@typeship-ax/cli 0.8.0 → 0.10.0

package/dist/credential-storage.js

@@ -0,0 +1,207 @@
+import { spawnSync } from "node:child_process";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { FileCredentialStore, CredentialStorageError } from "./oauth-session.js";
+const nativeCommand = (executable, args, input) => {
+    const result = spawnSync(executable, args, { input, encoding: "utf8", timeout: 15_000, maxBuffer: 64 * 1024, windowsHide: true, shell: false });
+    return { status: result.status, stdout: result.stdout ?? "", stderr: result.stderr ?? "", ...(result.error ? { error: result.error } : {}) };
+};
+function unavailable(name, environmentName) {
+    throw new CredentialStorageError("Cannot access " + name + ". Unlock or enable your OS credential store and retry. For a headless session, supply credentials through environment variables. Plaintext storage requires explicitly setting " + environmentName + "=file.");
+}
+function parseKey(value) {
+    const encoded = value.trim();
+    if (!/^[A-Za-z0-9+/]{43}=$/.test(encoded))
+        throw new CredentialStorageError("The OS credential key is invalid. Restore access to the original key before using the saved session.");
+    const key = Buffer.from(encoded, "base64");
+    if (key.length !== 32)
+        throw new CredentialStorageError("The OS credential key is invalid.");
+    return key;
+}
+/** A small wrapping key avoids OS item-size limits; session files are encrypted
+ * separately so refresh rotation can retain the atomic file/lock transaction. */
+export function nativeCredentialKeyStore(path, platform = process.platform, run = nativeCommand, environmentName = "CREDENTIAL_STORE") {
+    const failed = (name) => unavailable(name, environmentName);
+    const identity = createHash("sha256").update(resolve(path)).digest("hex");
+    const service = "typeship.credentials." + identity;
+    const account = "session-key";
+    if (platform === "darwin") {
+        const name = "macOS Keychain";
+        const lookup = () => run("/usr/bin/security", ["find-generic-password", "-s", service, "-a", account, "-w"]);
+        return {
+            name,
+            read() {
+                const result = lookup();
+                if (!result.error && result.status === 44)
+                    return null; // errSecItemNotFound
+                if (result.error || result.status !== 0)
+                    return failed(name);
+                return parseKey(result.stdout);
+            },
+            write(key) {
+                // security's interactive command stream keeps the key off argv. All
+                // tokens below have a fixed safe alphabet; no shell or user text is run.
+                const input = "add-generic-password -U -s " + service + " -a " + account + " -w " + key.toString("base64") + "\n";
+                const result = run("/usr/bin/security", ["-i"], input);
+                if (result.error || result.status !== 0)
+                    return failed(name);
+                // Verify the write: an interactive tool's process status alone is not
+                // sufficient evidence that its command stored the requested item.
+                const saved = this.read();
+                if (!saved || !timingSafeEqual(saved, key))
+                    return failed(name);
+            },
+            remove() {
+                const result = run("/usr/bin/security", ["delete-generic-password", "-s", service, "-a", account]);
+                if (result.error || (result.status !== 0 && result.status !== 44))
+                    failed(name);
+            },
+        };
+    }
+    if (platform === "linux") {
+        const name = "Linux Secret Service (secret-tool)";
+        const attributes = ["service", service, "account", account];
+        return {
+            name,
+            read() {
+                const result = run("/usr/bin/secret-tool", ["lookup", ...attributes]);
+                if (!result.error && result.status === 1 && !result.stderr.trim())
+                    return null;
+                if (result.error || result.status !== 0)
+                    return failed(name);
+                return parseKey(result.stdout);
+            },
+            write(key) {
+                const result = run("/usr/bin/secret-tool", ["store", "--label=CLI session encryption key", ...attributes], key.toString("base64"));
+                if (result.error || result.status !== 0)
+                    return failed(name);
+                const saved = this.read();
+                if (!saved || !timingSafeEqual(saved, key))
+                    return failed(name);
+            },
+            remove() {
+                const result = run("/usr/bin/secret-tool", ["clear", ...attributes]);
+                if (result.error || result.status !== 0)
+                    failed(name);
+            },
+        };
+    }
+    if (platform === "win32") {
+        const name = "Windows DPAPI (current user)";
+        const keyPath = path + ".key";
+        const executable = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
+        const script = `
+$ErrorActionPreference = 'Stop'
+try {
+  Add-Type -AssemblyName System.Security
+  $payload = [Console]::In.ReadToEnd() | ConvertFrom-Json
+  $bytes = [Convert]::FromBase64String([string]$payload.data)
+  $entropy = [Text.Encoding]::UTF8.GetBytes([string]$payload.service)
+  $scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser
+  if ($payload.action -eq 'protect') { $result = [System.Security.Cryptography.ProtectedData]::Protect($bytes, $entropy, $scope) }
+  elseif ($payload.action -eq 'unprotect') { $result = [System.Security.Cryptography.ProtectedData]::Unprotect($bytes, $entropy, $scope) }
+  else { exit 1 }
+  [Console]::Out.Write([Convert]::ToBase64String($result))
+  exit 0
+} catch { exit 1 }
+`;
+        const crypt = (action, data) => {
+            // EncodedCommand contains fixed code only. Sensitive data goes over stdin.
