@typeship-ax/mcp 0.6.0 → 0.9.1

package/dist/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE5I;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAChD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAClD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC/C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACrD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACzD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACjD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;gBACpD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACrD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC9C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBACpD,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;gBAC9C,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY;CAGrD"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC7D,OAAO,KAAK,EAAc,cAAc,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,KAAK,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE3I;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,iBAAkB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACtD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,cAAe,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACnD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,wBAAyB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAC7D,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;;GAIG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACrD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACzD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,mBAAoB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACxD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,aAAc,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBAClD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD;AAED;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;gBACpD,IAAI,EAAE,cAAc,EAAE,QAAQ,EAAE,YAAY;CAGzD"}

package/dist/errors.js

@@ -1,14 +1,14 @@
 // typeship — typed error classes.
 // Generated by typeship — https://typeship.dev — do not edit by hand.
 import { ApiError } from "./core/http.js";
-export { ApiError, GraphQLRequestError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
+export { ApiError, ResponseParseError, TransportError, UnexpectedApiError, ValidationError, unwrap } from "./core/http.js";
 /**
- * The request body, specification source, output selection, or package name is invalid.
+ * The request body, Definition source, target selection, or package name is invalid.
  * Raised for HTTP 400 responses.
  */
 export class BadRequestError extends ApiError {
     constructor(body, response) {
-        super("The request body, specification source, output selection, or package name is invalid.", 400, body, response);
+        super("The request body, Definition source, target selection, or package name is invalid.", 400, body, response);
     }
 }
 /**
@@ -29,6 +29,15 @@ export class ForbiddenError extends ApiError {
         super("The credentials are valid but cannot act on the requested organization.", 403, body, response);
     }
 }
+/**
+ * The key identifies changed intent.
+ * Raised for HTTP 409 responses.
+ */
+export class ConflictError extends ApiError {
+    constructor(body, response) {
+        super("The key identifies changed intent.", 409, body, response);
+    }
+}
 /**
  * Spec exceeds the 10MB limit.
  * Raised for HTTP 413 responses.
@@ -39,21 +48,22 @@ export class PayloadTooLargeError extends ApiError {
     }
 }
 /**
- * The spec could not be understood.
+ * The Definition could not be resolved or understood.
  * Raised for HTTP 422 responses.
  */
 export class UnprocessableEntityError extends ApiError {
     constructor(body, response) {
-        super("The spec could not be understood.", 422, body, response);
+        super("The Definition could not be resolved or understood.", 422, body, response);
     }
 }
 /**
- * Too many requests. Wait for Retry-After before retrying.
+ * Too many requests, or an identical write is still in progress. Wait for Retry-After before
+ * retrying.
  * Raised for HTTP 429 responses.
  */
 export class RateLimitedError extends ApiError {
     constructor(body, response) {
-        super("Too many requests. Wait for Retry-After before retrying.", 429, body, response);
+        super("Too many requests, or an identical write is still in progress. Wait for Retry-After before retrying.", 429, body, response);
     }
 }
 /**
@@ -66,30 +76,21 @@ export class ApiResponseError extends ApiError {
     }
 }
 /**
- * The plan does not include another project or the requested output configuration.
+ * The plan does not include another project or the requested target configuration.
  * Raised for HTTP 402 responses.
  */
 export class PaymentRequiredError extends ApiError {
     constructor(body, response) {
-        super("The plan does not include another project or the requested output configuration.", 402, body, response);
+        super("The plan does not include another project or the requested target configuration.", 402, body, response);
     }
 }
 /**
- * The Idempotency-Key was already used with different request parameters.
- * Raised for HTTP 409 responses.
- */
-export class ConflictError extends ApiError {
-    constructor(body, response) {
-        super("The Idempotency-Key was already used with different request parameters.", 409, body, response);
-    }
-}
-/**
- * The original idempotent request is temporarily unavailable.
+ * Project setup failed unexpectedly; the key reservation is released.
  * Raised for HTTP 500 responses.
  */
 export class InternalServerError extends ApiError {
     constructor(body, response) {
-        super("The original idempotent request is temporarily unavailable.", 500, body, response);
+        super("Project setup failed unexpectedly; the key reservation is released.", 500, body, response);
     }
 }
 /**
@@ -101,3 +102,12 @@ export class NotFoundError extends ApiError {
         super("No such resource in this account.", 404, body, response);
     }
 }
+/**
+ * The Project was saved, but an obsolete release pull request could not be retired.
