@extenshi/mcp 0.4.0 → 0.5.1

package/README.md

@@ -15,8 +15,9 @@ enforces it too.
 
 1. Sign up at **https://auth.extenshi.io/signup**
 2. Create a key at **https://dojo.extenshi.io/api-keys**
-3. Provide it via the `EXTENSHI_API_KEY` environment variable (or run `extenshi login`,
-   which the MCP server reads from `~/.extenshi/config.json`).
+3. Provide it via the `EXTENSHI_API_KEY` environment variable (or run
+   `npx @extenshi/cli@latest login`, which the MCP server reads from
+   `~/.extenshi/config.json`).
 
 ## Configure your MCP client
 
@@ -40,10 +41,12 @@ enforces it too.
 | `get_extension` | Full catalog detail for one extension — by numeric catalog ID **or** by its store id (see below) | 1 read |
 | `get_reviews` | Paginated Firefox/Edge user reviews (rating, short excerpt, date, language) + a store-level aggregate (rating, count, reviews link) — Chrome Web Store review rows excluded (aggregate is the only public content for Chrome); reviewer identity omitted; sort by recent or rating | 1 read |
 | `get_security` | Risk score + finding counts + top grouped findings (reads existing scans) | 3 reads |
+| `get_risk_by_store_ids` | Safety scores for **up to 40** extensions in one call, by store id — for auditing a list of installed extensions instead of calling `get_security` per extension | 1 read per call |
 | `market_overview` | Catalog-wide market intelligence with no args (totals, store split, category tree, and the extended breakdown — MV2/MV3, sensitive permissions, risk tiers, trader status, recency, reviews); pass a `query` to scope facets to a search | 1 read |
 | `get_credit_balance` | Remaining credits across every pool (read / scan / icon / inventory), so an agent can size a batch before running it instead of hitting a mid-batch limit | Free |
 | `search_docs` | Search the Extenshi docs + `@extenshi/cli` reference so the assistant can quote exact commands | Free (no key) |
-| `generate_icon_workflow` | Icon design requirements + the local agent-draws-SVG → `extenshi icon preview` → export workflow | Free (no key) |
+| `generate_icon_workflow` | Icon design requirements + the local agent-draws-SVG → `npx @extenshi/cli@latest icon preview` → export workflow | Free (no key) |
+| `generate_welcome_page_workflow` | Design brief for the post-install welcome page: the one action it must drive, which illustrations to produce, where to place click markers, and the block JSON to return | Free (no key) |
 | `scan_extension` | Pre-publish security scan of a local artifact (.zip/.crx/.xpi), with live progress | 1 scan |
 | `publish_extension` | Publish to Chrome/Firefox/Edge with your own store credentials (fully local) | Free |
 

package/dist/bff.d.ts

@@ -70,6 +70,30 @@ export interface Bff {
             store: 'CHROME' | 'FIREFOX' | 'EDGE';
         }>;
     }): Promise<unknown>;
+    /**
+     * The caller's OWN extension projects. FREE — credits pay for catalog data
+     * about other people's extensions, never for reading your own work.
+     */
+    listMyProjects(): Promise<unknown>;
+    /**
+     * One own project as state an agent can act on: chosen extension types, the
+     * manifest.json that project produces per browser, live hosted URLs, and an
+     * index of saved tool state. FREE, same reasoning. `includeToolStates` inlines
+     * named payloads; without it the response lists what exists and how big.
+     */
+    getMyProjectState(input: {
+        projectId: string;
+        includeToolStates?: string[];
+    }): Promise<unknown>;
+    /**
+     * The starter extension one own project produces, as files — the same set the
+     * site commits and packs into its download. FREE, same reasoning. One browser
+     * per call: the manifests differ between them and the rest does not.
+     */
+    getMyProjectScaffold(input: {
+        projectId: string;
+        browser?: string;
+    }): Promise<unknown>;
 }
 /** Build a BFF client from a static `ek_…` key (stdio path). */
 export declare function makeBff(bffUrl: string, apiKey: string): Bff;

package/dist/bff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bff.d.ts","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IAC1B,2GAA2G;IAC3G,SAAS,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,GAAG;IACnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,2EAA2E;IAC3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrD,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,sGAAsG;IACtG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,2DAA2D;IAC3D,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACnC,yFAAyF;IACzF,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAChD;;;;OAIG;IACH,mBAAmB,CAAC,KAAK,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;KACrC,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC;;;;;OAKG;IACH,uBAAuB,CAAC,KAAK,EAAE;QAC9B,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAC5E,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACpB;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CA0B/F"}
+{"version":3,"file":"bff.d.ts","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IAC1B,2GAA2G;IAC3G,SAAS,EAAE,MAAM,CAAA;IACjB,iGAAiG;IACjG,aAAa,EAAE,MAAM,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;CAChB;AAED,kFAAkF;AAClF,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;IAChB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;IACrB,UAAU,EAAE,MAAM,CAAA;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;CACpC;AAED,MAAM,WAAW,GAAG;IACnB,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAClE,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,2EAA2E;IAC3E,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5D,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACtD,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACrD,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,sGAAsG;IACtG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,2DAA2D;IAC3D,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IACnC,yFAAyF;IACzF,mBAAmB,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAChD;;;;OAIG;IACH,mBAAmB,CAAC,KAAK,EAAE;QAC1B,OAAO,EAAE,MAAM,CAAA;QACf,KAAK,CAAC,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;KACrC,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAA;IAChC;;;;;OAKG;IACH,uBAAuB,CAAC,KAAK,EAAE;QAC9B,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAA;SAAE,CAAC,CAAA;KAC5E,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACpB;;;OAGG;IACH,cAAc,IAAI,OAAO,CAAC,OAAO,CAAC,CAAA;IAClC;;;;;OAKG;IACH,iBAAiB,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/F;;;;OAIG;IACH,oBAAoB,CAAC,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACtF;AAED,gEAAgE;AAChE,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,GAAG,CAE3D;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CA6B/F"}

