@entrinsik/vite-plugin-informer 2.6.0-beta.1 → 2.6.0-beta.2

package/index.d.ts

@@ -1,9 +1,11 @@
 import type { Plugin } from 'vite';
 
 /**
- * Dev-only binding for a `target: app` dependency slot. Points `request()` at
- * the target app in dev; overrides the manifest `defaultBinding` when both are
- * present.
+ * Dev-only binding for a `target: app` or `target: pack` dependency slot.
+ * Points `request()` at the target app in dev. For app slots it overrides the
+ * manifest `defaultBinding` when both are present; for pack slots it is the
+ * only way to bind — the marketplace pin has no install to resolve against in
+ * dev, so point it at your locally-installed copy of the pack's app.
  *
  * - `app` — the target app (`owner:slug` or UUID). Powers `request()`.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@entrinsik/vite-plugin-informer",
-    "version": "2.6.0-beta.1",
+    "version": "2.6.0-beta.2",
     "description": "Vite plugin and deploy tool for Informer App development",
     "scripts": {
         "test": "node --test"

package/src/agent-dev.js

@@ -29,21 +29,23 @@ async function loadInformerYaml(projectRoot) {
 }
 
 /**
- * Scan the tools/ directory for .js files that export a handler.
+ * Scan the tools/ and mcp/ directories for .js files that export a handler.
+ * Both share one tool namespace; agents may reference tools from either.
  *
  * @param {string} projectRoot
  * @returns {Promise<Array<{ name: string, filePath: string }>>}
  */
 async function scanLocalTools(projectRoot) {
-    const toolsDir = join(projectRoot, 'tools');
-    try {
-        await access(toolsDir);
-    } catch {
-        return [];
-    }
-
     const tools = [];
-    await walkToolFiles(toolsDir, 'tools', tools);
+    for (const dirName of ['tools', 'mcp']) {
+        const toolsDir = join(projectRoot, dirName);
+        try {
+            await access(toolsDir);
+        } catch {
+            continue;
+        }
+        await walkToolFiles(toolsDir, dirName, tools);
+    }
     return tools;
 }
 
@@ -64,7 +66,7 @@ async function walkToolFiles(dir, basePath, results) {
             await walkToolFiles(full, childPath, results);
         } else if (item.endsWith('.js')) {
             const name = childPath
-                .replace(/^tools\//, '')
+                .replace(/^(tools|mcp)\//, '')
                 .replace(/\.js$/, '')
                 .replace(/\//g, '_');
             results.push({ name, filePath: full });

package/src/assemble.js

@@ -15,7 +15,7 @@ import { join, relative, posix } from 'node:path';
  * (server/…, tools/…) — matching how an app's library is structured in Informer.
  */
 const ROOT_CONFIG_FILES = ['informer.yaml', 'data-access.yaml'];
-const SOURCE_DIRS = ['migrations', 'tools', 'server', 'webhooks', 'lib', 'shared'];
+const SOURCE_DIRS = ['migrations', 'tools', 'mcp', 'server', 'webhooks', 'lib', 'shared'];
 
 // Entries never worth shipping in an app's server-side library: OS/editor
 // dotfiles (.DS_Store, .env), nested dependency trees, and test files. Applied

package/src/deploy.js

@@ -105,7 +105,7 @@ export async function deploy({ baseUrl, apiKey, user, pass, distDir, name, descr
     await api.post(`${entityPath}/files/_clear`);
 
