openapi-mcp-codegen 0.2.0

package/dist/index.js

@@ -0,0 +1,1104 @@
+// src/parser/index.ts
+import { readFileSync } from "fs";
+import { extname } from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/parser/refs.ts
+function resolveRefs(spec) {
+  const root = JSON.parse(JSON.stringify(spec));
+  const MAX_DEPTH = 64;
+  const cache = /* @__PURE__ */ new Map();
+  function lookup(ref) {
+    if (!ref.startsWith("#/")) return null;
+    const parts = ref.slice(2).split("/").map((p) => p.replace(/~1/g, "/").replace(/~0/g, "~"));
+    let cur = root;
+    for (const p of parts) {
+      if (cur === null || typeof cur !== "object") return null;
+      cur = cur[p];
+    }
+    return cur ?? null;
+  }
+  function resolve(node, stack, depth) {
+    if (node === null || typeof node !== "object") return node;
+    if (depth > MAX_DEPTH) {
+      return Array.isArray(node) ? [] : {};
+    }
+    if (Array.isArray(node)) {
+      return node.map((n) => resolve(n, stack, depth + 1));
+    }
+    const obj = node;
+    if (typeof obj.$ref === "string") {
+      const ref = obj.$ref;
+      if (stack.includes(ref)) {
+        return { type: "object", description: "(circular reference truncated)" };
+      }
+      if (cache.has(ref)) return cache.get(ref);
+      const target = lookup(ref);
+      if (target === null || target === void 0) {
+        const { $ref: _discard, ...rest } = obj;
+        return resolve(rest, stack, depth + 1);
+      }
+      const resolved = resolve(target, [...stack, ref], 0);
+      cache.set(ref, resolved);
+      return resolved;
+    }
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+      out[k] = resolve(v, stack, depth + 1);
+    }
+    return out;
+  }
+  return resolve(root, [], 0);
+}
+
+// src/parser/index.ts
+async function parseSpec(input) {
+  const raw = await loadRaw(input);
+  const spec = deserialize(raw, input);
+  validateSpec(spec);
+  return resolveRefs(spec);
+}
+async function loadRaw(input) {
+  if (input.startsWith("http://") || input.startsWith("https://")) {
+    const res = await fetch(input);
+    if (!res.ok) {
+      throw new Error(`Failed to fetch spec from ${input}: ${res.status} ${res.statusText}`);
+    }
+    return res.text();
+  }
+  return readFileSync(input, "utf-8");
+}
+function deserialize(raw, source) {
+  const ext = extname(source).toLowerCase();
+  if (ext === ".json") {
+    return JSON.parse(raw);
+  }
+  return parseYaml(raw);
+}
+function validateSpec(spec) {
+  const s = spec;
+  if (!s.openapi || typeof s.openapi !== "string") {
+    throw new Error("Invalid spec: missing 'openapi' version field");
+  }
+  if (!s.openapi.startsWith("3.")) {
+    throw new Error(`Unsupported OpenAPI version: ${s.openapi}. Only 3.x is supported.`);
+  }
+  if (!s.paths || typeof s.paths !== "object") {
+    throw new Error("Invalid spec: missing 'paths' object");
+  }
+  if (!s.info || typeof s.info !== "object") {
+    throw new Error("Invalid spec: missing 'info' object");
+  }
+}
+
+// src/mapper/index.ts
+var HTTP_METHODS = ["get", "post", "put", "patch", "delete"];
+function mapToMcpTools(spec, options = {}) {
+  const tools = [];
+  const detectPagination = options.detectPagination ?? true;
+  const usedNames = /* @__PURE__ */ new Set();
+  for (const [path, pathItem] of Object.entries(spec.paths)) {
+    for (const method of HTTP_METHODS) {
+      const operation = pathItem[method];
+      if (!operation) continue;
+      if (operation["x-mcp-exclude"]) continue;
+      if (options.excludeTags?.length && operation.tags?.some((t) => options.excludeTags.includes(t))) {
+        continue;
+      }
+      if (options.includeTags?.length && !operation.tags?.some((t) => options.includeTags.includes(t))) {
+        continue;
+      }
+      const tool = mapOperation(spec, path, method, operation, pathItem.parameters, detectPagination);
+      if (tool) {
+        if (options.excludeOperations?.includes(tool.name)) continue;
+        tool.name = uniqueName(tool.name, usedNames);
+        usedNames.add(tool.name);
+        tools.push(tool);
+      }
+    }
+  }
+  return tools;
+}
+function uniqueName(name, used) {
+  let base = name.slice(0, 60);
+  if (!used.has(base)) return base;
+  let i = 2;
+  while (used.has(`${base}_${i}`)) i++;
+  return `${base}_${i}`;
+}
+function mapOperation(spec, path, method, op, pathParams, detectPagination) {
+  const name = op["x-mcp-name"] ?? op.operationId ?? generateToolName(method, path);
+  const description = op["x-mcp-description"] ?? op.summary ?? op.description ?? `${method.toUpperCase()} ${path}`;
+  const allParams = mergeParams(pathParams, op.parameters);
+  const { schema: inputSchema, queryParams, bodyParams, bodyMode, bodyContentType } = buildInputSchema(op, allParams);
+  const auth = resolveAuth(spec, op);
+  const pagination = detectPagination ? detectPaginationConfig(op, allParams) : null;
+  const streaming = isStreamingResponse(op);
+  const responseHint = buildResponseHint(op);
+  if (pagination) {
+    inputSchema.properties = inputSchema.properties ?? {};
+    inputSchema.properties.cursor = {
+      type: "string",
+      description: "Opaque pagination cursor. Omit for first page."
