@mcpmake/core 0.2.5 → 0.3.1

package/dist/llm/openai-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-provider.d.ts","sourceRoot":"","sources":["../../src/llm/openai-provider.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EAGZ,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,GAAG,mBAAmB,CAAC;CACtC;AAgCD,qBAAa,cAAe,YAAW,WAAW;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,cAAc,QAAQ;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAiC;IAGtD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgC;IAG3D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IAGjC,OAAO,CAAC,mBAAmB,CAAS;gBAExB,IAAI,EAAE,qBAAqB;IAOvC;;;;;;;;;;;;;;;OAeG;YACW,YAAY;IA2D1B;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAQlB,kFAAkF;IAClF,OAAO,CAAC,aAAa;IAOf,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC;IAa1F,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,EAC9B,MAAM,EACN,MAAM,EACN,MAAM,EACN,IAAI,EACJ,KAAK,EACL,SAAS,GACV,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC;IA2EnC,8EAA8E;IAC9E,OAAO,CAAC,iBAAiB;CAO1B"}

package/dist/llm/openai-provider.js

@@ -0,0 +1,245 @@
+/**
+ * OpenAI-family provider. One class serves BOTH:
+ *  - `openai`            — the hosted api.openai.com endpoint, and
+ *  - `openai-compatible` — any self-hosted server speaking the OpenAI wire
+ *                          format (Ollama, vLLM, LM Studio, Groq, Together, …).
+ *
+ * The two differ in three places, all handled here:
+ *  1. Model resolution against `/v1/models` — hosted OpenAI always lists models,
+ *     compatible servers may not implement the endpoint at all.
+ *  2. The output-token parameter name (`max_completion_tokens` vs `max_tokens`).
+ *  3. Structured-output support (`response_format: json_schema`), which many
+ *     compatible servers don't honor — so `completeJson` degrades gracefully.
+ */
+import OpenAI from 'openai';
+import { extractJsonObject } from '../utils/json-extract.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Preferred (undated) model id per tier. Model ids rot — a whole family can be
+ * retired and a hardcoded snapshot then silently 404s — so the preferred id is
+ * only trusted when the live `/v1/models` listing confirms it (mirrors the
+ * Anthropic resolver in {@link ../utils/model-resolver}).
+ */
+const PREFERRED = {
+    balanced: 'gpt-4o',
+    fast: 'gpt-4o-mini',
+};
+const TIER_PATTERN = {
+    balanced: /gpt-(5|4\.1|4o|4)/i,
+    fast: /mini|nano|small|flash|haiku/i,
+};
+/**
+ * True only for an HTTP 400 from the OpenAI SDK — the signal that a server or
+ * model rejects a *request format* (e.g. an unsupported `response_format`),
+ * which the `completeJson` fallback chain may legitimately downgrade past.
+ *
+ * Every other error (401 auth, 429 rate limit, 5xx, network/connection) is a
+ * hard failure that retrying with a weaker request mode will not fix, so those
+ * must propagate untouched instead of being masked as "unparseable JSON". The
+ * SDK exposes the HTTP status as `err.status` on its error objects.
+ */
+function isFormatError(err) {
+    return err?.status === 400;
+}
+export class OpenAiProvider {
+    name;
+    supportsVision = true;
+    client;
+    kind;
+    // Resolved once per tier per process: the served-model list rarely changes
+    // mid-run, and we don't want a Models API round-trip before every call.
+    modelCache = new Map();
+    // The endpoint we talk to, used in error messages so a misconfigured
+    // openai-compatible server is obvious from the thrown error alone.
+    baseURL;
+    // Whether we've already warned about a structured-output downgrade. Warning
+    // once per process keeps the log readable when many JSON calls degrade.
+    jsonDowngradeWarned = false;
+    constructor(opts) {
+        this.kind = opts.kind;
+        this.name = opts.kind;
+        this.baseURL = opts.baseURL ?? 'https://api.openai.com/v1';
+        this.client = new OpenAI({ apiKey: opts.apiKey, baseURL: opts.baseURL });
+    }
+    /**
+     * Resolve a usable model id for a tier against the live `/v1/models` listing,
+     * so a retired id can never silently 404 the way a hardcoded snapshot does.
+     *
+     * Resolution order:
+     *  1. An explicit `override` (e.g. a `--model` flag) wins, unchecked — the
+     *     caller knows what they want, and a bad id surfaces as a clear API error.
+     *  2. The tier's preferred id, **if** the listing contains it.
+     *  3. Otherwise the newest served model whose id matches the tier pattern.
+     *  4. No match: hosted OpenAI falls back to the preferred id; an
+     *     openai-compatible server falls back to its first listed model (or throws
+     *     if it lists nothing).
+     *  5. Listing throws (server has no `/v1/models`): hosted OpenAI returns the
+     *     preferred id WITHOUT caching (so a later call retries); an
+     *     openai-compatible server throws — there's nothing safe to guess.
+     */
+    async resolveModel(tier, override) {
+        if (override)
+            return override;
+        const cached = this.modelCache.get(tier);
+        if (cached)
+            return cached;
+        const preferred = PREFERRED[tier];
+        let choice;
+        let models;
+        try {
+            const page = await this.client.models.list();
+            models = page.data;
+        }
+        catch (err) {
+            // Transient or unimplemented Models API.
+            if (this.kind === 'openai') {
+                // Return the fallback for this call WITHOUT caching it, so a later call
+                // retries once the API recovers (a poisoned cache would pin the whole
+                // process to the fallback id).
+                logger.warn(`Could not list models (${err instanceof Error ? err.message : err}); using "${preferred}"`);
+                return preferred;
+            }
+            throw new Error('Could not list models; pass --model for openai-compatible providers');
+        }
+        if (models.some((m) => m.id === preferred)) {
+            choice = preferred;
+        }
+        else {
+            const pattern = TIER_PATTERN[tier];
+            const newest = models
+                .filter((m) => pattern.test(m.id))
+                // `created` is an epoch number (seconds); missing values sort oldest.
+                .sort((a, b) => (b.created ?? 0) - (a.created ?? 0))[0];
