@typeship-ax/cli 0.6.0 → 0.9.1

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE5I;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAChD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAClD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC/C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACrD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACzD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACjD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;gBACpD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACrD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC9C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACpD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC9C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE3I;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACtD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACnD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC7D,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACrD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD"}

package/dist/errors.js

@@ -1,14 +1,14 @@
 // typeship — typed error classes.
 // Generated by typeship — https://typeship.dev — do not edit by hand.
 import { ApiError } from "./core/http.js";
-export { ApiError, GraphQLRequestError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
+export { ApiError, ResponseParseError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
 /**
- * The request body, specification source, output selection, or package name is invalid.
+ * The request body, Definition source, target selection, or package name is invalid.
  * Raised for HTTP 400 responses.
  */
 export class BadRequestError extends ApiError {
     constructor(body, response) {
-        super("The request body, specification source, output selection, or package name is invalid.", 400, body, response);
+        super("The request body, Definition source, target selection, or package name is invalid.", 400, body, response);
     }
 }
 /**
@@ -29,6 +29,15 @@ export class ForbiddenError extends ApiError {
         super("The credentials are valid but cannot act on the requested organization.", 403, body, response);
     }
 }
+/**
+ * The key identifies changed intent.
+ * Raised for HTTP 409 responses.
+ */
+export class ConflictError extends ApiError {
+    constructor(body, response) {
+        super("The key identifies changed intent.", 409, body, response);
+    }
+}
 /**
  * Spec exceeds the 10MB limit.
  * Raised for HTTP 413 responses.
@@ -39,21 +48,22 @@ export class PayloadTooLargeError extends ApiError {
     }
 }
 /**
- * The spec could not be understood.
+ * The Definition could not be resolved or understood.
  * Raised for HTTP 422 responses.
  */
 export class UnprocessableEntityError extends ApiError {
     constructor(body, response) {
-        super("The spec could not be understood.", 422, body, response);
+        super("The Definition could not be resolved or understood.", 422, body, response);
     }
 }
 /**
- * Too many requests. Wait for Retry-After before retrying.
+ * Too many requests, or an identical write is still in progress. Wait for Retry-After before
+ * retrying.
  * Raised for HTTP 429 responses.
  */
 export class RateLimitedError extends ApiError {
     constructor(body, response) {
-        super("Too many requests. Wait for Retry-After before retrying.", 429, body, response);
+        super("Too many requests, or an identical write is still in progress. Wait for Retry-After before retrying.", 429, body, response);
     }
 }
 /**
@@ -66,30 +76,21 @@ export class ApiResponseError extends ApiError {
     }
 }
 /**
- * The plan does not include another project or the requested output configuration.
+ * The plan does not include another project or the requested target configuration.
  * Raised for HTTP 402 responses.
  */
 export class PaymentRequiredError extends ApiError {
     constructor(body, response) {
-        super("The plan does not include another project or the requested output configuration.", 402, body, response);
+        super("The plan does not include another project or the requested target configuration.", 402, body, response);
     }
 }
 /**
- * The Idempotency-Key was already used with different request parameters.
- * Raised for HTTP 409 responses.
- */
-export class ConflictError extends ApiError {
-    constructor(body, response) {
-        super("The Idempotency-Key was already used with different request parameters.", 409, body, response);
-    }
-}
-/**
- * The original idempotent request is temporarily unavailable.
+ * Project setup failed unexpectedly; the key reservation is released.
  * Raised for HTTP 500 responses.
  */
 export class InternalServerError extends ApiError {
     constructor(body, response) {
-        super("The original idempotent request is temporarily unavailable.", 500, body, response);
+        super("Project setup failed unexpectedly; the key reservation is released.", 500, body, response);
     }
 }
 /**
@@ -101,3 +102,12 @@ export class NotFoundError extends ApiError {
         super("No such resource in this account.", 404, body, response);
     }
 }
+/**
+ * The Project was saved, but an obsolete release pull request could not be retired.
+ * Raised for HTTP 502 responses.
+ */
+export class BadGatewayError extends ApiError {
+    constructor(body, response) {
+        super("The Project was saved, but an obsolete release pull request could not be retired.", 502, body, response);
+    }
+}