package/dist/bff.js

@@ -47,6 +47,9 @@ export function makeBffWithAuth(bffUrl, authHeader) {
         getApiCallerBalance: () => client.cli.getApiCallerBalance.query(),
         resolveExtensionRef: (input) => client.catalog.resolveExtensionRef.query(input),
         getSecuritySummaryBatch: (input) => client.security.getSecuritySummaryBatch.query(input),
+        listMyProjects: () => client.devProject.agentListProjects.query(),
+        getMyProjectState: (input) => client.devProject.agentGetProjectState.query(input),
+        getMyProjectScaffold: (input) => client.devProject.agentGetProjectScaffold.query(input),
     };
 }
 //# sourceMappingURL=bff.js.map

package/dist/bff.js.map

@@ -1 +1 @@
-{"version":3,"file":"bff.js","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAgE9D,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc;IACrD,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAA0C;IACzF,MAAM,MAAM,GAAkB,gBAAgB,CAAC;QAC9C,KAAK,EAAE;YACN,aAAa,CAAC;gBACb,GAAG,EAAE,GAAG,MAAM,WAAW;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC;aAC5D,CAAC;SACF;KACD,CAAC,CAAA;IAEF,uEAAuE;IACvE,mFAAmF;IACnF,OAAO;QACN,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;QACzE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QACzE,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACxF,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACtF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACvE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC/C,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE;QAC7E,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;QAC7D,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/E,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;KACxF,CAAA;AACF,CAAC"}
+{"version":3,"file":"bff.js","sourceRoot":"","sources":["../src/bff.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAkF9D,gEAAgE;AAChE,MAAM,UAAU,OAAO,CAAC,MAAc,EAAE,MAAc;IACrD,OAAO,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,UAAU,MAAM,EAAE,CAAC,CAAA;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,UAA0C;IACzF,MAAM,MAAM,GAAkB,gBAAgB,CAAC;QAC9C,KAAK,EAAE;YACN,aAAa,CAAC;gBACb,GAAG,EAAE,GAAG,MAAM,WAAW;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,UAAU,EAAE,EAAE,CAAC;aAC5D,CAAC;SACF;KACD,CAAC,CAAA;IAEF,uEAAuE;IACvE,mFAAmF;IACnF,OAAO;QACN,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC;QACzE,gBAAgB,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC;QACvE,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC;QACzE,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACxF,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;QACtF,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC;QACvE,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,EAAE;QAC/C,uBAAuB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE;QAC7E,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;QAC7D,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACjE,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;QAC/E,uBAAuB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;QACxF,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,iBAAiB,CAAC,KAAK,EAAE;QACjE,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC;QACjF,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC;KACvF,CAAA;AACF,CAAC"}

