@typeship-ax/mcp 0.8.0 → 0.9.1

package/api.json

@@ -4,20 +4,50 @@
   "api_version": "1.0.0",
   "spec_format": "openapi",
   "language": "TypeScript",
+  "surface": "mcp",
+  "tool_mode": "meta",
   "operations": [
     {
       "operation": "generate.run",
-      "signature": "client.generate.run(body)",
+      "signature": "execute(generate_run, arguments)",
+      "tool": "generate_run",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "generate_run",
+          "arguments": {
+            "definition": {
+              "url": "https://example.com"
+            },
+            "target": {
+              "generator": "typescript-sdk"
+            }
+          }
+        }
+      },
       "method": "POST",
       "path": "/generate",
       "summary": "Generate one Target from a Definition",
       "description": "Stateless generation: nothing is stored. Returns the full generated\npackage as files. Works without an API key: anonymous calls generate\nthe first 25 operations, rate limited per IP address, and the\nresponse's `limits` object says what was held back and where to lift\nit; anonymous calls from a Definition URL also carry `claim.url`, a link\nthat turns the run into a project once a person signs in. With a key, the free plan generates the first 25 operations and\npaid plans generate the complete Definition. A present but invalid key is a\n401, not a downgrade to anonymous.",
       "safety": "write",
       "auth": "optional",
+      "security": [
+        {},
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
           "definition": {
             "description": "A Definition for stateless generation, provided as exactly one URL or inline entrypoint.",
             "anyOf": [
@@ -89,7 +119,7 @@
             "type": "string"
           },
           "config": {
-            "description": "Everything Typeship needs beyond the Definition, in one object: generation customization (globals, retries, pagination) and how the generated tooling behaves (cli, mcp, package, docs_url). Plain configuration. Typeship never requires vendor extensions inside the Definition itself. Stateless generation also accepts GraphQL settings here; stored projects keep those settings on their Definition.",
+            "description": "Everything Typeship needs beyond the Definition, in one object: generation customization (globals, retries, pagination, readme) and how the generated tooling behaves (cli, mcp, package, docs_url). Plain configuration. Typeship never requires vendor extensions inside the Definition itself. Stateless generation also accepts GraphQL settings here; stored projects keep those settings on their Definition.",
             "properties": {
               "globals": {
                 "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
@@ -265,40 +295,256 @@
                 "additionalProperties": false,
                 "type": "object"
               },
-              "cli": {
-                "description": "How the generated CLI behaves. Part of Config.",
+              "auth": {
+                "description": "Public authentication defaults for generated clients and tools. Stored Projects own the OAuth server, application catalog, and identity policy; stateless generation accepts the same shape for one run. Runtime credentials and client secrets are never accepted.",
                 "properties": {
-                  "command_name": {
-                    "description": "Command users run, independent of how the CLI is distributed.",
+                  "oauth_server": {
+                    "anyOf": [
+                      {
+                        "description": "Authorization-server metadata used by generated OAuth flows. Secrets and runtime credentials are never accepted here.",
+                        "properties": {
+                          "issuer": {
+                            "format": "uri",
+                            "description": "Exact authorization-server issuer, including any tenant path.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "discovery_url": {
+                            "format": "uri",
+                            "description": "Exact metadata URL when it cannot be derived from the issuer.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "authorization_url": {
+                            "format": "uri",
+                            "description": "Authorization endpoint override.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "token_url": {
+                            "format": "uri",
+                            "description": "Token endpoint override.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "device_authorization_url": {
+                            "format": "uri",
+                            "description": "Device-authorization endpoint override.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "scopes": {
+                            "description": "Default scopes requested during login.",
+                            "maxItems": 20,
+                            "type": [
+                              "array",
+                              "null"
+                            ]
+                          },
+                          "audience": {
+                            "description": "Default audience included in authorization and token requests.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          },
+                          "resource": {
+                            "format": "uri",
+                            "description": "Protected API resource included in authorization and token requests.",
+                            "type": [
+                              "string",
+                              "null"
+                            ]
+                          }
+                        },
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "oauth_applications": {
+                    "description": "OAuth applications keyed by a stable name.",
+                    "additionalProperties": {
+                      "description": "OAuth application available to generated products. Public clients support interactive login; confidential clients support runtime-supplied machine credentials. Client secrets are never stored.",
+                      "properties": {
+                        "client_id": {
+                          "description": "OAuth client identifier.",
+                          "minLength": 1,
+                          "maxLength": 200,
+                          "type": "string"
+                        },
+                        "login_method": {
+                          "enum": [
+                            "browser",
+                            "device",
+                            null
+                          ],
+                          "description": "Interactive login method. Browser login uses Authorization Code with PKCE.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "client_auth_method": {
+                          "enum": [
+                            "post",
+                            "basic",
+                            null
+                          ],
+                          "description": "How a runtime-supplied client secret is sent for machine grants.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "redirect_uri": {
+                          "format": "uri",
+                          "description": "Loopback callback URL for browser login.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "organization_parameter": {
+                          "enum": [
+                            "organization",
+                            "organization_id",
+                            null
+                          ],
+                          "description": "Provider parameter used to request an organization during browser login.",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        }
+                      },
+                      "required": [
+                        "client_id"
+                      ],
+                      "additionalProperties": false,
+                      "type": "object"
+                    },
                     "type": [
-                      "string",
+                      "object",
                       "null"
                     ]
                   },
-                  "whoami_operation": {
-                    "description": "resource.method of a zero-argument GET that the generated CLI's whoami command calls. Overrides auto-detection; a value that matches nothing is reported as a generation warning.",
+                  "oauth_application": {
+                    "description": "Default OAuth application used by generated products.",
+                    "maxLength": 64,
+                    "pattern": "^[a-z][a-z0-9_-]{0,63}$",
                     "type": [
                       "string",
                       "null"
                     ]
                   },
-                  "oauth_client_id": {
-                    "description": "OAuth client id baked into the generated CLI for device-flow login. Without it, login prompts for a pasted credential.",
+                  "identity_verification": {
+                    "anyOf": [
+                      {
+                        "description": "Authenticated identity read used to verify a login before it is saved. Operation is auto-detected when omitted. Requests must include at least one of subject_field, account_field, or organization_field.",
+                        "properties": {
+                          "operation": {
+                            "description": "resource.method of a safe identity read with no required arguments.",
+                            "maxLength": 2000,
+                            "pattern": "^[\\w$]+\\.[\\w$]+$",
+                            "type": "string"
+                          },
+                          "subject_field": {
+                            "description": "JSON Pointer to the stable caller ID in the identity response.",
+                            "maxLength": 512,
+                            "type": "string"
+                          },
+                          "account_field": {
+                            "description": "JSON Pointer to the customer account ID.",
+                            "maxLength": 512,
+                            "type": "string"
+                          },
+                          "organization_field": {
+                            "description": "JSON Pointer to the customer organization ID.",
+                            "maxLength": 512,
+                            "type": "string"
+                          }
+                        },
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ]
+                  },
+                  "approval_url": {
+                    "format": "uri",
+                    "description": "Base URL of a custom browser-approval backend implementing the start, status, and revoke contract. Used only when OAuth is not configured.",
                     "type": [
                       "string",
                       "null"
                     ]
                   },
-                  "oauth_scopes": {
-                    "description": "Scopes requested during device-flow login. Include offline_access if the authorization server gates refresh tokens behind it.",
-                    "maxItems": 20,
-                    "items": {
-                      "type": "string"
+                  "environments": {
+                    "description": "Authentication selections keyed by generated API environment name.",
+                    "additionalProperties": {
+                      "description": "OAuth application and request-value overrides for one named API environment.",
+                      "properties": {
+                        "oauth_application": {
+                          "maxLength": 64,
+                          "pattern": "^[a-z][a-z0-9_-]{0,63}$",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "scopes": {
+                          "maxItems": 20,
+                          "type": [
+                            "array",
+                            "null"
+                          ]
+                        },
+                        "audience": {
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        },
+                        "resource": {
+                          "format": "uri",
+                          "type": [
+                            "string",
+                            "null"
+                          ]
+                        }
+                      },
+                      "additionalProperties": false,
+                      "type": "object"
                     },
-                    "type": "array"
-                  },
-                  "oauth_audience": {
-                    "description": "Audience sent with the device-authorization request, for authorization servers that require one to issue API-valid access tokens.",
+                    "type": [
+                      "object",
+                      "null"
+                    ]
+                  }
+                },
+                "additionalProperties": false,
+                "type": "object"
+              },
+              "cli": {
+                "description": "How the generated CLI behaves. Part of Config.",
+                "properties": {
+                  "command_name": {
+                    "description": "Command users run, independent of how the CLI is distributed.",
                     "type": [
                       "string",
                       "null"
@@ -315,13 +561,6 @@
                       "null"
                     ]
                   },
-                  "auth_url": {
-                    "description": "Base URL of the browser-approval endpoint pair used by CLI login. The CLI keeps the verifier and receives the credential directly; no key is pasted through a conversation.",
-                    "type": [
-                      "string",
-                      "null"
-                    ]
-                  },
                   "mcp_url": {
                     "description": "Hosted MCP endpoint installed by the generated CLI instead of launching the package's local stdio server.",
                     "type": [
@@ -341,7 +580,7 @@
                 "type": "object"
               },
               "mcp": {
-                "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
                 "properties": {
                   "registry_name": {
                     "description": "Stable official MCP registry name, independent of the server runtime.",
@@ -350,6 +589,40 @@
                       "null"
                     ]
                   },
+                  "access": {
+                    "description": "Authorization for callers connecting to a generated MCP server deployed over HTTP. The hosting application resolves upstream API credentials separately at runtime. This setting does not apply to the Typeship-hosted endpoint.",
+                    "properties": {
+                      "issuer": {
+                        "format": "uri",
+                        "description": "Exact issuer allowed to sign MCP connection tokens.",
+                        "type": "string"
+                      },
+                      "resource": {
+                        "format": "uri",
+                        "description": "Canonical public URL of the self-hosted MCP endpoint that connection tokens must target.",
+                        "type": "string"
+                      },
+                      "jwks_url": {
+                        "format": "uri",
+                        "description": "Public signing-key endpoint. Omit to discover it from the issuer.",
+                        "type": "string"
+                      },
+                      "scopes": {
