    if (consent !== 'off') {
+        const payload = buildPayload(message, error);
+        try {
+            if (consent === 'prompt') {
+                previewReport(payload);
+                const ok = await consola.prompt('Send this report?', { type: 'confirm' });
+                if (ok === true) {
+                    await sendReport(payload);
+                }
+            }
+            else {
+                // auto: send silently.
+                await sendReport(payload);
+            }
+        }
+        catch {
+            // Prompting/reporting must never get in the way of the exit.
+        }
+    }
+    process.exit(1);
+}
+//# sourceMappingURL=fail.js.map

package/dist/utils/fail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail.js","sourceRoot":"","sources":["../../src/utils/fail.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAEvD;;;;;;GAMG;AACH,SAAS,cAAc;IACrB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAA0B,CAAC;QAC/E,OAAO,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;AAErC,mFAAmF;AACnF,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAIhC,+EAA+E;AAC/E,MAAM,IAAI,GAAG;IACX,OAAO,EAAE,GAAG;IACZ,YAAY,EAAE,IAAI;IAClB,KAAK,EAAE,MAAM;IACb,UAAU,EAAE,EAAE;IACd,QAAQ,EAAE,EAAE;IACZ,WAAW,EAAE,EAAE;CACP,CAAC;AAWX,8EAA8E;AAE9E,oFAAoF;AACpF,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,IAAI,IAAI,EAAE,CAAC;QACT,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IACD,2EAA2E;IAC3E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;AAC7D,CAAC;AAED,+CAA+C;AAC/C,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;AACzD,CAAC;AAED,wFAAwF;AACxF,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,kBAAkB,CAAC,cAAc,CAAC,kBAAkB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC;AAED,qEAAqE;AACrE,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B,SAAS,QAAQ,CAAC,KAAa,EAAE,GAAW;IAC1C,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,8EAA8E;AAE9E;;;GAGG;AACH,SAAS,aAAa;IACpB,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,KAAe;IACpD,MAAM,YAAY,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,OAAO;QACL,2EAA2E;QAC3E,qDAAqD;QACrD,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC;QACxD,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC;QAC/D,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC;QAC1C,UAAU,EAAE,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,UAAU,CAAC;QAClD,QAAQ,EAAE,QAAQ,CAAC,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC;QACxE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC;KACzD,CAAC;AACJ,CAAC;AAcD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAiB;IACpD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC;IAC7B,MAAM,IAAI,GACR,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE/E,+EAA+E;IAC/E,uEAAuE;IACvE,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc;IACrB,IAAI,UAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;IAC3E,CAAC;IAED,OAAO,oBAAoB,CAAC;QAC1B,8EAA8E;QAC9E,8EAA8E;QAC9E,UAAU;QACV,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QACpE,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAE9E,SAAS,YAAY;IACnB,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,sBAAsB,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,OAAsB;IAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC5E,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC7D,MAAM,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClD,MAAM,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,MAAM,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IACjF,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,OAAsB;IAC9C,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,iBAAiB,CAAC,CAAC;IACtE,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,GAAG,IAAI,uBAAuB,EAAE;YAC1C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAe,EAAE,KAAe;IACzD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC;YACH,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,aAAa,CAAC,OAAO,CAAC,CAAC;gBACvB,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC1E,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;oBAChB,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,uBAAuB;gBACvB,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/utils/fs.d.ts

@@ -0,0 +1,6 @@
+export declare function ensureDir(dir: string): Promise<void>;
+export declare function writeFileSafe(filePath: string, content: string, options: {
+    force: boolean;
+}): Promise<boolean>;
+export declare function pathExists(filePath: string): Promise<boolean>;
+//# sourceMappingURL=fs.d.ts.map

package/dist/utils/fs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.d.ts","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAGA,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAC1B,OAAO,CAAC,OAAO,CAAC,CAYlB;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE"}

package/dist/utils/fs.js

@@ -0,0 +1,29 @@
+import { mkdir, writeFile, access } from 'node:fs/promises';
+import { dirname } from 'node:path';
+export async function ensureDir(dir) {
+    await mkdir(dir, { recursive: true });
+}
+export async function writeFileSafe(filePath, content, options) {
+    if (!options.force) {
+        try {
+            await access(filePath);
+            return false; // file exists, skip
+        }
+        catch {
+            // file doesn't exist, proceed
+        }
+    }
+    await ensureDir(dirname(filePath));
+    await writeFile(filePath, content, 'utf-8');
+    return true;
+}
+export async function pathExists(filePath) {
+    try {
+        await access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=fs.js.map

package/dist/utils/fs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs.js","sourceRoot":"","sources":["../../src/utils/fs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,OAAe,EACf,OAA2B;IAE3B,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC,CAAC,oBAAoB;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,MAAM,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/utils/interactive.d.ts

