typespec-http-mcp 0.3.0 → 0.5.0

package/dist/src/lib.d.ts

@@ -75,6 +75,9 @@ type Diagnostics = {
     "tool-name-collision": {
         readonly default: CallableMessage<["first", "second", "name"]>;
     };
+    "shared-input-key": {
+        readonly default: CallableMessage<["operationId", "types"]>;
+    };
     "binary-tool-input": {
         readonly default: CallableMessage<["operationId", "types"]>;
     };

package/dist/src/lib.js

@@ -128,6 +128,23 @@ const diagnostics = {
      * contract no reader of the document could predict, and would put a whole upload through a model's
      * context window.
      */
+    /**
+     * **An operation two of whose inputs would arrive as one argument is not a tool.**
+     *
+     * A tool's arguments are the path, query, header and cookie groups spread into one object, the
+     * body merged or named beside them - the same input a server's handler receives. `@header("x")`
+     * beside `@query("x")` therefore published one `x` argument, the later group's schema replacing
+     * the earlier, and the handler was handed one value for two declarations (typespec-http-graphql,
+     * 2026-10-16). `typespec-http-zod` names the pair in `EmittedRoute.sharedInputKeys` and reports it
+     * as its own `shared-input-key`; this is the tool surface declining it, as `typespec-hono` declines
+     * to mount it.
+     */
+    "shared-input-key": {
+        severity: "warning",
+        messages: {
+            default: paramMessage `'${"operationId"}' is not a tool: ${"types"} would arrive as one argument, which holds one value. Give one of them a different name, or exclude the operation with 'exclude-tags'.`,
+        },
+    },
     "binary-tool-input": {
         severity: "warning",
         messages: {

package/dist/src/refusals.d.ts

@@ -2,6 +2,9 @@ import { type Program } from "@typespec/compiler";
 import type { HttpOperation } from "@typespec/http";
 import type { EmittedRoute, RouteSchemaNames } from "typespec-http-zod";
 export type Refusal = {
+    readonly kind: "shared-input-key";
+    readonly types: string;
+} | {
     readonly kind: "binary-tool-input";
     readonly types: string;
 } | {

package/dist/src/refusals.js

@@ -8,6 +8,14 @@ import { unvalidatedResponsesOf } from "./bodies.js";
  * arithmetically impossible. A WARNING leaves the tool in place and says something about its quality.
  * Conflating them would let a quality complaint quietly delete a tool.
  */
+/** How a `shared-input-key` refusal names where each of the two inputs comes from. */
+const INPUT_LOCATION_NOUNS = {
+    path: "path parameter",
+    query: "query parameter",
+    header: "header",
+    cookie: "cookie",
+    body: "body",
+};
 /** A media type a tool can actually send. `application/json`, and the `+json` structured suffix. */
 function isJson(contentType) {
     const type = contentType.split(";")[0]?.trim().toLowerCase() ?? "";
@@ -37,9 +45,10 @@ function isMergeableBody(program, type) {
     if (type.indexer?.key?.name === "integer")
         return false;
     /**
-     * A model carrying `@discriminator` is emitted as a UNION of its variants, not as an object --
-     * measured: `z.discriminatedUnion("kind", [...])`, which has no shape. Which variant arrived is
-     * decided by a value, so there is no single set of properties to merge into the arguments.
+     * A model carrying `@discriminator` is emitted as a UNION of its variants and itself, not as an
+     * object -- measured: `z.union([z.discriminatedUnion("kind", [...]), z.object(...)])`, which has
+     * no shape. Which arm a value takes is decided by the value, so there is no single set of
+     * properties to merge into the arguments.
      */
     if (getDiscriminator(program, type) !== undefined)
         return false;
@@ -70,6 +79,21 @@ function isMergeableBody(program, type) {
  */
 export function refusalFor(program, route, operation) {
     const types = route.requestContentTypes;
+    /**
+     * **Two inputs under one key cannot both be arguments.** A tool's arguments are the parameter
+     * groups spread into one object, as a server's handler input is, so `@header("x")` beside
+     * `@query("x")` published one `x` whose later schema replaced the earlier, and the handler was
+     * handed one value for two declarations. The library names every such pair; the operation is not
+     * a tool, for the reason `typespec-hono` does not mount it.
+     */
+    if (route.sharedInputKeys.length > 0) {
+        return {
+            kind: "shared-input-key",
+            types: route.sharedInputKeys
+                .map((shared) => `the ${INPUT_LOCATION_NOUNS[shared.first]} '${shared.key}' and the ${INPUT_LOCATION_NOUNS[shared.second]} '${shared.key}'`)
+                .join("; "),
+        };
+    }
     /**
      * A raw body is bytes or a stream; a multipart body is parts, one of which is usually a file.
      * Neither is a JSON value, and encoding one into a string argument would put an upload through a
@@ -101,7 +125,13 @@ export function refusalFor(program, route, operation) {
      * body is merged into the argument object, so it must have properties to merge.
      */
     if (route.bodyProperty === undefined) {
-        const body = operation.parameters.body?.type;
+        /**
+         * **A body declared `void` is no body**, and the library lists no media type for one; read
+         * that way, there is nothing to merge. Read off the operation, its intrinsic type is not an
+         * object and the tool was refused as `non-object-body`. A body declared `never` the library
+         * refuses, as `never-body`.
+         */
+        const body = types.length === 0 ? undefined : operation.parameters.body?.type;
         if (!isMergeableBody(program, body)) {
             return { kind: "non-object-body", types: body?.kind ?? "unknown" };
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "typespec-http-mcp",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "TypeSpec emitter: generate an MCP tool surface, and the Zod validators it publishes, from an HTTP service definition, dispatching into the same handlers a generated HTTP server calls.",
   "keywords": [
     "cloudflare-workers",
@@ -45,7 +45,7 @@
     "provenance": true
   },
   "dependencies": {
-    "typespec-http-zod": "^0.29.0"
+    "typespec-http-zod": "^0.31.0"
   },
   "devDependencies": {
     "@hono/zod-validator": "^0.9.1",
@@ -66,8 +66,9 @@
     "hono": "^4.13.7",
     "oxfmt": "^0.67.0",
     "oxlint": "^1.82.0",
+    "secure-json-parse": "4.1.1",
     "typescript": "~7.0.2",
-    "typespec-hono": "0.26.0",
+    "typespec-hono": "0.28.0",
     "typespec-http-mcp": "link:.",
     "vitest": "^5.0.0",
     "wrangler": "^4.131.1",