@sezzlee/openapi-mcp 0.0.0-stage → 0.2.0

package/dist/credentials/token-exchange.js

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import { SingleFlight } from "@sezzlee/core";
+export class TokenExchangeFailed extends Error {
+    rejected;
+    constructor(rejected, message) {
+        super(message);
+        this.rejected = rejected;
+        this.name = "TokenExchangeFailed";
+    }
+}
+const skewSeconds = 30;
+const maxTokenResponseBytes = 64 * 1024;
+function subjectExpiry(token) {
+    const payload = token.split(".")[1];
+    if (payload === undefined) {
+        return undefined;
+    }
+    try {
+        const claims = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof claims.exp === "number" ? claims.exp : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * RFC 8693 token exchange against one authorization server.
+ *
+ * Guard: the cache key is a digest of the subject token, never the token, so a heap dump of the
+ * cache does not hold a usable credential; an exchanged token never outlives the subject token it
+ * was issued for; a failure is not cached, so a caller whose grant is restored is not locked out
+ * until an expiry; the token endpoint's body is never surfaced, for the reason a backend's 401 body
+ * is not — it describes the credential, not the call.
+ */
+export function createTokenExchange(config, clientSecret, fetcher, timeoutMs, now = () => Math.floor(Date.now() / 1000)) {
+    const cache = new Map();
+    const flight = new SingleFlight();
+    const endpoint = new URL(config.tokenEndpoint);
+    async function request(subjectToken) {
+        const form = new URLSearchParams({
+            grant_type: "urn:ietf:params:oauth:grant-type:token-exchange",
+            subject_token: subjectToken,
+            subject_token_type: "urn:ietf:params:oauth:token-type:access_token",
+            requested_token_type: "urn:ietf:params:oauth:token-type:access_token",
+        });
+        if (config.audience !== undefined) {
+            form.set("audience", config.audience);
+        }
+        if (config.resource !== undefined) {
+            form.set("resource", config.resource);
+        }
+        if (config.scope !== undefined) {
+            form.set("scope", config.scope);
+        }
+        const headers = {
+            "content-type": "application/x-www-form-urlencoded",
+            accept: "application/json",
+        };
+        if (config.clientAuth === "basic") {
+            headers["authorization"] =
+                `Basic ${Buffer.from(`${encodeURIComponent(config.clientId)}:${encodeURIComponent(clientSecret)}`, "utf8").toString("base64")}`;
+        }
+        else {
+            form.set("client_id", config.clientId);
+            form.set("client_secret", clientSecret);
+        }
+        const response = await fetcher({
+            method: "POST",
+            url: endpoint,
+            headers,
+            body: new TextEncoder().encode(form.toString()),
+        }, AbortSignal.timeout(timeoutMs), maxTokenResponseBytes);
+        if (response.status >= 500) {
+            throw new TokenExchangeFailed(false, `The authorization server answered ${String(response.status)} to the token exchange.`);
+        }
+        let body = {};
+        try {
+            body = JSON.parse(response.body ?? "{}");
+        }
+        catch {
+            body = {};
+        }
+        if (response.status !== 200 || typeof body.access_token !== "string") {
+            throw new TokenExchangeFailed(true, "The authorization server refused to exchange the token.");
+        }
+        const issuedFor = typeof body.expires_in === "number"
+            ? now() + body.expires_in
+            : now() + 300;
+        const subjectExp = subjectExpiry(subjectToken);
+        return {
+            token: body.access_token,
+            expiresAt: subjectExp === undefined ? issuedFor : Math.min(issuedFor, subjectExp),
+        };
+    }
+    return {
+        async exchange(subjectToken) {
+            const key = createHash("sha256")
+                .update(subjectToken)
+                .update("\0")
+                .update(config.audience ?? "")
+                .update("\0")
+                .update(config.resource ?? "")
+                .update("\0")
+                .update(config.scope ?? "")
+                .digest("hex");
+            const cached = cache.get(key);
+            if (cached !== undefined && cached.expiresAt - skewSeconds > now()) {
+                return cached;
+            }
+            cache.delete(key);
+            const issued = await flight.run(key, () => request(subjectToken));
+            cache.set(key, issued);
+            return issued;
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export { buildGatewayCatalog, summarize } from "./catalog/build.js";
+export type { GatewayCatalog, GatewaySource } from "./catalog/build.js";
+export { chooseCredentials, applyCredentials, } from "./credentials/credentials.js";
+export { createBoundedFetch, HostNotAllowed, ResponseTooLarge, } from "./net/fetch.js";
+export type { BoundedFetch, OutboundRequest } from "./net/fetch.js";
+export { invokeEntry } from "./invoke/invoke.js";
+export type { InvokeLimits, InvokeTarget } from "./invoke/invoke.js";
+export { configSchema, readConfig } from "./platform/config.js";
+export type { GatewayConfig, ResolvedCredential } from "./platform/config.js";
+export { createOpenApiMcpServer } from "./server.js";
+export type { OpenApiMcpServerOptions } from "./server.js";