+            if (newest) {
+                logger.warn(`Preferred model "${preferred}" unavailable; using "${newest.id}"`);
+                choice = newest.id;
+            }
+            else if (this.kind === 'openai') {
+                logger.warn(`Preferred model "${preferred}" unavailable and no ${tier} model found; trying it anyway`);
+                choice = preferred;
+            }
+            else if (models[0]) {
+                // openai-compatible: no tiered match, but the server lists *something* —
+                // use the first model rather than guessing an OpenAI id it won't have.
+                logger.warn(`No ${tier} model matched on ${this.baseURL}; using "${models[0].id}"`);
+                choice = models[0].id;
+            }
+            else {
+                throw new Error(`No model available from ${this.baseURL}; pass --model`);
+            }
+        }
+        // Only successful resolutions are cached.
+        this.modelCache.set(tier, choice);
+        return choice;
+    }
+    /**
+     * Output-token parameter, keyed by provider kind: newer hosted OpenAI models
+     * reject `max_tokens` and require `max_completion_tokens`, while many
+     * openai-compatible servers only understand the older `max_tokens`.
+     */
+    tokenParam(maxTokens) {
+        return this.kind === 'openai'
+            ? { max_completion_tokens: maxTokens }
+            : { max_tokens: maxTokens };
+    }
+    /** Build the message list: a leading system message only when `system` is set. */
+    buildMessages(prompt, system) {
+        const messages = [];
+        if (system)
+            messages.push({ role: 'system', content: system });
+        messages.push({ role: 'user', content: prompt });
+        return messages;
+    }
+    async completeText({ system, prompt, tier, model, maxTokens }) {
+        const resolved = await this.resolveModel(tier, model);
+        const messages = this.buildMessages(prompt, system);
+        const res = await this.client.chat.completions.create({
+            model: resolved,
+            messages,
+            ...this.tokenParam(maxTokens),
+        });
+        return res.choices[0]?.message?.content ?? '';
+    }
+    async completeJson({ system, prompt, schema, tier, model, maxTokens, }) {
+        const resolved = await this.resolveModel(tier, model);
+        const tokenParam = this.tokenParam(maxTokens);
+        // Nudge appended to the prompt for the non-native fallbacks, so the model
+        // still aims at the schema even without enforced structured output.
+        const schemaNudge = `Respond with JSON only that conforms to this JSON Schema:\n${JSON.stringify(schema)}`;
+        // 1) Native structured output (`json_schema`). Best fidelity when supported.
+        let content;
+        try {
+            const res = await this.client.chat.completions.create({
+                model: resolved,
+                messages: this.buildMessages(prompt, system),
+                response_format: {
+                    type: 'json_schema',
+                    json_schema: { name: 'response', strict: true, schema },
+                },
+                ...tokenParam,
+            });
+            content = res.choices[0]?.message?.content ?? '';
+        }
+        catch (err) {
+            // Only an HTTP 400 means "this server/model rejects the structured-output
+            // *format*" — that is the one error we downgrade past. A hard error (401
+            // auth, 429 rate limit, 5xx, network) is not fixed by retrying with a
+            // weaker request mode, so rethrow it rather than masking it behind a later
+            // "unparseable JSON". (See how the SDK surfaces `status` on its errors.)
+            if (!isFormatError(err))
+                throw err;
+            this.warnJsonDowngrade();
+            try {
+                // 2) `json_object` mode + schema-in-prompt: forces valid JSON without
+                //    enforcing the schema, which most compatible servers support.
+                const messages = this.buildMessages(prompt, system);
+                messages.push({ role: 'user', content: schemaNudge });
+                const res = await this.client.chat.completions.create({
+                    model: resolved,
+                    messages,
+                    response_format: { type: 'json_object' },
+                    ...tokenParam,
+                });
+                content = res.choices[0]?.message?.content ?? '';
+            }
+            catch (err2) {
+                // Same rule one tier down: only a 400 (server rejects `response_format`)
+                // justifies the final plain-completion attempt; anything else rethrows.
+                if (!isFormatError(err2))
+                    throw err2;
+                // 3) Plain completion + schema-in-prompt: last resort for servers that
+                //    reject `response_format` entirely. Rely on the JSON extractor.
+                const messages = this.buildMessages(prompt, system);
+                messages.push({ role: 'user', content: schemaNudge });
+                const res = await this.client.chat.completions.create({
+                    model: resolved,
+                    messages,
+                    ...tokenParam,
+                });
+                content = res.choices[0]?.message?.content ?? '';
+            }
+        }
+        const json = extractJsonObject(content);
+        if (json === null)
+            throw new Error('OpenAI provider returned unparseable JSON');
+        let parsed;
+        try {
+            parsed = JSON.parse(json);
+        }
+        catch {
+            throw new Error('OpenAI provider returned unparseable JSON');
+        }
+        if (typeof parsed !== 'object' || parsed === null) {
+            throw new Error('OpenAI provider returned unparseable JSON');
+        }
+        return parsed;
+    }
+    /** Warn once when structured output is downgraded, so the loss is visible. */
+    warnJsonDowngrade() {
+        if (this.jsonDowngradeWarned)
+            return;
+        this.jsonDowngradeWarned = true;
+        logger.warn(`${this.name}: native JSON-schema output not supported on ${this.baseURL}; falling back to best-effort JSON parsing`);
+    }
+}
+//# sourceMappingURL=openai-provider.js.map