+    };
+    inputSchema.properties.limit = {
+      type: "integer",
+      description: `Maximum items per page (default: ${pagination.defaultLimit})`
+    };
+    if (pagination.offsetParam) delete inputSchema.properties[pagination.offsetParam];
+    if (pagination.pageParam) delete inputSchema.properties[pagination.pageParam];
+    if (pagination.limitParam && pagination.limitParam !== "limit") {
+      delete inputSchema.properties[pagination.limitParam];
+    }
+    if (inputSchema.required) {
+      inputSchema.required = inputSchema.required.filter(
+        (r) => r !== pagination.offsetParam && r !== pagination.pageParam
+      );
+      if (inputSchema.required.length === 0) inputSchema.required = void 0;
+    }
+  }
+  const finalQueryParams = queryParams.filter(
+    (q) => !pagination || q !== pagination.offsetParam && q !== pagination.pageParam && q !== pagination.limitParam && q !== pagination.cursorParam
+  );
+  let fullDescription = pagination ? `${description} (paginated)` : description;
+  if (responseHint) fullDescription += responseHint;
+  return {
+    name: sanitizeName(name),
+    description: fullDescription,
+    inputSchema,
+    meta: {
+      method: method.toUpperCase(),
+      path,
+      tags: op.tags ?? [],
+      auth,
+      pagination,
+      streaming,
+      queryParams: finalQueryParams,
+      bodyParams,
+      bodyMode,
+      bodyContentType
+    }
+  };
+}
+function buildResponseHint(op) {
+  const resp = op.responses?.["200"] ?? op.responses?.["201"];
+  const schema = resp?.content?.["application/json"]?.schema;
+  if (!schema) return null;
+  let fields = [];
+  let prefix = "Returns";
+  if (schema.type === "array") {
+    prefix = "Returns array of";
+    if (schema.items?.properties) fields = Object.keys(schema.items.properties);
+  } else if (schema.properties) {
+    fields = Object.keys(schema.properties);
+  }
+  if (fields.length === 0) return null;
+  const shown = fields.slice(0, 12);
+  const suffix = fields.length > shown.length ? ", ..." : "";
+  return ` ${prefix}: { ${shown.join(", ")}${suffix} }`;
+}
+function mergeParams(pathParams, opParams) {
+  const allParams = [...pathParams ?? [], ...opParams ?? []];
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const p of allParams.reverse()) {
+    const key = `${p.in}:${p.name}`;
+    if (!seen.has(key)) {
+      seen.add(key);
+      result.push(p);
+    }
+  }
+  return result;
+}
+function buildInputSchema(op, params) {
+  const properties = {};
+  const required = [];
+  const queryParams = [];
+  const bodyParams = [];
+  let bodyMode = "none";
+  for (const param of params) {
+    if (param.in === "header" || param.in === "cookie") continue;
+    properties[param.name] = {
+      ...param.schema,
+      description: param.description ?? param.schema?.description
+    };
+    if (param.in === "query") queryParams.push(param.name);
+    if (param.required) {
+      required.push(param.name);
+    }
+  }
+  const content = op.requestBody?.content;
+  const bodySchema = content?.["application/json"]?.schema ?? content?.["application/x-www-form-urlencoded"]?.schema;
+  const bodyContentType = !content?.["application/json"] && content?.["application/x-www-form-urlencoded"] ? "form" : "json";
+  if (bodySchema) {
+    if (bodySchema.type === "object" && bodySchema.properties) {
+      bodyMode = "fields";
+      for (const [key, val] of Object.entries(bodySchema.properties)) {
+        let propKey = key;
+        if (propKey in properties) propKey = `body_${key}`;
+        properties[propKey] = val;
+        bodyParams.push([propKey, key]);
+        if (bodySchema.required?.includes(key)) {
+          required.push(propKey);
+        }
+      }
+    } else {
+      bodyMode = "whole";
+      let bodyKey = "body";
+      if (bodyKey in properties) bodyKey = "request_body";
+      properties[bodyKey] = {
+        ...bodySchema,
+        description: op.requestBody?.description ?? bodySchema.description
+      };
+      bodyParams.push([bodyKey, "*"]);
+      if (op.requestBody?.required) {
+        required.push(bodyKey);
+      }
+    }
+  }
+  return {
+    schema: {
+      type: "object",
+      properties,
+      required: required.length > 0 ? required : void 0
+    },
+    queryParams,
+    bodyParams,
+    bodyMode,
+    bodyContentType
+  };
+}
+function detectPaginationConfig(op, params) {
+  const hint = op["x-mcp-pagination"];
+  if (hint) {
+    return {
+      type: hint.type,
+      limitParam: hint.limitParam ?? "limit",
+      offsetParam: hint.offsetParam,
+      pageParam: hint.pageParam,
+      cursorParam: hint.cursorParam,
+      cursorPath: hint.cursorPath ?? "next_cursor",
+      totalPath: hint.totalPath ?? "total",
+      itemsPath: hint.itemsPath ?? "items",
+      defaultLimit: 20
+    };
+  }