package/dist/index.js

@@ -0,0 +1,6 @@
+export { buildGatewayCatalog, summarize } from "./catalog/build.js";
+export { chooseCredentials, applyCredentials, } from "./credentials/credentials.js";
+export { createBoundedFetch, HostNotAllowed, ResponseTooLarge, } from "./net/fetch.js";
+export { invokeEntry } from "./invoke/invoke.js";
+export { configSchema, readConfig } from "./platform/config.js";
+export { createOpenApiMcpServer } from "./server.js";

package/dist/invoke/invoke.d.ts

@@ -0,0 +1,14 @@
+import { type CatalogEntry, type MetaResponse } from "@sezzlee/core";
+import type { GatewaySource } from "../catalog/build.js";
+import { type BoundedFetch } from "../net/fetch.js";
+export interface InvokeTarget {
+    readonly tool: string;
+    readonly method: string;
+    readonly route: string;
+}
+export interface InvokeLimits {
+    readonly timeoutMs: number;
+    readonly maxResponseBytes: number;
+    readonly maxInlineFileBytes: number;
+}
+export declare function invokeEntry(entry: CatalogEntry<GatewaySource>, args: unknown, fetcher: BoundedFetch, limits: InvokeLimits, signal: AbortSignal | undefined, exchanged?: string): Promise<MetaResponse<InvokeTarget>>;