package/dist/extension-templates.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Extension templates — the "what kind of extension is this?" taxonomy.
+ *
+ * A template is not a folder of files to copy. It is a small set of claims
+ * about the extension's shape: which manifest components it cannot work
+ * without, which permissions those components force, and which files the
+ * scaffold has to write so the manifest does not point at something that isn't
+ * there. Everything downstream — the picker in the manifest generator, the
+ * locked checkboxes, the scaffolded file set, and (next phase) the MCP tool
+ * that hands this catalog to a developer's own agent — reads THIS module.
+ *
+ * It lives in shared-types rather than in dojo because the readers span
+ * packages: the website, catalog-bff (answering a developer's own agent), and
+ * the published `@extenshi/mcp` package, whose tool tells an agent what kinds of
+ * extension exist and what each costs in permissions. All three must give the
+ * same answer.
+ *
+ * SELF-CONTAINED ON PURPOSE — no imports, so it can be copied verbatim into
+ * `@extenshi/mcp`, which cannot depend on unpublished workspace packages (same
+ * constraint and same solution as welcome-agent-brief.ts).
+ *
+ * SINGLE SOURCE, TWO COPIES, byte-identical:
+ *   shared-types/extension-templates.ts            ← canonical
+ *   tools/extenshi-mcp/src/extension-templates.ts  ← copy, pinned by a test
+ * Edit the canonical file and copy it over; the sync test in the MCP package
+ * fails on any divergence inside the monorepo and skips in the npm tarball.
+ *
+ * Templates COMBINE. A side panel with a content script is one extension with
+ * two capabilities, not a fifth template — the picker is multi-select and every
+ * helper here takes a list and unions the result. That is why requirements are
+ * expressed as components + permissions rather than as whole manifests.
+ */
+export declare const EXTENSION_TEMPLATE_IDS: readonly ["popup", "sidepanel", "content", "overlay"];
+export type ExtensionTemplateId = (typeof EXTENSION_TEMPLATE_IDS)[number];
+/**
+ * The template applied when a project has never picked one.
+ *
+ * `popup` is deliberately the same shape the scaffold produced before templates
+ * existed, so an old project regenerates byte-for-byte what it did yesterday.
+ */
+export declare const DEFAULT_EXTENSION_TEMPLATE: ExtensionTemplateId;
+/**
+ * Manifest components a template can require.
+ *
+ * These are the things the UI can lock: a side-panel extension whose
+ * `side_panel` key is turned off is not a side-panel extension, it is a broken
+ * one. Each maps to a group of fields in the manifest draft.
+ */
+export declare const EXTENSION_TEMPLATE_COMPONENTS: readonly ["action", "sidePanel", "contentScript"];
+export type ExtensionTemplateComponent = (typeof EXTENSION_TEMPLATE_COMPONENTS)[number];
+/** Where scaffolded source goes, so the manifest and the file writer agree. */
+export declare const EXTENSION_TEMPLATE_SOURCE_DIR = "src";
+/**
+ * The background service worker every template gets, template or not.
+ *
+ * It is not part of any one template because it carries the integration the
+ * whole product is built around: `setUninstallURL` must be registered at
+ * startup, and a template that skipped the background script would silently
+ * ship an extension that can never report why someone uninstalled it.
+ */
+export declare const EXTENSION_BACKGROUND_PATH = "src/background.js";
+export interface ExtensionTemplate {
+    id: ExtensionTemplateId;
+    label: string;
+    /** One line on the picker card: what this kind of extension is for. */
+    summary: string;
+    /** Components locked on while this template is selected. */
+    requires: readonly ExtensionTemplateComponent[];
+    /**
+     * Permissions the manifest cannot drop while this template is selected.
+     *
+     * Chromium vocabulary. Firefox reaches the same capability through a
+     * different manifest key and needs no permission for it (`sidebar_action`
+     * instead of `sidePanel` + `side_panel`), so a per-browser manifest builder
+     * is expected to translate rather than to emit these verbatim.
+     */
+    requiredPermissions: readonly string[];
+    /** Pre-ticked because the template usually needs them — always removable. */
+    recommendedPermissions: readonly string[];
+    /** Repo-relative file the required component points at. */
+    entry: string;
+    /** Every file the scaffold writes for this template, `entry` included. */
+    emits: readonly string[];
+    /** Seed match patterns, for the templates whose component is a content script. */
+    defaultMatches?: readonly string[];
+}
+export declare const EXTENSION_TEMPLATE_CATALOG: readonly ExtensionTemplate[];
+export declare function isExtensionTemplateId(value: unknown): value is ExtensionTemplateId;
+export declare function getExtensionTemplate(id: ExtensionTemplateId): ExtensionTemplate;
+/**
+ * Clean a persisted or client-supplied list into templates we know.
+ *
+ * Saved tool state is free-form JSON written by whatever build was live at the
+ * time, so an unknown id is expected rather than exceptional: it is dropped,
+ * not thrown on. Order follows the catalog so two projects that picked the same
+ * set produce the same manifest, and duplicates collapse.
+ */
+export declare function normalizeExtensionTemplates(value: unknown): ExtensionTemplateId[];
+/** The selection to build with: what was picked, or the default when nothing was. */
+export declare function effectiveExtensionTemplates(value: unknown): ExtensionTemplateId[];
+/** Permissions the selection forces into the manifest (locked in the UI). */
+export declare function extensionTemplateRequiredPermissions(ids: readonly ExtensionTemplateId[]): string[];
+/** Permissions ticked when a template is picked, minus the ones already forced. */
+export declare function extensionTemplateRecommendedPermissions(ids: readonly ExtensionTemplateId[]): string[];
+/** Components the selection locks on. */
+export declare function extensionTemplateComponents(ids: readonly ExtensionTemplateId[]): ExtensionTemplateComponent[];
+/** Templates whose component is a content script, in catalog order. */
+export declare function extensionTemplatesWithContentScripts(ids: readonly ExtensionTemplateId[]): ExtensionTemplate[];
+/** Every file the scaffold writes for a selection, background script included. */
+export declare function extensionTemplateFiles(ids: readonly ExtensionTemplateId[]): string[];
+//# sourceMappingURL=extension-templates.d.ts.map

package/dist/extension-templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-templates.d.ts","sourceRoot":"","sources":["../src/extension-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,eAAO,MAAM,sBAAsB,uDAAwD,CAAA;AAC3F,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEzE;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,mBAA6B,CAAA;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,mDAAoD,CAAA;AAC9F,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,6BAA6B,CAAC,CAAC,MAAM,CAAC,CAAA;AAEvF,+EAA+E;AAC/E,eAAO,MAAM,6BAA6B,QAAQ,CAAA;AAElD;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,sBAAmD,CAAA;AAEzF,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,mBAAmB,CAAA;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,uEAAuE;IACvE,OAAO,EAAE,MAAM,CAAA;IACf,4DAA4D;IAC5D,QAAQ,EAAE,SAAS,0BAA0B,EAAE,CAAA;IAC/C;;;;;;;OAOG;IACH,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,6EAA6E;IAC7E,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAA;IACzC,2DAA2D;IAC3D,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACxB,kFAAkF;IAClF,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,eAAO,MAAM,0BAA0B,EAAE,SAAS,iBAAiB,EAoDlE,CAAA;AAMD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,mBAAmB,CAElF;AAED,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,mBAAmB,GAAG,iBAAiB,CAM/E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,EAAE,CAIjF;AAED,qFAAqF;AACrF,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,EAAE,CAGjF;AAeD,6EAA6E;AAC7E,wBAAgB,oCAAoC,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAElG;AAED,mFAAmF;AACnF,wBAAgB,uCAAuC,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAGrG;AAED,yCAAyC;AACzC,wBAAgB,2BAA2B,CAC1C,GAAG,EAAE,SAAS,mBAAmB,EAAE,GACjC,0BAA0B,EAAE,CAQ9B;AAED,uEAAuE;AACvE,wBAAgB,oCAAoC,CACnD,GAAG,EAAE,SAAS,mBAAmB,EAAE,GACjC,iBAAiB,EAAE,CAErB;AAED,kFAAkF;AAClF,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,SAAS,mBAAmB,EAAE,GAAG,MAAM,EAAE,CAEpF"}

