@powerduck/openapi-mcp-server 1.0.0

package/dist/index.cjs

@@ -0,0 +1,3697 @@
+#!/usr/bin/env node
+'use strict';
+
+var fs2 = require('fs');
+var jsYaml = require('js-yaml');
+var openapiParser = require('@scalar/openapi-parser');
+var types_js = require('@modelcontextprotocol/sdk/types.js');
+var axios = require('axios');
+var crypto = require('crypto');
+var index_js = require('@modelcontextprotocol/sdk/server/index.js');
+var stdio_js = require('@modelcontextprotocol/sdk/server/stdio.js');
+var express2 = require('express');
+var sse_js = require('@modelcontextprotocol/sdk/server/sse.js');
+var streamableHttp_js = require('@modelcontextprotocol/sdk/server/streamableHttp.js');
+var cors = require('cors');
+var multer = require('multer');
+var path = require('path');
+var http = require('http');
+var url = require('url');
+var os = require('os');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var fs2__default = /*#__PURE__*/_interopDefault(fs2);
+var axios__default = /*#__PURE__*/_interopDefault(axios);
+var express2__default = /*#__PURE__*/_interopDefault(express2);
+var cors__default = /*#__PURE__*/_interopDefault(cors);
+var multer__default = /*#__PURE__*/_interopDefault(multer);
+var path__default = /*#__PURE__*/_interopDefault(path);
+var os__default = /*#__PURE__*/_interopDefault(os);
+
+// node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/core/spec-utils.ts
+var HTTP_METHODS = [
+  "get",
+  "put",
+  "post",
+  "delete",
+  "options",
+  "head",
+  "patch",
+  "trace",
+  "query"
+];
+var HTTP_METHOD_SET = new Set(HTTP_METHODS);
+var PATH_ITEM_METADATA_KEYS = /* @__PURE__ */ new Set([
+  "$ref",
+  "summary",
+  "description",
+  "servers",
+  "parameters",
+  "additionalOperations"
+]);
+var PARAMETER_LOCATIONS = [
+  "path",
+  "query",
+  "header",
+  "cookie"
+];
+var PARAMETER_LOCATION_SET = new Set(
+  PARAMETER_LOCATIONS
+);
+var KNOWN_UNSUPPORTED_LOCATIONS = /* @__PURE__ */ new Set([
+  "querystring"
+]);
+var RESERVED_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "accept",
+  "content-type",
+  "authorization",
+  "host",
+  "content-length",
+  "connection",
+  "transfer-encoding"
+]);
+var MAX_GENERATED_NAME_LENGTH = 64;
+function report(sink, issue) {
+  sink?.push(issue);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isReference(value) {
+  return isPlainObject(value) && typeof value.$ref === "string";
+}
+function stableDigest(input) {
+  let hash = 2166136261;
+  for (let index = 0; index < input.length; index += 1) {
+    hash ^= input.charCodeAt(index);
+    hash = Math.imul(hash, 16777619) >>> 0;
+  }
+  return hash.toString(36).padStart(7, "0").slice(0, 7);
+}
+function truncateGeneratedName(name, limit = MAX_GENERATED_NAME_LENGTH) {
+  if (name.length <= limit) return name;
+  const digest = stableDigest(name);
+  const keep = Math.max(1, limit - digest.length - 1);
+  return `${name.slice(0, keep).replace(/_+$/, "")}_${digest}`;
+}
+function extractPathTemplateVariables(pathTemplate) {
+  const found = /* @__PURE__ */ new Set();
+  const pattern = /\{([^{}/]+)\}/g;
+  let match;
+  while ((match = pattern.exec(pathTemplate)) !== null) {
+    const name = match[1]?.trim();
+    if (name) found.add(name);
+  }
+  return [...found];
+}
+function selectContentMediaType(content) {
+  const keys = Object.keys(content);
+  if (keys.length === 0) return void 0;
+  const json = keys.find((key) => /\bjson\b/i.test(key));
+  return json ?? keys[0];
+}
+function normalizeParameter(candidate) {
+  if (!isPlainObject(candidate)) return null;
+  if (isReference(candidate)) return null;
+  const name = candidate.name;
+  const location = candidate.in;
+  if (typeof name !== "string" || name.trim().length === 0) return null;
+  if (typeof location !== "string") return null;
+  if (!PARAMETER_LOCATION_SET.has(location)) return null;
+  const hasSchema = isPlainObject(candidate.schema);
+  const hasContent = isPlainObject(candidate.content) && Object.keys(candidate.content).length > 0;
+  if (hasSchema && hasContent) return null;
+  const trimmedName = name.trim();
+  const required = location === "path" ? true : candidate.required === true;
+  const normalized = {
+    name: trimmedName,
+    in: location,
+    required,
+    raw: candidate
+  };
+  if (location === "header" && RESERVED_HEADER_NAMES.has(trimmedName.toLowerCase())) {
+    normalized.reserved = true;
+  }
+  if (typeof candidate.description === "string") {
+    normalized.description = candidate.description;
+  }
+  if (typeof candidate.deprecated === "boolean") {
+    normalized.deprecated = candidate.deprecated;
+  }
+  if (typeof candidate.style === "string") normalized.style = candidate.style;
+  if (typeof candidate.explode === "boolean") {
+    normalized.explode = candidate.explode;
+  }
+  if (typeof candidate.allowReserved === "boolean") {
+    normalized.allowReserved = candidate.allowReserved;
+  }
+  if (typeof candidate.allowEmptyValue === "boolean") {
+    normalized.allowEmptyValue = candidate.allowEmptyValue;
+  }
+  if (hasSchema) {
+    normalized.schema = candidate.schema;
+  }
+  if (hasContent) {
+    const content = candidate.content;
+    normalized.content = content;
+    const mediaType = selectContentMediaType(content);
+    if (mediaType) normalized.contentMediaType = mediaType;
+  }
+  return normalized;
+}
+function effectiveStyle(parameter) {
+  if (parameter.style) return parameter.style;
+  switch (parameter.in) {
+    case "query":
+    case "cookie":
+      return "form";
+    case "path":
+    case "header":
+    default:
+      return "simple";
+  }
+}
+function effectiveExplode(parameter) {
+  if (typeof parameter.explode === "boolean") return parameter.explode;
+  return effectiveStyle(parameter) === "form";
+}
+function collectOperationParameters(pathItem, operation, issues, context) {
+  const merged = /* @__PURE__ */ new Map();
+  const contextPath = context?.path ?? "";
+  const contextMethod = context?.method;
+  const absorb = (list, origin) => {
+    if (list === void 0 || list === null) return;
+    if (!Array.isArray(list)) {
+      report(issues, {
+        path: contextPath,
+        method: contextMethod,
+        code: "invalid-parameter",
+        message: `The ${origin} "parameters" field is not an array and was ignored.`
+      });
+      return;
+    }
+    for (const entry of list) {
+      const normalized = normalizeParameter(entry);
+      if (!normalized) {
+        const location = isPlainObject(entry) ? entry.in : void 0;
+        if (typeof location === "string" && KNOWN_UNSUPPORTED_LOCATIONS.has(location)) {
+          report(issues, {
+            path: contextPath,
+            method: contextMethod,
+            code: "unsupported-parameter-location",
+            message: `Parameter location "${location}" is not supported and was skipped.`
+          });
+          continue;
+        }
+        report(issues, {
+          path: contextPath,
+          method: contextMethod,
+          code: isReference(entry) ? "unresolved-ref" : "invalid-parameter",
+          message: `Skipped an unusable ${origin} parameter entry.`
+        });
+        continue;
+      }
+      if (normalized.reserved) {
+        report(issues, {
+          path: contextPath,
+          method: contextMethod,
+          code: "reserved-parameter",
+          message: `Header parameter "${normalized.name}" is managed by the transport and will not be exposed as an argument.`
+        });
+      }
+      merged.set(`${normalized.in}:${normalized.name}`, normalized);
+    }
+  };
+  absorb(pathItem?.parameters, "path-item");
+  absorb(operation?.parameters, "operation");
+  return [...merged.values()];
+}
+function synthesizeOperationId(method, pathTemplate) {
+  const segments = pathTemplate.split("/").map((segment) => segment.trim()).filter(Boolean).map((segment) => {
+    const templated = segment.match(/^\{(.+)\}$/);
+    if (templated) return `by_${templated[1]}`;
+    return segment;
+  }).map((segment) => segment.replace(/[^A-Za-z0-9]+/g, "_")).map((segment) => segment.replace(/^_+|_+$/g, "")).filter(Boolean);
+  const safeMethod = method.toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "") || "call";
+  const base = [safeMethod, ...segments].join("_");
+  const cleaned = base.replace(/_{2,}/g, "_").replace(/^_+|_+$/g, "");
+  return cleaned || `${safeMethod}_root`;
+}
+function ensureUniqueName(candidate, taken) {
+  if (!taken.has(candidate)) {
+    taken.add(candidate);
+    return candidate;
+  }
+  let counter = 2;
+  let next = `${candidate}_${counter}`;
+  while (taken.has(next)) {
+    counter += 1;
+    next = `${candidate}_${counter}`;
+  }
+  taken.add(next);
+  return next;
+}
+function readAdditionalOperations(pathItem) {
+  const extra = pathItem.additionalOperations;
+  if (!isPlainObject(extra)) return [];
+  return Object.entries(extra);
+}
+function* iterateOperations(spec, issues) {
+  if (!spec) return;
+  if (spec.paths === void 0 || spec.paths === null) return;
+  if (!isPlainObject(spec.paths)) {
+    report(issues, {
+      path: "",
+      code: "invalid-paths-object",
+      message: `The document's "paths" field is not an object.`
+    });
+    return;
+  }
+  const usedIds = /* @__PURE__ */ new Set();
+  for (const [pathTemplate, rawPathItem] of Object.entries(spec.paths)) {
+    if (pathTemplate.startsWith("x-")) continue;
+    if (!pathTemplate.startsWith("/")) {
+      report(issues, {
+        path: pathTemplate,
+        code: "invalid-path-template",
+        message: 'Path templates must start with "/"; entry was skipped.'
+      });
+      continue;
+    }
+    if (!isPlainObject(rawPathItem)) {
+      report(issues, {
+        path: pathTemplate,
+        code: "invalid-path-item",
+        message: "Path item is not an object and was skipped."
+      });
+      continue;
+    }
+    if (isReference(rawPathItem)) {
+      report(issues, {
+        path: pathTemplate,
+        code: "unresolved-ref",
+        message: "Path item still contains an unresolved $ref and was skipped."
+      });
+      continue;
+    }
+    const pathItem = rawPathItem;
+    const candidates = [];
+    for (const [key, value] of Object.entries(rawPathItem)) {
+      if (key.startsWith("x-")) continue;
+      if (PATH_ITEM_METADATA_KEYS.has(key)) continue;
+      if (!HTTP_METHOD_SET.has(key.toLowerCase())) continue;
+      candidates.push({ key: key.toLowerCase(), value, standard: true });
+    }
+    for (const [key, value] of readAdditionalOperations(rawPathItem)) {
+      const method = key.trim().toLowerCase();
+      if (!method) continue;
+      if (candidates.some((candidate) => candidate.key === method)) continue;
+      candidates.push({ key: method, value, standard: false });
+    }
+    for (const { key: method, value: rawOperation, standard } of candidates) {
+      if (!isPlainObject(rawOperation)) {
+        report(issues, {
+          path: pathTemplate,
+          method,
+          code: "invalid-operation",
+          message: "Operation is not an object and was skipped."
+        });
+        continue;
+      }
+      if (isReference(rawOperation)) {
+        report(issues, {
+          path: pathTemplate,
+          method,
+          code: "unresolved-ref",
+          message: "Operation still contains an unresolved $ref and was skipped."
+        });
+        continue;
+      }
+      const operation = rawOperation;
+      const declaredId = typeof operation.operationId === "string" ? operation.operationId.trim() : "";
+      let generated = false;
+      let candidate = declaredId;
+      if (!candidate) {
+        candidate = synthesizeOperationId(method, pathTemplate);
+        generated = true;
+        report(issues, {
+          path: pathTemplate,
+          method,
+          code: "generated-operation-id",
+          message: `Missing operationId; generated "${candidate}".`
+        });
+      }
+      const capped = truncateGeneratedName(candidate);
+      if (capped !== candidate) {
+        report(issues, {
+          path: pathTemplate,
+          method,
+          code: "truncated-operation-id",
+          message: `operationId "${candidate}" exceeded ${MAX_GENERATED_NAME_LENGTH} characters and was shortened to "${capped}".`
+        });
+      }
+      const operationId = ensureUniqueName(capped, usedIds);
+      if (operationId !== capped) {
+        report(issues, {
+          path: pathTemplate,
+          method,
+          code: "duplicate-operation-id",
+          message: `Duplicate operationId "${capped}"; renamed to "${operationId}".`
+        });
+      }
+      yield {
+        path: pathTemplate,
+        method,
+        operation,
+        pathItem,
+        operationId,
+        operationIdGenerated: generated,
+        isStandardMethod: standard
+      };
+    }
+  }
+}
+function listOperations(spec, issues) {
+  return [...iterateOperations(spec, issues)];
+}
+function declaredOperationId(entry) {
+  const value = entry.operation.operationId;
+  return typeof value === "string" ? value.trim() : "";
+}
+var indexCache = /* @__PURE__ */ new WeakMap();
+function buildIndex(spec) {
+  const operations = listOperations(spec);
+  const byOperationId = /* @__PURE__ */ new Map();
+  for (const entry of operations) {
+    byOperationId.set(entry.operationId, entry);
+  }
+  const declaredCounts = /* @__PURE__ */ new Map();
+  for (const entry of operations) {
+    const declared = declaredOperationId(entry);
+    if (!declared) continue;
+    declaredCounts.set(declared, (declaredCounts.get(declared) ?? 0) + 1);
+  }
+  const byDeclaredId = /* @__PURE__ */ new Map();
+  for (const entry of operations) {
+    const declared = declaredOperationId(entry);
+    if (!declared) continue;
+    if (declaredCounts.get(declared) !== 1) continue;
+    if (byOperationId.has(declared)) continue;
+    byDeclaredId.set(declared, entry);
+  }
+  return { operations, byOperationId, byDeclaredId };
+}
+function getOperationIndex(spec) {
+  if (!spec) {
+    return {
+      operations: [],
+      byOperationId: /* @__PURE__ */ new Map(),
+      byDeclaredId: /* @__PURE__ */ new Map()
+    };
+  }
+  const cached = indexCache.get(spec);
+  if (cached) return cached;
+  const built = buildIndex(spec);
+  indexCache.set(spec, built);
+  return built;
+}
+function findOperationById(spec, operationId) {
+  if (typeof operationId !== "string") return null;
+  const target = operationId.trim();
+  if (!target) return null;
+  const index = getOperationIndex(spec);
+  return index.byOperationId.get(target) ?? index.byDeclaredId.get(target) ?? null;
+}
+function findDuplicateOperationIds(spec) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const entry of getOperationIndex(spec).operations) {
+    const declared = declaredOperationId(entry);
+    if (!declared) continue;
+    const bucket = seen.get(declared);
+    if (bucket) {
+      bucket.push({ method: entry.method, path: entry.path });
+    } else {
+      seen.set(declared, [{ method: entry.method, path: entry.path }]);
+    }
+  }
+  const duplicates = [];
+  for (const [operationId, occurrences] of seen) {
+    if (occurrences.length > 1) duplicates.push({ operationId, occurrences });
+  }
+  return duplicates;
+}
+function assertUniqueOperationIds(spec) {
+  const duplicates = findDuplicateOperationIds(spec);
+  if (duplicates.length === 0) return;
+  const detail = duplicates.map((duplicate) => {
+    const where = duplicate.occurrences.map((item) => `${item.method.toUpperCase()} ${item.path}`).join(", ");
+    return `"${duplicate.operationId}" (${where})`;
+  }).join("; ");
+  throw new Error(`Duplicate operationId values in specification: ${detail}`);
+}
+
+// src/core/openapi-loader.ts
+function isPlainObject2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseRaw(rawText, isYaml) {
+  if (isYaml) {
+    try {
+      return jsYaml.load(rawText);
+    } catch (error) {
+      throw new Error(
+        `Failed to parse YAML: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  try {
+    return JSON.parse(rawText);
+  } catch (error) {
+    throw new Error(
+      `Failed to parse JSON: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+async function validateAndDereference(doc) {
+  if (!isPlainObject2(doc)) {
+    throw new Error("The OpenAPI document must be a JSON or YAML object.");
+  }
+  if (typeof doc.openapi !== "string" || !doc.openapi.trim()) {
+    throw new Error(
+      'The OpenAPI document must include a non-empty "openapi" field.'