+  const paramNames = params.map((p) => p.name.toLowerCase());
+  const hasLimit = paramNames.some((n) => n === "limit" || n === "per_page" || n === "page_size" || n === "pagesize");
+  if (!hasLimit) return null;
+  const limitParam = params.find((p) => {
+    const n = p.name.toLowerCase();
+    return n === "limit" || n === "per_page" || n === "page_size" || n === "pagesize";
+  });
+  const cursorParam = params.find((p) => {
+    const n = p.name.toLowerCase();
+    return n === "cursor" || n === "after" || n === "next_token" || n === "page_token" || n === "starting_after";
+  });
+  if (cursorParam) {
+    return {
+      type: "cursor",
+      limitParam: limitParam.name,
+      cursorParam: cursorParam.name,
+      cursorPath: "next_cursor",
+      totalPath: "total",
+      itemsPath: "items",
+      defaultLimit: 20
+    };
+  }
+  const offsetParam = params.find((p) => {
+    const n = p.name.toLowerCase();
+    return n === "offset" || n === "skip";
+  });
+  if (offsetParam) {
+    return {
+      type: "offset",
+      limitParam: limitParam.name,
+      offsetParam: offsetParam.name,
+      cursorPath: "next_cursor",
+      totalPath: "total",
+      itemsPath: "items",
+      defaultLimit: 20
+    };
+  }
+  const pageParam = params.find((p) => {
+    const n = p.name.toLowerCase();
+    return n === "page" || n === "page_number" || n === "pagenumber";
+  });
+  if (pageParam) {
+    return {
+      type: "page",
+      limitParam: limitParam.name,
+      pageParam: pageParam.name,
+      cursorPath: "next_cursor",
+      totalPath: "total",
+      itemsPath: "items",
+      defaultLimit: 20
+    };
+  }
+  return null;
+}
+function isStreamingResponse(op) {
+  if (!op.responses) return false;
+  const successResponse = op.responses["200"] ?? op.responses["201"];
+  if (!successResponse?.content) return false;
+  return "text/event-stream" in successResponse.content || "application/x-ndjson" in successResponse.content || "application/stream+json" in successResponse.content;
+}
+function resolveAuth(spec, op) {
+  const securityReqs = op.security ?? spec.security ?? [];
+  if (securityReqs.length === 0) return null;
+  const schemeName = Object.keys(securityReqs[0])[0];
+  if (!schemeName) return null;
+  return spec.components?.securitySchemes?.[schemeName] ?? null;
+}
+function generateToolName(method, path) {
+  const segments = path.split("/").filter(Boolean).map((s) => {
+    if (s.startsWith("{") && s.endsWith("}")) {
+      return `by_${s.slice(1, -1)}`;
+    }
+    return s;
+  });
+  return `${method}_${segments.join("_")}`;
+}
+function sanitizeName(name) {
+  return name.replace(/[^a-zA-Z0-9_]/g, "_").replace(/_+/g, "_");
+}
+
+// src/generator/index.ts
+import { mkdirSync, writeFileSync } from "fs";
+import { join } from "path";
+
+// src/generator/templates.ts
+function renderServerCode(opts) {
+  const imports = buildImports(opts);
+  const toolRegistrations = opts.tools.map((t) => renderToolHandler(t, opts.auth)).join("\n\n");
+  const serverSetup = buildServerSetup(opts);
+  return `${imports}
+
+const server = new McpServer({
+	name: ${JSON.stringify(opts.serverName)},
+	version: "0.1.0",
+});
+
+const API_BASE_URL = process.env.API_BASE_URL ?? ${JSON.stringify(opts.spec.servers?.[0]?.url ?? "")};
+
+${renderAuthHelper(opts)}
+
+${renderPaginationHelper(opts)}
+
+${renderRequestHelpers(opts)}
+
+${toolRegistrations}
+
+${serverSetup}
+`;
+}
+function buildServerSetup(opts) {
+  if (opts.transport === "stdio") {
+    return `async function main() {
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
+}
+
+main().catch(console.error);`;
+  }
+  return `const PORT = parseInt(process.env.PORT ?? "3000", 10);
+
+async function main() {
+	const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined });
+	await server.connect(transport);
+
+	const httpServer = createServer(async (req, res) => {
+		const url = new URL(req.url ?? "/", \`http://\${req.headers.host}\`);
+		if (url.pathname === "/mcp") {
+			try {
+				await transport.handleRequest(req, res);
+			} catch (err) {
+				console.error("Error handling MCP request:", err);
+				if (!res.headersSent) {
+					res.writeHead(500, { "Content-Type": "application/json" });
+					res.end(JSON.stringify({ jsonrpc: "2.0", error: { code: -32603, message: "Internal server error" }, id: null }));
+				}
+			}
+		} else {
+			res.writeHead(404);
+			res.end("Not found");
+		}
+	});
+
+	httpServer.listen(PORT, () => {
+		console.log(\`MCP server listening on http://localhost:\${PORT}/mcp\`);
+	});
+}
+
+main().catch(console.error);`;
+}
+function buildImports(opts) {
+  const lines = [
+    `import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";`
+  ];
+  if (opts.transport === "stdio") {
+    lines.push(
+      `import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";`
+    );
+  } else {
+    lines.push(