package/dist/index.d.ts

@@ -1,12 +1,14 @@
-import { type DebugEvent, type RequestContext } from "./core/http.js";
+import { type AuthValue, type DebugEvent, type RequestContext } from "./core/http.js";
 import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
+import { DefinitionsResource } from "./resources/definitions.js";
+import { TargetsResource } from "./resources/targets.js";
 import { GenerationsResource } from "./resources/generations.js";
-import { SpecRevisionsResource } from "./resources/spec-revisions.js";
+import { DefinitionRevisionsResource } from "./resources/definition-revisions.js";
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.9.1";
 export interface ClientOptions {
     /** Override the server URL. Default: `https://typeship.dev/api/v1` */
     baseUrl?: string;
@@ -15,6 +17,13 @@ export interface ClientOptions {
      * before every attempt.
      */
     bearerToken?: string | (() => string | Promise<string>);
+    /**
+     * Credentials keyed by the Definition's security scheme names. Only one complete alternative is
+     * sent for each operation. Named values take precedence over convenience options.
+     */
+    credentials?: {
+        "apiKey"?: AuthValue;
+    };
     /** Per-attempt timeout in milliseconds. Default: 30000. */
     timeoutMs?: number;
     /** Retries after the first attempt (retryable failures only). Default: 2. */
@@ -60,21 +69,25 @@ export interface ClientOptions {
     };
 }
 /**
- * typeship — v0.6.0
+ * typeship — v0.9.1
  *
- * Generate production SDKs, CLIs, and MCP servers from an OpenAPI or
- * GraphQL spec, and keep every selected output current.
+ * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
+ * selected SDK, CLI, and MCP Target current.
  *
- * Every operation but one requires an API key, created in the console and
- * sent as `Authorization: Bearer ak_...`. A browser session is not a
- * credential for this API. The exception is POST /generate, which works
- * anonymously with the free plan's limits.
+ * Every operation but one requires a bearer credential: an organization
+ * API key from the console, or an OAuth access token carrying the operation's
+ * read, generate, or write capability and the organization selected during
+ * consent. OAuth grants cannot switch organizations after consent. A browser
+ * session is not a credential for this API. The exception is POST /generate,
+ * which works anonymously with the free plan's limits.
  */
 export declare class TypeshipClient {
     readonly generate: GenerateResource;
     readonly projects: ProjectsResource;
+    readonly definitions: DefinitionsResource;
+    readonly targets: TargetsResource;
     readonly generations: GenerationsResource;
-    readonly specRevisions: SpecRevisionsResource;
+    readonly definitionRevisions: DefinitionRevisionsResource;
     readonly account: AccountResource;
     readonly apiKeys: ApiKeysResource;
     constructor(options?: ClientOptions);
@@ -85,8 +98,10 @@ export { formatDebugEvent, type ApiResult, type AuthValue, type DebugEvent, type
 export { Page, PagePromise } from "./core/pagination.js";
 export * from "./resources/generate.js";
 export * from "./resources/projects.js";
+export * from "./resources/definitions.js";
+export * from "./resources/targets.js";
 export * from "./resources/generations.js";
-export * from "./resources/spec-revisions.js";
+export * from "./resources/definition-revisions.js";
 export * from "./resources/account.js";
 export * from "./resources/api-keys.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA2CxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,SAAS,CAAC;KACtB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA8DxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -4,29 +4,35 @@ import { HttpCore, formatDebugEvent, bearerAuth, } from "./core/http.js";
 import { DEFS, SCHEMAS } from "./schemas.js";
 import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
+import { DefinitionsResource } from "./resources/definitions.js";
+import { TargetsResource } from "./resources/targets.js";
 import { GenerationsResource } from "./resources/generations.js";
-import { SpecRevisionsResource } from "./resources/spec-revisions.js";
