mcp-from-openapi 0.0.1 → 1.0.0

package/src/security-resolver.js

@@ -0,0 +1,324 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityResolver = void 0;
+exports.createSecurityContext = createSecurityContext;
+/**
+ * Security resolver that maps OpenAPI security requirements to actual auth values
+ *
+ * This helper handles security parameters from any OpenAPI spec, regardless of
+ * custom naming (BearerAuth, JWT, Authorization, etc.). It uses the mapper's
+ * security metadata to determine the auth type and format.
+ *
+ * @example
+ * ```typescript
+ * // In FrontMCP
+ * const resolver = new SecurityResolver();
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   jwt: context.authInfo.jwt,
+ *   apiKey: process.env.API_KEY
+ * });
+ *
+ * // Use resolved.headers in HTTP request
+ * fetch(url, { headers: { ...resolved.headers, ...otherHeaders } });
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Custom resolver for framework-specific auth
+ * const resolved = resolver.resolve(tool.mapper, {
+ *   customResolver: (security) => {
+ *     if (security.type === 'http' && security.httpScheme === 'bearer') {
+ *       return myFramework.getAuthToken();
+ *     }
+ *     return undefined;
+ *   }
+ * });
+ * ```
+ */
+class SecurityResolver {
+    /**
+     * Resolve security parameters from mapper entries
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values or custom resolver
+     * @returns Resolved headers, query params, and cookies with auth applied
+     */
+    async resolve(mappers, context) {
+        const resolved = {
+            headers: {},
+            query: {},
+            cookies: {},
+        };
+        // Add client certificate if available (for mTLS)
+        if (context.clientCertificate) {
+            resolved.clientCertificate = context.clientCertificate;
+        }
+        // Check if signature-based auth is needed
+        let requiresSignature = false;
+        let signatureScheme;
+        for (const mapper of mappers) {
+            // Skip non-security parameters
+            if (!mapper.security) {
+                continue;
+            }
+            // Check for signature-based auth
+            if (this.isSignatureBasedAuth(mapper.security)) {
+                requiresSignature = true;
+                signatureScheme = mapper.security.scheme;
+                // Signature will be added later by signRequest()
+                continue;
+            }
+            // Try to resolve the auth value
+            const authValue = await this.resolveAuthValue(mapper.security, context);
+            if (!authValue) {
+                // Auth value not available - skip this security requirement
+                // Framework may want to throw an error or log a warning
+                continue;
+            }
+            // Apply to the correct location
+            const headerName = mapper.key;
+            if (mapper.type === 'header') {
+                resolved.headers[headerName] = authValue;
+            }
+            else if (mapper.type === 'query') {
+                resolved.query[headerName] = authValue;
+            }
+            else if (mapper.type === 'cookie') {
+                resolved.cookies[headerName] = authValue;
+            }
+        }
+        // Add context cookies if available
+        if (context.cookies) {
+            resolved.cookies = { ...resolved.cookies, ...context.cookies };
+        }
+        // Add signature metadata if needed
+        if (requiresSignature) {
+            resolved.requiresSignature = true;
+            resolved.signatureInfo = {
+                scheme: signatureScheme || 'unknown',
+            };
+        }
+        return resolved;
+    }
+    /**
+     * Check if security scheme requires request signing
+     */
+    isSignatureBasedAuth(security) {
+        // Check for schemes that typically require signing
+        const signatureSchemes = ['aws4', 'hmac', 'signature', 'hawk', 'custom-signature'];
+        return signatureSchemes.some(scheme => security.scheme.toLowerCase().includes(scheme));
+    }
+    /**
+     * Resolve the actual auth value based on security type
+     */
+    async resolveAuthValue(security, context) {
+        // Try custom resolver first
+        if (context.customResolver) {
+            const customValue = await context.customResolver(security);
+            if (customValue !== undefined) {
+                return customValue;
+            }
+        }
+        // Handle standard security types
+        if (security.type === 'http') {
+            return this.resolveHttpAuth(security, context);
+        }
+        else if (security.type === 'apiKey') {
+            return this.resolveApiKey(security, context);
+        }
+        else if (security.type === 'oauth2' || security.type === 'openIdConnect') {
+            return this.resolveOAuth2(security, context);
+        }
+        return undefined;
+    }
+    /**
+     * Resolve HTTP authentication (bearer, basic, digest, etc.)
+     */
+    resolveHttpAuth(security, context) {
+        const scheme = security.httpScheme?.toLowerCase() || 'bearer';
+        switch (scheme) {
+            case 'bearer':
+                return this.resolveBearerAuth(context);
+            case 'basic':
+                return this.resolveBasicAuth(context);
+            case 'digest':
+                return this.resolveDigestAuth(context);
+            case 'hoba':
+            case 'mutual':
+            case 'negotiate':
+            case 'vapid':
+            case 'scram':
+                // These schemes typically require custom implementation
+                // Try custom headers or signature generator
+                return this.resolveCustomHttpScheme(scheme, security, context);
+            default:
+                // Unknown scheme - try custom resolver
+                return undefined;
+        }
+    }
+    /**
+     * Resolve Bearer token authentication
+     */
+    resolveBearerAuth(context) {
+        const token = context.jwt;
+        if (!token)
+            return undefined;
+        return `Bearer ${token}`;
+    }
+    /**
+     * Resolve Basic authentication
+     */
+    resolveBasicAuth(context) {
+        const credentials = context.basic;
+        if (!credentials)
+            return undefined;
+        return `Basic ${credentials}`;
+    }
+    /**
+     * Resolve Digest authentication
+     */
+    resolveDigestAuth(context) {
+        const digest = context.digest;
+        if (!digest)
+            return undefined;
+        // Build digest auth header
+        const parts = [
+            `username="${digest.username}"`,
+            digest.realm ? `realm="${digest.realm}"` : '',
+            digest.nonce ? `nonce="${digest.nonce}"` : '',
+            digest.uri ? `uri="${digest.uri}"` : '',
+            digest.response ? `response="${digest.response}"` : '',
+            digest.opaque ? `opaque="${digest.opaque}"` : '',
+            digest.qop ? `qop=${digest.qop}` : '',
+            digest.nc ? `nc=${digest.nc}` : '',
+            digest.cnonce ? `cnonce="${digest.cnonce}"` : '',
+        ].filter(Boolean);
+        return `Digest ${parts.join(', ')}`;
+    }
+    /**
+     * Resolve custom HTTP authentication schemes
+     */
+    resolveCustomHttpScheme(scheme, security, context) {
+        // Try custom headers first
+        const headerKey = security.apiKeyName || `X-${scheme.toUpperCase()}`;
+        if (context.customHeaders?.[headerKey]) {
+            return context.customHeaders[headerKey];
+        }
+        // Unknown scheme
+        return undefined;
+    }
+    /**
+     * Resolve API key authentication
+     */
+    resolveApiKey(security, context) {
+        // Try named API keys first (for multiple keys)
+        if (context.apiKeys && security.apiKeyName) {
+            const key = context.apiKeys[security.apiKeyName];
+            if (key)
+                return key;
+        }
+        // Try custom headers (for proprietary auth headers like X-Custom-Auth)
+        if (context.customHeaders && security.apiKeyName) {
+            const header = context.customHeaders[security.apiKeyName];
+            if (header)
+                return header;
+        }
+        // Fall back to single apiKey (backward compatibility)
+        return context.apiKey;
+    }
+    /**
+     * Resolve OAuth2/OpenID Connect authentication
+     */
+    resolveOAuth2(security, context) {
+        const token = context.oauth2Token;
+        if (!token)
+            return undefined;
+        // OAuth2 tokens are typically formatted as "Bearer {token}"
+        return `Bearer ${token}`;
+    }
+    /**
+     * Check if any security requirements are missing from context
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param context - Security context with auth values
+     * @returns Array of missing security scheme names
+     */
+    async checkMissingSecurity(mappers, context) {
+        const missing = [];
+        for (const mapper of mappers) {
+            if (!mapper.security)
+                continue;
+            const authValue = await this.resolveAuthValue(mapper.security, context);
+            if (!authValue) {
+                missing.push(mapper.security.scheme);
+            }
+        }
+        return missing;
+    }
+    /**
+     * Sign a request for signature-based authentication
+     *
+     * Use this when resolved.requiresSignature is true.
+     * This method will call the signatureGenerator from context to sign the request.