package/dist/invoke/invoke.js

@@ -0,0 +1,118 @@
+import { asciiLower } from "../platform/ascii.js";
+import { armDeadline, compose, errorResult, isInvokeError, knownFields, mapInvokeResult, narrowingArguments, normalizeInvokeArguments, notInvocable, refuseTimedOutInvoke, sdkError, SezzleeArgumentError, SezzleeDispatchAborted, textResult, untilAbandoned, vocabularyOf, writeBody, } from "@sezzlee/core";
+import { applyCredentials, ExchangedTokenMissing, } from "../credentials/credentials.js";
+import { HostNotAllowed, ResponseTooLarge, } from "../net/fetch.js";
+const userAgent = "sezzlee-openapi/0.0.0";
+/**
+ * Guard: a `ref` file argument needs a resolver, and this server binds none, so the composer never
+ * offers `ref` and this path is unreachable unless a template was built with one.
+ */
+const noRefResolver = () => {
+    throw new SezzleeArgumentError("invalid_file_argument", "This server accepts file contents inline only; send 'text' or 'base64'.");
+};
+export async function invokeEntry(entry, args, fetcher, limits, signal, exchanged) {
+    const template = entry.template;
+    if (template === undefined) {
+        return notInvocable(entry.tool.name);
+    }
+    const target = {
+        tool: entry.tool.name,
+        method: entry.descriptor.method,
+        route: entry.descriptor.route,
+    };
+    const normalized = normalizeInvokeArguments(args);
+    let composed;
+    try {
+        composed = compose(template, normalized.value, undefined, {
+            maxInlineFileBytes: limits.maxInlineFileBytes,
+        });
+    }
+    catch (error) {
+        if (error instanceof SezzleeArgumentError) {
+            return errorResult(error.code, error.message);
+        }
+        throw error;
+    }
+    const headers = {
+        accept: "application/json, */*;q=0.5",
+        "user-agent": userAgent,
+    };
+    let cookie;
+    for (const [name, value] of Object.entries(composed.headers)) {
+        if (asciiLower(name) === "cookie") {
+            cookie = value;
+        }
+        else {
+            headers[asciiLower(name)] = value;
+        }
+    }
+    const slots = { headers, queryPairs: [], cookie };
+    try {
+        applyCredentials(entry.credentials, slots, exchanged);
+    }
+    catch (error) {
+        if (error instanceof SezzleeArgumentError) {
+            return errorResult(error.code, error.message);
+        }
+        if (error instanceof ExchangedTokenMissing) {
+            return errorResult("not_invocable", `Operation '${entry.tool.name}' acts as the caller, and this session carries no caller token.`);
+        }
+        throw error;
+    }
+    if (slots.cookie !== undefined) {
+        headers["cookie"] = slots.cookie;
+    }
+    const extraQuery = slots.queryPairs.join("&");
+    const pathAndQuery = extraQuery === ""
+        ? composed.pathAndQuery
+        : `${composed.pathAndQuery}${composed.pathAndQuery.includes("?") ? "&" : "?"}${extraQuery}`;
+    const url = new URL(`${entry.baseUrl}${pathAndQuery}`);
+    const deadline = armDeadline({
+        ...(signal === undefined ? {} : { signal }),
+        timeoutMs: limits.timeoutMs,
+    });
+    try {
+        const written = composed.body === undefined
+            ? undefined
+            : await untilAbandoned(writeBody(composed.body, noRefResolver), deadline.signal, deadline.reason);
+        if (written !== undefined) {
+            headers["content-type"] = written.contentType;
+        }
+        const response = await fetcher({
+            method: template.method,
+            url,
+            headers,
+            ...(written === undefined ? {} : { body: written.bytes }),
+        }, deadline.signal, limits.maxResponseBytes);
+        const outcome = mapInvokeResult(response, {
+            knownFields: knownFields(entry.tool),
+            ...vocabularyOf(template),
+        });
+        return textResult(outcome, isInvokeError(outcome), {
+            summaryOf: isInvokeError(outcome) ? outcome : outcome.body,
+            narrowing: narrowingArguments(entry.tool.inputSchema),
+            target,
+        });
+    }
+    catch (error) {
+        const abandoned = deadline.reason();
+        if (abandoned === "timeout" ||
+            (error instanceof SezzleeDispatchAborted && error.reason === "timeout")) {
+            return { payload: refuseTimedOutInvoke(limits.timeoutMs), isError: true };
+        }
+        if (error instanceof ResponseTooLarge) {
+            return {
+                payload: sdkError("response_too_large", `The backend's answer exceeded ${String(error.limit)} bytes and was not read to the end; narrow the call and retry.`),
+                isError: true,
+                narrowing: narrowingArguments(entry.tool.inputSchema),
+            };
+        }
+        if (error instanceof HostNotAllowed) {
+            return errorResult("not_invocable", `Operation '${entry.tool.name}' targets a host this server may not reach.`);
+        }
+        throw error;
+    }
+    finally {
+        deadline.dispose();
+    }
+}

package/dist/net/fetch.d.ts

@@ -0,0 +1,25 @@
+import type { BackendResponse } from "@sezzlee/core";
+export declare class HostNotAllowed extends Error {
+    readonly host: string;
+    constructor(host: string);
+}
+export declare class ResponseTooLarge extends Error {
+    readonly limit: number;
+    constructor(limit: number);
+}
+export interface OutboundRequest {
+    readonly method: string;
+    readonly url: URL;
+    readonly headers: Readonly<Record<string, string>>;
+    readonly body?: Uint8Array;
+}
+export type BoundedFetch = (request: OutboundRequest, signal: AbortSignal, maxBytes: number) => Promise<BackendResponse>;
+/**
+ * The only network egress of this package.
+ *
+ * Guard: redirects are never followed. A followed redirect would carry the request — and its
+ * credential — to whatever host a `Location` header names, which is exactly what the allowlist
+ * exists to prevent; a 3xx is returned to the error mapper as it arrived. The body is read under a
+ * byte cap, so a backend that streams without end cannot exhaust memory before the budget check.
+ */
+export declare function createBoundedFetch(allowedHosts: ReadonlySet<string>): BoundedFetch;