+      `import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";`,
+      `import { createServer } from "node:http";`
+    );
+  }
+  lines.push(`import { z } from "zod";`);
+  if (opts.auth === "oauth2-auth-code") {
+    lines.push(
+      `import { createServer as createHttpServer } from "node:http";`,
+      `import { randomBytes, createHash } from "node:crypto";`
+    );
+  }
+  return lines.join("\n");
+}
+function renderAuthHelper(opts) {
+  if (opts.auth === "none") {
+    return `function authHeaders(): Record<string, string> {
+	return {};
+}`;
+  }
+  if (opts.auth === "api-key") {
+    const apiKeyScheme = Object.values(opts.spec.components?.securitySchemes ?? {}).find((s) => s.type === "apiKey");
+    const headerName = apiKeyScheme?.name ?? "X-API-Key";
+    return `function authHeaders(): Record<string, string> {
+	const key = process.env.API_KEY;
+	if (!key) throw new Error("API_KEY environment variable is required");
+	return { ${JSON.stringify(headerName)}: key };
+}`;
+  }
+  if (opts.auth === "bearer") {
+    return `function authHeaders(): Record<string, string> {
+	const token = process.env.API_TOKEN;
+	if (!token) throw new Error("API_TOKEN environment variable is required");
+	return { "Authorization": \`Bearer \${token}\` };
+}`;
+  }
+  if (opts.auth === "oauth2-auth-code") {
+    return renderOAuth2AuthCodeHelper(opts);
+  }
+  return renderOAuth2CCHelper();
+}
+function renderOAuth2CCHelper() {
+  return `let cachedToken: { token: string; expiresAt: number } | null = null;
+
+async function getOAuthToken(): Promise<string> {
+	if (cachedToken && Date.now() < cachedToken.expiresAt) {
+		return cachedToken.token;
+	}
+	const tokenUrl = process.env.OAUTH_TOKEN_URL;
+	const clientId = process.env.OAUTH_CLIENT_ID;
+	const clientSecret = process.env.OAUTH_CLIENT_SECRET;
+	if (!tokenUrl || !clientId || !clientSecret) {
+		throw new Error("OAUTH_TOKEN_URL, OAUTH_CLIENT_ID, and OAUTH_CLIENT_SECRET are required");
+	}
+	const res = await fetch(tokenUrl, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: clientId,
+			client_secret: clientSecret,
+		}),
+	});
+	if (!res.ok) throw new Error(\`OAuth token request failed: \${res.status}\`);
+	const data = await res.json() as { access_token: string; expires_in?: number };
+	cachedToken = {
+		token: data.access_token,
+		expiresAt: Date.now() + ((data.expires_in ?? 3600) - 60) * 1000,
+	};
+	return cachedToken.token;
+}
+
+async function authHeaders(): Promise<Record<string, string>> {
+	const token = await getOAuthToken();
+	return { "Authorization": \`Bearer \${token}\` };
+}`;
+}
+function renderOAuth2AuthCodeHelper(opts) {
+  const oauthScheme = Object.values(opts.spec.components?.securitySchemes ?? {}).find((s) => s.type === "oauth2");
+  const flow = oauthScheme?.flows?.authorizationCode;
+  const defaultAuthUrl = flow?.authorizationUrl ?? "";
+  const defaultTokenUrl = flow?.tokenUrl ?? "";
+  const defaultScopes = Object.keys(flow?.scopes ?? {}).join(" ");
+  return `interface TokenStore {
+	accessToken: string;
+	refreshToken?: string;
+	expiresAt: number;
+}
+
+let tokenStore: TokenStore | null = null;
+
+const OAUTH_AUTH_URL = process.env.OAUTH_AUTH_URL ?? ${JSON.stringify(defaultAuthUrl)};
+const OAUTH_TOKEN_URL = process.env.OAUTH_TOKEN_URL ?? ${JSON.stringify(defaultTokenUrl)};
+const OAUTH_CLIENT_ID = process.env.OAUTH_CLIENT_ID ?? "";
+const OAUTH_CLIENT_SECRET = process.env.OAUTH_CLIENT_SECRET ?? "";
+const OAUTH_REDIRECT_PORT = parseInt(process.env.OAUTH_REDIRECT_PORT ?? "8976", 10);
+const OAUTH_REDIRECT_URI = \`http://localhost:\${OAUTH_REDIRECT_PORT}/callback\`;
+const OAUTH_SCOPES = process.env.OAUTH_SCOPES ?? ${JSON.stringify(defaultScopes)};
+
+function generatePKCE(): { verifier: string; challenge: string } {
+	const verifier = randomBytes(32).toString("base64url");
+	const challenge = createHash("sha256").update(verifier).digest("base64url");
+	return { verifier, challenge };
+}
+
+async function refreshAccessToken(): Promise<string> {
+	if (!tokenStore?.refreshToken) throw new Error("No refresh token available");
+	const res = await fetch(OAUTH_TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: tokenStore.refreshToken,
+			client_id: OAUTH_CLIENT_ID,
+			...(OAUTH_CLIENT_SECRET ? { client_secret: OAUTH_CLIENT_SECRET } : {}),
+		}),
+	});
+	if (!res.ok) {
+		tokenStore = null;
+		throw new Error(\`Token refresh failed: \${res.status}\`);
+	}
+	const data = await res.json() as {
+		access_token: string;
+		refresh_token?: string;
+		expires_in?: number;
+	};
+	tokenStore = {
+		accessToken: data.access_token,
+		refreshToken: data.refresh_token ?? tokenStore.refreshToken,
+		expiresAt: Date.now() + ((data.expires_in ?? 3600) - 60) * 1000,
+	};
+	return tokenStore.accessToken;
+}
+
+async function authorizeInteractive(): Promise<string> {
