bundleup-sdk 0.4.3 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a81131b46ad1f04a1714e8e7a07d87d69ee3419648e966daa9099cba31fb4a9
-  data.tar.gz: b1861d43ace1fd90f86e89e8b161b91c135f1fc53215cf0dad3defd95351a048
+  metadata.gz: ab7e53fa4d67aa688569b213a6b9f090cce9b8e557203e598ef4ce946e4ac508
+  data.tar.gz: 5226846b47d962f8c616eb14e6c47ee8836bde8a63f610cfc155fda1eec879df
 SHA512:
-  metadata.gz: 13c18248fe861fb462cf3d9019764d13a7925031b49aa40d37f5ab7c3b106e019407140873dda6467057777313bc58cc6cb661daac8f102ff462b318aec4c413
-  data.tar.gz: c3bc826ddfb41e39616049a651b180dffd36bb3ee939f27ee315bd350400ae25dbec72666025f22860944d20f82e1945dc20f856b7a2c2cc0302cb671b7b0f9f
+  metadata.gz: 0a8085e498cfd804bbd5d7b93840997f0d719a4d040d4d0639f2d51621976217b1cfb1038db537e0ca46d917c0440a8ed6b7ab83b3e362c34d45c064dff7a1df
+  data.tar.gz: 823c5ebb016f7c2f31cdae1a838556f2ea7d62a25d0d6193aead188dfe045392cbf940892f258d24a2167fbc5f620816d03274154d07535031c66535c232909d

data/README.md

@@ -72,6 +72,7 @@ The BundleUp SDK is tested and supported on:
 - 🔌 **100+ Integrations** - Connect to Slack, GitHub, Jira, Linear, and many more
 - 🎯 **Unified API** - Consistent interface across all integrations via Unify API
 - 🔑 **Proxy API** - Direct access to underlying integration APIs
+- 🤖 **MCP** - Connect agents to a provider's own MCP server or to BundleUp's Unified MCP
 - 🪶 **Lightweight** - Minimal dependencies
 - 🛡️ **Error Handling** - Comprehensive error messages and validation
 - 📚 **Well Documented** - Extensive documentation and examples
@@ -175,6 +176,10 @@ BUNDLEUP_CLIENT = BundleUp::Client.new(ENV['BUNDLEUP_API_KEY'])
 
 ## Core Concepts
 
+### Auth API
+
+The **Auth API** runs the hosted authorization flow: build the URL that sends a user to connect an integration, then exchange the one-time `code` from the redirect for a `connection_id`. See [Authorization Flow](https://docs.bundleup.io/authorization-flow).
+
 ### Platform API
 
 The **Platform API** provides access to core BundleUp features like managing connections and integrations. Use this API to list, retrieve, and delete connections, as well as discover available integrations.
@@ -187,6 +192,10 @@ The **Proxy API** allows you to make direct HTTP requests to the underlying inte
 
 The **Unify API** provides a standardized, normalized interface across different integrations. For example, you can fetch chat channels from Slack, Discord, or Microsoft Teams using the same API call.
 
+### MCP API
+
+The **MCP API** reaches a provider's own MCP server using a connection's stored credentials. Tools are defined by the provider, not by BundleUp. Because the connection is chosen per client, one agent can serve many end users without ever handling a token.
+
 ## API Reference
 