+import { DefinitionRevisionsResource } from "./resources/definition-revisions.js";
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export const VERSION = "0.6.0";
-const USER_AGENT = "@typeship-ax/cli/0.6.0 (typeship)";
+export const VERSION = "0.9.1";
+const USER_AGENT = "@typeship-ax/cli/0.9.1 (typeship)";
 /**
- * typeship — v0.6.0
+ * typeship — v0.9.1
  *
- * Generate production SDKs, CLIs, and MCP servers from an OpenAPI or
- * GraphQL spec, and keep every selected output current.
+ * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
+ * selected SDK, CLI, and MCP Target current.
  *
- * Every operation but one requires an API key, created in the console and
- * sent as `Authorization: Bearer ak_...`. A browser session is not a
- * credential for this API. The exception is POST /generate, which works
- * anonymously with the free plan's limits.
+ * Every operation but one requires a bearer credential: an organization
+ * API key from the console, or an OAuth access token carrying the operation's
+ * read, generate, or write capability and the organization selected during
+ * consent. OAuth grants cannot switch organizations after consent. A browser
+ * session is not a credential for this API. The exception is POST /generate,
+ * which works anonymously with the free plan's limits.
  */
 export class TypeshipClient {
     generate;
     projects;
+    definitions;
+    targets;
     generations;
-    specRevisions;
+    definitionRevisions;
     account;
     apiKeys;
     constructor(options = {}) {
@@ -41,8 +47,23 @@ export class TypeshipClient {
                 ? (event) => console.error(formatDebugEvent("typeship", event))
                 : undefined;
         const query = {};
+        const authHeaders = {};
+        const authQuery = {};
+        let bearerCredential;
         if (options.bearerToken !== undefined)
-            headers["Authorization"] = bearerAuth(options.bearerToken);
+            bearerCredential = bearerAuth(options.bearerToken);
+        const allowedCredentials = new Set(["apiKey"]);
+        for (const name of Object.keys(options.credentials ?? {})) {
+            if (!allowedCredentials.has(name))
+                throw new Error("Unknown security scheme: " + name);
+        }
+        const credentials = Object.create(null);
+        {
+            const named = options.credentials && Object.hasOwn(options.credentials, "apiKey") ? options.credentials["apiKey"] : undefined;
+            const value = named !== undefined ? bearerAuth(named) : bearerCredential;
+            if (value !== undefined)
+                credentials["apiKey"] = { headers: { ["Authorization"]: value } };
+        }
         const v = options.validate;
         const validate = v
             ? {
@@ -55,6 +76,7 @@ export class TypeshipClient {
             baseUrl: options.baseUrl ?? "https://typeship.dev/api/v1",
             headers,
             query,
+            credentials,
             fetch: options.fetch ?? fetch,
             timeoutMs: options.timeoutMs ?? 30_000,
             maxRetries: options.maxRetries ?? 2,
@@ -68,8 +90,10 @@ export class TypeshipClient {
         });
         this.generate = new GenerateResource(core);
         this.projects = new ProjectsResource(core);
+        this.definitions = new DefinitionsResource(core);
+        this.targets = new TargetsResource(core);
         this.generations = new GenerationsResource(core);
-        this.specRevisions = new SpecRevisionsResource(core);
+        this.definitionRevisions = new DefinitionRevisionsResource(core);
         this.account = new AccountResource(core);
         this.apiKeys = new ApiKeysResource(core);
     }
@@ -80,7 +104,9 @@ export { formatDebugEvent, } from "./core/http.js";
 export { Page, PagePromise } from "./core/pagination.js";
 export * from "./resources/generate.js";
 export * from "./resources/projects.js";
+export * from "./resources/definitions.js";
+export * from "./resources/targets.js";
 export * from "./resources/generations.js";
-export * from "./resources/spec-revisions.js";
+export * from "./resources/definition-revisions.js";
 export * from "./resources/account.js";
 export * from "./resources/api-keys.js";