@@ -0,0 +1,7 @@
+import type { OperationDescriptor } from '../types/index.js';
+/**
+ * Show detected operations and let user confirm, skip, or rename before generation.
+ * Returns the filtered/modified list of operations to proceed with.
+ */
+export declare function confirmOperations(operations: OperationDescriptor[]): Promise<OperationDescriptor[]>;
+//# sourceMappingURL=interactive.d.ts.map

package/dist/utils/interactive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.d.ts","sourceRoot":"","sources":["../../src/utils/interactive.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAG7D;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,UAAU,EAAE,mBAAmB,EAAE,GAChC,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAoChC"}

package/dist/utils/interactive.js

@@ -0,0 +1,31 @@
+import { createInterface } from 'node:readline';
+import { logger } from './logger.js';
+/**
+ * Show detected operations and let user confirm, skip, or rename before generation.
+ * Returns the filtered/modified list of operations to proceed with.
+ */
+export async function confirmOperations(operations) {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    const ask = (question) => new Promise((resolve) => rl.question(question, resolve));
+    logger.info('');
+    logger.info(`Detected ${operations.length} operations:`);
+    logger.info('');
+    for (let i = 0; i < operations.length; i++) {
+        const op = operations[i];
+        logger.info(`  ${i + 1}. [${op.method.toUpperCase()}] ${op.path} → ${op.operationId}` +
+            (op.summary ? ` — ${op.summary}` : ''));
+    }
+    logger.info('');
+    const answer = await ask('Enter numbers to exclude (comma-separated), or press Enter to keep all: ');
+    rl.close();
+    if (!answer.trim())
+        return operations;
+    const excludeIndices = new Set(answer
+        .split(',')
+        .map((s) => parseInt(s.trim(), 10) - 1)
+        .filter((n) => !isNaN(n) && n >= 0 && n < operations.length));
+    const result = operations.filter((_, i) => !excludeIndices.has(i));
+    logger.info(`Proceeding with ${result.length} operations (excluded ${excludeIndices.size})`);
+    return result;
+}
+//# sourceMappingURL=interactive.js.map

package/dist/utils/interactive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interactive.js","sourceRoot":"","sources":["../../src/utils/interactive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,UAAiC;IAEjC,MAAM,EAAE,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7E,MAAM,GAAG,GAAG,CAAC,QAAgB,EAAmB,EAAE,CAChD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3D,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,MAAM,cAAc,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,IAAI,CACT,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,IAAI,MAAM,EAAE,CAAC,WAAW,EAAE;YACvE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzC,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB,0EAA0E,CAC3E,CAAC;IACF,EAAE,CAAC,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC;IAEtC,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,MAAM;SACH,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC;SACtC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAC/D,CAAC;IAEF,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,MAAM,CAAC,IAAI,CAAC,mBAAmB,MAAM,CAAC,MAAM,yBAAyB,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IAC7F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/logger.d.ts

@@ -0,0 +1,2 @@
+export declare const logger: import("consola").ConsolaInstance;
+//# sourceMappingURL=logger.d.ts.map

package/dist/utils/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,MAAM,mCAA6B,CAAC"}

package/dist/utils/logger.js

@@ -0,0 +1,3 @@
+import { consola } from 'consola';
+export const logger = consola.withTag('mcpmake');
+//# sourceMappingURL=logger.js.map

package/dist/utils/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/utils/logger.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAElC,MAAM,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC"}

package/dist/utils/sanitize.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Sanitize a string for safe embedding in a JavaScript/TypeScript single-quoted string literal.
+ * Escapes backslashes, single quotes, and newlines.
+ */
+export declare function escapeStringLiteral(str: string): string;
+/**
+ * Sanitize a string for safe embedding in a JavaScript/TypeScript template literal.
+ * Escapes backticks, ${} expressions, and backslashes.
+ */
+export declare function escapeTemplateLiteral(str: string): string;
+/**
+ * Validate that an identifier (operationId, param name) contains only safe characters.
+ * Strips anything that isn't alphanumeric, underscore, or hyphen.
+ */
+export declare function sanitizeIdentifier(str: string): string;
+/**
+ * Validate that a URL path template contains only safe characters.
+ * Allows: alphanumeric, /, {, }, -, _, .
+ */
+export declare function sanitizePathTemplate(str: string): string;
+/**
+ * Sanitize a file name — strip path separators and traversal sequences.
+ */
+export declare function sanitizeFileName(str: string): string;
+/**
+ * Check if a key is a dangerous prototype pollution key.
+ */
+export declare function isDangerousKey(key: string): boolean;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/utils/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAID;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/utils/sanitize.js