+     *
+     * @param mappers - Parameter mappers from the tool definition
+     * @param signatureData - Request data to sign
+     * @param context - Security context with signature generator
+     * @returns Headers with signature added
+     *
+     * @example
+     * ```typescript
+     * const resolved = resolver.resolve(tool.mapper, context);
+     * if (resolved.requiresSignature) {
+     *   const signedHeaders = await resolver.signRequest(
+     *     tool.mapper,
+     *     { method: 'GET', url: 'https://api.example.com/data', headers: resolved.headers },
+     *     context
+     *   );
+     *   // Use signedHeaders in request
+     * }
+     * ```
+     */
+    async signRequest(mappers, signatureData, context) {
+        const headers = { ...signatureData.headers };
+        if (!context.signatureGenerator) {
+            throw new Error('Signature-based auth required but no signatureGenerator provided');
+        }
+        for (const mapper of mappers) {
+            if (!mapper.security || !this.isSignatureBasedAuth(mapper.security)) {
+                continue;
+            }
+            // Call signature generator
+            const signature = await context.signatureGenerator(signatureData, mapper.security);
+            // Add signature to appropriate location
+            if (mapper.type === 'header') {
+                headers[mapper.key] = signature;
+            }
+            // Note: Query/cookie signatures would be handled differently
+        }
+        return headers;
+    }
+}
+exports.SecurityResolver = SecurityResolver;
+/**
+ * Create a basic security context from common auth sources
+ *
+ * @example
+ * ```typescript
+ * const context = createSecurityContext({
+ *   jwt: process.env.JWT_TOKEN,
+ *   apiKey: process.env.API_KEY
+ * });
+ * ```
+ */
+function createSecurityContext(auth) {
+    return {
+        ...auth,
+        jwt: auth.jwt,
+        basic: auth.basic,
+        apiKey: auth.apiKey,
+        oauth2Token: auth.oauth2Token,
+        customResolver: auth.customResolver,
+    };
+}
+//# sourceMappingURL=security-resolver.js.map

package/src/security-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-resolver.js","sourceRoot":"","sources":["../../src/security-resolver.ts"],"names":[],"mappings":";;;AA+iBA,sDAWC;AAxXD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAa,gBAAgB;IAC3B;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,OAA0B,EAAE,OAAwB;QAChE,MAAM,QAAQ,GAAqB;YACjC,OAAO,EAAE,EAAE;YACX,KAAK,EAAE,EAAE;YACT,OAAO,EAAE,EAAE;SACZ,CAAC;QAEF,iDAAiD;QACjD,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;YAC9B,QAAQ,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACzD,CAAC;QAED,0CAA0C;QAC1C,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,eAAmC,CAAC;QAExC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,+BAA+B;YAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrB,SAAS;YACX,CAAC;YAED,iCAAiC;YACjC,IAAI,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/C,iBAAiB,GAAG,IAAI,CAAC;gBACzB,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBACzC,iDAAiD;gBACjD,SAAS;YACX,CAAC;YAED,gCAAgC;YAChC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,4DAA4D;gBAC5D,wDAAwD;gBACxD,SAAS;YACX,CAAC;YAED,gCAAgC;YAChC,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YAC3C,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACnC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YACzC,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACpC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,mCAAmC;QACnC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,QAAQ,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QAED,mCAAmC;QACnC,IAAI,iBAAiB,EAAE,CAAC;YACtB,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAClC,QAAQ,CAAC,aAAa,GAAG;gBACvB,MAAM,EAAE,eAAe,IAAI,SAAS;aACrC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,QAA+B;QAC1D,mDAAmD;QACnD,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;QACnF,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CACpC,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,gBAAgB,CAC5B,QAA+B,EAC/B,OAAwB;QAExB,4BAA4B;QAC5B,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC3D,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,WAAW,CAAC;YACrB,CAAC;QACH,CAAC;QAED,iCAAiC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,QAA+B,EAC/B,OAAwB;QAExB,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,EAAE,WAAW,EAAE,IAAI,QAAQ,CAAC;QAE9D,QAAQ,MAAM,EAAE,CAAC;YACf,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEzC,KAAK,OAAO;gBACV,OAAO,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAExC,KAAK,QAAQ;gBACX,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAEzC,KAAK,MAAM,CAAC;YACZ,KAAK,QAAQ,CAAC;YACd,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO,CAAC;YACb,KAAK,OAAO;gBACV,wDAAwD;gBACxD,4CAA4C;gBAC5C,OAAO,IAAI,CAAC,uBAAuB,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAEjE;gBACE,uCAAuC;gBACvC,OAAO,SAAS,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAwB;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,OAAwB;QAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QACnC,OAAO,SAAS,WAAW,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACK,iBAAiB,CAAC,OAAwB;QAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,2BAA2B;QAC3B,MAAM,KAAK,GAAa;YACtB,aAAa,MAAM,CAAC,QAAQ,GAAG;YAC/B,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE;YAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE;YACvC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE;YACtD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;YAChD,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE;YACrC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;YAClC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE;SACjD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,OAAO,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,uBAAuB,CAC7B,MAAc,EACd,QAA+B,EAC/B,OAAwB;QAExB,2BAA2B;QAC3B,MAAM,SAAS,GAAG,QAAQ,CAAC,UAAU,IAAI,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QACrE,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,iBAAiB;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAA+B,EAC/B,OAAwB;QAExB,+CAA+C;QAC/C,IAAI,OAAO,CAAC,OAAO,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACjD,IAAI,GAAG;gBAAE,OAAO,GAAG,CAAC;QACtB,CAAC;QAED,uEAAuE;QACvE,IAAI,OAAO,CAAC,aAAa,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YAC1D,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QAED,sDAAsD;QACtD,OAAO,OAAO,CAAC,MAAM,CAAC;IACxB,CAAC;IAED;;OAEG;IACK,aAAa,CACnB,QAA+B,EAC/B,OAAwB;QAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAE7B,4DAA4D;QAC5D,OAAO,UAAU,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,OAA0B,EAC1B,OAAwB;QAExB,MAAM,OAAO,GAAa,EAAE,CAAC;QAE7B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ;gBAAE,SAAS;YAE/B,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,KAAK,CAAC,WAAW,CACf,OAA0B,EAC1B,aAA4B,EAC5B,OAAwB;QAExB,MAAM,OAAO,GAA2B,EAAE,GAAG,aAAa,CAAC,OAAO,EAAE,CAAC;QAErE,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;QACtF,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpE,SAAS;YACX,CAAC;YAED,2BAA2B;YAC3B,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,kBAAkB,CAAC,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;YAEnF,wCAAwC;YACxC,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC;YAClC,CAAC;YACD,6DAA6D;QAC/D,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;CACF;AA/TD,4CA+TC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,qBAAqB,CACnC,IAA8B;IAE9B,OAAO;QACL,GAAG,IAAI;QACP,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;KACpC,CAAC;AACJ,CAAC","sourcesContent":["import type { ParameterMapper, SecurityParameterInfo } from './types';\n\n/**\n * Context for resolving security parameters\n * Frameworks should implement this interface based on their auth system\n */\nexport interface SecurityContext {\n  /**\n   * JWT/Bearer token\n   */\n  jwt?: string;\n\n  /**\n   * Basic auth credentials (base64 encoded \"username:password\")\n   */\n  basic?: string;\n\n  /**\n   * Digest auth credentials\n   * Object with username, password, realm, nonce, etc.\n   */\n  digest?: DigestAuthCredentials;\n\n  /**\n   * API key (single key for backward compatibility)\n   */\n  apiKey?: string;\n\n  /**\n   * Multiple API keys by name\n   * Use this when API requires different keys for different purposes\n   * @example { 'X-API-Key': 'key1', 'X-Client-Id': 'client123' }\n   */\n  apiKeys?: Record<string, string>;\n\n  /**\n   * OAuth2 access token\n   */\n  oauth2Token?: string;\n\n  /**\n   * Client certificate for mutual TLS (mTLS)\n   */\n  clientCertificate?: ClientCertificate;\n\n  /**\n   * Private key for signature-based auth (HMAC, AWS Signature V4, etc.)