mcp-authz 0.1.0 → 0.3.0

package/dist/ladder-CUzOKudC.js

@@ -0,0 +1,407 @@
+import { a as policyDenied, i as emitDecision, o as principalLabel, s as AccessDeniedError } from "./verifier-D6VIAYuT.js";
+import { OAuthError, OAuthErrorCode, bearerAuthChallengeResponse, classifyInboundRequest, isJsonContentType } from "@modelcontextprotocol/server";
+//#region src/scopes.ts
+const BASE64_SENTINEL = /^=\?base64\?([A-Za-z0-9+/]*(?:={0,2}))\?=$/;
+const CANONICAL_BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+/**
+* Tools use their bare name (or `tool:name`); prompts use `prompt:name`; and
+* resources use `resource:<uri>`. Everything else needs only the baseline.
+*/
+function scopesFromMcpHeaders(request, toolScopes, baseline = "mcp") {
+	const method = request.headers.get("mcp-method");
+	const rawName = request.headers.get("mcp-name");
+	const name = rawName === null ? void 0 : decodeMcpNameHeader(rawName);
+	return scopesForCapability(method ?? void 0, name, toolScopes, baseline);
+}
+/** Select scopes from an already validated MCP method/name pair. */
+function scopesForCapability(method, name, capabilityScopes, baseline = "mcp") {
+	if (!name) return [baseline];
+	const key = method === "tools/call" ? configured(capabilityScopes, name) === void 0 ? `tool:${name}` : name : method === "prompts/get" ? `prompt:${name}` : method === "resources/read" ? `resource:${name}` : void 0;
+	const required = (key === void 0 ? void 0 : configured(capabilityScopes, key)) ?? baseline;
+	return typeof required === "string" ? [required] : [...required];
+}
+/**
+* What the map actually says about this capability, and nothing it inherited.
+*
+* A capability may be named anything the server likes, `__proto__` included,
+* and a plain `map[name]` answers that one with `Object.prototype` — which is
+* not `undefined`, so it reads as a configured scope, and then is not a string
+* or a list either. Own properties only, and only values that are one of the
+* two shapes a scope can take.
+*/
+function configured(capabilityScopes, key) {
+	if (!Object.hasOwn(capabilityScopes, key)) return void 0;
+	const value = capabilityScopes[key];
+	if (typeof value === "string" || Array.isArray(value)) return value;
+}
+/** Decode SEP-2243's optional Base64 sentinel without accepting non-canonical input. */
+function decodeMcpNameHeader(value) {
+	const normalized = value.trim();
+	if (!normalized.startsWith("=?base64?") || !normalized.endsWith("?=")) return normalized;
+	const encoded = BASE64_SENTINEL.exec(normalized)?.[1];
+	if (encoded === void 0 || !CANONICAL_BASE64.test(encoded)) return void 0;
+	try {
+		const binary = atob(encoded);
+		const bytes = Uint8Array.from(binary, (character) => character.codePointAt(0) ?? 0);
+		return new TextDecoder("utf-8", { fatal: true }).decode(bytes);
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/routing.ts
+const NAME_SOURCE = {
+	"tools/call": "name",
+	"prompts/get": "name",
+	"resources/read": "uri"
+};
+/**
+* Parse and validate every routing input before it can influence OAuth scopes.
+* This mirrors the SDK's standard-header rung, including Base64 sentinel
+* decoding, but runs before bearer authorization rather than during dispatch.
