@mcpmake/core 0.2.4 → 0.3.0

package/dist/emitter/index.js

@@ -1,5 +1,5 @@
 import { writeCodeUnits } from './code-writer.js';
-import { scaffoldProjectFiles, scaffoldSharedModules } from './project-scaffolder.js';
+import { scaffoldProjectFiles, scaffoldSharedModules, escapeDotenvValue, } from './project-scaffolder.js';
 import { scaffoldSiteProjectFiles, scaffoldSiteSharedModules } from './site-scaffolder.js';
 import { renderTemplate } from './template-loader.js';
 import { renderSiteTemplate } from './site-template-loader.js';
@@ -7,7 +7,26 @@ import { renderPythonTemplate } from './python-template-loader.js';
 import { renderWorkerTemplate } from './worker-template-loader.js';
 import { buildCatalog } from '../transformer/catalog-builder.js';
 import { logger } from '../utils/logger.js';
+import { sanitizeUrlLiteral, sanitizePyIdentifier } from '../utils/sanitize.js';
 const SAFE_VERSION_RE = /^[0-9a-zA-Z._+-]{1,50}$/;
+/**
+ * Whether any configured auth scheme sends the API key as a query parameter.
+ * Query-string API-key auth cannot be applied as a header, so the generated
+ * tool handler appends it during URL construction instead (D-H2). Used to gate
+ * the `apiKeyQueryName` config field and the handler's append logic so projects
+ * without query auth are byte-for-byte unchanged.
+ */
+function hasQueryApiKey(manifest) {
+    return manifest.authSchemes.some((s) => s.type === 'apiKey' && s.in === 'query');
+}
+/**
+ * Per-tool render data for the handler templates. Carries the manifest-level
+ * `hasQueryApiKey` flag onto each tool so the template can emit the query
+ * API-key append without needing access to the whole manifest.
+ */
+function toToolHandlerView(tool, manifest) {
+    return { ...tool, hasQueryApiKey: hasQueryApiKey(manifest) };
+}
 /**
  * Serialize named environments for the generated `.env.example` / `.dev.vars`
  * seed (the `MCP_ENVIRONMENTS` JSON map). Returns undefined when none are set,
@@ -26,6 +45,10 @@ export async function emitProject(manifest, options) {
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(manifest.serverName)) {
         throw new Error(`Invalid server name: "${manifest.serverName}". Must match /^[a-z0-9][a-z0-9._-]*$/`);
     }
+    // baseUrl is emitted into string literals across TS/Python/TOML/.env targets.
+    // Sanitize once here so a malicious spec/flag value cannot break out of any of
+    // them (lossless for real URLs).
+    manifest = { ...manifest, baseUrl: sanitizeUrlLiteral(manifest.baseUrl) };
     if (!SAFE_VERSION_RE.test(manifest.serverVersion)) {
         logger.warn(`Unsafe server version "${manifest.serverVersion}" sanitized to "0.0.0"`);
         manifest = { ...manifest, serverVersion: '0.0.0' };
@@ -77,7 +100,7 @@ export async function emitProject(manifest, options) {
             for (const tool of staticTools) {
                 units.push({
                     filePath: `src/tools/${tool.fileName}.ts`,
-                    content: renderTemplate('tool-handler.ts', tool),
+                    content: renderTemplate('tool-handler.ts', toToolHandlerView(tool, manifest)),
                 });
             }
             units.push({
@@ -93,7 +116,7 @@ export async function emitProject(manifest, options) {
         for (const tool of manifest.tools) {
             units.push({
                 filePath: `src/tools/${tool.fileName}.ts`,
-                content: renderTemplate('tool-handler.ts', tool),
+                content: renderTemplate('tool-handler.ts', toToolHandlerView(tool, manifest)),
             });
         }
         units.push({
@@ -142,6 +165,10 @@ export async function emitWorkerProject(manifest, options) {
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(manifest.serverName)) {
         throw new Error(`Invalid server name: "${manifest.serverName}". Must match /^[a-z0-9][a-z0-9._-]*$/`);
     }
+    // baseUrl is emitted into string literals across TS/Python/TOML/.env targets.
+    // Sanitize once here so a malicious spec/flag value cannot break out of any of
+    // them (lossless for real URLs).
+    manifest = { ...manifest, baseUrl: sanitizeUrlLiteral(manifest.baseUrl) };
     if (!SAFE_VERSION_RE.test(manifest.serverVersion)) {
         logger.warn(`Unsafe server version "${manifest.serverVersion}" sanitized to "0.0.0"`);
         manifest = { ...manifest, serverVersion: '0.0.0' };
@@ -182,7 +209,19 @@ export async function emitWorkerProject(manifest, options) {
         { filePath: 'README.md', content: renderWorkerTemplate('readme.md', templateData) },
         {
             filePath: '.dev.vars.example',
-            content: renderWorkerTemplate('dev-vars.example', templateData),
+            // Escape the dotenv VALUES (baseUrl, defaultEnvironment) at this emit
+            // boundary so a value with a CR/LF or `#` cannot inject an extra
+            // KEY=value line into the operator's `.dev.vars` (D-M3). Env NAMES are
+            // already validated upstream in the Stainless translator. The wider
+            // templateData keeps the raw (url-literal-sanitized) baseUrl for the
+            // non-dotenv sinks (wrangler.toml, config.ts).
+            content: renderWorkerTemplate('dev-vars.example', {
+                ...templateData,
+                baseUrl: escapeDotenvValue(manifest.baseUrl),
+                defaultEnvironment: manifest.defaultEnvironment
+                    ? escapeDotenvValue(manifest.defaultEnvironment)
+                    : manifest.defaultEnvironment,
+            }),
         },