 ### Connections
@@ -515,6 +524,62 @@ class WebhooksController < ApplicationController
 end
 ```
 
+### Auth API
+
+Connect an end user's account and get back a `connection_id`. See [Authorization Flow](https://docs.bundleup.io/authorization-flow) for the full flow.
+
+#### Build the Authorization URL
+
+```ruby
+url = client.auth.build_authorization_url(
+  client_id: 'your-client-id',
+  integration_id: 'github',
+  redirect_uri: 'https://app.example.com/callback',
+  external_id: 'user_42', # optional
+  state: 'random-csrf-token' # optional
+)
+
+# Redirect the user to `url`
+```
+
+**Parameters:**
+
+- `client_id` (String, required): Your workspace client ID
+- `integration_id` (String, required): The integration to connect
+- `redirect_uri` (String, required): Must exactly match a redirect URI registered in your dashboard
+- `external_id` (String, optional): Your own reference, stored on the connection
+- `state` (String, optional): Returned unchanged on the redirect
+
+#### Exchange the Code for a Connection
+
+BundleUp redirects back to `redirect_uri` with a one-time `code`. Exchange it server-side:
+
+```ruby
+connection = client.auth.get_connection_from_code(
+  code: params[:code],
+  redirect_uri: 'https://app.example.com/callback'
+)
+
+puts connection['connection_id']
+```
+
+**Parameters:**
+
+- `code` (String, required): The `code` query parameter from the redirect
+- `redirect_uri` (String, required): The same redirect URI used to build the authorization URL
+
+**Response:**
+
+```ruby
+{
+  'connection_id' => 'conn_abc123',
+  'external_id' => 'user_42',
+  'integration_id' => 'github'
+}
+```
+
+The code expires after 5 minutes and can only be exchanged once. An invalid, expired or reused code raises a `RuntimeError` that includes the API's error body. Missing arguments raise `ArgumentError`.
+
 ### Proxy API
 
 Make direct HTTP requests to integration APIs through BundleUp.
@@ -873,6 +938,38 @@ puts "Pull Requests: #{result['data']}"
 }
 ```
 
+##### List Issues
+
+```ruby
+result = unify.git.issues('organization/repo-name', limit: 20)
+
+puts "Issues: #{result['data']}"
+```
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'id' => 67890,
+      'number' => 17,
+      'title' => 'Timestamps drift on retry',
+      'description' => 'Retried requests report the first attempt time',
+      'state' => 'open',
+      'url' => 'https://github.com/org/repo/issues/17',
+      'user' => 'john-doe',
+      'created_at' => '2024-01-15T10:30:00Z',
+      'updated_at' => '2024-01-20T14:22:00Z',
+      'closed_at' => nil
+    }
+  ],
+  'metadata' => {
+    'next' => nil
+  }
+}
+```
+
 ##### List Tags
 
 ```ruby
@@ -956,6 +1053,37 @@ puts "Branches: #{result['data']}"
 }
 ```
 
+##### List Commits
+
+```ruby
+result = unify.git.commits('organization/repo-name', branch: 'main', limit: 20)
+
+puts "Commits: #{result['data']}"
+```
+
+`branch` is optional and accepts a branch name, tag or commit SHA. When it is omitted the
+provider's default branch is used.
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'sha' => 'abc123def4567890abc123def4567890abc123de',
+      'message' => 'Add commits endpoint',
+      'url' => 'https://github.com/org/repo/commit/abc123def4567890abc123def4567890abc123de',
+      'author' => 'Jane Doe',
+      'author_email' => 'jane@example.com',
+      'committed_at' => '2024-01-15T10:30:00Z'
+    }
+  ],
+  'metadata' => {
+    'next' => nil
+  }
+}
+```
+
 #### Ticketing API
 
 The Ticketing API provides a unified interface for ticketing and project management platforms like Jira, Linear, and Asana.
@@ -1028,6 +1156,41 @@ puts "Ticket: #{result['data']}"
 
 A single resource carries no pagination, so there is no `metadata` on this response.
 