+	if (!OAUTH_CLIENT_ID) throw new Error("OAUTH_CLIENT_ID is required");
+	if (!OAUTH_AUTH_URL || !OAUTH_TOKEN_URL) {
+		throw new Error("OAUTH_AUTH_URL and OAUTH_TOKEN_URL are required");
+	}
+
+	const { verifier, challenge } = generatePKCE();
+	const state = randomBytes(16).toString("hex");
+
+	const authUrl = new URL(OAUTH_AUTH_URL);
+	authUrl.searchParams.set("response_type", "code");
+	authUrl.searchParams.set("client_id", OAUTH_CLIENT_ID);
+	authUrl.searchParams.set("redirect_uri", OAUTH_REDIRECT_URI);
+	authUrl.searchParams.set("state", state);
+	authUrl.searchParams.set("code_challenge", challenge);
+	authUrl.searchParams.set("code_challenge_method", "S256");
+	if (OAUTH_SCOPES) authUrl.searchParams.set("scope", OAUTH_SCOPES);
+
+	console.error(\`\\nOpen this URL to authorize:\\n\${authUrl.toString()}\\n\`);
+
+	const code = await new Promise<string>((resolve, reject) => {
+		const srv = createHttpServer((req, res) => {
+			const url = new URL(req.url ?? "/", \`http://localhost:\${OAUTH_REDIRECT_PORT}\`);
+			if (url.pathname !== "/callback") {
+				res.writeHead(404);
+				res.end();
+				return;
+			}
+			const receivedState = url.searchParams.get("state");
+			const receivedCode = url.searchParams.get("code");
+			const error = url.searchParams.get("error");
+
+			if (error) {
+				res.writeHead(400);
+				res.end(\`Authorization error: \${error}\`);
+				srv.close();
+				reject(new Error(\`OAuth error: \${error}\`));
+				return;
+			}
+			if (receivedState !== state || !receivedCode) {
+				res.writeHead(400);
+				res.end("Invalid callback");
+				srv.close();
+				reject(new Error("Invalid OAuth callback"));
+				return;
+			}
+
+			res.writeHead(200, { "Content-Type": "text/html" });
+			res.end("<h1>Authorization successful!</h1><p>You can close this tab.</p>");
+			srv.close();
+			resolve(receivedCode);
+		});
+
+		srv.listen(OAUTH_REDIRECT_PORT, () => {
+			console.error(\`Waiting for OAuth callback on port \${OAUTH_REDIRECT_PORT}...\`);
+		});
+
+		setTimeout(() => {
+			srv.close();
+			reject(new Error("OAuth callback timed out after 120 seconds"));
+		}, 120_000);
+	});
+
+	const tokenRes = await fetch(OAUTH_TOKEN_URL, {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			redirect_uri: OAUTH_REDIRECT_URI,
+			client_id: OAUTH_CLIENT_ID,
+			code_verifier: verifier,
+			...(OAUTH_CLIENT_SECRET ? { client_secret: OAUTH_CLIENT_SECRET } : {}),
+		}),
+	});
+	if (!tokenRes.ok) throw new Error(\`Token exchange failed: \${tokenRes.status}\`);
+
+	const tokenData = await tokenRes.json() as {
+		access_token: string;
+		refresh_token?: string;
+		expires_in?: number;
+	};
+	tokenStore = {
+		accessToken: tokenData.access_token,
+		refreshToken: tokenData.refresh_token,
+		expiresAt: Date.now() + ((tokenData.expires_in ?? 3600) - 60) * 1000,
+	};
+	return tokenStore.accessToken;
+}
+
+async function authHeaders(): Promise<Record<string, string>> {
+	if (tokenStore && Date.now() < tokenStore.expiresAt) {
+		return { "Authorization": \`Bearer \${tokenStore.accessToken}\` };
+	}
+	if (tokenStore?.refreshToken) {
+		try {
+			const token = await refreshAccessToken();
+			return { "Authorization": \`Bearer \${token}\` };
+		} catch {
+			// Refresh failed, re-authorize
+		}
+	}
+	const token = await authorizeInteractive();
+	return { "Authorization": \`Bearer \${token}\` };
+}`;
+}
+function renderPaginationHelper(opts) {
+  const hasPaginated = opts.tools.some((t) => t.meta.pagination);
+  if (!hasPaginated) return "";
+  return `// Pagination cursor encoding/decoding
+function encodeCursor(data: Record<string, unknown>): string {
+	return Buffer.from(JSON.stringify(data)).toString("base64url");
+}
+
+function decodeCursor(cursor: string): Record<string, unknown> {
+	try {
+		return JSON.parse(Buffer.from(cursor, "base64url").toString("utf-8"));
+	} catch {
+		throw new Error("Invalid pagination cursor");
+	}
+}`;
+}
+function renderToolHandler(tool, authMode) {
+  if (tool.meta.pagination) {
+    return renderPaginatedToolHandler(tool, authMode);
+  }
+  if (tool.meta.streaming) {
+    return renderStreamingToolHandler(tool, authMode);
+  }
+  return renderSimpleToolHandler(tool, authMode);
+}
+function renderSimpleToolHandler(tool, authMode) {
+  const zodSchema = jsonSchemaToZod(tool.inputSchema);
+  const authCall = isAsyncAuth(authMode) ? "await authHeaders()" : "authHeaders()";
+  const pathInterpolation = interpolatePath(tool.meta.path);
+  const query = tool.meta.queryParams.length ? ` + buildQuery(p, ${JSON.stringify(tool.meta.queryParams)})` : "";
+  const hasBody = tool.meta.bodyMode !== "none" && tool.meta.method !== "GET";
+  const isForm = tool.meta.bodyContentType === "form";
+  const pickCall = `pickBody(p, ${JSON.stringify(tool.meta.bodyParams)})`;
+  const bodyLine = hasBody ? `
+			body: ${isForm ? `formEncode(${pickCall}).toString()` : `JSON.stringify(${pickCall})`},` : "";