package/dist/extension-templates.js

@@ -0,0 +1,182 @@
+/**
+ * Extension templates — the "what kind of extension is this?" taxonomy.
+ *
+ * A template is not a folder of files to copy. It is a small set of claims
+ * about the extension's shape: which manifest components it cannot work
+ * without, which permissions those components force, and which files the
+ * scaffold has to write so the manifest does not point at something that isn't
+ * there. Everything downstream — the picker in the manifest generator, the
+ * locked checkboxes, the scaffolded file set, and (next phase) the MCP tool
+ * that hands this catalog to a developer's own agent — reads THIS module.
+ *
+ * It lives in shared-types rather than in dojo because the readers span
+ * packages: the website, catalog-bff (answering a developer's own agent), and
+ * the published `@extenshi/mcp` package, whose tool tells an agent what kinds of
+ * extension exist and what each costs in permissions. All three must give the
+ * same answer.
+ *
+ * SELF-CONTAINED ON PURPOSE — no imports, so it can be copied verbatim into
+ * `@extenshi/mcp`, which cannot depend on unpublished workspace packages (same
+ * constraint and same solution as welcome-agent-brief.ts).
+ *
+ * SINGLE SOURCE, TWO COPIES, byte-identical:
+ *   shared-types/extension-templates.ts            ← canonical
+ *   tools/extenshi-mcp/src/extension-templates.ts  ← copy, pinned by a test
+ * Edit the canonical file and copy it over; the sync test in the MCP package
+ * fails on any divergence inside the monorepo and skips in the npm tarball.
+ *
+ * Templates COMBINE. A side panel with a content script is one extension with
+ * two capabilities, not a fifth template — the picker is multi-select and every
+ * helper here takes a list and unions the result. That is why requirements are
+ * expressed as components + permissions rather than as whole manifests.
+ */
+export const EXTENSION_TEMPLATE_IDS = ['popup', 'sidepanel', 'content', 'overlay'];
+/**
+ * The template applied when a project has never picked one.
+ *
+ * `popup` is deliberately the same shape the scaffold produced before templates
+ * existed, so an old project regenerates byte-for-byte what it did yesterday.
+ */
+export const DEFAULT_EXTENSION_TEMPLATE = 'popup';
+/**
+ * Manifest components a template can require.
+ *
+ * These are the things the UI can lock: a side-panel extension whose
+ * `side_panel` key is turned off is not a side-panel extension, it is a broken
+ * one. Each maps to a group of fields in the manifest draft.
+ */
+export const EXTENSION_TEMPLATE_COMPONENTS = ['action', 'sidePanel', 'contentScript'];
+/** Where scaffolded source goes, so the manifest and the file writer agree. */
+export const EXTENSION_TEMPLATE_SOURCE_DIR = 'src';
+/**
+ * The background service worker every template gets, template or not.
+ *
+ * It is not part of any one template because it carries the integration the
+ * whole product is built around: `setUninstallURL` must be registered at
+ * startup, and a template that skipped the background script would silently
+ * ship an extension that can never report why someone uninstalled it.
+ */
+export const EXTENSION_BACKGROUND_PATH = `${EXTENSION_TEMPLATE_SOURCE_DIR}/background.js`;
+export const EXTENSION_TEMPLATE_CATALOG = [
+    {
+        id: 'popup',
+        label: 'Popup',
+        summary: 'Opens a small window from the toolbar icon. The default shape for a self-contained tool.',
+        requires: ['action'],
+        // A popup needs nothing. Saying so is the point: our own store-compliance
+        // advice is "ask for the minimum", and a starter that pads the manifest to
+        // look substantial teaches the opposite on day one.
+        requiredPermissions: [],
+        recommendedPermissions: ['storage'],
+        entry: `${EXTENSION_TEMPLATE_SOURCE_DIR}/popup.html`,
+        emits: [`${EXTENSION_TEMPLATE_SOURCE_DIR}/popup.html`],
+    },
+    {
+        id: 'sidepanel',
+        label: 'Side panel',
+        summary: 'Opens a panel docked beside the page, which stays open while the user browses.',
+        requires: ['sidePanel', 'action'],
+        requiredPermissions: ['sidePanel'],
+        recommendedPermissions: [],
+        entry: `${EXTENSION_TEMPLATE_SOURCE_DIR}/sidepanel.html`,
+        emits: [
+            `${EXTENSION_TEMPLATE_SOURCE_DIR}/sidepanel.html`,
+            `${EXTENSION_TEMPLATE_SOURCE_DIR}/sidepanel.js`,
+        ],
+    },
+    {
+        id: 'content',
+        label: 'Page enhancer',
+        summary: 'Runs inside specific sites you list and changes what is already on the page.',
+        requires: ['contentScript'],
+        requiredPermissions: [],
+        recommendedPermissions: [],
+        entry: `${EXTENSION_TEMPLATE_SOURCE_DIR}/content.js`,
+        emits: [`${EXTENSION_TEMPLATE_SOURCE_DIR}/content.js`],
+        defaultMatches: ['https://example.com/*'],
+    },
+    {
+        id: 'overlay',
+        label: 'In-page assistant',
+        summary: 'Adds your own UI on top of any site — a form filler, a password helper, a clipper.',
+        requires: ['contentScript'],
+        requiredPermissions: [],
+        // An assistant that cannot remember anything between pages is a demo, so
+        // storage is ticked — but it stays removable, because an overlay that only
+        // reformats what is on screen genuinely does not need it.
+        recommendedPermissions: ['storage'],
+        entry: `${EXTENSION_TEMPLATE_SOURCE_DIR}/overlay.js`,
+        emits: [`${EXTENSION_TEMPLATE_SOURCE_DIR}/overlay.js`],
+        defaultMatches: ['<all_urls>'],
+    },
+];
+const BY_ID = new Map(EXTENSION_TEMPLATE_CATALOG.map((t) => [t.id, t]));
+export function isExtensionTemplateId(value) {
+    return typeof value === 'string' && BY_ID.has(value);
+}
+export function getExtensionTemplate(id) {
+    const template = BY_ID.get(id);
+    // Unreachable through the type, but this module is also read from persisted
+    // JSON — throwing here beats returning undefined into a manifest builder.
+    if (!template)
+        throw new Error(`Unknown extension template: ${id}`);
+    return template;
+}
+/**
+ * Clean a persisted or client-supplied list into templates we know.
+ *
+ * Saved tool state is free-form JSON written by whatever build was live at the
+ * time, so an unknown id is expected rather than exceptional: it is dropped,
+ * not thrown on. Order follows the catalog so two projects that picked the same
+ * set produce the same manifest, and duplicates collapse.
+ */
+export function normalizeExtensionTemplates(value) {
+    if (!Array.isArray(value))
+        return [];
+    const picked = new Set(value.filter(isExtensionTemplateId));
+    return EXTENSION_TEMPLATE_CATALOG.filter((t) => picked.has(t.id)).map((t) => t.id);
+}
+/** The selection to build with: what was picked, or the default when nothing was. */
+export function effectiveExtensionTemplates(value) {
+    const templates = normalizeExtensionTemplates(value);
+    return templates.length ? templates : [DEFAULT_EXTENSION_TEMPLATE];
+}
+function unionOf(ids, pick) {
+    const out = [];
+    for (const id of ids) {
+        for (const value of pick(getExtensionTemplate(id))) {
+            if (!out.includes(value))
+                out.push(value);
+        }
+    }
+    return out;
+}
+/** Permissions the selection forces into the manifest (locked in the UI). */
+export function extensionTemplateRequiredPermissions(ids) {
+    return unionOf(ids, (t) => t.requiredPermissions);
+}
+/** Permissions ticked when a template is picked, minus the ones already forced. */
+export function extensionTemplateRecommendedPermissions(ids) {
+    const required = extensionTemplateRequiredPermissions(ids);
+    return unionOf(ids, (t) => t.recommendedPermissions).filter((p) => !required.includes(p));
+}
+/** Components the selection locks on. */
+export function extensionTemplateComponents(ids) {
+    const out = [];
+    for (const id of ids) {
+        for (const component of getExtensionTemplate(id).requires) {
+            if (!out.includes(component))
+                out.push(component);
+        }
+    }
+    return out;
+}
+/** Templates whose component is a content script, in catalog order. */
+export function extensionTemplatesWithContentScripts(ids) {
+    return ids.map(getExtensionTemplate).filter((t) => t.requires.includes('contentScript'));
+}
+/** Every file the scaffold writes for a selection, background script included. */
+export function extensionTemplateFiles(ids) {
+    return [EXTENSION_BACKGROUND_PATH, ...unionOf(ids, (t) => t.emits)];
+}
+//# sourceMappingURL=extension-templates.js.map

