@mcpmake/core 0.2.5 → 0.3.1

package/dist/emitter/worker-templates/worker.ts.hbs

@@ -90,8 +90,34 @@ async function safeEqual(a: string, b: string): Promise<boolean> {
   for (let i = 0; i < da.length; i++) diff |= da[i] ^ db[i];
   return diff === 0;
 }
-async function isAuthorized(request: Request, expected: string | undefined): Promise<boolean> {
-  if (!expected) return true; // auth disabled when MCP_AUTH_TOKEN is unset (local/dev only)
+// Fail CLOSED: when MCP_AUTH_TOKEN is unset every authenticated route is denied
+// unless the operator opts in with MCP_ALLOW_UNAUTHENTICATED === 'true' (a
+// local/dev escape hatch). We warn once per isolate so the open posture is loud.
+let unauthWarned = false;
+async function isAuthorized(request: Request, env: Env): Promise<boolean> {
+  const expected = env.MCP_AUTH_TOKEN;
+  if (!expected) {
+    if (env.MCP_ALLOW_UNAUTHENTICATED === 'true') {
+      if (!unauthWarned) {
+        unauthWarned = true;
+        console.warn(
+          'SECURITY: MCP_AUTH_TOKEN is unset and MCP_ALLOW_UNAUTHENTICATED=true — ' +
+            'this Worker is serving authenticated routes WITHOUT a bearer token. ' +
+            'Set MCP_AUTH_TOKEN before exposing this endpoint.',
+        );
+      }
+      return true;
+    }
+    if (!unauthWarned) {
+      unauthWarned = true;
+      console.error(
+        'SECURITY: MCP_AUTH_TOKEN is unset — denying all authenticated routes. ' +
+          'Set MCP_AUTH_TOKEN (wrangler secret put MCP_AUTH_TOKEN), or set ' +
+          'MCP_ALLOW_UNAUTHENTICATED=true for local/dev only.',
+      );
+    }
+    return false;
+  }
   const header = request.headers.get('authorization');
   if (!header || !header.startsWith('Bearer ')) return false;
   const presented = header.slice(7).trim();
@@ -99,19 +125,41 @@ async function isAuthorized(request: Request, expected: string | undefined): Pro
   return safeEqual(presented, expected);
 }
 
-/* ── HTTP / CORS helpers ─────────────────────────────────────────────── */
-function corsHeaders(origin?: string | null): Record<string, string> {
-  return {
-    'access-control-allow-origin': origin || '*',
+/* ── HTTP / CORS helpers ───────────────────────────────────────────────
+ * These responses are credentialed (gated by a bearer token), so we never
+ * emit a blanket `Access-Control-Allow-Origin: *`. CORS headers are reflected
+ * only when the request Origin is in the MCP_ALLOWED_ORIGINS allowlist
+ * (comma-separated); otherwise the response carries no ACAO header at all. */
+function originAllowed(origin: string | null | undefined, env: Env): boolean {
+  if (!origin) return false;
+  const raw = env.MCP_ALLOWED_ORIGINS;
+  if (!raw) return false;
+  return raw
+    .split(',')
+    .map((s) => s.trim())
+    .filter(Boolean)
+    .includes(origin);
+}
+function corsHeaders(origin: string | null | undefined, env: Env): Record<string, string> {
+  const headers: Record<string, string> = {
     'access-control-allow-methods': 'POST, GET, OPTIONS',
     'access-control-allow-headers':
       'authorization, content-type, mcp-method, mcp-name, mcp-protocol-version, traceparent, tracestate',
   };
+  if (originAllowed(origin, env)) {
+    headers['access-control-allow-origin'] = origin as string;
+    headers['vary'] = 'Origin';
+  }
+  return headers;
 }
-function json(body: unknown, status = 200, extra?: Record<string, string>): Response {
+function json(
+  body: unknown,
+  status = 200,
+  extra?: Record<string, string>,
+): Response {
   return new Response(JSON.stringify(body), {
     status,
-    headers: { 'content-type': 'application/json', ...corsHeaders(), ...extra },
+    headers: { 'content-type': 'application/json', ...extra },
   });
 }
 function ok(id: unknown, result: unknown): object {
@@ -120,8 +168,13 @@ function ok(id: unknown, result: unknown): object {
 function err(id: unknown, code: number, message: string): object {
   return { jsonrpc: '2.0', id: id ?? null, error: { code, message } };
 }
-function rpcErrorResponse(id: unknown, code: number, message: string): Response {
-  return json(err(id, code, message));
+function rpcErrorResponse(
+  id: unknown,
+  code: number,
+  message: string,
+  cors?: Record<string, string>,
+): Response {
+  return json(err(id, code, message), 200, cors);
 }
 