+##### List Projects
+
+```ruby
+result = unify.ticketing.projects(
+  limit: 100,
+  after: nil,
+  include_raw: false
+)
+
+puts "Projects: #{result['data']}"
+```
+
+**Response:**
+
+```ruby
+{
+  'data' => [
+    {
+      'id' => '10001',
+      'name' => 'Website Redesign',
+      'status' => 'active',
+      'url' => 'https://jira.example.com/browse/PROJ',
+      'description' => 'All the work for the new marketing site',
+      'created_at' => '2024-01-15T10:30:00Z',
+      'updated_at' => '2024-01-20T14:22:00Z'
+    }
+  ],
+  'metadata' => {
+    'next' => 'cursor_def456'
+  }
+}
+```
+
+**Note:** Not every platform returns every field. Jira does not expose creation or update timestamps for projects, so `created_at` and `updated_at` are `nil` for Jira connections, and `status` is only set when Jira reports whether the project is archived.
+
 #### CRM API
 
 The CRM API provides a unified interface for CRM platforms like Attio, HubSpot, PipeDrive, Salesforce and Zoho.
@@ -1171,6 +1334,218 @@ puts "Events: #{result['data']}"
 
 Recurring events are expanded into their occurrences. All-day events carry a `YYYY-MM-DD` date rather than a timestamp. Attendees, conferencing links and organizers are available through `include_raw` or the Proxy API.
 