+ * Raised for HTTP 502 responses.
+ */
+export class BadGatewayError extends ApiError {
+    constructor(body, response) {
+        super("The Project was saved, but an obsolete release pull request could not be retired.", 502, body, response);
+    }
+}

package/dist/index.d.ts

@@ -1,12 +1,14 @@
-import { type DebugEvent, type RequestContext } from "./core/http.js";
+import { type AuthValue, type DebugEvent, type RequestContext } from "./core/http.js";
 import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
+import { DefinitionsResource } from "./resources/definitions.js";
+import { TargetsResource } from "./resources/targets.js";
 import { GenerationsResource } from "./resources/generations.js";
-import { SpecRevisionsResource } from "./resources/spec-revisions.js";
+import { DefinitionRevisionsResource } from "./resources/definition-revisions.js";
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export declare const VERSION = "0.6.0";
+export declare const VERSION = "0.9.1";
 export interface ClientOptions {
     /** Override the server URL. Default: `https://typeship.dev/api/v1` */
     baseUrl?: string;
@@ -15,6 +17,13 @@ export interface ClientOptions {
      * before every attempt.
      */
     bearerToken?: string | (() => string | Promise<string>);
+    /**
+     * Credentials keyed by the Definition's security scheme names. Only one complete alternative is
+     * sent for each operation. Named values take precedence over convenience options.
+     */
+    credentials?: {
+        "apiKey"?: AuthValue;
+    };
     /** Per-attempt timeout in milliseconds. Default: 30000. */
     timeoutMs?: number;
     /** Retries after the first attempt (retryable failures only). Default: 2. */
@@ -60,21 +69,25 @@ export interface ClientOptions {
     };
 }
 /**
- * typeship — v0.6.0
+ * typeship — v0.9.1
  *
- * Generate production SDKs, CLIs, and MCP servers from an OpenAPI or
- * GraphQL spec, and keep every selected output current.
+ * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
+ * selected SDK, CLI, and MCP Target current.
  *
- * Every operation but one requires an API key, created in the console and
- * sent as `Authorization: Bearer ak_...`. A browser session is not a
- * credential for this API. The exception is POST /generate, which works
- * anonymously with the free plan's limits.
+ * Every operation but one requires a bearer credential: an organization
+ * API key from the console, or an OAuth access token carrying the operation's
+ * read, generate, or write capability and the organization selected during
+ * consent. OAuth grants cannot switch organizations after consent. A browser
+ * session is not a credential for this API. The exception is POST /generate,
+ * which works anonymously with the free plan's limits.
  */
 export declare class TypeshipClient {
     readonly generate: GenerateResource;
     readonly projects: ProjectsResource;
+    readonly definitions: DefinitionsResource;
+    readonly targets: TargetsResource;
     readonly generations: GenerationsResource;
-    readonly specRevisions: SpecRevisionsResource;
+    readonly definitionRevisions: DefinitionRevisionsResource;
     readonly account: AccountResource;
     readonly apiKeys: ApiKeysResource;
     constructor(options?: ClientOptions);
@@ -85,8 +98,10 @@ export { formatDebugEvent, type ApiResult, type AuthValue, type DebugEvent, type
 export { Page, PagePromise } from "./core/pagination.js";
 export * from "./resources/generate.js";
 export * from "./resources/projects.js";
+export * from "./resources/definitions.js";
+export * from "./resources/targets.js";
 export * from "./resources/generations.js";
-export * from "./resources/spec-revisions.js";
+export * from "./resources/definition-revisions.js";
 export * from "./resources/account.js";
 export * from "./resources/api-keys.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;GAUG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA2CxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,SAAS,EAEd,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,qCAAqC,CAAC;AAClF,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,6DAA6D;AAC7D,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD;;;OAGG;IACH,WAAW,CAAC,EAAE;QACZ,QAAQ,CAAC,EAAE,SAAS,CAAC;KACtB,CAAC;IACF,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,uCAAuC;IACvC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC;;;OAGG;IACH,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9D;;;OAGG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnF;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9F;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,CAAC;IAChD;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG;QAAE,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAA;KAAE,CAAC;CAC3F;AAED;;;;;;;;;;;;GAYG;AACH,qBAAa,cAAc;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,mBAAmB,CAAC;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEtB,OAAO,GAAE,aAAkB;CA8DxC;AAED,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAEzD,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,4BAA4B,CAAC;AAC3C,cAAc,qCAAqC,CAAC;AACpD,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC"}

