@typeship-ax/mcp 0.21.0 → 0.22.0

package/src/index.ts

@@ -1,5 +1,5 @@
-// typeship — client entry point.
-// Generated by typeship — https://typeship.dev
+// Typeship — client entry point.
+// Generated by Typeship — https://typeship.dev
 
 import {
   HttpCore,
@@ -10,34 +10,33 @@ import {
   type RequestContext,
   bearerAuth,
 } from "./core/http.js";
-import { DEFS, SCHEMAS } from "./schemas.js";
 
-import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
 import { SpecsResource } from "./resources/specs.js";
 import { SpecRevisionsResource } from "./resources/spec-revisions.js";
 import { TargetsResource } from "./resources/targets.js";
-import { DraftsResource } from "./resources/drafts.js";
-import { ReleasesResource } from "./resources/releases.js";
 import { DeliveriesResource } from "./resources/deliveries.js";
-import { PublicationsResource } from "./resources/publications.js";
 import { GenerationsResource } from "./resources/generations.js";
+import { DraftsResource } from "./resources/drafts.js";
+import { ReleasesResource } from "./resources/releases.js";
 import { FilesResource } from "./resources/files.js";
+import { PackagesResource } from "./resources/packages.js";
 import { OrganizationResource } from "./resources/organization.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 
 /** This package's version, also sent as the `User-Agent`. */
-export const VERSION = "0.21.0";
-const USER_AGENT = "@typeship-ax/mcp/0.21.0";
+export const VERSION = "0.22.0";
+const USER_AGENT = "@typeship-ax/mcp/0.22.0";
 
 export interface ClientOptions {
   /** Override the server URL. Default: `https://typeship.dev/api/v1` */
   baseUrl?: string;
   /**
    * Sent as `Authorization: Bearer <token>`. Pass a callback for tokens that expire; it is resolved
-   * before every attempt.
+   * before every attempt, and after a 401 it is called once more with `{ rejected: true }` so it
+   * can refresh instead of returning the rejected token.
    */
-  bearerToken?: string | (() => string | Promise<string>);
+  bearerToken?: AuthValue;
   /**
    * Credentials keyed by the Spec's security scheme names. Only one complete alternative is sent
    * for each operation. Named values take precedence over convenience options.
@@ -45,10 +44,15 @@ export interface ClientOptions {
   credentials?: {
     "apiKey"?: AuthValue;
   };
-  /** Per-attempt timeout in milliseconds. Default: 30000. */
+  /** Per-attempt timeout in milliseconds. Default: 60000. */
   timeoutMs?: number;
   /** Retries after the first attempt (retryable failures only). Default: 2. */
   maxRetries?: number;
+  /**
+   * The longest wait a server may request (Retry-After, x-ratelimit-reset) that a retry honors; a
+   * longer one fails the call with the reset time. Default: 60000.
+   */
+  maxRetryWaitMs?: number;
   /** Custom fetch implementation (proxies, testing, instrumentation). */
   fetch?: typeof fetch;
   /** Headers sent with every request. */
@@ -83,7 +87,7 @@ export interface ClientOptions {
 }
 
 /**
- * typeship — v0.21.0
+ * Typeship — v0.22.0
  *
  * Resolve an OpenAPI or GraphQL Spec, diagnose it, and keep every
  * selected CLI, MCP, and SDK Target current.
@@ -100,21 +104,22 @@ export interface ClientOptions {
  * petstore Spec is a runnable sample.
  */
 export class TypeshipClient {
-  readonly generate: GenerateResource;
   readonly projects: ProjectsResource;
   readonly specs: SpecsResource;
   readonly specRevisions: SpecRevisionsResource;
   readonly targets: TargetsResource;
-  readonly drafts: DraftsResource;
-  readonly releases: ReleasesResource;
   readonly deliveries: DeliveriesResource;
-  readonly publications: PublicationsResource;
   readonly generations: GenerationsResource;
+  readonly drafts: DraftsResource;
+  readonly releases: ReleasesResource;
   readonly files: FilesResource;
+  readonly packages: PackagesResource;
   readonly organization: OrganizationResource;
   readonly apiKeys: ApiKeysResource;
+  private readonly _options: ClientOptions;
 