+                        "description": "Minimum scopes required to connect to the self-hosted MCP server.",
+                        "maxItems": 20,
+                        "items": {
+                          "type": "string"
+                        },
+                        "type": "array"
+                      }
+                    },
+                    "required": [
+                      "issuer",
+                      "resource"
+                    ],
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
                   "tool_mode": {
                     "enum": [
                       "auto",
@@ -374,6 +647,41 @@
                       "type": "string"
                     },
                     "type": "object"
+                  },
+                  "reference_resolvers": {
+                    "description": "Exact name-or-ID resolver overrides keyed first by the target operationId or \"METHOD /path\", then by its wire argument name. A resolver names one read collection operation plus 1-4 item fields to match case-insensitively; false opts that argument out of strict inference.",
+                    "additionalProperties": {
+                      "additionalProperties": {
+                        "anyOf": [
+                          {
+                            "enum": [
+                              false
+                            ],
+                            "type": "boolean"
+                          },
+                          {
+                            "type": "object"
+                          }
+                        ]
+                      },
+                      "type": "object"
+                    },
+                    "type": "object"
+                  }
+                },
+                "additionalProperties": false,
+                "type": "object"
+              },
+              "readme": {
+                "description": "Generated README behavior. Part of Config.",
+                "properties": {
+                  "quickstart_operation": {
+                    "description": "operationId or \"METHOD /path\" to feature as the README's first API call. It must be present in the generated package and callable with no required input beyond path placeholders. Missing or unsuitable choices produce a warning and use the automatic example.",
+                    "maxLength": 500,
+                    "type": [
+                      "string",
+                      "null"
+                    ]
                   }
                 },
                 "additionalProperties": false,
@@ -442,6 +750,13 @@
             },
             "additionalProperties": false,
             "type": "object"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -767,12 +1082,25 @@
     },
     {
       "operation": "projects.list",
-      "signature": "client.projects.list(params)",
+      "signature": "execute(projects_list, arguments)",
+      "tool": "projects_list",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_list",
+          "arguments": {}
+        }
+      },
       "method": "GET",
       "path": "/projects",
       "summary": "List projects",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
@@ -787,6 +1115,13 @@
           "cursor": {
             "type": "string",
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         }
       },
@@ -796,7 +1131,7 @@
           "items": {
             "type": "array",
             "items": {
-              "description": "Lean Project identity returned by collection endpoints. Retrieve the Project or list its Targets for the complete aggregate.",
+              "description": "Lean Project identity returned by collection endpoints. Retrieve the Project for shared configuration and list its Targets for the complete canonical child collection.",
               "properties": {
                 "id": {
                   "description": "Unique identifier for a project.",
@@ -857,13 +1192,40 @@
     },
     {
       "operation": "projects.create",
-      "signature": "client.projects.create(body, params)",
+      "signature": "execute(projects_create, arguments)",
+      "tool": "projects_create",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_create",
+          "arguments": {
+            "name": "example",
+            "definition": {
+              "source": {
+                "kind": "url",
+                "url": "https://example.com"
+              }
+            },
+            "targets": [
+              {
+                "name": "example",
+                "generator": "typescript-sdk"
+              }
+            ]
+          }
+        }
+      },
       "method": "POST",
       "path": "/projects",
       "summary": "Create a project",
       "description": "Stores a URL- or GitHub-sourced project. Free includes one stored project, every selected target, and the first 25 operations, while keeping manual and automatic regeneration, history, destination pull requests, and preview checks. Stateless POST /generate does not consume this slot. Pro adds projects and generates every operation in the Definition.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -873,7 +1235,7 @@
             "maxLength": 255,
             "pattern": "^[!-~]+$",
             "type": "string",
-            "description": "Uniquely identifies this creation attempt. Retrying the same request with the same key returns the original response instead of creating another project. Reusing a key with different parameters returns 409."
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
           },
           "name": {
             "minLength": 1,
@@ -1193,10 +1555,9 @@
                   "description": "Target-specific overrides merged over Project.config. GraphQL settings are rejected here and belong to the Definition.",
                   "anyOf": [
                     {
-                      "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                      "description": "Target-specific generation and delivery overrides. Authentication may only select a Project-owned OAuth application. OAuth server metadata, applications, and identity policy remain Project-owned. Self-hosted MCP access may be overridden for a Target-specific deployment.",
                       "properties": {
                         "globals": {
-                          "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
                           "maxItems": 20,
                           "type": "array"
                         },
@@ -1205,7 +1566,10 @@
                           "type": "object"
                         },
                         "pagination": {
-                          "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\". Unmatched keys are reported as generation warnings.",
+                          "type": "object"
+                        },
+                        "auth": {
+                          "description": "Selects a Project OAuth application for one Target. OAuth server metadata, applications, and identity policy remain Project-owned.",
                           "type": "object"
                         },
                         "cli": {
@@ -1213,7 +1577,11 @@
                           "type": "object"
                         },
                         "mcp": {
-                          "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                          "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
+                          "type": "object"
+                        },
+                        "readme": {
+                          "description": "Generated README behavior. Part of Config.",
                           "type": "object"
                         },
                         "package": {
@@ -1221,7 +1589,7 @@
                           "type": "object"
                         },
                         "docs_url": {
-                          "description": "The API's documentation site. Read through its llms.txt by the generated CLI's docs command, the MCP server's docs tools, and the package's AGENTS.md. Defaults to the Definition's externalDocs URL.",
+                          "format": "uri",
                           "type": [
                             "string",
                             "null"
@@ -1229,7 +1597,6 @@
                         },
                         "docs_index_url": {
                           "format": "uri",
-                          "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                           "type": [
                             "string",
                             "null"
@@ -1245,6 +1612,7 @@
                   ]
                 },
                 "deliveries": {
+                  "maxItems": 2,
                   "items": {
                     "anyOf": [
                       {
@@ -1281,7 +1649,7 @@
             "description": "Shared defaults inherited by every Target. GraphQL settings belong in definition.graphql.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, auth, readme, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
                 "properties": {
                   "globals": {
                     "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
@@ -1348,40 +1716,79 @@
                     },
                     "type": "object"
                   },
-                  "cli": {
-                    "description": "How the generated CLI behaves. Part of Config.",
+                  "auth": {
+                    "description": "Public authentication defaults for generated clients and tools. Stored Projects own the OAuth server, application catalog, and identity policy; stateless generation accepts the same shape for one run. Runtime credentials and client secrets are never accepted.",
                     "properties": {
-                      "command_name": {
-                        "description": "Command users run, independent of how the CLI is distributed.",
+                      "oauth_server": {
+                        "anyOf": [
+                          {
+                            "description": "Authorization-server metadata used by generated OAuth flows. Secrets and runtime credentials are never accepted here.",
+                            "type": "object"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ]
+                      },
+                      "oauth_applications": {
+                        "description": "OAuth applications keyed by a stable name.",
+                        "additionalProperties": {
+                          "description": "OAuth application available to generated products. Public clients support interactive login; confidential clients support runtime-supplied machine credentials. Client secrets are never stored.",
+                          "type": "object"
+                        },
                         "type": [
-                          "string",
+                          "object",
                           "null"
                         ]
                       },
-                      "whoami_operation": {
-                        "description": "resource.method of a zero-argument GET that the generated CLI's whoami command calls. Overrides auto-detection; a value that matches nothing is reported as a generation warning.",
+                      "oauth_application": {
+                        "description": "Default OAuth application used by generated products.",
+                        "maxLength": 64,
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_client_id": {
-                        "description": "OAuth client id baked into the generated CLI for device-flow login. Without it, login prompts for a pasted credential.",
+                      "identity_verification": {
+                        "anyOf": [
+                          {
+                            "description": "Authenticated identity read used to verify a login before it is saved. Operation is auto-detected when omitted. Requests must include at least one of subject_field, account_field, or organization_field.",
+                            "type": "object"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ]
+                      },
+                      "approval_url": {
+                        "format": "uri",
+                        "description": "Base URL of a custom browser-approval backend implementing the start, status, and revoke contract. Used only when OAuth is not configured.",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_scopes": {
-                        "description": "Scopes requested during device-flow login. Include offline_access if the authorization server gates refresh tokens behind it.",
-                        "maxItems": 20,
-                        "items": {
-                          "type": "string"
+                      "environments": {
+                        "description": "Authentication selections keyed by generated API environment name.",
+                        "additionalProperties": {
+                          "description": "OAuth application and request-value overrides for one named API environment.",
+                          "type": "object"
                         },
-                        "type": "array"
-                      },
-                      "oauth_audience": {
-                        "description": "Audience sent with the device-authorization request, for authorization servers that require one to issue API-valid access tokens.",
+                        "type": [
+                          "object",
+                          "null"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "cli": {
+                    "description": "How the generated CLI behaves. Part of Config.",
+                    "properties": {
+                      "command_name": {
+                        "description": "Command users run, independent of how the CLI is distributed.",
                         "type": [
                           "string",
                           "null"
@@ -1398,13 +1805,6 @@
                           "null"
                         ]
                       },
-                      "auth_url": {
-                        "description": "Base URL of the browser-approval endpoint pair used by CLI login. The CLI keeps the verifier and receives the credential directly; no key is pasted through a conversation.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
                       "mcp_url": {
                         "description": "Hosted MCP endpoint installed by the generated CLI instead of launching the package's local stdio server.",
                         "type": [
@@ -1424,7 +1824,7 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
                     "properties": {
                       "registry_name": {
                         "description": "Stable official MCP registry name, independent of the server runtime.",
@@ -1433,6 +1833,37 @@
                           "null"
                         ]
                       },
+                      "access": {
+                        "description": "Authorization for callers connecting to a generated MCP server deployed over HTTP. The hosting application resolves upstream API credentials separately at runtime. This setting does not apply to the Typeship-hosted endpoint.",
+                        "properties": {
+                          "issuer": {
+                            "format": "uri",
+                            "description": "Exact issuer allowed to sign MCP connection tokens.",
+                            "type": "string"
+                          },
+                          "resource": {
+                            "format": "uri",
+                            "description": "Canonical public URL of the self-hosted MCP endpoint that connection tokens must target.",
+                            "type": "string"
+                          },
