@experia-labs/plugin-dev-mcp 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Experia Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,82 @@
+# @experia-labs/plugin-dev-mcp
+
+A Model Context Protocol server that helps developers build plugins for the
+[Experia](https://experialabs.com) platform. Plug it into Claude Code (or any
+MCP-aware IDE) and ask things like:
+
+> "Generate a starter manifest for an organizer-tool plugin called acme.standup."
+>
+> "Validate this manifest" *(paste it)*
+>
+> "Which scope do I need to call POST /messaging/send?"
+>
+> "Why is my webhook returning 401?" *(paste payload + header + secret)*
+
+The same validation rules used by the platform's publish endpoint run inside
+this server — if `validate_manifest` passes locally, your `POST
+/developer-portal/plugins/:id/versions` call will too.
+
+## Install + run via Claude Code
+
+```bash
+claude mcp add experia-plugin-dev -- npx -y @experia-labs/plugin-dev-mcp
+```
+
+Or, while developing locally:
+
+```bash
+cd creatoros-api/packages/plugin-dev-mcp
+npm install
+npm run build
+claude mcp add experia-plugin-dev -- node $(pwd)/dist/cli.js
+```
+
+To use it inside a non-Claude MCP client, point the client at the same binary
+and use stdio transport.
+
+## Tools
+
+| Tool | What it does |
+|------|--------------|
+| `list_scopes` | Every OAuth-style scope, what it grants, which endpoints it unlocks. |
+| `list_events` | Lifecycle + domain webhook events with example payloads. |
+| `list_extension_slots` | Where in the host UI your iframe can render. |
+| `list_api_endpoints` | Every `/plugin-api/v1` endpoint and the scope it requires. |
+| `validate_manifest` | Runs the platform's publish-time validator on your manifest. |
+| `get_starter_manifest` | Scaffolds a manifest (`minimal` / `attendee-app` / `organizer-tool`). |
+| `verify_webhook_signature` | Verifies an `X-Experia-Signature` header against a payload + secret. Use to debug 401/403s. |
+
+## Resources
+
+| URI | Contents |
+|-----|----------|
+| `experia://docs/overview` | Plugin lifecycle, manifests, webhooks, /plugin-api/v1. |
+| `experia://docs/manifest` | Field-by-field manifest reference. |
+| `experia://docs/webhooks` | Signature scheme, replay window, retries. |
+
+## Library use
+
+The same helpers are exported from the package root if you want to use them
+in CI checks or your own tooling:
+
+```ts
+import {
+  validateManifest,
+  generateStarterManifest,
+  verifyWebhookSignature,
+} from '@experia-labs/plugin-dev-mcp';
+```
+
+## Develop
+
+```bash
+npm install
+npm run build       # compile TS
+npm test            # 25+ unit tests
+npm run verify      # tsc --noEmit
+```
+
+Static data files in `src/data/` (scopes, events, slots, API endpoints) must
+stay in sync with their counterparts in `creatoros-api/src/features/plugin-platform/`.
+The `data/registry.spec.ts` tests catch obvious drift; the
+`manifest/validate.spec.ts` tests cover the validator.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { createServer } from './server.js';
+async function main() {
+    const server = createServer();
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((err) => {
+    console.error('experia-plugin-dev-mcp: fatal', err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;IAC7C,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,+BAA+B,EAAE,GAAG,CAAC,CAAC;IACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/data/api-endpoints.d.ts

@@ -0,0 +1,15 @@
+export interface ApiEndpointInfo {
+    method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+    path: string;
+    scope: string;
+    description: string;
+    exampleResponse?: unknown;
+}
+/**
+ * /plugin-api/v1/* endpoints. Bearer token auth (the
+ * `installationToken` delivered in the plugin.installed webhook).
+ * Scope on each endpoint must be present in the granted scope set
+ * or the call returns 403.
+ */
+export declare const PLUGIN_API_ENDPOINTS: ApiEndpointInfo[];
+//# sourceMappingURL=api-endpoints.d.ts.map

package/dist/data/api-endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-endpoints.d.ts","sourceRoot":"","sources":["../../src/data/api-endpoints.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,CAAC;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,eAAe,EA4EjD,CAAC"}