+  const contentType = hasBody && isForm ? "application/x-www-form-urlencoded" : "application/json";
+  return `server.tool(
+	${JSON.stringify(tool.name)},
+	${JSON.stringify(tool.description)},
+	${zodSchema},
+	async (params) => {
+		const p: Record<string, unknown> = params;
+		const url = \`\${API_BASE_URL}${pathInterpolation}\`${query};
+		const headers: Record<string, string> = { ...${authCall}, "Content-Type": ${JSON.stringify(contentType)} };
+		const res = await fetch(url, {
+			method: ${JSON.stringify(tool.meta.method)},
+			headers,${bodyLine}
+		});
+		const data = await res.text();
+		return {
+			content: [{ type: "text" as const, text: data }],
+		};
+	},
+);`;
+}
+function renderPaginatedToolHandler(tool, authMode) {
+  const zodSchema = jsonSchemaToZod(tool.inputSchema);
+  const authCall = isAsyncAuth(authMode) ? "await authHeaders()" : "authHeaders()";
+  const pg = tool.meta.pagination;
+  const pathInterpolation = interpolatePath(tool.meta.path);
+  const passThrough = JSON.stringify(tool.meta.queryParams);
+  let paginationLogic;
+  if (pg.type === "offset") {
+    paginationLogic = `		// Decode cursor to get offset, or start from 0
+		const pageLimit = typeof p.limit === "number" ? p.limit : ${pg.defaultLimit};
+		let offset = 0;
+		if (typeof p.cursor === "string") {
+			const decoded = decodeCursor(p.cursor);
+			offset = (decoded.offset as number) ?? 0;
+		}
+		const queryParams: Record<string, string> = {};
+		for (const k of ${passThrough}) {
+			const v = p[k];
+			if (v !== undefined && v !== null) queryParams[k] = String(v);
+		}
+		queryParams[${JSON.stringify(pg.limitParam)}] = String(pageLimit);
+		queryParams[${JSON.stringify(pg.offsetParam)}] = String(offset);
+		const qs = new URLSearchParams(queryParams).toString();
+		const url = \`\${API_BASE_URL}${pathInterpolation}\` + (qs ? "?" + qs : "");`;
+  } else if (pg.type === "page") {
+    paginationLogic = `		// Decode cursor to get page number, or start from 1
+		const pageLimit = typeof p.limit === "number" ? p.limit : ${pg.defaultLimit};
+		let page = 1;
+		if (typeof p.cursor === "string") {
+			const decoded = decodeCursor(p.cursor);
+			page = (decoded.page as number) ?? 1;
+		}
+		const queryParams: Record<string, string> = {};
+		for (const k of ${passThrough}) {
+			const v = p[k];
+			if (v !== undefined && v !== null) queryParams[k] = String(v);
+		}
+		queryParams[${JSON.stringify(pg.limitParam)}] = String(pageLimit);
+		queryParams[${JSON.stringify(pg.pageParam)}] = String(page);
+		const qs = new URLSearchParams(queryParams).toString();
+		const url = \`\${API_BASE_URL}${pathInterpolation}\` + (qs ? "?" + qs : "");`;
+  } else {
+    paginationLogic = `		const pageLimit = typeof p.limit === "number" ? p.limit : ${pg.defaultLimit};
+		const queryParams: Record<string, string> = {};
+		for (const k of ${passThrough}) {
+			const v = p[k];
+			if (v !== undefined && v !== null) queryParams[k] = String(v);
+		}
+		queryParams[${JSON.stringify(pg.limitParam)}] = String(pageLimit);
+		if (typeof p.cursor === "string") {
+			const decoded = decodeCursor(p.cursor);
+			queryParams[${JSON.stringify(pg.cursorParam ?? "cursor")}] = decoded.cursor as string;
+		}
+		const qs = new URLSearchParams(queryParams).toString();
+		const url = \`\${API_BASE_URL}${pathInterpolation}\` + (qs ? "?" + qs : "");`;
+  }
+  let nextCursorLogic;
+  if (pg.type === "offset") {
+    nextCursorLogic = `		const nextOffset = offset + pageLimit;
+		const total = parsed?.${pg.totalPath} as number | undefined;
+		const hasMore = total !== undefined ? nextOffset < total : items.length >= pageLimit;
+		const nextCursor = hasMore ? encodeCursor({ offset: nextOffset }) : null;`;
+  } else if (pg.type === "page") {
+    nextCursorLogic = `		const total = parsed?.${pg.totalPath} as number | undefined;
+		const totalPages = total !== undefined ? Math.ceil(total / pageLimit) : undefined;
+		const hasMore = totalPages !== undefined ? page < totalPages : items.length >= pageLimit;
+		const nextCursor = hasMore ? encodeCursor({ page: page + 1 }) : null;`;
+  } else {
+    nextCursorLogic = `		const apiCursor = parsed?.${pg.cursorPath} as string | undefined;
+		const hasMore = !!apiCursor;
+		const nextCursor = hasMore ? encodeCursor({ cursor: apiCursor }) : null;`;
+  }
+  return `server.tool(
+	${JSON.stringify(tool.name)},
+	${JSON.stringify(tool.description)},
+	${zodSchema},
+	async (params) => {
+		const p: Record<string, unknown> = params;
+${paginationLogic}
+		const headers: Record<string, string> = { ...${authCall}, "Content-Type": "application/json" };
+		const res = await fetch(url, { method: "GET", headers });
+		const data = await res.text();
+		let parsed: Record<string, unknown> | null = null;
+		try { parsed = JSON.parse(data); } catch {}