package/dist/index.js

@@ -4,29 +4,35 @@ import { HttpCore, formatDebugEvent, bearerAuth, } from "./core/http.js";
 import { DEFS, SCHEMAS } from "./schemas.js";
 import { GenerateResource } from "./resources/generate.js";
 import { ProjectsResource } from "./resources/projects.js";
+import { DefinitionsResource } from "./resources/definitions.js";
+import { TargetsResource } from "./resources/targets.js";
 import { GenerationsResource } from "./resources/generations.js";
-import { SpecRevisionsResource } from "./resources/spec-revisions.js";
+import { DefinitionRevisionsResource } from "./resources/definition-revisions.js";
 import { AccountResource } from "./resources/account.js";
 import { ApiKeysResource } from "./resources/api-keys.js";
 /** This package's version, also sent as the `User-Agent`. */
-export const VERSION = "0.6.0";
-const USER_AGENT = "@typeship-ax/mcp/0.6.0 (typeship)";
+export const VERSION = "0.9.1";
+const USER_AGENT = "@typeship-ax/mcp/0.9.1 (typeship)";
 /**
- * typeship — v0.6.0
+ * typeship — v0.9.1
  *
- * Generate production SDKs, CLIs, and MCP servers from an OpenAPI or
- * GraphQL spec, and keep every selected output current.
+ * Resolve an OpenAPI or GraphQL Definition, diagnose it, and keep every
+ * selected SDK, CLI, and MCP Target current.
  *
- * Every operation but one requires an API key, created in the console and
- * sent as `Authorization: Bearer ak_...`. A browser session is not a
- * credential for this API. The exception is POST /generate, which works
- * anonymously with the free plan's limits.
+ * Every operation but one requires a bearer credential: an organization
+ * API key from the console, or an OAuth access token carrying the operation's
+ * read, generate, or write capability and the organization selected during
+ * consent. OAuth grants cannot switch organizations after consent. A browser
+ * session is not a credential for this API. The exception is POST /generate,
+ * which works anonymously with the free plan's limits.
  */
 export class TypeshipClient {
     generate;
     projects;
+    definitions;
+    targets;
     generations;
-    specRevisions;
+    definitionRevisions;
     account;
     apiKeys;
     constructor(options = {}) {
@@ -41,8 +47,23 @@ export class TypeshipClient {
                 ? (event) => console.error(formatDebugEvent("typeship", event))
                 : undefined;
         const query = {};
+        const authHeaders = {};
+        const authQuery = {};
+        let bearerCredential;
         if (options.bearerToken !== undefined)
-            headers["Authorization"] = bearerAuth(options.bearerToken);
+            bearerCredential = bearerAuth(options.bearerToken);
+        const allowedCredentials = new Set(["apiKey"]);
+        for (const name of Object.keys(options.credentials ?? {})) {
+            if (!allowedCredentials.has(name))
+                throw new Error("Unknown security scheme: " + name);
+        }
+        const credentials = Object.create(null);
+        {
+            const named = options.credentials && Object.hasOwn(options.credentials, "apiKey") ? options.credentials["apiKey"] : undefined;
+            const value = named !== undefined ? bearerAuth(named) : bearerCredential;
+            if (value !== undefined)
+                credentials["apiKey"] = { headers: { ["Authorization"]: value } };
+        }
         const v = options.validate;
         const validate = v
             ? {
@@ -55,6 +76,7 @@ export class TypeshipClient {
             baseUrl: options.baseUrl ?? "https://typeship.dev/api/v1",
             headers,
             query,
+            credentials,
             fetch: options.fetch ?? fetch,
             timeoutMs: options.timeoutMs ?? 30_000,
             maxRetries: options.maxRetries ?? 2,
@@ -68,8 +90,10 @@ export class TypeshipClient {
         });
         this.generate = new GenerateResource(core);
         this.projects = new ProjectsResource(core);
+        this.definitions = new DefinitionsResource(core);
+        this.targets = new TargetsResource(core);
         this.generations = new GenerationsResource(core);
-        this.specRevisions = new SpecRevisionsResource(core);
+        this.definitionRevisions = new DefinitionRevisionsResource(core);