   constructor(options: ClientOptions = {}) {
+    this._options = options;
     // Identifies this package to the API (ignored by browsers, which
     // control their own User-Agent); override via defaultHeaders.
     const headers: Record<string, AuthValue> = { "User-Agent": USER_AGENT, ...options.defaultHeaders };
@@ -157,30 +162,42 @@ export class TypeshipClient {
       query,
       credentials,
       fetch: options.fetch ?? fetch,
-      timeoutMs: options.timeoutMs ?? 30_000,
+      timeoutMs: options.timeoutMs ?? 60_000,
       maxRetries: options.maxRetries ?? 2,
+      maxRetryWaitMs: options.maxRetryWaitMs,
       onRequest: options.onRequest,
       onResponse: options.onResponse,
       onError: options.onError,
       debug,
       validate,
-      schemas: validate ? SCHEMAS : undefined,
-      schemaDefs: validate ? DEFS : undefined,
+      // Loaded on the first validated request, so the schema table costs
+      // nothing when validation is off.
+      loadSchemas: validate ? () => import("./schemas.js") : undefined,
     });
-    this.generate = new GenerateResource(core);
     this.projects = new ProjectsResource(core);
     this.specs = new SpecsResource(core);
     this.specRevisions = new SpecRevisionsResource(core);
     this.targets = new TargetsResource(core);
-    this.drafts = new DraftsResource(core);
-    this.releases = new ReleasesResource(core);
     this.deliveries = new DeliveriesResource(core);
-    this.publications = new PublicationsResource(core);
     this.generations = new GenerationsResource(core);
+    this.drafts = new DraftsResource(core);
+    this.releases = new ReleasesResource(core);
     this.files = new FilesResource(core);
+    this.packages = new PackagesResource(core);
     this.organization = new OrganizationResource(core);
     this.apiKeys = new ApiKeysResource(core);
   }
+
+  /**
+   * A client with this client's configuration and only these credentials,
+   * for a server acting on behalf of many users. Nothing is inherited from
+   * this client's credentials. The copy shares the configured fetch.
+   */
+  withCredentials(credentials: Pick<ClientOptions, "bearerToken" | "credentials">): TypeshipClient {
+    const options: Record<string, unknown> = { ...this._options };
+    for (const key of ["bearerToken","credentials"]) delete options[key];
+    return new TypeshipClient({ ...options, ...credentials } as ClientOptions);
+  }
 }
 
 export * from "./types.js";
@@ -188,6 +205,7 @@ export * from "./errors.js";
 export {
   formatDebugEvent,
   type AuthValue,
+  type CredentialContext,
   type DebugEvent,
   type RequestContext,
   type RequestOptions,
@@ -195,16 +213,15 @@ export {
 } from "./core/http.js";
 export { Page, PagePromise } from "./core/pagination.js";
 
-export * from "./resources/generate.js";
 export * from "./resources/projects.js";
 export * from "./resources/specs.js";
 export * from "./resources/spec-revisions.js";
 export * from "./resources/targets.js";
-export * from "./resources/drafts.js";
-export * from "./resources/releases.js";
 export * from "./resources/deliveries.js";
-export * from "./resources/publications.js";
 export * from "./resources/generations.js";
+export * from "./resources/drafts.js";
+export * from "./resources/releases.js";
 export * from "./resources/files.js";
+export * from "./resources/packages.js";
 export * from "./resources/organization.js";
 export * from "./resources/api-keys.js";

package/src/mcp-authorization.ts

@@ -77,17 +77,35 @@ function decode(value: string): Record<string, unknown> {
 
 interface SigningKey { kty?: string; kid?: string; alg?: string; use?: string; key_ops?: string[]; n?: string; e?: string; crv?: string; x?: string; y?: string; d?: string; k?: string }
 