package/dist/data/api-endpoints.js

@@ -0,0 +1,80 @@
+/**
+ * /plugin-api/v1/* endpoints. Bearer token auth (the
+ * `installationToken` delivered in the plugin.installed webhook).
+ * Scope on each endpoint must be present in the granted scope set
+ * or the call returns 403.
+ */
+export const PLUGIN_API_ENDPOINTS = [
+    {
+        method: 'GET',
+        path: '/plugin-api/v1/event',
+        scope: 'event.read',
+        description: 'Returns metadata for the event this installation is bound to.',
+        exampleResponse: {
+            id: 'evt_01HXXX',
+            name: 'Manila Tech Summit 2026',
+            slug: 'manila-tech-summit-2026',
+            startsAt: '2026-06-01T19:00:00.000Z',
+            endsAt: '2026-06-01T23:00:00.000Z',
+            status: 'PUBLISHED',
+            venue: { name: 'SMX Convention', address: 'Pasay City, PH' },
+        },
+    },
+    {
+        method: 'GET',
+        path: '/plugin-api/v1/event/attendees',
+        scope: 'event.attendees.read',
+        description: 'Paginated list of attendees with tickets for the bound event.',
+        exampleResponse: {
+            page: 1,
+            pageSize: 50,
+            total: 1234,
+            items: [
+                { id: 'att_01HXXX', email: 'a@b.com', firstName: 'Ana', lastName: 'Doe' },
+            ],
+        },
+    },
+    {
+        method: 'GET',
+        path: '/plugin-api/v1/event/attendees/:id',
+        scope: 'event.attendees.read',
+        description: 'Single attendee record.',
+    },
+    {
+        method: 'POST',
+        path: '/plugin-api/v1/messaging/send',
+        scope: 'messaging.send',
+        description: 'Send a message to attendees over a single channel. Body: { channel: IN_APP|PUSH|EMAIL, recipients: string[], title?, body, deepLink? }. Subject to plugin-level rate limits (60/min default).',
+    },
+    {
+        method: 'GET',
+        path: '/plugin-api/v1/storage/:key',
+        scope: 'storage.read',
+        description: 'Get a value from the plugin\'s sandboxed KV store for THIS installation.',
+    },
+    {
+        method: 'PUT',
+        path: '/plugin-api/v1/storage/:key',
+        scope: 'storage.write',
+        description: 'Set a value in the plugin\'s sandboxed KV store. Body: { value: any }. 64KB max per key.',
+    },
+    {
+        method: 'DELETE',
+        path: '/plugin-api/v1/storage/:key',
+        scope: 'storage.write',
+        description: 'Delete a key from the plugin\'s sandboxed KV store.',
+    },
+    {
+        method: 'GET',
+        path: '/plugin-api/v1/membership/communities',
+        scope: 'membership.read',
+        description: 'List communities + tiers for the installed organization.',
+    },
+    {
+        method: 'POST',
+        path: '/plugin-api/v1/membership/communities/:slug/prompt',
+        scope: 'membership.subscribe.prompt',
+        description: 'Trigger an in-app/push "subscribe to community" prompt for an attendee.',
+    },
+];
+//# sourceMappingURL=api-endpoints.js.map

package/dist/data/api-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-endpoints.js","sourceRoot":"","sources":["../../src/data/api-endpoints.ts"],"names":[],"mappings":"AAQA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,YAAY;QACnB,WAAW,EAAE,+DAA+D;QAC5E,eAAe,EAAE;YACf,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,0BAA0B;YACpC,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gBAAgB,EAAE;SAC7D;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,+DAA+D;QAC5E,eAAe,EAAE;YACf,IAAI,EAAE,CAAC;YACP,QAAQ,EAAE,EAAE;YACZ,KAAK,EAAE,IAAI;YACX,KAAK,EAAE;gBACL,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;aAC1E;SACF;KACF;IACD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,oCAAoC;QAC1C,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,+LAA+L;KAClM;IACD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,cAAc;QACrB,WAAW,EACT,0EAA0E;KAC7E;IACD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,0FAA0F;KAC7F;IACD;QACE,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,6BAA6B;QACnC,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,qDAAqD;KACnE;IACD;QACE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,uCAAuC;QAC7C,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,0DAA0D;KACxE;IACD;QACE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,oDAAoD;QAC1D,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,yEAAyE;KAC5E;CACF,CAAC"}