package/dist/extension-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension-templates.js","sourceRoot":"","sources":["../src/extension-templates.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,CAAU,CAAA;AAG3F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAwB,OAAO,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,eAAe,CAAU,CAAA;AAG9F,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,KAAK,CAAA;AAElD;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,6BAA6B,gBAAgB,CAAA;AA4BzF,MAAM,CAAC,MAAM,0BAA0B,GAAiC;IACvE;QACC,EAAE,EAAE,OAAO;QACX,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,0FAA0F;QACnG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,0EAA0E;QAC1E,2EAA2E;QAC3E,oDAAoD;QACpD,mBAAmB,EAAE,EAAE;QACvB,sBAAsB,EAAE,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,GAAG,6BAA6B,aAAa;QACpD,KAAK,EAAE,CAAC,GAAG,6BAA6B,aAAa,CAAC;KACtD;IACD;QACC,EAAE,EAAE,WAAW;QACf,KAAK,EAAE,YAAY;QACnB,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,CAAC,WAAW,EAAE,QAAQ,CAAC;QACjC,mBAAmB,EAAE,CAAC,WAAW,CAAC;QAClC,sBAAsB,EAAE,EAAE;QAC1B,KAAK,EAAE,GAAG,6BAA6B,iBAAiB;QACxD,KAAK,EAAE;YACN,GAAG,6BAA6B,iBAAiB;YACjD,GAAG,6BAA6B,eAAe;SAC/C;KACD;IACD;QACC,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,eAAe;QACtB,OAAO,EAAE,8EAA8E;QACvF,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,mBAAmB,EAAE,EAAE;QACvB,sBAAsB,EAAE,EAAE;QAC1B,KAAK,EAAE,GAAG,6BAA6B,aAAa;QACpD,KAAK,EAAE,CAAC,GAAG,6BAA6B,aAAa,CAAC;QACtD,cAAc,EAAE,CAAC,uBAAuB,CAAC;KACzC;IACD;QACC,EAAE,EAAE,SAAS;QACb,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,oFAAoF;QAC7F,QAAQ,EAAE,CAAC,eAAe,CAAC;QAC3B,mBAAmB,EAAE,EAAE;QACvB,yEAAyE;QACzE,2EAA2E;QAC3E,0DAA0D;QAC1D,sBAAsB,EAAE,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,GAAG,6BAA6B,aAAa;QACpD,KAAK,EAAE,CAAC,GAAG,6BAA6B,aAAa,CAAC;QACtD,cAAc,EAAE,CAAC,YAAY,CAAC;KAC9B;CACD,CAAA;AAED,MAAM,KAAK,GAAG,IAAI,GAAG,CACpB,0BAA0B,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAChD,CAAA;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,GAAG,CAAC,KAA4B,CAAC,CAAA;AAC5E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,EAAuB;IAC3D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IAC9B,4EAA4E;IAC5E,0EAA0E;IAC1E,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,EAAE,EAAE,CAAC,CAAA;IACnE,OAAO,QAAQ,CAAA;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAA;IAC3D,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AACnF,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACzD,MAAM,SAAS,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAA;IACpD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAA;AACnE,CAAC;AAED,SAAS,OAAO,CACf,GAAmC,EACnC,IAAiD;IAEjD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC1C,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oCAAoC,CAAC,GAAmC;IACvF,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAA;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uCAAuC,CAAC,GAAmC;IAC1F,MAAM,QAAQ,GAAG,oCAAoC,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC1F,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,2BAA2B,CAC1C,GAAmC;IAEnC,MAAM,GAAG,GAAiC,EAAE,CAAA;IAC5C,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACtB,KAAK,MAAM,SAAS,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC3D,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAClD,CAAC;IACF,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,oCAAoC,CACnD,GAAmC;IAEnC,OAAO,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAA;AACzF,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,sBAAsB,CAAC,GAAmC;IACzE,OAAO,CAAC,yBAAyB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;AACpE,CAAC"}