package/dist/named-credentials.d.ts

@@ -0,0 +1,21 @@
+/** Runtime credentials keyed by the API's exact security-scheme names. */
+export type NamedCredential = string | {
+    username: string;
+    password: string;
+};
+export type NamedCredentials = Record<string, NamedCredential>;
+export type CredentialSchemes = Record<string, {
+    kind: string;
+    options: string[];
+}>;
+export declare function parseNamedCredentials(value: unknown, schemes: CredentialSchemes): NamedCredentials;
+/** Low-to-high source order. Within a source, exact names beat convenience options. */
+export declare function resolveNamedCredentials(schemes: CredentialSchemes, layers: {
+    named?: NamedCredentials;
+    options?: Record<string, unknown>;
+}[]): NamedCredentials;
+/** Make convenience and named inputs comparable without expanding combinations. */
+export declare function namedCredentialAvailability(schemes: CredentialSchemes, options: Set<string>, named: NamedCredentials): Set<string>;
+/** Bound file/stdin reads before allocating a full credential document. */
+export declare function readNamedCredentialsFile(input: string, schemes: CredentialSchemes): NamedCredentials;
+//# sourceMappingURL=named-credentials.d.ts.map

package/dist/named-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"named-credentials.d.ts","sourceRoot":"","sources":["../src/named-credentials.ts"],"names":[],"mappings":"AAEA,0EAA0E;AAC1E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAC9E,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AAC/D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAAC;AAEpF,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAqBlG;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE;IAAE,KAAK,CAAC,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,EAAE,GAAG,gBAAgB,CAa/J;AAED,mFAAmF;AACnF,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,gBAAgB,GAAG,GAAG,CAAC,MAAM,CAAC,CAKlI;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,gBAAgB,CAkBpG"}

package/dist/named-credentials.js

@@ -0,0 +1,86 @@
+import { openSync, readSync, closeSync } from "node:fs";
+export function parseNamedCredentials(value, schemes) {
+    if (typeof value === "string") {
+        if (new TextEncoder().encode(value).byteLength > 1_048_576)
+            throw new Error("Named credentials exceed the 1 MiB limit.");
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            throw new Error("Named credentials must be a JSON object keyed by security scheme. Credential contents are not included in errors.");
+        }
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("Named credentials must be a JSON object keyed by security scheme.");
+    const result = Object.create(null);
+    for (const [name, credential] of Object.entries(value)) {
+        if (!Object.hasOwn(schemes, name))
+            throw new Error("Named credentials contain an unknown or unsupported security scheme. Check the names listed by login --help.");
+        if (schemes[name].kind === "basic") {
+            if (!credential || typeof credential !== "object" || Array.isArray(credential) || Object.keys(credential).some((key) => key !== "username" && key !== "password") ||
+                typeof credential.username !== "string" || typeof credential.password !== "string" || !credential.username || !credential.password || credential.username.includes(":")) {
+                throw new Error("A named Basic credential requires a nonempty username and password; the username cannot contain a colon.");
+            }
+            result[name] = { username: credential.username, password: credential.password };
+        }
+        else {
+            if (typeof credential !== "string" || !credential || /[\x00-\x1f\x7f]/.test(credential) || (schemes[name].kind === "bearer" && credential.includes(" ")))
+                throw new Error("A named token or API key must be a nonempty string without control characters; bearer tokens cannot contain spaces.");
+            result[name] = credential;
+        }
+    }
+    return result;
+}
+/** Low-to-high source order. Within a source, exact names beat convenience options. */
+export function resolveNamedCredentials(schemes, layers) {
+    const resolved = Object.create(null);
+    for (const layer of layers) {
+        for (const [name, scheme] of Object.entries(schemes)) {
+            for (const option of scheme.options) {
+                if (option === "clientCredentials")
+                    continue;
+                const value = layer.options?.[option];
+                if (value !== undefined)
+                    resolved[name] = value;
+            }
+        }
+        if (layer.named)
+            Object.assign(resolved, parseNamedCredentials(layer.named, schemes));
+    }
+    return resolved;
+}
+/** Make convenience and named inputs comparable without expanding combinations. */
+export function namedCredentialAvailability(schemes, options, named) {
+    for (const [name, scheme] of Object.entries(schemes)) {
+        if (Object.hasOwn(named, name) || scheme.options.some((option) => options.has(option)))
+            options.add("credentials." + name);
+    }
+    return options;
+}
+/** Bound file/stdin reads before allocating a full credential document. */
+export function readNamedCredentialsFile(input, schemes) {
+    let fd;
+    const chunks = [];
+    let total = 0;
+    try {
+        fd = input === "-" ? 0 : openSync(input.slice(1), "r");
+        while (true) {
+            const buffer = Buffer.alloc(Math.min(32_768, 1_048_577 - total));
+            const size = readSync(fd, buffer, 0, buffer.length, null);
+            if (!size)
+                break;
+            total += size;
+            if (total > 1_048_576)
+                throw new Error("size");
+            chunks.push(buffer.subarray(0, size));
+        }
+    }
+    catch {
+        throw new Error("Cannot read named credentials. Supply a readable JSON file or stdin input of at most 1 MiB.");
+    }
+    finally {
+        if (fd !== undefined && input !== "-")
+            closeSync(fd);
+    }
+    return parseNamedCredentials(Buffer.concat(chunks).toString("utf8"), schemes);
+}