+            const result = run(executable, ["-NoProfile", "-NonInteractive", "-EncodedCommand", Buffer.from(script, "utf16le").toString("base64")], JSON.stringify({ action, data, service }));
+            if (result.error || result.status !== 0 || !result.stdout.trim())
+                return failed(name);
+            return result.stdout.trim();
+        };
+        return {
+            name,
+            read() {
+                let wrapped;
+                try {
+                    wrapped = readFileSync(keyPath, "utf8");
+                }
+                catch (error) {
+                    if (error.code === "ENOENT")
+                        return null;
+                    return failed(name);
+                }
+                return parseKey(crypt("unprotect", wrapped));
+            },
+            write(key) {
+                const wrapped = crypt("protect", key.toString("base64"));
+                const temporary = keyPath + "." + randomBytes(16).toString("hex") + ".tmp";
+                try {
+                    writeFileSync(temporary, wrapped, { mode: 0o600, flag: "wx", flush: true });
+                    renameSync(temporary, keyPath);
+                }
+                finally {
+                    rmSync(temporary, { force: true });
+                }
+                const saved = this.read();
+                if (!saved || !timingSafeEqual(saved, key))
+                    return failed(name);
+            },
+            remove() { rmSync(keyPath, { force: true }); },
+        };
+    }
+    return { name: "OS credential storage", read: () => failed("OS credential storage on this platform"), write: () => failed("OS credential storage on this platform"), remove: () => failed("OS credential storage on this platform") };
+}
+export function encryptedCredentialCodec(path, keyStore) {
+    const associatedData = Buffer.from("cli-credentials-v1:" + resolve(path));
+    const key = (create) => {
+        const saved = keyStore.read();
+        if (saved)
+            return saved;
+        if (!create || existsSync(path))
+            throw new CredentialStorageError("The encryption key for this saved session is missing. Restore the original OS credential store, or run logout --local to remove the saved encrypted session before logging in again.");
+        const generated = randomBytes(32);
+        keyStore.write(generated);
+        return generated;
+    };
+    return {
+        name: keyStore.name,
+        prepare() { key(true); },
+        encode(plaintext) {
+            const nonce = randomBytes(12);
+            const cipher = createCipheriv("aes-256-gcm", key(true), nonce);
+            cipher.setAAD(associatedData);
+            const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+            return JSON.stringify({ version: 1, algorithm: "aes-256-gcm", nonce: nonce.toString("base64"), tag: cipher.getAuthTag().toString("base64"), ciphertext: ciphertext.toString("base64") });
+        },
+        decode(encoded) {
+            let envelope;
+            try {
+                envelope = JSON.parse(encoded);
+            }
+            catch {
+                throw new CredentialStorageError("Saved encrypted credentials are damaged. Restore the credential file before logging in again.");
+            }
+            if (!envelope || envelope.version !== 1 || envelope.algorithm !== "aes-256-gcm" || typeof envelope.nonce !== "string" || typeof envelope.tag !== "string" || typeof envelope.ciphertext !== "string")
+                throw new CredentialStorageError("Saved encrypted credentials use an invalid format.");
+            const secret = key(false);
+            try {
+                const nonce = Buffer.from(envelope.nonce, "base64"), tag = Buffer.from(envelope.tag, "base64");
+                if (nonce.length !== 12 || tag.length !== 16)
+                    throw new Error();
+                const decipher = createDecipheriv("aes-256-gcm", secret, nonce);
+                decipher.setAAD(associatedData);
+                decipher.setAuthTag(tag);
+                return Buffer.concat([decipher.update(Buffer.from(envelope.ciphertext, "base64")), decipher.final()]).toString("utf8");
+            }
+            catch {
+                throw new CredentialStorageError("Saved credentials could not be authenticated. Restore the original credential file and OS key; do not reuse this session.");