 /* ── server/discover (SEP-2575) — VERIFY result shape against the final spec ── */
@@ -235,16 +288,19 @@ export default {
   async fetch(request: Request, env: Env): Promise<Response> {
     const url = new URL(request.url);
     const origin = request.headers.get('origin');
+    // Computed once: empty unless the request Origin is in MCP_ALLOWED_ORIGINS.
+    const cors = corsHeaders(origin, env);
 
     if (request.method === 'OPTIONS') {
-      return new Response(null, { status: 204, headers: corsHeaders(origin) });
+      return new Response(null, { status: 204, headers: cors });
     }
     if (url.pathname === '/health') return json({ status: 'ok' });
     if (url.pathname === '/ready') return json({ status: 'ready' });
 
     // Bearer authentication (every path except /health and /ready).
-    if (!(await isAuthorized(request, env.MCP_AUTH_TOKEN))) {
+    if (!(await isAuthorized(request, env))) {
       return json({ error: 'Unauthorized: missing or invalid bearer token' }, 401, {
+        ...cors,
         'www-authenticate': 'Bearer',
       });
     }
@@ -256,30 +312,37 @@ export default {
       console.log(JSON.stringify({ level: 'info', msg: 'mcp-meta-headers', mcpMethod, mcpName }));
     }
 
-    if (url.pathname !== '/mcp') return json({ error: 'Not found' }, 404);
+    if (url.pathname !== '/mcp') return json({ error: 'Not found' }, 404, cors);
     if (request.method !== 'POST') {
       // Stateless: no SSE stream to open (GET) or session to delete (DELETE).
-      return rpcErrorResponse(null, -32601, 'Only POST is supported on this stateless server');
+      return rpcErrorResponse(
+        null,
+        -32601,
+        'Only POST is supported on this stateless server',
+        cors,
+      );
     }
 
     // Origin guard (DNS-rebinding protection). Enforced only when configured —
     // a Workers endpoint is public and gated by the bearer token, not by origin.
     const allowedOrigin = env.ALLOWED_ORIGIN;
     if (allowedOrigin && origin && origin !== allowedOrigin) {
-      return json({ error: 'Forbidden: invalid origin' }, 403);
+      return json({ error: 'Forbidden: invalid origin' }, 403, cors);
     }
 
     const contentLength = Number(request.headers.get('content-length') ?? '0');
-    if (contentLength > MAX_BODY) return rpcErrorResponse(null, -32600, 'Request body too large');
+    if (contentLength > MAX_BODY)
+      return rpcErrorResponse(null, -32600, 'Request body too large', cors);
     const raw = await request.text();
-    if (raw.length > MAX_BODY) return rpcErrorResponse(null, -32600, 'Request body too large');
-    if (!raw) return rpcErrorResponse(null, -32600, 'Empty request body');
+    if (raw.length > MAX_BODY)
+      return rpcErrorResponse(null, -32600, 'Request body too large', cors);
+    if (!raw) return rpcErrorResponse(null, -32600, 'Empty request body', cors);
 
     let parsed: unknown;
     try {
       parsed = JSON.parse(raw);
     } catch {
-      return rpcErrorResponse(null, -32700, 'Parse error');
+      return rpcErrorResponse(null, -32700, 'Parse error', cors);
     }
 