         this.account = new AccountResource(core);
         this.apiKeys = new ApiKeysResource(core);
     }
@@ -80,7 +104,9 @@ export { formatDebugEvent, } from "./core/http.js";
 export { Page, PagePromise } from "./core/pagination.js";
 export * from "./resources/generate.js";
 export * from "./resources/projects.js";
+export * from "./resources/definitions.js";
+export * from "./resources/targets.js";
 export * from "./resources/generations.js";
-export * from "./resources/spec-revisions.js";
+export * from "./resources/definition-revisions.js";
 export * from "./resources/account.js";
 export * from "./resources/api-keys.js";

package/dist/mcp-authorization.d.ts

@@ -0,0 +1,52 @@
+export interface McpAuthorizationConfiguration {
+    /** Exact authorization-server issuer. Never inferred from an incoming token. */
+    issuer: string;
+    /** Canonical public MCP endpoint, including its path. */
+    resource: string;
+    /** Optional public signing-key endpoint; otherwise use issuer discovery. */
+    jwksUrl?: string;
+    /** Minimum connection scopes; upstream API permissions are independent. */
+    scopes?: readonly string[];
+}
+export interface McpPrincipal {
+    readonly issuer: string;
+    readonly subject: string;
+    readonly resource: string;
+    readonly scopes: readonly string[];
+    /** Provider claims verified by signature or authenticated introspection. */
+    readonly claims: Readonly<Record<string, unknown>>;
+}
+/** Server-only credentials. Supply at runtime, never in generation config. */
+export interface McpTokenIntrospectionConfiguration {
+    /** Fixed provider endpoint authorized to receive this issuer's tokens. */
+    url: string;
+    clientId: string;
+    clientSecret: string;
+    authMethod?: "client_secret_basic" | "client_secret_post";
+    /** Entire response deadline, including the body; defaults to 10 seconds. */
+    timeoutMs?: number;
+}
+export declare class McpAuthorizationError extends Error {
+    readonly status: 401 | 403 | 503;
+    readonly code: "invalid_token" | "insufficient_scope" | "authorization_unavailable";
+    constructor(status: 401 | 403 | 503, code: "invalid_token" | "insufficient_scope" | "authorization_unavailable");
+}
+/** Validate configuration independently of any request or token claims. */
+export declare function mcpAuthorizationConfiguration(value: McpAuthorizationConfiguration): McpAuthorizationConfiguration;
+/** Resource-server validation using platform crypto or explicit introspection. The caller supplies
+ * only a token; issuer, resource, discovery and key destinations are fixed by
+ * the owner. No Authorization header is sent during discovery/key fetching.
+ * Introspection replaces JWT verification for every request: no fallback and
+ * no token-result cache, so provider revocation is checked on the next request. */
+export declare function createMcpAuthorizer(input: McpAuthorizationConfiguration, introspection?: McpTokenIntrospectionConfiguration): {
+    configuration: McpAuthorizationConfiguration;
+    metadata(): {
+        resource: string;
+        authorization_servers: string[];
+        bearer_methods_supported: string[];
+        scopes_supported: string[];
+    };
+    challenge(error?: "invalid_token" | "insufficient_scope"): string;
+    authorize(header: string | null): Promise<McpPrincipal>;
+};
+//# sourceMappingURL=mcp-authorization.d.ts.map

package/dist/mcp-authorization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-authorization.d.ts","sourceRoot":"","sources":["../src/mcp-authorization.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,6BAA6B;IAC5C,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,QAAQ,EAAE,MAAM,CAAC;IACjB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC5B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACpD;AAED,8EAA8E;AAC9E,MAAM,WAAW,kCAAkC;IACjD,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,qBAAqB,GAAG,oBAAoB,CAAC;IAC1D,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAClC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,oBAAoB,GAAG,2BAA2B;gBAA5G,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EAAW,IAAI,EAAE,eAAe,GAAG,oBAAoB,GAAG,2BAA2B;CAIlI;AAeD,2EAA2E;AAC3E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,6BAA6B,GAAG,6BAA6B,CAMjH;AA+DD;;;;mFAImF;AACnF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAa,CAAC,EAAE,kCAAkC;;;;;;;;sBA2DtG,eAAe,GAAG,oBAAoB;sBAKhC,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC;EAkBhE"}

package/dist/mcp-authorization.js

@@ -0,0 +1,232 @@
+import { oauthJsonRequest } from "./oauth-request.js";
+export class McpAuthorizationError extends Error {
+    status;
+    code;