package/dist/llm/openai-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-provider.js","sourceRoot":"","sources":["../../src/llm/openai-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAe5C;;;;;GAKG;AACH,MAAM,SAAS,GAA8B;IAC3C,QAAQ,EAAE,QAAQ;IAClB,IAAI,EAAE,aAAa;CACpB,CAAC;AAEF,MAAM,YAAY,GAA8B;IAC9C,QAAQ,EAAE,oBAAoB;IAC9B,IAAI,EAAE,8BAA8B;CACrC,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,GAAY;IACjC,OAAQ,GAA8C,EAAE,MAAM,KAAK,GAAG,CAAC;AACzE,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,IAAI,CAAS;IACb,cAAc,GAAG,IAAI,CAAC;IACd,MAAM,CAAS;IACf,IAAI,CAAiC;IACtD,2EAA2E;IAC3E,wEAAwE;IACvD,UAAU,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3D,qEAAqE;IACrE,mEAAmE;IAClD,OAAO,CAAS;IACjC,4EAA4E;IAC5E,wEAAwE;IAChE,mBAAmB,GAAG,KAAK,CAAC;IAEpC,YAAY,IAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,2BAA2B,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACK,KAAK,CAAC,YAAY,CAAC,IAAe,EAAE,QAAiB;QAC3D,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAE1B,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,MAAc,CAAC;QAEnB,IAAI,MAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,yCAAyC;YACzC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC3B,wEAAwE;gBACxE,sEAAsE;gBACtE,+BAA+B;gBAC/B,MAAM,CAAC,IAAI,CACT,0BAA0B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,aAAa,SAAS,GAAG,CAC5F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACzF,CAAC;QAED,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,EAAE,CAAC;YAC3C,MAAM,GAAG,SAAS,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM;iBAClB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAClC,sEAAsE;iBACrE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1D,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,IAAI,CAAC,oBAAoB,SAAS,yBAAyB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChF,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;YACrB,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,oBAAoB,SAAS,wBAAwB,IAAI,gCAAgC,CAC1F,CAAC;gBACF,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;iBAAM,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrB,yEAAyE;gBACzE,uEAAuE;gBACvE,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,qBAAqB,IAAI,CAAC,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBACpF,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACxB,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,OAAO,gBAAgB,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;QAED,0CAA0C;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,UAAU,CAChB,SAAiB;QAEjB,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC3B,CAAC,CAAC,EAAE,qBAAqB,EAAE,SAAS,EAAE;YACtC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,kFAAkF;IAC1E,aAAa,CAAC,MAAc,EAAE,MAAe;QACnD,MAAM,QAAQ,GAAiC,EAAE,CAAC;QAClD,IAAI,MAAM;YAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAmB;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAEpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;YACpD,KAAK,EAAE,QAAQ;YACf,QAAQ;YACR,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;SAC9B,CAAC,CAAC;QAEH,OAAO,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,YAAY,CAAc,EAC9B,MAAM,EACN,MAAM,EACN,MAAM,EACN,IAAI,EACJ,KAAK,EACL,SAAS,GACW;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAE9C,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,WAAW,GAAG,8DAA8D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAE3G,6EAA6E;QAC7E,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;gBACpD,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC;gBAC5C,eAAe,EAAE;oBACf,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;iBACxD;gBACD,GAAG,UAAU;aACd,CAAC,CAAC;YACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,yEAAyE;YACzE,sEAAsE;YACtE,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YACnC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,sEAAsE;gBACtE,kEAAkE;gBAClE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACpD,KAAK,EAAE,QAAQ;oBACf,QAAQ;oBACR,eAAe,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE;oBACxC,GAAG,UAAU;iBACd,CAAC,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACnD,CAAC;YAAC,OAAO,IAAI,EAAE,CAAC;gBACd,yEAAyE;gBACzE,wEAAwE;gBACxE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC;gBACrC,uEAAuE;gBACvE,oEAAoE;gBACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACpD,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;gBACtD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC;oBACpD,KAAK,EAAE,QAAQ;oBACf,QAAQ;oBACR,GAAG,UAAU;iBACd,CAAC,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;YACnD,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,IAAI,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAEhF,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO,MAAW,CAAC;IACrB,CAAC;IAED,8EAA8E;IACtE,iBAAiB;QACvB,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO;QACrC,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,IAAI,gDAAgD,IAAI,CAAC,OAAO,4CAA4C,CACrH,CAAC;IACJ,CAAC;CACF"}