+            }
+        },
+    };
+}
+/** OS protection is the default. Plaintext storage is an explicit, separate
+ * store for environments where the owner accepts that tradeoff. Never migrate
+ * or fall back silently when an OS service is unavailable. */
+export function createCredentialStore(directory, mode = "os", environmentName = "CREDENTIAL_STORE") {
+    if (mode === "file")
+        return new FileCredentialStore(join(directory, "credentials.json"));
+    if (mode !== "os")
+        throw new CredentialStorageError(environmentName + " must be os or file.");
+    const path = join(directory, "credentials.enc");
+    return new FileCredentialStore(path, 40_000, encryptedCredentialCodec(path, nativeCredentialKeyStore(path, process.platform, nativeCommand, environmentName)));
+}

package/dist/docs.d.ts

@@ -5,7 +5,32 @@ export declare function resolveDocsPageUrl(base: string | null, pathOrFile: stri
  * llms.txt location. Guide links may live on either the docs-site origin or
  * the index origin; no other origin is accepted. */
 export declare function resolveDocsContentUrl(base: string | null, indexUrl: string | null, pathOrFile: string): string | null;
+export interface GuideMatch {
+    title: string;
+    section: string | null;
+    /** Kept for callers that displayed the original heading-only results. */
+    heading: string;
+    excerpt: string;
+    url: string;
+}
+interface GuidePage {
+    title: string;
+    url: string;
+    description: string;
+}
+export declare function docsIndexPages(index: string | null, base: string | null, indexUrl: string | null): GuidePage[];
+/** Rank sections, then keep the strongest section of each real page. A heading
+ * match must have content: blank lines, fences, and source markers are not hits. */
+export declare function searchGuidePages(prose: string | null, index: string | null, base: string | null, indexUrl: string | null, query: string): GuideMatch[];
+export declare function searchConnectedGuides(base: string | null, indexUrl: string | null, fetchText: (path: string) => Promise<string | null>, query: string): Promise<{
+    guides: GuideMatch[];
+    status: "not_configured" | "unavailable" | "ok";
+}>;
+export declare function docsReadTarget(index: string | null, base: string | null, indexUrl: string | null, page: string): string;
+/** One shell argument, including URLs with quotes, query strings, or fragments. */
+export declare function docsReadCommand(bin: string, url: string): string;
 /** Markdown-preferred fetch with same-origin redirects, one deadline, and a
  * streaming byte cap. Returns null for every invalid or failed read. */
 export declare function fetchDocsText(url: string): Promise<string | null>;
+export {};
 //# sourceMappingURL=docs.d.ts.map

package/dist/docs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYzF;AAED;;oDAEoD;AACpD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAkBf;AAcD;wEACwE;AACxE,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCvE"}
+{"version":3,"file":"docs.d.ts","sourceRoot":"","sources":["../src/docs.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAE9E,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAYzF;AAED;;oDAEoD;AACpD,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,IAAI,CAkBf;AAcD,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,yEAAyE;IACzE,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,UAAU,SAAS;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE;AAUvE,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,CAW9G;AAUD;oFACoF;AACpF,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,GACtG,UAAU,EAAE,CAqEd;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,GAC/G,OAAO,CAAC;IAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,GAAG,aAAa,GAAG,IAAI,CAAA;CAAE,CAAC,CAIpF;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAQvH;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;wEACwE;AACxE,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyCvE"}

package/dist/docs.js

@@ -60,6 +60,150 @@ function safeHttpUrl(value) {
         return null;
     }
 }
+/** Links in an index follow URL semantics, including site-root relative links. */
+function docsLink(base, indexUrl, value) {
+    const index = resolveDocsContentUrl(base, indexUrl, "llms.txt");
+    if (!index)
+        return null;
+    try {
+        return resolveDocsContentUrl(base, indexUrl, new URL(value, index).toString());