\n   */\n  privateKey?: string;\n\n  /**\n   * Public key (if needed for verification)\n   */\n  publicKey?: string;\n\n  /**\n   * HMAC secret for HMAC-based authentication\n   */\n  hmacSecret?: string;\n\n  /**\n   * AWS credentials for AWS Signature V4\n   */\n  awsCredentials?: AWSCredentials;\n\n  /**\n   * Custom headers for proprietary authentication\n   * @example { 'X-Custom-Auth': 'custom-value' }\n   */\n  customHeaders?: Record<string, string>;\n\n  /**\n   * Session cookies\n   */\n  cookies?: Record<string, string>;\n\n  /**\n   * Custom resolver for framework-specific auth\n   * @param security - Security parameter info from mapper\n   * @returns The auth value to use, or undefined if not available\n   */\n  customResolver?: (security: SecurityParameterInfo) => string | Promise<string | undefined>;\n\n  /**\n   * Signature generator for signature-based auth\n   * @param data - Data to sign (typically the request)\n   * @param security - Security parameter info\n   * @returns The signature or signed value\n   */\n  signatureGenerator?: (data: SignatureData, security: SecurityParameterInfo) => string | Promise<string>;\n}\n\n/**\n * Digest authentication credentials\n */\nexport interface DigestAuthCredentials {\n  username: string;\n  password: string;\n  realm?: string;\n  nonce?: string;\n  uri?: string;\n  qop?: string;\n  nc?: string;\n  cnonce?: string;\n  response?: string;\n  opaque?: string;\n}\n\n/**\n * Client certificate for mTLS\n */\nexport interface ClientCertificate {\n  /**\n   * Certificate in PEM format\n   */\n  cert: string;\n\n  /**\n   * Private key in PEM format\n   */\n  key: string;\n\n  /**\n   * Passphrase for encrypted key\n   */\n  passphrase?: string;\n\n  /**\n   * CA certificates\n   */\n  ca?: string | string[];\n}\n\n/**\n * AWS credentials for Signature V4\n */\nexport interface AWSCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string;\n  region?: string;\n  service?: string;\n}\n\n/**\n * Data to be signed for signature-based auth\n */\nexport interface SignatureData {\n  method: string;\n  url: string;\n  headers: Record<string, string>;\n  body?: string;\n  timestamp?: number;\n}\n\n/**\n * Resolved security parameters ready to be added to HTTP request\n */\nexport interface ResolvedSecurity {\n  /**\n   * Headers to add to the request\n   */\n  headers: Record<string, string>;\n\n  /**\n   * Query parameters to add to the request\n   */\n  query: Record<string, string>;\n\n  /**\n   * Cookie values to add to the request\n   */\n  cookies: Record<string, string>;\n\n  /**\n   * Client certificate for mTLS (if applicable)\n   */\n  clientCertificate?: ClientCertificate;\n\n  /**\n   * Whether signature-based auth is required\n   * If true, you need to call signRequest() before sending\n   */\n  requiresSignature?: boolean;\n\n  /**\n   * Signature metadata (if signature-based auth is used)\n   */\n  signatureInfo?: {\n    scheme: string;\n    algorithm?: string;\n  };\n}\n\n/**\n * Security resolver that maps OpenAPI security requirements to actual auth values\n *\n * This helper handles security parameters from any OpenAPI spec, regardless of\n * custom naming (BearerAuth, JWT, Authorization, etc.). It uses the mapper's\n * security metadata to determine the auth type and format.\n *\n * @example\n * ```typescript\n * // In FrontMCP\n * const resolver = new SecurityResolver();\n * const resolved = resolver.resolve(tool.mapper, {\n *   jwt: context.authInfo.jwt,\n *   apiKey: process.env.API_KEY\n * });\n *\n * // Use resolved.headers in HTTP request\n * fetch(url, { headers: { ...resolved.headers, ...otherHeaders } });\n * ```\n *\n * @example\n * ```typescript\n * // Custom resolver for framework-specific auth\n * const resolved = resolver.resolve(tool.mapper, {\n *   customResolver: (security) => {\n *     if (security.type === 'http' && security.httpScheme === 'bearer') {\n *       return myFramework.getAuthToken();\n *     }\n *     return undefined;\n *   }\n * });\n * ```\n */\nexport class SecurityResolver {\n  /**\n   * Resolve security parameters from mapper entries\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param context - Security context with auth values or custom resolver\n   * @returns Resolved headers, query params, and cookies with auth applied\n   */\n  async resolve(mappers: ParameterMapper[], context: SecurityContext): Promise<ResolvedSecurity> {\n    const resolved: ResolvedSecurity = {\n      headers: {},\n      query: {},\n      cookies: {},\n    };\n\n    // Add client certificate if available (for mTLS)\n    if (context.clientCertificate) {\n      resolved.clientCertificate = context.clientCertificate;\n    }\n\n    // Check if signature-based auth is needed\n    let requiresSignature = false;\n    let signatureScheme: string | undefined;\n\n    for (const mapper of mappers) {\n      // Skip non-security parameters\n      if (!mapper.security) {\n        continue;\n      }\n\n      // Check for signature-based auth\n      if (this.isSignatureBasedAuth(mapper.security)) {\n        requiresSignature = true;\n        signatureScheme = mapper.security.scheme;\n        // Signature will be added later by signRequest()\n        continue;\n      }\n\n      // Try to resolve the auth value\n      const authValue = await this.resolveAuthValue(mapper.security, context);\n      if (!authValue) {\n        // Auth value not available - skip this security requirement\n        // Framework may want to throw an error or log a warning\n        continue;\n      }\n\n      // Apply to the correct location\n      const headerName = mapper.key;\n\n      if (mapper.type === 'header') {\n        resolved.headers[headerName] = authValue;\n      } else if (mapper.type === 'query') {\n        resolved.query[headerName] = authValue;\n      } else if (mapper.type === 'cookie') {\n        resolved.cookies[headerName] = authValue;\n      }\n    }\n\n    // Add context cookies if available\n    if (context.cookies) {\n      resolved.cookies = { ...resolved.cookies, ...context.cookies };\n    }\n\n    // Add signature metadata if needed\n    if (requiresSignature) {\n      resolved.requiresSignature = true;\n      resolved.signatureInfo = {\n        scheme: signatureScheme || 'unknown',\n      };\n    }\n\n    return resolved;\n  }\n\n  /**\n   * Check if security scheme requires request signing\n   */\n  private isSignatureBasedAuth(security: SecurityParameterInfo): boolean {\n    // Check for schemes that typically require signing\n    const signatureSchemes = ['aws4', 'hmac', 'signature', 'hawk', 'custom-signature'];\n    return signatureSchemes.some(scheme =>\n      security.scheme.toLowerCase().includes(scheme)\n    );\n  }\n\n  /**\n   * Resolve the actual auth value based on security type\n   */\n  private async resolveAuthValue(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): Promise<string | undefined> {\n    // Try custom resolver first\n    if (context.customResolver) {\n      const customValue = await context.customResolver(security);\n      if (customValue !== undefined) {\n        return customValue;\n      }\n    }\n\n    // Handle standard security types\n    if (security.type === 'http') {\n      return this.resolveHttpAuth(security, context);\n    } else if (security.type === 'apiKey') {\n      return this.resolveApiKey(security, context);\n    } else if (security.type === 'oauth2' || security.type === 'openIdConnect') {\n      return this.resolveOAuth2(security, context);\n    }\n\n    return undefined;\n  }\n\n  /**\n   * Resolve HTTP authentication (bearer, basic, digest, etc.)