+    );
+  }
+  if (!isPlainObject2(doc.info)) {
+    throw new Error('The OpenAPI document must include a valid "info" object.');
+  }
+  if (typeof doc.info.title !== "string" || !doc.info.title.trim()) {
+    throw new Error(
+      'The OpenAPI document must include a non-empty "info.title" value.'
+    );
+  }
+  if (typeof doc.info.version !== "string" || !doc.info.version.trim()) {
+    throw new Error(
+      'The OpenAPI document must include a non-empty "info.version" value.'
+    );
+  }
+  const validationResult = await openapiParser.validate(doc);
+  if (!validationResult.valid) {
+    const errors = (validationResult.errors ?? []).map((item) => typeof item === "string" ? item : JSON.stringify(item)).join("; ");
+    throw new Error(
+      `The OpenAPI document is invalid: ${errors || "Unknown validation error."}`
+    );
+  }
+  const dereferenced = await openapiParser.dereference(doc);
+  if (dereferenced.errors?.length) {
+    const errors = dereferenced.errors.map((item) => typeof item === "string" ? item : JSON.stringify(item)).join("; ");
+    throw new Error(`Failed to dereference the OpenAPI document: ${errors}`);
+  }
+  const schema = dereferenced.schema;
+  if (!schema.paths || Object.keys(schema.paths).length === 0) {
+    throw new Error("The OpenAPI document does not define any paths.");
+  }
+  assertUniqueOperationIds(schema);
+  return schema;
+}
+async function loadOpenApiSpec(filePath) {
+  const raw = fs2__default.default.readFileSync(filePath, "utf8");
+  return validateAndDereference(parseRaw(raw, /\.ya?ml$/i.test(filePath)));
+}
+async function parseSpecContent(rawText, isYaml) {
+  if (!rawText.trim()) {
+    throw new Error("The OpenAPI content is empty.");
+  }
+  return validateAndDereference(parseRaw(rawText, isYaml));
+}
+var BODY_PREFERENCE = [
+  { test: (m) => m === "application/json", encoding: "json" },
+  { test: (m) => /^application\/[\w.+-]+\+json$/.test(m), encoding: "json" },
+  {
+    test: (m) => m === "application/x-www-form-urlencoded",
+    encoding: "form-urlencoded"
+  },
+  { test: (m) => m === "multipart/form-data", encoding: "multipart" },
+  { test: (m) => m.startsWith("text/"), encoding: "text" },
+  { test: (m) => m === "application/octet-stream", encoding: "binary" }
+];
+var BODY_KEY = "body";
+var FALLBACK_BODY_KEY = "requestBody";
+var BODYLESS_METHODS = /* @__PURE__ */ new Set(["get", "head", "trace"]);
+var READ_ONLY_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "head",
+  "options",
+  "trace",
+  "query"
+]);
+var IDEMPOTENT_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "head",
+  "options",
+  "trace",
+  "put",
+  "delete",
+  "query"
+]);
+var MAX_DESCRIPTION_LENGTH = 1024;
+function truncateText(text, limit) {
+  if (text.length <= limit) return text;
+  return `${text.slice(0, Math.max(0, limit - 1)).trimEnd()}\u2026`;
+}
+function stripMediaTypeParameters(mediaType) {
+  const semicolon = mediaType.indexOf(";");
+  const base = semicolon === -1 ? mediaType : mediaType.slice(0, semicolon);
+  return base.trim().toLowerCase();
+}
+function extractParameterSchema(parameter) {
+  if (parameter.schema) return parameter.schema;
+  if (parameter.content) {
+    const entries = Object.entries(parameter.content).filter(
+      ([, media2]) => isPlainObject(media2)
+    );
+    const jsonEntry = entries.find(
+      ([mediaType]) => /json/.test(stripMediaTypeParameters(mediaType))
+    ) ?? entries[0];
+    if (!jsonEntry) return null;
+    const media = jsonEntry[1];
+    if (isPlainObject(media.schema)) {
+      return media.schema;
+    }
+  }
+  return null;
+}
+function stripReadOnly(schema, memo = /* @__PURE__ */ new WeakMap()) {
+  if (Array.isArray(schema)) {
+    const cached2 = memo.get(schema);
+    if (cached2 !== void 0) return cached2;
+    const output2 = [];
+    memo.set(schema, output2);
+    for (const entry of schema) output2.push(stripReadOnly(entry, memo));
+    return output2;
+  }
+  if (!isPlainObject(schema)) return schema;
+  const cached = memo.get(schema);
+  if (cached !== void 0) return cached;
+  const output = {};
+  memo.set(schema, output);
+  for (const [key, value] of Object.entries(schema)) {
+    if (key === "properties" && isPlainObject(value)) {
+      const properties = {};
+      for (const [propertyName, propertySchema] of Object.entries(value)) {
+        if (isPlainObject(propertySchema) && propertySchema.readOnly === true) {
+          continue;
+        }
+        properties[propertyName] = stripReadOnly(propertySchema, memo);
+      }
+      output.properties = properties;
+      continue;
+    }
+    if (key === "items" || key === "additionalProperties" || key === "not" || key === "allOf" || key === "anyOf" || key === "oneOf" || key === "prefixItems" || key === "patternProperties" || key === "$defs") {
+      output[key] = stripReadOnly(value, memo);
+      continue;
+    }
+    output[key] = value;
+  }
+  if (Array.isArray(output.required) && isPlainObject(output.properties)) {
+    const properties = output.properties;
+    const filtered = output.required.filter(
+      (entry) => typeof entry === "string" && entry in properties
+    );
+    if (filtered.length > 0) output.required = filtered;
+    else delete output.required;
+  }
+  return output;
+}
+function buildParameterSchema(parameter) {
+  const resolved = extractParameterSchema(parameter);
+  const base = resolved ? { ...stripReadOnly(resolved) } : { type: "string" };
+  const notes = [];
+  if (parameter.description) notes.push(parameter.description);
+  notes.push(`Sent as a ${parameter.in} parameter named "${parameter.name}".`);
+  if (parameter.deprecated) notes.push("This parameter is deprecated.");
+  const existingDescription = typeof base.description === "string" ? base.description : void 0;
+  const description = existingDescription ? [existingDescription, ...notes.slice(parameter.description ? 1 : 0)].filter(Boolean).join(" ") : notes.join(" ");
+  base.description = truncateText(description, MAX_DESCRIPTION_LENGTH);
+  return base;
+}
+function selectBodyMedia(body) {
+  if (!isPlainObject(body.content)) return null;
+  const candidates = Object.entries(body.content).filter(([, media]) => isPlainObject(media)).map(([mediaType, media]) => ({
+    mediaType,
+    normalized: stripMediaTypeParameters(mediaType),
+    media
+  }));
+  for (const preference of BODY_PREFERENCE) {
+    const hit = candidates.find(
+      (candidate) => preference.test(candidate.normalized)
+    );
+    if (hit) {
+      return {
+        mediaType: hit.mediaType,
+        media: hit.media,
+        encoding: preference.encoding
+      };
+    }
+  }
+  return null;
+}
+function buildAnnotations(method, isStandardMethod, title) {
+  const annotations = { title };
+  if (!isStandardMethod) {
+    annotations.readOnlyHint = false;
+    annotations.destructiveHint = true;
+    annotations.idempotentHint = false;
+    annotations.openWorldHint = true;
+    return annotations;
+  }
+  const readOnly = READ_ONLY_METHODS.has(method);
+  annotations.readOnlyHint = readOnly;
+  annotations.destructiveHint = readOnly ? false : method === "delete";
+  annotations.idempotentHint = IDEMPOTENT_METHODS.has(method);
+  annotations.openWorldHint = true;
+  return annotations;
+}
+function buildToolForOperation(toolName, path3, pathItem, method, isStandardMethod, operation, parameters) {
+  const properties = {};
+  const required = [];
+  const argumentBindings = [];
+  const degradationReasons = [];
+  const usageNotes = [];
+  const omittedParameters = [];
+  const usedKeys = /* @__PURE__ */ new Set();
+  const exposedParameters = [];
+  for (const parameter of parameters) {
+    if (parameter.reserved) {
+      omittedParameters.push({
+        name: parameter.name,
+        in: parameter.in,
+        reason: "Managed by the transport layer; supplied from the server configuration."
+      });
+      continue;
+    }
+    exposedParameters.push(parameter);
+  }
+  const bodyObject = operation.requestBody && !isReference(operation.requestBody) ? operation.requestBody : null;
+  const bodyAllowed = !BODYLESS_METHODS.has(method);
+  const bodySelection = bodyObject && bodyAllowed ? selectBodyMedia(bodyObject) : null;
+  if (bodyObject && !bodyAllowed) {
+    degradationReasons.push(
+      `The document declares a request body for ${method.toUpperCase()}, which cannot carry a payload; it was ignored.`
+    );
+  }
+  let bodyKey = null;
+  if (bodySelection) {
+    const clashes = exposedParameters.some(
+      (parameter) => parameter.name === BODY_KEY
+    );
+    bodyKey = clashes ? FALLBACK_BODY_KEY : BODY_KEY;
+    usedKeys.add(bodyKey);
+  }
+  for (const parameter of exposedParameters) {
+    let key = parameter.name;
+    if (usedKeys.has(key)) {
+      key = `${parameter.in}_${parameter.name}`;
+    }
+    key = ensureUniqueName(key, usedKeys);
+    if (!parameter.schema && !parameter.content) {
+      degradationReasons.push(
+        `Parameter "${parameter.name}" (${parameter.in}) has no schema; treated as a string.`
+      );
+    }
+    properties[key] = buildParameterSchema(parameter);
+    if (parameter.required) required.push(key);
+    argumentBindings.push({
+      key,
+      name: parameter.name,
+      in: parameter.in,
+      parameter
+    });
+  }
+  const declaredPathParameters = new Set(
+    exposedParameters.filter((parameter) => parameter.in === "path").map((parameter) => parameter.name)
+  );
+  for (const variable of extractPathTemplateVariables(path3)) {
+    if (!declaredPathParameters.has(variable)) {
+      degradationReasons.push(
+        `Path template variable "{${variable}}" has no matching path parameter definition.`
+      );
+    }
+  }
+  if (bodySelection && bodyKey) {
+    const rawSchema = isPlainObject(bodySelection.media.schema) ? stripReadOnly(bodySelection.media.schema) : null;
+    let bodySchema;
+    if (rawSchema) {
+      bodySchema = { ...rawSchema };
+    } else if (bodySelection.encoding === "binary") {
+      bodySchema = { type: "string", contentEncoding: "base64" };
+    } else if (bodySelection.encoding === "text") {
+      bodySchema = { type: "string" };
+    } else {
+      bodySchema = { type: "object", additionalProperties: true };
+      degradationReasons.push(
+        `Request body for "${bodySelection.mediaType}" has no schema; accepting a free-form object.`
+      );
+    }
+    if (bodySelection.encoding === "multipart") {
+      usageNotes.push(
+        "Multipart bodies are sent as encoded fields; binary file parts must be supplied as base64 strings."
+      );
+    }
+    const bodyDescription = [
+      bodyObject?.description,
+      `Request body encoded as ${bodySelection.mediaType}.`
+    ].filter(Boolean).join(" ");
+    bodySchema.description = truncateText(
+      bodyDescription,
+      MAX_DESCRIPTION_LENGTH
+    );
+    properties[bodyKey] = bodySchema;
+    if (bodyObject?.required === true) required.push(bodyKey);
+  } else if (bodyObject && bodyAllowed) {
+    const available = isPlainObject(bodyObject.content) ? Object.keys(bodyObject.content).join(", ") || "none" : "none";
+    degradationReasons.push(
+      `No supported request body media type (available: ${available}).`
+    );
+  } else if (isReference(operation.requestBody)) {
+    degradationReasons.push(
+      "Request body still contains an unresolved $ref and was ignored."