-function principalFor(claims: Record<string, unknown>, configuration: McpAuthorizationConfiguration): McpPrincipal {
+/** Providers name granted scopes in `scope` (RFC 8693/9068, a space-separated
+ * string) or `scp` (Okta and Entra: a string or an array of strings). */
+function grantedScopes(claims: Record<string, unknown>): string[] {
+  const scopes: string[] = [];
+  if (claims.scope !== undefined) {
+    if (typeof claims.scope !== "string" || claims.scope.length > 10_000) throw invalid();
+    scopes.push(...claims.scope.split(" ").filter(Boolean));
+  }
+  if (claims.scp !== undefined) {
+    if (typeof claims.scp === "string") {
+      if (claims.scp.length > 10_000) throw invalid();
+      scopes.push(...claims.scp.split(" ").filter(Boolean));
+    } else if (Array.isArray(claims.scp) && claims.scp.length <= 100 && claims.scp.every(s => typeof s === "string" && s.length > 0 && s.length <= 500)) {
+      scopes.push(...claims.scp as string[]);
+    } else throw invalid();
+  }
+  if (scopes.some(s => !scopePattern.test(s))) throw invalid();
+  return scopes;
+}
+
+function principalFor(claims: Record<string, unknown>, configuration: McpAuthorizationConfiguration, audience: unknown = claims.aud): McpPrincipal {
   const now = Date.now() / 1000;
-  const audiences = typeof claims.aud === "string" ? [claims.aud] : claims.aud;
+  const audiences = typeof audience === "string" ? [audience] : audience;
   if (claims.cnf !== undefined || claims.iss !== configuration.issuer || typeof claims.sub !== "string" || !claims.sub || claims.sub.length > 1000 ||
     !Array.isArray(audiences) || !audiences.every(a => typeof a === "string") || !audiences.includes(configuration.resource) ||
     typeof claims.exp !== "number" || !Number.isFinite(claims.exp) || claims.exp <= now ||
     (claims.nbf !== undefined && (typeof claims.nbf !== "number" || !Number.isFinite(claims.nbf) || claims.nbf > now)) ||
-    (claims.iat !== undefined && (typeof claims.iat !== "number" || !Number.isFinite(claims.iat) || claims.iat > now + 60)) ||
-    (claims.scope !== undefined && (typeof claims.scope !== "string" || claims.scope.length > 10_000))) throw invalid();
-  const scopes = typeof claims.scope === "string" ? claims.scope.split(" ").filter(Boolean) : [];
-  if (scopes.some(s => !scopePattern.test(s))) throw invalid();
+    (claims.iat !== undefined && (typeof claims.iat !== "number" || !Number.isFinite(claims.iat) || claims.iat > now + 60))) throw invalid();
+  const scopes = grantedScopes(claims);
   if (configuration.scopes!.some(s => !scopes.includes(s))) throw new McpAuthorizationError(403, "insufficient_scope");
   return Object.freeze({ issuer: configuration.issuer, subject: claims.sub, resource: configuration.resource, scopes: Object.freeze([...new Set(scopes)]), claims: Object.freeze(claims) });
 }
@@ -113,11 +131,13 @@ function introspector(input: McpTokenIntrospectionConfiguration, configuration:
     if (!data || typeof data.active !== "boolean") throw unavailable();
     if (!data.active || (data.token_type !== undefined && (typeof data.token_type !== "string" || data.token_type.toLowerCase() !== "bearer"))) throw invalid();
     // RFC 7662 permits omitted issuer: the owner-pinned authenticated endpoint
-    // establishes it. Audience, subject and expiry are mandatory for this handler.
-    // Never substitute client_id for the MCP resource audience.
+    // establishes it. Subject and expiry are mandatory for this handler. The
+    // audience is `aud`; a provider that omits it must name the exact MCP
+    // resource in `resource` instead. Never substitute client_id for it.
     const claims = { ...data, iss: data.iss === undefined ? configuration.issuer : data.iss };
     for (const key of ["token", "access_token", "refresh_token", "id_token", "client_secret"]) delete (claims as Record<string, unknown>)[key];
-    return principalFor(claims, configuration);
+    const audience = data.aud === undefined ? data.resource : data.aud;
+    return principalFor(claims, configuration, audience);
   };
 }