package/dist/data/events.d.ts

@@ -0,0 +1,13 @@
+export interface EventInfo {
+    type: string;
+    category: 'lifecycle' | 'domain';
+    description: string;
+    /** Example HTTP body the plugin will receive (truncated for brevity). */
+    examplePayload: Record<string, unknown>;
+}
+export declare const LIFECYCLE_EVENTS: EventInfo[];
+export declare const DOMAIN_EVENTS: EventInfo[];
+export declare const ALL_EVENTS: EventInfo[];
+export declare const VALID_DOMAIN_EVENT_TYPES: string[];
+export declare function isValidDomainEvent(s: string): boolean;
+//# sourceMappingURL=events.d.ts.map

package/dist/data/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../src/data/events.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,WAAW,GAAG,QAAQ,CAAC;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,gBAAgB,EAAE,SAAS,EA4CvC,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,SAAS,EA6DpC,CAAC;AAEF,eAAO,MAAM,UAAU,aAA0C,CAAC;AAElE,eAAO,MAAM,wBAAwB,UAAmC,CAAC;AAEzE,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAErD"}

package/dist/data/events.js

@@ -0,0 +1,110 @@
+// Mirrors creatoros-api/src/features/plugin-platform/events/plugin-events.constants.ts
+export const LIFECYCLE_EVENTS = [
+    {
+        type: 'plugin.installed',
+        category: 'lifecycle',
+        description: 'Fired when an organizer installs the plugin on an event. The payload includes a one-time `installationToken` (Bearer for /plugin-api/v1/*) and `webhookSecret` (HMAC for verifying future deliveries). PERSIST BOTH IMMEDIATELY — they are only delivered once.',
+        examplePayload: {
+            type: 'plugin.installed',
+            eventPluginId: 'epi_01HXXX',
+            orgId: 'org_01HXXX',
+            eventId: 'evt_01HXXX',
+            pluginKey: 'acme.sponsors-lounge',
+            pluginVersion: '1.0.0',
+            config: { theme: 'dark' },
+            grantedScopes: ['event.read', 'event.attendees.read'],
+            installationToken: 'pit_xxxxx',
+            webhookSecret: 'whsec_xxxxx',
+        },
+    },
+    {
+        type: 'plugin.uninstalled',
+        category: 'lifecycle',
+        description: 'Fired when the organizer disables/removes the plugin from an event. After this, the installation token is revoked. Use to clean up plugin-side state.',
+        examplePayload: {
+            type: 'plugin.uninstalled',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+        },
+    },
+    {
+        type: 'plugin.config_updated',
+        category: 'lifecycle',
+        description: 'Fired when the organizer changes plugin config OR when the platform upgrades the pinned plugin version (then `fromVersion`/`toVersion` are present).',
+        examplePayload: {
+            type: 'plugin.config_updated',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            config: { theme: 'light' },
+            fromVersion: '1.0.0',
+            toVersion: '1.1.0',
+        },
+    },
+];
+export const DOMAIN_EVENTS = [
+    {
+        type: 'event.started',
+        category: 'domain',
+        description: 'Fires once when the event\'s startsAt is reached. Use to unlock features.',
+        examplePayload: {
+            type: 'event.started',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            startedAt: '2026-06-01T19:00:00.000Z',
+        },
+    },
+    {
+        type: 'event.ended',
+        category: 'domain',
+        description: 'Fires when the event\'s endsAt is reached. Use to enter wind-down mode.',
+        examplePayload: {
+            type: 'event.ended',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            endedAt: '2026-06-01T22:00:00.000Z',
+        },
+    },
+    {
+        type: 'attendee.registered',
+        category: 'domain',
+        description: 'Fires when an attendee\'s ticket is generated (post-payment).',
+        examplePayload: {
+            type: 'attendee.registered',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            attendeeId: 'att_01HXXX',
+            ticketTypeId: 'tt_01HXXX',
+        },
+    },
+    {
+        type: 'attendee.checked_in',
+        category: 'domain',
+        description: 'Fires when an attendee\'s ticket is scanned at the event.',
+        examplePayload: {
+            type: 'attendee.checked_in',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            attendeeId: 'att_01HXXX',
+            checkedInAt: '2026-06-01T19:12:34.000Z',
+        },
+    },
+    {
+        type: 'membership.subscribed',
+        category: 'domain',
+        description: 'Fires when an attendee subscribes to one of the org\'s communities. Used for community-continuity flows.',
+        examplePayload: {
+            type: 'membership.subscribed',
+            eventPluginId: 'epi_01HXXX',
+            eventId: 'evt_01HXXX',
+            attendeeId: 'att_01HXXX',
+            communitySlug: 'acme-club',
+            tierId: 'tier_01HXXX',
+        },
+    },
+];
+export const ALL_EVENTS = [...LIFECYCLE_EVENTS, ...DOMAIN_EVENTS];
+export const VALID_DOMAIN_EVENT_TYPES = DOMAIN_EVENTS.map((e) => e.type);
+export function isValidDomainEvent(s) {
+    return VALID_DOMAIN_EVENT_TYPES.includes(s);
+}
+//# sourceMappingURL=events.js.map