package/dist/net/fetch.js

@@ -0,0 +1,97 @@
+import { asciiLower } from "../platform/ascii.js";
+export class HostNotAllowed extends Error {
+    host;
+    constructor(host) {
+        super(`sezzlee-openapi: host '${host}' is not on the allowlist.`);
+        this.host = host;
+        this.name = "HostNotAllowed";
+    }
+}
+export class ResponseTooLarge extends Error {
+    limit;
+    constructor(limit) {
+        super(`sezzlee-openapi: the response exceeded ${String(limit)} bytes.`);
+        this.limit = limit;
+        this.name = "ResponseTooLarge";
+    }
+}
+/**
+ * Guard: hop-by-hop headers describe one connection, and `set-cookie` would hand the backend's
+ * session to the agent; neither may reach the error mapper or a result.
+ */
+const droppedHeaders = new Set([
+    "connection",
+    "keep-alive",
+    "transfer-encoding",
+    "upgrade",
+    "proxy-authenticate",
+    "trailer",
+    "set-cookie",
+]);
+async function readCapped(response, maxBytes) {
+    if (response.body === null) {
+        return new Uint8Array();
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done) {
+            break;
+        }
+        total += value.byteLength;
+        if (total > maxBytes) {
+            await reader.cancel();
+            throw new ResponseTooLarge(maxBytes);
+        }
+        chunks.push(value);
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return bytes;
+}
+/**
+ * The only network egress of this package.
+ *
+ * Guard: redirects are never followed. A followed redirect would carry the request — and its
+ * credential — to whatever host a `Location` header names, which is exactly what the allowlist
+ * exists to prevent; a 3xx is returned to the error mapper as it arrived. The body is read under a
+ * byte cap, so a backend that streams without end cannot exhaust memory before the budget check.
+ */
+export function createBoundedFetch(allowedHosts) {
+    return async (request, signal, maxBytes) => {
+        if (!allowedHosts.has(asciiLower(request.url.host))) {
+            throw new HostNotAllowed(request.url.host);
+        }
+        const response = await fetch(request.url, {
+            method: request.method,
+            headers: request.headers,
+            redirect: "manual",
+            signal,
+            ...(request.body === undefined
+                ? {}
+                : { body: new Uint8Array(request.body) }),
+        });
+        const bytes = await readCapped(response, maxBytes);
+        const headers = {};
+        response.headers.forEach((value, name) => {
+            if (!droppedHeaders.has(asciiLower(name))) {
+                headers[asciiLower(name)] = value;
+            }
+        });
+        const contentType = response.headers.get("content-type") ?? undefined;
+        return {
+            status: response.status,
+            headers,
+            ...(contentType === undefined ? {} : { contentType }),
+            ...(bytes.byteLength === 0
+                ? {}
+                : { body: new TextDecoder().decode(bytes) }),
+        };
+    };
+}

package/dist/platform/ascii.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Guard: header names, hosts and methods are ASCII by protocol, and a locale-sensitive
+ * `toLowerCase` turns `I` into a dotless `ı` under a Turkish locale, so a host or header would stop
+ * matching its allowlist or carrier entry on such a machine.
+ */
+export declare const asciiLower: (value: string) => string;
+export declare const asciiUpper: (value: string) => string;

package/dist/platform/ascii.js

@@ -0,0 +1,7 @@
+/**
+ * Guard: header names, hosts and methods are ASCII by protocol, and a locale-sensitive
+ * `toLowerCase` turns `I` into a dotless `ı` under a Turkish locale, so a host or header would stop
+ * matching its allowlist or carrier entry on such a machine.
+ */
+export const asciiLower = (value) => value.replace(/[A-Z]/g, (c) => String.fromCharCode(c.charCodeAt(0) + 32));
+export const asciiUpper = (value) => value.replace(/[a-z]/g, (c) => String.fromCharCode(c.charCodeAt(0) - 32));

