@mcpmake/core 0.2.3 → 0.2.5

package/dist/types/site.d.ts

@@ -20,6 +20,14 @@ export interface SelectorSet {
     humanLabel?: string;
 }
 export type FormFieldType = 'text' | 'email' | 'password' | 'number' | 'tel' | 'url' | 'search' | 'select' | 'checkbox' | 'radio' | 'textarea' | 'hidden' | 'file' | 'date' | 'datetime-local' | 'color' | 'range' | 'other';
+/** A single <option> from a <select>, preserving both the user-visible label
+ *  and the wire value submitted to the server (they routinely differ). */
+export interface SelectOption {
+    /** Visible option text shown to the user */
+    label: string;
+    /** Value attribute actually submitted / matched by Playwright's selectOption */
+    value: string;
+}
 export interface FormFieldDescriptor {
     /** Form field name attribute */
     name: string;
@@ -33,10 +41,20 @@ export interface FormFieldDescriptor {
     placeholder?: string;
     /** Whether the field is required */
     required: boolean;
-    /** Options for <select>, radio groups, and datalists */
+    /** Options for <select>, radio groups, and datalists (visible labels). */
     options?: string[];
+    /** Option label/value pairs for <select> fields (value drives Playwright). */
+    optionPairs?: SelectOption[];
     /** Default or current value */
     defaultValue?: string;
+    /**
+     * Stable, deduplicated MCP input key for this field. Derived from `name`
+     * but guaranteed to be a valid, unique JS identifier within the form so the
+     * generated schema property and the generated handler agree on one key. The
+     * handler still drives the DOM via `selector`, so the original `name` is not
+     * needed at fill time. Set by the site tool-generator.
+     */
+    inputKey?: string;
 }
 export interface FormDescriptor {
     /** Generated stable ID for this form */