package/dist/data/events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.js","sourceRoot":"","sources":["../../src/data/events.ts"],"names":[],"mappings":"AAAA,uFAAuF;AAUvF,MAAM,CAAC,MAAM,gBAAgB,GAAgB;IAC3C;QACE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,iQAAiQ;QACnQ,cAAc,EAAE;YACd,IAAI,EAAE,kBAAkB;YACxB,aAAa,EAAE,YAAY;YAC3B,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,sBAAsB;YACjC,aAAa,EAAE,OAAO;YACtB,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE;YACzB,aAAa,EAAE,CAAC,YAAY,EAAE,sBAAsB,CAAC;YACrD,iBAAiB,EAAE,WAAW;YAC9B,aAAa,EAAE,aAAa;SAC7B;KACF;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,uJAAuJ;QACzJ,cAAc,EAAE;YACd,IAAI,EAAE,oBAAoB;YAC1B,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;SACtB;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,WAAW;QACrB,WAAW,EACT,sJAAsJ;QACxJ,cAAc,EAAE;YACd,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,MAAM,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;YAC1B,WAAW,EAAE,OAAO;YACpB,SAAS,EAAE,OAAO;SACnB;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAgB;IACxC;QACE,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2EAA2E;QACxF,cAAc,EAAE;YACd,IAAI,EAAE,eAAe;YACrB,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE,0BAA0B;SACtC;KACF;IACD;QACE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,yEAAyE;QACtF,cAAc,EAAE;YACd,IAAI,EAAE,aAAa;YACnB,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,OAAO,EAAE,0BAA0B;SACpC;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,+DAA+D;QAC5E,cAAc,EAAE;YACd,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,YAAY;YACxB,YAAY,EAAE,WAAW;SAC1B;KACF;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EAAE,2DAA2D;QACxE,cAAc,EAAE;YACd,IAAI,EAAE,qBAAqB;YAC3B,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,YAAY;YACxB,WAAW,EAAE,0BAA0B;SACxC;KACF;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,WAAW,EACT,0GAA0G;QAC5G,cAAc,EAAE;YACd,IAAI,EAAE,uBAAuB;YAC7B,aAAa,EAAE,YAAY;YAC3B,OAAO,EAAE,YAAY;YACrB,UAAU,EAAE,YAAY;YACxB,aAAa,EAAE,WAAW;YAC1B,MAAM,EAAE,aAAa;SACtB;KACF;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,aAAa,CAAC,CAAC;AAElE,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAEzE,MAAM,UAAU,kBAAkB,CAAC,CAAS;IAC1C,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/data/scopes.d.ts