+*/
+function classifyScopedRequest(request, body) {
+	if (request.method.toUpperCase() !== "POST") return {
+		kind: "legacy",
+		body: void 0,
+		outcome: {
+			kind: "legacy",
+			reason: "http-method"
+		}
+	};
+	const outcome = classifyInboundRequest({
+		httpMethod: request.method,
+		...header(request, "mcp-protocol-version", "protocolVersionHeader"),
+		...header(request, "mcp-method", "mcpMethodHeader"),
+		...header(request, "mcp-name", "mcpNameHeader"),
+		body
+	});
+	if (outcome.kind === "reject") return rejected(outcome.httpStatus, outcome.code, outcome.message, outcome.data, requestId$1(body));
+	if (outcome.kind === "legacy") return {
+		kind: "legacy",
+		body,
+		outcome
+	};
+	const method = outcome.message.method;
+	if (outcome.messageKind !== "request") return {
+		kind: "modern",
+		body,
+		outcome,
+		method
+	};
+	if (request.headers.get("mcp-method") === null) return mismatch("(missing)", `the body names method ${method} but the required Mcp-Method header is absent`, body);
+	const source = Object.hasOwn(NAME_SOURCE, method) ? NAME_SOURCE[method] : void 0;
+	if (source === void 0) return {
+		kind: "modern",
+		body,
+		outcome,
+		method
+	};
+	const params = isRecord(outcome.message.params) ? outcome.message.params : void 0;
+	const bodyName = typeof params?.[source] === "string" ? params[source] : void 0;
+	const rawName = request.headers.get("mcp-name");
+	if (rawName === null) {
+		if (bodyName === void 0) return {
+			kind: "modern",
+			body,
+			outcome,
+			method
+		};
+		return mismatch("(missing)", `the body carries params.${source}="${bodyName}" but the required Mcp-Name header is absent`, body);
+	}
+	const decodedName = decodeMcpNameHeader(rawName);
+	if (decodedName === void 0) return mismatch(rawName.trim(), "the Mcp-Name header carries an invalid Base64 sentinel value", body);
+	if (bodyName !== void 0 && decodedName !== bodyName) return mismatch(rawName.trim(), `the body carries params.${source}="${bodyName}" but the Mcp-Name header names "${decodedName}"`, body);
+	return {
+		kind: "modern",
+		body,
+		outcome,
+		method,
+		...bodyName === void 0 ? {} : { name: bodyName }
+	};
+}
+function header(request, name, property) {
+	const value = request.headers.get(name);
+	return value === null ? {} : { [property]: value };
+}
+function mismatch(headerValue, bodyDescription, body) {
+	return rejected(400, -32020, `Bad Request: the request headers and body disagree: ${bodyDescription}`, { mismatch: {
+		header: headerValue,
+		body: bodyDescription
+	} }, requestId$1(body));
+}
+function rejected(httpStatus, code, message, data, id) {
+	return {
+		kind: "reject",
+		httpStatus,
+		code,
+		message,
+		...data === void 0 ? {} : { data },
+		id
+	};
+}
+function requestId$1(body) {
+	if (!isRecord(body)) return null;
+	const id = body.id;
+	return typeof id === "string" || typeof id === "number" ? id : null;
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/**
+* The route a JSON-RPC body names, ignoring headers entirely.
+*
+* For a request that carries no trustworthy 2026 routing headers there is
+* nothing to cross-check, and the choice is between reading the body and
+* refusing to say what the request does. A caller that has to price every
+* capability it forwards needs the former: the body is the only claim the
+* upstream will act on, so it is the claim to authorize against.
+*/
+function routeFromBody(body) {
+	if (!isRecord(body)) return void 0;
+	const method = body.method;
+	if (typeof method !== "string") return void 0;
+	const params = isRecord(body.params) ? body.params : void 0;
+	const source = Object.hasOwn(NAME_SOURCE, method) ? NAME_SOURCE[method] : void 0;
+	const name = source !== void 0 && typeof params?.[source] === "string" ? params[source] : void 0;
+	return {
+		kind: "modern",
+		body,
+		method,
+		...name === void 0 ? {} : { name }
+	};
+}
+//#endregion
+//#region src/upstream.ts
+/**
+* Headers that must not survive a hop.
+*
+* `authorization` and `cookie` are the caller's credentials for *this* proxy;
+* forwarding either would hand a third-party upstream a token it was never the
+* audience for. The rest are hop-by-hop per RFC 9110 §7.6.1 — they describe the
+* connection that just ended, not the one about to be opened — plus `host`,
+* which the new URL decides.