     // 6. Upload the app-library file set: dist output at the library root, plus
-    //    informer.yaml / data-access.yaml and the server/tools/migrations/webhooks
+    //    informer.yaml / data-access.yaml and the server/tools/mcp/migrations/webhooks
     //    source trees. Sourced from the shared collectAppFiles() so a deploy and a
     //    marketplace publish package byte-identical contents.
     console.log('Uploading files...');
@@ -160,6 +160,9 @@ export async function deploy({ baseUrl, apiKey, user, pass, distDir, name, descr
                 if (result.tools && result.tools.length > 0) {
                     console.log(`  Registered ${result.tools.length} tool(s): ${result.tools.join(', ')}`);
                 }
+                if (result.mcpTools && result.mcpTools.length > 0) {
+                    console.log(`  Registered ${result.mcpTools.length} MCP tool(s): ${result.mcpTools.join(', ')}`);
+                }
                 if (result.agents && result.agents.length > 0) {
                     console.log(`  Deployed ${result.agents.length} agent(s): ${result.agents.join(', ')}`);
                 }

package/src/dev-dependencies.js

@@ -150,11 +150,13 @@ export function buildDevMessaging(logPrefix = '[app]') {
 // reject the same shapes with the same wording. Keep these in lockstep.
 const DEPENDENCY_NAME_PATTERN = /^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)*$/;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-const VALID_TARGETS = new Set(['dataset', 'query', 'datasource', 'integration', 'app']);
+const VALID_TARGETS = new Set(['dataset', 'query', 'datasource', 'integration', 'app', 'pack']);
 const VALID_RUN_AS = new Set(['user', 'owner']);
 
 // Targets that accept `defaultBinding:` in the manifest — mirrors
 // DEFAULT_BINDING_LOOKUP in deploy.js. All resolve the target under read_access.
+// `pack` is deliberately absent: its identity is the marketplace pin
+// (`pack:` + `requires:`), and the installer consents per instance.
 const DEFAULT_BINDABLE_TARGETS = new Set(['dataset', 'query', 'datasource', 'integration', 'app']);
 
 const METHOD_SURFACE = {
@@ -162,7 +164,8 @@ const METHOD_SURFACE = {
     query: ['execute'],
     datasource: ['query'],
     integration: ['request'],
-    app: ['request']
+    app: ['request'],
+    pack: ['request']
 };
 
 // Cross-app request() method allow-list — mirrors REQUEST_METHODS in
@@ -246,6 +249,11 @@ export function validateDependencies(deps) {
         if (!VALID_RUN_AS.has(runAs)) {
             errors.push(`dependency "${name}": runAs must be 'user' or 'owner' (got "${runAs}")`);
         }
+        // `target: pack` pins marketplace identity at the top level of the
+        // declaration — same check (and wording) as deploy.js.
+        if (decl.target === 'pack' && (typeof decl.pack !== 'string' || typeof decl.requires !== 'string')) {
+            errors.push(`dependency "${name}" (pack) requires "pack: <marketplace slug>" and "requires: <semver range>"`);
+        }
         if (decl.defaultBinding != null) {
             if (!DEFAULT_BINDABLE_TARGETS.has(decl.target)) {
                 // Same rejection the deploy performs — surface it at dev boot
@@ -268,9 +276,12 @@ export function validateDependencies(deps) {
  * the first call reports the slot as unbound — telling the developer to add the
  * thing they think they already added.
  *
- * A binding key must name a declared `target: app` dependency; its value must be
- * a non-empty `owner:slug` string (shorthand for `{ app }`) or an object with a
- * non-empty `app` (the target app, for request()).
+ * A binding key must name a declared `target: app` or `target: pack`
+ * dependency; its value must be a non-empty `owner:slug` string (shorthand for
+ * `{ app }`) or an object with a non-empty `app` (the target app, for
+ * request()). For a pack slot the value points at your locally-installed copy
+ * of the pack's app — dev has no marketplace install to resolve the pin
+ * against, so the developer says where it lives.
  *
  * @param {Object} deps - The raw `dependencies:` object from informer.yaml
  * @param {Object} devBindings - The plugin's `devBindings` option
@@ -285,8 +296,8 @@ export function validateDevBindings(deps, devBindings) {
             errors.push(`devBindings."${name}": no dependency "${name}" is declared in informer.yaml`);
             continue;
         }
-        if (decl.target !== 'app') {
-            errors.push(`devBindings."${name}": only "target: app" dependencies take a devBinding (got "${decl.target}")`);
+        if (decl.target !== 'app' && decl.target !== 'pack') {
+            errors.push(`devBindings."${name}": only "target: app" and "target: pack" dependencies take a devBinding (got "${decl.target}")`);
             continue;
         }
         if (typeof binding === 'string') {
@@ -356,17 +367,20 @@ export function buildDevContext({ deps, apiFetch, devBindings = {}, appFetch = n
         const target = decl.target;
         if (!VALID_TARGETS.has(target)) continue;
 