package/dist/types/site.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site.d.ts","sourceRoot":"","sources":["../../src/types/site.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,IAAI,GACJ,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,MAAM,GACN,gBAAgB,GAChB,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,QAAQ,EAAE,WAAW,CAAC;IACtB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,wDAAwD;IACxD,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,WAAW,CAAC;IACtB,6BAA6B;IAC7B,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,6BAA6B;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,EAAE,WAAW,CAAC;IACtB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,WAAW,CAAC;IACtB,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,4CAA4C;IAC5C,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,oCAAoC;IACpC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,SAAS,CAAC;AAEd,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,gCAAgC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,sCAAsC;IACtC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,2CAA2C;IAC3C,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE;QACjB,uEAAuE;QACvE,QAAQ,CAAC,EAAE,WAAW,CAAC;QACvB,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2DAA2D;QAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAID,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,QAAQ,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAID,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,gBAAgB,GAAG,YAAY,GAAG,mBAAmB,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IAErB,qCAAqC;IACrC,QAAQ,EAAE,YAAY,CAAC;IACvB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,yCAAyC;IACzC,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAE3B,2BAA2B;IAC3B,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;CACH;AAID,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,cAAc,CAAC;IAC/B,sBAAsB;IACtB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,uCAAuC;IACvC,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,aAAa,EAAE,aAAa,CAAC;CAC9B;AAID,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAC9E,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,mCAAmC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,uCAAuC;IACvC,eAAe,EAAE,KAAK,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,WAAW,CAAC;QACtB,6CAA6C;QAC7C,cAAc,CAAC,EAAE,WAAW,CAAC;KAC9B,CAAC,CAAC;IACH,8BAA8B;IAC9B,iBAAiB,EAAE,cAAc,CAAC;IAClC,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB"}
+{"version":3,"file":"site.d.ts","sourceRoot":"","sources":["../../src/types/site.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAIlE,MAAM,MAAM,gBAAgB,GACxB,aAAa,GACb,IAAI,GACJ,YAAY,GACZ,MAAM,GACN,MAAM,GACN,UAAU,GACV,OAAO,CAAC;AAEZ,MAAM,WAAW,WAAW;IAC1B,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,MAAM,aAAa,GACrB,MAAM,GACN,OAAO,GACP,UAAU,GACV,QAAQ,GACR,KAAK,GACL,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,UAAU,GACV,OAAO,GACP,UAAU,GACV,QAAQ,GACR,MAAM,GACN,MAAM,GACN,gBAAgB,GAChB,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AAEZ;0EAC0E;AAC1E,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB;IACjB,SAAS,EAAE,aAAa,CAAC;IACzB,kCAAkC;IAClC,QAAQ,EAAE,WAAW,CAAC;IACtB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,QAAQ,EAAE,OAAO,CAAC;IAClB,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,YAAY,EAAE,CAAC;IAC7B,+BAA+B;IAC/B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kBAAkB;IAClB,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,WAAW,CAAC;IACtB,6BAA6B;IAC7B,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC9B,6BAA6B;IAC7B,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,0BAA0B;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,QAAQ,EAAE,WAAW,CAAC;IACtB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kBAAkB;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;IAC7C,kCAAkC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,uCAAuC;IACvC,QAAQ,EAAE,WAAW,CAAC;IACtB,wBAAwB;IACxB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,YAAY,EAAE,OAAO,CAAC;IACtB,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,gCAAgC;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,4CAA4C;IAC5C,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,oCAAoC;IACpC,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,8CAA8C;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;CACpB;AAID,MAAM,MAAM,YAAY,GACpB,YAAY,GACZ,gBAAgB,GAChB,YAAY,GACZ,gBAAgB,GAChB,SAAS,CAAC;AAEd,MAAM,WAAW,kBAAkB;IACjC,8BAA8B;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,yCAAyC;IACzC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,gCAAgC;IAChC,SAAS,CAAC,EAAE,cAAc,CAAC;IAC3B,4CAA4C;IAC5C,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,sCAAsC;IACtC,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,2CAA2C;IAC3C,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,uDAAuD;IACvD,gBAAgB,CAAC,EAAE;QACjB,uEAAuE;QACvE,QAAQ,CAAC,EAAE,WAAW,CAAC;QACvB,mDAAmD;QACnD,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,2DAA2D;QAC3D,UAAU,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAID,MAAM,WAAW,cAAc;IAC7B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,2BAA2B;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,2BAA2B;IAC3B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,mCAAmC;IACnC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAC9B,oCAAoC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB;IACpB,QAAQ,EAAE;QACR,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAID,MAAM,MAAM,YAAY,GAAG,aAAa,GAAG,gBAAgB,GAAG,YAAY,GAAG,mBAAmB,CAAC;AAEjG,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,uBAAuB;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,gDAAgD;IAChD,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,0CAA0C;IAC1C,YAAY,EAAE,MAAM,CAAC;IAErB,qCAAqC;IACrC,QAAQ,EAAE,YAAY,CAAC;IACvB,uCAAuC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,6CAA6C;IAC7C,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,yCAAyC;IACzC,SAAS,EAAE,WAAW,EAAE,CAAC;IACzB,4DAA4D;IAC5D,iBAAiB,EAAE,OAAO,CAAC;IAE3B,2BAA2B;IAC3B,WAAW,CAAC,EAAE;QACZ,YAAY,CAAC,EAAE,OAAO,CAAC;QACvB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;CACH;AAID,MAAM,WAAW,aAAa;IAC5B,mCAAmC;IACnC,QAAQ,EAAE,OAAO,CAAC;IAClB,oDAAoD;IACpD,aAAa,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5C,+BAA+B;IAC/B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,+BAA+B;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,8BAA8B;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB;IACzB,SAAS,EAAE,aAAa,CAAC;IACzB,2DAA2D;IAC3D,cAAc,EAAE,cAAc,CAAC;IAC/B,sBAAsB;IACtB,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,uDAAuD;IACvD,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,uCAAuC;IACvC,aAAa,EAAE,aAAa,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,aAAa,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,gBAAgB,EAAE,CAAC;IAC5B,aAAa,EAAE,aAAa,CAAC;CAC9B;AAID,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,iBAAiB,CAAC;AAC9E,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,CAAC;AAExE,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,UAAU,EAAE,UAAU,CAAC;IACvB,mCAAmC;IACnC,WAAW,EAAE,WAAW,CAAC;IACzB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,4CAA4C;IAC5C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,yBAAyB;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,2BAA2B;IAC3B,OAAO,EAAE,eAAe,EAAE,CAAC;IAC3B,uCAAuC;IACvC,eAAe,EAAE,KAAK,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,WAAW,CAAC;QACtB,6CAA6C;QAC7C,cAAc,CAAC,EAAE,WAAW,CAAC;KAC9B,CAAC,CAAC;IACH,8BAA8B;IAC9B,iBAAiB,EAAE,cAAc,CAAC;IAClC,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/utils/model-resolver.d.ts