         { filePath: '.gitignore', content: renderWorkerTemplate('gitignore', templateData) },
         // Runtime-agnostic modules reused from the Node templates (fetch / Buffer /
@@ -198,7 +237,7 @@ export async function emitWorkerProject(manifest, options) {
     for (const tool of manifest.tools) {
         units.push({
             filePath: `src/tools/${tool.fileName}.ts`,
-            content: renderWorkerTemplate('tool-handler.ts', tool),
+            content: renderWorkerTemplate('tool-handler.ts', toToolHandlerView(tool, manifest)),
         });
     }
     units.push({
@@ -220,6 +259,10 @@ export async function emitSiteProject(manifest, options) {
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(manifest.serverName)) {
         throw new Error(`Invalid server name: "${manifest.serverName}". Must match /^[a-z0-9][a-z0-9._-]*$/`);
     }
+    // baseUrl is emitted into string literals across TS/Python/TOML/.env targets.
+    // Sanitize once here so a malicious spec/flag value cannot break out of any of
+    // them (lossless for real URLs).
+    manifest = { ...manifest, baseUrl: sanitizeUrlLiteral(manifest.baseUrl) };
     if (!SAFE_VERSION_RE.test(manifest.serverVersion)) {
         logger.warn(`Unsafe server version "${manifest.serverVersion}" sanitized to "0.0.0"`);
         manifest = { ...manifest, serverVersion: '0.0.0' };
@@ -259,6 +302,52 @@ function getSiteToolTemplate(tool) {
             return 'tool-handler-action.ts';
     }
 }
+/**
+ * Build a Python-safe view of a tool. Path/query param names become valid,
+ * de-duplicated Python identifiers (used as function args and locals), while the
+ * original API name is preserved for the URL path token and query-string key.
+ * This lets server.py.hbs build the URL with plain `str.replace()` instead of an
+ * f-string, removing the brace-expression evaluation / breakout vectors.
+ */
+function toPythonToolView(tool) {
+    const used = new Set();
+    const uniquePyName = (apiName) => {
+        let base = sanitizePyIdentifier(apiName);
+        let candidate = base;
+        let i = 1;
+        while (used.has(candidate))
+            candidate = `${base}_${i++}`;
+        used.add(candidate);
+        return candidate;
+    };
+    const pyPathParams = tool.pathParams.map((apiName) => ({
+        apiName,
+        pyName: uniquePyName(apiName),
+        brace: `{${apiName}}`,
+    }));
+    const pyQueryParams = tool.queryParams.map((apiName) => ({
+        apiName,
+        pyName: uniquePyName(apiName),
+    }));
+    // Header/cookie request params (D-H2). Driven off paramMappings so the
+    // function arg uses a sanitized, de-duplicated Python identifier while the
+    // upstream request still uses the original wire name. De-duplicated by wire
+    // name so a header/cookie repeated across mappings cannot emit two args.
+    const dedupeByWire = (kind) => {
+        const seen = new Set();
+        const out = [];
+        for (const m of tool.paramMappings) {
+            if (m.in !== kind || seen.has(m.wireName))
+                continue;
+            seen.add(m.wireName);
+            out.push({ wireName: m.wireName, pyName: uniquePyName(m.wireName) });
+        }
+        return out;
+    };
+    const pyHeaderParams = dedupeByWire('header');
+    const pyCookieParams = dedupeByWire('cookie');
+    return { ...tool, pyPathParams, pyQueryParams, pyHeaderParams, pyCookieParams };
+}
 /**
  * Emit a Python MCP server project.
  * Generates a single server.py file with all tools, plus requirements.txt.
@@ -267,11 +356,18 @@ export async function emitPythonProject(manifest, options) {
     if (!/^[a-z0-9][a-z0-9._-]*$/.test(manifest.serverName)) {
         throw new Error(`Invalid server name: "${manifest.serverName}". Must match /^[a-z0-9][a-z0-9._-]*$/`);
     }
+    // baseUrl is emitted into string literals across TS/Python/TOML/.env targets.
+    // Sanitize once here so a malicious spec/flag value cannot break out of any of
+    // them (lossless for real URLs).
+    manifest = { ...manifest, baseUrl: sanitizeUrlLiteral(manifest.baseUrl) };
     const units = [];
     const templateData = {
         ...manifest,
+        tools: manifest.tools.map(toPythonToolView),
         authEnvVars: manifest.envVars.filter((v) => v.name !== 'BASE_URL'),
         environmentsJson: environmentsJson(manifest),
+        // Gate the apiKey-in-query merge so projects without query auth are unchanged.
+        hasQueryApiKey: hasQueryApiKey(manifest),
     };
     units.push({
         filePath: 'server.py',
@@ -283,7 +379,18 @@ export async function emitPythonProject(manifest, options) {
     });
     units.push({
         filePath: '.env.example',
-        content: renderPythonTemplate('env.example', templateData),
+        // Escape the dotenv VALUES (baseUrl, defaultEnvironment) at this emit
+        // boundary so a value with a CR/LF or `#` cannot inject an extra KEY=value
+        // line into the operator's `.env` (D-M3). Env NAMES are already validated
+        // upstream. The wider templateData keeps the raw (url-literal-sanitized)
+        // baseUrl for the Python string-literal sink in server.py.
+        content: renderPythonTemplate('env.example', {
+            ...templateData,
+            baseUrl: escapeDotenvValue(manifest.baseUrl),
+            defaultEnvironment: manifest.defaultEnvironment
+                ? escapeDotenvValue(manifest.defaultEnvironment)
+                : manifest.defaultEnvironment,
+        }),
     });
     if (manifest.transport === 'http') {
         units.push({