+*/
+const DROPPED_ON_FORWARD = /* @__PURE__ */ new Set([
+	"authorization",
+	"cookie",
+	"host",
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade"
+]);
+async function forwardToUpstream(request, config) {
+	const fetchFn = config.fetch ?? fetch;
+	const bearer = typeof config.bearer === "function" ? await config.bearer() : config.bearer;
+	const target = new URL(config.url);
+	const dropped = new Set(DROPPED_ON_FORWARD);
+	for (const named of request.headers.get("connection")?.split(",") ?? []) {
+		const field = named.trim().toLowerCase();
+		if (field) dropped.add(field);
+	}
+	const headers = new Headers();
+	for (const [name, value] of request.headers) if (!dropped.has(name.toLowerCase())) headers.set(name, value);
+	headers.set("authorization", `Bearer ${bearer}`);
+	return fetchFn(new Request(target, {
+		method: request.method,
+		headers,
+		body: request.body,
+		duplex: "half"
+	}));
+}
+/**
+* The upstream's headers minus the framing that described a body we replaced.
+*
+* A filtered listing is shorter than what arrived, and `fetch` has already
+* decoded any `content-encoding`, so copying either header across would
+* describe the old body: a client would read a truncated response, or try to
+* gunzip plain JSON.
+*/
+function headersForRewrittenBody(response) {
+	const headers = new Headers(response.headers);
+	headers.delete("content-length");
+	headers.delete("content-encoding");
+	return headers;
+}
+function isEventStream(response) {
+	return (response.headers.get("content-type") ?? "").includes("text/event-stream");
+}
+function isJsonResponse(response) {
+	const type = response.headers.get("content-type") ?? "";
+	return type.includes("application/json") || type.includes("+json");
+}
+/**
+* A response body as text, or `undefined` when it is over the cap.
+*
+* Reads chunk by chunk and stops at the limit rather than buffering first and
+* measuring after, because measuring after is how an upstream decides how much
+* memory this process spends. Consumes the body rather than cloning it, so
+* there is no second buffered branch left behind holding the same bytes.
+*/
+async function readCappedBody(body, maxBytes) {
+	if (!body) return "";
+	const reader = body.getReader();
+	const chunks = [];
+	let total = 0;
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > maxBytes) {
+				reader.cancel().catch(() => {});
+				return;
+			}
+			chunks.push(value);
+		}
+	} finally {
+		reader.releaseLock();
+	}
+	const joined = new Uint8Array(total);
+	let at = 0;
+	for (const chunk of chunks) {
+		joined.set(chunk, at);
+		at += chunk.byteLength;
+	}
+	return new TextDecoder().decode(joined);
+}
+//#endregion
+//#region src/ladder.ts
+/**
+* The rungs both enforcement locations share: classify a request, price the
+* capability it names, then step up its scope.
+*
+* **Every rung here has to say which side's assumptions it encodes.** The two
+* callers are not symmetric, and where they differ is where the security bugs
+* live. `createMcpFetch` has the SDK downstream of it, so it can be lenient
+* with a request it cannot classify and let the SDK refuse it a second way.
+* `createMcpProxy` has nothing downstream that re-checks anything, and forwards
+* on a service credential that outranks the caller, so the same leniency hands
+* an upstream a call nobody priced. That difference is `strictClassification`,
+* and it was a header-smuggling hole before it was an option.
+*
+* The same shape has surfaced twice more: a resource is named by label in a
+* permission map and by URI on the wire, and a listing filter that cannot read
+* a response has to withhold it rather than pass it on. A shared rung that
+* silently picks one caller's default is the bug, not the sharing.
+*/
+/** Bare name for a tool, `prompt:`/`resource:` prefixed for the rest — same as `gate()`. */
+function capabilityLabel(kind, name) {
+	return kind === "tool" ? name : `${kind}:${name}`;
+}
+function permissionForRoute(resolver, permissions, route) {
+	if (!route.name || !resolver && !permissions) return void 0;
+	const kind = route.method === "tools/call" ? "tool" : route.method === "prompts/get" ? "prompt" : route.method === "resources/read" ? "resource" : void 0;
+	return kind ? resolver?.(kind, route.name) ?? permissions?.get(`${kind}:${route.name}`) : void 0;
+}
+/**
+* Resolve a permission from a flat map whose tool keys are bare names.
+*
+* `tools/call` and `prompts/get` carry the capability's name, which is what the
+* map is keyed by. `resources/read` carries a URI instead — `cases://case/C1`,
+* never `case` — so it is answered from the resource index rather than by
+* looking up a name the request never sent.