+                          "jwks_url": {
+                            "format": "uri",
+                            "description": "Public signing-key endpoint. Omit to discover it from the issuer.",
+                            "type": "string"
+                          },
+                          "scopes": {
+                            "description": "Minimum scopes required to connect to the self-hosted MCP server.",
+                            "maxItems": 20,
+                            "type": "array"
+                          }
+                        },
+                        "required": [
+                          "issuer",
+                          "resource"
+                        ],
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
                       "tool_mode": {
                         "enum": [
                           "auto",
@@ -1457,6 +1888,28 @@
                           "type": "string"
                         },
                         "type": "object"
+                      },
+                      "reference_resolvers": {
+                        "description": "Exact name-or-ID resolver overrides keyed first by the target operationId or \"METHOD /path\", then by its wire argument name. A resolver names one read collection operation plus 1-4 item fields to match case-insensitively; false opts that argument out of strict inference.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
+                        "type": "object"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior. Part of Config.",
+                    "properties": {
+                      "quickstart_operation": {
+                        "description": "operationId or \"METHOD /path\" to feature as the README's first API call. It must be present in the generated package and callable with no required input beyond path placeholders. Missing or unsuitable choices produce a warning and use the automatic example.",
+                        "maxLength": 500,
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "additionalProperties": false,
@@ -1530,6 +1983,13 @@
                 "type": "null"
               }
             ]
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -1539,6 +1999,7 @@
         ]
       },
       "output_schema": {
+        "description": "Project-owned identity, Definition reference, generation controls, and shared configuration.",
         "properties": {
           "id": {
             "description": "Unique identifier for a project.",
@@ -1564,131 +2025,6 @@
             "pattern": "^def_[a-z0-9]{16}$",
             "type": "string"
           },
-          "targets": {
-            "description": "All configured Targets, including disabled Targets and their saved Deliveries.",
-            "items": {
-              "properties": {
-                "id": {
-                  "description": "Stable identifier for one configured generated product.",
-                  "examples": [
-                    "tgt_5m8q2v7k1p9d4h6c"
-                  ],
-                  "pattern": "^tgt_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "object": {
-                  "const": "target",
-                  "type": "string"
-                },
-                "project_id": {
-                  "description": "Unique identifier for a project.",
-                  "examples": [
-                    "prj_4f8k2m7x9q1v6b3n"
-                  ],
-                  "pattern": "^prj_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "definition_id": {
-                  "description": "Unique identifier for a project's logical API Definition.",
-                  "examples": [
-                    "def_2p8m4q7k1v9d6h3c"
-                  ],
-                  "pattern": "^def_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "name": {
-                  "type": "string"
-                },
-                "generator": {
-                  "enum": [
-                    "typescript-sdk",
-                    "python-sdk",
-                    "go-sdk",
-                    "cli",
-                    "mcp"
-                  ],
-                  "description": "Generator implementation selected by a Target.",
-                  "type": "string"
-                },
-                "state": {
-                  "enum": [
-                    "active",
-                    "disabled"
-                  ],
-                  "type": "string"
-                },
-                "edition": {
-                  "type": "string"
-                },
-                "release_channel": {
-                  "enum": [
-                    "stable",
-                    "prerelease"
-                  ],
-                  "type": "string"
-                },
-                "version_policy": {
-                  "type": "object"
-                },
-                "current_version": {
-                  "type": "string"
-                },
-                "proposed_version": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "config": {
-                  "description": "Target-specific overrides merged over Project.config.",
-                  "anyOf": [
-                    {
-                      "description": "Shared generated-client and tooling behavior for a stored Project.",
-                      "type": "object"
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ]
-                },
-                "deliveries": {
-                  "type": "array"
-                },
-                "created_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "updated_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "request_id": {
-                  "description": "Server-generated identifier used to correlate this response with Typeship logs.",
-                  "examples": [
-                    "req_3k8m1v6q9p2d7h4c"
-                  ],
-                  "pattern": "^req_[a-z0-9]{16}$",
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "deliveries": {
-            "description": "Flattened convenience view derived from the same Target bundles.",
-            "items": {
-              "anyOf": [
-                {
-                  "type": "object"
-                },
-                {
-                  "type": "object"
-                }
-              ]
-            },
-            "type": "array"
-          },
           "auto_generate": {
             "description": "Regenerate when the Definition changes: on every push to the default branch for a repository source…",
             "type": "boolean"
@@ -1716,12 +2052,20 @@
                     "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
                     "type": "object"
                   },
+                  "auth": {
+                    "description": "Public authentication defaults for generated clients and tools.",
+                    "type": "object"
+                  },
                   "cli": {
                     "description": "How the generated CLI behaves.",
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -1789,23 +2133,46 @@
     },
     {
       "operation": "projects.retrieve",
-      "signature": "client.projects.retrieve(projectId)",
+      "signature": "execute(projects_retrieve, arguments)",
+      "tool": "projects_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_retrieve",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "GET",
       "path": "/projects/{project_id}",
       "summary": "Retrieve a project",
+      "description": "Returns Project-owned fields only. List Targets separately for Target and Delivery data.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -1813,6 +2180,7 @@
         ]
       },
       "output_schema": {
+        "description": "Project-owned identity, Definition reference, generation controls, and shared configuration.",
         "properties": {
           "id": {
             "description": "Unique identifier for a project.",
@@ -1822,147 +2190,22 @@
             "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
-          "object": {
-            "const": "project",
-            "type": "string"
-          },
-          "name": {
-            "maxLength": 80,
-            "type": "string"
-          },
-          "definition_id": {
-            "description": "Unique identifier for a project's logical API Definition.",
-            "examples": [
-              "def_2p8m4q7k1v9d6h3c"
-            ],
-            "pattern": "^def_[a-z0-9]{16}$",
-            "type": "string"
-          },
-          "targets": {
-            "description": "All configured Targets, including disabled Targets and their saved Deliveries.",
-            "items": {
-              "properties": {
-                "id": {
-                  "description": "Stable identifier for one configured generated product.",
-                  "examples": [
-                    "tgt_5m8q2v7k1p9d4h6c"
-                  ],
-                  "pattern": "^tgt_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "object": {
-                  "const": "target",
-                  "type": "string"
-                },
-                "project_id": {
-                  "description": "Unique identifier for a project.",
-                  "examples": [
-                    "prj_4f8k2m7x9q1v6b3n"
-                  ],
-                  "pattern": "^prj_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "definition_id": {
-                  "description": "Unique identifier for a project's logical API Definition.",
-                  "examples": [
-                    "def_2p8m4q7k1v9d6h3c"
-                  ],
-                  "pattern": "^def_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "name": {
-                  "type": "string"
-                },
-                "generator": {
-                  "enum": [
-                    "typescript-sdk",
-                    "python-sdk",
-                    "go-sdk",
-                    "cli",
-                    "mcp"
-                  ],
-                  "description": "Generator implementation selected by a Target.",
-                  "type": "string"
-                },
-                "state": {
-                  "enum": [
-                    "active",
-                    "disabled"
-                  ],
-                  "type": "string"
-                },
-                "edition": {
-                  "type": "string"
-                },
-                "release_channel": {
-                  "enum": [
-                    "stable",
-                    "prerelease"
-                  ],
-                  "type": "string"
-                },
-                "version_policy": {
-                  "type": "object"
-                },
-                "current_version": {
-                  "type": "string"
-                },
-                "proposed_version": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "config": {
-                  "description": "Target-specific overrides merged over Project.config.",
-                  "anyOf": [
-                    {
-                      "description": "Shared generated-client and tooling behavior for a stored Project.",
-                      "type": "object"
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ]
-                },
-                "deliveries": {
-                  "type": "array"
-                },
-                "created_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "updated_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "request_id": {
-                  "description": "Server-generated identifier used to correlate this response with Typeship logs.",
-                  "examples": [
-                    "req_3k8m1v6q9p2d7h4c"
-                  ],
-                  "pattern": "^req_[a-z0-9]{16}$",
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "deliveries": {
-            "description": "Flattened convenience view derived from the same Target bundles.",
-            "items": {
-              "anyOf": [
-                {
-                  "type": "object"
-                },
-                {
-                  "type": "object"
-                }
-              ]
-            },
-            "type": "array"
-          },
+          "object": {
+            "const": "project",
+            "type": "string"
+          },
+          "name": {
+            "maxLength": 80,
+            "type": "string"
+          },
+          "definition_id": {
+            "description": "Unique identifier for a project's logical API Definition.",
+            "examples": [
+              "def_2p8m4q7k1v9d6h3c"
+            ],
+            "pattern": "^def_[a-z0-9]{16}$",
+            "type": "string"
+          },
           "auto_generate": {
             "description": "Regenerate when the Definition changes: on every push to the default branch for a repository source…",
             "type": "boolean"
@@ -1990,12 +2233,20 @@
                     "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
                     "type": "object"
                   },
+                  "auth": {
+                    "description": "Public authentication defaults for generated clients and tools.",
+                    "type": "object"
+                  },
                   "cli": {
                     "description": "How the generated CLI behaves.",
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -2051,23 +2302,46 @@
     },
     {
       "operation": "projects.delete",
-      "signature": "client.projects.delete(projectId)",
+      "signature": "execute(projects_delete, arguments)",
+      "tool": "projects_delete",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_delete",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          },
+          "confirm": true
+        }
+      },
       "method": "DELETE",
       "path": "/projects/{project_id}",
       "summary": "Delete a project",
       "safety": "destructive",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -2109,22 +2383,37 @@
     },
     {
       "operation": "projects.update",
-      "signature": "client.projects.update(projectId, body)",
+      "signature": "execute(projects_update, arguments)",
+      "tool": "projects_update",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_update",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "PATCH",
       "path": "/projects/{project_id}",
       "summary": "Update a project",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
           "name": {
@@ -2143,7 +2432,7 @@
             "description": "Replaces the Project's shared Target defaults. Send null to clear them.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, auth, readme, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
                 "properties": {
                   "globals": {
                     "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
@@ -2210,40 +2499,79 @@
                     },
                     "type": "object"
                   },
-                  "cli": {
-                    "description": "How the generated CLI behaves. Part of Config.",
+                  "auth": {
+                    "description": "Public authentication defaults for generated clients and tools. Stored Projects own the OAuth server, application catalog, and identity policy; stateless generation accepts the same shape for one run. Runtime credentials and client secrets are never accepted.",
                     "properties": {
-                      "command_name": {
-                        "description": "Command users run, independent of how the CLI is distributed.",
+                      "oauth_server": {
+                        "anyOf": [
+                          {
+                            "description": "Authorization-server metadata used by generated OAuth flows. Secrets and runtime credentials are never accepted here.",
+                            "type": "object"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ]