package/dist/platform/config.d.ts

@@ -0,0 +1,106 @@
+import { z } from "zod";
+export declare const configSchema: z.ZodObject<{
+    transport: z.ZodDefault<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        kind: z.ZodLiteral<"stdio">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"http">;
+        host: z.ZodDefault<z.ZodString>;
+        port: z.ZodDefault<z.ZodNumber>;
+        path: z.ZodDefault<z.ZodString>;
+        resource: z.ZodURL;
+        authorizationServers: z.ZodArray<z.ZodURL>;
+        allowedHostnames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>], "kind">>;
+    tokenExchange: z.ZodOptional<z.ZodObject<{
+        tokenEndpoint: z.ZodURL;
+        clientId: z.ZodString;
+        clientSecret: z.ZodObject<{
+            fromEnv: z.ZodString;
+        }, z.core.$strict>;
+        clientAuth: z.ZodDefault<z.ZodEnum<{
+            basic: "basic";
+            post: "post";
+        }>>;
+        audience: z.ZodOptional<z.ZodString>;
+        resource: z.ZodOptional<z.ZodURL>;
+        scope: z.ZodOptional<z.ZodString>;
+        schemes: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    source: z.ZodString;
+    baseUrl: z.ZodOptional<z.ZodURL>;
+    serverVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    hoistPathPrefix: z.ZodOptional<z.ZodString>;
+    outputSchema: z.ZodDefault<z.ZodEnum<{
+        document: "document";
+        omit: "omit";
+    }>>;
+    requestBodyRequired: z.ZodDefault<z.ZodEnum<{
+        always: "always";
+        document: "document";
+    }>>;
+    strict: z.ZodDefault<z.ZodBoolean>;
+    selection: z.ZodDefault<z.ZodObject<{
+        default: z.ZodDefault<z.ZodEnum<{
+            exclude: "exclude";
+            include: "include";
+        }>>;
+        rules: z.ZodDefault<z.ZodArray<z.ZodObject<{
+            route: z.ZodOptional<z.ZodString>;
+            method: z.ZodOptional<z.ZodString>;
+            decision: z.ZodEnum<{
+                exclude: "exclude";
+                include: "include";
+            }>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
+    names: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    searchTerms: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>>;
+    credentials: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        value: z.ZodObject<{
+            fromEnv: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        username: z.ZodObject<{
+            fromEnv: z.ZodString;
+        }, z.core.$strict>;
+        password: z.ZodObject<{
+            fromEnv: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>]>>>;
+    allowHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    refHosts: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    identityCookies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    limits: z.ZodDefault<z.ZodObject<{
+        timeoutMs: z.ZodDefault<z.ZodNumber>;
+        maxResponseBytes: z.ZodDefault<z.ZodNumber>;
+        maxInlineFileBytes: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type GatewayConfig = z.infer<typeof configSchema>;
+export type TokenExchangeConfig = NonNullable<GatewayConfig["tokenExchange"]>;
+export type ResolvedCredential = {
+    readonly kind: "value";
+    readonly value: string;
+} | {
+    readonly kind: "exchanged";
+} | {
+    readonly kind: "basic";
+    readonly username: string;
+    readonly password: string;
+};
+export type ConfigOutcome = {
+    readonly kind: "ok";
+    readonly config: GatewayConfig;
+    readonly credentials: ReadonlyMap<string, ResolvedCredential>;
+    readonly clientSecret?: string;
+} | {
+    readonly kind: "invalid";
+    readonly reason: string;
+};
+/**
+ * Parses the config and resolves every secret it names.
+ *
+ * @param env reads one environment variable; secrets are named in the config, never inlined, so a
+ * config file can be committed and shared
+ */
+export declare function readConfig(raw: unknown, env: (name: string) => string | undefined): ConfigOutcome;