package/dist/llm/types.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Provider-agnostic LLM abstraction.
+ *
+ * The CLI's AI features (spec generation, tool naming, semantic naming,
+ * goal-directed crawl, selector healing) used to call `@anthropic-ai/sdk`
+ * directly. They now go through an {@link LlmProvider} so the same features can
+ * run against Claude, OpenAI/ChatGPT, or any OpenAI-compatible endpoint
+ * (Ollama, vLLM, LM Studio, Groq, Together, OpenRouter, …).
+ *
+ * The active provider is selected by environment (see `getLlmProvider`):
+ * `MCPMAKE_LLM_PROVIDER` + the matching key/base-url vars. Anthropic stays the
+ * default so existing setups are unaffected.
+ */
+/** Model tiers used across the generator. */
+export type ModelTier = 'balanced' | 'fast';
+/** Which backend the active provider talks to. */
+export type ProviderKind = 'anthropic' | 'openai' | 'openai-compatible';
+/** All supported provider kinds, for validation + help text. */
+export declare const PROVIDER_KINDS: readonly ProviderKind[];
+/** A single completion request. */
+export interface CompleteOptions {
+    /** Optional system instruction. */
+    system?: string;
+    /** User prompt. */
+    prompt: string;
+    /** Tier resolved to a concrete model when `model` is not given. */
+    tier: ModelTier;
+    /** Explicit model id — wins over tier resolution, passed through unchecked. */
+    model?: string;
+    /** Hard cap on output tokens. */
+    maxTokens: number;
+}
+/** A completion request constrained to a JSON Schema. */
+export interface CompleteJsonOptions extends CompleteOptions {
+    /** JSON Schema the response must satisfy (flat/non-recursive for native modes). */
+    schema: Record<string, unknown>;
+}
+/**
+ * One LLM backend. Implementations hide SDK + wire-format differences:
+ * structured output (Anthropic `messages.parse` vs OpenAI `response_format`),
+ * model resolution (live model listing per provider), and text completion.
+ */
+export interface LlmProvider {
+    /** Human-readable provider id, e.g. `anthropic` / `openai` / `openai-compatible`. */
+    readonly name: string;
+    /** Whether this provider/model class can accept image inputs (future use). */
+    readonly supportsVision: boolean;
+    /**
+     * Plain text completion. Returns the model's raw text (callers that want JSON
+     * run it through `utils/json-extract`). Throws on transport/API failure.
+     */
+    completeText(options: CompleteOptions): Promise<string>;
+    /**
+     * Schema-constrained completion returning the parsed object. Uses the
+     * provider's native structured-output mode when available, otherwise falls
+     * back to a text completion parsed with the shared JSON extractor. Throws if
+     * the response cannot be parsed into an object.
+     */
+    completeJson<T = unknown>(options: CompleteJsonOptions): Promise<T>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/llm/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/llm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,6CAA6C;AAC7C,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE5C,kDAAkD;AAClD,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,QAAQ,GAAG,mBAAmB,CAAC;AAExE,gEAAgE;AAChE,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAAiD,CAAC;AAEpG,mCAAmC;AACnC,MAAM,WAAW,eAAe;IAC9B,mCAAmC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mBAAmB;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,IAAI,EAAE,SAAS,CAAC;IAChB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAoB,SAAQ,eAAe;IAC1D,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,WAAW;IAC1B,qFAAqF;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8EAA8E;IAC9E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IAEjC;;;OAGG;IACH,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAExD;;;;;OAKG;IACH,YAAY,CAAC,CAAC,GAAG,OAAO,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACrE"}