+                      },
+                      "oauth_applications": {
+                        "description": "OAuth applications keyed by a stable name.",
+                        "additionalProperties": {
+                          "description": "OAuth application available to generated products. Public clients support interactive login; confidential clients support runtime-supplied machine credentials. Client secrets are never stored.",
+                          "type": "object"
+                        },
                         "type": [
-                          "string",
+                          "object",
                           "null"
                         ]
                       },
-                      "whoami_operation": {
-                        "description": "resource.method of a zero-argument GET that the generated CLI's whoami command calls. Overrides auto-detection; a value that matches nothing is reported as a generation warning.",
+                      "oauth_application": {
+                        "description": "Default OAuth application used by generated products.",
+                        "maxLength": 64,
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_client_id": {
-                        "description": "OAuth client id baked into the generated CLI for device-flow login. Without it, login prompts for a pasted credential.",
+                      "identity_verification": {
+                        "anyOf": [
+                          {
+                            "description": "Authenticated identity read used to verify a login before it is saved. Operation is auto-detected when omitted. Requests must include at least one of subject_field, account_field, or organization_field.",
+                            "type": "object"
+                          },
+                          {
+                            "type": "null"
+                          }
+                        ]
+                      },
+                      "approval_url": {
+                        "format": "uri",
+                        "description": "Base URL of a custom browser-approval backend implementing the start, status, and revoke contract. Used only when OAuth is not configured.",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_scopes": {
-                        "description": "Scopes requested during device-flow login. Include offline_access if the authorization server gates refresh tokens behind it.",
-                        "maxItems": 20,
-                        "items": {
-                          "type": "string"
+                      "environments": {
+                        "description": "Authentication selections keyed by generated API environment name.",
+                        "additionalProperties": {
+                          "description": "OAuth application and request-value overrides for one named API environment.",
+                          "type": "object"
                         },
-                        "type": "array"
-                      },
-                      "oauth_audience": {
-                        "description": "Audience sent with the device-authorization request, for authorization servers that require one to issue API-valid access tokens.",
+                        "type": [
+                          "object",
+                          "null"
+                        ]
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "cli": {
+                    "description": "How the generated CLI behaves. Part of Config.",
+                    "properties": {
+                      "command_name": {
+                        "description": "Command users run, independent of how the CLI is distributed.",
                         "type": [
                           "string",
                           "null"
@@ -2260,13 +2588,6 @@
                           "null"
                         ]
                       },
-                      "auth_url": {
-                        "description": "Base URL of the browser-approval endpoint pair used by CLI login. The CLI keeps the verifier and receives the credential directly; no key is pasted through a conversation.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
                       "mcp_url": {
                         "description": "Hosted MCP endpoint installed by the generated CLI instead of launching the package's local stdio server.",
                         "type": [
@@ -2286,7 +2607,7 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
                     "properties": {
                       "registry_name": {
                         "description": "Stable official MCP registry name, independent of the server runtime.",
@@ -2295,6 +2616,37 @@
                           "null"
                         ]
                       },
+                      "access": {
+                        "description": "Authorization for callers connecting to a generated MCP server deployed over HTTP. The hosting application resolves upstream API credentials separately at runtime. This setting does not apply to the Typeship-hosted endpoint.",
+                        "properties": {
+                          "issuer": {
+                            "format": "uri",
+                            "description": "Exact issuer allowed to sign MCP connection tokens.",
+                            "type": "string"
+                          },
+                          "resource": {
+                            "format": "uri",
+                            "description": "Canonical public URL of the self-hosted MCP endpoint that connection tokens must target.",
+                            "type": "string"
+                          },
+                          "jwks_url": {
+                            "format": "uri",
+                            "description": "Public signing-key endpoint. Omit to discover it from the issuer.",
+                            "type": "string"
+                          },
+                          "scopes": {
+                            "description": "Minimum scopes required to connect to the self-hosted MCP server.",
+                            "maxItems": 20,
+                            "type": "array"
+                          }
+                        },
+                        "required": [
+                          "issuer",
+                          "resource"
+                        ],
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
                       "tool_mode": {
                         "enum": [
                           "auto",
@@ -2319,6 +2671,28 @@
                           "type": "string"
                         },
                         "type": "object"
+                      },
+                      "reference_resolvers": {
+                        "description": "Exact name-or-ID resolver overrides keyed first by the target operationId or \"METHOD /path\", then by its wire argument name. A resolver names one read collection operation plus 1-4 item fields to match case-insensitively; false opts that argument out of strict inference.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
+                        "type": "object"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior. Part of Config.",
+                    "properties": {
+                      "quickstart_operation": {
+                        "description": "operationId or \"METHOD /path\" to feature as the README's first API call. It must be present in the generated package and callable with no required input beyond path placeholders. Missing or unsuitable choices produce a warning and use the automatic example.",
+                        "maxLength": 500,
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "additionalProperties": false,
@@ -2392,6 +2766,13 @@
                 "type": "null"
               }
             ]
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -2399,6 +2780,7 @@
         ]
       },
       "output_schema": {
+        "description": "Project-owned identity, Definition reference, generation controls, and shared configuration.",
         "properties": {
           "id": {
             "description": "Unique identifier for a project.",
@@ -2412,143 +2794,18 @@
             "const": "project",
             "type": "string"
           },
-          "name": {
-            "maxLength": 80,
-            "type": "string"
-          },
-          "definition_id": {
-            "description": "Unique identifier for a project's logical API Definition.",
-            "examples": [
-              "def_2p8m4q7k1v9d6h3c"
-            ],
-            "pattern": "^def_[a-z0-9]{16}$",
-            "type": "string"
-          },
-          "targets": {
-            "description": "All configured Targets, including disabled Targets and their saved Deliveries.",
-            "items": {
-              "properties": {
-                "id": {
-                  "description": "Stable identifier for one configured generated product.",
-                  "examples": [
-                    "tgt_5m8q2v7k1p9d4h6c"
-                  ],
-                  "pattern": "^tgt_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "object": {
-                  "const": "target",
-                  "type": "string"
-                },
-                "project_id": {
-                  "description": "Unique identifier for a project.",
-                  "examples": [
-                    "prj_4f8k2m7x9q1v6b3n"
-                  ],
-                  "pattern": "^prj_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "definition_id": {
-                  "description": "Unique identifier for a project's logical API Definition.",
-                  "examples": [
-                    "def_2p8m4q7k1v9d6h3c"
-                  ],
-                  "pattern": "^def_[a-z0-9]{16}$",
-                  "type": "string"
-                },
-                "name": {
-                  "type": "string"
-                },
-                "generator": {
-                  "enum": [
-                    "typescript-sdk",
-                    "python-sdk",
-                    "go-sdk",
-                    "cli",
-                    "mcp"
-                  ],
-                  "description": "Generator implementation selected by a Target.",
-                  "type": "string"
-                },
-                "state": {
-                  "enum": [
-                    "active",
-                    "disabled"
-                  ],
-                  "type": "string"
-                },
-                "edition": {
-                  "type": "string"
-                },
-                "release_channel": {
-                  "enum": [
-                    "stable",
-                    "prerelease"
-                  ],
-                  "type": "string"
-                },
-                "version_policy": {
-                  "type": "object"
-                },
-                "current_version": {
-                  "type": "string"
-                },
-                "proposed_version": {
-                  "type": [
-                    "string",
-                    "null"
-                  ]
-                },
-                "config": {
-                  "description": "Target-specific overrides merged over Project.config.",
-                  "anyOf": [
-                    {
-                      "description": "Shared generated-client and tooling behavior for a stored Project.",
-                      "type": "object"
-                    },
-                    {
-                      "type": "null"
-                    }
-                  ]
-                },
-                "deliveries": {
-                  "type": "array"
-                },
-                "created_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "updated_at": {
-                  "format": "date-time",
-                  "type": "string"
-                },
-                "request_id": {
-                  "description": "Server-generated identifier used to correlate this response with Typeship logs.",
-                  "examples": [
-                    "req_3k8m1v6q9p2d7h4c"
-                  ],
-                  "pattern": "^req_[a-z0-9]{16}$",
-                  "type": "string"
-                }
-              },
-              "type": "object"
-            },
-            "type": "array"
-          },
-          "deliveries": {
-            "description": "Flattened convenience view derived from the same Target bundles.",
-            "items": {
-              "anyOf": [
-                {
-                  "type": "object"
-                },
-                {
-                  "type": "object"
-                }
-              ]
-            },
-            "type": "array"
-          },
+          "name": {
+            "maxLength": 80,
+            "type": "string"
+          },
+          "definition_id": {
+            "description": "Unique identifier for a project's logical API Definition.",
+            "examples": [
+              "def_2p8m4q7k1v9d6h3c"
+            ],
+            "pattern": "^def_[a-z0-9]{16}$",
+            "type": "string"
+          },
           "auto_generate": {
             "description": "Regenerate when the Definition changes: on every push to the default branch for a repository source…",
             "type": "boolean"
@@ -2576,12 +2833,20 @@
                     "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
                     "type": "object"
                   },
+                  "auth": {
+                    "description": "Public authentication defaults for generated clients and tools.",
+                    "type": "object"
+                  },
                   "cli": {
                     "description": "How the generated CLI behaves.",
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -2637,24 +2902,46 @@
     },
     {
       "operation": "projects.retrieveDiagnostics",
-      "signature": "client.projects.retrieveDiagnostics(projectId)",
+      "signature": "execute(projects_retrieve_diagnostics, arguments)",
+      "tool": "projects_retrieve_diagnostics",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_retrieve_diagnostics",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "GET",
       "path": "/projects/{project_id}/diagnostics",
       "summary": "Analyze a project's latest Definition Revision",
       "description": "Runs deterministic OpenAPI or GraphQL authorship checks against the latest observed immutable Definition Revision after applying the Definition's existing patches. Diagnostics group every affected location under a stable rule. Exact patches are included only when Typeship can derive the change without inventing API behavior.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -2915,24 +3202,53 @@
     },
     {
       "operation": "projects.refreshDiagnostics",
-      "signature": "client.projects.refreshDiagnostics(projectId)",
+      "signature": "execute(projects_refresh_diagnostics, arguments)",
+      "tool": "projects_refresh_diagnostics",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_refresh_diagnostics",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "POST",
       "path": "/projects/{project_id}/diagnostics",
       "summary": "Refresh a project's Diagnostics from its configured source",
       "description": "Fetches the complete configured source, records a new immutable revision only when content changed, and returns its Diagnostics. This does not generate targets or consume a metered generation.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -3193,25 +3509,50 @@
     },
     {
       "operation": "projects.remediateDiagnostics",
-      "signature": "client.projects.remediateDiagnostics(projectId, body)",
+      "signature": "execute(projects_remediate_diagnostics, arguments)",