+    );
+  }
+  const fullySupported = degradationReasons.length === 0;
+  const inputSchema = {
+    type: "object",
+    properties,
+    ...required.length > 0 ? { required } : {},
+    additionalProperties: !fullySupported
+  };
+  const label = `${method.toUpperCase()} ${path3}`;
+  const descriptionParts = [operation.summary, operation.description].filter(
+    (entry) => typeof entry === "string" && entry.trim().length > 0
+  );
+  if (descriptionParts.length === 0) descriptionParts.push(label);
+  if (operation.deprecated === true) {
+    descriptionParts.push("[DEPRECATED]");
+  }
+  if (!isStandardMethod) {
+    descriptionParts.push(`[CUSTOM METHOD ${method.toUpperCase()}]`);
+  }
+  if (omittedParameters.length > 0) {
+    descriptionParts.push(
+      `[SERVER-MANAGED: ${omittedParameters.map((entry) => entry.name).join(", ")}]`
+    );
+  }
+  if (usageNotes.length > 0) {
+    descriptionParts.push(`[NOTE] ${usageNotes.join(" ")}`);
+  }
+  if (!fullySupported) {
+    descriptionParts.push(`[PARTIAL SUPPORT] ${degradationReasons.join(" ")}`);
+  }
+  const tool = {
+    name: toolName,
+    description: truncateText(
+      descriptionParts.join(" \u2014 "),
+      MAX_DESCRIPTION_LENGTH
+    ),
+    inputSchema,
+    annotations: buildAnnotations(
+      method,
+      isStandardMethod,
+      operation.summary?.trim() || label
+    )
+  };
+  const binding = {
+    toolName,
+    path: path3,
+    pathItem,
+    method,
+    isStandardMethod,
+    operation,
+    arguments: argumentBindings,
+    bodyKey,
+    bodyEncoding: bodySelection?.encoding ?? null,
+    bodyMediaType: bodySelection?.mediaType ?? null,
+    bodyRequired: bodyObject?.required === true && bodySelection !== null,
+    omittedParameters,
+    fullySupported,
+    degradationReasons,
+    usageNotes
+  };
+  return { tool, binding };
+}
+function generateToolsDetailed(spec) {
+  const issues = [];
+  const tools = [];
+  const bindings = [];
+  const usedToolNames = /* @__PURE__ */ new Set();
+  for (const resolved of iterateOperations(spec, issues)) {
+    const parameters = collectOperationParameters(
+      resolved.pathItem,
+      resolved.operation,
+      issues,
+      { path: resolved.path, method: resolved.method }
+    );
+    const toolName = ensureUniqueName(
+      truncateGeneratedName(resolved.operationId),
+      usedToolNames
+    );
+    const generated = buildToolForOperation(
+      toolName,
+      resolved.path,
+      resolved.pathItem,
+      resolved.method,
+      resolved.isStandardMethod,
+      resolved.operation,
+      parameters
+    );
+    tools.push(generated.tool);
+    bindings.push(generated.binding);
+  }
+  return { tools, bindings, issues };
+}
+function generateTools(spec) {
+  return generateToolsDetailed(spec).tools;
+}
+var resultCache = /* @__PURE__ */ new WeakMap();
+var bindingIndexCache = /* @__PURE__ */ new WeakMap();
+var EMPTY_RESULT = Object.freeze({
+  tools: [],
+  bindings: [],
+  issues: []
+});
+function getGeneratedTools(spec) {
+  if (!spec) return EMPTY_RESULT;
+  const cached = resultCache.get(spec);
+  if (cached) return cached;
+  const generated = generateToolsDetailed(spec);
+  resultCache.set(spec, generated);
+  return generated;
+}
+function getBindingIndex(spec) {
+  if (!spec) return /* @__PURE__ */ new Map();
+  const cached = bindingIndexCache.get(spec);
+  if (cached) return cached;
+  const index = /* @__PURE__ */ new Map();
+  for (const binding of getGeneratedTools(spec).bindings) {
+    index.set(binding.toolName, binding);
+  }
+  bindingIndexCache.set(spec, index);
+  return index;
+}
+var buildBindingIndex = getBindingIndex;
+
+// src/registry/prompt-registry.ts
+var MAX_PROMPT_NAME_LENGTH = 96;
+var MAX_DESCRIPTION_LENGTH2 = 400;
+var MAX_ARGS_TEXT_LENGTH = 4e3;
+var MAX_OPERATIONS = 2e3;
+var indexCache2 = /* @__PURE__ */ new WeakMap();
+function sanitizeSegment(raw) {
+  const normalized = raw.normalize("NFKD").replace(/[^A-Za-z0-9]+/g, "_").replace(/_+/g, "_").replace(/^_+|_+$/g, "");
+  return normalized.length > 0 ? normalized : "operation";
+}
+function truncate(text, limit) {
+  if (text.length <= limit) return text;
+  return `${text.slice(0, Math.max(0, limit - 1)).trimEnd()}\u2026`;
+}
+function describe(primary, fallback) {
+  const candidate = typeof primary === "string" ? primary.trim() : "";
+  return truncate(
+    candidate.length > 0 ? candidate : fallback,
+    MAX_DESCRIPTION_LENGTH2
+  );
+}
+function safeSerializeArgs(args) {
+  const keys = Object.keys(args);
+  if (keys.length === 0) return "(none)";
+  const seen = /* @__PURE__ */ new WeakSet();
+  let serialized;
+  try {
+    serialized = JSON.stringify(
+      args,
+      (_key, value) => {
+        if (typeof value === "bigint") return value.toString();
+        if (typeof value === "function" || typeof value === "symbol") {
+          return `[${typeof value}]`;
+        }
+        if (value && typeof value === "object") {
+          if (seen.has(value)) return "[Circular]";
+          seen.add(value);
+        }
+        return value;
+      },
+      2
+    );
+  } catch {
+    return `(unserializable arguments: ${keys.join(", ")})`;
+  }
+  if (typeof serialized !== "string") return "(none)";
+  return truncate(serialized, MAX_ARGS_TEXT_LENGTH);
+}
+function userMessage(text) {
+  return { role: "user", content: { type: "text", text } };
+}
+function makeResult(description, text) {
+  return { description, messages: [userMessage(text)] };
+}
+function toPromptArguments(parameters) {
+  const result = [];
+  const used = /* @__PURE__ */ new Set();
+  for (const parameter of parameters) {
+    const rawName = typeof parameter.name === "string" ? parameter.name.trim() : "";
+    if (!rawName) continue;
+    let name = rawName;
+    if (used.has(name)) {
+      const location = typeof parameter.in === "string" ? parameter.in : "arg";
+      name = `${rawName}_${location}`;
+      let suffix = 2;
+      while (used.has(name)) {
+        name = `${rawName}_${location}_${suffix}`;
+        suffix += 1;
+      }
+    }
+    used.add(name);
+    result.push({
+      name,
+      description: describe(
+        parameter.description,
+        `Input for the ${parameter.in ?? "unknown"} parameter "${rawName}".`
+      ),
+      // Sample generation must never hard-fail on a missing hint.
+      required: false
+    });
+  }
+  return result;
+}
+function buildIndex2(spec) {
+  const ordered = [];
+  const byName = /* @__PURE__ */ new Map();
+  const title = spec.info?.title?.trim() || "Untitled API";
+  const version = spec.info?.version?.trim() || "unknown";
+  const register = (prompt, build) => {
+    const generated = prompt;
+    if (byName.has(generated.name)) return;
+    byName.set(generated.name, { prompt: generated, build });
+    ordered.push(generated);
+  };
+  const operations = [];
+  let truncatedOperations = false;
+  for (const entry of iterateOperations(spec)) {
+    if (operations.length >= MAX_OPERATIONS) {
+      truncatedOperations = true;
+      break;
+    }
+    const method = String(entry.method ?? "get").toUpperCase();
+    const parameters = collectOperationParameters(
+      entry.pathItem,
+      entry.operation
+    );
+    const args = toPromptArguments(parameters);
+    operations.push({
+      path: entry.path,
+      method,
+      operationId: entry.operationId,
+      summary: entry.operation.summary?.trim() || `${method} ${entry.path}`,
+      description: entry.operation.description,
+      deprecated: entry.operation.deprecated === true,
+      args,
+      parameterHints: parameters.length > 0 ? parameters.map(
+        (parameter) => `- ${parameter.name} (${parameter.in}${parameter.required ? ", required" : ""})`
+      ).join("\n") : "- (this operation declares no parameters)"
+    });
+  }
+  register(
+    {
+      name: "spec_overview",
+      description: `Summarize the scope, conventions and major capabilities of "${truncate(title, 60)}".`,
+      arguments: []
+    },
+    () => makeResult(
+      "High-level orientation for the loaded API specification.",
+      [
+        `Summarize the API "${title}" (version "${version}").`,
+        `It exposes ${operations.length} callable operation(s)${truncatedOperations ? " (list truncated for size)" : ""}.`,
+        "Cover: authentication requirements, the main resource groups, naming conventions,",
+        "pagination style, and any caveats a client should know before integrating."
+      ].join("\n")
+    )
+  );
+  register(
+    {
+      name: "integration_guardrails",
+      description: "Describe how to call this API safely and incrementally.",
+      arguments: []
+    },
+    () => makeResult(
+      "Conservative integration guidance for the loaded API specification.",
+      [
+        `Provide conservative integration guidance for "${title}" (version "${version}").`,
+        "Address: retry and backoff policy, idempotency of mutating calls, pagination expectations,",
+        "rate-limit handling, error-response interpretation, and data-safety or PII considerations.",
+        "Prefer read-only verification steps before recommending any destructive call."
+      ].join("\n")
+    )
+  );
+  const usedOperationSlugs = /* @__PURE__ */ new Set();
+  for (const operation of operations) {
+    let slug = truncate(
+      sanitizeSegment(operation.operationId),
+      MAX_PROMPT_NAME_LENGTH - 12
+    ).replace(/…$/, "");
+    if (usedOperationSlugs.has(slug)) {
+      let suffix = 2;
+      while (usedOperationSlugs.has(`${slug}_${suffix}`)) suffix += 1;
+      slug = `${slug}_${suffix}`;
+    }
+    usedOperationSlugs.add(slug);
+    const label = `${operation.method} ${operation.path}`;
+    const deprecationNote = operation.deprecated ? "\nNote: this operation is marked deprecated in the specification; mention safer alternatives if any exist." : "";
+    register(
+      {
+        name: `explain_${slug}`,
+        description: describe(
+          operation.description,
+          `Explain how to use ${label}.`
+        ),
+        arguments: []
+      },
+      () => makeResult(
+        `Explanation of ${label}.`,
+        [
+          `Explain the operation "${operation.operationId}" (${label}).`,
+          `Summary: ${operation.summary}`,
+          "Describe required inputs, optional inputs, request body rules, authentication needs,",
+          "and the likely success and error response shapes.",
+          "Parameters:",
+          operation.parameterHints
+        ].join("\n") + deprecationNote
+      )
+    );
+    register(
+      {
+        name: `plan_${slug}`,
+        description: `Create an execution plan for ${label}.`,
+        arguments: []
+      },
+      () => makeResult(
+        `Execution plan for ${label}.`,
+        [
+          `Create a step-by-step execution plan for "${operation.operationId}" (${label}).`,
+          "List every required parameter, any preconditions or prerequisite calls,",
+          "the exact call to make, and how to validate the response before proceeding.",
+          "Parameters:",
+          operation.parameterHints
+        ].join("\n") + deprecationNote
+      )
+    );
+    register(
+      {
+        name: `sample_${slug}`,
+        description: `Generate realistic sample arguments for ${label}.`,
+        arguments: operation.args
+      },
+      (args) => makeResult(
+        `Sample arguments for ${label}.`,
+        [
+          `Generate realistic sample arguments for "${operation.operationId}" (${label}).`,
+          "Use production-like placeholders that satisfy the declared types and formats.",
+          "Do not invent real credentials, tokens, or personal data.",
+          "Parameters:",
+          operation.parameterHints,
+          "Values already provided by the caller:",
+          safeSerializeArgs(args)
+        ].join("\n")
+      )
+    );
+  }
+  return { ordered, byName };
+}
+function getIndex(spec) {
+  const cached = indexCache2.get(spec);
+  if (cached) return cached;
+  const built = buildIndex2(spec);
+  indexCache2.set(spec, built);
+  return built;
+}
+function generatePrompts(spec) {
+  return getIndex(spec).ordered.slice();
+}
+function resolvePrompt(spec, name, args = {}) {
+  if (typeof name !== "string" || name.length === 0) return null;
+  const entry = getIndex(spec).byName.get(name);
+  if (!entry) return null;
+  const safeArgs = args && typeof args === "object" && !Array.isArray(args) ? args : {};
+  try {
+    return entry.build(safeArgs);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return makeResult(
+      entry.prompt.description ?? name,
+      `The prompt "${name}" could not be fully rendered from the specification (${message}). Explain what you can from the surrounding API context.`
+    );
+  }
+}
+
+// src/registry/resource-registry.ts
+function generateResources(spec) {
+  return [
+    {
+      uri: "openapi://spec/summary",
+      name: "OpenAPI Spec Summary",
+      description: "High-level API metadata and counts.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://spec/raw-info",
+      name: "OpenAPI Info Object",
+      description: "The OpenAPI info metadata.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://catalog/tools",
+      name: "Tool Catalog",
+      description: "The generated MCP tool catalog.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://catalog/prompts",
+      name: "Prompt Catalog",
+      description: "The generated MCP prompt catalog.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://catalog/resources",
+      name: "Resource Catalog",
+      description: "The generated MCP resource catalog.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://catalog/operations",
+      name: "Operation Catalog",
+      description: "The full operation catalog.",
+      mimeType: "application/json"
+    },
+    {
+      uri: "openapi://spec/document",
+      name: "OpenAPI Document",
+      description: "The dereferenced OpenAPI document.",
+      mimeType: "application/json"
+    }
+  ];
+}
+function readResource(spec, uri) {
+  if (uri === "openapi://spec/summary") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify(
+        {
+          title: spec.info?.title ?? null,
+          version: spec.info?.version ?? null,
+          openapi: spec.openapi,
+          servers: spec.servers ?? [],
+          operationCount: Array.from(iterateOperations(spec)).length
+        },
+        null,
+        2
+      )
+    };
+  }
+  if (uri === "openapi://spec/raw-info") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify(spec.info ?? {}, null, 2)
+    };
+  }
+  if (uri === "openapi://catalog/tools") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify(generateToolsDetailed(spec), null, 2)
+    };
+  }
+  if (uri === "openapi://catalog/prompts") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify({ prompts: generatePrompts(spec) }, null, 2)
+    };
+  }
+  if (uri === "openapi://catalog/resources") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify({ resources: generateResources() }, null, 2)
+    };
+  }
+  if (uri === "openapi://catalog/operations") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify(
+        Array.from(iterateOperations(spec)).map((item) => ({
+          operationId: item.operationId,
+          method: item.method,
+          path: item.path,
+          summary: item.operation.summary ?? null,
+          description: item.operation.description ?? null
+        })),
+        null,
+        2
+      )
+    };
+  }
+  if (uri === "openapi://spec/document") {
+    return {
+      uri,
+      mimeType: "application/json",
+      text: JSON.stringify(spec, null, 2)
+    };
+  }
+  return null;
+}
+
+// src/core/request-builder.ts
+var RESERVED_HEADERS = /* @__PURE__ */ new Set([
+  "host",
+  "content-length",
+  "content-type",
+  "transfer-encoding",
+  "connection",
+  "keep-alive",
+  "upgrade",
+  "te",
+  "trailer",
+  "expect",
+  "authorization",
+  "proxy-authorization",
+  "proxy-connection",
+  "accept-encoding",
+  "cookie"
+]);
+function isPlainObject3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function renderScalar(value) {
+  if (value === null || value === void 0) return "";
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  if (value instanceof Date) return value.toISOString();
+  return String(value);
+}
+function encodeComponent(value) {
+  return encodeURIComponent(value);
+}
+function isEmptyValue(value) {
+  return value === void 0 || value === null || value === "";
+}
+function serializePathParameter(name, value, style, explode) {
+  const encodedName = encodeComponent(name);
+  if (Array.isArray(value)) {
+    const parts = value.filter((entry) => entry !== void 0 && entry !== null).map((entry) => encodeComponent(renderScalar(entry)));
+    switch (style) {
+      case "label":
+        return explode ? `.${parts.join(".")}` : `.${parts.join(",")}`;
+      case "matrix":
+        return explode ? parts.map((part) => `;${encodedName}=${part}`).join("") : `;${encodedName}=${parts.join(",")}`;
+      default:
+        return parts.join(",");
+    }
+  }
+  if (isPlainObject3(value)) {
+    const entries = Object.entries(value).filter(
+      ([, entryValue]) => entryValue !== void 0 && entryValue !== null
+    );
+    const flat = entries.flatMap(([key, entryValue]) => [
+      encodeComponent(key),
+      encodeComponent(renderScalar(entryValue))
+    ]);
+    const pairs = entries.map(
+      ([key, entryValue]) => `${encodeComponent(key)}=${encodeComponent(renderScalar(entryValue))}`
+    );
+    switch (style) {
+      case "label":
+        return explode ? `.${pairs.join(".")}` : `.${flat.join(",")}`;
+      case "matrix":
+        return explode ? `;${pairs.join(";")}` : `;${encodedName}=${flat.join(",")}`;
+      default:
+        return explode ? pairs.join(",") : flat.join(",");
+    }
+  }
+  const scalar = encodeComponent(renderScalar(value));
+  switch (style) {
+    case "label":
+      return `.${scalar}`;
+    case "matrix":
+      return `;${encodedName}=${scalar}`;
+    default:
+      return scalar;
+  }
+}
+function serializeQueryParameter(name, value, style, explode) {
+  if (Array.isArray(value)) {
+    const parts = value.filter((entry) => entry !== void 0 && entry !== null).map((entry) => renderScalar(entry));
+    if (parts.length === 0) return explode ? [] : [[name, ""]];
+    if (explode) return parts.map((part) => [name, part]);
+    if (style === "spaceDelimited") return [[name, parts.join(" ")]];
+    if (style === "pipeDelimited") return [[name, parts.join("|")]];
+    return [[name, parts.join(",")]];
+  }
+  if (isPlainObject3(value)) {
+    const entries = Object.entries(value).filter(
+      ([, entryValue]) => entryValue !== void 0 && entryValue !== null
+    );
+    if (style === "deepObject") {
+      return entries.map(([key, entryValue]) => {
+        return [`${name}[${key}]`, renderScalar(entryValue)];
+      });
+    }
+    if (explode) {
+      return entries.map(
+        ([key, entryValue]) => [key, renderScalar(entryValue)]
+      );
+    }
+    const flat = entries.flatMap(([key, entryValue]) => [
+      key,
+      renderScalar(entryValue)
+    ]);
+    return [[name, flat.join(",")]];
+  }
+  return [[name, renderScalar(value)]];
+}
+function serializeHeaderParameter(value, explode) {
+  if (Array.isArray(value)) {
+    return value.filter((entry) => entry !== void 0 && entry !== null).map((entry) => renderScalar(entry)).join(",");
+  }
+  if (isPlainObject3(value)) {
+    const entries = Object.entries(value).filter(
+      ([, entryValue]) => entryValue !== void 0 && entryValue !== null
+    );
+    return explode ? entries.map(([key, v]) => `${key}=${renderScalar(v)}`).join(",") : entries.flatMap(([key, v]) => [key, renderScalar(v)]).join(",");
+  }
+  return renderScalar(value);
+}
+function assertSafeHeaderValue(name, value) {
+  if (/[\r\n\u0000]/.test(value)) {
+    throw new Error(
+      `Header parameter "${name}" contains a control character and was rejected.`
+    );
+  }
+}
+function isValidHeaderName(name) {
+  return /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/.test(name);
+}
+function buildRequest(baseUrl, templatePath, pathItem, operation, args, binding) {
+  let parsedBaseUrl;
+  try {
+    parsedBaseUrl = new URL(baseUrl);
+  } catch {
+    throw new Error(`Invalid upstream base URL: "${baseUrl}".`);
+  }
+  if (parsedBaseUrl.protocol !== "http:" && parsedBaseUrl.protocol !== "https:") {
+    throw new Error(
+      `Unsupported upstream base URL protocol: "${parsedBaseUrl.protocol}". Only http and https are allowed.`
+    );
+  }
+  if (/\{[^}]+\}/.test(parsedBaseUrl.pathname) || /\{/.test(parsedBaseUrl.host)) {
+    throw new Error(
+      `The upstream base URL "${baseUrl}" still contains unresolved server variables.`
+    );
+  }
+  const query = new URLSearchParams();
+  for (const [key, value] of parsedBaseUrl.searchParams.entries()) {
+    query.append(key, value);
+  }
+  const parameters = binding ? [] : collectOperationParameters(pathItem, operation, []);
+  const bindingMap = new Map(
+    binding?.arguments.map((item) => [item.key, item]) ?? []
+  );
+  let path3 = templatePath;
+  const headers = {};
+  const cookies = [];
+  const dropped = [];
+  const bodyKey = binding ? binding.bodyKey : "body" in args ? "body" : null;
+  for (const [key, value] of Object.entries(args)) {
+    if (bodyKey !== null && key === bodyKey) continue;
+    const bound = bindingMap.get(key);
+    const parameter = bound?.parameter ?? parameters.find((item) => item.name === key);
+    if (!bound && !parameter) {
+      dropped.push({
+        key,
+        reason: "Not a declared parameter of this operation."