package/dist/llm/types.js

@@ -0,0 +1,16 @@
+/**
+ * Provider-agnostic LLM abstraction.
+ *
+ * The CLI's AI features (spec generation, tool naming, semantic naming,
+ * goal-directed crawl, selector healing) used to call `@anthropic-ai/sdk`
+ * directly. They now go through an {@link LlmProvider} so the same features can
+ * run against Claude, OpenAI/ChatGPT, or any OpenAI-compatible endpoint
+ * (Ollama, vLLM, LM Studio, Groq, Together, OpenRouter, …).
+ *
+ * The active provider is selected by environment (see `getLlmProvider`):
+ * `MCPMAKE_LLM_PROVIDER` + the matching key/base-url vars. Anthropic stays the
+ * default so existing setups are unaffected.
+ */
+/** All supported provider kinds, for validation + help text. */
+export const PROVIDER_KINDS = ['anthropic', 'openai', 'openai-compatible'];
+//# sourceMappingURL=types.js.map

package/dist/llm/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/llm/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,gEAAgE;AAChE,MAAM,CAAC,MAAM,cAAc,GAA4B,CAAC,WAAW,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC"}

package/dist/parser/har-filter.d.ts

@@ -1,4 +1,11 @@
 import type { Entry } from 'har-format';
+/**
+ * Scrub credentials out of a HAR entry in place: Authorization/Cookie/API-key
+ * request & response headers, and the parsed request/response cookie arrays.
+ * Recorded HAR is persisted to disk, so this prevents live secrets leaking in
+ * cleartext. Safe to call more than once (redaction is idempotent).
+ */
+export declare function redactEntrySecrets(entry: Entry): Entry;
 export interface FilterOptions {
     /** Only include entries from these domains. If empty, include all. */
     allowedDomains?: string[];