@@ -0,0 +1,10 @@
+export interface ScopeInfo {
+    scope: string;
+    description: string;
+    /** What endpoints under /plugin-api/v1 this scope unlocks. */
+    unlocks: string[];
+}
+export declare const SCOPE_REGISTRY: ScopeInfo[];
+export declare const ALL_SCOPES: string[];
+export declare function isValidScope(s: string): boolean;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/data/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/data/scopes.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,eAAO,MAAM,cAAc,EAAE,SAAS,EAqErC,CAAC;AAEF,eAAO,MAAM,UAAU,UAAqC,CAAC;AAE7D,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAE/C"}

package/dist/data/scopes.js

@@ -0,0 +1,70 @@
+// Mirrors creatoros-api/src/features/plugin-platform/scopes/plugin-scopes.constants.ts
+// Kept self-contained so this MCP server is publishable without the API repo.
+export const SCOPE_REGISTRY = [
+    {
+        scope: 'event.read',
+        description: 'Read event metadata (name, dates, venue, status). Almost every plugin needs this.',
+        unlocks: ['GET /plugin-api/v1/event'],
+    },
+    {
+        scope: 'event.attendees.read',
+        description: 'Read the attendee list for the installed event. Required for directory/networking plugins.',
+        unlocks: [
+            'GET /plugin-api/v1/event/attendees',
+            'GET /plugin-api/v1/event/attendees/:id',
+        ],
+    },
+    {
+        scope: 'event.attendees.write',
+        description: 'Tag/note attendees. Use for CRM-style enrichment plugins. Cannot create or delete attendees.',
+        unlocks: ['PATCH /plugin-api/v1/event/attendees/:id'],
+    },
+    {
+        scope: 'event.tickets.read',
+        description: 'Read ticket types and inventory for the installed event.',
+        unlocks: ['GET /plugin-api/v1/event/tickets'],
+    },
+    {
+        scope: 'attendee.profile.read',
+        description: 'Read the attendee profile of users currently viewing the plugin via iframe. Bound to the iframe JWT, not bulk.',
+        unlocks: ['GET /plugin-api/v1/me'],
+    },
+    {
+        scope: 'attendee.profile.write',
+        description: 'Update the viewing attendee\'s profile fields managed by the plugin. Required for profile-builder plugins (e.g. Networking).',
+        unlocks: ['PATCH /plugin-api/v1/me'],
+    },
+    {
+        scope: 'messaging.send',
+        description: 'Send messages to attendees over IN_APP / PUSH / EMAIL. Subject to per-plugin rate limits.',
+        unlocks: ['POST /plugin-api/v1/messaging/send'],
+    },
+    {
+        scope: 'storage.read',
+        description: 'Read the plugin\'s sandboxed key-value store for this installation.',
+        unlocks: ['GET /plugin-api/v1/storage/:key'],
+    },
+    {
+        scope: 'storage.write',
+        description: 'Write to the plugin\'s sandboxed key-value store for this installation.',
+        unlocks: [
+            'PUT /plugin-api/v1/storage/:key',
+            'DELETE /plugin-api/v1/storage/:key',
+        ],
+    },
+    {
+        scope: 'membership.read',
+        description: 'Read communities and tiers belonging to the installed organization.',
+        unlocks: ['GET /plugin-api/v1/membership/communities'],
+    },
+    {
+        scope: 'membership.subscribe.prompt',
+        description: 'Trigger a "subscribe to community" prompt for the viewing attendee. Used by post-event continuity flows.',
+        unlocks: ['POST /plugin-api/v1/membership/communities/:slug/prompt'],
+    },
+];
+export const ALL_SCOPES = SCOPE_REGISTRY.map((s) => s.scope);
+export function isValidScope(s) {
+    return ALL_SCOPES.includes(s);
+}
+//# sourceMappingURL=scopes.js.map