+      "tool": "projects_remediate_diagnostics",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_remediate_diagnostics",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n",
+            "diagnostic_ids": [
+              "value"
+            ]
+          }
+        }
+      },
       "method": "POST",
       "path": "/projects/{project_id}/diagnostics/remediations",
       "summary": "Apply exact, reviewed diagnostic remediations",
       "description": "Applies only deterministic patches. Repository sources receive an updateable source pull request; URL sources receive project overlays. Diagnostics that require API-owner intent return 422 and include an authoring_brief in the Diagnostic instead.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
           "diagnostic_ids": {
             "description": "Stable IDs of current diagnostics whose exact patches should be reviewed and applied.",
             "minItems": 1,
@@ -3221,6 +3562,13 @@
               "type": "string"
             },
             "type": "array"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -3273,24 +3621,46 @@
     },
     {
       "operation": "projects.retrieveIntegrationHealth",
-      "signature": "client.projects.retrieveIntegrationHealth(projectId)",
+      "signature": "execute(projects_retrieve_integration_health, arguments)",
+      "tool": "projects_retrieve_integration_health",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_retrieve_integration_health",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "GET",
       "path": "/projects/{project_id}/integration-health",
       "summary": "Diagnose a project's repository integrations",
       "description": "Returns provider-neutral, machine-actionable source and destination access, Definition readability, source-approval label setup, required status names, and the latest durable webhook delivery. The Console renders this same result.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -3468,22 +3838,37 @@
     },
     {
       "operation": "projects.listGenerations",
-      "signature": "client.projects.listGenerations(projectId, params)",
+      "signature": "execute(projects_list_generations, arguments)",
+      "tool": "projects_list_generations",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_list_generations",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "GET",
       "path": "/projects/{project_id}/generations",
       "summary": "List a project's generations",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
           "limit": {
@@ -3498,12 +3883,19 @@
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
           },
           "target_id": {
-            "description": "Stable identifier for one configured generated product. IDs come from targets_list.",
+            "description": "Stable identifier for one configured generated product.",
             "examples": [
               "tgt_5m8q2v7k1p9d4h6c"
             ],
             "pattern": "^tgt_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -3516,6 +3908,7 @@
           "items": {
             "type": "array",
             "items": {
+              "description": "Generation metadata returned by collection endpoints.",
               "examples": [
                 {
                   "id": "gen_7h2p5d9c3m8w1k6q",
@@ -3565,16 +3958,6 @@
                   "const": "generation",
                   "type": "string"
                 },
-                "files_omitted": {
-                  "description": "Present and true when the generated target was too large to inline; files_index lists paths, fetche…",
-                  "type": "boolean"
-                },
-                "files_index": {
-                  "items": {
-                    "type": "object"
-                  },
-                  "type": "array"
-                },
                 "project_id": {
                   "description": "Unique identifier for a project.",
                   "examples": [
@@ -3712,13 +4095,6 @@
                   },
                   "type": "array"
                 },
-                "files": {
-                  "description": "Present on retrieve and create; omitted in lists.",
-                  "items": {
-                    "type": "object"
-                  },
-                  "type": "array"
-                },
                 "error": {
                   "type": [
                     "string",
@@ -3728,14 +4104,6 @@
                 "created_at": {
                   "format": "date-time",
                   "type": "string"
-                },
-                "request_id": {
-                  "description": "Server-generated identifier used to correlate this response with Typeship logs.",
-                  "examples": [
-                    "req_3k8m1v6q9p2d7h4c"
-                  ],
-                  "pattern": "^req_[a-z0-9]{16}$",
-                  "type": "string"
                 }
               },
               "type": "object"
@@ -3763,24 +4131,53 @@
     },
     {
       "operation": "projects.generate",
-      "signature": "client.projects.generate(projectId)",
+      "signature": "execute(projects_generate, arguments)",
+      "tool": "projects_generate",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "projects_generate",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "POST",
       "path": "/projects/{project_id}/generations",
       "summary": "Generate targets and open pull requests",
       "description": "Resolves the project's URL or GitHub source, generates every\nconfigured delivery package, stores each result in the project's history,\nand attempts to open a pull request in every configured destination.\nWhen the complete generated tree already matches a destination, no\ncommit, branch, or pull request is created and that generation reports\n`pr_status: no_changes`. This is the same pipeline automatic\nregeneration runs after a source change.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -3788,11 +4185,13 @@
         ]
       },
       "output_schema": {
+        "description": "Metadata for each Target generation attempted by a Project run. Retrieve one Generation separately for generated files.",
         "properties": {
           "data": {
             "items": {
               "anyOf": [
                 {
+                  "description": "Generation metadata returned by collection endpoints. Generated file contents and file indexes are available only from retrieve and create operations.",
                   "examples": [
                     {
                       "id": "gen_7h2p5d9c3m8w1k6q",
@@ -3842,13 +4241,6 @@
                       "const": "generation",
                       "type": "string"
                     },
-                    "files_omitted": {
-                      "description": "Present and true when the generated target was too large to inline; files_index lists paths, fetched one at a time via GET /generations/{generation_id}/file.",
-                      "type": "boolean"
-                    },
-                    "files_index": {
-                      "type": "array"
-                    },
                     "project_id": {
                       "description": "Unique identifier for a project.",
                       "examples": [
@@ -3932,10 +4324,6 @@
                     "warnings": {
                       "type": "array"
                     },
-                    "files": {
-                      "description": "Present on retrieve and create; omitted in lists.",
-                      "type": "array"
-                    },
                     "error": {
                       "type": [
                         "string",
@@ -3945,14 +4333,6 @@
                     "created_at": {
                       "format": "date-time",
                       "type": "string"
-                    },
-                    "request_id": {
-                      "description": "Server-generated identifier used to correlate this response with Typeship logs.",
-                      "examples": [
-                        "req_3k8m1v6q9p2d7h4c"
-                      ],
-                      "pattern": "^req_[a-z0-9]{16}$",
-                      "type": "string"
                     }
                   },
                   "type": "object"
@@ -4010,12 +4390,27 @@
     },
     {
       "operation": "definitions.retrieve",
-      "signature": "client.definitions.retrieve(definitionId)",
+      "signature": "execute(definitions_retrieve, arguments)",
+      "tool": "definitions_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definitions_retrieve",
+          "arguments": {
+            "definition_id": "def_2p8m4q7k1v9d6h3c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/definitions/{definition_id}",
       "summary": "Retrieve a Definition",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -4027,6 +4422,13 @@
             ],
             "pattern": "^def_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -4317,13 +4719,28 @@
     },
     {
       "operation": "definitions.update",
-      "signature": "client.definitions.update(definitionId, body)",
+      "signature": "execute(definitions_update, arguments)",
+      "tool": "definitions_update",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definitions_update",
+          "arguments": {
+            "definition_id": "def_2p8m4q7k1v9d6h3c"
+          }
+        }
+      },
       "method": "PATCH",
       "path": "/definitions/{definition_id}",
       "summary": "Update and resolve a Definition",
       "description": "Resolves the complete document graph and records a new immutable revision before saving.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -4336,6 +4753,13 @@
             "pattern": "^def_[a-z0-9]{16}$",
             "type": "string"
           },
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
           "source": {
             "anyOf": [
               {
@@ -4604,6 +5028,13 @@
             ],
             "additionalProperties": false,
             "type": "object"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -4894,22 +5325,37 @@
     },
     {
       "operation": "targets.list",
-      "signature": "client.targets.list(projectId, params)",
+      "signature": "execute(targets_list, arguments)",
+      "tool": "targets_list",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_list",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n"
+          }
+        }
+      },
       "method": "GET",
       "path": "/projects/{project_id}/targets",
       "summary": "List a project's Targets",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
           "limit": {
@@ -4922,6 +5368,13 @@
           "cursor": {
             "type": "string",
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -5020,10 +5473,9 @@
                   "description": "Target-specific overrides merged over Project.config. GraphQL settings are Definition-owned and never appear here.",
                   "anyOf": [
                     {
-                      "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                      "description": "Target-specific generation and delivery overrides. Authentication may only select a Project-owned OAuth application. OAuth server metadata, applications, and identity policy remain Project-owned. Self-hosted MCP access may be overridden for a Target-specific deployment.",
                       "properties": {
                         "globals": {
-                          "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
                           "maxItems": 20,
                           "type": "array"
                         },
@@ -5032,7 +5484,10 @@
                           "type": "object"
                         },
                         "pagination": {
-                          "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\". Unmatched keys are reported as generation warnings.",
+                          "type": "object"
+                        },
+                        "auth": {
+                          "description": "Selects a Project OAuth application for one Target. OAuth server metadata, applications, and identity policy remain Project-owned.",
                           "type": "object"
                         },
                         "cli": {
@@ -5040,7 +5495,11 @@
                           "type": "object"
                         },
                         "mcp": {
-                          "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                          "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
+                          "type": "object"
+                        },
+                        "readme": {
+                          "description": "Generated README behavior. Part of Config.",
                           "type": "object"
                         },
                         "package": {
@@ -5048,7 +5507,7 @@
                           "type": "object"
                         },
                         "docs_url": {
-                          "description": "The API's documentation site. Read through its llms.txt by the generated CLI's docs command, the MCP server's docs tools, and the package's AGENTS.md. Defaults to the Definition's externalDocs URL.",
+                          "format": "uri",
                           "type": [
                             "string",
                             "null"
@@ -5056,7 +5515,6 @@
                         },
                         "docs_index_url": {
                           "format": "uri",
-                          "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                           "type": [
                             "string",
                             "null"
@@ -5071,6 +5529,8 @@
                   ]
                 },
                 "deliveries": {
+                  "description": "At most one repository and one hosted MCP Delivery.",
+                  "maxItems": 2,
                   "items": {
                     "anyOf": [
                       {
@@ -5125,25 +5585,50 @@
     },
     {
       "operation": "targets.create",
-      "signature": "client.targets.create(projectId, body)",
+      "signature": "execute(targets_create, arguments)",
+      "tool": "targets_create",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_create",
+          "arguments": {
+            "project_id": "prj_4f8k2m7x9q1v6b3n",
+            "name": "example",
+            "definition_id": "def_2p8m4q7k1v9d6h3c",
+            "generator": "typescript-sdk"
+          }
+        }
+      },
       "method": "POST",
       "path": "/projects/{project_id}/targets",
       "summary": "Create an independently configured Target",
       "description": "Several Targets may use the same generator with distinct configuration, Deliveries, and release streams.",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "project_id": {
-            "description": "Unique identifier for a project. IDs come from projects_list.",
+            "description": "Unique identifier for a project. Accepts an ID or an exact name (resolved via projects_list). IDs come from projects_list.",
             "examples": [
+              "example-name",
               "prj_4f8k2m7x9q1v6b3n"
             ],
-            "pattern": "^prj_[a-z0-9]{16}$",
             "type": "string"
           },
+          "Idempotency-Key": {
+            "minLength": 1,
+            "maxLength": 255,
+            "pattern": "^[!-~]+$",
+            "type": "string",
+            "description": "Identifies one logical write for 24 hours. The key is scoped to the authenticated account and operation; account-less generation uses a hashed network identity. Retrying the same method, path, query, and JSON body replays the original response. Reusing the key with changed intent returns 409. After expiry the key starts a new write."