package/dist/parser/har-filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"har-filter.d.ts","sourceRoot":"","sources":["../../src/parser/har-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAiCxC,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK,EAAE,CA4CvF"}
+{"version":3,"file":"har-filter.d.ts","sourceRoot":"","sources":["../../src/parser/har-filter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAU,KAAK,EAAU,MAAM,YAAY,CAAC;AA6FxD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,CAMtD;AAiCD,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,sEAAsE;IACtE,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,OAAO,GAAE,aAAkB,GAAG,KAAK,EAAE,CAgDvF"}

package/dist/parser/har-filter.js

@@ -1,3 +1,105 @@
+const REDACTED = '<redacted>';
+/**
+ * Headers whose value is a credential and must be scrubbed from recorded HAR.
+ * We keep the header NAME (and, for Authorization, the scheme word) so auth
+ * detection downstream still works, but strip the secret material.
+ */
+const SENSITIVE_HEADERS = new Set([
+    'authorization',
+    'proxy-authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'api-key',
+    'apikey',
+    'authorization-token',
+    'x-auth-token',
+    'x-access-token',
+    'x-session-token',
+    'x-csrf-token',
+    'x-amz-security-token',
+    'x-goog-api-key',
+]);
+// Authorization values are `<scheme> <credential>`; keep the scheme so
+// downstream auth detection can still classify bearer/basic/token.
+const AUTH_SCHEME_PATTERN = /^(\s*[A-Za-z][\w-]*\s+)\S[\s\S]*$/;
+/**
+ * Redact the secret value of a single header in place, preserving the header
+ * name (and the auth scheme word for Authorization-style headers) so auth
+ * detection still sees a scheme exists.
+ */
+function redactHeaderValue(name, value) {
+    const lower = name.toLowerCase();
+    if (lower === 'cookie')
+        return redactCookiePairs(value);
+    if (lower === 'set-cookie')
+        return redactSetCookie(value);
+    if (lower === 'authorization' || lower === 'proxy-authorization') {
+        const m = AUTH_SCHEME_PATTERN.exec(value);
+        if (m)
+            return `${m[1].trimStart()}${REDACTED}`;
+    }
+    return REDACTED;
+}
+/** Replace a single `name[=value]` segment's value with the redaction marker. */
+function redactPairValue(pair) {
+    const eq = pair.indexOf('=');
+    if (eq === -1)
+        return pair; // attribute flag (e.g. `Secure`) — no value.
+    return `${pair.slice(0, eq)}=${REDACTED}`;
+}
+/**
+ * Cookie request header: every `;`-separated segment is a `name=value` cookie.
+ * `s=Y; foo=bar` becomes `s=<redacted>; foo=<redacted>` (names kept).
+ */
+function redactCookiePairs(value) {
+    return value
+        .split(';')
+        .map((part) => part.replace(/^(\s*)(.*)$/, (_, ws, body) => ws + redactPairValue(body)))
+        .join(';');
+}
+/**
+ * Set-Cookie response header: only the FIRST segment is the cookie `name=value`;
+ * the rest (Path, Domain, Expires, Secure, ...) are attributes carrying no
+ * secret, so they are preserved verbatim to keep the HAR shape intact.
+ */
+function redactSetCookie(value) {
+    const semi = value.indexOf(';');
+    if (semi === -1)
+        return redactCookiePairs(value);
+    const head = value.slice(0, semi);
+    const rest = value.slice(semi); // includes leading ';'
+    return redactCookiePairs(head) + rest;
+}
+function redactHeaders(headers) {
+    if (!headers)
+        return;
+    for (const header of headers) {
+        if (SENSITIVE_HEADERS.has(header.name.toLowerCase())) {
+            header.value = redactHeaderValue(header.name, header.value);
+        }
+    }
+}
+function redactCookies(cookies) {
+    if (!cookies)
+        return;
+    for (const cookie of cookies) {
+        cookie.value = REDACTED;
+    }
+}
+/**
+ * Scrub credentials out of a HAR entry in place: Authorization/Cookie/API-key
+ * request & response headers, and the parsed request/response cookie arrays.
+ * Recorded HAR is persisted to disk, so this prevents live secrets leaking in
+ * cleartext. Safe to call more than once (redaction is idempotent).
+ */
+export function redactEntrySecrets(entry) {
+    redactHeaders(entry.request?.headers);
+    redactHeaders(entry.response?.headers);
+    redactCookies(entry.request?.cookies);
+    redactCookies(entry.response?.cookies);
+    return entry;
+}
 const NOISE_EXTENSIONS = /\.(js|css|png|jpg|jpeg|gif|svg|ico|woff|woff2|ttf|eot|map|webp|avif)(\?|$)/i;
 const ANALYTICS_DOMAINS = [
     'google-analytics.com',
@@ -26,7 +128,7 @@ const SKIP_MIME_TYPES = [
     'video/',
 ];
 export function filterHarEntries(entries, options = {}) {
-    return entries.filter((entry) => {
+    const kept = entries.filter((entry) => {
         const url = entry.request.url;
         let hostname;
         try {
@@ -68,5 +170,9 @@ export function filterHarEntries(entries, options = {}) {
         }
         return true;
     });
+    // Scrub credentials before the HAR (or anything derived from it) is persisted.
+    for (const entry of kept)
+        redactEntrySecrets(entry);
+    return kept;
 }
 //# sourceMappingURL=har-filter.js.map