+		const items = (parsed && Array.isArray(parsed.${pg.itemsPath}) ? parsed.${pg.itemsPath} : parsed) as unknown[];
+${nextCursorLogic}
+		const result = {
+			items,
+			has_more: hasMore,
+			...(nextCursor ? { next_cursor: nextCursor } : {}),
+			...(parsed?.${pg.totalPath} !== undefined ? { total: parsed.${pg.totalPath} } : {}),
+		};
+		return {
+			content: [{ type: "text" as const, text: JSON.stringify(result, null, 2) }],
+		};
+	},
+);`;
+}
+function renderStreamingToolHandler(tool, authMode) {
+  const zodSchema = jsonSchemaToZod(tool.inputSchema);
+  const authCall = isAsyncAuth(authMode) ? "await authHeaders()" : "authHeaders()";
+  const pathInterpolation = interpolatePath(tool.meta.path);
+  const query = tool.meta.queryParams.length ? ` + buildQuery(p, ${JSON.stringify(tool.meta.queryParams)})` : "";
+  return `server.tool(
+	${JSON.stringify(tool.name)},
+	${JSON.stringify(tool.description + " (streaming)")},
+	${zodSchema},
+	async (params) => {
+		const p: Record<string, unknown> = params;
+		const url = \`\${API_BASE_URL}${pathInterpolation}\`${query};
+		const headers: Record<string, string> = { ...${authCall}, "Accept": "text/event-stream" };
+		const res = await fetch(url, { method: ${JSON.stringify(tool.meta.method)}, headers });
+		if (!res.body) {
+			return { content: [{ type: "text" as const, text: "No response body" }] };
+		}
+		const reader = res.body.getReader();
+		const decoder = new TextDecoder();
+		const chunks: string[] = [];
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			chunks.push(decoder.decode(value, { stream: true }));
+		}
+		return {
+			content: [{ type: "text" as const, text: chunks.join("") }],
+		};
+	},
+);`;
+}
+function isAsyncAuth(authMode) {
+  return authMode === "oauth2" || authMode === "oauth2-auth-code";
+}
+function interpolatePath(path) {
+  return path.replace(
+    /\{([^}]+)\}/g,
+    (_m, name) => `\${encodeURIComponent(String(p[${JSON.stringify(name)}] ?? ""))}`
+  );
+}
+function renderRequestHelpers(opts) {
+  const needsBody = opts.tools.some((t) => t.meta.bodyMode !== "none");
+  const needsQuery = opts.tools.some((t) => t.meta.queryParams.length > 0 && !t.meta.pagination);
+  const parts = [];
+  if (needsQuery) {
+    parts.push(`function buildQuery(params: Record<string, unknown>, keys: string[]): string {
+	const entries: Array<[string, string]> = [];
+	for (const k of keys) {
+		const v = params[k];
+		if (v === undefined || v === null) continue;
+		entries.push([k, String(v)]);
+	}
+	return entries.length ? "?" + new URLSearchParams(entries).toString() : "";
+}`);
+  }
+  if (needsBody) {
+    parts.push(`function pickBody(params: Record<string, unknown>, pairs: string[][]): unknown {
+	if (pairs.length === 1 && pairs[0][1] === "*") return params[pairs[0][0]];
+	const out: Record<string, unknown> = {};
+	for (const [propKey, fieldKey] of pairs) {
+		if (params[propKey] !== undefined) out[fieldKey] = params[propKey];
+	}
+	return out;
+}`);
+  }
+  const needsForm = opts.tools.some(
+    (t) => t.meta.bodyMode !== "none" && t.meta.bodyContentType === "form" && t.meta.method !== "GET"
+  );
+  if (needsForm) {
+    parts.push(`function formEncode(value: unknown, prefix = "", out = new URLSearchParams()): URLSearchParams {
+	if (value === null || value === undefined) return out;
+	if (typeof value === "object") {
+		if (Array.isArray(value)) {
+			value.forEach((v, i) => formEncode(v, prefix ? \`\${prefix}[\${i}]\` : String(i), out));
+		} else {
+			for (const [k, v] of Object.entries(value as Record<string, unknown>)) {
+				formEncode(v, prefix ? \`\${prefix}[\${k}]\` : k, out);
+			}
+		}
+	} else if (prefix) {
+		out.append(prefix, String(value));
+	}
+	return out;
+}`);
+  }
+  return parts.join("\n\n");
+}
+var MAX_ZOD_DEPTH = 4;
+var MAX_DESCRIBE_LENGTH = 300;
+function jsonSchemaToZod(schema) {
+  const entries = Object.entries(schema.properties ?? {});
+  if (entries.length === 0) return "{}";
+  const fields = entries.map(([name, prop]) => {
+    let zodType = schemaToZodType(prop, 0);
+    if (!schema.required?.includes(name)) {
+      zodType += ".optional()";
+    }
+    if (prop.description) {
+      zodType += `.describe(${JSON.stringify(truncate(prop.description, MAX_DESCRIBE_LENGTH))})`;
+    }
+    return `		${JSON.stringify(name)}: ${zodType},`;
+  });
+  return `{
+${fields.join("\n")}
+	}`;
+}
+function truncate(s, max) {
+  return s.length > max ? `${s.slice(0, max - 3)}...` : s;
+}
+function schemaToZodType(schema, depth) {
+  if (depth > MAX_ZOD_DEPTH) return "z.unknown()";
+  let zod = baseZodType(schema, depth);
+  const isNullable = schema.nullable === true || Array.isArray(schema.type) && schema.type.includes("null");
+  if (isNullable && zod !== "z.unknown()" && zod !== "z.null()") {
+    zod += ".nullable()";
+  }
+  return zod;
+}
+function baseZodType(schema, depth) {