+    constructor(status, code) {
+        super(code === "invalid_token" ? "A valid MCP access token is required." : code === "insufficient_scope" ? "The access token lacks the required MCP permissions." : "MCP authorization is unavailable. Check the server's authorization configuration.");
+        this.status = status;
+        this.code = code;
+        this.name = "McpAuthorizationError";
+    }
+}
+const invalid = () => new McpAuthorizationError(401, "invalid_token");
+const unavailable = () => new McpAuthorizationError(503, "authorization_unavailable");
+const scopePattern = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+function endpoint(value, query = false) {
+    try {
+        const url = new URL(value);
+        if (value !== value.trim() || /[\u0000-\u0020\u007F"\\]/.test(value) || url.username || url.password || url.hash || (!query && url.search) ||
+            !(url.protocol === "https:" || url.protocol === "http:" && ["127.0.0.1", "[::1]", "localhost"].includes(url.hostname)))
+            throw unavailable();
+        return value;
+    }
+    catch {
+        throw unavailable();
+    }
+}
+/** Validate configuration independently of any request or token claims. */
+export function mcpAuthorizationConfiguration(value) {
+    if (!value || typeof value.issuer !== "string" || typeof value.resource !== "string")
+        throw unavailable();
+    const issuer = endpoint(value.issuer), resource = endpoint(value.resource);
+    const scopes = value.scopes ?? [];
+    if (!Array.isArray(scopes) || scopes.length > 20 || scopes.some(s => typeof s !== "string" || s.length > 500 || !scopePattern.test(s)))
+        throw unavailable();
+    return Object.freeze({ issuer, resource, ...(value.jwksUrl ? { jwksUrl: endpoint(value.jwksUrl, true) } : {}), scopes: Object.freeze([...new Set(scopes)]) });
+}
+function bytes(value) {
+    if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1)
+        throw invalid();
+    try {
+        const decoded = Uint8Array.from(atob(value.replace(/-/g, "+").replace(/_/g, "/")), ch => ch.charCodeAt(0));
+        if (btoa(String.fromCharCode(...decoded)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_") !== value)
+            throw invalid();
+        return decoded;
+    }
+    catch {
+        throw invalid();
+    }
+}
+function object(value) { return !!value && typeof value === "object" && !Array.isArray(value); }
+function decode(value) {
+    try {
+        const parsed = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes(value)));
+        if (!object(parsed))
+            throw invalid();
+        return parsed;
+    }
+    catch {
+        throw invalid();
+    }
+}
+function principalFor(claims, configuration) {
+    const now = Date.now() / 1000;
+    const audiences = typeof claims.aud === "string" ? [claims.aud] : claims.aud;
+    if (claims.cnf !== undefined || claims.iss !== configuration.issuer || typeof claims.sub !== "string" || !claims.sub || claims.sub.length > 1000 ||
+        !Array.isArray(audiences) || !audiences.every(a => typeof a === "string") || !audiences.includes(configuration.resource) ||
+        typeof claims.exp !== "number" || !Number.isFinite(claims.exp) || claims.exp <= now ||
+        (claims.nbf !== undefined && (typeof claims.nbf !== "number" || !Number.isFinite(claims.nbf) || claims.nbf > now)) ||
+        (claims.iat !== undefined && (typeof claims.iat !== "number" || !Number.isFinite(claims.iat) || claims.iat > now + 60)) ||
+        (claims.scope !== undefined && (typeof claims.scope !== "string" || claims.scope.length > 10_000)))
+        throw invalid();
+    const scopes = typeof claims.scope === "string" ? claims.scope.split(" ").filter(Boolean) : [];
+    if (scopes.some(s => !scopePattern.test(s)))
+        throw invalid();
+    if (configuration.scopes.some(s => !scopes.includes(s)))
+        throw new McpAuthorizationError(403, "insufficient_scope");
+    return Object.freeze({ issuer: configuration.issuer, subject: claims.sub, resource: configuration.resource, scopes: Object.freeze([...new Set(scopes)]), claims: Object.freeze(claims) });
+}
+function introspector(input, configuration) {
+    const url = endpoint(input.url);
+    const method = input.authMethod ?? "client_secret_basic", timeoutMs = input.timeoutMs ?? 10_000;
+    if (!["client_secret_basic", "client_secret_post"].includes(method) || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 30_000 ||
+        [input.clientId, input.clientSecret].some(value => typeof value !== "string" || !value || value.length > 16_000 || /[\u0000-\u001F\u007F]/.test(value)))
+        throw unavailable();
+    // Snapshot secrets in a private closure. Public metadata/config never exposes them.