+      });
+      continue;
+    }
+    const location = bound?.in ?? parameter?.in ?? "query";
+    const targetName = bound?.name ?? parameter?.name ?? key;
+    const style = parameter ? effectiveStyle(parameter) : location === "path" || location === "header" ? "simple" : "form";
+    const explode = parameter ? effectiveExplode(parameter) : style === "form";
+    if (location === "path") {
+      const placeholder = `{${targetName}}`;
+      if (!path3.includes(placeholder)) {
+        dropped.push({
+          key,
+          reason: `No "${placeholder}" placeholder exists in the path template.`
+        });
+        continue;
+      }
+      if (isEmptyValue(value) || Array.isArray(value) && value.length === 0) {
+        throw new Error(
+          `Path parameter "${targetName}" requires a non-empty value.`
+        );
+      }
+      path3 = path3.split(placeholder).join(serializePathParameter(targetName, value, style, explode));
+      continue;
+    }
+    if (value === void 0 || value === null) continue;
+    if (value === "" && !(location === "query" && parameter?.allowEmptyValue === true)) {
+      continue;
+    }
+    if (location === "header") {
+      if (RESERVED_HEADERS.has(targetName.toLowerCase())) {
+        dropped.push({
+          key,
+          reason: `Header "${targetName}" is managed by the transport layer.`
+        });
+        continue;
+      }
+      if (!isValidHeaderName(targetName)) {
+        dropped.push({
+          key,
+          reason: `"${targetName}" is not a valid header name.`
+        });
+        continue;
+      }
+      const rendered = serializeHeaderParameter(value, explode);
+      assertSafeHeaderValue(targetName, rendered);
+      headers[targetName] = rendered;
+      continue;
+    }
+    if (location === "cookie") {
+      if (isPlainObject3(value) && explode) {
+        for (const [cookieKey, cookieValue] of Object.entries(value)) {
+          if (cookieValue === void 0 || cookieValue === null) continue;
+          cookies.push(
+            `${cookieKey}=${encodeComponent(renderScalar(cookieValue))}`
+          );
+        }
+        continue;
+      }
+      if (Array.isArray(value) && explode) {
+        for (const entry of value) {
+          if (entry === void 0 || entry === null) continue;
+          cookies.push(`${targetName}=${encodeComponent(renderScalar(entry))}`);
+        }
+        continue;
+      }
+      for (const [, cookieValue] of serializeQueryParameter(
+        targetName,
+        value,
+        "form",
+        false
+      )) {
+        cookies.push(`${targetName}=${encodeComponent(cookieValue)}`);
+      }
+      continue;
+    }
+    if (style === "deepObject" && !isPlainObject3(value)) {
+      throw new Error(
+        `Parameter "${targetName}" uses style "deepObject", which requires an object value.`
+      );
+    }
+    for (const [pairName, pairValue] of serializeQueryParameter(
+      targetName,
+      value,
+      style,
+      explode
+    )) {
+      query.append(pairName, pairValue);
+    }
+  }
+  const unresolved = path3.match(/\{[^}]+\}/g);
+  if (unresolved?.length) {
+    throw new Error(
+      `Missing required path parameters: ${unresolved.join(", ")}.`
+    );
+  }
+  if (cookies.length > 0) {
+    const cookieHeader = cookies.join("; ");
+    assertSafeHeaderValue("Cookie", cookieHeader);
+    headers.Cookie = cookieHeader;
+  }
+  const body = bodyKey !== null ? args[bodyKey] : void 0;
+  const basePath = parsedBaseUrl.pathname.replace(/\/+$/, "");
+  const suffix = path3.startsWith("/") ? path3 : `/${path3}`;
+  return {
+    url: `${parsedBaseUrl.origin}${basePath}${suffix}`,
+    query,
+    headers,
+    body,
+    dropped
+  };
+}
+function isAbortError(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = error.name;
+  return name === "AbortError" || name === "CanceledError";
+}
+function newId() {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `id_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+  }
+}
+
+// src/core/http-executor.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var MIN_TIMEOUT_MS = 1e3;
+var MAX_CONTENT_BYTES = 10 * 1024 * 1024;
+var MAX_RESULT_CHARS = 5e4;
+var MAX_LOGGED_BODY_CHARS = 8e3;
+var SENSITIVE_HEADERS = /* @__PURE__ */ new Set([
+  "authorization",
+  "proxy-authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "api-key",
+  "x-auth-token",
+  "x-access-token",
+  "x-csrf-token"
+]);
+function groupQuery(params) {
+  const grouped = {};
+  for (const [key, value] of params.entries()) {
+    const existing = grouped[key];
+    if (existing === void 0) {
+      grouped[key] = value;
+    } else if (Array.isArray(existing)) {
+      existing.push(value);
+    } else {
+      grouped[key] = [existing, value];
+    }
+  }
+  return grouped;
+}
+function classifyFailure(error, callerAborted = false) {
+  const code = error.code ?? "";
+  const name = error.name ?? "";
+  const message = error.message ?? "";
+  if (code === "ETIMEDOUT" || /timeout/i.test(message)) return "timeout";
+  if (code === "ERR_CANCELED" || code === "ECONNABORTED" || name === "CanceledError" || name === "AbortError") {
+    return callerAborted ? "canceled" : "timeout";
+  }
+  if (code === "ENOTFOUND" || code === "EAI_AGAIN") return "dns";
+  if (code === "ECONNREFUSED" || code === "ECONNRESET" || code === "EHOSTUNREACH") {
+    return "connection-refused";
+  }
+  if (code.startsWith("ERR_TLS") || code === "CERT_HAS_EXPIRED" || code === "DEPTH_ZERO_SELF_SIGNED_CERT") {
+    return "tls";
+  }
+  if (code === "ERR_FR_MAX_BODY_LENGTH_EXCEEDED" || code === "ERR_BAD_RESPONSE" && /maxContentLength/i.test(message)) {
+    return "payload-too-large";
+  }
+  return "unknown";
+}
+function findHeader(headers, name) {
+  const target = name.toLowerCase();
+  for (const [key, value] of Object.entries(headers)) {
+    if (key.toLowerCase() === target) return value;
+  }
+  return void 0;
+}
+function hasHeader(headers, name) {
+  return findHeader(headers, name) !== void 0;
+}
+function redactHeaders(headers) {
+  const output = {};
+  for (const [key, value] of Object.entries(headers)) {
+    if (value === void 0) continue;
+    output[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? "[redacted]" : value;
+  }
+  return output;
+}
+function normalizeResponseHeaders(raw) {
+  if (!raw || typeof raw !== "object") return {};
+  const output = {};
+  for (const [key, value] of Object.entries(raw)) {
+    output[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? "[redacted]" : value;
+  }
+  return output;
+}
+function trimAtLimits(value, limits) {
+  if (value === void 0 || value === null || typeof value === "number") {
+    return limits.map(() => ({ value, truncated: false }));
+  }
+  let serialized = null;
+  if (typeof value === "string") {
+    serialized = value;
+  } else if (typeof value === "object") {
+    try {
+      serialized = JSON.stringify(value);
+    } catch {
+      return limits.map(() => ({
+        value: "[unserializable value]",
+        truncated: true
+      }));
+    }
+  }
+  if (serialized === null) {
+    return limits.map(() => ({ value, truncated: false }));
+  }
+  const text = serialized;
+  return limits.map(
+    (limit) => text.length <= limit ? { value, truncated: false } : { value: `${text.slice(0, limit)}
+...[truncated]`, truncated: true }
+  );
+}
+function trimLargeValue(value, limit) {
+  return trimAtLimits(value, [limit, limit])[0];
+}
+function emitLog(onLog, entry) {
+  try {
+    onLog?.(entry);
+  } catch {
+  }
+}
+function toSearchParams(query) {
+  if (query instanceof URLSearchParams) return query;
+  const params = new URLSearchParams();
+  if (!query || typeof query !== "object") return params;
+  if (Array.isArray(query)) {
+    for (const entry of query) {
+      if (Array.isArray(entry) && entry.length === 2) {
+        params.append(String(entry[0]), String(entry[1] ?? ""));
+      }
+    }
+    return params;
+  }
+  for (const [key, value] of Object.entries(query)) {
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value)) {
+      for (const item of value) {
+        if (item === void 0 || item === null) continue;
+        params.append(key, String(item));
+      }
+      continue;
+    }
+    params.append(key, String(value));
+  }
+  return params;
+}
+function serializeBody(body, encoding) {
+  if (body === void 0) return { data: void 0 };
+  switch (encoding) {
+    case "form-urlencoded": {
+      const text = body && typeof body === "object" ? toSearchParams(body).toString() : String(body);
+      return {
+        data: text,
+        contentType: "application/x-www-form-urlencoded"
+      };
+    }
+    case "multipart": {
+      if (!body || typeof body !== "object") return { data: body };
+      const form = new FormData();
+      for (const [key, value] of Object.entries(
+        body
+      )) {
+        if (value === void 0 || value === null) continue;
+        if (Array.isArray(value)) {
+          for (const item of value) {
+            if (item === void 0 || item === null) continue;
+            form.append(key, String(item));
+          }
+          continue;
+        }
+        if (typeof value === "object") {
+          form.append(
+            key,
+            new Blob([JSON.stringify(value)], { type: "application/json" })
+          );
+          continue;
+        }
+        form.append(key, String(value));
+      }
+      return { data: form };
+    }
+    case "binary": {
+      if (typeof body === "string") {
+        try {
+          return {
+            data: Buffer.from(body, "base64"),
+            contentType: "application/octet-stream"
+          };
+        } catch {
+          return { data: body, contentType: "application/octet-stream" };
+        }
+      }
+      return { data: body, contentType: "application/octet-stream" };
+    }
+    case "text":
+      return {
+        data: typeof body === "string" ? body : JSON.stringify(body),
+        contentType: "text/plain"
+      };
+    case "json":
+    default:
+      return { data: body, contentType: "application/json" };
+  }
+}
+function describeBodyForLog(data) {
+  if (typeof FormData !== "undefined" && data instanceof FormData) {
+    return "[multipart form data]";
+  }
+  if (Buffer.isBuffer(data)) return `[binary, ${data.byteLength} bytes]`;
+  return data;
+}
+async function executeToolCall(spec, toolName, args, context = {}) {
+  const trimmedName = toolName.trim();
+  if (!trimmedName) throw new Error("A tool name is required.");
+  const binding = getBindingIndex(spec).get(trimmedName);
+  const resolved = binding ? {
+    path: binding.path,
+    method: binding.method,
+    operation: binding.operation,
+    pathItem: binding.pathItem
+  } : findOperationById(spec, trimmedName);
+  if (!resolved) {
+    throw new Error(
+      `Tool "${trimmedName}" was not found in the specification.`
+    );
+  }
+  const baseUrl = context.baseUrlOverride ?? spec.servers?.[0]?.url ?? "";
+  if (!baseUrl) {
+    throw new Error(
+      "No upstream base URL is available: the document declares no servers and no override was configured."