package/dist/emitter/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/emitter/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAQ5C,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAElD;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAyB;IACjD,OAAO,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAyB,EAAE,OAAoB;IAC/E,gFAAgF;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,kDAAkD;IAClD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,QAAQ,CAAC;SACrD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,sBAAsB;YAChC,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,8DAA8D;QAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,uBAAuB;YACjC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;oBACzC,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC;iBACjD,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,CAAC,MAAM,mBAAmB;YACrD,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;gBACzC,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,IAAI,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,oBAAoB;YAC9B,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,cAAc,IAAI,CAAC,QAAQ,UAAU;YAC/C,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,IAAI,CACT,wCAAwC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,eAAe;YACpF,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,wDAAwD,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CACT,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CACT,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClF,IAAI,iBAAiB,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC1E,gFAAgF;IAChF,+CAA+C;IAC/C,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,WAAW,EAAE,iBAAiB;QAC9B,WAAW;QACX,QAAQ,EAAE,KAAK;QACf,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KAC7C,CAAC;IAEF,MAAM,KAAK,GAAe;QACxB,yBAAyB;QACzB,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACtF,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACvF,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE;QACzF,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE;QAC3F,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE;QAC3F,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACnF;YACE,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,YAAY,CAAC;SAChE;QACD,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACpF,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;QACtF;YACE,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;SAC5D;QACD,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;QACtF,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE;KAChF,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;YACzC,OAAO,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,IAAI,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,YAAY,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,qBAAqB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA6B,EAC7B,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElD,sFAAsF;IACtF,KAAK,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnD,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;YACzC,OAAO,EAAE,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,kBAAkB,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,IAAwB;IACnD,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,mBAAmB;YACtB,OAAO,2BAA2B,CAAC;QACrC,KAAK,aAAa;YAChB,OAAO,sBAAsB,CAAC;QAChC,KAAK,gBAAgB,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC;QAClC;YACE,OAAO,wBAAwB,CAAC;IACpC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;QAClE,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KAC7C,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC;KACzD,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;KAC5D,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,cAAc;QACxB,OAAO,EAAE,oBAAoB,CAAC,aAAa,EAAE,YAAY,CAAC;KAC3D,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,oBAAoB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/emitter/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,sBAAsB,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAiBhF,MAAM,eAAe,GAAG,yBAAyB,CAAC;AAElD;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,QAAyB;IAC/C,OAAO,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,CAAC;AACnF,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CACxB,IAAoB,EACpB,QAAyB;IAEzB,OAAO,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,QAAyB;IACjD,OAAO,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAyB,EAAE,OAAoB;IAC/E,gFAAgF;IAChF,IAAI,QAAQ,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QACrC,OAAO,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,iCAAiC;IACjC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,mBAAmB;IACnB,KAAK,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE9C,wBAAwB;IACxB,KAAK,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,kDAAkD;IAClD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,aAAa,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,qBAAqB;YAC/B,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,QAAQ,CAAC;SACrD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,sBAAsB;YAChC,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,iBAAiB;YAC3B,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE,QAAQ,CAAC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,8DAA8D;QAC9D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,uBAAuB;YACjC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1C,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD,CAAC,CAAC;QAEH,sDAAsD;QACtD,MAAM,WAAW,GAAG,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC;QAClD,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;QAEzD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,WAAW,EAAE,CAAC;gBAC/B,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;oBACzC,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;iBAC9E,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,oBAAoB;gBAC9B,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;aACjE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,CAAC,IAAI,CACT,sBAAsB,OAAO,CAAC,MAAM,mBAAmB;YACrD,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,WAAW,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CACnE,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,6CAA6C;QAC7C,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,CAAC,IAAI,CAAC;gBACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;gBACzC,OAAO,EAAE,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;aAC9E,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,oBAAoB;YAC9B,