+*/
+function permissionForFlatMap(permissions, route, resources = [], can = () => true) {
+	if (!route.name) return void 0;
+	if (route.method === "tools/call") return permissions.get(route.name) ?? permissions.get(`tool:${route.name}`);
+	if (route.method === "prompts/get") return permissions.get(`prompt:${route.name}`);
+	if (route.method !== "resources/read") return void 0;
+	const matches = resources.filter((entry) => entry.matches(route.name));
+	if (matches.length === 0) return void 0;
+	return (matches.find((entry) => !can(entry.permission)) ?? matches[0])?.permission;
+}
+async function runScopedGate(options) {
+	const { request, auth, principal, maxRequestBytes, requiredScopes, scoped, routed, strictClassification = false, scopeMap, resolveCapabilityScopes, scopesForRequest, resolvePermission, onDecision, emitter, resourceMetadataUrl } = options;
+	const classified = (scoped || routed) && request.method.toUpperCase() === "POST" ? await preflightScopedRequest(request, maxRequestBytes) : void 0;
+	if (classified instanceof Response && (scoped || strictClassification)) return {
+		ok: false,
+		response: classified
+	};
+	const preflight = classified instanceof Response ? void 0 : classified;
+	if (scoped && preflight && !preflight.headersValidated) return {
+		ok: false,
+		response: protocolError(400, -32020, "Per-capability scopes require a 2026-07-28 request with matching MCP routing headers.", void 0, requestId(preflight.body))
+	};
+	const routePermission = preflight ? resolvePermission(preflight.route) : void 0;
+	if (routePermission && principal && !principal.can(routePermission)) {
+		await emitDecision(onDecision, principal, "deny", "policy_denied", emitter);
+		return {
+			ok: false,
+			response: policyDenied(AccessDeniedError.notPermitted(principalLabel(principal), `the permission '${routePermission}'`))
+		};
+	}
+	const scopes = preflight && scoped ? scopeMap ? [.../* @__PURE__ */ new Set([...requiredScopes, ...resolveCapabilityScopes?.(preflight.route) ?? scopesForCapability(preflight.route.method, preflight.route.name, scopeMap, requiredScopes[0] ?? "mcp")])] : scopesForRequest(request, preflight.route) : requiredScopes;
+	if (scopes.filter((scope) => !auth.scopes.includes(scope)).length > 0) return {
+		ok: false,
+		response: bearerAuthChallengeResponse(new OAuthError(OAuthErrorCode.InsufficientScope, "Insufficient scope"), {
+			requiredScopes: scopes,
+			resourceMetadataUrl
+		})
+	};
+	return {
+		ok: true,
+		...preflight ? { preflight } : {}
+	};
+}
+async function preflightScopedRequest(request, maxBytes) {
+	if (!isJsonContentType(request.headers.get("content-type"))) return protocolError(415, -32e3, "Per-capability scopes require an application/json body.");
+	const raw = await readCapped(request, maxBytes);
+	if (raw === void 0) return protocolError(413, -32e3, `Request body exceeds the ${maxBytes} byte limit.`);
+	let body;
+	try {
+		body = JSON.parse(raw);
+	} catch {
+		return protocolError(400, -32700, "Parse error: the request body is not valid JSON");
+	}
+	const route = classifyScopedRequest(request, body);
+	if (route.kind === "reject") return protocolError(route.httpStatus, route.code, route.message, route.data, route.id);
+	if (route.kind !== "modern") {
+		const derived = routeFromBody(body);
+		return derived === void 0 ? protocolError(400, -32600, "Invalid Request: no JSON-RPC method to route on.", void 0, requestId(body)) : {
+			body,
+			route: derived,
+			headersValidated: false
+		};
+	}
+	return {
+		body,
+		route,
+		headersValidated: true
+	};
+}
+function requestId(body) {
+	if (typeof body !== "object" || body === null || Array.isArray(body)) return null;
+	const id = body.id;
+	return typeof id === "string" || typeof id === "number" ? id : null;
+}
+function protocolError(status, code, message, data, id = null) {
+	return Response.json({
+		jsonrpc: "2.0",
+		error: {
+			code,
+			message,
+			...data === void 0 ? {} : { data }
+		},
+		id
+	}, { status });
+}
+/**
+* The request body as text, or `undefined` when it is over the cap.
+*
+* A declared `Content-Length` over the limit is refused without reading
+* anything; the stream itself is then held to the same limit, because the
+* header is the caller's claim rather than a measurement.