+    }
+    catch {
+        return null;
+    }
+}
+export function docsIndexPages(index, base, indexUrl) {
+    const pages = new Map();
+    for (const line of (index ?? "").split("\n")) {
+        for (const match of line.matchAll(/\[([^\]]+)\]\(([^\s)]+)\)/g)) {
+            const url = docsLink(base, indexUrl, match[2]);
+            if (!url || /\/llms(?:-full)?\.txt(?:[?#]|$)/.test(url))
+                continue;
+            const description = line.slice(match.index + match[0].length).replace(/^\s*:\s*/, "").trim();
+            if (!pages.has(url))
+                pages.set(url, { title: match[1], url, description: cleanDocsText(description) });
+        }
+    }
+    return [...pages.values()];
+}
+function cleanDocsText(text) {
+    return text.replace(/^\s*(?:>\s*)+/, "").replace(/!?\[([^\]]+)\]\([^)]*\)/g, "$1").replace(/<[^>]*>/g, "").replace(/[*`]/g, "").replace(/^\s*[-*>]\s*/, "").replace(/\s+/g, " ").trim();
+}
+function docsTerms(query) {
+    return [...new Set(query.replace(/([a-z])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter((term) => term.length >= 2))];
+}
+/** Rank sections, then keep the strongest section of each real page. A heading
+ * match must have content: blank lines, fences, and source markers are not hits. */
+export function searchGuidePages(prose, index, base, indexUrl, query) {
+    const pages = docsIndexPages(index, base, indexUrl);
+    const terms = docsTerms(query);
+    if (terms.length === 0)
+        return [];
+    const phrase = query.trim().toLowerCase();
+    const candidates = [];
+    const add = (title, section, url, lines) => {
+        if (!url)
+            return;
+        const content = lines.map(cleanDocsText).filter((line) => line.length > 0);
+        if (content.length === 0)
+            return;
+        const heading = (title + " " + (section ?? "")).toLowerCase();
+        const body = content.join(" ").toLowerCase();
+        const matched = terms.filter((term) => heading.includes(term) || body.includes(term));
+        if (matched.length === 0)
+            return;
+        const score = matched.length * 10 + (matched.length === terms.length ? 50 : 0)
+            + (heading.includes(phrase) ? 35 : body.includes(phrase) ? 25 : 0)
+            + (title.toLowerCase().includes(phrase) ? 25 : 0)
+            + terms.filter((term) => title.toLowerCase().includes(term)).length * 5
+            + terms.filter((term) => heading.includes(term)).length * 5
+            + terms.filter((term) => section?.toLowerCase().includes(term)).length * 3;
+        const excerpt = [...content].sort((a, b) => {
+            const rank = (line) => terms.filter((term) => line.toLowerCase().includes(term)).length;
+            return rank(b) - rank(a);
+        })[0].slice(0, 240);
+        candidates.push({ match: { title, section, heading: section ?? title, excerpt, url }, score });
+    };
+    let title = "";
+    let section = null;
+    let url = null;
+    let lines = [];
+    let fence = null;
+    const flush = () => { add(title, section, url, lines); lines = []; };
+    for (const line of (prose ?? "").split("\n")) {
+        const fenced = line.trim().match(/^(`{3,}|~{3,})/);
+        if (fenced) {
+            if (fence === null)
+                fence = fenced[1][0];
+            else if (fenced[1][0] === fence)
+                fence = null;
+            continue;
+        }
+        if (fence !== null) {
+            if (line.trim())
+                lines.push(line);
+            continue;
+        }
+        const heading = line.match(/^(#{1,6})\s+(.+?)\s*#*$/);
+        if (heading) {
+            flush();
+            if (heading[1] === "#") {
+                title = cleanDocsText(heading[2]);
+                section = null;
+                const link = heading[2].match(/\[[^\]]+\]\(([^\s)]+)\)/);
+                url = link ? docsLink(base, indexUrl, link[1]) : pages.find((page) => page.title.toLowerCase() === title.toLowerCase())?.url ?? null;
+            }
+            else
+                section = cleanDocsText(heading[2]);
+            continue;
+        }
+        const source = line.match(/^Source:\s*(?:\[[^\]]*\]\()?<?(https?:\/\/[^\s)>]+)>?\)?\s*$/i);
+        if (source) {
+            url = docsLink(base, indexUrl, source[1]);
+            continue;
+        }
+        // Markdown callouts are blockquotes; keep their text for search and excerpts.