\n   */\n  private resolveHttpAuth(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    const scheme = security.httpScheme?.toLowerCase() || 'bearer';\n\n    switch (scheme) {\n      case 'bearer':\n        return this.resolveBearerAuth(context);\n\n      case 'basic':\n        return this.resolveBasicAuth(context);\n\n      case 'digest':\n        return this.resolveDigestAuth(context);\n\n      case 'hoba':\n      case 'mutual':\n      case 'negotiate':\n      case 'vapid':\n      case 'scram':\n        // These schemes typically require custom implementation\n        // Try custom headers or signature generator\n        return this.resolveCustomHttpScheme(scheme, security, context);\n\n      default:\n        // Unknown scheme - try custom resolver\n        return undefined;\n    }\n  }\n\n  /**\n   * Resolve Bearer token authentication\n   */\n  private resolveBearerAuth(context: SecurityContext): string | undefined {\n    const token = context.jwt;\n    if (!token) return undefined;\n    return `Bearer ${token}`;\n  }\n\n  /**\n   * Resolve Basic authentication\n   */\n  private resolveBasicAuth(context: SecurityContext): string | undefined {\n    const credentials = context.basic;\n    if (!credentials) return undefined;\n    return `Basic ${credentials}`;\n  }\n\n  /**\n   * Resolve Digest authentication\n   */\n  private resolveDigestAuth(context: SecurityContext): string | undefined {\n    const digest = context.digest;\n    if (!digest) return undefined;\n\n    // Build digest auth header\n    const parts: string[] = [\n      `username=\"${digest.username}\"`,\n      digest.realm ? `realm=\"${digest.realm}\"` : '',\n      digest.nonce ? `nonce=\"${digest.nonce}\"` : '',\n      digest.uri ? `uri=\"${digest.uri}\"` : '',\n      digest.response ? `response=\"${digest.response}\"` : '',\n      digest.opaque ? `opaque=\"${digest.opaque}\"` : '',\n      digest.qop ? `qop=${digest.qop}` : '',\n      digest.nc ? `nc=${digest.nc}` : '',\n      digest.cnonce ? `cnonce=\"${digest.cnonce}\"` : '',\n    ].filter(Boolean);\n\n    return `Digest ${parts.join(', ')}`;\n  }\n\n  /**\n   * Resolve custom HTTP authentication schemes\n   */\n  private resolveCustomHttpScheme(\n    scheme: string,\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    // Try custom headers first\n    const headerKey = security.apiKeyName || `X-${scheme.toUpperCase()}`;\n    if (context.customHeaders?.[headerKey]) {\n      return context.customHeaders[headerKey];\n    }\n\n    // Unknown scheme\n    return undefined;\n  }\n\n  /**\n   * Resolve API key authentication\n   */\n  private resolveApiKey(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    // Try named API keys first (for multiple keys)\n    if (context.apiKeys && security.apiKeyName) {\n      const key = context.apiKeys[security.apiKeyName];\n      if (key) return key;\n    }\n\n    // Try custom headers (for proprietary auth headers like X-Custom-Auth)\n    if (context.customHeaders && security.apiKeyName) {\n      const header = context.customHeaders[security.apiKeyName];\n      if (header) return header;\n    }\n\n    // Fall back to single apiKey (backward compatibility)\n    return context.apiKey;\n  }\n\n  /**\n   * Resolve OAuth2/OpenID Connect authentication\n   */\n  private resolveOAuth2(\n    security: SecurityParameterInfo,\n    context: SecurityContext\n  ): string | undefined {\n    const token = context.oauth2Token;\n    if (!token) return undefined;\n\n    // OAuth2 tokens are typically formatted as \"Bearer {token}\"\n    return `Bearer ${token}`;\n  }\n\n  /**\n   * Check if any security requirements are missing from context\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param context - Security context with auth values\n   * @returns Array of missing security scheme names\n   */\n  async checkMissingSecurity(\n    mappers: ParameterMapper[],\n    context: SecurityContext\n  ): Promise<string[]> {\n    const missing: string[] = [];\n\n    for (const mapper of mappers) {\n      if (!mapper.security) continue;\n\n      const authValue = await this.resolveAuthValue(mapper.security, context);\n      if (!authValue) {\n        missing.push(mapper.security.scheme);\n      }\n    }\n\n    return missing;\n  }\n\n  /**\n   * Sign a request for signature-based authentication\n   *\n   * Use this when resolved.requiresSignature is true.\n   * This method will call the signatureGenerator from context to sign the request.\n   *\n   * @param mappers - Parameter mappers from the tool definition\n   * @param signatureData - Request data to sign\n   * @param context - Security context with signature generator\n   * @returns Headers with signature added\n   *\n   * @example\n   * ```typescript\n   * const resolved = resolver.resolve(tool.mapper, context);\n   * if (resolved.requiresSignature) {\n   *   const signedHeaders = await resolver.signRequest(\n   *     tool.mapper,\n   *     { method: 'GET', url: 'https://api.example.com/data', headers: resolved.headers },\n   *     context\n   *   );\n   *   // Use signedHeaders in request\n   * }\n   * ```\n   */\n  async signRequest(\n    mappers: ParameterMapper[],\n    signatureData: SignatureData,\n    context: SecurityContext\n  ): Promise<Record<string, string>> {\n    const headers: Record<string, string> = { ...signatureData.headers };\n\n    if (!context.signatureGenerator) {\n      throw new Error('Signature-based auth required but no signatureGenerator provided');\n    }\n\n    for (const mapper of mappers) {\n      if (!mapper.security || !this.isSignatureBasedAuth(mapper.security)) {\n        continue;\n      }\n\n      // Call signature generator\n      const signature = await context.signatureGenerator(signatureData, mapper.security);\n\n      // Add signature to appropriate location\n      if (mapper.type === 'header') {\n        headers[mapper.key] = signature;\n      }\n      // Note: Query/cookie signatures would be handled differently\n    }\n\n    return headers;\n  }\n}\n\n/**\n * Create a basic security context from common auth sources\n *\n * @example\n * ```typescript\n * const context = createSecurityContext({\n *   jwt: process.env.JWT_TOKEN,\n *   apiKey: process.env.API_KEY\n * });\n * ```\n */\nexport function createSecurityContext(\n  auth: Partial<SecurityContext>\n): SecurityContext {\n  return {\n    ...auth,\n    jwt: auth.jwt,\n    basic: auth.basic,\n    apiKey: auth.apiKey,\n    oauth2Token: auth.oauth2Token,\n    customResolver: auth.customResolver,\n  };\n}\n"]}

package/src/types.d.ts

@@ -19,7 +19,7 @@ export type ParameterLocation = 'path' | 'query' | 'header' | 'cookie' | 'body';
 /**
  * Authentication types supported
  */
-export type AuthType = 'apiKey' | 'http' | 'oauth2' | 'openIdConnect';
+export type AuthType = 'apiKey' | 'http' | 'oauth2' | 'openIdConnect' | 'mutualTLS';
 export type OperationObject = OpenAPIV3.OperationObject | OpenAPIV3_1.OperationObject;
 export type ParameterObject = OpenAPIV3.ParameterObject | OpenAPIV3_1.ParameterObject;
 export type RequestBodyObject = OpenAPIV3.RequestBodyObject | OpenAPIV3_1.RequestBodyObject;
@@ -112,6 +112,11 @@ export interface ParameterMapper {
      * Custom serialization info
      */
     serialization?: SerializationInfo;
+    /**
+     * Security scheme information (if this is an auth parameter)
+     * This allows frameworks to resolve auth from context, env vars, etc.
+     */
+    security?: SecurityParameterInfo;
 }
 /**
  * Serialization information for complex parameters
@@ -126,6 +131,44 @@ export interface SerializationInfo {
      */
     encoding?: Record<string, EncodingObject>;
 }
+/**
+ * Security parameter information for framework-agnostic auth resolution
+ */
+export interface SecurityParameterInfo {
+    /**
+     * Security scheme name from OpenAPI (e.g., "BearerAuth")
+     */
+    scheme: string;
+    /**
+     * Security type (apiKey, http, oauth2, openIdConnect)
+     */
+    type: AuthType;
+    /**
+     * HTTP authentication scheme (for type: "http")
+     * e.g., "bearer", "basic"
+     */
+    httpScheme?: string;
+    /**
+     * Bearer token format (e.g., "JWT")
+     */
+    bearerFormat?: string;
+    /**
+     * Required OAuth2 scopes
+     */
+    scopes?: string[];
+    /**
+     * API key parameter name (for type: "apiKey")
+     */
+    apiKeyName?: string;
+    /**
+     * API key location (for type: "apiKey")
+     */
+    apiKeyIn?: 'query' | 'header' | 'cookie';
+    /**
+     * Description of the security scheme
+     */
+    description?: string;
+}
 /**
  * Additional metadata about the generated tool
  */
@@ -191,6 +234,19 @@ export interface SecurityRequirement {
      * Parameter location (for API key)
      */
     in?: 'query' | 'header' | 'cookie';
+    /**
+     * HTTP authentication scheme (for type: "http")
+     * e.g., "bearer", "basic"
+     */
+    httpScheme?: string;
+    /**
+     * Bearer token format (e.g., "JWT")
+     */
+    bearerFormat?: string;
+    /**
+     * Description of the security scheme
+     */
+    description?: string;
 }
 /**
  * Server information
@@ -296,6 +352,13 @@ export interface GenerateOptions {
      * @default false
      */
     includeExamples?: boolean;
+    /**
+     * Whether to include security requirements as input parameters
+     * If false, security is only in mapper (frameworks resolve from context/env/etc.)