-        // App slots bind from the plugin's `devBindings` (a human `owner:slug`
-        // pointing request() at the target app), falling back to the manifest
-        // `defaultBinding` UUID like every other target. request() is the only
-        // surface.
-        if (target === 'app') {
-            const fallback = (typeof decl.defaultBinding === 'string' && UUID_PATTERN.test(decl.defaultBinding))
+        // App and pack slots bind from the plugin's `devBindings` (a human
+        // `owner:slug` pointing request() at the target app). App slots fall
+        // back to the manifest `defaultBinding` UUID; pack slots have no
+        // fallback — the pin resolves via marketplace installs, which dev
+        // doesn't have, so the devBinding names the locally-installed app.
+        // request() is the only surface either way.
+        if (target === 'app' || target === 'pack') {
+            const fallback = (target === 'app'
+                && typeof decl.defaultBinding === 'string' && UUID_PATTERN.test(decl.defaultBinding))
                 ? decl.defaultBinding
                 : null;
             const binding = devBindings[name] != null ? devBindings[name] : fallback;
             context[name] = binding
-                ? makeAppDevProxy({ name, binding, appFetch })
+                ? makeAppDevProxy({ name, binding, appFetch, kind: target })
                 : makeUnboundDevProxy({ name, target });
             continue;
         }
@@ -383,7 +397,12 @@ export function buildDevContext({ deps, apiFetch, devBindings = {}, appFetch = n
 }
 
 /**
- * Dev proxy for a `target: app` slot. `request()` is the only surface.
+ * Dev proxy for a `target: app` or `target: pack` slot. `request()` is the
+ * only surface. Pack slots reuse this wholesale — in production the pack
+ * driver resolves its marketplace pin and then delegates the runtime to the
+ * app driver, and the devBinding IS that resolution done by hand. The prod
+ * version gate (pack_dependency_out_of_range) is not emulated: dev has no
+ * pack_install to read a version from.
  *
  * Production runs `request()` through the target's own /view/_/ dispatch, and
  * dev injects into the same route:
@@ -404,29 +423,31 @@ export function buildDevContext({ deps, apiFetch, devBindings = {}, appFetch = n
  *   manifest defaultBinding UUID). A bare string is shorthand for `{ app }`.
  * @param {Function|null} args.appFetch - token-authed fetch, or null when
  *   INFORMER_APP_TOKEN is unset.
+ * @param {'app'|'pack'} [args.kind] - slot flavor, for error labels and the
+ *   structured resourceType guest code branches on.
  */
-function makeAppDevProxy({ name, binding, appFetch }) {
+function makeAppDevProxy({ name, binding, appFetch, kind = 'app' }) {
     const { app } = resolveAppBinding(binding);
 