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC;SAC3E,CAAC,CAAC;IACL,CAAC;IAED,wBAAwB;IACxB,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,gBAAgB;YAC1B,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;SACrE,CAAC,CAAC;IACL,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,cAAc,IAAI,CAAC,QAAQ,UAAU;YAC/C,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,IAAI,CAAC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,iCAAiC;IACjC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAC1E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QACjF,MAAM,CAAC,IAAI,CACT,wCAAwC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,eAAe;YACpF,OAAO,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,wDAAwD,CAC/F,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,IAAI,CACT,gHAAgH,CACjH,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CACT,0FAA0F,CAC3F,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAClF,IAAI,iBAAiB,CAAC,MAAM,KAAK,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CACT,2HAA2H,CAC5H,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IAC1E,gFAAgF;IAChF,+CAA+C;IAC/C,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,WAAW,EAAE,iBAAiB;QAC9B,WAAW;QACX,QAAQ,EAAE,KAAK;QACf,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;KAC7C,CAAC;IAEF,MAAM,KAAK,GAAe;QACxB,yBAAyB;QACzB,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACtF,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACvF,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,oBAAoB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE;QACzF,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE;QAC3F,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,YAAY,CAAC,EAAE;QAC3F,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACnF;YACE,QAAQ,EAAE,mBAAmB;YAC7B,sEAAsE;YACtE,iEAAiE;YACjE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+CAA+C;YAC/C,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,EAAE;gBAChD,GAAG,YAAY;gBACf,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;oBAC7C,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,kBAAkB;aAChC,CAAC;SACH;QACD,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE;QACpF,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;QACtF;YACE,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;SAC5D;QACD,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC,EAAE;QACtF,EAAE,QAAQ,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE;KAChF,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;YACzC,OAAO,EAAE,oBAAoB,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,oBAAoB,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;KAC1E,CAAC,CAAC;IACH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,oBAAoB,CAAC,gBAAgB,EAAE,YAAY,CAAC;KAC9D,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,qBAAqB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC7E,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAA6B,EAC7B,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,iCAAiC;IACjC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,0BAA0B,QAAQ,CAAC,aAAa,wBAAwB,CAAC,CAAC;QACtF,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,kFAAkF;IAClF,KAAK,CAAC,IAAI,CAAC,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAElD,sFAAsF;IACtF,KAAK,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEnD,kDAAkD;IAClD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAClC,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,aAAa,IAAI,CAAC,QAAQ,KAAK;YACzC,OAAO,EAAE,kBAAkB,CAAC,YAAY,EAAE,IAAI,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,mCAAmC;IACnC,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,oBAAoB;QAC9B,OAAO,EAAE,kBAAkB,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;KACxE,CAAC,CAAC;IAEH,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,aAAa,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrE,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC;AAED,iEAAiE;AACjE,SAAS,mBAAmB,CAAC,IAAwB;IACnD,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtB,KAAK,mBAAmB;YACtB,OAAO,2BAA2B,CAAC;QACrC,KAAK,aAAa;YAChB,OAAO,sBAAsB,CAAC;QAChC,KAAK,gBAAgB,CAAC;QACtB,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC;QAClC;YACE,OAAO,wBAAwB,CAAC;IACpC,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,IAAoB;IAC5C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,YAAY,GAAG,CAAC,OAAe,EAAU,EAAE;QAC/C,IAAI,IAAI,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,SAAS,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACrD,OAAO;QACP,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE,IAAI,OAAO,GAAG;KACtB,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvD,OAAO;QACP,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;KAC9B,CAAC,CAAC,CAAC;IACJ,uEAAuE;IACvE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,YAAY,GAAG,CAAC,IAAyB,EAA0C,EAAE;QACzF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAA2C,EAAE,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IACF,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,cAAc,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC9C,OAAO,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,CAAC;AAClF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,QAAyB,EACzB,OAAoB;IAEpB,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,yBAAyB,QAAQ,CAAC,UAAU,wCAAwC,CACrF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,iCAAiC;IACjC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3C,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;QAClE,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QAC5C,+EAA+E;QAC/E,cAAc,EAAE,cAAc,CAAC,QAAQ,CAAC;KACzC,CAAC;IAEF,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,WAAW;QACrB,OAAO,EAAE,oBAAoB,CAAC,WAAW,EAAE,YAAY,CAAC;KACzD,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,oBAAoB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;KAC5D,CAAC,CAAC;IAEH,KAAK,CAAC,IAAI,CAAC;QACT,QAAQ,EAAE,cAAc;QACxB,sEAAsE;QACtE,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,2DAA2D;QAC3D,OAAO,EAAE,oBAAoB,CAAC,aAAa,EAAE;YAC3C,GAAG,YAAY;YACf,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC5C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;gBAC7C,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;gBAChD,CAAC,CAAC,QAAQ,CAAC,kBAAkB;SAChC,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,oBAAoB,CAAC,YAAY,EAAE,QAAQ,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,MAAM,oBAAoB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC5E,MAAM,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC1D,CAAC"}