+     * If true, security is added to inputSchema as explicit parameters
+     * @default false
+     */
+    includeSecurityInInput?: boolean;
 }
 /**
  * Naming strategy for resolving parameter conflicts

package/src/types.js

@@ -18,20 +18,81 @@ function toJSONSchema7(schema) {
         return { $ref: schema.$ref };
     }
     // Handle OpenAPI 3.0 boolean exclusiveMaximum/exclusiveMinimum
-    const result = { ...schema };
-    // Convert boolean exclusiveMaximum to number format (JSON Schema Draft 7)
-    if ('exclusiveMaximum' in schema && typeof schema.exclusiveMaximum === 'boolean') {
-        if (schema.exclusiveMaximum && 'maximum' in schema) {
-            result.exclusiveMaximum = schema.maximum;
-            delete result.maximum;
+    // by converting them to JSON Schema Draft 7 numeric format
+    const { exclusiveMaximum, exclusiveMinimum, maximum, minimum, ...rest } = schema;
+    const result = { ...rest };
+    // Handle exclusiveMaximum conversion
+    if (typeof exclusiveMaximum === 'boolean') {
+        if (exclusiveMaximum && maximum !== undefined) {
+            // true + maximum present -> convert to numeric exclusiveMaximum
+            result['exclusiveMaximum'] = maximum;
+        }
+        else if (maximum !== undefined) {
+            // false or true without maximum -> keep maximum only
+            result['maximum'] = maximum;
+        }
+        // Boolean exclusiveMaximum is never added (invalid in JSON Schema 7)
+    }
+    else if (exclusiveMaximum !== undefined) {
+        // Already numeric (OpenAPI 3.1) - keep as is
+        result['exclusiveMaximum'] = exclusiveMaximum;
+        if (maximum !== undefined) {
+            result['maximum'] = maximum;
         }
     }
-    // Convert boolean exclusiveMinimum to number format (JSON Schema Draft 7)
-    if ('exclusiveMinimum' in schema && typeof schema.exclusiveMinimum === 'boolean') {
-        if (schema.exclusiveMinimum && 'minimum' in schema) {
-            result.exclusiveMinimum = schema.minimum;
-            delete result.minimum;
+    else if (maximum !== undefined) {
+        // No exclusiveMaximum, just maximum
+        result['maximum'] = maximum;
+    }
+    // Handle exclusiveMinimum conversion
+    if (typeof exclusiveMinimum === 'boolean') {
+        if (exclusiveMinimum && minimum !== undefined) {
+            // true + minimum present -> convert to numeric exclusiveMinimum
+            result['exclusiveMinimum'] = minimum;
+        }
+        else if (minimum !== undefined) {
+            // false or true without minimum -> keep minimum only
+            result['minimum'] = minimum;
         }
+        // Boolean exclusiveMinimum is never added (invalid in JSON Schema 7)
+    }
+    else if (exclusiveMinimum !== undefined) {
+        // Already numeric (OpenAPI 3.1) - keep as is
+        result['exclusiveMinimum'] = exclusiveMinimum;
+        if (minimum !== undefined) {
+            result['minimum'] = minimum;
+        }
+    }
+    else if (minimum !== undefined) {
+        // No exclusiveMinimum, just minimum
+        result['minimum'] = minimum;
+    }
+    // Recursively convert nested schemas to ensure all nested schemas are valid JSONSchema7
+    if (result['properties'] && typeof result['properties'] === 'object') {
+        const props = {};
+        for (const [key, value] of Object.entries(result['properties'])) {
+            props[key] = toJSONSchema7(value);
+        }
+        result['properties'] = props;
+    }
+    if (result['items']) {
+        if (Array.isArray(result['items'])) {
+            result['items'] = result['items'].map(toJSONSchema7);
+        }
+        else {
+            result['items'] = toJSONSchema7(result['items']);
+        }
+    }
+    if (result['additionalProperties'] && typeof result['additionalProperties'] === 'object') {
+        result['additionalProperties'] = toJSONSchema7(result['additionalProperties']);
+    }
+    for (const key of ['allOf', 'anyOf', 'oneOf']) {
+        if (result[key] && Array.isArray(result[key])) {
+            result[key] = result[key].map(toJSONSchema7);
+        }
+    }
+    if (result['not']) {
+        result['not'] = toJSONSchema7(result['not']);
     }
     return result;
 }

package/src/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";;AAoDA,8CAEC;AAOD,sCAyBC;AArCD;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAQ;IACxC,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,MAAsC;IAClE,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAiB,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,MAAM,MAAM,GAAgB,EAAE,GAAG,MAAM,EAAS,CAAC;IAEjD,0EAA0E;IAC1E,IAAI,kBAAkB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,gBAAgB,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAiB,CAAC;YACnD,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,IAAI,kBAAkB,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACjF,IAAI,MAAM,CAAC,gBAAgB,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACnD,MAAM,CAAC,gBAAgB,GAAG,MAAM,CAAC,OAAiB,CAAC;YACnD,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import type { JSONSchema7 } from 'json-schema';\nimport type { OpenAPIV3, OpenAPIV3_1 } from 'openapi-types';\n\n/**\n * OpenAPI specification version 3.0.x or 3.1.x\n */\nexport type OpenAPIVersion = '3.0.0' | '3.0.1' | '3.0.2' | '3.0.3' | '3.1.0';\n\n/**\n * Unified OpenAPI Document type (supports both 3.0 and 3.1)\n */\nexport type OpenAPIDocument = OpenAPIV3.Document | OpenAPIV3_1.Document;\n\n/**\n * HTTP methods supported by OpenAPI\n */\nexport type HTTPMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'head' | 'options' | 'trace';\n\n/**\n * Parameter location types\n */\nexport type ParameterLocation = 'path' | 'query' | 'header' | 'cookie' | 'body';\n\n/**\n * Authentication types supported\n */\nexport type AuthType = 'apiKey' | 'http' | 'oauth2' | 'openIdConnect';\n\n// Re-export OpenAPI types for convenience\nexport type OperationObject = OpenAPIV3.OperationObject | OpenAPIV3_1.OperationObject;\nexport type ParameterObject = OpenAPIV3.ParameterObject | OpenAPIV3_1.ParameterObject;\nexport type RequestBodyObject = OpenAPIV3.RequestBodyObject | OpenAPIV3_1.RequestBodyObject;\nexport type ResponseObject = OpenAPIV3.ResponseObject | OpenAPIV3_1.ResponseObject;\nexport type ResponsesObject = OpenAPIV3.ResponsesObject | OpenAPIV3_1.ResponsesObject;\nexport type MediaTypeObject = OpenAPIV3.MediaTypeObject | OpenAPIV3_1.MediaTypeObject;\nexport type HeaderObject = OpenAPIV3.HeaderObject | OpenAPIV3_1.HeaderObject;\nexport type ExampleObject = OpenAPIV3.ExampleObject | OpenAPIV3_1.ExampleObject;\nexport type PathItemObject = OpenAPIV3.PathItemObject | OpenAPIV3_1.PathItemObject;\nexport type PathsObject = OpenAPIV3.PathsObject | OpenAPIV3_1.PathsObject;\nexport type ServerObject = OpenAPIV3.ServerObject | OpenAPIV3_1.ServerObject;\nexport type SecuritySchemeObject = OpenAPIV3.SecuritySchemeObject | OpenAPIV3_1.SecuritySchemeObject;\nexport type ReferenceObject = OpenAPIV3.ReferenceObject | OpenAPIV3_1.ReferenceObject;\nexport type TagObject = OpenAPIV3.TagObject | OpenAPIV3_1.TagObject;\nexport type ExternalDocumentationObject = OpenAPIV3.ExternalDocumentationObject | OpenAPIV3_1.ExternalDocumentationObject;\nexport type ServerVariableObject = OpenAPIV3.ServerVariableObject | OpenAPIV3_1.ServerVariableObject;\nexport type EncodingObject = OpenAPIV3.EncodingObject | OpenAPIV3_1.EncodingObject;\nexport type SecurityRequirementObject = OpenAPIV3.SecurityRequirementObject | OpenAPIV3_1.SecurityRequirementObject;\nexport type SchemaObject = OpenAPIV3.SchemaObject | OpenAPIV3_1.SchemaObject;\n\n/**\n * Helper to check if an object is a ReferenceObject\n */\nexport function isReferenceObject(obj: any): obj is ReferenceObject {\n  return obj && typeof obj === 'object' && '$ref' in obj;\n}\n\n/**\n * Convert OpenAPI schema to JSONSchema7\n * Note: OpenAPI 3.0 uses a subset of JSON Schema Draft 4\n * OpenAPI 3.1 uses JSON Schema Draft 2020-12\n */\nexport function toJSONSchema7(schema: SchemaObject | ReferenceObject): JSONSchema7 {\n  if (isReferenceObject(schema)) {\n    return { $ref: schema.