+*/
+async function readCapped(request, maxBytes) {
+	const declared = Number(request.headers.get("content-length"));
+	if (Number.isFinite(declared) && declared > maxBytes) return void 0;
+	return readCappedBody(request.clone().body, maxBytes);
+}
+//#endregion
+export { forwardToUpstream as a, isJsonResponse as c, scopesForCapability as d, scopesFromMcpHeaders as f, runScopedGate as i, readCappedBody as l, permissionForFlatMap as n, headersForRewrittenBody as o, permissionForRoute as r, isEventStream as s, capabilityLabel as t, decodeMcpNameHeader as u };

package/dist/ladder-D18eJ7tD.d.ts

@@ -0,0 +1,32 @@
+import { AuthInfo, InboundClassificationOutcome } from "@modelcontextprotocol/server";
+//#region src/routing.d.ts
+type TrustedMcpRoute = {
+  kind: 'modern';
+  body: unknown;
+  /** Absent on a route derived from the body alone; nothing downstream reads it. */
+  outcome?: Extract<InboundClassificationOutcome, {
+    kind: 'modern';
+  }>;
+  method: string;
+  name?: string;
+};
+//#endregion
+//#region src/scopes.d.ts
+/**
+ * Helpers for deriving required OAuth scopes from Streamable HTTP headers
+ * (SEP-2243). Use with `createMcpFetch({ scopesForRequest })`.
+ */
+type ScopeRequirement = string | readonly string[];
+type ToolScopeMap = Readonly<Record<string, ScopeRequirement>>;
+type CapabilityScopeMap = ToolScopeMap;
+/**
+ * Tools use their bare name (or `tool:name`); prompts use `prompt:name`; and
+ * resources use `resource:<uri>`. Everything else needs only the baseline.
+ */
+declare function scopesFromMcpHeaders(request: Request, toolScopes: ToolScopeMap, baseline?: string): string[];
+/** Select scopes from an already validated MCP method/name pair. */
+declare function scopesForCapability(method: string | undefined, name: string | undefined, capabilityScopes: CapabilityScopeMap, baseline?: string): string[];
+/** Decode SEP-2243's optional Base64 sentinel without accepting non-canonical input. */
+declare function decodeMcpNameHeader(value: string): string | undefined;
+//#endregion
+export { scopesForCapability as a, decodeMcpNameHeader as i, ScopeRequirement as n, scopesFromMcpHeaders as o, ToolScopeMap as r, TrustedMcpRoute as s, CapabilityScopeMap as t };

package/dist/openapi.d.ts

@@ -0,0 +1,112 @@
+import { _ as Identity, l as Principal, s as Policy } from "./policy-DuZbwrKf.js";
+import { c as AuditSink, o as AuditErrorSink } from "./tools-BQE1O-7P.js";
+import { a as AuthorizationDecisionSink, t as VerifierOptions } from "./verifier-DF6gUMQ6.js";
+import { t as PermissionMapRecord } from "./permissions-module-DxCHuE-N.js";
+import { AuthInfo, OAuthMetadata, OAuthTokenVerifier } from "@modelcontextprotocol/server";
+//#region src/openapi.d.ts
+/**
+ * The same bet as the MCP side, on the other catalogue an agent reads.
+ *
+ * `gate()` earns its keep because a tool that is never registered is a tool the
+ * model never sees, so it never tries. An HTTP API has one thing shaped like
+ * that list: its OpenAPI document. Filtering the served document per caller is
+ * the same move — a smaller prompt, and no confident calls into a 403.
+ *
+ * For a hand-written client it changes nothing, because that client was coded
+ * against the spec months ago. Hiding an operation is not the boundary; the
+ * check on the request is, and it runs here whether or not the caller ever read
+ * the document.
+ */
+/**
+ * As much of an OpenAPI document as this needs to know about. Everything else
+ * rides along untouched, so a document with `components`, `webhooks` or a
+ * vendor extension comes back out the way it went in.