package/dist/emitter/project-scaffolder.d.ts

@@ -1,5 +1,18 @@
 import type { ProjectManifest } from '../types/index.js';
 import type { CodeUnit } from './code-writer.js';
+/**
+ * Escape an arbitrary string for use as a single-line dotenv value in the
+ * generated `.env.example` (the file users are told to copy to `.env`).
+ *
+ * Untrusted values (e.g. a Stainless `defaultEnvironment` name, a base URL) are
+ * interpolated raw by Handlebars (`noEscape: true`), so a value containing a
+ * newline or `#` could inject extra `KEY=value` lines or a comment — config
+ * injection into the operator's `.env`. We collapse all line breaks to a single
+ * space and wrap the value in double quotes (dotenv treats a quoted value as a
+ * single token) whenever it contains a character that would otherwise change how
+ * dotenv parses the line. Lossless for benign values (those are returned as-is).
+ */
+export declare function escapeDotenvValue(raw: string): string;
 export declare function scaffoldProjectFiles(manifest: ProjectManifest): CodeUnit[];
 export declare function scaffoldSharedModules(manifest: ProjectManifest): CodeUnit[];
 //# sourceMappingURL=project-scaffolder.d.ts.map

package/dist/emitter/project-scaffolder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"project-scaffolder.d.ts","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AASjD,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,EAAE,CAgD1E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,EAAE,CAmD3E"}
+{"version":3,"file":"project-scaffolder.d.ts","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AASjD;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,EAAE,CAuD1E;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,QAAQ,EAAE,CAmD3E"}

package/dist/emitter/project-scaffolder.js

@@ -4,6 +4,28 @@ import { renderTemplate } from './template-loader.js';
  * problem; the README recommends `--dynamic-discovery` (the #1 buyer concern).
  */
 const DISCOVERY_RECOMMEND_THRESHOLD = 50;
+/**
+ * Escape an arbitrary string for use as a single-line dotenv value in the
+ * generated `.env.example` (the file users are told to copy to `.env`).
+ *
+ * Untrusted values (e.g. a Stainless `defaultEnvironment` name, a base URL) are
+ * interpolated raw by Handlebars (`noEscape: true`), so a value containing a
+ * newline or `#` could inject extra `KEY=value` lines or a comment — config
+ * injection into the operator's `.env`. We collapse all line breaks to a single
+ * space and wrap the value in double quotes (dotenv treats a quoted value as a
+ * single token) whenever it contains a character that would otherwise change how
+ * dotenv parses the line. Lossless for benign values (those are returned as-is).
+ */
+export function escapeDotenvValue(raw) {
+    // Neutralize any CR/LF — these are what break out into new dotenv lines.
+    const oneLine = raw.replace(/[\r\n]+/g, ' ');
+    // A bare value is safe only when it has no characters dotenv treats specially
+    // at the start/inside an unquoted value (#, quotes, backslash, surrounding ws).
+    const needsQuoting = /[#"'\\]/.test(oneLine) || /^\s|\s$/.test(oneLine) || oneLine !== raw;
+    if (!needsQuoting)
+        return oneLine;
+    return `"${oneLine.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+}
 export function scaffoldProjectFiles(manifest) {
     const dynamicDiscovery = manifest.dynamicDiscovery ?? false;
     const units = [
@@ -19,9 +41,16 @@ export function scaffoldProjectFiles(manifest) {
             filePath: '.env.example',
             content: renderTemplate('env.example', {
                 ...manifest,
+                // Serialize every untrusted scalar through the dotenv escaper at this
+                // emit boundary so a value with a newline/`#` cannot inject extra lines.
+                baseUrl: escapeDotenvValue(manifest.baseUrl),
+                defaultEnvironment: manifest.defaultEnvironment
+                    ? escapeDotenvValue(manifest.defaultEnvironment)
+                    : manifest.defaultEnvironment,
                 authEnvVars: manifest.envVars.filter((v) => v.name !== 'BASE_URL'),
                 // Pre-seed MCP_ENVIRONMENTS when an importer carried over named
                 // environments (e.g. Stainless `environments:`); omitted otherwise.
+                // JSON.stringify already escapes the keys/values into a single token.
                 environmentsJson: manifest.environments && Object.keys(manifest.environments).length > 0
                     ? JSON.stringify(manifest.environments)
                     : undefined,

package/dist/emitter/project-scaffolder.js.map

@@ -1 +1 @@
-{"version":3,"file":"project-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;GAGG;AACH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE;gBACrC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gEAAgE;gBAChE,oEAAoE;gBACpE,gBAAgB,EACd,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACpE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACvC,CAAC,CAAC,SAAS;aAChB,CAAC;SACH;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;gBACnC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gBAAgB;gBAChB,kBAAkB,EAChB,CAAC,gBAAgB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,6BAA6B;aAC9E,CAAC;SACH;KACF,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC/D,MAAM,cAAc,GAAG,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC/C,QAAQ;QACR,mBAAmB;QACnB,cAAc;QACd,aAAa;KACd,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CACrB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EACxE,YAAY,CACb;SACF;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,0EAA0E;YAC1E,sCAAsC;YACtC,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACxD;QACD;YACE,sEAAsE;YACtE,uEAAuE;YACvE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"project-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/project-scaffolder.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;GAGG;AACH,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,yEAAyE;IACzE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,YAAY,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC;IAC3F,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC;IAClC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAyB;IAC5D,MAAM,gBAAgB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC;SAClD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,aAAa,EAAE;gBACrC,GAAG,QAAQ;gBACX,sEAAsE;gBACtE,yEAAyE;gBACzE,OAAO,EAAE,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAC5C,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;oBAC7C,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC,kBAAkB,CAAC;oBAChD,CAAC,CAAC,QAAQ,CAAC,kBAAkB;gBAC/B,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gEAAgE;gBAChE,oEAAoE;gBACpE,sEAAsE;gBACtE,gBAAgB,EACd,QAAQ,CAAC,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC;oBACpE,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACvC,CAAC,CAAC,SAAS;aAChB,CAAC;SACH;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,WAAW;YACrB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE;gBACnC,GAAG,QAAQ;gBACX,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC;gBAClE,gBAAgB;gBAChB,kBAAkB,EAChB,CAAC,gBAAgB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,6BAA6B;aAC9E,CAAC;SACH;KACF,CAAC;IAEF,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAClC,KAAK,CAAC,IAAI,CAAC;YACT,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,QAAQ,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC/D,MAAM,cAAc,GAAG,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG;QACnB,GAAG,QAAQ;QACX,YAAY,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QACnD,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC;QAC/C,QAAQ;QACR,mBAAmB;QACnB,cAAc;QACd,aAAa;KACd,CAAC;IACF,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CACrB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,EACxE,YAAY,CACb;SACF;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,YAAY,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,aAAa;YACvB,OAAO,EAAE,cAAc,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,0EAA0E;YAC1E,sCAAsC;YACtC,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,cAAc,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SACxD;QACD;YACE,sEAAsE;YACtE,uEAAuE;YACvE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,cAAc,CAAC,UAAU,EAAE,QAAQ,CAAC;SAC9C;KACF,CAAC;AACJ,CAAC"}