package/dist/oauth-login.d.ts

@@ -0,0 +1,39 @@
+export interface OAuthLoginConfig {
+    issuer: string;
+    clientId: string;
+    discoveryUrl?: string;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    /** Register http://127.0.0.1/callback; an omitted port uses a random port. */
+    redirectUri?: string;
+    scopes?: string[];
+    audience?: string;
+    resource?: string;
+    /** Explicit runtime selection. The CLI verifies this ID through the API. */
+    organization?: {
+        parameter: "organization" | "organization_id";
+        id: string;
+    };
+}
+export interface OAuthLoginSession {
+    accessToken: string;
+    refreshToken?: string;
+    expiresAt?: number;
+    issuer: string;
+    clientId: string;
+    tokenUrl: string;
+    /** The actual native callback used for this exchange, including its port. */
+    redirectUri: string;
+    revocationUrl?: string;
+    scopes?: string[];
+}
+export interface OAuthLoginInteraction {
+    /** Open or display the URL. Never send the verifier or returned tokens. */
+    authorize(url: string): void | Promise<void>;
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+/** Authorization Code + S256 PKCE for a public native client. The listener
+ * binds only a loopback IP, verifies state/issuer, and closes on every path. */
+export declare function oauthBrowserLogin(config: OAuthLoginConfig, interaction: OAuthLoginInteraction): Promise<OAuthLoginSession>;
+//# sourceMappingURL=oauth-login.d.ts.map

package/dist/oauth-login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-login.d.ts","sourceRoot":"","sources":["../src/oauth-login.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,YAAY,CAAC,EAAE;QAAE,SAAS,EAAE,cAAc,GAAG,iBAAiB,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,2EAA2E;IAC3E,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAgDD;gFACgF;AAChF,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,EAAE,WAAW,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAgGhI"}