+        if (!line.trim() || /^\s*(?:---+|\|[\s:|-]+\|)\s*$/.test(line) || /^\s*</.test(line))
+            continue;
+        lines.push(line);
+    }
+    flush();
+    // An index is useful without llms-full.txt, and may include additional pages.
+    const described = new Set(candidates.map(({ match }) => match.url.replace(/\.md(?=[?#]|$)/, "")));
+    for (const page of pages) {
+        if (!described.has(page.url.replace(/\.md(?=[?#]|$)/, "")))
+            add(page.title, null, page.url, [page.description || page.title]);
+    }
+    candidates.sort((a, b) => b.score - a.score || a.match.title.localeCompare(b.match.title) || a.match.url.localeCompare(b.match.url));
+    const distinct = new Map();
+    for (const { match } of candidates) {
+        const key = match.url.replace(/\.md(?=[?#]|$)/, "");
+        if (!distinct.has(key))
+            distinct.set(key, match);
+    }
+    return [...distinct.values()];
+}
+export async function searchConnectedGuides(base, indexUrl, fetchText, query) {
+    if (!base && !indexUrl)
+        return { guides: [], status: "not_configured" };
+    const [index, prose] = await Promise.all([fetchText("llms.txt"), fetchText("llms-full.txt")]);
+    return { guides: searchGuidePages(prose, index, base, indexUrl, query), status: index === null && prose === null ? "unavailable" : "ok" };
+}
+export function docsReadTarget(index, base, indexUrl, page) {
+    if (/^https?:\/\//.test(page))
+        return page;
+    const pages = docsIndexPages(index, base, indexUrl);
+    const term = page.toLowerCase();
+    const exact = pages.find((item) => item.title.toLowerCase() === term || new URL(item.url).pathname.toLowerCase() === term);
+    if (exact)
+        return exact.url;
+    const matches = pages.filter((item) => item.url.toLowerCase().includes(term));
+    return matches.length === 1 ? matches[0].url : page;
+}
+/** One shell argument, including URLs with quotes, query strings, or fragments. */
+export function docsReadCommand(bin, url) {
+    return bin + " docs read '" + url.replace(/'/g, "'\\''") + "'";
+}
 /** Markdown-preferred fetch with same-origin redirects, one deadline, and a
  * streaming byte cap. Returns null for every invalid or failed read. */
 export async function fetchDocsText(url) {

package/dist/errors.d.ts

@@ -1,6 +1,6 @@
 import { ApiError, type ResponseMeta } from "./core/http.js";
 import type { ErrorModelRead } from "./types.js";
-export { ApiError, TransportError, UnexpectedApiError, ValidationError, type Violation, unwrap } from "./core/http.js";
+export { ApiError, ResponseParseError, TransportError, UnexpectedApiError, ValidationError, type Violation, unwrap } from "./core/http.js";
 /**
  * The request body, Definition source, target selection, or package name is invalid.
  * Raised for HTTP 400 responses.
@@ -22,6 +22,13 @@ export declare class UnauthorizedError extends ApiError<401, ErrorModelRead> {
 export declare class ForbiddenError extends ApiError<403, ErrorModelRead> {
     constructor(body: ErrorModelRead, response: ResponseMeta);
 }
+/**
+ * The key identifies changed intent.
+ * Raised for HTTP 409 responses.
+ */
+export declare class ConflictError extends ApiError<409, ErrorModelRead> {
+    constructor(body: ErrorModelRead, response: ResponseMeta);
+}
 /**
  * Spec exceeds the 10MB limit.