+          },
           "name": {
             "minLength": 1,
             "maxLength": 80,
@@ -5202,10 +5687,9 @@
             "description": "Target-specific overrides merged over Project.config. GraphQL settings are rejected here and belong to the Definition.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                "description": "Target-specific generation and delivery overrides. Authentication may only select a Project-owned OAuth application. OAuth server metadata, applications, and identity policy remain Project-owned. Self-hosted MCP access may be overridden for a Target-specific deployment.",
                 "properties": {
                   "globals": {
-                    "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
                     "maxItems": 20,
                     "items": {
                       "type": "string"
@@ -5255,54 +5739,49 @@
                     "type": "object"
                   },
                   "pagination": {
-                    "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\". Unmatched keys are reported as generation warnings.",
                     "additionalProperties": {
                       "anyOf": [
                         {
                           "type": "object"
                         },
                         {
-                          "description": "false disables pagination detection for the operation.",
                           "type": "boolean"
                         }
                       ]
                     },
                     "type": "object"
                   },
-                  "cli": {
-                    "description": "How the generated CLI behaves. Part of Config.",
+                  "auth": {
+                    "description": "Selects a Project OAuth application for one Target. OAuth server metadata, applications, and identity policy remain Project-owned.",
                     "properties": {
-                      "command_name": {
-                        "description": "Command users run, independent of how the CLI is distributed.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
-                      "whoami_operation": {
-                        "description": "resource.method of a zero-argument GET that the generated CLI's whoami command calls. Overrides auto-detection; a value that matches nothing is reported as a generation warning.",
+                      "oauth_application": {
+                        "description": "Project OAuth application to use. Omit to inherit the Project default.",
+                        "maxLength": 64,
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_client_id": {
-                        "description": "OAuth client id baked into the generated CLI for device-flow login. Without it, login prompts for a pasted credential.",
+                      "environments": {
+                        "description": "Project OAuth application selections keyed by API environment.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
                         "type": [
-                          "string",
+                          "object",
                           "null"
                         ]
-                      },
-                      "oauth_scopes": {
-                        "description": "Scopes requested during device-flow login. Include offline_access if the authorization server gates refresh tokens behind it.",
-                        "maxItems": 20,
-                        "items": {
-                          "type": "string"
-                        },
-                        "type": "array"
-                      },
-                      "oauth_audience": {
-                        "description": "Audience sent with the device-authorization request, for authorization servers that require one to issue API-valid access tokens.",
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "cli": {
+                    "description": "How the generated CLI behaves. Part of Config.",
+                    "properties": {
+                      "command_name": {
+                        "description": "Command users run, independent of how the CLI is distributed.",
                         "type": [
                           "string",
                           "null"
@@ -5319,13 +5798,6 @@
                           "null"
                         ]
                       },
-                      "auth_url": {
-                        "description": "Base URL of the browser-approval endpoint pair used by CLI login. The CLI keeps the verifier and receives the credential directly; no key is pasted through a conversation.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
                       "mcp_url": {
                         "description": "Hosted MCP endpoint installed by the generated CLI instead of launching the package's local stdio server.",
                         "type": [
@@ -5345,7 +5817,7 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
                     "properties": {
                       "registry_name": {
                         "description": "Stable official MCP registry name, independent of the server runtime.",
@@ -5354,6 +5826,37 @@
                           "null"
                         ]
                       },
+                      "access": {
+                        "description": "Authorization for callers connecting to a generated MCP server deployed over HTTP. The hosting application resolves upstream API credentials separately at runtime. This setting does not apply to the Typeship-hosted endpoint.",
+                        "properties": {
+                          "issuer": {
+                            "format": "uri",
+                            "description": "Exact issuer allowed to sign MCP connection tokens.",
+                            "type": "string"
+                          },
+                          "resource": {
+                            "format": "uri",
+                            "description": "Canonical public URL of the self-hosted MCP endpoint that connection tokens must target.",
+                            "type": "string"
+                          },
+                          "jwks_url": {
+                            "format": "uri",
+                            "description": "Public signing-key endpoint. Omit to discover it from the issuer.",
+                            "type": "string"
+                          },
+                          "scopes": {
+                            "description": "Minimum scopes required to connect to the self-hosted MCP server.",
+                            "maxItems": 20,
+                            "type": "array"
+                          }
+                        },
+                        "required": [
+                          "issuer",
+                          "resource"
+                        ],
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
                       "tool_mode": {
                         "enum": [
                           "auto",
@@ -5370,14 +5873,36 @@
                           "string",
                           "null"
                         ]
-                      },
-                      "tool_descriptions": {
-                        "description": "Hand-written MCP tool descriptions keyed by operationId or \"METHOD /path\". Each replaces the text typeship derives for that operation (summary, first sentence, method and path, deprecation and auth notes). For flows the spec cannot describe, such as a multi-step upload. Keys that match no operation are reported as generation warnings.",
-                        "additionalProperties": {
-                          "maxLength": 600,
-                          "type": "string"
-                        },
-                        "type": "object"
+                      },
+                      "tool_descriptions": {
+                        "description": "Hand-written MCP tool descriptions keyed by operationId or \"METHOD /path\". Each replaces the text typeship derives for that operation (summary, first sentence, method and path, deprecation and auth notes). For flows the spec cannot describe, such as a multi-step upload. Keys that match no operation are reported as generation warnings.",
+                        "additionalProperties": {
+                          "maxLength": 600,
+                          "type": "string"
+                        },
+                        "type": "object"
+                      },
+                      "reference_resolvers": {
+                        "description": "Exact name-or-ID resolver overrides keyed first by the target operationId or \"METHOD /path\", then by its wire argument name. A resolver names one read collection operation plus 1-4 item fields to match case-insensitively; false opts that argument out of strict inference.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
+                        "type": "object"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior. Part of Config.",
+                    "properties": {
+                      "quickstart_operation": {
+                        "description": "operationId or \"METHOD /path\" to feature as the README's first API call. It must be present in the generated package and callable with no required input beyond path placeholders. Missing or unsuitable choices produce a warning and use the automatic example.",
+                        "maxLength": 500,
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "additionalProperties": false,
@@ -5429,7 +5954,7 @@
                     "type": "object"
                   },
                   "docs_url": {
-                    "description": "The API's documentation site. Read through its llms.txt by the generated CLI's docs command, the MCP server's docs tools, and the package's AGENTS.md. Defaults to the Definition's externalDocs URL.",
+                    "format": "uri",
                     "type": [
                       "string",
                       "null"
@@ -5437,7 +5962,6 @@
                   },
                   "docs_index_url": {
                     "format": "uri",
-                    "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                     "type": [
                       "string",
                       "null"
@@ -5453,6 +5977,7 @@
             ]
           },
           "deliveries": {
+            "maxItems": 2,
             "items": {
               "anyOf": [
                 {
@@ -5530,6 +6055,13 @@
               ]
             },
             "type": "array"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -5626,10 +6158,9 @@
             "description": "Target-specific overrides merged over Project.config.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project.",
+                "description": "Target-specific generation and delivery overrides.",
                 "properties": {
                   "globals": {
-                    "description": "Wire names of query/header parameters that become settable once on the generated client and auto-ap…",
                     "maxItems": 20,
                     "type": "array"
                   },
@@ -5638,7 +6169,10 @@
                     "type": "object"
                   },
                   "pagination": {
-                    "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
+                    "type": "object"
+                  },
+                  "auth": {
+                    "description": "Selects a Project OAuth application for one Target.",
                     "type": "object"
                   },
                   "cli": {
@@ -5646,7 +6180,11 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -5654,7 +6192,7 @@
                     "type": "object"
                   },
                   "docs_url": {
-                    "description": "The API's documentation site.",
+                    "format": "uri",
                     "type": [
                       "string",
                       "null"
@@ -5662,7 +6200,6 @@
                   },
                   "docs_index_url": {
                     "format": "uri",
-                    "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                     "type": [
                       "string",
                       "null"
@@ -5677,6 +6214,8 @@
             ]
           },
           "deliveries": {
+            "description": "At most one repository and one hosted MCP Delivery.",
+            "maxItems": 2,
             "items": {
               "anyOf": [
                 {
@@ -5717,23 +6256,45 @@
     },
     {
       "operation": "targets.retrieve",
-      "signature": "client.targets.retrieve(targetId)",
+      "signature": "execute(targets_retrieve, arguments)",
+      "tool": "targets_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_retrieve",
+          "arguments": {
+            "target_id": "tgt_5m8q2v7k1p9d4h6c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/targets/{target_id}",
       "summary": "Retrieve a Target",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "target_id": {
-            "description": "Stable identifier for one configured generated product. IDs come from targets_list.",
+            "description": "Stable identifier for one configured generated product.",
             "examples": [
               "tgt_5m8q2v7k1p9d4h6c"
             ],
             "pattern": "^tgt_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -5827,10 +6388,9 @@
             "description": "Target-specific overrides merged over Project.config.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project.",
+                "description": "Target-specific generation and delivery overrides.",
                 "properties": {
                   "globals": {
-                    "description": "Wire names of query/header parameters that become settable once on the generated client and auto-ap…",
                     "maxItems": 20,
                     "type": "array"
                   },
@@ -5839,7 +6399,10 @@
                     "type": "object"
                   },
                   "pagination": {
-                    "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
+                    "type": "object"
+                  },
+                  "auth": {