$ref } as JSONSchema7;\n  }\n\n  // Handle OpenAPI 3.0 boolean exclusiveMaximum/exclusiveMinimum\n  const result: JSONSchema7 = { ...schema } as any;\n\n  // Convert boolean exclusiveMaximum to number format (JSON Schema Draft 7)\n  if ('exclusiveMaximum' in schema && typeof schema.exclusiveMaximum === 'boolean') {\n    if (schema.exclusiveMaximum && 'maximum' in schema) {\n      result.exclusiveMaximum = schema.maximum as number;\n      delete result.maximum;\n    }\n  }\n\n  // Convert boolean exclusiveMinimum to number format (JSON Schema Draft 7)\n  if ('exclusiveMinimum' in schema && typeof schema.exclusiveMinimum === 'boolean') {\n    if (schema.exclusiveMinimum && 'minimum' in schema) {\n      result.exclusiveMinimum = schema.minimum as number;\n      delete result.minimum;\n    }\n  }\n\n  return result;\n}\n\n/**\n * Main MCP Tool definition generated from OpenAPI\n */\nexport interface McpOpenAPITool {\n  /**\n   * Unique tool name (from operationId or generated)\n   */\n  name: string;\n\n  /**\n   * Tool description (from operation summary/description)\n   */\n  description: string;\n\n  /**\n   * Combined input schema including all parameters\n   * (path, query, header, cookie, body)\n   */\n  inputSchema: JSONSchema7;\n\n  /**\n   * Output schema based on response definitions\n   * Can be a union of multiple status codes\n   */\n  outputSchema?: JSONSchema7;\n\n  /**\n   * Mapping from input schema properties to actual request parameters\n   */\n  mapper: ParameterMapper[];\n\n  /**\n   * Additional metadata about the tool\n   */\n  metadata: ToolMetadata;\n}\n\n/**\n * Maps input schema properties to their actual request locations\n */\nexport interface ParameterMapper {\n  /**\n   * Property name in the input schema\n   */\n  inputKey: string;\n\n  /**\n   * Where this parameter should be placed in the request\n   */\n  type: ParameterLocation;\n\n  /**\n   * Original parameter name (before conflict resolution)\n   */\n  key: string;\n\n  /**\n   * Whether this parameter is required\n   */\n  required?: boolean;\n\n  /**\n   * Parameter style (for path/query parameters)\n   */\n  style?: string;\n\n  /**\n   * Whether to explode arrays/objects\n   */\n  explode?: boolean;\n\n  /**\n   * Custom serialization info\n   */\n  serialization?: SerializationInfo;\n}\n\n/**\n * Serialization information for complex parameters\n */\nexport interface SerializationInfo {\n  /**\n   * Content type for body parameters\n   */\n  contentType?: string;\n\n  /**\n   * Encoding rules\n   */\n  encoding?: Record<string, EncodingObject>;\n}\n\n/**\n * Additional metadata about the generated tool\n */\nexport interface ToolMetadata {\n  /**\n   * Original OpenAPI path\n   */\n  path: string;\n\n  /**\n   * HTTP method\n   */\n  method: HTTPMethod;\n\n  /**\n   * Operation ID from OpenAPI\n   */\n  operationId?: string;\n\n  /**\n   * Tags from OpenAPI\n   */\n  tags?: string[];\n\n  /**\n   * Whether operation is deprecated\n   */\n  deprecated?: boolean;\n\n  /**\n   * Security requirements\n   */\n  security?: SecurityRequirement[];\n\n  /**\n   * Server information\n   */\n  servers?: ServerInfo[];\n\n  /**\n   * Response status codes included in output schema\n   */\n  responseStatusCodes?: number[];\n\n  /**\n   * External documentation\n   */\n  externalDocs?: ExternalDocumentationObject;\n}\n\n/**\n * Security requirement definition\n */\nexport interface SecurityRequirement {\n  /**\n   * Security scheme name\n   */\n  scheme: string;\n\n  /**\n   * Security type\n   */\n  type: AuthType;\n\n  /**\n   * Scopes required (for OAuth2/OpenID Connect)\n   */\n  scopes?: string[];\n\n  /**\n   * Parameter name (for API key)\n   */\n  name?: string;\n\n  /**\n   * Parameter location (for API key)\n   */\n  in?: 'query' | 'header' | 'cookie';\n}\n\n/**\n * Server information\n */\nexport interface ServerInfo {\n  /**\n   * Server URL\n   */\n  url: string;\n\n  /**\n   * Server description\n   */\n  description?: string;\n\n  /**\n   * Server variables\n   */\n  variables?: Record<string, ServerVariableObject>;\n}\n\n/**\n * Options for loading OpenAPI specifications\n */\nexport interface LoadOptions {\n  /**\n   * Whether to dereference $refs in schemas\n   * @default true\n   */\n  dereference?: boolean;\n\n  /**\n   * Base URL for API requests\n   * Overrides servers in OpenAPI spec\n   */\n  baseUrl?: string;\n\n  /**\n   * Custom HTTP headers for loading from URL\n   */\n  headers?: Record<string, string>;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000\n   */\n  timeout?: number;\n\n  /**\n   * Whether to validate the OpenAPI document\n   * @default true\n   */\n  validate?: boolean;\n\n  /**\n   * Whether to follow HTTP redirects\n   * @default true\n   */\n  followRedirects?: boolean;\n}\n\n/**\n * Operation object with additional context for filtering\n */\nexport type OperationWithContext = OperationObject & {\n  path: string;\n  method: string;\n};\n\n/**\n * Options for generating tools\n */\nexport interface GenerateOptions {\n  /**\n   * Include only these operation IDs\n   */\n  includeOperations?: string[];\n\n  /**\n   * Exclude these operation IDs\n   */\n  excludeOperations?: string[];\n\n  /**\n   * Custom filter function\n   */\n  filterFn?: (operation: OperationWithContext) => boolean;\n\n  /**\n   * Naming strategy for resolving conflicts\n   */\n  namingStrategy?: NamingStrategy;\n\n  /**\n   * Preferred response status codes (in order of preference)\n   * @default [200, 201, 204, 202, 203, 206]\n   */\n  preferredStatusCodes?: number[];\n\n  /**\n   * Whether to include deprecated operations\n   * @default false\n   */\n  includeDeprecated?: boolean;\n\n  /**\n   * Whether to include all response codes in output schema\n   * If false, only preferred status code is used\n   * @default true\n   */\n  includeAllResponses?: boolean;\n\n  /**\n   * Maximum depth for dereferencing schemas\n   * @default 10\n   */\n  maxSchemaDepth?: number;\n\n  /**\n   * Whether to include examples in schemas\n   * @default false\n   */\n  includeExamples?: boolean;\n}\n\n/**\n * Naming strategy for resolving parameter conflicts\n */\nexport interface NamingStrategy {\n  /**\n   * Resolver function for parameter name conflicts\n   * @param paramName - Original parameter name\n   * @param location - Parameter location\n   * @param index - Index of conflicting parameter (0-based)\n   * @returns New parameter name\n   */\n  conflictResolver: (\n    paramName: string,\n    location: ParameterLocation,\n    index: number\n  ) => string;\n\n  /**\n   * Function to generate tool names\n   * @param path - OpenAPI path\n   * @param method - HTTP method\n   * @param operationId - Operation ID if available\n   * @returns Tool name\n   */\n  toolNameGenerator?: (\n    path: string,\n    method: HTTPMethod,\n    operationId?: string\n  ) => string;\n}\n\n/**\n * Validation result\n */\nexport interface ValidationResult {\n  /**\n   * Whether the document is valid\n   */\n  valid: boolean;\n\n  /**\n   * Validation errors\n   */\n  errors?: ValidationErrorDetail[];\n\n  /**\n   * Validation warnings\n   */\n  warnings?: ValidationWarning[];\n}\n\n/**\n * Validation error detail\n */\nexport interface ValidationErrorDetail {\n  /**\n   * Error message\n   */\n  message: string;\n\n  /**\n   * Error path (JSON pointer)\n   */\n  path?: string;\n\n  /**\n   * Error code\n   */\n  code?: string;\n}\n\n/**\n * Validation warning\n */\nexport interface ValidationWarning {\n  /**\n   * Warning message\n   */\n  message: string;\n\n  /**\n   * Warning path (JSON pointer)\n   */\n  path?: string;\n\n  /**\n   * Warning code\n   */\n  code?: string;\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/types.ts"],"names":[],"mappings":";;AAsDA,8CAEC;AAOD,sCAqFC;AAjGD;;GAEG;AACH,SAAgB,iBAAiB,CAAC,GAAQ;IACxC,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,MAAsC;IAClE,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAiB,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,2DAA2D;IAC3D,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;IAEjF,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,EAAE,CAAC;IAEpD,qCAAqC;IACrC,IAAI,OAAO,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,gBAAgB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,gEAAgE;YAChE,MAAM,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC;QACvC,CAAC;aAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,qDAAqD;YACrD,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAC9B,CAAC;QACD,qEAAqE;IACvE,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,6CAA6C;QAC7C,MAAM,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,oCAAoC;QACpC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,qCAAqC;IACrC,IAAI,OAAO,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,IAAI,gBAAgB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9C,gEAAgE;YAChE,MAAM,CAAC,kBAAkB,CAAC,GAAG,OAAO,CAAC;QACvC,CAAC;aAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACjC,qDAAqD;YACrD,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAC9B,CAAC;QACD,qEAAqE;IACvE,CAAC;SAAM,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QAC1C,6CAA6C;QAC7C,MAAM,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;QAC9B,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,oCAAoC;QACpC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC;IAC9B,CAAC;IAED,wFAAwF;IACxF,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,OAAO,MAAM,CAAC,YAAY,CAAC,KAAK,QAAQ,EAAE,CAAC;QACrE,MAAM,KAAK,GAAgC,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAmD,CAAC,EAAE,CAAC;YAClH,KAAK,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,OAAO,CAAC,GAAI,MAAM,CAAC,OAAO,CAAwC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC/F,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,OAAO,CAAmC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,sBAAsB,CAAC,IAAI,OAAO,MAAM,CAAC,sBAAsB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACzF,MAAM,CAAC,sBAAsB,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,sBAAsB,CAAmC,CAAC,CAAC;IACnH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACvD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,CAAC,GAAI,MAAM,CAAC,GAAG,CAAwC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAmC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAqB,CAAC;AAC/B,CAAC","sourcesContent":["import type { JSONSchema7 } from 'json-schema';\nimport type { OpenAPIV3, OpenAPIV3_1 } from 'openapi-types';\n\n/**\n * OpenAPI specification version 3.0.x or 3.1.x\n */\nexport type OpenAPIVersion = '3.0.0' | '3.0.1' | '3.0.2' | '3.0.3' | '3.1.0';\n\n/**\n * Unified OpenAPI Document type (supports both 3.0 and 3.1)\n */\nexport type OpenAPIDocument = OpenAPIV3.Document | OpenAPIV3_1.Document;\n\n/**\n * HTTP methods supported by OpenAPI\n */\nexport type HTTPMethod = 'get' | 'post' | 'put' | 'patch' | 'delete' | 'head' | 'options' | 'trace';\n\n/**\n * Parameter location types\n */\nexport type ParameterLocation = 'path' | 'query' | 'header' | 'cookie' | 'body';\n\n/**\n * Authentication types supported\n */\nexport type AuthType = 'apiKey' | 'http' | 'oauth2' | 'openIdConnect' | 'mutualTLS';\n\n// Re-export OpenAPI types for convenience\nexport type OperationObject = OpenAPIV3.OperationObject | OpenAPIV3_1.OperationObject;\nexport type ParameterObject = OpenAPIV3.ParameterObject | OpenAPIV3_1.ParameterObject;\nexport type RequestBodyObject = OpenAPIV3.RequestBodyObject | OpenAPIV3_1.RequestBodyObject;\nexport type ResponseObject = OpenAPIV3.ResponseObject | OpenAPIV3_1.ResponseObject;\nexport type ResponsesObject = OpenAPIV3.ResponsesObject | OpenAPIV3_1.ResponsesObject;\nexport type MediaTypeObject = OpenAPIV3.MediaTypeObject | OpenAPIV3_1.MediaTypeObject;\nexport type HeaderObject = OpenAPIV3.HeaderObject | OpenAPIV3_1.HeaderObject;\nexport type ExampleObject = OpenAPIV3.ExampleObject | OpenAPIV3_1.ExampleObject;\nexport type PathItemObject = OpenAPIV3.PathItemObject | OpenAPIV3_1.PathItemObject;\nexport type PathsObject = OpenAPIV3.PathsObject | OpenAPIV3_1.PathsObject;\nexport type ServerObject = OpenAPIV3.ServerObject | OpenAPIV3_1.ServerObject;\nexport type SecuritySchemeObject = OpenAPIV3.SecuritySchemeObject | OpenAPIV3_1.SecuritySchemeObject;\nexport type ReferenceObject = OpenAPIV3.ReferenceObject | OpenAPIV3_1.ReferenceObject;\nexport type TagObject = OpenAPIV3.TagObject | OpenAPIV3_1.TagObject;\nexport type ExternalDocumentationObject =\n  | OpenAPIV3.ExternalDocumentationObject\n  | OpenAPIV3_1.ExternalDocumentationObject;\nexport type ServerVariableObject = OpenAPIV3.ServerVariableObject | OpenAPIV3_1.ServerVariableObject;\nexport type EncodingObject = OpenAPIV3.EncodingObject | OpenAPIV3_1.EncodingObject;\nexport type SecurityRequirementObject = OpenAPIV3.SecurityRequirementObject | OpenAPIV3_1.SecurityRequirementObject;\nexport type SchemaObject = OpenAPIV3.SchemaObject | OpenAPIV3_1.SchemaObject;\n\n/**\n * Helper to check if an object is a ReferenceObject\n */\nexport function isReferenceObject(obj: any): obj is ReferenceObject {\n  return obj && typeof obj === 'object' && '$ref' in obj;\n}\n\n/**\n * Convert OpenAPI schema to JSONSchema7\n * Note: OpenAPI 3.0 uses a subset of JSON Schema Draft 4\n * OpenAPI 3.1 uses JSON Schema Draft 2020-12\n */\nexport function toJSONSchema7(schema: SchemaObject | ReferenceObject): JSONSchema7 {\n  if (isReferenceObject(schema)) {\n    return { $ref: schema.$ref } as JSONSchema7;\n  }\n\n  // Handle OpenAPI 3.0 boolean exclusiveMaximum/exclusiveMinimum\n  // by converting them to JSON Schema Draft 7 numeric format\n  const { exclusiveMaximum, exclusiveMinimum, maximum, minimum, ...rest } = schema;\n\n  const result: Record<string, unknown> = { ...rest };\n\n  // Handle exclusiveMaximum conversion\n  if (typeof exclusiveMaximum === 'boolean') {\n    if (exclusiveMaximum && maximum !== undefined) {\n      // true + maximum present -> convert to numeric exclusiveMaximum\n      result['exclusiveMaximum'] = maximum;\n    } else if (maximum !== undefined) {\n      // false or true without maximum -> keep maximum only\n      result['maximum'] = maximum;\n    }\n    // Boolean exclusiveMaximum is never added (invalid in JSON Schema 7)\n  } else if (exclusiveMaximum !== undefined) {\n    // Already numeric (OpenAPI 3.1) - keep as is\n    result['exclusiveMaximum'] = exclusiveMaximum;\n    if (maximum !== undefined) {\n      result['maximum'] = maximum;\n    }\n  } else if (maximum !== undefined) {\n    // No exclusiveMaximum, just maximum\n    result['maximum'] = maximum;\n  }\n\n  // Handle exclusiveMinimum conversion\n  if (typeof exclusiveMinimum === 'boolean') {\n    if (exclusiveMinimum && minimum !== undefined) {\n      // true + minimum present -> convert to numeric exclusiveMinimum\n      result['exclusiveMinimum'] = minimum;\n    } else if (minimum !== undefined) {\n      // false or true without minimum -> keep minimum only\n      result['minimum'] = minimum;\n    }\n    // Boolean exclusiveMinimum is never added (invalid in JSON Schema 7)\n  } else if (exclusiveMinimum !== undefined) {\n    // Already numeric (OpenAPI 3.1) - keep as is\n    result['exclusiveMinimum'] = exclusiveMinimum;\n    if (minimum !== undefined) {\n      result['minimum'] = minimum;\n    }\n  } else if (minimum !== undefined) {\n    // No exclusiveMinimum, just minimum\n    result['minimum'] = minimum;\n  }\n\n  // Recursively convert nested schemas to ensure all nested schemas are valid JSONSchema7\n  if (result['properties'] && typeof result['properties'] === 'object') {\n    const props: Record<string, JSONSchema7> = {};\n    for (const [key, value] of Object.entries(result['properties'] as Record<string, SchemaObject | ReferenceObject>)) {\n      props[key] = toJSONSchema7(value);\n    }\n    result['properties'] = props;\n  }\n\n  if (result['items']) {\n    if (Array.isArray(result['items'])) {\n      result['items'] = (result['items'] as (SchemaObject | ReferenceObject)[]).map(toJSONSchema7);\n    } else {\n      result['items'] = toJSONSchema7(result['items'] as SchemaObject | ReferenceObject);\n    }\n  }\n\n  if (result['additionalProperties'] && typeof result['additionalProperties'] === 'object') {\n    result['additionalProperties'] = toJSONSchema7(result['additionalProperties'] as SchemaObject | ReferenceObject);\n  }\n\n  for (const key of ['allOf', 'anyOf', 'oneOf'] as const) {\n    if (result[key] && Array.isArray(result[key])) {\n      result[key] = (result[key] as (SchemaObject | ReferenceObject)[]).map(toJSONSchema7);\n    }\n  }\n\n  if (result['not']) {\n    result['not'] = toJSONSchema7(result['not'] as SchemaObject | ReferenceObject);\n  }\n\n  return result as JSONSchema7;\n}\n\n/**\n * Main MCP Tool definition generated from OpenAPI\n */\nexport interface McpOpenAPITool {\n  /**\n   * Unique tool name (from operationId or generated)\n   */\n  name: string;\n\n  /**\n   * Tool description (from operation summary/description)\n   */\n  description: string;\n\n  /**\n   * Combined input schema including all parameters\n   * (path, query, header, cookie, body)\n   */\n  inputSchema: JSONSchema7;\n\n  /**\n   * Output schema based on response definitions\n   * Can be a union of multiple status codes\n   */\n  outputSchema?: JSONSchema7;\n\n  /**\n   * Mapping from input schema properties to actual request parameters\n   */\n  mapper: ParameterMapper[];\n\n  /**\n   * Additional metadata about the tool\n   */\n  metadata: ToolMetadata;\n}\n\n/**\n * Maps input schema properties to their actual request locations\n */\nexport interface ParameterMapper {\n  /**\n   * Property name in the input schema\n   */\n  inputKey: string;\n\n  /**\n   * Where this parameter should be placed in the request\n   */\n  type: ParameterLocation;\n\n  /**\n   * Original parameter name (before conflict resolution)\n   */\n  key: string;\n\n  /**\n   * Whether this parameter is required\n   */\n  required?: boolean;\n\n  /**\n   * Parameter style (for path/query parameters)\n   */\n  style?: string;\n\n  /**\n   * Whether to explode arrays/objects\n   */\n  explode?: boolean;\n\n  /**\n   * Custom serialization info\n   */\n  serialization?: SerializationInfo;\n\n  /**\n   * Security scheme information (if this is an auth parameter)\n   * This allows frameworks to resolve auth from context, env vars, etc.