@@ -0,0 +1,21 @@
+import type Anthropic from '@anthropic-ai/sdk';
+/**
+ * Model tiers used across the generator. Each maps to a preferred undated alias
+ * plus a name pattern used to auto-pick a replacement if that alias is ever
+ * retired.
+ */
+export type ModelTier = 'balanced' | 'fast';
+/**
+ * Resolve a usable model id for a tier against the live Models API, so a retired
+ * model id can never silently 404 the way a hardcoded snapshot does.
+ *
+ * Resolution order:
+ *  1. An explicit `override` (e.g. a `--model` CLI flag) wins, unchecked — the
+ *     caller knows what they want, and a bad id surfaces as a clear API error
+ *     rather than being second-guessed here.
+ *  2. The tier's preferred alias, **if** the Models API lists it.
+ *  3. Otherwise the newest served model whose id/name matches the tier.
+ *  4. If the Models API can't be reached, the preferred alias as a last resort.
+ */
+export declare function resolveModel(client: Anthropic, tier: ModelTier, override?: string): Promise<string>;
+//# sourceMappingURL=model-resolver.d.ts.map

package/dist/utils/model-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolver.d.ts","sourceRoot":"","sources":["../../src/utils/model-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAG/C;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAqB5C;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,SAAS,EACf,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAsCjB"}

package/dist/utils/model-resolver.js

@@ -0,0 +1,64 @@
+import { logger } from './logger.js';
+/**
+ * Preferred (undated) alias per tier. Undated aliases track the latest snapshot,
+ * but a whole family can still be retired — so the alias is only used when the
+ * live Models API confirms it exists (see {@link resolveModel}).
+ */
+const PREFERRED = {
+    balanced: 'claude-sonnet-4-6',
+    fast: 'claude-haiku-4-5',
+};
+const TIER_PATTERN = {
+    balanced: /sonnet/i,
+    fast: /haiku/i,
+};
+// Resolved once per tier per process: the served-model list rarely changes
+// mid-run, and we don't want a Models API round-trip before every call.
+const cache = new Map();
+/**
+ * Resolve a usable model id for a tier against the live Models API, so a retired
+ * model id can never silently 404 the way a hardcoded snapshot does.
+ *
+ * Resolution order:
+ *  1. An explicit `override` (e.g. a `--model` CLI flag) wins, unchecked — the
+ *     caller knows what they want, and a bad id surfaces as a clear API error
+ *     rather than being second-guessed here.
+ *  2. The tier's preferred alias, **if** the Models API lists it.
+ *  3. Otherwise the newest served model whose id/name matches the tier.
+ *  4. If the Models API can't be reached, the preferred alias as a last resort.
+ */
+export async function resolveModel(client, tier, override) {
+    if (override)
+        return override;
+    const cached = cache.get(tier);
+    if (cached)
+        return cached;
+    const preferred = PREFERRED[tier];
+    let choice = preferred;
+    try {
+        const models = [];
+        for await (const m of client.models.list()) {
+            models.push({ id: m.id, display_name: m.display_name, created_at: m.created_at });
+        }
+        if (!models.some((m) => m.id === preferred)) {
+            const pattern = TIER_PATTERN[tier];
+            const newest = models
+                .filter((m) => pattern.test(m.id) || pattern.test(m.display_name))
+                // RFC 3339 timestamps sort correctly as strings (ISO 8601, newest last).
+                .sort((a, b) => b.created_at.localeCompare(a.created_at))[0];
+            if (newest) {
+                logger.warn(`Preferred model "${preferred}" unavailable; using "${newest.id}"`);
+                choice = newest.id;
+            }
+            else {
+                logger.warn(`Preferred model "${preferred}" unavailable and no ${tier} model found; trying it anyway`);
+            }
+        }
+    }
+    catch (err) {
+        logger.warn(`Could not list models (${err instanceof Error ? err.message : err}); using "${preferred}"`);
+    }
+    cache.set(tier, choice);
+    return choice;
+}
+//# sourceMappingURL=model-resolver.js.map