+                    "description": "Selects a Project OAuth application for one Target.",
                     "type": "object"
                   },
                   "cli": {
@@ -5847,7 +6410,11 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -5855,7 +6422,7 @@
                     "type": "object"
                   },
                   "docs_url": {
-                    "description": "The API's documentation site.",
+                    "format": "uri",
                     "type": [
                       "string",
                       "null"
@@ -5863,7 +6430,6 @@
                   },
                   "docs_index_url": {
                     "format": "uri",
-                    "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                     "type": [
                       "string",
                       "null"
@@ -5878,6 +6444,8 @@
             ]
           },
           "deliveries": {
+            "description": "At most one repository and one hosted MCP Delivery.",
+            "maxItems": 2,
             "items": {
               "anyOf": [
                 {
@@ -5915,24 +6483,47 @@
     },
     {
       "operation": "targets.delete",
-      "signature": "client.targets.delete(targetId)",
+      "signature": "execute(targets_delete, arguments)",
+      "tool": "targets_delete",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_delete",
+          "arguments": {
+            "target_id": "tgt_5m8q2v7k1p9d4h6c"
+          },
+          "confirm": true
+        }
+      },
       "method": "DELETE",
       "path": "/targets/{target_id}",
       "summary": "Delete an unused Target",
       "description": "Targets with Generation or release history, or an active release candidate, must be disabled instead.",
       "safety": "destructive",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "target_id": {
-            "description": "Stable identifier for one configured generated product. IDs come from targets_list.",
+            "description": "Stable identifier for one configured generated product.",
             "examples": [
               "tgt_5m8q2v7k1p9d4h6c"
             ],
             "pattern": "^tgt_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -5974,18 +6565,33 @@
     },
     {
       "operation": "targets.update",
-      "signature": "client.targets.update(targetId, body)",
+      "signature": "execute(targets_update, arguments)",
+      "tool": "targets_update",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_update",
+          "arguments": {
+            "target_id": "tgt_5m8q2v7k1p9d4h6c"
+          }
+        }
+      },
       "method": "PATCH",
       "path": "/targets/{target_id}",
       "summary": "Update a Target, its Deliveries, or its next reviewed version",
       "safety": "write",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "target_id": {
-            "description": "Stable identifier for one configured generated product. IDs come from targets_list.",
+            "description": "Stable identifier for one configured generated product.",
             "examples": [
               "tgt_5m8q2v7k1p9d4h6c"
             ],
@@ -6024,10 +6630,9 @@
             "description": "Target-specific overrides merged over Project.config. GraphQL settings are rejected here and belong to the Definition.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project. Every Target inherits these defaults. Target.config is merged over them for one Target; top-level values replace defaults while cli, mcp, and package merge by field. GraphQL-only source settings live on the Project's Definition and are rejected in both stored config scopes.",
+                "description": "Target-specific generation and delivery overrides. Authentication may only select a Project-owned OAuth application. OAuth server metadata, applications, and identity policy remain Project-owned. Self-hosted MCP access may be overridden for a Target-specific deployment.",
                 "properties": {
                   "globals": {
-                    "description": "Wire names of query/header parameters that become settable once on the generated client and auto-apply to every operation that accepts them; per-call values win. Names that match nothing are reported as generation warnings.",
                     "maxItems": 20,
                     "items": {
                       "type": "string"
@@ -6077,54 +6682,49 @@
                     "type": "object"
                   },
                   "pagination": {
-                    "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\". Unmatched keys are reported as generation warnings.",
                     "additionalProperties": {
                       "anyOf": [
                         {
                           "type": "object"
                         },
                         {
-                          "description": "false disables pagination detection for the operation.",
                           "type": "boolean"
                         }
                       ]
                     },
                     "type": "object"
                   },
-                  "cli": {
-                    "description": "How the generated CLI behaves. Part of Config.",
+                  "auth": {
+                    "description": "Selects a Project OAuth application for one Target. OAuth server metadata, applications, and identity policy remain Project-owned.",
                     "properties": {
-                      "command_name": {
-                        "description": "Command users run, independent of how the CLI is distributed.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
-                      "whoami_operation": {
-                        "description": "resource.method of a zero-argument GET that the generated CLI's whoami command calls. Overrides auto-detection; a value that matches nothing is reported as a generation warning.",
+                      "oauth_application": {
+                        "description": "Project OAuth application to use. Omit to inherit the Project default.",
+                        "maxLength": 64,
+                        "pattern": "^[a-z][a-z0-9_-]{0,63}$",
                         "type": [
                           "string",
                           "null"
                         ]
                       },
-                      "oauth_client_id": {
-                        "description": "OAuth client id baked into the generated CLI for device-flow login. Without it, login prompts for a pasted credential.",
+                      "environments": {
+                        "description": "Project OAuth application selections keyed by API environment.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
                         "type": [
-                          "string",
+                          "object",
                           "null"
                         ]
-                      },
-                      "oauth_scopes": {
-                        "description": "Scopes requested during device-flow login. Include offline_access if the authorization server gates refresh tokens behind it.",
-                        "maxItems": 20,
-                        "items": {
-                          "type": "string"
-                        },
-                        "type": "array"
-                      },
-                      "oauth_audience": {
-                        "description": "Audience sent with the device-authorization request, for authorization servers that require one to issue API-valid access tokens.",
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "cli": {
+                    "description": "How the generated CLI behaves. Part of Config.",
+                    "properties": {
+                      "command_name": {
+                        "description": "Command users run, independent of how the CLI is distributed.",
                         "type": [
                           "string",
                           "null"
@@ -6141,13 +6741,6 @@
                           "null"
                         ]
                       },
-                      "auth_url": {
-                        "description": "Base URL of the browser-approval endpoint pair used by CLI login. The CLI keeps the verifier and receives the credential directly; no key is pasted through a conversation.",
-                        "type": [
-                          "string",
-                          "null"
-                        ]
-                      },
                       "mcp_url": {
                         "description": "Hosted MCP endpoint installed by the generated CLI instead of launching the package's local stdio server.",
                         "type": [
@@ -6167,7 +6760,7 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave. Part of Config.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave. Part of Config.",
                     "properties": {
                       "registry_name": {
                         "description": "Stable official MCP registry name, independent of the server runtime.",
@@ -6176,6 +6769,37 @@
                           "null"
                         ]
                       },
+                      "access": {
+                        "description": "Authorization for callers connecting to a generated MCP server deployed over HTTP. The hosting application resolves upstream API credentials separately at runtime. This setting does not apply to the Typeship-hosted endpoint.",
+                        "properties": {
+                          "issuer": {
+                            "format": "uri",
+                            "description": "Exact issuer allowed to sign MCP connection tokens.",
+                            "type": "string"
+                          },
+                          "resource": {
+                            "format": "uri",
+                            "description": "Canonical public URL of the self-hosted MCP endpoint that connection tokens must target.",
+                            "type": "string"
+                          },
+                          "jwks_url": {
+                            "format": "uri",
+                            "description": "Public signing-key endpoint. Omit to discover it from the issuer.",
+                            "type": "string"
+                          },
+                          "scopes": {
+                            "description": "Minimum scopes required to connect to the self-hosted MCP server.",
+                            "maxItems": 20,
+                            "type": "array"
+                          }
+                        },
+                        "required": [
+                          "issuer",
+                          "resource"
+                        ],
+                        "additionalProperties": false,
+                        "type": "object"
+                      },
                       "tool_mode": {
                         "enum": [
                           "auto",
@@ -6200,6 +6824,28 @@
                           "type": "string"
                         },
                         "type": "object"
+                      },
+                      "reference_resolvers": {
+                        "description": "Exact name-or-ID resolver overrides keyed first by the target operationId or \"METHOD /path\", then by its wire argument name. A resolver names one read collection operation plus 1-4 item fields to match case-insensitively; false opts that argument out of strict inference.",
+                        "additionalProperties": {
+                          "type": "object"
+                        },
+                        "type": "object"
+                      }
+                    },
+                    "additionalProperties": false,
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior. Part of Config.",
+                    "properties": {
+                      "quickstart_operation": {
+                        "description": "operationId or \"METHOD /path\" to feature as the README's first API call. It must be present in the generated package and callable with no required input beyond path placeholders. Missing or unsuitable choices produce a warning and use the automatic example.",
+                        "maxLength": 500,
+                        "type": [
+                          "string",
+                          "null"
+                        ]
                       }
                     },
                     "additionalProperties": false,
@@ -6251,7 +6897,7 @@
                     "type": "object"
                   },
                   "docs_url": {
-                    "description": "The API's documentation site. Read through its llms.txt by the generated CLI's docs command, the MCP server's docs tools, and the package's AGENTS.md. Defaults to the Definition's externalDocs URL.",
+                    "format": "uri",
                     "type": [
                       "string",
                       "null"
@@ -6259,7 +6905,6 @@
                   },
                   "docs_index_url": {
                     "format": "uri",
-                    "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                     "type": [
                       "string",
                       "null"
@@ -6275,6 +6920,7 @@
             ]
           },
           "deliveries": {
+            "maxItems": 2,
             "items": {
               "anyOf": [
                 {
@@ -6352,6 +6998,13 @@
               ]
             },
             "type": "array"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -6445,10 +7098,9 @@
             "description": "Target-specific overrides merged over Project.config.",
             "anyOf": [
               {
-                "description": "Shared generated-client and tooling behavior for a stored Project.",
+                "description": "Target-specific generation and delivery overrides.",
                 "properties": {
                   "globals": {
-                    "description": "Wire names of query/header parameters that become settable once on the generated client and auto-ap…",
                     "maxItems": 20,
                     "type": "array"
                   },
@@ -6457,7 +7109,10 @@
                     "type": "object"
                   },