package/dist/parser/har-filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"har-filter.js","sourceRoot":"","sources":["../../src/parser/har-filter.ts"],"names":[],"mappings":"AAEA,MAAM,gBAAgB,GACpB,6EAA6E,CAAC;AAEhF,MAAM,iBAAiB,GAAG;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,WAAW;IACX,cAAc;IACd,eAAe;IACf,YAAY;CACb,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,UAAU;IACV,wBAAwB;IACxB,iBAAiB;IACjB,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AASF,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,UAAyB,EAAE;IAC5E,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE/D,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,kCAAkC;QAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtE,mBAAmB;QACnB,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAEzE,yCAAyC;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5D,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,2EAA2E;YAC3E,wCAAwC;YACxC,IAAI,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"har-filter.js","sourceRoot":"","sources":["../../src/parser/har-filter.ts"],"names":[],"mappings":"AAEA,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,eAAe;IACf,qBAAqB;IACrB,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,SAAS;IACT,QAAQ;IACR,qBAAqB;IACrB,cAAc;IACd,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAC;AAEH,uEAAuE;AACvE,mEAAmE;AACnE,MAAM,mBAAmB,GAAG,mCAAmC,CAAC;AAEhE;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACxD,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,eAAe,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,KAAK,KAAK,eAAe,IAAI,KAAK,KAAK,qBAAqB,EAAE,CAAC;QACjE,MAAM,CAAC,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,iFAAiF;AACjF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IACzE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;SACvF,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAa;IACpC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,uBAAuB;IACvD,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,OAA6B;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACrD,MAAM,CAAC,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAA6B;IAClD,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,KAAK,GAAG,QAAQ,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAY;IAC7C,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GACpB,6EAA6E,CAAC;AAEhF,MAAM,iBAAiB,GAAG;IACxB,sBAAsB;IACtB,sBAAsB;IACtB,YAAY;IACZ,cAAc;IACd,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,iBAAiB;IACjB,cAAc;IACd,WAAW;IACX,WAAW;IACX,cAAc;IACd,eAAe;IACf,YAAY;CACb,CAAC;AAEF,MAAM,eAAe,GAAG;IACtB,WAAW;IACX,UAAU;IACV,wBAAwB;IACxB,iBAAiB;IACjB,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AASF,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,UAAyB,EAAE;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9B,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAE/D,kCAAkC;QAClC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QACvC,IAAI,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAElD,kCAAkC;QAClC,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAEtE,mBAAmB;QACnB,IAAI,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC9E,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;YAAE,OAAO,KAAK,CAAC;QAEzE,yCAAyC;QACzC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,IAAI,EAAE,CAAC;QAC5D,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,2EAA2E;YAC3E,wCAAwC;YACxC,IAAI,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3F,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACpE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,+EAA+E;IAC/E,KAAK,MAAM,KAAK,IAAI,IAAI;QAAE,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/parser/index.d.ts