     const config = loadConfig(env);
@@ -293,25 +356,25 @@ export default {
     return runWithTrace(trace, async () => {
       if (Array.isArray(parsed)) {
         if (parsed.length === 0) {
-          return rpcErrorResponse(null, -32600, 'Empty JSON-RPC batch');
+          return rpcErrorResponse(null, -32600, 'Empty JSON-RPC batch', cors);
         }
         if (parsed.length > MAX_BATCH) {
-          return rpcErrorResponse(null, -32600, `Batch too large (max ${MAX_BATCH})`);
+          return rpcErrorResponse(null, -32600, `Batch too large (max ${MAX_BATCH})`, cors);
         }
         const settled = await mapWithConcurrency(parsed, BATCH_CONCURRENCY, (m) =>
           handleRpc(m as { id?: unknown; method?: unknown }, config, env),
         );
         const responses = settled.filter((r): r is object => r !== null);
         if (responses.length === 0) {
-          return new Response(null, { status: 202, headers: corsHeaders(origin) });
+          return new Response(null, { status: 202, headers: cors });
         }
-        return json(responses);
+        return json(responses, 200, cors);
       }
       const response = await handleRpc(parsed as { id?: unknown; method?: unknown }, config, env);
       if (response === null) {
-        return new Response(null, { status: 202, headers: corsHeaders(origin) });
+        return new Response(null, { status: 202, headers: cors });
       }
-      return json(response);
+      return json(response, 200, cors);
     });
   },
 };

package/dist/generator/spec-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../src/generator/spec-generator.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAcD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+C/F"}
+{"version":3,"file":"spec-generator.d.ts","sourceRoot":"","sources":["../../src/generator/spec-generator.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAcD,wBAAsB,2BAA2B,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAoC/F"}

package/dist/generator/spec-generator.js

@@ -1,6 +1,6 @@
-import Anthropic from '@anthropic-ai/sdk';
+import { extractJsonObject } from '../utils/json-extract.js';
 import { logger } from '../utils/logger.js';
-import { resolveModel } from '../utils/model-resolver.js';
+import { requireLlmProvider } from '../llm/index.js';
 const SYSTEM_PROMPT = `You are an API architect. Given a description of an API or service, generate a valid OpenAPI 3.0 specification in JSON format.
 
 Rules:
@@ -13,78 +13,33 @@ Rules:
 - Include a servers array with a base URL
 - Keep it practical — 3-10 operations is typical`;
 export async function generateSpecFromDescription(options) {
-    const apiKey = process.env.ANTHROPIC_API_KEY;
-    if (!apiKey) {
-        throw new Error('ANTHROPIC_API_KEY environment variable is required for describe mode.\n' +
-            'Set it with: export ANTHROPIC_API_KEY=your-key-here');
-    }
-    const client = new Anthropic({ apiKey });
-    const model = await resolveModel(client, 'balanced', options.model);
+    const provider = requireLlmProvider('describe mode');
     let userPrompt = `Generate an OpenAPI 3.0 spec for: ${options.description}`;
     if (options.baseUrl) {
         userPrompt += `\n\nUse this base URL: ${options.baseUrl}`;
     }
     logger.info('Generating OpenAPI spec from description...');
-    const message = await client.messages.create({
-        model,
-        max_tokens: 4096,
+    const responseText = await provider.completeText({
         system: SYSTEM_PROMPT,
-        messages: [{ role: 'user', content: userPrompt }],
+        prompt: userPrompt,
+        tier: 'balanced',
+        model: options.model,
+        maxTokens: 4096,
     });
-    const content = message.content[0];
-    if (content.type !== 'text') {
-        throw new Error('Unexpected response format from Claude');
-    }
     // OpenAPI specs are recursive, so structured outputs can't enforce the shape.
     // Instead, extract the first balanced JSON object — robust to markdown fences,
     // leading/trailing prose, and braces that appear inside string values.
-    const json = extractJsonObject(content.text);
+    const json = extractJsonObject(responseText);
     if (json === null) {
-        throw new Error('Claude did not return a JSON object. Try again or refine your description.');
+        throw new Error('The model did not return a JSON object. Try again or refine your description.');
     }
     // Validate it's parseable JSON
     try {
         JSON.parse(json);
     }
     catch {
-        throw new Error('Claude returned invalid JSON. Try again or refine your description.');
+        throw new Error('The model returned invalid JSON. Try again or refine your description.');
     }
     return json;
 }
-/**
- * Return the substring spanning the first balanced top-level `{...}` object in
- * `text`, or null if none. String-aware (ignores braces inside quoted strings)
- * and linear-time — no regex, so no catastrophic-backtracking risk.
- */
-function extractJsonObject(text) {
-    const start = text.indexOf('{');
-    if (start === -1)
-        return null;
-    let depth = 0;
-    let inString = false;
-    let escaped = false;
-    for (let i = start; i < text.length; i++) {
-        const ch = text[i];
-        if (inString) {
-            if (escaped)
-                escaped = false;
-            else if (ch === '\\')
-                escaped = true;
-            else if (ch === '"')
-                inString = false;
-        }
-        else if (ch === '"') {
-            inString = true;
-        }
-        else if (ch === '{') {
-            depth++;
-        }
-        else if (ch === '}') {
-            depth--;
-            if (depth === 0)
-                return text.slice(start, i + 1);
-        }
-    }
-    return null;
-}
 //# sourceMappingURL=spec-generator.js.map