     return {
         async request(payload) {
             if (!app) {
                 throw new Error(
-                    `Dependency "${name}" (app): dev request() needs the target app — set devBindings.${name}.app (e.g. 'admin:kanban')`
+                    `Dependency "${name}" (${kind}): dev request() needs the target app — set devBindings.${name}.app (e.g. 'admin:kanban')`
                 );
             }
             if (!appFetch) {
                 throw new Error(
-                    `Dependency "${name}" (app): dev request() needs a Bearer credential — the target's /view/_/ dispatch does not accept basic auth. Run in API-key mode (INFORMER_API_KEY), or create a token (Admin → Tokens, or POST /api/tokens) and set INFORMER_APP_TOKEN in .env`
+                    `Dependency "${name}" (${kind}): dev request() needs a Bearer credential — the target's /view/_/ dispatch does not accept basic auth. Run in API-key mode (INFORMER_API_KEY), or create a token (Admin → Tokens, or POST /api/tokens) and set INFORMER_APP_TOKEN in .env`
                 );
             }
             const { method = 'GET', url, params, data } = payload || {};
             const httpMethod = String(method).toUpperCase();
             if (!REQUEST_METHODS.includes(httpMethod)) {
-                throw new Error(`Dependency "${name}" (app): unsupported method "${method}"`);
+                throw new Error(`Dependency "${name}" (${kind}): unsupported method "${method}"`);
             }
             if (!url || typeof url !== 'string') {
-                throw new Error(`Dependency "${name}" (app): request({ url }) requires the target route path`);
+                throw new Error(`Dependency "${name}" (${kind}): request({ url }) requires the target route path`);
             }
             const path = url.replace(/^\/+/, '');
             const search = params ? `?${new URLSearchParams(params).toString()}` : '';
@@ -440,17 +461,17 @@ function makeAppDevProxy({ name, binding, appFetch }) {
             try {
                 resolvedPath = new URL(`${targetPrefix}${path}${search}`, 'http://localhost').pathname;
             } catch {
-                throw new Error(`Dependency "${name}" (app): request({ url }) is malformed`);
+                throw new Error(`Dependency "${name}" (${kind}): request({ url }) is malformed`);
             }
             if (!resolvedPath.startsWith(targetPrefix)) {
-                throw new Error(`Dependency "${name}" (app): request({ url }) must not escape the target app with ".." path segments`);
+                throw new Error(`Dependency "${name}" (${kind}): request({ url }) must not escape the target app with ".." path segments`);
             }
             const { status, body, contentType } = await appFetch(
                 `apps/${encodeURIComponent(app)}/view/_/${path}${search}`,
                 { method: httpMethod, body: data }
             );
             if (status >= 400) {
-                throw dependencyCallError(name, 'app', status, body);
+                throw dependencyCallError(name, kind, status, body);
             }
             // Success-envelope contract mirrors entity-type/app.js: JSON → parsed
             // body; non-JSON text/HTML → text envelope; binary → not emulatable
@@ -458,7 +479,7 @@ function makeAppDevProxy({ name, binding, appFetch }) {
             // silently hand back mangled bytes.
             if (isBinaryContentType(contentType)) {
                 throw new Error(
-                    `Dependency "${name}" (app): the dev proxy can't return binary responses yet (upstream content-type "${contentType}"). Test binary endpoints against a deployed build.`
+                    `Dependency "${name}" (${kind}): the dev proxy can't return binary responses yet (upstream content-type "${contentType}"). Test binary endpoints against a deployed build.`
                 );
             }
             // (An empty content-type gets the text envelope too, matching prod.)
@@ -514,10 +535,14 @@ function makeDevProxy({ name, target, targetId, apiFetch }) {
 function makeUnboundDevProxy({ name, target }) {
     const methods = METHOD_SURFACE[target] || [];
     // App slots bind via devBindings (a dev-local owner:slug) or a manifest
-    // defaultBinding UUID, so point at whichever the reader is likelier to want.
+    // defaultBinding UUID; pack slots ONLY via devBindings (the pin has no
+    // marketplace install to resolve against in dev). Point at whichever the
+    // reader is likelier to want.
     const hint = target === 'app'
         ? `add \`devBindings: { ${name}: { app: '<owner:slug>' } }\` to the informer() plugin options in vite.config.js, or \`defaultBinding: <uuid>\` to its entry in informer.yaml`
-        : 'add `defaultBinding: <uuid>` to its entry in informer.yaml';
+        : target === 'pack'
+            ? `add \`devBindings: { ${name}: { app: '<owner:slug>' } }\` to the informer() plugin options in vite.config.js, pointing at your locally-installed copy of the pack`
+            : 'add `defaultBinding: <uuid>` to its entry in informer.yaml';
     const proxy = {};
     for (const method of methods) {
         proxy[method] = async () => {