+### MCP API
+
+Reach a provider's own MCP server using a connection's credentials. BundleUp injects and refreshes the access token, so the connection ID is the only thing your agent needs to know about a user.
+
+Supported for providers that run a first-party MCP server — see the [integrations page](https://www.bundleup.io/integrations). Others return an `mcp_not_supported` error.
+
+`post` and `delete` are transport only, like the Proxy API — responses come back untouched as `Faraday::Response` objects. `connect` layers a managed session on top when you would rather not drive the protocol yourself.
+
+#### Creating an MCP Client
+
+```ruby
+mcp = client.mcp('conn_123abc')
+```
+
+#### Managed Sessions
+
+`connect` returns a client that handles the handshake, session ID and response decoding, and exposes what the provider offers.
+
+```ruby
+mcp = client.mcp('conn_123abc').connect
+
+tools = mcp.list_tools
+result = mcp.call_tool('create_issue', { title: 'Login broken' })
+
+mcp.close
+```
+
+Resources and prompts follow the same shape:
+
+```ruby
+resources = mcp.list_resources
+contents = mcp.read_resource('file:///readme.md')
+
+prompts = mcp.list_prompts
+messages = mcp.get_prompt('summarize', { id: '123' })
+```
+
+Anything else in the protocol:
+
+```ruby
+mcp.request('logging/setLevel', { level: 'debug' })
+```
+
+The handshake runs lazily on the first call and once per client, list methods follow `nextCursor` to the end, and `text/event-stream` responses are decoded for you. Results are hashes with string keys. Errors raise a `RuntimeError` with the provider's message, or BundleUp's with its code appended — `Missing or invalid connection ID (connection_invalid)`.
+
+Call `close` when you are done to end the session upstream.
+
+#### Model-Hosted MCP
+
+OpenAI and Anthropic can connect to an MCP server themselves, with no tool mapping or dispatch loop on your side. Both accept only a single credential and no custom headers, so `hosted` returns the server URL alongside the API key and connection joined into one bearer.
+
+```ruby
+hosted = client.mcp('conn_123abc').hosted
+
+response = openai.responses.create(
+  model: 'gpt-4o',
+  input: 'What issues are assigned to me?',
+  tools: [
+    {
+      type: 'mcp',
+      server_label: 'linear',
+      server_url: hosted[:url],
+      authorization: hosted[:token],
+      require_approval: 'never'
+    }
+  ]
+)
+```
+
+Anthropic's connector takes the same pair as `url` and `authorization_token`. `client.unify('conn_123abc').mcp.hosted` returns them for Unified MCP.
+
+`server_url` must be exactly the URL `hosted` returns — the proxy rebuilds the upstream URL from the provider's own base, so any path or query you append is ignored rather than rejected.
+
+This sends your API key to the model provider, whose servers make the request. Use an MCP client in your own backend if that is not acceptable.
+
+#### Using an MCP Client Library
+
+`transport` returns the URL and headers if you would rather use an existing MCP client. Pass them to any client that supports the streamable HTTP transport.
+
+```ruby
+transport = client.mcp('conn_123abc').transport
+
+transport[:url]     # => "https://mcp.bundleup.io"
+transport[:headers] # => { "Authorization" => "Bearer ...", "BU-Connection-Id" => "conn_123abc", ... }
+```
+
+#### Sending JSON-RPC Directly
+
+MCP requires an `initialize` handshake before any other method. The session ID comes back on that first response and must be sent on every call after it.
+
+```ruby
+mcp = client.mcp('conn_123abc')
+
+# 1. Handshake
+init = mcp.post({
+  jsonrpc: '2.0',
+  id: 1,
+  method: 'initialize',
+  params: {
+    protocolVersion: '2025-06-18',
+    capabilities: {},
+    clientInfo: { name: 'my-agent', version: '1.0.0' }
+  }
+})
+
+session_id = init.headers['mcp-session-id']
+session = session_id ? { 'Mcp-Session-Id' => session_id } : {}
+
+# 2. Confirm the handshake (a notification — no id, no response body)
+mcp.post({ jsonrpc: '2.0', method: 'notifications/initialized' }, headers: session)
+
+# 3. List tools
+response = mcp.post({ jsonrpc: '2.0', id: 2, method: 'tools/list' }, headers: session)
+result = parse(response)['result']
+
+puts result['tools']
+```
+
+Providers may answer with `text/event-stream` rather than JSON, so responses need unwrapping either way:
+
+```ruby
+require 'json'
+
+def parse(response)
+  return JSON.parse(response.body) unless response.headers['content-type'].to_s.include?('text/event-stream')
+
+  data = response.body.lines
+                 .select { |line| line.start_with?('data:') }
+                 .map { |line| line[5..].strip }
+                 .join("\n")
+
+  JSON.parse(data)
+end
+```
+
+Tool lists can be paginated. If `result['nextCursor']` is set, call `tools/list` again with `params: { cursor: result['nextCursor'] }` until it comes back empty.
+
+Calling a tool follows the same shape:
+
+```ruby
+response = mcp.post({
+  jsonrpc: '2.0',
+  id: 3,
+  method: 'tools/call',
+  params: { name: 'create_issue', arguments: { title: 'Login broken' } }
+}, headers: session)
+```
+
+#### Sessions
+
+MCP sessions live on the provider's server — BundleUp holds no session state. Close one when you are done:
+
+```ruby
+mcp.delete(headers: { 'Mcp-Session-Id' => session_id })
+```
+
+#### Errors
+
+BundleUp rejects a request before it reaches the provider by returning an HTTP error with a JSON body — the response is passed straight through, so check `response.success?` yourself.
+
+```ruby
+response = mcp.post(body)
+
+unless response.success?
+  error = JSON.parse(response.body)
+  # connection_invalid, connection_refresh_failed, mcp_not_supported, rate_limit
+  warn "#{error['code']}: #{error['message']}"
+end
+```
+
+Every JSON-RPC message counts toward the rate limit of 100 requests per 60 seconds, per connection — including the `initialize` handshake.
+
+#### Merging Several Connections
+
+An agent often needs more than one provider for the same end user. There is no merge helper in the SDK — how tools are namespaced, filtered and recovered from differs enough per agent that it is better written where you can see it:
+
+```ruby
+clients = {
+  'slack' => client.mcp(user.slack_connection).connect,
+  'linear' => client.mcp(user.linear_connection).connect,
+  'crm' => client.unify(user.hubspot_connection).mcp
+}
+
+# One namespaced list: slack__send_message, linear__create_issue, …
+tools = clients.flat_map do |label, mcp|
+  mcp.list_tools.map { |tool| tool.merge('name' => "#{label}__#{tool['name']}") }
+end
+
+# Route a call back to the client that owns it
+call = lambda do |name, args|
+  label, tool_name = name.split('__', 2)
+  clients.fetch(label).call_tool(tool_name, args)
+end
+```
+
+Anything that exposes `list_tools` and `call_tool(name, args)` fits the same shape, so an internal tool layer of your own can sit in that map alongside BundleUp connections.
+
+Two things worth handling that the sketch above skips. **Filter before you hand the list to a model** — three providers is easily sixty tools, and accuracy drops as that list grows, so select the ones the agent actually needs rather than passing everything. And decide what an unreachable provider should do: as written, one failing `list_tools` raises and fails the whole list, while a `rescue` per client lets the others through.
+
+#### Unified MCP
+
+BundleUp's normalized tools instead of the provider's, on the same protocol. Tools only — Unified MCP exposes no resources or prompts.
+
+```ruby
+mcp = client.unify('conn_123abc').mcp
+
+tools = mcp.list_tools
+result = mcp.call_tool('send_message', { text: 'Deploy finished' })
+```
+
+`unify.mcp` is memoized per Unify client, so the handshake runs once no matter how often you call it. The server itself is stateless and POST-only, so there is no session to close.
+
 ## Error Handling
 