package/dist/utils/model-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolver.js","sourceRoot":"","sources":["../../src/utils/model-resolver.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AASrC;;;;GAIG;AACH,MAAM,SAAS,GAA8B;IAC3C,QAAQ,EAAE,mBAAmB;IAC7B,IAAI,EAAE,kBAAkB;CACzB,CAAC;AAEF,MAAM,YAAY,GAA8B;IAC9C,QAAQ,EAAE,SAAS;IACnB,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,2EAA2E;AAC3E,wEAAwE;AACxE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;AAE3C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAiB,EACjB,IAAe,EACf,QAAiB;IAEjB,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAClC,IAAI,MAAM,GAAG,SAAS,CAAC;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAA+D,EAAE,CAAC;QAC9E,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;gBAClE,yEAAyE;iBACxE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,yBAAyB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChF,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,oBAAoB,SAAS,wBAAwB,IAAI,gCAAgC,CAC1F,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,GAAG,CAC5F,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/sanitize.d.ts

@@ -13,6 +13,68 @@ export declare function escapeTemplateLiteral(str: string): string;
  * Strips anything that isn't alphanumeric, underscore, or hyphen.
  */
 export declare function sanitizeIdentifier(str: string): string;
+/**
+ * Sanitize an HTTP header name (e.g. an apiKey scheme `name`) for safe embedding
+ * in a string literal. Real header names are RFC 7230 tokens; in practice API
+ * key headers are `[A-Za-z0-9-]` (plus `_`). Stripping everything else removes
+ * quotes/backticks/newlines that could break out of the generated literal.
+ */
+export declare function sanitizeHeaderName(str: string): string;
+/**
+ * Sanitize an environment-variable name. It is emitted both as a quoted string
+ * and as a bare member access (`process.env.<NAME>` / `env.<NAME>`), so it must
+ * be a valid JS/POSIX identifier. Strips invalid chars and prefixes `_` when the
+ * result would start with a digit or be empty.
+ */
+export declare function sanitizeEnvVarName(str: string): string;
+/**
+ * Resolve OpenAPI server-variable placeholders (`{var}`) in a server URL from
+ * their declared defaults, then validate the result is a real http(s) URL.
+ *
+ * OpenAPI server URLs may carry variables — `https://{region}.api.test/{version}`
+ * — with a `variables` map giving each a `default`. Substituting them here keeps
+ * the URL semantically intact instead of stripping the braces (which would corrupt
+ * the path, e.g. `{version}` → empty). Variables without a known default are left
+ * as-is; the subsequent per-sink escaper neutralizes any residual unsafe chars.
+ */
+export declare function resolveServerUrl(url: string, variables?: Record<string, {
+    default?: string;
+} | undefined>): string;
+/**
+ * Escape a base URL for safe embedding in a string literal across multiple
+ * target languages without mutating its semantics. Unlike a strip-based
+ * approach, this preserves every character that is legal in a URL (including
+ * `$`, `{`, `}`, `~`, etc. that appear in real paths such as `/v1/$metadata`)
+ * and only neutralizes the characters that could break out of, or inject into,
+ * the literal it is embedded in:
+ *   - backslash, single/double quote, backtick → backslash-escaped
+ *   - `${` (TS template-literal interpolation) → broken with a backslash
+ *   - CR/LF (could inject extra dotenv/TOML lines) → backslash-escaped
+ * The same escaped form is safe in a TS single/double-quote string, a TS
+ * backtick literal, a Python double-quote string, a TOML basic string, and a
+ * single-line dotenv value. Validation/variable-resolution happens upstream in
+ * the emitter via {@link resolveServerUrl}.
+ */
+export declare function sanitizeUrlLiteral(str: string): string;
+/**
+ * Validate a request-body media type against the RFC media-type grammar
+ * (`type/subtype`, optional parameters). The OpenAPI `content` map key is
+ * attacker-influenced and is interpolated into a string literal, so a value
+ * that is not a well-formed media type is replaced with `application/json`
+ * (the universal safe default) rather than trusted. The returned value is
+ * still escaped at the literal sink by {@link escapeStringLiteral}.
+ */
+export declare function sanitizeMediaType(str: string): string;
+/**
+ * Escape a string for safe embedding in a double-quoted Python string literal.
+ * Escapes backslashes, double quotes, and newlines.
+ */
+export declare function escapePyString(str: string): string;
+/**
+ * Convert an arbitrary parameter name into a valid, non-keyword Python
+ * identifier for use as a function argument or local variable name.
+ */
+export declare function sanitizePyIdentifier(str: string): string;
 /**
  * Validate that a URL path template contains only safe characters.
  * Allows: alphanumeric, /, {, }, -, _, .

