feat(typegen): add @decocms/typegen package

[viktormarinho]

Summary

• Adds new packages/typegen package with a dual-purpose design: a CLI bin (bunx @decocms/typegen) and a runtime factory (createMeshClient)
• CLI connects to a Virtual MCP via the MCP SDK, introspects its tools, and writes a generated client.ts with a fully typed Tools interface
• createMeshClient<T>() returns a lazy-connecting Proxy typed to the generated interface — one import, zero boilerplate

Test Plan

• bun test packages/typegen/ — 10/10 tests pass (runtime + codegen)
• bun run --cwd=packages/typegen check — TypeScript clean
• bun run --cwd=packages/typegen build — dist/ built with index.js, cli.js, .d.ts files
• bun run fmt — Biome formatting applied

---

Summary by cubic

Adds a new @decocms/typegen package to generate a typed TypeScript client for Mesh Virtual MCPs. Updates the Connect UI, stabilizes the runtime (race fix, safe URLs, close()), adds CI auto‑publish, and improves test isolation.

• New Features

  • CLI: bunx @decocms/typegen connects to a Virtual MCP, introspects tools, and writes client.ts with a typed Tools interface; formats with Prettier and uses unknown when outputSchema is missing.
  • Runtime: createMeshClient() returns a lazy, cached Proxy client with .close() to release the connection; supports MESH_API_KEY and MESH_BASE_URL envs (defaults to https://mesh-admin.decocms.com).
  • UI: “Share” → “Connect” (ZapCircle + labeled button), dialog title “Connect,” and a “Generate typed client” section that creates an API key, shows a prefilled bunx command with --output client.ts, and an env vars block (copy-to-clipboard); uses Suspense for loading.
  • CI: adds npm publish workflow for @decocms/typegen with version check, prerelease/stable tag selection, and GitHub release creation.

• Bug Fixes

  • Runtime: fixed a concurrent connect race via a shared promise and built URLs safely (base normalization and encodeURIComponent for mcpId).
  • UI: ensured long keys/commands wrap, set sm:max-w-2xl, fixed an unclosed div, and resolved a cn lint error.
  • Tooling/Tests: replaced mock.module with dependency injection to prevent SDK mock leaks in CI; knip ignores typegen test files; restored module mocks in afterAll to prevent cross‑test leaks.

^{Written for commit d2e1369. Summary will update on new commits.}

[github-actions]

🧪 Benchmark

Should we run the Virtual MCP strategy benchmark for this PR?

React with 👍 to run the benchmark.

Reaction	Action
👍	Run quick benchmark (10 & 128 tools)

Benchmark will run on the next push after you react.

[cubic-dev-ai]

2 issues found across 11 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/typegen/src/runtime.ts">

<violation number="1" location="packages/typegen/src/runtime.ts:11">
P2: This factory creates an active client connection that cannot be closed by the consumer, leading to potential resource leaks if `createMeshClient` is called repeatedly or used in a hot-reload environment.

Consider exposing a `close` or `dispose` method on the returned proxy, or documenting that this function should only be used as a singleton.</violation>

<violation number="2" location="packages/typegen/src/runtime.ts:14">
P1: 1. **Race Condition**: `getClient` checks `mcpClient` synchronously but awaits the connection. Concurrent calls will bypass the check, creating multiple `Client` instances and connections (orphan connections). Use a shared Promise to ensure a singleton connection.
2. **URL Construction Bug**: `new URL("/mcp/...", baseUrl)` ignores the path component of `baseUrl` (if any) because the first argument starts with `/`. This breaks usage with proxy URLs (e.g., `https://example.com/api`).
3. **Injection Risk**: `opts.mcpId` is not encoded, which breaks the URL if it contains special characters.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[github-actions]

Release Options

Should a new version be published when this PR is merged?

React with an emoji to vote on the release type:

Reaction	Type	Next Version
👍	Prerelease	2.115.1-alpha.1
🎉	Patch	2.115.1
❤️	Minor	2.116.0
🚀	Major	3.0.0

Current version: 2.115.0

Deployment

• Deploy to production (triggers ArgoCD sync after Docker image is published)