package/dist/generator/spec-generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"spec-generator.js","sourceRoot":"","sources":["../../src/generator/spec-generator.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAQ1D,MAAM,aAAa,GAAG;;;;;;;;;;iDAU2B,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAA4B;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC7C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,qDAAqD,CACxD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAEpE,IAAI,UAAU,GAAG,qCAAqC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,IAAI,0BAA0B,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAE3D,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC3C,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,MAAM,EAAE,aAAa;QACrB,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;KAClD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY;IACrC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;QACxC,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"spec-generator.js","sourceRoot":"","sources":["../../src/generator/spec-generator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAQrD,MAAM,aAAa,GAAG;;;;;;;;;;iDAU2B,CAAC;AAElD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAA4B;IAC5E,MAAM,QAAQ,GAAG,kBAAkB,CAAC,eAAe,CAAC,CAAC;IAErD,IAAI,UAAU,GAAG,qCAAqC,OAAO,CAAC,WAAW,EAAE,CAAC;IAC5E,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,IAAI,0BAA0B,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;IAE3D,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC;QAC/C,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,8EAA8E;IAC9E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,IAAI,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,+EAA+E,CAChF,CAAC;IACJ,CAAC;IAED,+BAA+B;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/index.d.ts

@@ -12,6 +12,7 @@ export { renderTemplate } from './emitter/template-loader.js';
 export { scaffoldSharedModules } from './emitter/project-scaffolder.js';
 export { loadOpenApiSpec } from './parser/openapi-loader.js';
 export type { LoadResult } from './parser/openapi-loader.js';
+export { assertPublicUrl, isPrivateOrReservedIp, privateHostsAllowed } from './utils/ssrf-guard.js';
 export { applyOverlay } from './parser/overlay-loader.js';
 export { extractOperations } from './parser/operation-extractor.js';
 export type { ExtractionResult } from './parser/operation-extractor.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAK5E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAKhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAKxE,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,YAAY,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,YAAY,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAChE,YAAY,EAAE,YAAY,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,YAAY,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAC/D,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAKnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAK3E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAK5E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACpF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAKtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC/E,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC3F,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAKpG,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAK7E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAChF,YAAY,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAK3D,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAKhC,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAK/C,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACnG,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -16,6 +16,7 @@ export { scaffoldSharedModules } from './emitter/project-scaffolder.js';
 // Parser (OpenAPI / HAR / Postman ingestion)
 // ---------------------------------------------------------------------------
 export { loadOpenApiSpec } from './parser/openapi-loader.js';
+export { assertPublicUrl, isPrivateOrReservedIp, privateHostsAllowed } from './utils/ssrf-guard.js';
 export { applyOverlay } from './parser/overlay-loader.js';
 export { extractOperations } from './parser/operation-extractor.js';
 export { jsonSchemaToZodCode, buildOperationInputSchema } from './parser/schema-converter.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhF,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAC9E,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AAExE,8EAA8E;AAC9E,6CAA6C;AAC7C,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AACpG,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EACL,UAAU,EACV,WAAW,EACX,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAEzD,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAEhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,+CAA+C;AAC/C,8EAA8E;AAC9E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AACpF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AAG/D,8EAA8E;AAC9E,sDAAsD;AACtD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAE3E,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAC9E,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAE5E,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAC9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAEtE,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE/E,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG3F,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAC9E,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAE7E,8EAA8E;AAC9E,6BAA6B;AAC7B,8EAA8E;AAC9E,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAGhF,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAEhC,8EAA8E;AAC9E,QAAQ;AACR,8EAA8E;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAC9E,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC"}