 The SDK raises exceptions for errors. Always wrap SDK calls in rescue blocks for proper error handling.
@@ -1212,7 +1587,9 @@ lib/
 ├── bundleup.rb              # Main entry point
 ├── bundleup/
 │   ├── client.rb            # Main client class
+│   ├── auth.rb              # Auth API (authorization URL + code exchange)
 │   ├── proxy.rb             # Proxy API implementation
+│   ├── mcp.rb               # MCP API (transport + managed sessions)
 │   ├── unify.rb             # Unify API client wrapper
 │   ├── version.rb           # Gem version
 │   ├── resources/

data/lib/bundleup/auth.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require 'uri'
+
+module BundleUp
+  # Client for the hosted authorization flow.
+  class Auth
+    BASE_URL = 'https://auth.bundleup.io'
+
+    attr_reader :api_key
+
+    def initialize(api_key)
+      @api_key = api_key
+    end
+
+    # Builds the hosted authorization URL to send the end user to.
+    def build_authorization_url(client_id:, integration_id:, redirect_uri:, external_id: nil, state: nil)
+      raise ArgumentError, 'client_id is required' if blank?(client_id)
+      raise ArgumentError, 'integration_id is required' if blank?(integration_id)
+      raise ArgumentError, 'redirect_uri is required' if blank?(redirect_uri)
+
+      params = {
+        client_id: client_id,
+        integration_id: integration_id,
+        redirect_uri: redirect_uri
+      }
+      params[:external_id] = external_id unless blank?(external_id)
+      params[:state] = state unless blank?(state)
+
+      "#{BASE_URL}/authorize?#{URI.encode_www_form(params)}"
+    end
+
+    # Exchanges the one-time code from the redirect for the connection.
+    # Call this server-side; the code expires after 5 minutes and works once.
+    # Returns { 'connection_id', 'external_id', 'integration_id' }.
+    def get_connection_from_code(code:, redirect_uri:)
+      raise ArgumentError, 'code is required' if blank?(code)
+      raise ArgumentError, 'redirect_uri is required' if blank?(redirect_uri)
+
+      response = connection.post('connection', { code: code, redirect_uri: redirect_uri })
+
+      raise "Failed to get connection: #{response.status}: #{response.body}" unless response.success?
+
+      response.body
+    end
+
+    private
+
+    def blank?(value)
+      value.nil? || value.to_s.empty?
+    end
+
+    # Memoize the Faraday connection to reuse it across requests
+    def connection
+      @connection ||= Faraday.new(url: BASE_URL) do |faraday|
+        faraday.headers = {
+          'Authorization' => "Bearer #{@api_key}",
+          'Content-Type' => 'application/json'
+        }
+
+        faraday.request :json
+        faraday.response :json, content_type: /\bjson$/
+        faraday.adapter Faraday.default_adapter
+      end
+    end
+  end
+end

data/lib/bundleup/client.rb

@@ -11,6 +11,10 @@ module BundleUp
       @api_key = api_key
     end
 
+    def auth
+      @auth ||= BundleUp::Auth.new(@api_key)
+    end
+
     def connections
       @connections ||= BundleUp::Resources::Connection.new(@api_key)
     end