+    );
+  }
+  const protocol = context.protocol;
+  const correlationId = newId();
+  const methodUpper = resolved.method.toUpperCase();
+  const timeoutMs = Math.max(
+    MIN_TIMEOUT_MS,
+    context.requestTimeoutMs ?? DEFAULT_TIMEOUT_MS
+  );
+  if (context.signal?.aborted) {
+    throw new DOMException(
+      "The tool call was cancelled before it was dispatched.",
+      "AbortError"
+    );
+  }
+  const built = buildRequest(
+    baseUrl,
+    resolved.path,
+    resolved.pathItem,
+    resolved.operation,
+    args ?? {},
+    binding
+  );
+  const startedAt = Date.now();
+  const searchParams = toSearchParams(built.query);
+  const mergedHeaders = {};
+  for (const [key, value] of Object.entries(context.upstreamHeaders ?? {})) {
+    if (typeof value === "string") mergedHeaders[key] = value;
+  }
+  for (const [key, value] of Object.entries(built.headers ?? {})) {
+    if (typeof value === "string") mergedHeaders[key] = value;
+  }
+  if (context.security?.bearerToken) {
+    mergedHeaders.Authorization = `Bearer ${context.security.bearerToken}`;
+  } else if (context.security?.basicAuth) {
+    const raw = `${context.security.basicAuth.username}:${context.security.basicAuth.password}`;
+    mergedHeaders.Authorization = `Basic ${Buffer.from(raw, "utf8").toString(
+      "base64"
+    )}`;
+  }
+  for (const [name, value] of Object.entries(context.security?.apiKeys ?? {})) {
+    if (!hasHeader(mergedHeaders, name)) mergedHeaders[name] = value;
+  }
+  const serialized = serializeBody(built.body, binding?.bodyEncoding ?? null);
+  if (serialized.data !== void 0 && !hasHeader(mergedHeaders, "content-type")) {
+    const chosen = binding?.bodyEncoding === "multipart" ? void 0 : binding?.bodyMediaType ?? serialized.contentType;
+    if (chosen) mergedHeaders["Content-Type"] = chosen;
+  }
+  if (!hasHeader(mergedHeaders, "accept")) {
+    mergedHeaders.Accept = "application/json, text/plain;q=0.9, */*;q=0.8";
+  }
+  const loggedRequestBody = trimLargeValue(
+    describeBodyForLog(serialized.data),
+    MAX_LOGGED_BODY_CHARS
+  );
+  emitLog(context.onLog, {
+    id: newId(),
+    correlationId,
+    at: (/* @__PURE__ */ new Date()).toISOString(),
+    direction: "request",
+    protocol,
+    toolName: trimmedName,
+    operationId: trimmedName,
+    method: methodUpper,
+    path: resolved.path,
+    url: built.url,
+    requestHeaders: redactHeaders(mergedHeaders),
+    requestQuery: groupQuery(searchParams),
+    requestBody: loggedRequestBody.value,
+    truncated: loggedRequestBody.truncated,
+    meta: { stage: "before-upstream" }
+  });
+  try {
+    const response = await axios__default.default({
+      // A lowercase custom method (OpenAPI 3.2 additional operations) is passed
+      // through unchanged; axios forwards it to the HTTP layer verbatim.
+      method: resolved.method,
+      url: built.url,
+      params: searchParams,
+      // The builder already applied the style and explode rules together with
+      // percent-encoding. Re-serializing here would double-encode every value.
+      paramsSerializer: {
+        serialize: (params) => params instanceof URLSearchParams ? params.toString() : toSearchParams(params).toString()
+      },
+      ...serialized.data !== void 0 ? { data: serialized.data } : {},
+      headers: new axios.AxiosHeaders(mergedHeaders),
+      timeout: timeoutMs,
+      maxContentLength: MAX_CONTENT_BYTES,
+      maxBodyLength: MAX_CONTENT_BYTES,
+      maxRedirects: 5,
+      decompress: true,
+      // Read as text and parse manually: axios's own JSON parsing hides the raw
+      // payload, which is exactly what an operator needs when a response is
+      // malformed.
+      responseType: "text",
+      transformResponse: [(data2) => data2],
+      // Any status is a valid answer. Letting axios throw on 4xx would turn an
+      // upstream validation error into an opaque transport failure.
+      validateStatus: () => true,
+      ...context.signal ? { signal: context.signal } : {}
+    });
+    const responseHeaders = normalizeResponseHeaders(response.headers);
+    const rawHeaders = response.headers;
+    const contentType = String(rawHeaders?.["content-type"] ?? "");
+    let data = response.data;
+    if (typeof data === "string" && data.length > 0 && /\bjson\b/i.test(contentType)) {
+      try {
+        data = JSON.parse(data);
+      } catch {
+      }
+    }
+    const [forModel, forLog] = trimAtLimits(data, [
+      MAX_RESULT_CHARS,
+      MAX_LOGGED_BODY_CHARS
+    ]);
+    const durationMs = Date.now() - startedAt;
+    emitLog(context.onLog, {
+      id: newId(),
+      correlationId,
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      direction: "response",
+      protocol,
+      toolName: trimmedName,
+      operationId: trimmedName,
+      method: methodUpper,
+      path: resolved.path,
+      url: built.url,
+      status: response.status,
+      durationMs,
+      success: response.status < 400,
+      responseHeaders,
+      responseBody: forLog.value,
+      truncated: forLog.truncated
+    });
+    return {
+      status: response.status,
+      statusText: response.statusText ?? "",
+      headers: responseHeaders,
+      data: forModel.value,
+      truncated: forModel.truncated,
+      url: built.url,
+      method: methodUpper,
+      durationMs,
+      correlationId
+    };
+  } catch (error) {
+    const err = error;
+    const durationMs = Date.now() - startedAt;
+    const kind = classifyFailure(err, context.signal?.aborted === true);
+    const message = (() => {
+      switch (kind) {
+        case "timeout":
+          return `The upstream request timed out after ${timeoutMs}ms.`;
+        case "canceled":
+          return "The tool call was cancelled by the client.";
+        case "dns":
+          return `The upstream host could not be resolved: ${err.message}`;
+        case "connection-refused":
+          return `The upstream connection was refused or reset: ${err.message}`;
+        case "tls":
+          return `The upstream TLS handshake failed: ${err.message}`;
+        case "payload-too-large":
+          return `The request or response exceeded the ${MAX_CONTENT_BYTES}-byte limit.`;
+        default:
+          return `Upstream request failed: ${err.message}`;
+      }
+    })();
+    emitLog(context.onLog, {
+      id: newId(),
+      correlationId,
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      direction: "response",
+      protocol,
+      toolName: trimmedName,
+      operationId: trimmedName,
+      method: methodUpper,
+      path: resolved.path,
+      url: built.url,
+      durationMs,
+      success: false,
+      error: message,
+      meta: { failureKind: kind, code: err.code }
+    });
+    const wrapped = new Error(message, { cause: err });
+    if (kind === "canceled") wrapped.name = "AbortError";
+    wrapped.failureKind = kind;
+    throw wrapped;
+  }
+}
+var DEFAULT_PAGE_SIZE = 100;
+var MAX_PAGE_SIZE = 500;
+var NO_SERVICE_MESSAGE = "No MCP service is currently running: the specification was cleared or the service was stopped.";
+function requireSpec(specProvider) {
+  const spec = specProvider();
+  if (!spec) {
+    throw new types_js.McpError(types_js.ErrorCode.InternalError, NO_SERVICE_MESSAGE);
+  }
+  return spec;
+}
+function paginate(items, cursor, pageSize) {
+  let offset = 0;
+  if (cursor !== void 0) {
+    let decoded;
+    try {
+      decoded = Buffer.from(cursor, "base64url").toString("utf8");
+    } catch {
+      throw new types_js.McpError(types_js.ErrorCode.InvalidParams, "The cursor is malformed.");
+    }
+    const parsed = Number.parseInt(decoded, 10);
+    if (!Number.isInteger(parsed) || parsed < 0 || parsed > items.length) {
+      throw new types_js.McpError(
+        types_js.ErrorCode.InvalidParams,
+        "The cursor is no longer valid; restart the listing without a cursor."
+      );
+    }
+    offset = parsed;
+  }
+  const page = items.slice(offset, offset + pageSize);
+  const nextOffset = offset + page.length;
+  if (nextOffset < items.length) {
+    return {
+      page,
+      nextCursor: Buffer.from(String(nextOffset), "utf8").toString("base64url")
+    };
+  }
+  return { page };
+}
+function toolErrorResult(message) {
+  return {
+    isError: true,
+    content: [{ type: "text", text: message }]
+  };
+}
+function buildMcpServer(specProvider, contextProvider = () => ({}), options = {}) {
+  const pageSize = Math.min(
+    MAX_PAGE_SIZE,
+    Math.max(1, options.pageSize ?? DEFAULT_PAGE_SIZE)
+  );
+  const server = new index_js.Server(
+    {
+      name: options.name ?? "openapi-mcp",
+      version: options.version ?? "1.1.0"
+    },
+    {
+      // `listChanged` is intentionally not advertised: replacing the document
+      // terminates existing sessions instead of mutating them in place, so this
+      // server never emits list-changed notifications. Advertising a capability
+      // it does not honour would make well-behaved clients wait for updates
+      // that never arrive.
+      capabilities: {
+        tools: {},
+        prompts: {},
+        resources: {}
+      },
+      ...options.instructions ? { instructions: options.instructions } : {
+        instructions: "Tools are generated from an OpenAPI document. Call tools/list first; arguments marked with a location note map to path, query, header or cookie parameters. Tools tagged [PARTIAL SUPPORT] could not be mapped completely and may require additional free-form arguments."
+      }
+    }
+  );
+  server.setRequestHandler(types_js.ListToolsRequestSchema, async (request) => {
+    const spec = specProvider();
+    const all = spec ? getGeneratedTools(spec).tools : [];
+    const { page, nextCursor } = paginate(
+      all,
+      request.params?.cursor,
+      pageSize
+    );
+    return { tools: page, ...nextCursor ? { nextCursor } : {} };
+  });
+  server.setRequestHandler(types_js.CallToolRequestSchema, async (request, extra) => {
+    const spec = requireSpec(specProvider);
+    const name = request.params.name;
+    const known = getGeneratedTools(spec).bindings.some(
+      (binding) => binding.toolName === name
+    );
+    if (!known) {
+      throw new types_js.McpError(types_js.ErrorCode.InvalidParams, `Unknown tool "${name}".`);
+    }
+    const rawArgs = request.params.arguments;
+    if (rawArgs !== void 0 && (typeof rawArgs !== "object" || rawArgs === null || Array.isArray(rawArgs))) {
+      throw new types_js.McpError(
+        types_js.ErrorCode.InvalidParams,
+        "Tool arguments must be an object."
+      );
+    }
+    try {
+      const result = await executeToolCall(
+        spec,
+        name,
+        rawArgs ?? {},
+        {
+          ...contextProvider(),
+          // Propagating the abort signal is what makes client-side
+          // cancellation actually release the upstream connection.
+          signal: extra.signal
+        }
+      );
+      const payload = {
+        status: result.status,
+        url: result.url,
+        method: result.method,
+        durationMs: result.durationMs,
+        truncated: result.truncated,
+        headers: result.headers,
+        data: result.data
+      };
+      let text;
+      try {
+        text = JSON.stringify(payload, null, 2);
+      } catch {
+        text = JSON.stringify(
+          { ...payload, data: "[unserializable response body]" },
+          null,
+          2
+        );
+      }
+      return {
+        // An upstream 4xx/5xx is a tool execution failure, which MCP models as
+        // `isError` on a successful protocol response — the model is expected to
+        // read the status and decide what to do.
+        isError: result.status >= 400,
+        content: [{ type: "text", text }]
+      };
+    } catch (error) {
+      if (error instanceof types_js.McpError) throw error;
+      return toolErrorResult(
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+  });
+  server.setRequestHandler(types_js.ListPromptsRequestSchema, async (request) => {
+    const spec = specProvider();
+    const all = spec ? generatePrompts(spec) : [];
+    const { page, nextCursor } = paginate(
+      all,
+      request.params?.cursor,
+      pageSize
+    );
+    return { prompts: page, ...nextCursor ? { nextCursor } : {} };
+  });
+  server.setRequestHandler(types_js.GetPromptRequestSchema, async (request) => {
+    const spec = requireSpec(specProvider);
+    const name = request.params.name;
+    const rawArgs = request.params.arguments;
+    const args = rawArgs && typeof rawArgs === "object" && !Array.isArray(rawArgs) ? rawArgs : {};
+    const result = resolvePrompt(spec, name, args);
+    if (!result) {
+      throw new types_js.McpError(types_js.ErrorCode.InvalidParams, `Unknown prompt "${name}".`);
+    }
+    return result;
+  });
+  server.setRequestHandler(types_js.ListResourcesRequestSchema, async (request) => {
+    const spec = specProvider();
+    const all = spec ? generateResources() : [];
+    const { page, nextCursor } = paginate(
+      all,
+      request.params?.cursor,
+      pageSize
+    );
+    return { resources: page, ...nextCursor ? { nextCursor } : {} };
+  });
+  server.setRequestHandler(types_js.ListResourceTemplatesRequestSchema, async () => ({
+    resourceTemplates: []
+  }));
+  server.setRequestHandler(types_js.ReadResourceRequestSchema, async (request) => {
+    const spec = requireSpec(specProvider);
+    const uri = request.params.uri;
+    const resource = readResource(spec, uri);
+    if (!resource) {
+      throw new types_js.McpError(
+        types_js.ErrorCode.InvalidParams,
+        `Unknown resource URI: ${uri}`
+      );
+    }
+    return { contents: [resource] };
+  });
+  return server;
+}
+function divertConsoleToStderr() {
+  const original = {
+    log: console.log,
+    info: console.info,
+    debug: console.debug,
+    dir: console.dir
+  };
+  const toStderr = (...args) => {
+    console.error(...args);
+  };
+  console.log = toStderr;
+  console.info = toStderr;
+  console.debug = toStderr;
+  console.dir = toStderr;
+  return () => {
+    console.log = original.log;
+    console.info = original.info;
+    console.debug = original.debug;
+    console.dir = original.dir;
+  };
+}
+async function startStdioServer(spec, context = {}, options = {}) {
+  const restoreConsole = divertConsoleToStderr();
+  const upstreamLog = context.onLog;
+  const onLog = upstreamLog ? (entry) => {
+    try {
+      upstreamLog(entry);
+    } catch {
+    }
+  } : void 0;
+  const stdioContext = {
+    ...context,
+    protocol: "stdio",
+    ...onLog ? { onLog } : {}
+  };
+  const server = buildMcpServer(
+    () => spec,
+    () => stdioContext,
+    { }
+  );
+  const transport = new stdio_js.StdioServerTransport();
+  let settleClosed = () => {
+  };
+  const closed = new Promise((resolve) => {
+    settleClosed = resolve;
+  });
+  let shuttingDown = false;
+  const detachSignals = [];
+  const finish = () => {
+    if (shuttingDown) return;
+    shuttingDown = true;
+    for (const detach of detachSignals) detach();
+    restoreConsole();
+    settleClosed();
+  };
+  transport.onerror = (error) => {
+    console.error("[mcp:stdio] transport error:", error);
+  };
+  transport.onclose = () => {
+    finish();
+  };
+  await server.connect(transport);
+  if (options.handleSignals !== false) {
+    for (const signal of ["SIGINT", "SIGTERM"]) {
+      const handler = () => {
+        void server.close().catch(() => {
+        });
+      };
+      process.once(signal, handler);
+      detachSignals.push(() => process.removeListener(signal, handler));
+    }
+  }
+  return {
+    closed,
+    close: async () => {
+      try {
+        await server.close();
+      } finally {
+        finish();
+      }
+    }
+  };
+}
+var MCP_ROUTES = {
+  /** Streamable HTTP endpoint (POST/GET/DELETE). Preferred by modern clients. */
+  streamableHttp: "/mcp",
+  /** Legacy HTTP+SSE stream endpoint. */
+  sse: "/sse",
+  /** Legacy HTTP+SSE message endpoint. */
+  messages: "/mcp/messages"
+};
+var DEFAULT_MAX_SESSIONS = 64;
+var DEFAULT_SESSION_IDLE_MS = 10 * 60 * 1e3;
+var KEEPALIVE_INTERVAL_MS = 25 * 1e3;
+var SWEEP_INTERVAL_MS = 30 * 1e3;
+var DRAIN_TIMEOUT_MS = 5 * 1e3;
+function rpcError(code, message) {
+  return { jsonrpc: "2.0", id: null, error: { code, message } };
+}
+function readHeader(value) {
+  if (typeof value === "string" && value.trim()) return value.trim();
+  if (Array.isArray(value)) {
+    const first = value.find(
+      (entry) => typeof entry === "string" && entry.trim() !== ""
+    );
+    return first?.trim();
+  }
+  return void 0;
+}
+function readQueryValue(value) {
+  if (typeof value === "string") return value.trim();
+  if (Array.isArray(value)) {
+    const first = value.find(
+      (entry) => typeof entry === "string" && entry.trim() !== ""
+    );
+    return first?.trim() ?? "";
+  }
+  return "";
+}
+function describe2(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function asTransport(value) {
+  return value;
+}
+function asStreamableTransport(value) {
+  return value;
+}
+function asSseTransport(value) {
+  return value;
+}
+function chainOnClose(transport, handler) {
+  const previous = transport.onclose;
+  transport.onclose = () => {
+    try {
+      previous?.();
+    } finally {
+      handler();
+    }
+  };
+}
+function chainOnError(transport, handler) {
+  const previous = transport.onerror;
+  transport.onerror = (error) => {
+    try {
+      previous?.(error);
+    } finally {
+      handler(error);
+    }
+  };
+}
+function attachMcpRoutes(app, options) {
+  const { specProvider, contextProvider } = options;
+  const sessions = /* @__PURE__ */ new Map();
+  const closures = /* @__PURE__ */ new Map();
+  let pending = 0;
+  const guard = options.routeGuard ? [options.routeGuard] : [];
+  const maxSessions = Math.max(1, options.maxSessions ?? DEFAULT_MAX_SESSIONS);
+  const idleMs = Math.max(0, options.sessionIdleMs ?? DEFAULT_SESSION_IDLE_MS);
+  const legacyEnabled = options.enableLegacySse !== false;
+  const allowedOrigins = options.allowedOrigins?.filter(
+    (entry) => Boolean(entry) && entry !== "*"
+  ) ?? [];
+  const configuredHosts = options.allowedHosts?.filter(Boolean) ?? [];
+  const dnsProtection = allowedOrigins.length > 0 || configuredHosts.length > 0;
+  const allowedHosts = configuredHosts.length > 0 ? configuredHosts : allowedOrigins.map((origin) => {
+    try {
+      return new URL(origin).host;
+    } catch {
+      return "";
+    }
+  }).filter(Boolean);
+  const emit = (event) => {
+    try {
+      options.onEvent?.(event);
+    } catch {
+    }
+  };
+  function touch(sessionId) {
+    const record = sessions.get(sessionId);
+    if (record) record.lastActivityAt = Date.now();
+  }
+  async function destroySession(sessionId, reason) {
+    const record = sessions.get(sessionId);
+    if (!record || record.closing) return false;
+    record.closing = true;
+    sessions.delete(sessionId);
+    if (record.keepAlive) clearInterval(record.keepAlive);
+    const closure = (async () => {
+      try {
+        await record.transport.close();
+      } catch {
+      }
+      try {
+        await record.server.close();
+      } catch {
+      }
+    })();
+    closures.set(sessionId, closure);
+    try {
+      await closure;
+    } finally {
+      closures.delete(sessionId);
+    }
+    emit({ type: "session-closed", kind: record.kind, sessionId, reason });
+    return true;
+  }
+  function admit(kind, response) {
+    if (!specProvider()) {
+      emit({ type: "session-rejected", kind, reason: "no-active-spec" });
+      response.status(503).json(
+        rpcError(
+          -32e3,
+          "No MCP service is currently running. Load a specification and start the service first."