package/dist/emitter/python-template-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"python-template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAsBH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAUpE"}
+{"version":3,"file":"python-template-loader.d.ts","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAkCH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,GAAG,MAAM,CAUpE"}

package/dist/emitter/python-template-loader.js

@@ -5,17 +5,27 @@ import { readFileSync } from 'node:fs';
 import { resolve, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import Handlebars from 'handlebars';
+import { escapePyString } from '../utils/sanitize.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const PYTHON_TEMPLATE_DIR = resolve(__dirname, 'python-templates');
 const pythonTemplateCache = new Map();
 Handlebars.registerHelper('eq', function (a, b) {
     return a === b;
 });
+// Logical OR for block conditionals (e.g. emit a section when either of two
+// param lists is non-empty). Handlebars has no built-in `or`.
+Handlebars.registerHelper('or', function (a, b) {
+    return a || b;
+});
 Handlebars.registerHelper('pyDocstring', function (str) {
     if (!str)
         return '';
     return str.replace(/"""/g, '\\"\\"\\"').replace(/\\/g, '\\\\');
 });
+// Escape a value for embedding in a double-quoted Python string literal.
+Handlebars.registerHelper('pyStr', function (str) {
+    return escapePyString(String(str ?? ''));
+});
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 export function renderPythonTemplate(name, data) {
     if (!pythonTemplateCache.has(name)) {

package/dist/emitter/python-template-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"python-template-loader.js","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE3E,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,UAAU,GAAW;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAS;IAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"python-template-loader.js","sourceRoot":"","sources":["../../src/emitter/python-template-loader.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,UAAU,MAAM,YAAY,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;AAEnE,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAE3E,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,KAAK,CAAC,CAAC;AACjB,CAAC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,8DAA8D;AAC9D,UAAU,CAAC,cAAc,CAAC,IAAI,EAAE,UAAU,CAAU,EAAE,CAAU;IAC9D,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC,CAAC,CAAC;AAEH,UAAU,CAAC,cAAc,CAAC,aAAa,EAAE,UAAU,GAAW;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,yEAAyE;AACzE,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,GAAY;IACvD,OAAO,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC,CAAC;AAEH,8DAA8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,IAAS;IAC1D,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,mBAAmB,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,mBAAmB,GAAG,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QAChD,mBAAmB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/emitter/python-templates/dockerfile.hbs

@@ -4,7 +4,10 @@ WORKDIR /app
 COPY requirements.txt .
 RUN pip install --no-cache-dir -r requirements.txt
 COPY server.py .
-COPY .env.example .env
+# Do NOT bake .env.example in as the runtime .env — it ships placeholder/sample
+# secrets into the image (L-pydocker). Provide real config at run time via
+# `docker run -e KEY=VALUE` / `--env-file`, or mount a real .env. `load_dotenv()`
+# in server.py is a no-op when no .env is present and falls back to os.environ.
 
 ENV TRANSPORT=http
 ENV PORT=3000

package/dist/emitter/python-templates/server.py.hbs

@@ -3,6 +3,7 @@
 import os
 import json
 import httpx
+from urllib.parse import quote
 from dotenv import load_dotenv
 from mcp.server import Server
 from mcp.server.stdio import stdio_server
@@ -37,7 +38,12 @@ API_KEY = os.environ.get("{{envVarName}}", "")
 {{/each}}
 
 server = Server("{{serverName}}")
-client = httpx.AsyncClient(timeout=30.0)
+
+# Hard per-request deadline (seconds) and response-size cap (bytes). A stalled or
+# runaway upstream otherwise keeps tool calls alive indefinitely or exhausts memory.
+_REQUEST_TIMEOUT_S = float(os.environ.get("MCP_REQUEST_TIMEOUT_MS", "30000")) / 1000.0
+_MAX_RESPONSE_BYTES = int(os.environ.get("MCP_MAX_RESPONSE_BYTES", str(10 * 1024 * 1024)))
+client = httpx.AsyncClient(timeout=_REQUEST_TIMEOUT_S)
 
 
 def _headers() -> dict[str, str]:
@@ -48,34 +54,102 @@ def _headers() -> dict[str, str]:
         headers["Authorization"] = f"Bearer {BEARER_TOKEN}"
 {{/if}}
 {{#if (eq type "apiKey")}}
+{{#if (eq in "header")}}
+    if API_KEY:
+        headers["{{pyStr headerName}}"] = API_KEY
+{{/if}}
+{{#if (eq in "cookie")}}
+    # API key sent as a cookie — appended to the Cookie header.
     if API_KEY:
-        headers["{{headerName}}"] = API_KEY
+        _existing = headers.get("Cookie")
+        _pair = "{{pyStr headerName}}=" + quote(str(API_KEY), safe="")
+        headers["Cookie"] = (_existing + "; " + _pair) if _existing else _pair
+{{/if}}
 {{/if}}
 {{/each}}
     return headers
 