package/dist/llm/anthropic-provider.d.ts

@@ -0,0 +1,14 @@
+import type { CompleteJsonOptions, CompleteOptions, LlmProvider } from './types.js';
+export interface AnthropicProviderOptions {
+    apiKey: string;
+    baseURL?: string;
+}
+export declare class AnthropicProvider implements LlmProvider {
+    readonly name = "anthropic";
+    readonly supportsVision = true;
+    private readonly client;
+    constructor(opts: AnthropicProviderOptions);
+    completeText({ system, prompt, tier, model, maxTokens }: CompleteOptions): Promise<string>;
+    completeJson<T = unknown>({ system, prompt, schema, tier, model, maxTokens, }: CompleteJsonOptions): Promise<T>;
+}
+//# sourceMappingURL=anthropic-provider.d.ts.map

package/dist/llm/anthropic-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-provider.d.ts","sourceRoot":"","sources":["../../src/llm/anthropic-provider.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEpF,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IACnD,QAAQ,CAAC,IAAI,eAAe;IAC5B,QAAQ,CAAC,cAAc,QAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;gBAEvB,IAAI,EAAE,wBAAwB;IAIpC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAc1F,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,EAC9B,MAAM,EACN,MAAM,EACN,MAAM,EACN,IAAI,EACJ,KAAK,EACL,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;CAoBpC"}

package/dist/llm/anthropic-provider.js

@@ -0,0 +1,50 @@
+/**
+ * Anthropic-backed {@link LlmProvider}. Wraps `@anthropic-ai/sdk`, hiding its
+ * wire-format details behind the provider-agnostic interface: text completion
+ * via `messages.create` and schema-constrained completion via the native
+ * structured-output path (`messages.parse` + `jsonSchemaOutputFormat`). Model
+ * ids are resolved against the live Models API (see {@link resolveModel}) so a
+ * retired snapshot can't silently 404.
+ */
+import Anthropic from '@anthropic-ai/sdk';
+import { jsonSchemaOutputFormat } from '@anthropic-ai/sdk/helpers/json-schema';
+import { resolveModel } from '../utils/model-resolver.js';
+export class AnthropicProvider {
+    name = 'anthropic';
+    supportsVision = true;
+    client;
+    constructor(opts) {
+        this.client = new Anthropic({ apiKey: opts.apiKey, baseURL: opts.baseURL });
+    }
+    async completeText({ system, prompt, tier, model, maxTokens }) {
+        const resolved = await resolveModel(this.client, tier, model);
+        const message = await this.client.messages.create({
+            model: resolved,
+            max_tokens: maxTokens,
+            ...(system ? { system } : {}),
+            messages: [{ role: 'user', content: prompt }],
+        });
+        const block = message.content[0];
+        return block?.type === 'text' ? block.text : '';
+    }
+    async completeJson({ system, prompt, schema, tier, model, maxTokens, }) {
+        const resolved = await resolveModel(this.client, tier, model);
+        const message = await this.client.messages.parse({
+            model: resolved,
+            max_tokens: maxTokens,
+            ...(system ? { system } : {}),
+            messages: [{ role: 'user', content: prompt }],
+            output_config: {
+                // `schema` is the interface's `Record<string, unknown>`; the helper wants
+                // a stricter JSON-schema type, so cast minimally to keep the public
+                // signature intact.
+                format: jsonSchemaOutputFormat(schema),
+            },
+        });
+        const out = message.parsed_output;
+        if (out == null)
+            throw new Error('Anthropic returned no structured output');
+        return out;
+    }
+}
+//# sourceMappingURL=anthropic-provider.js.map