@@ -0,0 +1,45 @@
+/**
+ * Sanitize a string for safe embedding in a JavaScript/TypeScript single-quoted string literal.
+ * Escapes backslashes, single quotes, and newlines.
+ */
+export function escapeStringLiteral(str) {
+    return str.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/\n/g, '\\n').replace(/\r/g, '');
+}
+/**
+ * Sanitize a string for safe embedding in a JavaScript/TypeScript template literal.
+ * Escapes backticks, ${} expressions, and backslashes.
+ */
+export function escapeTemplateLiteral(str) {
+    return str.replace(/\\/g, '\\\\').replace(/`/g, '\\`').replace(/\$\{/g, '\\${');
+}
+/**
+ * Validate that an identifier (operationId, param name) contains only safe characters.
+ * Strips anything that isn't alphanumeric, underscore, or hyphen.
+ */
+export function sanitizeIdentifier(str) {
+    return str.replace(/[^a-zA-Z0-9_\-]/g, '');
+}
+/**
+ * Validate that a URL path template contains only safe characters.
+ * Allows: alphanumeric, /, {, }, -, _, .
+ */
+export function sanitizePathTemplate(str) {
+    return str.replace(/[^a-zA-Z0-9/{}._\-]/g, '');
+}
+/**
+ * Sanitize a file name — strip path separators and traversal sequences.
+ */
+export function sanitizeFileName(str) {
+    return str
+        .replace(/\.\./g, '')
+        .replace(/[/\\]/g, '')
+        .replace(/[^a-zA-Z0-9._\-]/g, '');
+}
+const DANGEROUS_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+/**
+ * Check if a key is a dangerous prototype pollution key.
+ */
+export function isDangerousKey(key) {
+    return DANGEROUS_KEYS.has(key);
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/utils/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG;SACP,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/dist/utils/watcher.d.ts

@@ -0,0 +1,12 @@
+import { type FSWatcher } from 'node:fs';
+export interface WatchOptions {
+    filePath: string;
+    onChange: () => Promise<void>;
+    debounceMs?: number;
+}
+/**
+ * Watch a file for changes and invoke a callback.
+ * Debounces rapid successive changes (e.g., editor save + format).
+ */
+export declare function watchFile(options: WatchOptions): FSWatcher;
+//# sourceMappingURL=watcher.d.ts.map

package/dist/utils/watcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.d.ts","sourceRoot":"","sources":["../../src/utils/watcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,SAAS,CAAC;AAGhD,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CA4B1D"}

package/dist/utils/watcher.js

@@ -0,0 +1,37 @@
+import { watch } from 'node:fs';
+import { logger } from './logger.js';
+/**
+ * Watch a file for changes and invoke a callback.
+ * Debounces rapid successive changes (e.g., editor save + format).
+ */
+export function watchFile(options) {
+    const debounceMs = options.debounceMs ?? 500;
+    let timer;
+    let running = false;
+    const watcher = watch(options.filePath, (eventType) => {
+        if (eventType !== 'change')
+            return;
+        if (running)
+            return;
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(async () => {
+            running = true;
+            logger.info('Spec file changed, regenerating...');
+            try {
+                await options.onChange();
+                logger.success('Regeneration complete');
+            }
+            catch (err) {
+                logger.error(`Regeneration failed: ${err instanceof Error ? err.message : err}`);
+            }
+            finally {
+                running = false;
+            }
+        }, debounceMs);
+    });
+    logger.info(`Watching for changes: ${options.filePath}`);
+    logger.info('Press Ctrl+C to stop');
+    return watcher;
+}
+//# sourceMappingURL=watcher.js.map

package/dist/utils/watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watcher.js","sourceRoot":"","sources":["../../src/utils/watcher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAkB,MAAM,SAAS,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQrC;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IAC7C,IAAI,KAAgD,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,EAAE;QACpD,IAAI,SAAS,KAAK,QAAQ;YAAE,OAAO;QACnC,IAAI,OAAO;YAAE,OAAO;QAEpB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,KAAK,GAAG,UAAU,CAAC,KAAK,IAAI,EAAE;YAC5B,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;YAClD,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACzB,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACnF,CAAC;oBAAS,CAAC;gBACT,OAAO,GAAG,KAAK,CAAC;YAClB,CAAC;QACH,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACzD,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAEpC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,45 @@
+{
+  "name": "@mcpmake/core",
+  "version": "0.2.0",
+  "description": "Shared generation library for mcpmake — parse APIs (OpenAPI/HAR/Postman/websites) and emit MCP servers.",
+  "type": "module",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/starkyru/mcpmake-cli.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://mcpmake.dev",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "bash scripts/build.sh",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.90.0",
+    "@apidevtools/swagger-parser": "^12.1.0",
+    "citty": "^0.1.6",
+    "consola": "^3.4.2",
+    "handlebars": "^4.7.8",
+    "json-schema-to-zod": "^2.4.1",
+    "marked": "^12.0.2",
+    "openapi-types": "^12.1.3",
+    "playwright": "^1.59.1",
+    "yaml": "^2.7.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}