 
+def _auth_query_params() -> dict[str, str]:
+    # apiKey-in-query auth: the key is sent as a query parameter, not a header.
+    params: dict[str, str] = {}
+{{#each authSchemes}}
+{{#if (eq type "apiKey")}}
+{{#if (eq in "query")}}
+    if API_KEY:
+        params["{{pyStr headerName}}"] = API_KEY
+{{/if}}
+{{/if}}
+{{/each}}
+    return params
+
+
 {{#each tools}}
 @server.tool()
-async def {{functionName}}({{#each pathParams}}{{this}}: str, {{/each}}{{#each queryParams}}{{this}}: str = "", {{/each}}{{#if hasRequestBody}}body: dict | None = None{{/if}}) -> list[TextContent]:
+async def {{functionName}}({{#each pyPathParams}}{{pyName}}: str, {{/each}}{{#each pyQueryParams}}{{pyName}}: str = "", {{/each}}{{#each pyHeaderParams}}{{pyName}}: str = "", {{/each}}{{#each pyCookieParams}}{{pyName}}: str = "", {{/each}}{{#if hasRequestBody}}body: dict | None = None{{/if}}) -> list[TextContent]:
     """{{pyDocstring description}}"""
-    url = f"{BASE_URL}{{{pathTemplate}}}"
-    {{#if queryParams.length}}
-    params = { {{#each queryParams}}"{{this}}": {{this}}, {{/each}} }
+    url = BASE_URL + "{{pyStr pathTemplate}}"
+    {{#each pyPathParams}}
+    url = url.replace("{{pyStr brace}}", quote(str({{pyName}}), safe=""))
+    {{/each}}
+    {{#if pyQueryParams.length}}
+    params = { {{#each pyQueryParams}}"{{pyStr apiName}}": {{pyName}}, {{/each}} }
     params = {k: v for k, v in params.items() if v}
+    {{#if @root.hasQueryApiKey}}
+    params.update(_auth_query_params())
+    {{/if}}
+    {{else}}
+    {{#if @root.hasQueryApiKey}}
+    params = _auth_query_params()
+    {{/if}}
+    {{/if}}
+    {{#if (or pyHeaderParams.length pyCookieParams.length)}}
+    # Per-request header/cookie params (D-H2): sent under their original wire
+    # names, merged over the auth headers. Empty values are omitted.
+    req_headers = dict(_headers())
+    {{#each pyHeaderParams}}
+    if {{pyName}}:
+        req_headers["{{pyStr wireName}}"] = {{pyName}}
+    {{/each}}
+    {{#if pyCookieParams.length}}
+    _cookie_parts = []
+    {{#each pyCookieParams}}
+    if {{pyName}}:
+        _cookie_parts.append("{{pyStr wireName}}=" + quote(str({{pyName}}), safe=""))
+    {{/each}}
+    if _cookie_parts:
+        _existing = req_headers.get("Cookie")
+        _joined = "; ".join(_cookie_parts)
+        req_headers["Cookie"] = (_existing + "; " + _joined) if _existing else _joined
+    {{/if}}
     {{/if}}
     try:
         resp = await client.request(
             "{{method}}",
             url,
-            headers=_headers(),
-            {{#if queryParams.length}}
+            headers={{#if (or pyHeaderParams.length pyCookieParams.length)}}req_headers{{else}}_headers(){{/if}},
+            {{#if (or queryParams.length @root.hasQueryApiKey)}}
             params=params,
             {{/if}}
             {{#if hasRequestBody}}
+            {{#if (eq bodyEncoding "form")}}
+            data=body,
+            {{else}}
+            {{#if (eq bodyEncoding "multipart")}}
+            files=body,
+            {{else}}
             json=body,
             {{/if}}
+            {{/if}}
+            {{/if}}
         )
+        # Cap the buffered response so a runaway upstream cannot exhaust memory.
+        if len(resp.content) > _MAX_RESPONSE_BYTES:
+            return [TextContent(type="text", text=f"Error: response exceeded {_MAX_RESPONSE_BYTES}-byte cap")]
+        # Never echo upstream 4xx/5xx bodies to the MCP caller — they can leak
+        # internal/upstream detail. Surface only the status code + generic reason.
+        if resp.status_code >= 400:
+            return [TextContent(type="text", text=f"Error: upstream returned {resp.status_code} {resp.reason_phrase}".rstrip())]
         data = resp.json() if resp.headers.get("content-type", "").startswith("application/json") else resp.text
         return [TextContent(type="text", text=json.dumps(data, indent=2) if isinstance(data, (dict, list)) else str(data))]
     except Exception as e:

package/dist/emitter/site-scaffolder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"site-scaffolder.d.ts","sourceRoot":"","sources":["../../src/emitter/site-scaffolder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC/E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAIjD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CA0ClF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CAsBnF"}
+{"version":3,"file":"site-scaffolder.d.ts","sourceRoot":"","sources":["../../src/emitter/site-scaffolder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAqC,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AA4BjD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CA0ClF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,QAAQ,EAAE,CA4BnF"}