package/dist/llm/anthropic-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-provider.js","sourceRoot":"","sources":["../../src/llm/anthropic-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,SAAS,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAQ1D,MAAM,OAAO,iBAAiB;IACnB,IAAI,GAAG,WAAW,CAAC;IACnB,cAAc,GAAG,IAAI,CAAC;IACd,MAAM,CAAY;IAEnC,YAAY,IAA8B;QACxC,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAmB;QAC5E,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;SAC9C,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,OAAO,KAAK,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,YAAY,CAAc,EAC9B,MAAM,EACN,MAAM,EACN,MAAM,EACN,IAAI,EACJ,KAAK,EACL,SAAS,GACW;QACpB,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/C,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,SAAS;YACrB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC7C,aAAa,EAAE;gBACb,0EAA0E;gBAC1E,oEAAoE;gBACpE,oBAAoB;gBACpB,MAAM,EAAE,sBAAsB,CAAC,MAAsD,CAAC;aACvF;SACF,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC;QAClC,IAAI,GAAG,IAAI,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC5E,OAAO,GAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/llm/index.d.ts

@@ -0,0 +1,19 @@
+import { type LlmProvider, type ProviderKind } from './types.js';
+export * from './types.js';
+/** Resolve the configured provider kind from `MCPMAKE_LLM_PROVIDER` (default: anthropic). */
+export declare function resolveProviderKind(): ProviderKind;
+/**
+ * Build the active LLM provider from the environment, or return `null` when it
+ * is not usable (missing key, or an `openai-compatible` setup with no base
+ * URL). Optional AI steps treat `null` as "warn and skip", exactly as the old
+ * direct `ANTHROPIC_API_KEY` checks did. Required features should call
+ * {@link requireLlmProvider} instead so they fail with a clear message.
+ */
+export declare function getLlmProvider(): LlmProvider | null;
+/**
+ * Like {@link getLlmProvider} but throws a provider-aware error instead of
+ * returning null — for features that cannot degrade (spec generation, goal
+ * crawl).
+ */
+export declare function requireLlmProvider(feature: string): LlmProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/llm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAkB,MAAM,YAAY,CAAC;AAIjF,cAAc,YAAY,CAAC;AA+C3B,6FAA6F;AAC7F,wBAAgB,mBAAmB,IAAI,YAAY,CAMlD;AAOD;;;;;;GAMG;AACH,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CA8BnD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,CAO/D"}