package/dist/icon-workflow.js

@@ -39,7 +39,7 @@ Extenshi CLI renders an offline verification page. No API key, no credits, no up
 2. **Render the verification page** (free, offline):
 
    \`\`\`bash
-   npx @extenshi/cli icon preview ${iconFile} --name "${name}"
+   npx @extenshi/cli@latest icon preview ${iconFile} --name "${name}"
    \`\`\`
 
    This writes a self-contained HTML file and opens it: Chrome / Firefox / Edge toolbar

package/dist/icon-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"icon-workflow.js","sourceRoot":"","sources":["../src/icon-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,cAAc,CAAA;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAA;IAC3B,OAAO;;;;;;;;;;;;;;;;;;;;;+CAqBuC,QAAQ;;;;;oCAKnB,QAAQ,YAAY,IAAI;;;;;;;2DAOD,QAAQ;;;;;;;;;;;;;;;;;;;;;CAqBlE,CAAA;AACD,CAAC"}
+{"version":3,"file":"icon-workflow.js","sourceRoot":"","sources":["../src/icon-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,UAAU,kBAAkB,CAAC,IAAsB;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,cAAc,CAAA;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAA;IAC3B,OAAO;;;;;;;;;;;;;;;;;;;;;+CAqBuC,QAAQ;;;;;2CAKZ,QAAQ,YAAY,IAAI;;;;;;;2DAOR,QAAQ;;;;;;;;;;;;;;;;;;;;;CAqBlE,CAAA;AACD,CAAC"}

package/dist/index.js

@@ -23,6 +23,7 @@ import { createRequire } from 'node:module';
 import { FastMCP, UserError } from 'fastmcp';
 import { makeBff } from './bff.js';
 import { loadConfig } from './config.js';
+import { reportServerStarted } from './startup.js';
 import { flushTelemetry, initTelemetry } from './telemetry.js';
 import { MISSING_KEY_MESSAGE, registerTools, SERVER_INSTRUCTIONS, SERVER_NAME, } from './tools.js';
 import { checkForUpdate } from './update-check.js';
@@ -69,7 +70,21 @@ for (const signal of ['SIGTERM', 'SIGINT']) {
 process.once('beforeExit', () => {
     void flushTelemetry();
 });
-server.start({ transportType: 'stdio' });
+// Awaited, unlike the fire-and-forget calls around it. FastMCP's stdio `start()`
+// is genuinely async — it awaits `session.connect(transport)` and only then
+// registers the close handlers — so calling it and reporting on the next line
+// would time the event to "we called start", not "the session connected". It
+// resolves once connected rather than on shutdown, so awaiting it does not
+// strand the lines below. A rejection stays as loud as it was before: nothing
+// catches it, the process dies, and no event is emitted for a server that never
+// served. Top-level await is available here (ESM, target ES2022).
+await server.start({ transportType: 'stdio' });
+// Reaching this line means a client actually EXECUTED the server and the stdio
+// session connected: config parsed, tools registered, transport live. That is the
+// population `mcp_installed` cannot describe — postinstall counts npm extractions,
+// most of which are ecosystem scanners that never run the binary. See
+// ./startup.ts for the measurement.
+reportServerStarted(cfg.apiKey);
 // Fire-and-forget: nudge to stderr if a newer version is on npm. Never blocks
 // startup, never touches stdout (the MCP channel), fully fail-soft.
 void checkForUpdate(pkg.version);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAY,OAAO,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAEN,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,WAAW,GAEX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAA;AAE7D,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AAEvD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;AAExB,0EAA0E;AAC1E,SAAS,UAAU;IAClB,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACzD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,GAAG;IACX,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;IAC1B,IAAI,EAAE,WAAW;IACjB,2FAA2F;IAC3F,OAAO,EAAE,GAAG,CAAC,OAA0C;IACvD,YAAY,EAAE,mBAAmB;CACjC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,SAAS,GAAa;IAC3B,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;IACvE,YAAY,EAAE,IAAI,GAAG,CAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;IACnB,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;IACjC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS;CACxC,CAAA;AAED,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;AAEhC,wEAAwE;AACxE,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACzB,KAAK,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACH,CAAC;AACD,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,KAAK,cAAc,EAAE,CAAA;AACtB,CAAC,CAAC,CAAA;AAEF,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAA;AAExC,8EAA8E;AAC9E,oEAAoE;AACpE,KAAK,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,EAAY,OAAO,EAAE,MAAM,UAAU,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAC9D,OAAO,EAEN,mBAAmB,EACnB,aAAa,EACb,mBAAmB,EACnB,WAAW,GAEX,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAElD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAwB,CAAA;AAE7D,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;AAEvD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;AAExB,0EAA0E;AAC1E,SAAS,UAAU;IAClB,IAAI,CAAC,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,mBAAmB,CAAC,CAAA;IACzD,OAAO,GAAG,CAAC,MAAM,CAAA;AAClB,CAAC;AAED,mFAAmF;AACnF,SAAS,GAAG;IACX,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,OAAO,CAAC;IAC1B,IAAI,EAAE,WAAW;IACjB,2FAA2F;IAC3F,OAAO,EAAE,GAAG,CAAC,OAA0C;IACvD,YAAY,EAAE,mBAAmB;CACjC,CAAC,CAAA;AAEF,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAM,SAAS,GAAa;IAC3B,GAAG,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE;IACvE,YAAY,EAAE,IAAI,GAAG,CAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE;IACnB,aAAa,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE;IACjC,SAAS,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS;CACxC,CAAA;AAED,aAAa,CAAC,MAAM,EAAE,SAAS,CAAC,CAAA;AAEhC,wEAAwE;AACxE,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,6DAA6D;AAC7D,KAAK,MAAM,MAAM,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;IACrD,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACzB,KAAK,cAAc,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;AACH,CAAC;AACD,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,GAAG,EAAE;IAC/B,KAAK,cAAc,EAAE,CAAA;AACtB,CAAC,CAAC,CAAA;AAEF,iFAAiF;AACjF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,kEAAkE;AAClE,MAAM,MAAM,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,CAAA;AAE9C,+EAA+E;AAC/E,kFAAkF;AAClF,mFAAmF;AACnF,sEAAsE;AACtE,oCAAoC;AACpC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;AAE/B,8EAA8E;AAC9E,oEAAoE;AACpE,KAAK,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA"}