+    const { clientId, clientSecret } = input;
+    const form = (value) => new URLSearchParams({ v: value }).toString().slice(2);
+    const authorization = method === "client_secret_basic" ? "Basic " + btoa(form(clientId) + ":" + form(clientSecret)) : undefined;
+    return async (token) => {
+        const body = new URLSearchParams({ token, token_type_hint: "access_token" });
+        if (method === "client_secret_post") {
+            body.set("client_id", clientId);
+            body.set("client_secret", clientSecret);
+        }
+        let data;
+        try {
+            const response = await oauthJsonRequest(url, { method: "POST", headers: { "Content-Type": "application/x-www-form-urlencoded", Accept: "application/json", ...(authorization ? { Authorization: authorization } : {}) }, body }, timeoutMs);
+            if (response.status !== 200)
+                throw unavailable();
+            data = response.data;
+        }
+        catch {
+            throw unavailable();
+        }
+        if (!data || typeof data.active !== "boolean")
+            throw unavailable();
+        if (!data.active || (data.token_type !== undefined && (typeof data.token_type !== "string" || data.token_type.toLowerCase() !== "bearer")))
+            throw invalid();
+        // RFC 7662 permits omitted issuer: the owner-pinned authenticated endpoint
+        // establishes it. Audience, subject and expiry are mandatory for this handler.
+        // Never substitute client_id for the MCP resource audience.
+        const claims = { ...data, iss: data.iss === undefined ? configuration.issuer : data.iss };
+        for (const key of ["token", "access_token", "refresh_token", "id_token", "client_secret"])
+            delete claims[key];
+        return principalFor(claims, configuration);
+    };
+}
+/** Resource-server validation using platform crypto or explicit introspection. The caller supplies
+ * only a token; issuer, resource, discovery and key destinations are fixed by
+ * the owner. No Authorization header is sent during discovery/key fetching.
+ * Introspection replaces JWT verification for every request: no fallback and
+ * no token-result cache, so provider revocation is checked on the next request. */
+export function createMcpAuthorizer(input, introspection) {
+    const configuration = mcpAuthorizationConfiguration(input);
+    const introspect = introspection === undefined ? undefined : introspector(introspection, configuration);
+    const cacheMs = 300_000, retryMs = 30_000;
+    let keys = [], expiresAt = 0, lastAttempt = -Infinity;
+    let pending;
+    async function refresh() {
+        if (pending)
+            return pending;
+        if (Date.now() - lastAttempt < retryMs)
+            return;
+        lastAttempt = Date.now();
+        pending = (async () => {
+            try {
+                let jwksUrl = configuration.jwksUrl;
+                if (!jwksUrl) {
+                    const issuer = new URL(configuration.issuer), path = issuer.pathname.replace(/\/$/, "");
+                    const candidates = [...new Set([
+                            issuer.origin + "/.well-known/oauth-authorization-server" + path,
+                            issuer.origin + "/.well-known/openid-configuration" + path,
+                            issuer.origin + path + "/.well-known/openid-configuration",
+                        ])];
+                    for (const url of candidates) {
+                        const response = await oauthJsonRequest(url, {}, 10_000);
+                        if (response.status === 404)
+                            continue;
+                        if (response.status !== 200 || response.data?.issuer !== configuration.issuer || typeof response.data.jwks_uri !== "string")
+                            throw unavailable();
+                        jwksUrl = endpoint(response.data.jwks_uri, true);
+                        break;
+                    }
+                    if (!jwksUrl)
+                        throw unavailable();
+                }
+                const response = await oauthJsonRequest(jwksUrl, {}, 10_000);
+                if (response.status !== 200 || !Array.isArray(response.data?.keys) || response.data.keys.length === 0 || response.data.keys.length > 100)