+  if (schema.enum && schema.enum.length > 0) {
+    const nonNull = schema.enum.filter((v) => v !== null);
+    if (nonNull.length === 0) return "z.null()";
+    if (nonNull.every((v) => typeof v === "string")) {
+      return `z.enum([${nonNull.map((v) => JSON.stringify(v)).join(", ")}])`;
+    }
+    const literals = nonNull.map((v) => `z.literal(${JSON.stringify(v)})`);
+    return literals.length === 1 ? literals[0] : `z.union([${literals.join(", ")}])`;
+  }
+  const variants = schema.oneOf ?? schema.anyOf;
+  if (variants && variants.length > 0) {
+    const subs = [
+      ...new Set(
+        variants.filter((v) => v.type !== "null").slice(0, 5).map((v) => schemaToZodType(v, depth + 1))
+      )
+    ];
+    if (subs.length === 0) return "z.unknown()";
+    if (subs.length === 1) return subs[0];
+    return `z.union([${subs.join(", ")}])`;
+  }
+  if (schema.allOf && schema.allOf.length > 0) {
+    const merged = { type: "object", properties: {}, required: [] };
+    for (const part of schema.allOf) {
+      if (part.properties) Object.assign(merged.properties, part.properties);
+      if (part.required) merged.required.push(...part.required);
+    }
+    if (Object.keys(merged.properties).length > 0) {
+      return renderZodObject(merged, depth);
+    }
+    return "z.unknown()";
+  }
+  const type = Array.isArray(schema.type) ? schema.type.find((t) => t !== "null") : schema.type;
+  switch (type) {
+    case "integer":
+      return "z.number().int()";
+    case "number":
+      return "z.number()";
+    case "boolean":
+      return "z.boolean()";
+    case "array":
+      return `z.array(${schema.items ? schemaToZodType(schema.items, depth + 1) : "z.unknown()"})`;
+    case "object":
+      return renderZodObject(schema, depth);
+    case "string":
+      return "z.string()";
+    default:
+      if (schema.properties) return renderZodObject(schema, depth);
+      return "z.string()";
+  }
+}
+function renderZodObject(schema, depth) {
+  const entries = Object.entries(schema.properties ?? {});
+  if (entries.length === 0 || depth >= MAX_ZOD_DEPTH) {
+    return "z.record(z.unknown())";
+  }
+  const fields = entries.map(([key, val]) => {
+    let zod = schemaToZodType(val, depth + 1);
+    if (!schema.required?.includes(key)) zod += ".optional()";
+    return `${JSON.stringify(key)}: ${zod}`;
+  });
+  return `z.object({ ${fields.join(", ")} }).passthrough()`;
+}
+
+// src/generator/index.ts
+async function generate(opts) {
+  mkdirSync(opts.outputDir, { recursive: true });
+  mkdirSync(join(opts.outputDir, "src"), { recursive: true });
+  writeFileSync(join(opts.outputDir, "src", "server.ts"), renderServerCode(opts));
+  writeFileSync(
+    join(opts.outputDir, "package.json"),
+    JSON.stringify(
+      {
+        name: slugify(opts.serverName),
+        version: "0.1.0",
+        type: "module",
+        scripts: {
+          build: "tsc",
+          start: "node dist/server.js"
+        },
+        dependencies: {
+          "@modelcontextprotocol/sdk": "^1.29.0",
+          zod: "^3.23.0"
+        },
+        devDependencies: {
+          typescript: "^5.7.0",
+          "@types/node": "^22.0.0"
+        }
+      },
+      null,
+      2
+    )
+  );
+  writeFileSync(
+    join(opts.outputDir, "tsconfig.json"),
+    JSON.stringify(
+      {
+        compilerOptions: {
+          target: "ES2022",
+          module: "Node16",
+          moduleResolution: "Node16",
+          outDir: "dist",
+          rootDir: "src",
+          strict: true,
+          esModuleInterop: true,
+          skipLibCheck: true,
+          declaration: true
+        },
+        include: ["src/**/*"]
+      },
+      null,
+      2
+    )
+  );
+  writeFileSync(
+    join(opts.outputDir, ".env.example"),
+    generateEnvExample(opts)
+  );
+}
+function slugify(name) {
+  return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+function generateEnvExample(opts) {
+  const lines = ["# Generated by openapi-to-mcp", ""];
+  const server = opts.spec.servers?.[0];
+  lines.push(`API_BASE_URL=${server?.url ?? "https://api.example.com"}`);
+  if (opts.auth === "api-key") {
+    lines.push("API_KEY=your-api-key-here");
+  } else if (opts.auth === "bearer") {
+    lines.push("API_TOKEN=your-bearer-token-here");
+  } else if (opts.auth === "oauth2") {
+    lines.push("OAUTH_CLIENT_ID=");
+    lines.push("OAUTH_CLIENT_SECRET=");
+    lines.push("OAUTH_TOKEN_URL=");
+  } else if (opts.auth === "oauth2-auth-code") {
+    lines.push("OAUTH_CLIENT_ID=");
+    lines.push("OAUTH_CLIENT_SECRET=");
+    lines.push("OAUTH_AUTH_URL=");
+    lines.push("OAUTH_TOKEN_URL=");
+    lines.push("OAUTH_SCOPES=");
+    lines.push("OAUTH_REDIRECT_PORT=8976");
+  }
+  return lines.join("\n") + "\n";
+}
+export {
+  generate,
+  mapToMcpTools,
+  parseSpec
+};
+//# sourceMappingURL=index.js.map