+ */
+type OpenApiDocument = {
+  paths?: Record<string, Record<string, unknown> | undefined>;
+  [key: string]: unknown;
+};
+type OpenApiOperation = {
+  /** The document's own `operationId`, which is what the permission map is keyed by. */
+  operationId: string;
+  /** Lowercased HTTP method. */
+  method: string;
+  /** The templated path, e.g. `/cases/{id}`. */
+  path: string;
+};
+type OperationRecord = PermissionMapRecord & {
+  /** Every operation the document describes, in document order. */
+  operations: OpenApiOperation[];
+};
+/**
+ * What the document says this API can do, read off the document.
+ *
+ * The mirror of `recordCapabilities`, and it needs no running server: an
+ * OpenAPI file is the catalogue, already sitting in your repository. Feed the
+ * result to `toPermissionsModule` for a map priced `TODO:unassigned`, which no
+ * role grants and the boot refuses until somebody decides what each operation
+ * costs.
+ */
+declare function recordOperations(spec: OpenApiDocument): OperationRecord;
+/**
+ * The document as this caller should see it: their operations, and nothing else.
+ *
+ * A path item left with no operations is dropped, so the reader is not offered
+ * a route with no verbs. `components` is deliberately left whole — pruning it
+ * means walking the `$ref` graph, and a schema nobody references costs a few
+ * hundred tokens where a wrongly-pruned one breaks the document.
+ */
+declare function filterSpec<P extends string>(spec: OpenApiDocument, principal: Principal<P>, permissions: Readonly<Record<string, string>>): OpenApiDocument;
+type OpenApiFetchOptions<P extends string = string> = {
+  /** The document describing this API. Also the catalogue served to callers. */
+  spec: OpenApiDocument;
+  /** `operationId` to the permission it costs. Every operation needs an entry. */
+  permissions: Readonly<Record<string, string>>;
+  /** This API's public base URL, e.g. `https://api.acme.com`. Tokens must carry it. */
+  resourceServerUrl: URL;
+  /** RFC 8414 metadata for the authorization server in front of us. */
+  oauthMetadata: OAuthMetadata;
+  /** Token verification. Defaults come from `oauthMetadata` and `resourceServerUrl`. */
+  verifier?: Partial<VerifierOptions>;
+  /** Bring any SDK-compatible verifier. Mutually exclusive with `verifier`. */
+  tokenVerifier?: OAuthTokenVerifier;
+  /** Map a custom verifier's AuthInfo into the identity consumed by policy. */
+  identityFromAuth?: (auth: AuthInfo) => Identity;
+  /** Baseline scopes every request must carry. */
+  requiredScopes?: string[];
+  /** All scopes advertised in protected-resource metadata. */
+  supportedScopes?: string[];
+  /** Who may call and what they may do. */
+  policy?: Policy<P>;
+  /** Async alternative to `policy`, for roles held elsewhere. */
+  authorize?: (identity: Identity) => Promise<Principal<P>> | Principal<P>;
+  /** Awaited access-decision sink. Sees the refusals, including probes. */
+  onDecision?: AuthorizationDecisionSink;
+  /** Awaited audit sink. `attempt` then `success` or `failure`, per call. */
+  onAudit?: AuditSink;
+  /** Where a failed terminal audit write goes. */
+  onAuditError?: AuditErrorSink;
+  /** Where the filtered document is served. Defaults to `/openapi.json`. */
+  specPath?: string;
+  /**
+   * Names this deployment on every event it emits.
+   *
+   * Set the same value in every entry point of one deployment: a dashboard
+   * reading several of them cannot otherwise tell which server refused a call.
+   */
+  emitter?: string;
+  /** Your API. Reached only for a request this caller is permitted to make. */
+  upstream: (request: Request, principal: Principal<P>) => Promise<Response> | Response;
+};
+/**
+ * An OAuth 2.1 resource server in front of an API you already have.
+ *
+ * Anything the document does not describe is refused. That is the same rule as
+ * the MCP side — a capability nobody priced is reachable by everyone or by
+ * nobody, with no error to read — and it means routes you deliberately leave
+ * out of the spec (a health check, static files) belong outside this wrapper
+ * rather than behind it.
+ */
+declare function createOpenApiFetch<P extends string = string>(options: OpenApiFetchOptions<P>): (request: Request) => Promise<Response>;
+//#endregion
+export { OpenApiDocument, OpenApiFetchOptions, OpenApiOperation, OperationRecord, createOpenApiFetch, filterSpec, recordOperations };