package/dist/startup.d.ts

@@ -0,0 +1,63 @@
+/**
+ * "A real MCP client launched this server" — the signal `mcp_installed` is not.
+ *
+ * Why this exists: `mcp_installed` fires from scripts/postinstall.cjs the moment
+ * npm extracts the tarball, so it counts every machine that INSTALLS the
+ * package, whether or not anything ever runs the binary. Measured over the
+ * package's lifetime on 2026-08-08, that population is overwhelmingly automated:
+ * 107 of 109 install-reporting machines installed exactly one version, exactly
+ * once, and were never seen again; 88 of 122 install events were linux/x64
+ * across nine different Node majors, arriving within days of each publish. None
+ * of them ever emitted a tool call. That is the signature of npm-ecosystem
+ * scanners and mirrors, not of developers — so an "activation rate" computed as
+ * tool-callers ÷ installers measures robots, and reads as a product failure.
+ *
+ * A scanner sandbox runs `npm install` and stops there. An MCP client, by
+ * construction, EXECUTES the binary — so this event, emitted once per server
+ * process, is the honest denominator for "installed → actually used". Pair it
+ * with `mcp_tool_called` for a funnel whose numerator and denominator describe
+ * the same population.
+ *
+ * `has_api_key` is a boolean and never the key itself. It answers, at the
+ * population level, the question this funnel cannot otherwise settle: of the
+ * servers that really start, how many are configured well enough to be useful.
+ * Every read/scan tool refuses without a key (see MISSING_KEY_MESSAGE), so a
+ * high started-but-keyless share is an onboarding problem, not a demand problem.
+ *
+ * Privacy is unchanged from ./telemetry.ts: one boolean on top of the anonymous
+ * base properties. No path, no key, no user input.
+ */
+/** The event name, exported so tests and analyses can't drift from the emitter. */
+export declare const SERVER_STARTED_EVENT = "mcp_server_started";
+/** Sink shape, matching captureEvent — injectable so tests need no PostHog. */
+type Capture = (event: string, properties: Record<string, unknown>) => void;
+/**
+ * Everything this event carries beyond the anonymous base properties. Declared
+ * as a closed type rather than a `Record`, so "the payload is one boolean" is
+ * enforced by the compiler instead of asserted in prose: a later edit that tries
+ * to smuggle the key itself in here does not type-check.
+ *
+ * A type alias, not an `interface`, deliberately: an interface gets no implicit
+ * index signature, so it is not assignable to the `Record<string, unknown>` the
+ * sink takes and this would not compile.
+ */
+export type ServerStartedProperties = {
+    has_api_key: boolean;
+};
+/**
+ * The properties carried by SERVER_STARTED_EVENT. Split out from the emitter so
+ * the mapping "configured key → has_api_key" is directly testable, and so it is
+ * obvious at review time that the key's VALUE never reaches the payload.
+ */
+export declare function serverStartedProperties(apiKey: string | null | undefined): ServerStartedProperties;
+/**
+ * Report that this process got far enough to serve the MCP protocol.
+ *
+ * Fail-soft in the same sense as everything else in this package: telemetry must
+ * never be able to stop a server from serving, so any throw from the sink is
+ * swallowed. Buffered like every other event — the periodic flush and the
+ * SIGTERM/beforeExit handlers in index.ts drain it.
+ */
+export declare function reportServerStarted(apiKey: string | null | undefined, capture?: Capture): void;
+export {};
+//# sourceMappingURL=startup.d.ts.map

package/dist/startup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.d.ts","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,mFAAmF;AACnF,eAAO,MAAM,oBAAoB,uBAAuB,CAAA;AAExD,+EAA+E;AAC/E,KAAK,OAAO,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;AAE3E;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAAG;IACrC,WAAW,EAAE,OAAO,CAAA;CACpB,CAAA;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,uBAAuB,CAElG;AAED;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,OAAO,GAAE,OAAsB,GAC7B,IAAI,CAMN"}