  * Raised for HTTP 413 responses.
@@ -37,7 +44,8 @@ export declare class UnprocessableEntityError extends ApiError<422, ErrorModelRe
     constructor(body: ErrorModelRead, response: ResponseMeta);
 }
 /**
- * Too many requests. Wait for Retry-After before retrying.
+ * Too many requests, or an identical write is still in progress. Wait for Retry-After before
+ * retrying.
  * Raised for HTTP 429 responses.
  */
 export declare class RateLimitedError extends ApiError<429, ErrorModelRead> {
@@ -58,14 +66,7 @@ export declare class PaymentRequiredError extends ApiError<402, ErrorModelRead>
     constructor(body: ErrorModelRead, response: ResponseMeta);
 }
 /**
- * The Idempotency-Key was already used with different request parameters.
- * Raised for HTTP 409 responses.
- */
-export declare class ConflictError extends ApiError<409, ErrorModelRead> {
-    constructor(body: ErrorModelRead, response: ResponseMeta);
-}
-/**
- * The original idempotent request is temporarily unavailable.
+ * Project setup failed unexpectedly; the key reservation is released.
  * Raised for HTTP 500 responses.
  */
 export declare class InternalServerError extends ApiError<500, ErrorModelRead> {
@@ -78,4 +79,11 @@ export declare class InternalServerError extends ApiError<500, ErrorModelRead> {
 export declare class NotFoundError extends ApiError<404, ErrorModelRead> {
     constructor(body: ErrorModelRead, response: ResponseMeta);
 }
+/**
+ * The Project was saved, but an obsolete release pull request could not be retired.
+ * Raised for HTTP 502 responses.
+ */
+export declare class BadGatewayError extends ApiError<502, ErrorModelRead> {
+    constructor(body: ErrorModelRead, response: ResponseMeta);
+}
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEvH;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACtD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACnD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC7D,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACrD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE3I;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACtD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACnD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC7D,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACrD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD"}

package/dist/errors.js

@@ -1,7 +1,7 @@
 // typeship — typed error classes.
 // Generated by typeship — https://typeship.dev — do not edit by hand.
 import { ApiError } from "./core/http.js";
-export { ApiError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
+export { ApiError, ResponseParseError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
 /**
  * The request body, Definition source, target selection, or package name is invalid.
  * Raised for HTTP 400 responses.
@@ -29,6 +29,15 @@ export class ForbiddenError extends ApiError {
         super("The credentials are valid but cannot act on the requested organization.", 403, body, response);
     }
 }
+/**
+ * The key identifies changed intent.
+ * Raised for HTTP 409 responses.
+ */
+export class ConflictError extends ApiError {
+    constructor(body, response) {
+        super("The key identifies changed intent.", 409, body, response);
+    }
+}
 /**
  * Spec exceeds the 10MB limit.
  * Raised for HTTP 413 responses.
@@ -48,12 +57,13 @@ export class UnprocessableEntityError extends ApiError {
     }
 }
 /**
- * Too many requests. Wait for Retry-After before retrying.
+ * Too many requests, or an identical write is still in progress. Wait for Retry-After before
+ * retrying.
  * Raised for HTTP 429 responses.
  */
 export class RateLimitedError extends ApiError {
     constructor(body, response) {
-        super("Too many requests. Wait for Retry-After before retrying.", 429, body, response);
+        super("Too many requests, or an identical write is still in progress. Wait for Retry-After before retrying.", 429, body, response);
     }
 }
 /**
@@ -75,21 +85,12 @@ export class PaymentRequiredError extends ApiError {
     }
 }
 /**
- * The Idempotency-Key was already used with different request parameters.
- * Raised for HTTP 409 responses.
- */
-export class ConflictError extends ApiError {
-    constructor(body, response) {
-        super("The Idempotency-Key was already used with different request parameters.", 409, body, response);
-    }
-}
-/**
- * The original idempotent request is temporarily unavailable.
+ * Project setup failed unexpectedly; the key reservation is released.
  * Raised for HTTP 500 responses.