package/dist/emitter/site-scaffolder.js

@@ -1,8 +1,29 @@
 /**
  * Scaffolds the project files and shared modules for a site (Playwright-based) MCP server.
  */
+import { isSensitiveField } from '../analyzer/dom-parser.js';
 import { renderSiteTemplate } from './site-template-loader.js';
 import { renderTemplate } from './template-loader.js';
+/**
+ * Defense-in-depth before writing `site-descriptor.json`: strip any
+ * default/prefilled value from sensitive (password/credential) form fields so
+ * a captured live secret can never be serialized into the generated project,
+ * even if it slipped through an older parser or hand-edited descriptor (M9).
+ */
+function stripSensitiveDefaults(descriptor) {
+    return {
+        ...descriptor,
+        pages: descriptor.pages.map((page) => ({
+            ...page,
+            forms: page.forms.map((form) => ({
+                ...form,
+                fields: form.fields.map((field) => field.defaultValue !== undefined && isSensitiveField(field.name, field.fieldType, '')
+                    ? { ...field, defaultValue: undefined }
+                    : field),
+            })),
+        })),
+    };
+}
 /**
  * Generate project skeleton files (package.json, tsconfig, Dockerfile, etc.)
  */
@@ -62,9 +83,15 @@ export function scaffoldSiteSharedModules(manifest) {
             filePath: 'src/browser-manager.ts',
             content: renderSiteTemplate('browser-manager.ts', manifest),
         },
+        {
+            // Best-effort browser-session telemetry for exact metering on managed
+            // hosting. No-ops unless the host injects MCPMAKE_TELEMETRY_URL.
+            filePath: 'src/telemetry.ts',
+            content: renderSiteTemplate('telemetry.ts', manifest),
+        },
         {
             filePath: 'src/site-descriptor.json',
-            content: JSON.stringify(manifest.siteDescriptor, null, 2),
+            content: JSON.stringify(stripSensitiveDefaults(manifest.siteDescriptor), null, 2),
         },
     ];
 }

package/dist/emitter/site-scaffolder.js.map

@@ -1 +1 @@
-{"version":3,"file":"site-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/site-scaffolder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA6B;IACpE,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,6EAA6E;YAC7E,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC;SACrD;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC;SACpD;QACD;YACE,sEAAsE;YACtE,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,IAAI,CAAC,SAAS,CACrB;gBACE,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;aACV,EAC7B,IAAI,EACJ,CAAC,CACF;SACF;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA6B;IACrE,MAAM,kBAAkB,GACtB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAE3E,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,kBAAkB,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SAC5D;QACD;YACE,QAAQ,EAAE,0BAA0B;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;SAC1D;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"site-scaffolder.js","sourceRoot":"","sources":["../../src/emitter/site-scaffolder.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD;;;;;GAKG;AACH,SAAS,sBAAsB,CAAC,UAA0B;IACxD,OAAO;QACL,GAAG,UAAU;QACb,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrC,GAAG,IAAI;YACP,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC/B,GAAG,IAAI;gBACP,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAChC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;oBACnF,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE;oBACvC,CAAC,CAAC,KAAK,CACV;aACF,CAAC,CAAC;SACJ,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA6B;IACpE,MAAM,KAAK,GAAe;QACxB;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,6EAA6E;YAC7E,OAAO,EAAE,cAAc,CAAC,eAAe,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,aAAa,EAAE,QAAQ,CAAC;SACrD;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,cAAc,CAAC,WAAW,EAAE,QAAQ,CAAC;SAC/C;QACD;YACE,QAAQ,EAAE,YAAY;YACtB,OAAO,EAAE,kBAAkB,CAAC,YAAY,EAAE,QAAQ,CAAC;SACpD;QACD;YACE,sEAAsE;YACtE,QAAQ,EAAE,mBAAmB;YAC7B,OAAO,EAAE,IAAI,CAAC,SAAS,CACrB;gBACE,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,aAAa,EAAE,QAAQ,CAAC,aAAa;aACV,EAC7B,IAAI,EACJ,CAAC,CACF;SACF;KACF,CAAC;IAEF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,QAA6B;IACrE,MAAM,kBAAkB,GACtB,QAAQ,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,gBAAgB,CAAC;IAE3E,OAAO;QACL;YACE,QAAQ,EAAE,cAAc;YACxB,OAAO,EAAE,kBAAkB,CAAC,kBAAkB,EAAE,QAAQ,CAAC;SAC1D;QACD;YACE,QAAQ,EAAE,eAAe;YACzB,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,QAAQ,CAAC;SACnD;QACD;YACE,QAAQ,EAAE,wBAAwB;YAClC,OAAO,EAAE,kBAAkB,CAAC,oBAAoB,EAAE,QAAQ,CAAC;SAC5D;QACD;YACE,sEAAsE;YACtE,iEAAiE;YACjE,QAAQ,EAAE,kBAAkB;YAC5B,OAAO,EAAE,kBAAkB,CAAC,cAAc,EAAE,QAAQ,CAAC;SACtD;QACD;YACE,QAAQ,EAAE,0BAA0B;YACpC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;SAClF;KACF,CAAC;AACJ,CAAC"}