package/dist/startup.js

@@ -0,0 +1,57 @@
+/**
+ * "A real MCP client launched this server" — the signal `mcp_installed` is not.
+ *
+ * Why this exists: `mcp_installed` fires from scripts/postinstall.cjs the moment
+ * npm extracts the tarball, so it counts every machine that INSTALLS the
+ * package, whether or not anything ever runs the binary. Measured over the
+ * package's lifetime on 2026-08-08, that population is overwhelmingly automated:
+ * 107 of 109 install-reporting machines installed exactly one version, exactly
+ * once, and were never seen again; 88 of 122 install events were linux/x64
+ * across nine different Node majors, arriving within days of each publish. None
+ * of them ever emitted a tool call. That is the signature of npm-ecosystem
+ * scanners and mirrors, not of developers — so an "activation rate" computed as
+ * tool-callers ÷ installers measures robots, and reads as a product failure.
+ *
+ * A scanner sandbox runs `npm install` and stops there. An MCP client, by
+ * construction, EXECUTES the binary — so this event, emitted once per server
+ * process, is the honest denominator for "installed → actually used". Pair it
+ * with `mcp_tool_called` for a funnel whose numerator and denominator describe
+ * the same population.
+ *
+ * `has_api_key` is a boolean and never the key itself. It answers, at the
+ * population level, the question this funnel cannot otherwise settle: of the
+ * servers that really start, how many are configured well enough to be useful.
+ * Every read/scan tool refuses without a key (see MISSING_KEY_MESSAGE), so a
+ * high started-but-keyless share is an onboarding problem, not a demand problem.
+ *
+ * Privacy is unchanged from ./telemetry.ts: one boolean on top of the anonymous
+ * base properties. No path, no key, no user input.
+ */
+import { captureEvent } from './telemetry.js';
+/** The event name, exported so tests and analyses can't drift from the emitter. */
+export const SERVER_STARTED_EVENT = 'mcp_server_started';
+/**
+ * The properties carried by SERVER_STARTED_EVENT. Split out from the emitter so
+ * the mapping "configured key → has_api_key" is directly testable, and so it is
+ * obvious at review time that the key's VALUE never reaches the payload.
+ */
+export function serverStartedProperties(apiKey) {
+    return { has_api_key: Boolean(apiKey) };
+}
+/**
+ * Report that this process got far enough to serve the MCP protocol.
+ *
+ * Fail-soft in the same sense as everything else in this package: telemetry must
+ * never be able to stop a server from serving, so any throw from the sink is
+ * swallowed. Buffered like every other event — the periodic flush and the
+ * SIGTERM/beforeExit handlers in index.ts drain it.
+ */
+export function reportServerStarted(apiKey, capture = captureEvent) {
+    try {
+        capture(SERVER_STARTED_EVENT, serverStartedProperties(apiKey));
+    }
+    catch {
+        // Never throw into startup.
+    }
+}
+//# sourceMappingURL=startup.js.map

package/dist/startup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startup.js","sourceRoot":"","sources":["../src/startup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAA;AAE7C,mFAAmF;AACnF,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAA;AAmBxD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAiC;IACxE,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAA;AACxC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAAiC,EACjC,UAAmB,YAAY;IAE/B,IAAI,CAAC;QACJ,OAAO,CAAC,oBAAoB,EAAE,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAA;IAC/D,CAAC;IAAC,MAAM,CAAC;QACR,4BAA4B;IAC7B,CAAC;AACF,CAAC"}

package/dist/telemetry.d.ts

@@ -41,15 +41,16 @@ export declare function telemetryEnabled(): boolean;
 export declare function redactText(s: string): string;
 /**
  * Coarse error bucket. Driven by a numeric status when the error carries one
- * (ScanError `status`, tRPC `data.httpStatus`), else by message patterns (the
- * CLI throws plain Errors). Order matters — status first, then transport, then
- * semantic buckets.
+ * (ScanError `status`, tRPC `data.httpStatus`), else by message patterns (both
+ * surfaces also throw plain Errors). Order matters — status first, then
+ * transport, then semantic buckets.
  *
- * Follows the `cause` chain: the tool layer re-throws failures wrapped in a
- * `UserError` so fastmcp renders them for the caller (see readError() in
- * ./tools.ts), and that wrapper's own message can carry no status. The origin
- * hangs off `cause`, so an unclassifiable wrapper defers to what it wraps —
- * without it, a BFF 500 behind a UserError reads as `unexpected`.
+ * Follows the `cause` chain, because both surfaces re-throw a failure wrapped in
+ * an error of their own so it renders for the caller — the MCP tool layer wraps
+ * in fastmcp's `UserError` (readError() in its tools.ts) — and the wrapper's own
+ * message can carry no status. The origin hangs off `cause`, so an
+ * unclassifiable wrapper defers to what it wraps; without this, a BFF 500 behind
+ * a wrapper reads as `unexpected`.
  */
 export declare function classifyError(err: unknown): string;
 /**

package/dist/telemetry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AA+BH,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAG9E;AAmCD,wBAAgB,gBAAgB,IAAI,OAAO,CAO1C;AA6CD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AAsDD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAalD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAQ1F;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAQtF;AASD;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CASpD"}
+{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AA+BH,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAG9E;AAmCD,wBAAgB,gBAAgB,IAAI,OAAO,CAO1C;AA6CD,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAO5C;AA2DD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAgBlD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,MAAM,EAAE,CAM9E;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAQ1F;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAQtF;AASD;;;;GAIG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CASpD"}