  */
 export class InternalServerError extends ApiError {
     constructor(body, response) {
-        super("The original idempotent request is temporarily unavailable.", 500, body, response);
+        super("Project setup failed unexpectedly; the key reservation is released.", 500, body, response);
     }
 }
 /**
@@ -101,3 +102,12 @@ export class NotFoundError extends ApiError {
         super("No such resource in this account.", 404, body, response);
     }
 }
+/**
+ * The Project was saved, but an obsolete release pull request could not be retired.
+ * Raised for HTTP 502 responses.
+ */
+export class BadGatewayError extends ApiError {
+    constructor(body, response) {
+        super("The Project was saved, but an obsolete release pull request could not be retired.", 502, body, response);
+    }
+}

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { type DebugEvent, type RequestContext } from "./core/http.js";
+import { type AuthValue, type DebugEvent, type RequestContext } from "./core/http.js";
 import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
 import { DefinitionsResource } from "./resources/definitions.js";
@@ -8,7 +8,7 @@ import { DefinitionRevisionsResource } from "./resources/definition-revisions.js
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export declare const VERSION = "0.8.0";
+export declare const VERSION = "0.10.0";
 export interface ClientOptions {
     /** Override the server URL. Default: `https://typeship.dev/api/v1` */
     baseUrl?: string;
@@ -17,6 +17,13 @@ export interface ClientOptions {
      * before every attempt.
      */
     bearerToken?: string | (() => string | Promise<string>);
+    /**
+     * Credentials keyed by the Definition's security scheme names. Only one complete alternative is
+     * sent for each operation. Named values take precedence over convenience options.
+     */
+    credentials?: {
+        "apiKey"?: AuthValue;
+    };
     /** Per-attempt timeout in milliseconds. Default: 30000. */
     timeoutMs?: number;
     /** Retries after the first attempt (retryable failures only). Default: 2. */
@@ -62,7 +69,7 @@ export interface ClientOptions {
     };
 }
 /**
- * typeship — v0.8.0
+ * typeship — v0.10.0
  *
  * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
  * selected SDK, CLI, and MCP Target current.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA6CxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,WAAW,CAAC;AAGhC,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,SAAS,CAAC;KACtB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA8DxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -11,10 +11,10 @@ import { DefinitionRevisionsResource } from "./resources/definition-revisions.js
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export const VERSION = "0.8.0";
-const USER_AGENT = "@typeship-ax/cli/0.8.0 (typeship)";
+export const VERSION = "0.10.0";
+const USER_AGENT = "@typeship-ax/cli/0.10.0 (typeship)";
 /**
- * typeship — v0.8.0
+ * typeship — v0.10.0
  *
  * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
  * selected SDK, CLI, and MCP Target current.
@@ -47,8 +47,23 @@ export class TypeshipClient {
                 ? (event) => console.error(formatDebugEvent("typeship", event))
                 : undefined;
         const query = {};
+        const authHeaders = {};
+        const authQuery = {};
+        let bearerCredential;
         if (options.bearerToken !== undefined)
-            headers["Authorization"] = bearerAuth(options.bearerToken);
+            bearerCredential = bearerAuth(options.bearerToken);
+        const allowedCredentials = new Set(["apiKey"]);
+        for (const name of Object.keys(options.credentials ?? {})) {
+            if (!allowedCredentials.has(name))
+                throw new Error("Unknown security scheme: " + name);
+        }
+        const credentials = Object.create(null);
+        {
+            const named = options.credentials && Object.hasOwn(options.credentials, "apiKey") ? options.credentials["apiKey"] : undefined;
+            const value = named !== undefined ? bearerAuth(named) : bearerCredential;
+            if (value !== undefined)
+                credentials["apiKey"] = { headers: { ["Authorization"]: value } };
+        }
         const v = options.validate;
         const validate = v
             ? {
@@ -61,6 +76,7 @@ export class TypeshipClient {
             baseUrl: options.baseUrl ?? "https://typeship.dev/api/v1",
             headers,
             query,
+            credentials,
             fetch: options.fetch ?? fetch,
             timeoutMs: options.timeoutMs ?? 30_000,
             maxRetries: options.maxRetries ?? 2,