@@ -4,7 +4,7 @@ export { extractOperations } from './operation-extractor.js';
 export type { ExtractionResult } from './operation-extractor.js';
 export { jsonSchemaToZodCode, buildOperationInputSchema } from './schema-converter.js';
 export { loadHarFile } from './har-loader.js';
-export { filterHarEntries } from './har-filter.js';
+export { filterHarEntries, redactEntrySecrets } from './har-filter.js';
 export type { FilterOptions } from './har-filter.js';
 export { normalizeEntry } from './har-normalizer.js';
 export type { NormalizedEntry, PathParam, QueryParam } from './har-normalizer.js';

package/dist/parser/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/parser/index.js

@@ -2,6 +2,6 @@ export { loadOpenApiSpec } from './openapi-loader.js';
 export { extractOperations } from './operation-extractor.js';
 export { jsonSchemaToZodCode, buildOperationInputSchema } from './schema-converter.js';
 export { loadHarFile } from './har-loader.js';
-export { filterHarEntries } from './har-filter.js';
+export { filterHarEntries, redactEntrySecrets } from './har-filter.js';
 export { normalizeEntry } from './har-normalizer.js';
 //# sourceMappingURL=index.js.map

package/dist/parser/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/parser/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,OAAO,EAAE,mBAAmB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEvE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/parser/openapi-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi-loader.d.ts","sourceRoot":"","sources":["../../src/parser/openapi-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAG7C,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AA0VD,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAcxE"}
+{"version":3,"file":"openapi-loader.d.ts","sourceRoot":"","sources":["../../src/parser/openapi-loader.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAI7C,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAyXD,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBxE"}

package/dist/parser/openapi-loader.js

@@ -1,5 +1,34 @@
 import SwaggerParser from '@apidevtools/swagger-parser';
 import { logger } from '../utils/logger.js';
+import { assertPublicUrl } from '../utils/ssrf-guard.js';
+function isHttpUrl(input) {
+    return /^https?:\/\//i.test(input.trim());
+}
+/**
+ * Parser options that route every remote `$ref` fetch through the SSRF guard.
+ *
+ * The custom `read` runs before any download, so each remote ref URL is rejected
+ * if it resolves to a private/reserved host. Redirects are not followed
+ * (`redirect: 'error'`): a 3xx to an unvetted host (e.g. the metadata endpoint)
+ * surfaces as an error instead of an unguarded fetch.
+ */
+const guardedHttpResolver = {
+    order: 200,
+    canRead(file) {
+        return /^https?:\/\//i.test(file.url);
+    },
+    async read(file) {
+        await assertPublicUrl(file.url);
+        const res = await fetch(file.url, { redirect: 'error' });
+        if (!res.ok) {
+            throw new Error(`Error downloading ${file.url}: HTTP ${res.status}`);
+        }
+        return Buffer.from(await res.arrayBuffer());
+    },
+};
+const guardedParserOptions = {
+    resolve: { http: guardedHttpResolver },
+};
 /**
  * Detects if a parsed document is Swagger 2.0 and converts it to OpenAPI 3.0.
  */
@@ -297,13 +326,18 @@ function convertSchemaRef(schema) {
     return result;
 }
 export async function loadOpenApiSpec(input) {
+    // SSRF guard: vet a remote top-level spec URL before any fetch. Remote `$ref`s
+    // are vetted per-URL by the guarded http resolver in guardedParserOptions.
+    if (isHttpUrl(input)) {
+        await assertPublicUrl(input);
+    }
     // First, parse without dereferencing to check for Swagger 2.0
-    const raw = (await SwaggerParser.parse(input));
+    const raw = (await SwaggerParser.parse(input, guardedParserOptions));
     let specToParse = input;
     if (isSwagger2(raw)) {
         specToParse = convertSwagger2ToOpenApi3(raw);
     }
-    const api = (await SwaggerParser.dereference(specToParse));
+    const api = (await SwaggerParser.dereference(specToParse, guardedParserOptions));
     return { api, specPath: input };
 }
 //# sourceMappingURL=openapi-loader.js.map