package/dist/llm/index.js

@@ -0,0 +1,116 @@
+/**
+ * LLM provider selection. Reads the environment and builds the active
+ * {@link LlmProvider}; CLI flags populate that environment (see the CLI's
+ * provider options) so core code never needs a provider parameter threaded
+ * through every call.
+ */
+import { logger } from '../utils/logger.js';
+import { isPrivateOrReservedIp, privateHostsAllowed } from '../utils/ssrf-guard.js';
+import { PROVIDER_KINDS } from './types.js';
+import { AnthropicProvider } from './anthropic-provider.js';
+import { OpenAiProvider } from './openai-provider.js';
+export * from './types.js';
+/**
+ * SSRF guard for a provider base URL. A misconfigured `ANTHROPIC_BASE_URL` /
+ * `OPENAI_BASE_URL` would send the API key to whatever host it names, so reject
+ * non-http(s), malformed, and private/loopback/reserved hosts before the URL
+ * reaches the SDK.
+ *
+ * Provider selection is synchronous (callers expect a sync API), so this does
+ * the literal-IP/protocol checks that {@link assertPublicUrl} performs without
+ * DNS, plus a string match for loopback hostnames (`localhost` and friends) so
+ * the common `http://localhost:…` bypass is closed too. It still cannot resolve
+ * an arbitrary hostname that maps to a private address (no DNS here) — that
+ * residual gap matches {@link assertPublicUrl}'s own TOCTOU note. The
+ * `MCPMAKE_ALLOW_PRIVATE_HOSTS` escape hatch (honored via
+ * {@link privateHostsAllowed}) is what keeps trusted localhost endpoints like
+ * Ollama working; operators must opt in for those.
+ */
+function isLoopbackHostname(host) {
+    const h = host.toLowerCase();
+    return h === 'localhost' || h === 'localhost.localdomain' || h.endsWith('.localhost');
+}
+function assertSafeBaseUrl(envVar, value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`${envVar} is not a valid URL: ${value}`);
+    }
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
+        throw new Error(`${envVar} must be an http(s) URL, got: ${value}`);
+    }
+    if (privateHostsAllowed())
+        return;
+    // Strip IPv6 brackets from the hostname for literal checks.
+    const host = url.hostname.replace(/^\[/, '').replace(/\]$/, '');
+    if (isPrivateOrReservedIp(host) || isLoopbackHostname(host)) {
+        throw new Error(`${envVar} points at private/loopback host ${host}; refusing to send credentials there. ` +
+            `Set MCPMAKE_ALLOW_PRIVATE_HOSTS=1 to allow trusted localhost endpoints (e.g. Ollama).`);
+    }
+}
+/** Resolve the configured provider kind from `MCPMAKE_LLM_PROVIDER` (default: anthropic). */
+export function resolveProviderKind() {
+    const raw = process.env.MCPMAKE_LLM_PROVIDER?.trim().toLowerCase();
+    if (!raw)
+        return 'anthropic';
+    if (PROVIDER_KINDS.includes(raw))
+        return raw;
+    logger.warn(`Unknown MCPMAKE_LLM_PROVIDER "${raw}" — falling back to "anthropic"`);
+    return 'anthropic';
+}
+/** The env var that holds the API key for a given provider kind. */
+function keyVarFor(kind) {
+    return kind === 'anthropic' ? 'ANTHROPIC_API_KEY' : 'OPENAI_API_KEY';
+}
+/**
+ * Build the active LLM provider from the environment, or return `null` when it
+ * is not usable (missing key, or an `openai-compatible` setup with no base
+ * URL). Optional AI steps treat `null` as "warn and skip", exactly as the old
+ * direct `ANTHROPIC_API_KEY` checks did. Required features should call
+ * {@link requireLlmProvider} instead so they fail with a clear message.
+ */
+export function getLlmProvider() {
+    const kind = resolveProviderKind();
+    if (kind === 'anthropic') {
+        const apiKey = process.env.ANTHROPIC_API_KEY?.trim();
+        if (!apiKey)
+            return null;
+        const baseURL = process.env.ANTHROPIC_BASE_URL?.trim() || undefined;
+        if (baseURL)
+            assertSafeBaseUrl('ANTHROPIC_BASE_URL', baseURL);
+        return new AnthropicProvider({ apiKey, baseURL });
+    }
+    // openai / openai-compatible
+    const apiKey = process.env.OPENAI_API_KEY?.trim();
+    const baseURL = process.env.OPENAI_BASE_URL?.trim() || undefined;
+    if (baseURL)
+        assertSafeBaseUrl('OPENAI_BASE_URL', baseURL);
+    if (kind === 'openai') {
+        if (!apiKey)
+            return null;
+        return new OpenAiProvider({ apiKey, baseURL, kind });
+    }
+    // openai-compatible: self-hosted servers (Ollama, vLLM, …) frequently need no
+    // key, but they do need an explicit endpoint.
+    if (!baseURL) {
+        logger.warn('MCPMAKE_LLM_PROVIDER=openai-compatible requires OPENAI_BASE_URL — skipping AI step');
+        return null;
+    }
+    return new OpenAiProvider({ apiKey: apiKey || 'not-needed', baseURL, kind });
+}
+/**
+ * Like {@link getLlmProvider} but throws a provider-aware error instead of
+ * returning null — for features that cannot degrade (spec generation, goal
+ * crawl).
+ */
+export function requireLlmProvider(feature) {
+    const provider = getLlmProvider();
+    if (provider)
+        return provider;
+    const kind = resolveProviderKind();
+    const needs = keyVarFor(kind) + (kind === 'openai-compatible' ? ' and OPENAI_BASE_URL' : '');
+    throw new Error(`${feature} requires an LLM provider. Set ${needs} (active provider: ${kind}).`);
+}
+//# sourceMappingURL=index.js.map