+        )
+      );
+      return false;
+    }
+    if (sessions.size + pending >= maxSessions) {
+      emit({ type: "session-rejected", kind, reason: "capacity" });
+      response.status(429).json(
+        rpcError(
+          -32e3,
+          `Too many concurrent MCP sessions (limit ${maxSessions}).`
+        )
+      );
+      return false;
+    }
+    return true;
+  }
+  async function openStreamableSession(request, response, body) {
+    const server = buildMcpServer(specProvider, contextProvider, {
+      });
+    const transport = new streamableHttp_js.StreamableHTTPServerTransport({
+      sessionIdGenerator: () => crypto.randomUUID(),
+      enableDnsRebindingProtection: dnsProtection,
+      ...allowedHosts.length > 0 ? { allowedHosts } : {},
+      ...allowedOrigins.length > 0 ? { allowedOrigins } : {},
+      onsessioninitialized: (sessionId) => {
+        const now = Date.now();
+        sessions.set(sessionId, {
+          sessionId,
+          kind: "streamable-http",
+          transport: asTransport(transport),
+          server,
+          createdAt: now,
+          lastActivityAt: now,
+          closing: false,
+          remoteAddress: request.ip,
+          userAgent: readHeader(request.headers["user-agent"])
+        });
+        emit({ type: "session-opened", kind: "streamable-http", sessionId });
+      },
+      onsessionclosed: (sessionId) => {
+        void destroySession(sessionId, "client-terminated");
+      }
+    });
+    const rollback = async () => {
+      await transport.close().catch(() => void 0);
+      await server.close().catch(() => void 0);
+    };
+    pending += 1;
+    try {
+      try {
+        await server.connect(asTransport(transport));
+      } catch (error) {
+        await rollback();
+        emit({
+          type: "session-error",
+          kind: "streamable-http",
+          reason: describe2(error)
+        });
+        if (!response.headersSent) {
+          response.status(500).json(rpcError(-32603, "Failed to initialize the MCP session."));
+        }
+        return false;
+      }
+      chainOnClose(transport, () => {
+        const sessionId = transport.sessionId;
+        if (sessionId) void destroySession(sessionId, "transport-closed");
+      });
+      chainOnError(transport, (error) => {
+        emit({
+          type: "session-error",
+          kind: "streamable-http",
+          sessionId: transport.sessionId,
+          reason: error.message
+        });
+      });
+      try {
+        await transport.handleRequest(request, response, body);
+      } catch (error) {
+        const sessionId = transport.sessionId;
+        if (sessionId && sessions.has(sessionId)) {
+          await destroySession(sessionId, "initialize-failed");
+        } else {
+          await rollback();
+        }
+        emit({
+          type: "session-error",
+          kind: "streamable-http",
+          sessionId,
+          reason: describe2(error)
+        });
+        if (!response.headersSent) {
+          response.status(500).json(rpcError(-32603, "Failed to handle the initialize request."));
+        }
+        return false;
+      }
+      if (!transport.sessionId) {
+        await rollback();
+        return false;
+      }
+      return true;
+    } finally {
+      pending -= 1;
+    }
+  }
+  const handleStreamable = async (request, response) => {
+    const sessionId = readHeader(request.headers["mcp-session-id"]);
+    try {
+      if (sessionId) {
+        const record = sessions.get(sessionId);
+        if (!record || record.kind !== "streamable-http" || record.closing) {
+          response.status(404).json(rpcError(-32001, "Unknown or expired MCP session."));
+          return;
+        }
+        touch(sessionId);
+        await asStreamableTransport(record.transport).handleRequest(
+          request,
+          response,
+          request.body
+        );
+        touch(sessionId);
+        return;
+      }
+      if (request.method !== "POST") {
+        response.status(400).json(
+          rpcError(
+            -32e3,
+            "Missing mcp-session-id header. Send an initialize request over POST first, or use the legacy /sse endpoint."
+          )
+        );
+        return;
+      }
+      if (!types_js.isInitializeRequest(request.body)) {
+        response.status(400).json(
+          rpcError(
+            -32e3,
+            "Missing mcp-session-id header and the payload is not an initialize request. The session may have expired; re-initialize before retrying."
+          )
+        );
+        return;
+      }
+      if (!admit("streamable-http", response)) return;
+      await openStreamableSession(request, response, request.body);
+    } catch (error) {
+      emit({
+        type: "session-error",
+        kind: "streamable-http",
+        sessionId,
+        reason: describe2(error)
+      });
+      if (!response.headersSent) {
+        response.status(500).json(
+          rpcError(-32603, "Internal error while handling the MCP request.")
+        );
+      } else {
+        response.end();
+      }
+    }
+  };
+  app.post(MCP_ROUTES.streamableHttp, ...guard, handleStreamable);
+  app.get(MCP_ROUTES.streamableHttp, ...guard, handleStreamable);
+  app.delete(MCP_ROUTES.streamableHttp, ...guard, handleStreamable);
+  if (legacyEnabled) {
+    app.get(MCP_ROUTES.sse, ...guard, async (request, response) => {
+      if (allowedOrigins.length > 0) {
+        const origin = readHeader(request.headers.origin);
+        if (origin && !allowedOrigins.includes(origin)) {
+          emit({ type: "session-rejected", kind: "sse", reason: "origin" });
+          response.status(403).json(rpcError(-32e3, "Origin is not allowed."));
+          return;
+        }
+      }
+      if (!admit("sse", response)) return;
+      const server = buildMcpServer(specProvider, contextProvider, {
+        });
+      const transport = new sse_js.SSEServerTransport(MCP_ROUTES.messages, response);
+      const sessionId = transport.sessionId;
+      const now = Date.now();
+      const record = {
+        sessionId,
+        kind: "sse",
+        transport: asTransport(transport),
+        server,
+        createdAt: now,
+        lastActivityAt: now,
+        closing: false,
+        remoteAddress: request.ip,
+        userAgent: readHeader(request.headers["user-agent"])
+      };
+      sessions.set(sessionId, record);
+      response.on(
+        "close",
+        () => void destroySession(sessionId, "client-closed")
+      );
+      response.on(
+        "error",
+        () => void destroySession(sessionId, "stream-error")
+      );
+      try {
+        await server.connect(asTransport(transport));
+      } catch (error) {
+        emit({
+          type: "session-error",
+          kind: "sse",
+          sessionId,
+          reason: describe2(error)
+        });
+        await destroySession(sessionId, "connect-failed");
+        if (!response.headersSent) {
+          response.status(500).json(rpcError(-32603, "Failed to initialize the MCP session."));
+        }
+        return;
+      }
+      chainOnClose(transport, () => {
+        void destroySession(sessionId, "transport-closed");
+      });
+      chainOnError(transport, (error) => {
+        emit({
+          type: "session-error",
+          kind: "sse",
+          sessionId,
+          reason: error.message
+        });
+      });
+      record.keepAlive = setInterval(() => {
+        if (response.writableEnded || response.destroyed) return;
+        response.write(": keepalive\n\n", (error) => {
+          if (error) void destroySession(sessionId, "keepalive-write-failed");
+        });
+      }, KEEPALIVE_INTERVAL_MS);
+      record.keepAlive.unref?.();
+      emit({ type: "session-opened", kind: "sse", sessionId });
+    });
+    app.post(MCP_ROUTES.messages, ...guard, async (request, response) => {
+      const sessionId = readQueryValue(request.query.sessionId) || readHeader(request.headers["mcp-session-id"]) || "";
+      if (!sessionId) {
+        response.status(400).json(rpcError(-32e3, "A sessionId query parameter is required."));
+        return;
+      }
+      const record = sessions.get(sessionId);
+      if (!record || record.kind !== "sse" || record.closing) {
+        response.status(404).json(rpcError(-32001, "Unknown or expired sessionId."));
+        return;
+      }
+      touch(sessionId);
+      try {
+        await asSseTransport(record.transport).handlePostMessage(
+          request,
+          response,
+          request.body
+        );
+      } catch (error) {
+        emit({
+          type: "session-error",
+          kind: "sse",
+          sessionId,
+          reason: describe2(error)
+        });
+        if (!response.headersSent) {
+          response.status(500).json(rpcError(-32603, "Failed to dispatch the MCP message."));
+        } else {
+          response.end();
+        }
+      }
+    });
+  }
+  let sweeper;
+  if (idleMs > 0) {
+    sweeper = setInterval(() => {
+      const cutoff = Date.now() - idleMs;
+      for (const record of [...sessions.values()]) {
+        if (record.lastActivityAt < cutoff) {
+          void destroySession(record.sessionId, "idle-timeout");
+        }
+      }
+    }, SWEEP_INTERVAL_MS);
+    sweeper.unref?.();
+  }
+  async function closeAll() {
+    await Promise.all(
+      [...sessions.keys()].map(
+        (sessionId) => destroySession(sessionId, "shutdown")
+      )
+    );
+    const deadline = Date.now() + DRAIN_TIMEOUT_MS;
+    while (closures.size > 0 && Date.now() < deadline) {
+      await Promise.race([
+        Promise.all([...closures.values()]),
+        new Promise((resolve) => setTimeout(resolve, 100).unref?.())
+      ]);
+    }
+  }
+  return {
+    activeSessionCount: () => sessions.size,
+    pendingSessionCount: () => pending,
+    listSessions: () => [...sessions.values()].map((record) => ({
+      sessionId: record.sessionId,
+      kind: record.kind,
+      createdAt: new Date(record.createdAt).toISOString(),
+      lastActivityAt: new Date(record.lastActivityAt).toISOString(),
+      remoteAddress: record.remoteAddress,
+      userAgent: record.userAgent
+    })),
+    closeSession: (sessionId, reason = "closed-by-operator") => destroySession(sessionId, reason),
+    closeAll,
+    dispose: async () => {
+      if (sweeper) clearInterval(sweeper);
+      sweeper = void 0;
+      await closeAll();
+    }
+  };
+}
+function attachSseRoutes(app, specProvider, contextProvider, routeGuard) {
+  const handle = attachMcpRoutes(app, {
+    specProvider,
+    contextProvider,
+    ...routeGuard ? { routeGuard } : {}
+  });
+  return {
+    activeSessionCount: handle.activeSessionCount,
+    closeAll: handle.closeAll
+  };
+}
+function safeCompare(left, right) {
+  const digest = (value) => crypto.createHash("sha256").update(value, "utf8").digest();
+  return crypto.timingSafeEqual(digest(left), digest(right));
+}
+function readBearerToken(header) {
+  if (!header) return void 0;
+  const match = /^bearer\s+(.+)$/i.exec(header.trim());
+  return match?.[1]?.trim() || void 0;
+}
+function firstHeaderValue(value) {
+  if (Array.isArray(value)) return value[0];
+  return value;
+}
+function createAuthMiddleware(apiKey) {
+  if (apiKey !== void 0 && apiKey.trim().length === 0) {
+    throw new Error(
+      "The configured API key is empty. Omit it entirely to run without authentication, or supply a non-empty value."