package/dist/data/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.js","sourceRoot":"","sources":["../../src/data/scopes.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,8EAA8E;AAS9E,MAAM,CAAC,MAAM,cAAc,GAAgB;IACzC;QACE,KAAK,EAAE,YAAY;QACnB,WAAW,EACT,mFAAmF;QACrF,OAAO,EAAE,CAAC,0BAA0B,CAAC;KACtC;IACD;QACE,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EACT,4FAA4F;QAC9F,OAAO,EAAE;YACP,oCAAoC;YACpC,wCAAwC;SACzC;KACF;IACD;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,8FAA8F;QAChG,OAAO,EAAE,CAAC,0CAA0C,CAAC;KACtD;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,WAAW,EAAE,0DAA0D;QACvE,OAAO,EAAE,CAAC,kCAAkC,CAAC;KAC9C;IACD;QACE,KAAK,EAAE,uBAAuB;QAC9B,WAAW,EACT,gHAAgH;QAClH,OAAO,EAAE,CAAC,uBAAuB,CAAC;KACnC;IACD;QACE,KAAK,EAAE,wBAAwB;QAC/B,WAAW,EACT,8HAA8H;QAChI,OAAO,EAAE,CAAC,yBAAyB,CAAC;KACrC;IACD;QACE,KAAK,EAAE,gBAAgB;QACvB,WAAW,EACT,2FAA2F;QAC7F,OAAO,EAAE,CAAC,oCAAoC,CAAC;KAChD;IACD;QACE,KAAK,EAAE,cAAc;QACrB,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,CAAC,iCAAiC,CAAC;KAC7C;IACD;QACE,KAAK,EAAE,eAAe;QACtB,WAAW,EAAE,yEAAyE;QACtF,OAAO,EAAE;YACP,iCAAiC;YACjC,oCAAoC;SACrC;KACF;IACD;QACE,KAAK,EAAE,iBAAiB;QACxB,WAAW,EAAE,qEAAqE;QAClF,OAAO,EAAE,CAAC,2CAA2C,CAAC;KACvD;IACD;QACE,KAAK,EAAE,6BAA6B;QACpC,WAAW,EACT,0GAA0G;QAC5G,OAAO,EAAE,CAAC,yDAAyD,CAAC;KACrE;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAE7D,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC"}

package/dist/data/slots.d.ts

@@ -0,0 +1,9 @@
+export interface SlotInfo {
+    slot: string;
+    rendersIn: string;
+    iframeContext: string;
+    exampleUseCase: string;
+}
+export declare const SLOT_REGISTRY: SlotInfo[];
+export declare const ALL_SLOTS: string[];
+//# sourceMappingURL=slots.d.ts.map

package/dist/data/slots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.d.ts","sourceRoot":"","sources":["../../src/data/slots.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,aAAa,EAAE,QAAQ,EAmCnC,CAAC;AAEF,eAAO,MAAM,SAAS,UAAmC,CAAC"}

package/dist/data/slots.js

@@ -0,0 +1,34 @@
+export const SLOT_REGISTRY = [
+    {
+        slot: 'organizer.event.tabs',
+        rendersIn: 'Per-event editor in the organizer dashboard, as a new tab.',
+        iframeContext: 'Hosted by Creator OS FE. Available URL params: {eventId}, {orgId}, {pluginVersion}.',
+        exampleUseCase: 'Plugin configuration form (e.g. Networking → "Configure quests, leaderboard").',
+    },
+    {
+        slot: 'organizer.dashboard.cards',
+        rendersIn: 'Org-level dashboard home page, as a card.',
+        iframeContext: 'Available URL params: {orgId}.',
+        exampleUseCase: 'Cross-event analytics summary (e.g. "Plugins active across 12 events, 4.2k connections made").',
+    },
+    {
+        slot: 'experia.event.tabs',
+        rendersIn: 'Experia mobile/web app, on the event detail screen.',
+        iframeContext: 'Available URL params: {eventId}, {pluginJwt} (short-lived attendee JWT scoped to the plugin).',
+        exampleUseCase: 'Networking, Live Polls, Sponsor Booths.',
+    },
+    {
+        slot: 'experia.account.cards',
+        rendersIn: 'Experia mobile/web app, on the attendee account screen.',
+        iframeContext: 'Available URL params: {pluginJwt}.',
+        exampleUseCase: '"Your networking profile", "Your collected badges".',
+    },
+    {
+        slot: 'attendee.checkin.actions',
+        rendersIn: 'Event check-in flow, as an action button.',
+        iframeContext: 'Available URL params: {eventId}, {attendeeId}, {pluginJwt}.',
+        exampleUseCase: '"Add to networking directory" prompt at scan time.',
+    },
+];
+export const ALL_SLOTS = SLOT_REGISTRY.map((s) => s.slot);
+//# sourceMappingURL=slots.js.map