package/dist/llm/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/llm/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACpF,OAAO,EAAuC,cAAc,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,cAAc,YAAY,CAAC;AAE3B;;;;;;;;;;;;;;;GAeG;AACH,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,uBAAuB,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;AACxF,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,KAAa;IACtD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,iCAAiC,KAAK,EAAE,CAAC,CAAC;IACrE,CAAC;IAED,IAAI,mBAAmB,EAAE;QAAE,OAAO;IAElC,4DAA4D;IAC5D,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,oCAAoC,IAAI,wCAAwC;YACvF,uFAAuF,CAC1F,CAAC;IACJ,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnE,IAAI,CAAC,GAAG;QAAE,OAAO,WAAW,CAAC;IAC7B,IAAK,cAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAmB,CAAC;IACpF,MAAM,CAAC,IAAI,CAAC,iCAAiC,GAAG,iCAAiC,CAAC,CAAC;IACnF,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,oEAAoE;AACpE,SAAS,SAAS,CAAC,IAAkB;IACnC,OAAO,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IAEnC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACpE,IAAI,OAAO;YAAE,iBAAiB,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9D,OAAO,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,6BAA6B;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;IACjE,IAAI,OAAO;QAAE,iBAAiB,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;IAE3D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CACT,oFAAoF,CACrF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,MAAM,IAAI,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,kCAAkC,KAAK,sBAAsB,IAAI,IAAI,CAAC,CAAC;AACnG,CAAC"}

package/dist/llm/openai-provider.d.ts

@@ -0,0 +1,46 @@
+import type { CompleteJsonOptions, CompleteOptions, LlmProvider } from './types.js';
+export interface OpenAiProviderOptions {
+    apiKey: string;
+    baseURL?: string;
+    kind: 'openai' | 'openai-compatible';
+}
+export declare class OpenAiProvider implements LlmProvider {
+    readonly name: string;
+    readonly supportsVision = true;
+    private readonly client;
+    private readonly kind;
+    private readonly modelCache;
+    private readonly baseURL;
+    private jsonDowngradeWarned;
+    constructor(opts: OpenAiProviderOptions);
+    /**
+     * Resolve a usable model id for a tier against the live `/v1/models` listing,
+     * so a retired id can never silently 404 the way a hardcoded snapshot does.
+     *
+     * Resolution order:
+     *  1. An explicit `override` (e.g. a `--model` flag) wins, unchecked — the
+     *     caller knows what they want, and a bad id surfaces as a clear API error.
+     *  2. The tier's preferred id, **if** the listing contains it.
+     *  3. Otherwise the newest served model whose id matches the tier pattern.
+     *  4. No match: hosted OpenAI falls back to the preferred id; an
+     *     openai-compatible server falls back to its first listed model (or throws
+     *     if it lists nothing).
+     *  5. Listing throws (server has no `/v1/models`): hosted OpenAI returns the
+     *     preferred id WITHOUT caching (so a later call retries); an
+     *     openai-compatible server throws — there's nothing safe to guess.
+     */
+    private resolveModel;
+    /**
+     * Output-token parameter, keyed by provider kind: newer hosted OpenAI models
+     * reject `max_tokens` and require `max_completion_tokens`, while many
+     * openai-compatible servers only understand the older `max_tokens`.
+     */
+    private tokenParam;
+    /** Build the message list: a leading system message only when `system` is set. */
+    private buildMessages;
+    completeText({ system, prompt, tier, model, maxTokens }: CompleteOptions): Promise<string>;
+    completeJson<T = unknown>({ system, prompt, schema, tier, model, maxTokens, }: CompleteJsonOptions): Promise<T>;
+    /** Warn once when structured output is downgraded, so the loss is visible. */
+    private warnJsonDowngrade;
+}
+//# sourceMappingURL=openai-provider.d.ts.map