+    );
+  }
+  const expected = apiKey;
+  return (request, response, next) => {
+    if (!expected) return next();
+    if (request.method === "OPTIONS") return next();
+    const presented = firstHeaderValue(request.headers["x-api-key"]) ?? readBearerToken(firstHeaderValue(request.headers.authorization));
+    if (!presented || !safeCompare(presented, expected)) {
+      response.status(401).set("WWW-Authenticate", 'Bearer realm="openapi-mcp"').set("Cache-Control", "no-store").json({ error: "Unauthorized" });
+      return;
+    }
+    next();
+  };
+}
+var STATE_FILE_MODE = 384;
+var STATE_DIR_MODE = 448;
+var STATE_FILE_NAME = "state.json";
+var APP_DIR_NAME = "openapi-mcp";
+function resolveStateFilePath() {
+  const explicit = process.env.OPENAPI_MCP_STATE_FILE?.trim();
+  if (explicit) return path__default.default.resolve(explicit);
+  const xdg = process.env.XDG_CONFIG_HOME?.trim();
+  const base = xdg ? path__default.default.resolve(xdg) : process.platform === "win32" ? path__default.default.join(process.env.APPDATA ?? os__default.default.homedir(), "") : path__default.default.join(os__default.default.homedir(), ".config");
+  return path__default.default.join(base, APP_DIR_NAME, STATE_FILE_NAME);
+}
+function describe3(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function toError(error) {
+  return error instanceof Error ? error : new Error(String(error));
+}
+function safeReviver(key, value) {
+  if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    return void 0;
+  }
+  return value;
+}
+function saveState(obj, stateFilePath = resolveStateFilePath()) {
+  const dir = path__default.default.dirname(stateFilePath);
+  let tempFile;
+  try {
+    fs2__default.default.mkdirSync(dir, { recursive: true, mode: STATE_DIR_MODE });
+    const payload = JSON.stringify(obj, null, 2);
+    tempFile = path__default.default.join(
+      dir,
+      `.${path__default.default.basename(stateFilePath)}.${process.pid}.${Date.now()}.tmp`
+    );
+    const handle = fs2__default.default.openSync(tempFile, "wx", STATE_FILE_MODE);
+    try {
+      fs2__default.default.writeFileSync(handle, payload, "utf8");
+      fs2__default.default.fsyncSync(handle);
+    } finally {
+      fs2__default.default.closeSync(handle);
+    }
+    fs2__default.default.renameSync(tempFile, stateFilePath);
+    tempFile = void 0;
+    try {
+      fs2__default.default.chmodSync(stateFilePath, STATE_FILE_MODE);
+    } catch {
+    }
+    return { ok: true, path: stateFilePath };
+  } catch (error) {
+    console.warn(
+      `[config-store] Failed to persist state to ${stateFilePath}: ${describe3(error)}`
+    );
+    return { ok: false, path: stateFilePath, error: toError(error) };
+  } finally {
+    if (tempFile) {
+      try {
+        fs2__default.default.unlinkSync(tempFile);
+      } catch {
+      }
+    }
+  }
+}
+function quarantine(stateFilePath) {
+  const backup = `${stateFilePath}.corrupt-${Date.now()}`;
+  try {
+    fs2__default.default.renameSync(stateFilePath, backup);
+    console.warn(`[config-store] Moved unreadable state file to ${backup}`);
+  } catch (error) {
+    console.warn(
+      `[config-store] Could not quarantine ${stateFilePath}: ${describe3(error)}`
+    );
+  }
+}
+function loadState(stateFilePath = resolveStateFilePath()) {
+  let raw;
+  try {
+    raw = fs2__default.default.readFileSync(stateFilePath, "utf8");
+  } catch (error) {
+    const code = error.code;
+    if (code !== "ENOENT") {
+      console.warn(
+        `[config-store] Failed to read state from ${stateFilePath}: ${describe3(error)}`
+      );
+    }
+    return {};
+  }
+  if (raw.trim() === "") return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(raw, safeReviver);
+  } catch (error) {
+    console.warn(
+      `[config-store] State file is not valid JSON: ${describe3(error)}`
+    );
+    quarantine(stateFilePath);
+    return {};
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    console.warn("[config-store] State file does not contain a JSON object.");
+    quarantine(stateFilePath);
+    return {};
+  }
+  return parsed;
+}
+function clearState(stateFilePath = resolveStateFilePath()) {
+  try {
+    fs2__default.default.rmSync(stateFilePath, { force: true });
+    return { ok: true, path: stateFilePath };
+  } catch (error) {
+    console.warn(
+      `[config-store] Failed to clear state at ${stateFilePath}: ${describe3(error)}`
+    );
+    return { ok: false, path: stateFilePath, error: toError(error) };
+  }
+}
+
+// src/runtime/service-registry.ts
+var ServiceRegistry = class {
+  records = /* @__PURE__ */ new Map();
+  upsert(record) {
+    this.records.set(record.id, record);
+  }
+  list() {
+    return Array.from(this.records.values()).sort(
+      (left, right) => left.createdAt.localeCompare(right.createdAt)
+    );
+  }
+  get(id) {
+    return this.records.get(id);
+  }
+  remove(id) {
+    return this.records.delete(id);
+  }
+  clear() {
+    this.records.clear();
+  }
+  start(id) {
+    const current = this.records.get(id);
+    if (!current) return void 0;
+    const next = {
+      ...current,
+      status: "running",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastError: void 0
+    };
+    this.records.set(id, next);
+    return next;
+  }
+  stop(id) {
+    const current = this.records.get(id);
+    if (!current) return void 0;
+    const next = {
+      ...current,
+      status: "stopped",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.records.set(id, next);
+    return next;
+  }
+  fail(id, message) {
+    const current = this.records.get(id);
+    if (!current) return void 0;
+    const next = {
+      ...current,
+      status: "error",
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastError: {
+        message,
+        at: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    };
+    this.records.set(id, next);
+    return next;
+  }
+};
+
+// src/server/admin-server.ts
+var MODULE_DIR = path__default.default.dirname(url.fileURLToPath(importMetaUrl));
+var STATIC_DIR = [
+  path__default.default.resolve(MODULE_DIR, "webui"),
+  path__default.default.resolve(MODULE_DIR, "../webui"),
+  path__default.default.resolve(MODULE_DIR, "../../webui")
+].find((candidate) => fs2__default.default.existsSync(path__default.default.join(candidate, "index.html"))) ?? path__default.default.resolve(MODULE_DIR, "webui");
+var INDEX_HTML = path__default.default.join(STATIC_DIR, "index.html");
+var MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
+var JSON_BODY_LIMIT = "20mb";
+var DEFAULT_MAX_LOG_ENTRIES = 200;
+var PERSIST_DEBOUNCE_MS = 250;
+var REQUEST_TIMEOUT_MS = 3e5;
+var ENDPOINTS = {
+  streamableHttp: MCP_ROUTES.streamableHttp,
+  sse: MCP_ROUTES.sse,
+  messages: MCP_ROUTES.messages,
+  stdioSupported: true
+};
+function readParam(value) {
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+  }
+  if (Array.isArray(value)) {
+    for (const candidate of value) {
+      if (typeof candidate === "string" && candidate.trim().length > 0) {
+        return candidate.trim();
+      }
+    }
+  }
+  return null;
+}
+function newLogId() {
+  try {
+    return crypto.randomUUID();
+  } catch {
+    return `log_${Date.now()}_${Math.random().toString(16).slice(2)}`;
+  }
+}
+function stripBom(text) {
+  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
+}
+function shouldParseAsYaml(raw) {
+  const trimmed = stripBom(raw).trimStart();
+  return !(trimmed.startsWith("{") || trimmed.startsWith("["));
+}
+async function parseWithFallback(raw, preferYaml) {
+  try {
+    return {
+      spec: await parseSpecContent(raw, preferYaml),
+      isYaml: preferYaml
+    };
+  } catch (firstError) {
+    try {
+      return {
+        spec: await parseSpecContent(raw, !preferYaml),
+        isYaml: !preferYaml
+      };
+    } catch {
+      throw firstError;
+    }
+  }
+}
+function computeServiceId(title, version, rawText) {
+  const digest = crypto.createHash("sha256").update(`${title}\0${version}\0${rawText}`).digest("hex").slice(0, 12);
+  return `svc_${digest}`;
+}
+function buildCorsOptions(config) {
+  const allowed = config.allowedOrigins;
+  if (!allowed || allowed.length === 0) return { origin: false };
+  if (allowed.includes("*")) return { origin: true, credentials: false };
+  const allowSet = new Set(allowed);
+  return {
+    origin(origin, callback) {
+      if (!origin || allowSet.has(origin)) {
+        callback(null, true);
+        return;
+      }
+      callback(null, false);
+    },
+    credentials: true
+  };
+}
+function toMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function formatIssue(issue) {
+  const method = issue.method ? `${issue.method.toUpperCase()} ` : "";
+  return `${method}${issue.path}: ${issue.message}`;
+}
+var promptCache = /* @__PURE__ */ new WeakMap();
+var resourceCache = /* @__PURE__ */ new WeakMap();
+function cachedPrompts(spec) {
+  const key = spec;
+  const hit = promptCache.get(key);
+  if (hit) return hit;
+  const value = generatePrompts(spec);
+  promptCache.set(key, value);
+  return value;
+}
+function cachedResources(spec) {
+  const key = spec;
+  const hit = resourceCache.get(key);
+  if (hit) return hit;
+  const value = generateResources();
+  resourceCache.set(key, value);
+  return value;
+}
+async function startAdminServer(config) {
+  const app = express2__default.default();
+  const auth = createAuthMiddleware(config.apiKey);
+  const registry = new ServiceRegistry();
+  const persistEnabled = config.persistState !== false;
+  const maxLogEntries = Math.max(
+    20,
+    config.maxLogEntries ?? DEFAULT_MAX_LOG_ENTRIES
+  );
+  const state = {
+    spec: null,
+    baseUrlOverride: config.baseUrlOverride,
+    specSource: config.specPath ? "startup-file" : "runtime"
+  };
+  const logEntries = [];
+  let activeServiceId = null;
+  let activeSpecRawText = "";
+  let activeSpecIsYaml = false;
+  let closed = false;
+  app.disable("x-powered-by");
+  app.use(cors__default.default(buildCorsOptions(config)));
+  app.use(express2__default.default.json({ limit: JSON_BODY_LIMIT }));
+  function addLog(entry) {
+    logEntries.unshift({
+      ...entry,
+      serviceId: entry.serviceId ?? activeServiceId ?? void 0
+    });
+    if (logEntries.length > maxLogEntries) {
+      logEntries.length = maxLogEntries;
+    }
+  }
+  function addInternalLog(event, success, serviceId, extra, error) {
+    addLog({
+      id: newLogId(),
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      direction: "internal",
+      protocol: void 0,
+      success,
+      serviceId,
+      error,
+      meta: { event, ...extra }
+    });
+  }
+  function isActive() {
+    if (!state.spec || !activeServiceId) return false;
+    return registry.get(activeServiceId)?.status === "running";
+  }
+  const contextProvider = () => ({
+    baseUrlOverride: state.baseUrlOverride,
+    upstreamHeaders: config.upstreamHeaders,
+    requestTimeoutMs: config.requestTimeoutMs,
+    onLog: addLog
+  });
+  const mcp = attachMcpRoutes(app, {
+    specProvider: () => isActive() ? state.spec : null,
+    contextProvider,
+    ...config.apiKey ? { routeGuard: auth } : {},
+    ...config.allowedOrigins?.length ? { allowedOrigins: config.allowedOrigins } : {},
+    ...config.allowedHosts?.length ? { allowedHosts: config.allowedHosts } : {},
+    onEvent(event) {
+      addInternalLog(
+        event.type,
+        event.type !== "session-error",
+        void 0,
+        // Spread conditionally: several event types genuinely carry no session
+        // id or reason, and writing explicit undefined into the log record made
+        // the viewer render empty fields for every rejection.
+        {
+          transport: event.kind,
+          ...event.sessionId ? { sessionId: event.sessionId } : {},
+          ...event.reason ? { reason: event.reason } : {}
+        }
+      );
+    }
+  });
+  async function closeSessions(reason) {
+    const before = mcp.activeSessionCount();
+    if (before === 0) return;
+    await mcp.closeAll();
+    addInternalLog("sessions-closed", true, void 0, {
+      reason,
+      closed: before
+    });
+  }
+  let persistTimer;
+  let persistPending = null;
+  function flushState() {
+    if (persistTimer) {
+      clearTimeout(persistTimer);
+      persistTimer = void 0;
+    }
+    const payload = persistPending;
+    persistPending = null;
+    if (!payload) return;
+    let result;
+    try {
+      result = saveState(
+        {
+          // Explicit null rather than undefined: JSON.stringify drops undefined
+          // keys, making "no specification" indistinguishable from a truncated
+          // state file on the next read.
+          specRaw: payload.specRaw,
+          specIsYaml: payload.specIsYaml,
+          baseUrlOverride: state.baseUrlOverride ?? null
+        },
+        config.stateFilePath
+      );
+    } catch (error) {
+      addInternalLog(
+        "state-persist-failed",
+        false,
+        void 0,
+        void 0,
+        toMessage(error)
+      );
+      return;
+    }
+    if (!result.ok) {
+      addInternalLog(
+        "state-persist-failed",
+        false,
+        void 0,
+        void 0,
+        `${result.path}: ${result.error?.message ?? "unknown error"}`
+      );
+      return;
+    }
+    addInternalLog("state-persisted", true, void 0, { path: result.path });
+  }
+  function queueState(specRaw, specIsYaml) {
+    if (!persistEnabled) return;
+    persistPending = { specRaw, specIsYaml };
+    if (persistTimer) return;
+    persistTimer = setTimeout(() => {
+      persistTimer = void 0;
+      flushState();
+    }, PERSIST_DEBOUNCE_MS);
+    persistTimer.unref?.();
+  }
+  function persistSpec(rawText, isYaml) {
+    queueState(rawText, isYaml);
+  }
+  function persistConfig() {
+    queueState(activeSpecRawText || null, activeSpecIsYaml);
+  }
+  function applySpec(spec, rawText, isYaml, source, writeThrough = true) {
+    const generated = getGeneratedTools(spec);
+    const prompts = cachedPrompts(spec);
+    const resources = cachedResources(spec);
+    const previousServiceId = activeServiceId;
+    state.spec = spec;
+    state.specSource = source;
+    activeSpecRawText = rawText;
+    activeSpecIsYaml = isYaml;
+    const title = spec.info?.title ?? "Untitled API";
+    const version = spec.info?.version ?? "0.0.0";
+    const serviceId = computeServiceId(title, version, rawText);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const existing = registry.get(serviceId);
+    registry.upsert({
+      id: serviceId,
+      createdAt: existing?.createdAt ?? now,
+      updatedAt: now,
+      // Reloading an identical document must not silently resurrect a service
+      // the operator deliberately stopped.