package/dist/oauth-login.js

@@ -0,0 +1,171 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createServer } from "node:http";
+import { oauthJsonRequest, OAuthResponseError } from "./oauth-request.js";
+function endpoint(value) {
+    const url = new URL(value);
+    const loopback = ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname);
+    if ((url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) || url.username || url.password || url.hash) {
+        throw new Error("OAuth endpoints require HTTPS without credentials or fragments; loopback HTTP is allowed for development.");
+    }
+    return url;
+}
+async function metadata(config, signal) {
+    const issuer = endpoint(config.issuer);
+    if (issuer.search)
+        throw new Error("The OAuth issuer must not contain a query.");
+    const path = issuer.pathname.replace(/\/$/, "");
+    const urls = config.discoveryUrl ? [config.discoveryUrl] : [
+        issuer.origin + "/.well-known/oauth-authorization-server" + path,
+        issuer.origin + path + "/.well-known/openid-configuration",
+    ];
+    for (const url of urls) {
+        let response;
+        try {
+            response = await oauthJsonRequest(endpoint(url), { headers: { Accept: "application/json" }, signal }, 10_000);
+        }
+        catch (error) {
+            if (!signal.aborted && error instanceof OAuthResponseError && error.code === "request_failed")
+                continue;
+            throw error;
+        }
+        if (response.status !== 200)
+            continue;
+        const data = response.data;
+        if (data.issuer !== config.issuer)
+            throw new Error("OAuth discovery returned a different issuer. Check the issuer and discovery URL.");
+        if (Array.isArray(data.code_challenge_methods_supported) && !data.code_challenge_methods_supported.includes("S256")) {
+            throw new Error("The provider does not advertise S256 PKCE support.");
+        }
+        const authorizationUrl = config.authorizationUrl ?? data.authorization_endpoint;
+        const tokenUrl = config.tokenUrl ?? data.token_endpoint;
+        if (typeof authorizationUrl !== "string" || typeof tokenUrl !== "string")
+            throw new Error("Browser login requires authorization and token endpoints.");
+        return {
+            authorizationUrl: endpoint(authorizationUrl), tokenUrl: endpoint(tokenUrl).href,
+            ...(typeof data.revocation_endpoint === "string" ? { revocationUrl: endpoint(data.revocation_endpoint).href } : {}),
+        };
+    }
+    // Some custom providers publish no metadata. Their explicit endpoints are
+    // owner configuration, not endpoints accepted from an unverified document.
+    if (config.authorizationUrl && config.tokenUrl)
+        return {
+            authorizationUrl: endpoint(config.authorizationUrl), tokenUrl: endpoint(config.tokenUrl).href,
+        };
+    throw new Error("Could not discover OAuth endpoints. Check the issuer or provide explicit authorization and token URLs.");
+}
+/** Authorization Code + S256 PKCE for a public native client. The listener
+ * binds only a loopback IP, verifies state/issuer, and closes on every path. */
+export async function oauthBrowserLogin(config, interaction) {
+    if (!config.clientId.trim())
+        throw new Error("Browser login requires a public client ID.");
+    if (config.organization && (!["organization", "organization_id"].includes(config.organization.parameter) || typeof config.organization.id !== "string" || !config.organization.id || config.organization.id.length > 512 || /\s|[\u0000-\u001F\u007F]/.test(config.organization.id)))
+        throw new Error("Organization selection requires a supported parameter and a nonempty organization ID without whitespace.");
+    const signal = AbortSignal.any([interaction.signal ?? new AbortController().signal, AbortSignal.timeout(interaction.timeoutMs ?? 600_000)]);
+    signal.throwIfAborted();
+    const endpoints = await metadata(config, signal);
+    const redirect = new URL(config.redirectUri ?? "http://127.0.0.1/callback");
+    if (redirect.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(redirect.hostname) || redirect.username || redirect.password || redirect.search || redirect.hash) {
+        throw new Error("The OAuth redirect must be an HTTP loopback IP URL without credentials, query, or fragment.");
+    }
+    const verifier = randomBytes(32).toString("base64url");
+    const state = randomBytes(32).toString("base64url");
+    const challenge = createHash("sha256").update(verifier).digest("base64url");
+    let resolveCode;
+    let rejectCode;
+    const codeResult = new Promise((resolve, reject) => { resolveCode = resolve; rejectCode = reject; });
+    // Observe rejection even if opening the browser or starting the server fails.
+    void codeResult.catch(() => undefined);
+    let accepted = false;
+    const server = createServer((request, response) => {
+        response.setHeader("Content-Type", "text/plain; charset=utf-8");
+        response.setHeader("Cache-Control", "no-store");
+        response.setHeader("Referrer-Policy", "no-referrer");
+        response.setHeader("Content-Security-Policy", "default-src 'none'");
+        let incoming;
+        try {
+            incoming = new URL(request.url ?? "/", redirect.origin);
+        }
+        catch {
+            response.writeHead(400).end("Invalid callback URL.");
+            return;
+        }
+        if (accepted || request.method !== "GET" || request.headers.host !== redirect.host || incoming.pathname !== redirect.pathname) {