data/lib/bundleup/unify/git.rb

@@ -30,6 +30,21 @@ module BundleUp
         response.body
       end
 
+      # Fetches issues for a specific repository from the connected Git provider.
+      def issues(repo_name, params = {})
+        raise ArgumentError, 'repo_name is required to fetch issues.' if blank?(repo_name)
+
+        encoded_repo_name = URI.encode_www_form_component(repo_name)
+
+        response = connection.get("git/repos/#{encoded_repo_name}/issues") do |req|
+          req.params = params
+        end
+
+        raise "Failed to fetch git/repos/#{encoded_repo_name}/issues: #{response.status}" unless response.success?
+
+        response.body
+      end
+
       # Fetches tags for a specific repository from the connected Git provider.
       def tags(repo_name, params = {})
         raise ArgumentError, 'repo_name is required to fetch tags.' if blank?(repo_name)

data/lib/bundleup/unify/ticketing.rb

@@ -33,6 +33,17 @@ module BundleUp
         response.body
       end
 
+      # Fetches projects from the connected ticketing tool.
+      def projects(params = {})
+        response = connection.get('ticketing/projects') do |req|
+          req.params = params
+        end
+
+        raise "Failed to fetch ticketing/projects: #{response.status}" unless response.success?
+
+        response.body
+      end
+
       private
 
       def blank?(value)

data/lib/bundleup/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module BundleUp
-  VERSION = '0.4.3'
+  VERSION = '0.5.0'
 end

data/lib/bundleup.rb

@@ -4,6 +4,7 @@ require 'faraday'
 
 require_relative 'bundleup/version'
 require_relative 'bundleup/client'
+require_relative 'bundleup/auth'
 require_relative 'bundleup/proxy'
 require_relative 'bundleup/unify'
 require_relative 'bundleup/mcp'

data/sig/bundleup/auth.rbs

@@ -0,0 +1,31 @@
+module BundleUp
+  class Auth
+    BASE_URL: String
+
+    type connection = {
+      "connection_id" => String,
+      "external_id" => String?,
+      "integration_id" => String
+    }
+
+    attr_reader api_key: String
+
+    def initialize: (String api_key) -> void
+
+    def build_authorization_url: (
+      client_id: String,
+      integration_id: String,
+      redirect_uri: String,
+      ?external_id: String?,
+      ?state: String?
+    ) -> String
+
+    def get_connection_from_code: (code: String, redirect_uri: String) -> connection
+
+    private
+
+    def blank?: (untyped value) -> bool
+
+    def connection: () -> untyped
+  end
+end

data/sig/bundleup/unify/git.rbs

@@ -26,6 +26,19 @@ module BundleUp
         merged_at: String?
       }
 
+      type git_issue = {
+        id: Integer,
+        number: Integer,
+        title: String,
+        description: String?,
+        state: String,
+        url: String,
+        user: String?,
+        created_at: String,
+        updated_at: String,
+        closed_at: String?
+      }
+
       type git_tag = { name: String, commit_sha: String }
 
       type git_release = {
@@ -41,13 +54,24 @@ module BundleUp
 
       type git_branch = { name: String, commit_sha: String, protected: bool }
 
+      type git_commit = {
+        sha: String,
+        message: String?,
+        url: String,
+        author: String?,
+        author_email: String?,
+        committed_at: String?
+      }
+
       type metadata = { next: String? }
 
       def repos: (?Hash[Symbol, untyped] params) -> { data: Array[git_repo], metadata: metadata }
       def pulls: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_pull], metadata: metadata }
+      def issues: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_issue], metadata: metadata }
       def tags: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_tag], metadata: metadata }
       def releases: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_release], metadata: metadata }
       def branches: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_branch], metadata: metadata }
+      def commits: (String repo_name, ?Hash[Symbol, untyped] params) -> { data: Array[git_commit], metadata: metadata }
     end
   end
 end