+      status: existing?.status ?? "running",
+      title,
+      version,
+      source,
+      toolCount: generated.tools.length,
+      promptCount: prompts.length,
+      resourceCount: resources.length,
+      endpoint: { ...ENDPOINTS }
+    });
+    for (const id of registry.list().map((service) => service.id)) {
+      if (id !== serviceId) registry.remove(id);
+    }
+    activeServiceId = serviceId;
+    if (writeThrough) persistSpec(rawText, isYaml);
+    if (previousServiceId && previousServiceId !== serviceId) {
+      void closeSessions("specification-replaced").catch((error) => {
+        addInternalLog(
+          "sessions-close-failed",
+          false,
+          serviceId,
+          void 0,
+          toMessage(error)
+        );
+      });
+    }
+    addInternalLog("spec-applied", true, serviceId, {
+      source,
+      toolCount: generated.tools.length,
+      promptCount: prompts.length,
+      resourceCount: resources.length,
+      degradedToolCount: generated.bindings.filter((b) => !b.fullySupported).length
+    });
+    return {
+      serviceId,
+      toolCount: generated.tools.length,
+      promptCount: prompts.length,
+      resourceCount: resources.length,
+      degradedTools: generated.bindings.filter((binding) => !binding.fullySupported).map((binding) => binding.toolName),
+      issues: generated.issues.map(formatIssue)
+    };
+  }
+  async function clearSpec() {
+    state.spec = null;
+    state.specSource = "runtime";
+    activeSpecRawText = "";
+    activeSpecIsYaml = false;
+    activeServiceId = null;
+    registry.clear();
+    if (persistEnabled) {
+      persistPending = null;
+      if (persistTimer) {
+        clearTimeout(persistTimer);
+        persistTimer = void 0;
+      }
+      const result = clearState(config.stateFilePath);
+      if (!result.ok) {
+        addInternalLog(
+          "state-clear-failed",
+          false,
+          void 0,
+          void 0,
+          `${result.path}: ${result.error?.message ?? "unknown error"}`
+        );
+      }
+    }
+    await closeSessions("specification-cleared");
+    addInternalLog("spec-cleared", true);
+  }
+  async function bootstrap() {
+    if (config.specPath) {
+      const raw = stripBom(await fs2__default.default.promises.readFile(config.specPath, "utf8"));
+      const parsed = await parseWithFallback(raw, shouldParseAsYaml(raw));
+      applySpec(parsed.spec, raw, parsed.isYaml, "startup-file", false);
+      return;
+    }
+    if (!persistEnabled) return;
+    const saved = loadState(config.stateFilePath);
+    if (typeof saved.baseUrlOverride === "string" && !state.baseUrlOverride) {
+      state.baseUrlOverride = saved.baseUrlOverride;
+    }
+    if (typeof saved.specRaw === "string" && saved.specRaw.trim()) {
+      const raw = stripBom(saved.specRaw);
+      try {
+        const parsed = await parseWithFallback(
+          raw,
+          typeof saved.specIsYaml === "boolean" ? saved.specIsYaml : shouldParseAsYaml(raw)
+        );
+        applySpec(parsed.spec, raw, parsed.isYaml, "runtime", false);
+      } catch (error) {
+        addInternalLog(
+          "spec-restore-failed",
+          false,
+          void 0,
+          void 0,
+          `Persisted specification could not be restored: ${toMessage(error)}`
+        );
+      }
+    }
+  }
+  await bootstrap();
+  function buildStatus() {
+    const generated = state.spec ? getGeneratedTools(state.spec) : { tools: [], bindings: [], issues: [] };
+    const prompts = state.spec ? cachedPrompts(state.spec) : [];
+    const resources = state.spec ? cachedResources(state.spec) : [];
+    return {
+      specLoaded: Boolean(state.spec),
+      specSource: state.specSource ?? null,
+      serviceId: activeServiceId,
+      active: isActive(),
+      title: state.spec?.info?.title ?? null,
+      version: state.spec?.info?.version ?? null,
+      baseUrl: state.baseUrlOverride ?? state.spec?.servers?.[0]?.url ?? null,
+      toolCount: generated.tools.length,
+      degradedToolCount: generated.bindings.filter(
+        (binding) => !binding.fullySupported
+      ).length,
+      promptCount: prompts.length,
+      resourceCount: resources.length,
+      activeSessions: mcp.activeSessionCount(),
+      pendingSessions: mcp.pendingSessionCount(),
+      //Object literal may only specify known properties, and 'pendingSessions' does not exist in type 'AdminStatus'.ts(2353)
+      // Surfaced so the web UI can warn that changes will not survive a
+      // restart; previously this was silently invisible to the operator.
+      persistEnabled,
+      authRequired: Boolean(config.apiKey),
+      services: registry.list(),
+      issues: generated.issues.map(formatIssue),
+      lastUpdatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+  }
+  const upload = multer__default.default({
+    storage: multer__default.default.memoryStorage(),
+    limits: { fileSize: MAX_UPLOAD_BYTES, files: 1 }
+  });
+  app.post(
+    "/api/spec/upload",
+    auth,
+    upload.single("file"),
+    async (request, response) => {
+      try {
+        if (!request.file) {
+          response.status(400).json({ error: "No file was uploaded." });
+          return;
+        }
+        const rawText = stripBom(request.file.buffer.toString("utf8"));
+        if (!rawText.trim()) {
+          response.status(400).json({ error: "The uploaded file is empty." });
+          return;
+        }
+        const parsed = await parseWithFallback(
+          rawText,
+          shouldParseAsYaml(rawText)
+        );
+        const result = applySpec(parsed.spec, rawText, parsed.isYaml, "upload");
+        response.json({ ok: true, result, ...buildStatus() });
+      } catch (error) {
+        response.status(400).json({ error: toMessage(error) });
+      }
+    }
+  );
+  app.post("/api/spec/paste", auth, async (request, response) => {
+    try {
+      const content = request.body?.content;
+      if (typeof content !== "string" || !content.trim()) {
+        response.status(400).json({ error: "content must be a non-empty string." });
+        return;
+      }
+      const raw = stripBom(content);
+      const isYamlHint = request.body.isYaml;
+      const preferYaml = typeof isYamlHint === "boolean" ? isYamlHint : shouldParseAsYaml(raw);
+      const parsed = await parseWithFallback(raw, preferYaml);
+      const result = applySpec(parsed.spec, raw, parsed.isYaml, "paste");
+      response.json({ ok: true, result, ...buildStatus() });
+    } catch (error) {
+      response.status(400).json({ error: toMessage(error) });
+    }
+  });
+  app.post("/api/spec/clear", auth, async (_request, response) => {
+    await clearSpec();
+    response.json({ ok: true, ...buildStatus() });
+  });
+  app.get("/api/spec/raw", auth, (_request, response) => {
+    response.json({
+      content: activeSpecRawText,
+      isYaml: activeSpecIsYaml,
+      source: state.specSource ?? null
+    });
+  });
+  app.post("/api/config/base-url", auth, (request, response) => {
+    const value = request.body?.baseUrl;
+    if (value === null || value === void 0 || value === "") {
+      state.baseUrlOverride = void 0;
+      persistConfig();
+      addInternalLog("base-url-cleared", true);
+      response.json({ ok: true, ...buildStatus() });
+      return;
+    }
+    if (typeof value !== "string") {
+      response.status(400).json({ error: "baseUrl must be a string or null." });
+      return;
+    }
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(value);
+    } catch {
+      response.status(400).json({ error: "baseUrl is not a valid URL." });
+      return;
+    }
+    if (parsedUrl.protocol !== "http:" && parsedUrl.protocol !== "https:") {
+      response.status(400).json({ error: "baseUrl must use the http or https scheme." });
+      return;
+    }
+    state.baseUrlOverride = value;
+    persistConfig();
+    addInternalLog("base-url-updated", true, void 0, { baseUrl: value });
+    response.json({ ok: true, ...buildStatus() });
+  });
+  app.get("/api/status", auth, (_request, response) => {
+    response.json(buildStatus());
+  });
+  app.get("/api/tools", auth, (_request, response) => {
+    if (!state.spec) {
+      response.json({ tools: [], bindings: [], issues: [] });
+      return;
+    }
+    const generated = getGeneratedTools(state.spec);
+    response.json({
+      tools: generated.tools,
+      bindings: generated.bindings.map((binding) => ({
+        toolName: binding.toolName,
+        method: binding.method,
+        isStandardMethod: binding.isStandardMethod,
+        path: binding.path,
+        bodyKey: binding.bodyKey,
+        bodyMediaType: binding.bodyMediaType,
+        bodyRequired: binding.bodyRequired,
+        fullySupported: binding.fullySupported,
+        degradationReasons: binding.degradationReasons,
+        omittedParameters: binding.omittedParameters,
+        // Projected because the web UI renders it; omitting it silently blanked
+        // the multipart and serialisation notes.
+        usageNotes: binding.usageNotes,
+        arguments: binding.arguments.map((argument) => ({
+          key: argument.key,
+          name: argument.name,
+          in: argument.in,
+          required: argument.parameter.required === true
+        }))
+      })),
+      issues: generated.issues.map(formatIssue)
+    });
+  });
+  app.get("/api/prompts", auth, (_request, response) => {
+    response.json({ prompts: state.spec ? cachedPrompts(state.spec) : [] });
+  });
+  app.get("/api/resources", auth, (_request, response) => {
+    response.json({
+      resources: state.spec ? cachedResources(state.spec) : []
+    });
+  });
+  app.get("/api/servers", auth, (_request, response) => {
+    response.json({
+      services: registry.list(),
+      active: isActive(),
+      endpoints: { ...ENDPOINTS }
+    });
+  });
+  app.get("/api/sessions", auth, (_request, response) => {
+    response.json({
+      sessions: mcp.listSessions(),
+      total: mcp.activeSessionCount(),
+      pending: mcp.pendingSessionCount()
+    });
+  });
+  app.delete("/api/sessions/:id", auth, async (request, response) => {
+    const id = readParam(request.params.id);
+    if (!id) {
+      response.status(400).json({ error: "A session id is required." });
+      return;
+    }
+    const removed = await mcp.closeSession(id, "closed-by-operator");
+    if (!removed) {
+      response.status(404).json({ error: "Session not found." });
+      return;
+    }
+    response.json({ ok: true, sessions: mcp.listSessions() });
+  });
+  app.post("/api/servers/:id/start", auth, (request, response) => {
+    const id = readParam(request.params.id);
+    if (!id) {
+      response.status(400).json({ error: "A service id is required." });
+      return;
+    }
+    if (!registry.get(id)) {
+      response.status(404).json({ error: "Service not found." });
+      return;
+    }
+    if (!state.spec) {
+      response.status(409).json({ error: "No specification is loaded; nothing to start." });
+      return;
+    }
+    registry.start(id);
+    activeServiceId = id;
+    addInternalLog("service-started", true, id);
+    response.json({ ok: true, ...buildStatus() });
+  });
+  app.post("/api/servers/:id/stop", auth, async (request, response) => {
+    const id = readParam(request.params.id);
+    if (!id) {
+      response.status(400).json({ error: "A service id is required." });
+      return;
+    }
+    if (!registry.get(id)) {
+      response.status(404).json({ error: "Service not found." });
+      return;
+    }
+    registry.stop(id);
+    await closeSessions("service-stopped");
+    addInternalLog("service-stopped", true, id);
+    response.json({ ok: true, ...buildStatus() });
+  });
+  app.get("/api/logs", auth, (request, response) => {
+    const rawLimit = Number(request.query.limit);
+    const limit = Number.isFinite(rawLimit) ? Math.min(Math.max(Math.trunc(rawLimit), 1), maxLogEntries) : maxLogEntries;
+    const direction = readParam(request.query.direction);
+    const filtered = direction ? logEntries.filter((entry) => entry.direction === direction) : logEntries;
+    response.json({
+      logs: filtered.slice(0, limit),
+      total: filtered.length,
+      capacity: maxLogEntries
+    });
+  });
+  app.post("/api/logs/clear", auth, (_request, response) => {
+    logEntries.length = 0;
+    response.json({ ok: true, logs: [] });
+  });
+  app.post("/api/debug/call-tool", auth, async (request, response) => {
+    if (!state.spec) {
+      response.status(409).json({ error: "No specification is loaded." });
+      return;
+    }
+    const body = request.body ?? {};
+    const toolName = body.toolName;
+    const args = body.arguments;
+    if (typeof toolName !== "string" || !toolName.trim()) {
+      response.status(400).json({ error: "toolName must be a non-empty string." });
+      return;
+    }
+    if (args !== void 0 && (typeof args !== "object" || args === null || Array.isArray(args))) {
+      response.status(400).json({ error: "arguments must be an object when provided." });
+      return;
+    }
+    const controller = new AbortController();
+    const raw = response;
+    const onClientGone = () => {
+      if (!raw.writableEnded) {
+        controller.abort(
+          new DOMException("Client disconnected.", "AbortError")
+        );
+      }
+    };
+    raw.on("close", onClientGone);
+    try {
+      const result = await executeToolCall(
+        state.spec,
+        toolName.trim(),
+        args ?? {},
+        {
+          ...contextProvider(),
+          signal: controller.signal,
+          onLog(entry) {
+            addLog({
+              ...entry,
+              protocol: void 0,
+              meta: { ...entry.meta, debug: true }
+            });
+          }
+        }
+      );
+      response.json({
+        ok: true,
+        // Surfaced as data rather than enforced as a gate, so the operator knows
+        // the result came from a direct upstream call while the service was down.
+        serviceRunning: isActive(),
+        result
+      });
+    } catch (error) {
+      const aborted = isAbortError(error);
+      if (aborted && raw.destroyed) {
+        addLog({
+          id: newId(),
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          direction: "response",
+          toolName: toolName.trim(),
+          success: false,
+          error: "The client disconnected before the upstream call completed.",
+          meta: { debug: true, cancelled: true }
+        });
+        return;
+      }
+      if (aborted) {
+        if (!response.headersSent) {
+          response.status(504).json({
+            error: "The upstream call was aborted before it completed."
+          });
+        }
+        return;
+      }
+      if (!response.headersSent) {
+        response.status(400).json({ error: toMessage(error) });
+      }
+    } finally {
+      raw.off("close", onClientGone);
+    }
+  });
+  app.use(
+    express2__default.default.static(STATIC_DIR, {
+      index: false,
+      dotfiles: "ignore",
+      fallthrough: true
+    })
+  );
+  app.get(/^\/(?!api\/|mcp|sse).*/, (_request, response, next) => {
+    response.sendFile(INDEX_HTML, (error) => {
+      if (error) next(error);
+    });
+  });
+  app.use((_request, response) => {
+    response.status(404).json({ error: "Not found." });
+  });
+  app.use(
+    (error, _request, response, _next) => {
+      const code = error?.code;
+      if (code === "LIMIT_FILE_SIZE") {
+        response.status(413).json({ error: "The uploaded file exceeds the size limit." });
+        return;
+      }
+      if (code === "LIMIT_FILE_COUNT" || code === "LIMIT_UNEXPECTED_FILE") {
+        response.status(400).json({ error: 'Exactly one file field named "file" is expected.' });
+        return;
+      }
+      console.error("[admin] Unhandled error:", error);
+      if (response.headersSent) {
+        response.end();
+        return;
+      }
+      response.status(500).json({ error: "Internal server error." });
+    }
+  );
+  const server = http.createServer(app);
+  server.keepAliveTimeout = 76e3;
+  server.headersTimeout = 8e4;
+  server.requestTimeout = REQUEST_TIMEOUT_MS;
+  await new Promise((resolve, reject) => {
+    const onError = (error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("listening", onListening);
+    server.once("error", onError);
+    server.listen(config.port, config.host ?? "127.0.0.1");
+  });
+  const address = server.address();
+  const boundPort = address && typeof address === "object" ? address.port : config.port;
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    flushState();
+    await mcp.dispose();
+    await new Promise((resolve) => {
+      server.close(() => resolve());
+      server.closeIdleConnections?.();
+    });
+  };
+  return { app, server, port: boundPort, close };
+}
+
+exports.assertUniqueOperationIds = assertUniqueOperationIds;
+exports.attachSseRoutes = attachSseRoutes;
+exports.buildBindingIndex = buildBindingIndex;
+exports.buildMcpServer = buildMcpServer;
+exports.buildRequest = buildRequest;
+exports.collectOperationParameters = collectOperationParameters;
+exports.createAuthMiddleware = createAuthMiddleware;
+exports.effectiveExplode = effectiveExplode;
+exports.effectiveStyle = effectiveStyle;
+exports.ensureUniqueName = ensureUniqueName;
+exports.executeToolCall = executeToolCall;
+exports.extractPathTemplateVariables = extractPathTemplateVariables;
+exports.findDuplicateOperationIds = findDuplicateOperationIds;
+exports.findOperationById = findOperationById;
+exports.generatePrompts = generatePrompts;
+exports.generateResources = generateResources;
+exports.generateTools = generateTools;
+exports.generateToolsDetailed = generateToolsDetailed;
+exports.iterateOperations = iterateOperations;
+exports.loadOpenApiSpec = loadOpenApiSpec;
+exports.normalizeParameter = normalizeParameter;
+exports.parseSpecContent = parseSpecContent;
+exports.readResource = readResource;
+exports.resolvePrompt = resolvePrompt;
+exports.startAdminServer = startAdminServer;
+exports.startStdioServer = startStdioServer;
+exports.synthesizeOperationId = synthesizeOperationId;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map