\n   */\n  security?: SecurityParameterInfo;\n}\n\n/**\n * Serialization information for complex parameters\n */\nexport interface SerializationInfo {\n  /**\n   * Content type for body parameters\n   */\n  contentType?: string;\n\n  /**\n   * Encoding rules\n   */\n  encoding?: Record<string, EncodingObject>;\n}\n\n/**\n * Security parameter information for framework-agnostic auth resolution\n */\nexport interface SecurityParameterInfo {\n  /**\n   * Security scheme name from OpenAPI (e.g., \"BearerAuth\")\n   */\n  scheme: string;\n\n  /**\n   * Security type (apiKey, http, oauth2, openIdConnect)\n   */\n  type: AuthType;\n\n  /**\n   * HTTP authentication scheme (for type: \"http\")\n   * e.g., \"bearer\", \"basic\"\n   */\n  httpScheme?: string;\n\n  /**\n   * Bearer token format (e.g., \"JWT\")\n   */\n  bearerFormat?: string;\n\n  /**\n   * Required OAuth2 scopes\n   */\n  scopes?: string[];\n\n  /**\n   * API key parameter name (for type: \"apiKey\")\n   */\n  apiKeyName?: string;\n\n  /**\n   * API key location (for type: \"apiKey\")\n   */\n  apiKeyIn?: 'query' | 'header' | 'cookie';\n\n  /**\n   * Description of the security scheme\n   */\n  description?: string;\n}\n\n/**\n * Additional metadata about the generated tool\n */\nexport interface ToolMetadata {\n  /**\n   * Original OpenAPI path\n   */\n  path: string;\n\n  /**\n   * HTTP method\n   */\n  method: HTTPMethod;\n\n  /**\n   * Operation ID from OpenAPI\n   */\n  operationId?: string;\n\n  /**\n   * Tags from OpenAPI\n   */\n  tags?: string[];\n\n  /**\n   * Whether operation is deprecated\n   */\n  deprecated?: boolean;\n\n  /**\n   * Security requirements\n   */\n  security?: SecurityRequirement[];\n\n  /**\n   * Server information\n   */\n  servers?: ServerInfo[];\n\n  /**\n   * Response status codes included in output schema\n   */\n  responseStatusCodes?: number[];\n\n  /**\n   * External documentation\n   */\n  externalDocs?: ExternalDocumentationObject;\n}\n\n/**\n * Security requirement definition\n */\nexport interface SecurityRequirement {\n  /**\n   * Security scheme name\n   */\n  scheme: string;\n\n  /**\n   * Security type\n   */\n  type: AuthType;\n\n  /**\n   * Scopes required (for OAuth2/OpenID Connect)\n   */\n  scopes?: string[];\n\n  /**\n   * Parameter name (for API key)\n   */\n  name?: string;\n\n  /**\n   * Parameter location (for API key)\n   */\n  in?: 'query' | 'header' | 'cookie';\n\n  /**\n   * HTTP authentication scheme (for type: \"http\")\n   * e.g., \"bearer\", \"basic\"\n   */\n  httpScheme?: string;\n\n  /**\n   * Bearer token format (e.g., \"JWT\")\n   */\n  bearerFormat?: string;\n\n  /**\n   * Description of the security scheme\n   */\n  description?: string;\n}\n\n/**\n * Server information\n */\nexport interface ServerInfo {\n  /**\n   * Server URL\n   */\n  url: string;\n\n  /**\n   * Server description\n   */\n  description?: string;\n\n  /**\n   * Server variables\n   */\n  variables?: Record<string, ServerVariableObject>;\n}\n\n/**\n * Options for loading OpenAPI specifications\n */\nexport interface LoadOptions {\n  /**\n   * Whether to dereference $refs in schemas\n   * @default true\n   */\n  dereference?: boolean;\n\n  /**\n   * Base URL for API requests\n   * Overrides servers in OpenAPI spec\n   */\n  baseUrl?: string;\n\n  /**\n   * Custom HTTP headers for loading from URL\n   */\n  headers?: Record<string, string>;\n\n  /**\n   * Request timeout in milliseconds\n   * @default 30000\n   */\n  timeout?: number;\n\n  /**\n   * Whether to validate the OpenAPI document\n   * @default true\n   */\n  validate?: boolean;\n\n  /**\n   * Whether to follow HTTP redirects\n   * @default true\n   */\n  followRedirects?: boolean;\n}\n\n/**\n * Operation object with additional context for filtering\n */\nexport type OperationWithContext = OperationObject & {\n  path: string;\n  method: string;\n};\n\n/**\n * Options for generating tools\n */\nexport interface GenerateOptions {\n  /**\n   * Include only these operation IDs\n   */\n  includeOperations?: string[];\n\n  /**\n   * Exclude these operation IDs\n   */\n  excludeOperations?: string[];\n\n  /**\n   * Custom filter function\n   */\n  filterFn?: (operation: OperationWithContext) => boolean;\n\n  /**\n   * Naming strategy for resolving conflicts\n   */\n  namingStrategy?: NamingStrategy;\n\n  /**\n   * Preferred response status codes (in order of preference)\n   * @default [200, 201, 204, 202, 203, 206]\n   */\n  preferredStatusCodes?: number[];\n\n  /**\n   * Whether to include deprecated operations\n   * @default false\n   */\n  includeDeprecated?: boolean;\n\n  /**\n   * Whether to include all response codes in output schema\n   * If false, only preferred status code is used\n   * @default true\n   */\n  includeAllResponses?: boolean;\n\n  /**\n   * Maximum depth for dereferencing schemas\n   * @default 10\n   */\n  maxSchemaDepth?: number;\n\n  /**\n   * Whether to include examples in schemas\n   * @default false\n   */\n  includeExamples?: boolean;\n\n  /**\n   * Whether to include security requirements as input parameters\n   * If false, security is only in mapper (frameworks resolve from context/env/etc.)\n   * If true, security is added to inputSchema as explicit parameters\n   * @default false\n   */\n  includeSecurityInInput?: boolean;\n}\n\n/**\n * Naming strategy for resolving parameter conflicts\n */\nexport interface NamingStrategy {\n  /**\n   * Resolver function for parameter name conflicts\n   * @param paramName - Original parameter name\n   * @param location - Parameter location\n   * @param index - Index of conflicting parameter (0-based)\n   * @returns New parameter name\n   */\n  conflictResolver: (paramName: string, location: ParameterLocation, index: number) => string;\n\n  /**\n   * Function to generate tool names\n   * @param path - OpenAPI path\n   * @param method - HTTP method\n   * @param operationId - Operation ID if available\n   * @returns Tool name\n   */\n  toolNameGenerator?: (path: string, method: HTTPMethod, operationId?: string) => string;\n}\n\n/**\n * Validation result\n */\nexport interface ValidationResult {\n  /**\n   * Whether the document is valid\n   */\n  valid: boolean;\n\n  /**\n   * Validation errors\n   */\n  errors?: ValidationErrorDetail[];\n\n  /**\n   * Validation warnings\n   */\n  warnings?: ValidationWarning[];\n}\n\n/**\n * Validation error detail\n */\nexport interface ValidationErrorDetail {\n  /**\n   * Error message\n   */\n  message: string;\n\n  /**\n   * Error path (JSON pointer)\n   */\n  path?: string;\n\n  /**\n   * Error code\n   */\n  code?: string;\n}\n\n/**\n * Validation warning\n */\nexport interface ValidationWarning {\n  /**\n   * Warning message\n   */\n  message: string;\n\n  /**\n   * Warning path (JSON pointer)\n   */\n  path?: string;\n\n  /**\n   * Warning code\n   */\n  code?: string;\n}\n"]}

package/src/validator.js

@@ -150,7 +150,9 @@ class Validator {
         }
         // Check for path parameters in path string
         const pathParams = path.match(/\{([^}]+)\}/g)?.map((p) => p.slice(1, -1)) ?? [];
-        const definedPathParams = new Set(operation.parameters?.filter((p) => p.in === 'path').map((p) => p.name) ?? []);
+        const definedPathParams = new Set(operation.parameters
+            ?.filter((p) => p.in === 'path')
+            .map((p) => p.name) ?? []);
         for (const param of pathParams) {
             if (!definedPathParams.has(param)) {
                 errors.push({