+            response.writeHead(404).end("Not found.");
+            return;
+        }
+        const returnedState = Buffer.from(incoming.searchParams.get("state") ?? "");
+        const expectedState = Buffer.from(state);
+        if (incoming.searchParams.getAll("state").length !== 1 || returnedState.length !== expectedState.length || !timingSafeEqual(returnedState, expectedState)) {
+            response.writeHead(400).end("Invalid login state. Return to the terminal and try again.");
+            return;
+        }
+        const returnedIssuer = incoming.searchParams.get("iss");
+        if (returnedIssuer !== null && (incoming.searchParams.getAll("iss").length !== 1 || returnedIssuer !== config.issuer)) {
+            response.writeHead(400).end("The login issuer did not match.");
+            return;
+        }
+        accepted = true;
+        if (incoming.searchParams.has("error")) {
+            response.writeHead(400).end("Login was not approved. Return to the terminal.", () => rejectCode(new Error("OAuth authorization was denied or cancelled. Run login again to retry.")));
+            return;
+        }
+        const code = incoming.searchParams.get("code");
+        if (!code || incoming.searchParams.getAll("code").length !== 1) {
+            response.writeHead(400).end("The provider returned no authorization code.", () => rejectCode(new Error("OAuth callback did not contain one authorization code.")));
+            return;
+        }
+        response.end("Authorization received. Return to the terminal to finish signing in.", () => resolveCode(code));
+    });
+    server.headersTimeout = 10_000;
+    server.requestTimeout = 10_000;
+    const aborted = () => rejectCode(new Error("Browser login timed out or was cancelled. Run login again to retry."));
+    signal.addEventListener("abort", aborted, { once: true });
+    try {
+        await new Promise((resolve, reject) => {
+            server.once("error", reject);
+            server.listen(Number(redirect.port) || 0, redirect.hostname === "[::1]" ? "::1" : "127.0.0.1", () => { server.off("error", reject); resolve(); });
+        });
+        const address = server.address();
+        if (!address || typeof address === "string")
+            throw new Error("Could not start the OAuth callback listener.");
+        redirect.port = String(address.port);
+        signal.throwIfAborted();
+        const authorization = new URL(endpoints.authorizationUrl);
+        if (config.organization) {
+            const other = config.organization.parameter === "organization" ? "organization_id" : "organization";
+            if (authorization.searchParams.has(other))
+                throw new Error("The authorization URL contains a conflicting organization parameter. Update the provider configuration.");
+            authorization.searchParams.set(config.organization.parameter, config.organization.id);
+        }
+        for (const [key, value] of Object.entries({ response_type: "code", client_id: config.clientId, redirect_uri: redirect.href, state, code_challenge: challenge, code_challenge_method: "S256", ...(config.scopes?.length ? { scope: config.scopes.join(" ") } : {}), ...(config.audience ? { audience: config.audience } : {}), ...(config.resource ? { resource: config.resource } : {}) }))
+            authorization.searchParams.set(key, value);
+        await interaction.authorize(authorization.href);
+        const code = await codeResult;
+        signal.throwIfAborted();
+        const response = await oauthJsonRequest(endpoints.tokenUrl, {
+            method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json" }, redirect: "error",
+            body: new URLSearchParams({ grant_type: "authorization_code", client_id: config.clientId, redirect_uri: redirect.href, code, code_verifier: verifier, ...(config.audience ? { audience: config.audience } : {}), ...(config.resource ? { resource: config.resource } : {}) }),
+            signal,
+        });
+        const data = response.data;
+        if (response.status !== 200 || !data || typeof data.access_token !== "string" || !data.access_token || typeof data.token_type !== "string" || data.token_type.toLowerCase() !== "bearer") {
+            throw new Error(`OAuth token exchange failed (HTTP ${response.status}). Check the public client registration and run login again.`);
+        }
+        if (data.expires_in !== undefined && (typeof data.expires_in !== "number" || !Number.isFinite(data.expires_in) || data.expires_in <= 0))
+            throw new Error("OAuth provider returned an invalid token lifetime.");
+        return {
+            accessToken: data.access_token,
+            ...(typeof data.refresh_token === "string" && data.refresh_token ? { refreshToken: data.refresh_token } : {}),
+            ...(typeof data.expires_in === "number" ? { expiresAt: Date.now() + data.expires_in * 1000 } : {}),
+            issuer: config.issuer, clientId: config.clientId, tokenUrl: endpoints.tokenUrl, redirectUri: redirect.href,
+            ...(endpoints.revocationUrl ? { revocationUrl: endpoints.revocationUrl } : {}),
+            ...(typeof data.scope === "string" ? { scopes: data.scope.split(/\s+/).filter(Boolean) } : {}),
+        };
+    }
+    finally {
+        signal.removeEventListener("abort", aborted);
+        server.closeAllConnections();
+        if (server.listening)
+            await new Promise((resolve) => server.close(() => resolve()));
+    }
+}