+                    throw unavailable();
+                keys = response.data.keys.filter(object);
+                expiresAt = Date.now() + cacheMs;
+            }
+            catch {
+                throw unavailable();
+            }
+        })().finally(() => { pending = undefined; });
+        return pending;
+    }
+    function eligible(header) {
+        return keys.filter(key => (!header.kid || key.kid === header.kid) && (!key.alg || key.alg === header.alg) &&
+            (!key.use || key.use === "sig") && (!key.key_ops || Array.isArray(key.key_ops) && key.key_ops.includes("verify")) && !key.d && !key.k &&
+            (header.alg === "RS256" && key.kty === "RSA" || header.alg === "ES256" && key.kty === "EC" && key.crv === "P-256" || header.alg === "EdDSA" && key.kty === "OKP" && key.crv === "Ed25519"));
+    }
+    async function verifySignature(header, data, signature) {
+        const matches = eligible(header);
+        if (matches.length !== 1)
+            return false;
+        const key = matches[0];
+        try {
+            const algorithm = header.alg === "RS256" ? { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" } : header.alg === "ES256" ? { name: "ECDSA", namedCurve: "P-256", hash: "SHA-256" } : { name: "Ed25519" };
+            if (header.alg === "RS256") {
+                if (!key.n || bytes(key.n).byteLength < 256)
+                    return false;
+            }
+            const imported = await crypto.subtle.importKey("jwk", key, algorithm, false, ["verify"]);
+            if (header.alg === "RS256" && (imported.algorithm.modulusLength ?? 0) < 2048)
+                return false;
+            return await crypto.subtle.verify(algorithm, imported, signature, data);
+        }
+        catch {
+            return false;
+        }
+    }
+    return {
+        configuration,
+        metadata() { return { resource: configuration.resource, authorization_servers: [configuration.issuer], bearer_methods_supported: ["header"], scopes_supported: [...configuration.scopes] }; },
+        challenge(error) {
+            const resource = new URL(configuration.resource);
+            const metadata = resource.origin + "/.well-known/oauth-protected-resource" + resource.pathname.replace(/\/$/, "");
+            return 'Bearer resource_metadata="' + metadata + '"' + (configuration.scopes.length ? ', scope="' + configuration.scopes.join(" ") + '"' : "") + (error ? ', error="' + error + '"' : "");
+        },
+        async authorize(header) {
+            if (!header || header.length > 16_400 || !/^Bearer [A-Za-z0-9._~+/-]+=*$/i.test(header))
+                throw invalid();
+            const token = header.slice(7), parts = token.split(".");
+            if (introspect)
+                return introspect(token);
+            if (parts.length !== 3)
+                throw invalid();
+            const protectedHeader = decode(parts[0]), claims = decode(parts[1]);
+            if (!["RS256", "ES256", "EdDSA"].includes(String(protectedHeader.alg)) || protectedHeader.crit !== undefined || protectedHeader.jku !== undefined || protectedHeader.x5u !== undefined ||
+                (protectedHeader.typ !== undefined && !["at+jwt", "JWT"].includes(String(protectedHeader.typ))) ||
+                (protectedHeader.kid !== undefined && (typeof protectedHeader.kid !== "string" || !protectedHeader.kid || protectedHeader.kid.length > 200)))
+                throw invalid();
+            const signed = new TextEncoder().encode(parts[0] + "." + parts[1]), signature = bytes(parts[2]);
+            if (expiresAt <= Date.now()) {
+                await refresh();
+                if (expiresAt <= Date.now())
+                    throw unavailable();
+            }
+            let verified = await verifySignature(protectedHeader, signed, signature);
+            if (!verified && Date.now() - lastAttempt >= retryMs) {
+                await refresh();
+                verified = await verifySignature(protectedHeader, signed, signature);
+            }
+            if (!verified)
+                throw invalid();
+            // No bearer token or unverified claims cross into credential resolution.
+            return principalFor(claims, configuration);
+        },
+    };
+}