package/dist/data/slots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slots.js","sourceRoot":"","sources":["../../src/data/slots.ts"],"names":[],"mappings":"AAOA,MAAM,CAAC,MAAM,aAAa,GAAe;IACvC;QACE,IAAI,EAAE,sBAAsB;QAC5B,SAAS,EAAE,4DAA4D;QACvE,aAAa,EACX,qFAAqF;QACvF,cAAc,EACZ,gFAAgF;KACnF;IACD;QACE,IAAI,EAAE,2BAA2B;QACjC,SAAS,EAAE,2CAA2C;QACtD,aAAa,EAAE,gCAAgC;QAC/C,cAAc,EACZ,gGAAgG;KACnG;IACD;QACE,IAAI,EAAE,oBAAoB;QAC1B,SAAS,EAAE,qDAAqD;QAChE,aAAa,EACX,+FAA+F;QACjG,cAAc,EAAE,yCAAyC;KAC1D;IACD;QACE,IAAI,EAAE,uBAAuB;QAC7B,SAAS,EAAE,yDAAyD;QACpE,aAAa,EAAE,oCAAoC;QACnD,cAAc,EAAE,qDAAqD;KACtE;IACD;QACE,IAAI,EAAE,0BAA0B;QAChC,SAAS,EAAE,2CAA2C;QACtD,aAAa,EAAE,6DAA6D;QAC5E,cAAc,EAAE,oDAAoD;KACrE;CACF,CAAC;AAEF,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export { validateManifest } from './manifest/validate.js';
+export type { ManifestValidationResult } from './manifest/validate.js';
+export { generateStarterManifest } from './manifest/starter.js';
+export type { StarterArgs, StarterFlavor } from './manifest/starter.js';
+export { verifyWebhookSignature } from './webhook/verify.js';
+export type { VerifyWebhookArgs, VerifyWebhookResult, } from './webhook/verify.js';
+export { SCOPE_REGISTRY, ALL_SCOPES } from './data/scopes.js';
+export type { ScopeInfo } from './data/scopes.js';
+export { LIFECYCLE_EVENTS, DOMAIN_EVENTS, ALL_EVENTS, } from './data/events.js';
+export type { EventInfo } from './data/events.js';
+export { SLOT_REGISTRY, ALL_SLOTS } from './data/slots.js';
+export type { SlotInfo } from './data/slots.js';
+export { PLUGIN_API_ENDPOINTS } from './data/api-endpoints.js';
+export type { ApiEndpointInfo } from './data/api-endpoints.js';
+export { createServer } from './server.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,YAAY,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9D,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,10 @@
+// Public exports — re-exported for tests and library consumers.
+export { validateManifest } from './manifest/validate.js';
+export { generateStarterManifest } from './manifest/starter.js';
+export { verifyWebhookSignature } from './webhook/verify.js';
+export { SCOPE_REGISTRY, ALL_SCOPES } from './data/scopes.js';
+export { LIFECYCLE_EVENTS, DOMAIN_EVENTS, ALL_EVENTS, } from './data/events.js';
+export { SLOT_REGISTRY, ALL_SLOTS } from './data/slots.js';
+export { PLUGIN_API_ENDPOINTS } from './data/api-endpoints.js';
+export { createServer } from './server.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAEhE,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAM7D,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,UAAU,GACX,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAG/D,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/dist/manifest/starter.d.ts

@@ -0,0 +1,16 @@
+export type StarterFlavor = 'minimal' | 'attendee-app' | 'organizer-tool';
+export interface StarterArgs {
+    /** Vendor-prefixed key, e.g. "acme.sponsors-lounge". */
+    key: string;
+    /** Display name. */
+    name: string;
+    /** Developer name (org name). */
+    developerName: string;
+    /** Developer contact email. */
+    developerEmail: string;
+    /** Base URL where your plugin is hosted (no trailing slash). */
+    baseUrl: string;
+    flavor?: StarterFlavor;
+}
+export declare function generateStarterManifest(args: StarterArgs): Record<string, unknown>;
+//# sourceMappingURL=starter.d.ts.map

package/dist/manifest/starter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"starter.d.ts","sourceRoot":"","sources":["../../src/manifest/starter.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,cAAc,GAAG,gBAAgB,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,wDAAwD;IACxD,GAAG,EAAE,MAAM,CAAC;IACZ,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,+BAA+B;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiFlF"}