package/dist/utils/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAID;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAGtD;AAED;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,GAC3D,MAAM,CAUR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAStD;AAMD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAErD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAMlD;AA0CD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKxD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKpD;AAID;;GAEG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD"}

package/dist/utils/sanitize.js

@@ -19,6 +19,147 @@ export function escapeTemplateLiteral(str) {
 export function sanitizeIdentifier(str) {
     return str.replace(/[^a-zA-Z0-9_\-]/g, '');
 }
+/**
+ * Sanitize an HTTP header name (e.g. an apiKey scheme `name`) for safe embedding
+ * in a string literal. Real header names are RFC 7230 tokens; in practice API
+ * key headers are `[A-Za-z0-9-]` (plus `_`). Stripping everything else removes
+ * quotes/backticks/newlines that could break out of the generated literal.
+ */
+export function sanitizeHeaderName(str) {
+    return str.replace(/[^A-Za-z0-9_\-]/g, '');
+}
+/**
+ * Sanitize an environment-variable name. It is emitted both as a quoted string
+ * and as a bare member access (`process.env.<NAME>` / `env.<NAME>`), so it must
+ * be a valid JS/POSIX identifier. Strips invalid chars and prefixes `_` when the
+ * result would start with a digit or be empty.
+ */
+export function sanitizeEnvVarName(str) {
+    const cleaned = str.replace(/[^A-Za-z0-9_]/g, '');
+    return /^[A-Za-z_]/.test(cleaned) ? cleaned : `_${cleaned}`;
+}
+/**
+ * Resolve OpenAPI server-variable placeholders (`{var}`) in a server URL from
+ * their declared defaults, then validate the result is a real http(s) URL.
+ *
+ * OpenAPI server URLs may carry variables — `https://{region}.api.test/{version}`
+ * — with a `variables` map giving each a `default`. Substituting them here keeps
+ * the URL semantically intact instead of stripping the braces (which would corrupt
+ * the path, e.g. `{version}` → empty). Variables without a known default are left
+ * as-is; the subsequent per-sink escaper neutralizes any residual unsafe chars.
+ */
+export function resolveServerUrl(url, variables) {
+    if (!url)
+        return url;
+    let resolved = url;
+    if (variables) {
+        resolved = resolved.replace(/\{([^{}]+)\}/g, (match, name) => {
+            const def = variables[name]?.default;
+            return typeof def === 'string' ? def : match;
+        });
+    }
+    return resolved;
+}
+/**
+ * Escape a base URL for safe embedding in a string literal across multiple
+ * target languages without mutating its semantics. Unlike a strip-based
+ * approach, this preserves every character that is legal in a URL (including
+ * `$`, `{`, `}`, `~`, etc. that appear in real paths such as `/v1/$metadata`)
+ * and only neutralizes the characters that could break out of, or inject into,
+ * the literal it is embedded in:
+ *   - backslash, single/double quote, backtick → backslash-escaped
+ *   - `${` (TS template-literal interpolation) → broken with a backslash
+ *   - CR/LF (could inject extra dotenv/TOML lines) → backslash-escaped
+ * The same escaped form is safe in a TS single/double-quote string, a TS
+ * backtick literal, a Python double-quote string, a TOML basic string, and a
+ * single-line dotenv value. Validation/variable-resolution happens upstream in
+ * the emitter via {@link resolveServerUrl}.
+ */
+export function sanitizeUrlLiteral(str) {
+    return str
+        .replace(/\\/g, '\\\\')
+        .replace(/`/g, '\\`')
+        .replace(/'/g, "\\'")
+        .replace(/"/g, '\\"')
+        .replace(/\$\{/g, '\\${')
+        .replace(/\r/g, '\\r')
+        .replace(/\n/g, '\\n');
+}
+/** RFC 6838 / RFC 7231 media-type token: `type/subtype` with optional params. */
+const MEDIA_TYPE_RE = /^[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*\/[A-Za-z0-9][A-Za-z0-9!#$&^_.+-]*(\s*;\s*[^\s;]+)*$/;
+/**
+ * Validate a request-body media type against the RFC media-type grammar
+ * (`type/subtype`, optional parameters). The OpenAPI `content` map key is
+ * attacker-influenced and is interpolated into a string literal, so a value
+ * that is not a well-formed media type is replaced with `application/json`
+ * (the universal safe default) rather than trusted. The returned value is
+ * still escaped at the literal sink by {@link escapeStringLiteral}.
+ */
+export function sanitizeMediaType(str) {
+    return MEDIA_TYPE_RE.test(str.trim()) ? str.trim() : 'application/json';
+}
+/**
+ * Escape a string for safe embedding in a double-quoted Python string literal.
+ * Escapes backslashes, double quotes, and newlines.
+ */
+export function escapePyString(str) {
+    return str
+        .replace(/\\/g, '\\\\')
+        .replace(/"/g, '\\"')
+        .replace(/\n/g, '\\n')
+        .replace(/\r/g, '\\r');
+}
+const PY_KEYWORDS = new Set([
+    'False',
+    'None',
+    'True',
+    'and',
+    'as',
+    'assert',
+    'async',
+    'await',
+    'break',
+    'class',
+    'continue',
+    'def',
+    'del',
+    'elif',
+    'else',
+    'except',
+    'finally',
+    'for',
+    'from',
+    'global',
+    'if',
+    'import',
+    'in',
+    'is',
+    'lambda',
+    'nonlocal',
+    'not',
+    'or',
+    'pass',
+    'raise',
+    'return',
+    'try',
+    'while',
+    'with',
+    'yield',
+    'match',
+    'case',
+]);
+/**
+ * Convert an arbitrary parameter name into a valid, non-keyword Python
+ * identifier for use as a function argument or local variable name.
+ */
+export function sanitizePyIdentifier(str) {
+    let id = str.replace(/[^A-Za-z0-9_]/g, '_');
+    if (!/^[A-Za-z_]/.test(id))
+        id = `_${id}`;
+    if (PY_KEYWORDS.has(id))
+        id = `${id}_`;
+    return id || '_param';
+}
 /**
  * Validate that a URL path template contains only safe characters.
  * Allows: alphanumeric, /, {, }, -, _, .