package/dist/platform/config.js

@@ -0,0 +1,163 @@
+import { invokeLimits } from "@sezzlee/core";
+import { z } from "zod";
+const secret = z.object({ fromEnv: z.string().min(1) }).strict();
+const credential = z.union([
+    z.object({ value: secret }).strict(),
+    z.object({ username: secret, password: secret }).strict(),
+]);
+const selectionRule = z
+    .object({
+    route: z.string().min(1).optional(),
+    method: z.string().min(1).optional(),
+    decision: z.enum(["include", "exclude"]),
+})
+    .strict();
+const transport = z.discriminatedUnion("kind", [
+    z.object({ kind: z.literal("stdio") }).strict(),
+    z
+        .object({
+        kind: z.literal("http"),
+        host: z.string().min(1).default("127.0.0.1"),
+        port: z.number().int().min(0).max(65535).default(8787),
+        path: z.string().startsWith("/").default("/mcp"),
+        resource: z.url(),
+        authorizationServers: z.array(z.url()).min(1),
+        allowedHostnames: z.array(z.string().min(1)).default([]),
+    })
+        .strict(),
+]);
+const tokenExchange = z
+    .object({
+    tokenEndpoint: z.url(),
+    clientId: z.string().min(1),
+    clientSecret: secret,
+    clientAuth: z.enum(["basic", "post"]).default("basic"),
+    audience: z.string().min(1).optional(),
+    resource: z.url().optional(),
+    scope: z.string().min(1).optional(),
+    schemes: z.array(z.string().min(1)).min(1),
+})
+    .strict();
+export const configSchema = z
+    .object({
+    transport: transport.default({ kind: "stdio" }),
+    tokenExchange: tokenExchange.optional(),
+    source: z.string().min(1),
+    baseUrl: z.url().optional(),
+    serverVariables: z.record(z.string(), z.string()).optional(),
+    hoistPathPrefix: z.string().startsWith("/").optional(),
+    outputSchema: z.enum(["document", "omit"]).default("document"),
+    requestBodyRequired: z.enum(["document", "always"]).default("document"),
+    strict: z.boolean().default(false),
+    selection: z
+        .object({
+        default: z.enum(["include", "exclude"]).default("exclude"),
+        rules: z.array(selectionRule).default([]),
+    })
+        .strict()
+        .default({ default: "exclude", rules: [] }),
+    names: z
+        .record(z.string(), z.string().regex(/^[a-z][a-z0-9_]{0,255}$/))
+        .default({}),
+    searchTerms: z.record(z.string(), z.array(z.string())).default({}),
+    credentials: z.record(z.string(), credential).default({}),
+    allowHosts: z.array(z.string().min(1)).default([]),
+    /**
+     * Guard: kept apart from `allowHosts`. That list is where calls and their
+     * credentials may go; this one is where the document's author may make the
+     * gateway fetch schemas from. Merging them would let one entry widen both.
+     */
+    refHosts: z.array(z.string().min(1)).default([]),
+    identityCookies: z.array(z.string().min(1)).default([]),
+    limits: z
+        .object({
+        timeoutMs: z
+            .number()
+            .int()
+            .positive()
+            .default(invokeLimits.invokeTimeoutMs),
+        maxResponseBytes: z
+            .number()
+            .int()
+            .positive()
+            .default(invokeLimits.maxResponseBytes),
+        maxInlineFileBytes: z
+            .number()
+            .int()
+            .positive()
+            .default(invokeLimits.maxInlineFileBytes),
+    })
+        .strict()
+        .default({
+        timeoutMs: invokeLimits.invokeTimeoutMs,
+        maxResponseBytes: invokeLimits.maxResponseBytes,
+        maxInlineFileBytes: invokeLimits.maxInlineFileBytes,
+    }),
+})
+    .strict();
+/**
+ * Parses the config and resolves every secret it names.
+ *
+ * @param env reads one environment variable; secrets are named in the config, never inlined, so a
+ * config file can be committed and shared
+ */
+export function readConfig(raw, env) {
+    const parsed = configSchema.safeParse(raw);
+    if (!parsed.success) {
+        return {
+            kind: "invalid",
+            reason: `The config is invalid: ${parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ")}`,
+        };
+    }
+    const credentials = new Map();
+    const missing = [];
+    const read = (reference) => {
+        const value = env(reference.fromEnv);
+        if (value === undefined || value === "") {
+            missing.push(reference.fromEnv);
+            return "";
+        }
+        return value;
+    };
+    for (const [scheme, declared] of Object.entries(parsed.data.credentials)) {
+        credentials.set(scheme, "value" in declared
+            ? { kind: "value", value: read(declared.value) }
+            : {
+                kind: "basic",
+                username: read(declared.username),
+                password: read(declared.password),
+            });
+    }
+    const exchange = parsed.data.tokenExchange;
+    for (const scheme of exchange?.schemes ?? []) {
+        credentials.set(scheme, { kind: "exchanged" });
+    }
+    const clientSecret = exchange === undefined ? undefined : read(exchange.clientSecret);
+    if (missing.length > 0) {
+        return {
+            kind: "invalid",
+            reason: `The config names environment variables that are not set: ${missing.join(", ")}.`,
+        };
+    }
+    const transportConfig = parsed.data.transport;
+    if (exchange === undefined &&
+        transportConfig.kind === "http" &&
+        !["127.0.0.1", "::1", "localhost"].includes(transportConfig.host)) {
+        return {
+            kind: "invalid",
+            reason: "An http transport without token exchange authenticates no caller, so it may only listen on a loopback host; configure tokenExchange or set host to 127.0.0.1.",
+        };
+    }
+    if (exchange !== undefined && parsed.data.transport.kind !== "http") {
+        return {
+            kind: "invalid",
+            reason: "token_exchange_requires_http: token exchange needs the caller's own token, which only the http transport carries; stdio has no caller to exchange for.",
+        };
+    }
+    return {
+        kind: "ok",
+        config: parsed.data,
+        credentials,
+        ...(clientSecret === undefined ? {} : { clientSecret }),
+    };
+}