data/sig/bundleup/unify/ticketing.rbs

@@ -21,12 +21,24 @@ module BundleUp
         updated_at: String?
       }
 
+      type ticketing_project = {
+        id: String,
+        name: String,
+        status: String?,
+        url: String?,
+        description: String?,
+        created_at: String?,
+        updated_at: String?
+      }
+
       type metadata = { next: String? }
 
       def tickets: (?Hash[Symbol, untyped] params) -> { data: Array[ticketing_ticket], metadata: metadata }
 
       def ticket: (String ticket_id, ?Hash[Symbol, untyped] params) -> { data: ticket }
 
+      def projects: (?Hash[Symbol, untyped] params) -> { data: Array[ticketing_project], metadata: metadata }
+
       private
 
       def blank?: (untyped) -> bool

data/sig/bundleup/unify.rbs

@@ -8,7 +8,7 @@ module BundleUp
 
       def chat: () -> Chat
       def git: () -> Git
-      def pm: () -> PM
+      def ticketing: () -> Ticketing
       def crm: () -> CRM
       def drive: () -> Drive
       def calendar: () -> Calendar

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: bundleup-sdk
 version: !ruby/object:Gem::Version
-  version: 0.4.3
+  version: 0.5.0
 platform: ruby
 authors:
 - BundleUp
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-27 00:00:00.000000000 Z
+date: 2026-09-30 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: faraday
@@ -167,9 +167,9 @@ files:
 - LICENSE
 - README.md
 - lib/bundleup.rb
+- lib/bundleup/auth.rb
 - lib/bundleup/client.rb
 - lib/bundleup/mcp.rb
-- lib/bundleup/mcp_client.rb
 - lib/bundleup/proxy.rb
 - lib/bundleup/resources/base.rb
 - lib/bundleup/resources/connection.rb
@@ -186,6 +186,7 @@ files:
 - lib/bundleup/unify/me.rb
 - lib/bundleup/unify/ticketing.rb
 - lib/bundleup/version.rb
+- sig/bundleup/auth.rbs
 - sig/bundleup/unify.rbs
 - sig/bundleup/unify/base.rbs
 - sig/bundleup/unify/calendar.rbs