                   "pagination": {
-                    "description": "Per-operation pagination control, keyed by operationId or \"METHOD /path\".",
+                    "type": "object"
+                  },
+                  "auth": {
+                    "description": "Selects a Project OAuth application for one Target.",
                     "type": "object"
                   },
                   "cli": {
@@ -6465,7 +7120,11 @@
                     "type": "object"
                   },
                   "mcp": {
-                    "description": "How the generated MCP server and the hosted endpoint behave.",
+                    "description": "How generated MCP servers and the Typeship-hosted endpoint behave.",
+                    "type": "object"
+                  },
+                  "readme": {
+                    "description": "Generated README behavior.",
                     "type": "object"
                   },
                   "package": {
@@ -6473,7 +7132,7 @@
                     "type": "object"
                   },
                   "docs_url": {
-                    "description": "The API's documentation site.",
+                    "format": "uri",
                     "type": [
                       "string",
                       "null"
@@ -6481,7 +7140,6 @@
                   },
                   "docs_index_url": {
                     "format": "uri",
-                    "description": "Exact llms.txt URL when the documentation site does not publish it at docs_url + /llms.txt.",
                     "type": [
                       "string",
                       "null"
@@ -6496,6 +7154,8 @@
             ]
           },
           "deliveries": {
+            "description": "At most one repository and one hosted MCP Delivery.",
+            "maxItems": 2,
             "items": {
               "anyOf": [
                 {
@@ -6533,18 +7193,33 @@
     },
     {
       "operation": "targets.listReleases",
-      "signature": "client.targets.listReleases(targetId, params)",
+      "signature": "execute(targets_list_releases, arguments)",
+      "tool": "targets_list_releases",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_list_releases",
+          "arguments": {
+            "target_id": "tgt_5m8q2v7k1p9d4h6c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/targets/{target_id}/releases",
       "summary": "List immutable releases for a Target",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
         "properties": {
           "target_id": {
-            "description": "Stable identifier for one configured generated product. IDs come from targets_list.",
+            "description": "Stable identifier for one configured generated product.",
             "examples": [
               "tgt_5m8q2v7k1p9d4h6c"
             ],
@@ -6561,6 +7236,13 @@
           "cursor": {
             "type": "string",
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -6700,12 +7382,27 @@
     },
     {
       "operation": "targets.retrieveRelease",
-      "signature": "client.targets.retrieveRelease(targetReleaseId)",
+      "signature": "execute(targets_retrieve_release, arguments)",
+      "tool": "targets_retrieve_release",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "targets_retrieve_release",
+          "arguments": {
+            "target_release_id": "rel_7m2q8v4k1p9d5h6c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/target_releases/{target_release_id}",
       "summary": "Retrieve an immutable Target release",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -6716,6 +7413,13 @@
             ],
             "pattern": "^rel_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -6833,13 +7537,28 @@
     },
     {
       "operation": "generations.retrieve",
-      "signature": "client.generations.retrieve(generationId)",
+      "signature": "execute(generations_retrieve, arguments)",
+      "tool": "generations_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "generations_retrieve",
+          "arguments": {
+            "generation_id": "gen_7h2p5d9c3m8w1k6q"
+          }
+        }
+      },
       "method": "GET",
       "path": "/generations/{generation_id}",
       "summary": "Retrieve a generation",
       "description": "Includes the generated files when the generation succeeded.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -6851,6 +7570,13 @@
             ],
             "pattern": "^gen_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7052,13 +7778,29 @@
     },
     {
       "operation": "generations.retrieveFile",
-      "signature": "client.generations.retrieveFile(generationId, params)",
+      "signature": "execute(generations_retrieve_file, arguments)",
+      "tool": "generations_retrieve_file",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "generations_retrieve_file",
+          "arguments": {
+            "generation_id": "gen_7h2p5d9c3m8w1k6q",
+            "path": "openapi.yaml"
+          }
+        }
+      },
       "method": "GET",
       "path": "/generations/{generation_id}/file",
       "summary": "Fetch one file from a generation",
       "description": "Raw file content, for generations whose target was too large to inline (files_omitted true). The generation's files_index lists valid paths.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
@@ -7074,6 +7816,13 @@
           "path": {
             "type": "string",
             "description": "Repo-relative path inside the generated package."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7088,13 +7837,28 @@
     },
     {
       "operation": "definitionRevisions.list",
-      "signature": "client.definitionRevisions.list(definitionId, params)",
+      "signature": "execute(definition_revisions_list, arguments)",
+      "tool": "definition_revisions_list",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definition_revisions_list",
+          "arguments": {
+            "definition_id": "def_2p8m4q7k1v9d6h3c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/definitions/{definition_id}/revisions",
       "summary": "List Definition Revisions",
       "description": "Immutable snapshots of the complete resolved document graph this Definition observed, newest first. Content is available from the revision and document endpoints and is never embedded in a list response.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
@@ -7117,6 +7881,13 @@
           "cursor": {
             "type": "string",
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7274,24 +8045,46 @@
     },
     {
       "operation": "definitionRevisions.retrieve",
-      "signature": "client.definitionRevisions.retrieve(definitionRevisionId)",
+      "signature": "execute(definition_revisions_retrieve, arguments)",
+      "tool": "definition_revisions_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definition_revisions_retrieve",
+          "arguments": {
+            "definition_revision_id": "drev_6m1q8v4k2p9d7h3c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/definition_revisions/{definition_revision_id}",
       "summary": "Retrieve a Definition Revision",
       "description": "Metadata for one immutable resolved document graph. Fetch its canonical content or individual source documents from the content endpoints.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "definition_revision_id": {
-            "description": "Unique identifier for an immutable resolved Definition Revision. IDs come from definition_revisions_list.",
+            "description": "Unique identifier for an immutable resolved Definition Revision.",
             "examples": [
               "drev_6m1q8v4k2p9d7h3c"
             ],
             "pattern": "^drev_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7464,24 +8257,46 @@
     },
     {
       "operation": "definitionRevisions.retrieveContent",
-      "signature": "client.definitionRevisions.retrieveContent(definitionRevisionId)",
+      "signature": "execute(definition_revisions_retrieve_content, arguments)",
+      "tool": "definition_revisions_retrieve_content",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definition_revisions_retrieve_content",
+          "arguments": {
+            "definition_revision_id": "drev_6m1q8v4k2p9d7h3c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/definition_revisions/{definition_revision_id}/content",
       "summary": "Retrieve a Definition Revision's canonical content",
       "description": "Returns the exact canonical resolved content identified by the revision's graph digest, suitable for saving or piping into a diff.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "definition_revision_id": {
-            "description": "Unique identifier for an immutable resolved Definition Revision. IDs come from definition_revisions_list.",
+            "description": "Unique identifier for an immutable resolved Definition Revision.",
             "examples": [
               "drev_6m1q8v4k2p9d7h3c"
             ],
             "pattern": "^drev_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7494,18 +8309,34 @@
     },
     {
       "operation": "definitionRevisions.retrieveDocumentContent",
-      "signature": "client.definitionRevisions.retrieveDocumentContent(definitionRevisionId, documentId)",
+      "signature": "execute(definition_revisions_retrieve_document_content, arguments)",
+      "tool": "definition_revisions_retrieve_document_content",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "definition_revisions_retrieve_document_content",
+          "arguments": {
+            "definition_revision_id": "drev_6m1q8v4k2p9d7h3c",
+            "document_id": "doc_8q2m5v1k9p4d7h3c"
+          }
+        }
+      },
       "method": "GET",
       "path": "/definition_revisions/{definition_revision_id}/documents/{document_id}/content",
       "summary": "Retrieve one source document from a Definition Revision",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "definition_revision_id": {
-            "description": "Unique identifier for an immutable resolved Definition Revision. IDs come from definition_revisions_list.",
+            "description": "Unique identifier for an immutable resolved Definition Revision.",
             "examples": [
               "drev_6m1q8v4k2p9d7h3c"
             ],
@@ -7519,6 +8350,13 @@
             ],
             "pattern": "^doc_[a-z0-9]{16}$",
             "type": "string"
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [
@@ -7533,17 +8371,38 @@
     },
     {
       "operation": "account.retrieve",
-      "signature": "client.account.retrieve()",
+      "signature": "execute(account_retrieve, arguments)",
+      "tool": "account_retrieve",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "account_retrieve",
+          "arguments": {}
+        }
+      },
       "method": "GET",
       "path": "/me",
       "summary": "The account behind the presented credentials",
       "description": "Returns the account that owns the presented API key. This is also the\nidentity endpoint the generated typeship CLI's `whoami` calls.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
-        "properties": {}
+        "properties": {
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
+          }
+        }
       },
       "output_schema": {
         "description": "The organization an API key belongs to. Members share its projects, keys, and plan; sign-in identity is not part of the API.",
@@ -7590,13 +8449,26 @@
     },
     {
       "operation": "apiKeys.list",
-      "signature": "client.apiKeys.list(params)",
+      "signature": "execute(api_keys_list, arguments)",
+      "tool": "api_keys_list",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "api_keys_list",
+          "arguments": {}
+        }
+      },
       "method": "GET",
       "path": "/api_keys",
       "summary": "List API keys",
       "description": "Keys are never returned in full — only their identity and last four. Creation stays in the console deliberately: a leaked key that can mint more keys is a leaked account.",
       "safety": "read",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": true,
       "input_schema": {
         "type": "object",
@@ -7611,6 +8483,13 @@
           "cursor": {
             "type": "string",
             "description": "Opaque cursor from the preceding page's next_cursor. Valid only for the same account, operation, filters, and ordering that issued it."
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths, applied to each item (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         }
       },
@@ -7681,20 +8560,46 @@
     },
     {
       "operation": "apiKeys.revoke",
-      "signature": "client.apiKeys.revoke(apiKeyId)",
+      "signature": "execute(api_keys_revoke, arguments)",
+      "tool": "api_keys_revoke",
+      "example_call": {
+        "name": "execute",
+        "arguments": {
+          "operation": "api_keys_revoke",
+          "arguments": {
+            "api_key_id": "api_key_123"
+          },
+          "confirm": true
+        }
+      },
       "method": "DELETE",
       "path": "/api_keys/{api_key_id}",
       "summary": "Revoke an API key",
       "description": "Idempotent: revoking an already-revoked key returns the same body, so a rotation script that re-runs does not have to special-case having already succeeded. An OAuth member may revoke a key they created; an organization admin may revoke any key. Organization API keys retain account-wide authority.",
       "safety": "destructive",
       "auth": "required",
+      "security": [
+        {
+          "apiKey": []
+        }
+      ],
       "paginated": false,
       "input_schema": {
         "type": "object",
         "properties": {
           "api_key_id": {
-            "description": "Identifier returned by the API key list. IDs come from api_keys_list.",
-            "type": "string"
+            "description": "Identifier returned by the API key list. Accepts an ID or an exact name (resolved via api_keys_list). IDs come from api_keys_list.",
+            "type": "string",
+            "examples": [
+              "example-name"
+            ]
+          },
+          "fields": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Result keys to keep, as dotted paths (e.g. [\"id\",\"name\"]). Omit for the whole result. Keeps responses small."
           }
         },
         "required": [