package/src/index.js

@@ -45,8 +45,10 @@ async function writeAppDepTypes (projectRoot, dts) {
  * @param {Object} [options]
  * @param {{ report?: object, theme?: 'light'|'dark', roles?: string[] }} [options.mock]
  *   window.__INFORMER__ mock injected in dev.
- * @param {Object} [options.devBindings] - dev bindings for `target: app` deps,
- *   which can't be defaultBound in the manifest. See AppDevBinding in index.d.ts.
+ * @param {Object} [options.devBindings] - dev bindings for `target: app` and
+ *   `target: pack` deps. App slots can't be defaultBound in the manifest; pack
+ *   slots resolve their marketplace pin via installs dev doesn't have, so the
+ *   binding names the locally-installed app. See AppDevBinding in index.d.ts.
  * @param {Object} [options.proxy] - extra Vite proxy options merged onto /api.
  * @returns {import('vite').Plugin}
  */
@@ -184,9 +186,9 @@ export default function informer(options = {}) {
                 console.error(`[informer] vite.config.js: ${message}`);
             }
 
-            // Generate .d.ts types for bound `target: app` deps from their
-            // published OpenAPI docs, so server/ handlers get typed
-            // context.<slot>.request()/query() autocomplete.
+            // Generate .d.ts types for bound `target: app` / `target: pack`
+            // deps from their published OpenAPI docs, so server/ handlers get
+            // typed context.<slot>.request()/query() autocomplete.
             try {
                 // A bare string devBinding is shorthand for { app } — request()
                 // works under it, so its types must generate too, not just for
@@ -194,7 +196,7 @@ export default function informer(options = {}) {
                 const boundAppRef = (name) =>
                     resolveAppBinding(options.devBindings && options.devBindings[name]).app;
                 const appSlots = Object.entries(deps).filter(
-                    ([name, decl]) => decl && decl.target === 'app' && boundAppRef(name)
+                    ([name, decl]) => decl && (decl.target === 'app' || decl.target === 'pack') && boundAppRef(name)
                 );
                 if (appSlots.length) {
                     const specs = {};
@@ -257,8 +259,9 @@ export default function informer(options = {}) {
                     devWorkspaceId,
                     projectRoot,
                     roles: (options.mock && options.mock.roles) || [],
-                    // Dev-only bindings for `target: app` slots (override the
-                    // manifest defaultBinding for local dev). Shape:
+                    // Dev-only bindings for `target: app` / `target: pack`
+                    // slots (app: overrides the manifest defaultBinding; pack:
+                    // names the locally-installed pack app). Shape:
                     //   devBindings: { kanban: { app: 'admin:kanban' } }
                     devBindings: options.devBindings || {},
                     appToken
@@ -266,11 +269,12 @@ export default function informer(options = {}) {
                 server.middlewares.use('/api/_server', serverRoutes);
             }
 
-            // Mount agent dev middleware if tools/ or informer.yaml agents exist
+            // Mount agent dev middleware if tools/, mcp/, or informer.yaml agents exist
             const toolsDir = resolve(projectRoot, 'tools');
+            const mcpDir = resolve(projectRoot, 'mcp');
             const yamlPath = resolve(projectRoot, 'informer.yaml');
 
-            if (existsSync(toolsDir) || existsSync(yamlPath)) {
+            if (existsSync(toolsDir) || existsSync(mcpDir) || existsSync(yamlPath)) {
                 const agentDev = createAgentMiddleware(server, {
                     serverOrigin,
                     authHeader,