data/lib/bundleup/mcp_client.rb

@@ -1,202 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-
-module BundleUp
-  # A connected MCP session.
-  #
-  # Tools, resources and prompts are defined by the provider — BundleUp does
-  # not rename or normalize them.
-  class MCPClient
-    PROTOCOL_VERSION = '2025-06-18'
-    CLIENT_NAME = 'bundleup-sdk'
-
-    def initialize(base_url, api_key, connection_id)
-      @base_url = base_url
-      @api_key = api_key
-      @connection_id = connection_id
-      @session_id = nil
-      @connected = false
-      @last_id = 0
-    end
-
-    # List the provider's tools, following pagination to the end.
-    def tools
-      paginate('tools/list', 'tools')
-    end
-
-    # Call a tool by name, with arguments matching its own input schema.
-    def tool(name, args = {})
-      raise ArgumentError, 'Tool name is required to call a tool.' if blank?(name)
-
-      connect
-      send_message('tools/call', { name: name, arguments: args })
-    end
-
-    # List the provider's resources, following pagination to the end.
-    def resources
-      paginate('resources/list', 'resources')
-    end
-
-    # Read a resource by URI.
-    def resource(uri)
-      raise ArgumentError, 'Resource URI is required to read a resource.' if blank?(uri)
-
-      connect
-      send_message('resources/read', { uri: uri })
-    end
-
-    # List the provider's prompts, following pagination to the end.
-    def prompts
-      paginate('prompts/list', 'prompts')
-    end
-
-    # Get a prompt by name.
-    def prompt(name, args = {})
-      raise ArgumentError, 'Prompt name is required to get a prompt.' if blank?(name)
-
-      connect
-      send_message('prompts/get', { name: name, arguments: args })
-    end
-
-    # Send any other JSON-RPC method on this session.
-    def request(method, params = nil)
-      raise ArgumentError, 'Method is required to send a request.' if blank?(method)
-
-      connect
-      send_message(method, params)
-    end
-
-    # End the session and reset local state.
-    def close
-      delete_session if @session_id
-
-      @session_id = nil
-      @connected = false
-      nil
-    end
-
-    private
-
-    def blank?(value)
-      value.nil? || value.to_s.empty?
-    end
-
-    def default_headers
-      headers = {
-        'Authorization' => '******',
-        'Content-Type' => 'application/json',
-        'Accept' => 'application/json, text/event-stream',
-        'BU-Connection-Id' => @connection_id
-      }
-      headers['Mcp-Session-Id'] = @session_id if @session_id
-      headers
-    end
-
-    def connection
-      @connection ||= Faraday.new { |faraday| faraday.adapter Faraday.default_adapter }
-    end
-
-    def post_payload(payload)
-      response = connection.post(@base_url, payload.to_json, default_headers)
-      session_id = response.headers['mcp-session-id']
-      @session_id = session_id if session_id
-
-      raise error_for(response) unless response.success?
-
-      response
-    end
-
-    def error_for(response)
-      fallback = "MCP request failed with status #{response.status}."
-      parsed = JSON.parse(response.body.to_s)
-      return RuntimeError.new(fallback) unless parsed.is_a?(Hash) && parsed['message']
-
-      code = parsed['code']
-      RuntimeError.new(code ? "#{parsed['message']} (#{code})" : parsed['message'])
-    rescue JSON::ParserError
-      RuntimeError.new(fallback)
-    end
-
-    # Run the MCP handshake, once. Deferred until the first call.
-    def connect
-      return if @connected
-
-      send_message('initialize', handshake_params)
-      post_payload({ jsonrpc: '2.0', method: 'notifications/initialized' })
-      @connected = true
-    end
-
-    def handshake_params
-      {
-        protocolVersion: PROTOCOL_VERSION,
-        capabilities: {},
-        clientInfo: { name: CLIENT_NAME, version: BundleUp::VERSION }
-      }
-    end
-
-    def send_message(method, params = nil)
-      @last_id += 1
-      payload = { jsonrpc: '2.0', id: @last_id, method: method }
-      payload[:params] = params unless params.nil?
-
-      message = parse(post_payload(payload), @last_id)
-      raise "No response received for #{method}." if message.nil?
-      raise message['error']['message'].to_s if message['error']
-
-      message['result'] || {}
-    end
-
-    # Providers may answer a plain request/response over text/event-stream.
-    def parse(response, message_id)
-      body = response.body.to_s
-      return nil if body.empty?
-
-      content_type = response.headers['content-type'].to_s
-      return JSON.parse(body) unless content_type.include?('text/event-stream')
-
-      parse_stream(body, message_id)
-    end
-
-    def parse_stream(body, message_id)
-      body.gsub("\r\n", "\n").split("\n\n").each do |event|
-        data = event_data(event)
-        next if data.empty?
-
-        message = JSON.parse(data)
-        # Skip server notifications interleaved on the stream.
-        return message if message.is_a?(Hash) && message['id'] == message_id
-      end
-
-      nil
-    end
-
-    def event_data(event)
-      event.split("\n")
-           .select { |line| line.start_with?('data:') }
-           .map { |line| line.sub('data:', '').strip }
-           .join("\n")
-    end
-
-    def paginate(method, key)
-      connect
-      items = []
-      cursor = nil
-
-      loop do
-        result = send_message(method, cursor ? { cursor: cursor } : nil)
-        items.concat(result[key] || [])
-        cursor = result['nextCursor']
-        break unless cursor
-      end
-
-      items
-    end
-
-    def delete_session
-      connection.delete(@base_url, nil, default_headers)
-    rescue Faraday::Error
-      nil
-    end
-  end
-end