package/dist/utils/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG;SACP,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/utils/sanitize.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC7C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAClG,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,SAA4D;IAE5D,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,QAAQ,GAAG,GAAG,CAAC;IACnB,IAAI,SAAS,EAAE,CAAC;QACd,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;YACnE,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;YACrC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,GAAG;SACP,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC;SACxB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,aAAa,GACjB,uFAAuF,CAAC;AAE1F;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,OAAO,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC;AAC1E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG;SACP,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,IAAI;IACJ,QAAQ;IACR,OAAO;IACP,OAAO;IACP,OAAO;IACP,OAAO;IACP,UAAU;IACV,KAAK;IACL,KAAK;IACL,MAAM;IACN,MAAM;IACN,QAAQ;IACR,SAAS;IACT,KAAK;IACL,MAAM;IACN,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,KAAK;IACL,IAAI;IACJ,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,OAAO;IACP,MAAM;IACN,OAAO;IACP,OAAO;IACP,MAAM;CACP,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC;IAC1C,IAAI,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,EAAE,GAAG,GAAG,EAAE,GAAG,CAAC;IACvC,OAAO,EAAE,IAAI,QAAQ,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,OAAO,GAAG,CAAC,OAAO,CAAC,sBAAsB,EAAE,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG;SACP,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;AAE1E;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcpmake/core",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "Shared generation library for mcpmake — parse APIs (OpenAPI/HAR/Postman/websites) and emit MCP servers.",
   "type": "module",
   "license": "Apache-2.0",