@extension.dev/mcp 6.1.0 → 6.3.0

package/dist/rslib-runtime.js

@@ -1,3 +1,4 @@
+var __webpack_modules__ = {};
 var __webpack_module_cache__ = {};
 function __webpack_require__(moduleId) {
     var cachedModule = __webpack_module_cache__[moduleId];
@@ -8,6 +9,7 @@ function __webpack_require__(moduleId) {
     __webpack_modules__[moduleId](module, module.exports, __webpack_require__);
     return module.exports;
 }
+__webpack_require__.m = __webpack_modules__;
 (()=>{
     __webpack_require__.add = function(modules) {
         Object.assign(__webpack_require__.m, modules);

package/dist/src/lib/registry-access.d.ts

@@ -0,0 +1,45 @@
+import type { ProjectRef } from "./registry";
+export type AccessGrant = {
+    status: "ok";
+    token: string;
+    expiresAt: number;
+}
+/** Project is public; no token is needed and none was minted. */
+ | {
+    status: "public";
+}
+/** No stored credential, or it does not cover the requested project. */
+ | {
+    status: "no-credential";
+}
+/** Reached the platform and it refused (401/403/5xx, network, bad body). */
+ | {
+    status: "denied";
+    httpStatus?: number;
+    message: string;
+};
+export interface AccessTokenCacheOptions {
+    fetchImpl?: typeof fetch;
+    /** Test-only clock override, unix epoch seconds. */
+    nowSeconds?: () => number;
+}
+/**
+ * Per-process cache of minted tokens. Concurrent readers of the same project
+ * share one in-flight mint: a single tool call fans out over meta.json,
+ * channels.json and builds/index.json, and three cold 401s must not become
+ * three mint round-trips.
+ */
+export declare class RegistryAccessTokens {
+    private readonly cache;
+    private readonly fetchImpl;
+    private readonly nowSeconds;
+    constructor(options?: AccessTokenCacheOptions);
+    /** A cached, still-valid token, or "" if none. Never mints. */
+    peek(ref: ProjectRef): string;
+    get(ref: ProjectRef, apiHint?: string): Promise<AccessGrant>;
+    private mint;
+}
+/** Process-wide default, so one tool call's fan-out shares one mint. */
+export declare const defaultRegistryAccessTokens: RegistryAccessTokens;
+/** Append `?t=<token>` to a registry URL. */
+export declare function withAccessToken(url: string, token: string): string;

package/dist/src/lib/registry.d.ts

@@ -1,4 +1,5 @@
-import { type Origins } from "./urls-origins";
+import { type RegistryAccessTokens } from "./registry-access";
+import { type Origins } from "@extension.dev/urls/origins";
 export declare const REGISTRY_BASE_DEFAULT: string;
 /**
  * Resolve the fleet origins from the MCP's env vars, once per call. Console,
@@ -7,7 +8,7 @@ export declare const REGISTRY_BASE_DEFAULT: string;
  * MCP hands back follows to the dev host (`console.extension.localhost`) instead
  * of silently pointing at prod. Explicit per-host env vars still win. Falls back
  * to production when nothing is set. The dev-derivation lives in
- * `@extensiondev/urls` so it stays identical to what the apps resolve.
+ * `@extension.dev/urls` so it stays identical to what the apps resolve.
  */
 export declare function mcpOrigins(apiHint?: string): Origins;
 /** Base origin of the console dashboard, dev-aware (no trailing slash). */
@@ -37,6 +38,20 @@ export declare function registryFileUrl(ref: ProjectRef, file: string): string;
  * `EXTENSION_DEV_API_URL`/`EXTENSION_DEV_CONSOLE_URL`.
  */
 export declare function consoleProjectUrl(ref: ProjectRef | null, page: string, apiHint?: string): string;
+/**
+ * The PUBLIC page for a project, a build, or a channel on userland.
+ *
+ * The sibling of consoleProjectUrl, and the one to hand to a human who is not
+ * the operator: the console links every tool already returns require a login
+ * and workspace membership, so they are dead ends for a teammate, a reviewer,
+ * or anyone reading a PR. These carry the per-browser downloads, the run
+ * locally and integrity dialogs, and the what's new tab.
+ *
+ * A PRIVATE project's page still needs a `?share=` token, which only
+ * extension_publish can mint; callers should say so rather than imply the bare
+ * URL will open for anyone.
+ */
+export declare function userlandProjectUrl(ref: ProjectRef | null, page?: string, apiHint?: string): string;
 export type RegistryFetchResult<T> = {
     ok: true;
     json: T;
@@ -46,11 +61,23 @@ export type RegistryFetchResult<T> = {
     message: string;
 };
 /**
- * Fetch a registry JSON file. Never throws: 404s (private or never-built
- * projects), network failures, and non-JSON bodies all come back as
- * `{ok:false}` so callers can degrade honestly instead of crashing the verb.
+ * Fetch a registry JSON file. Never throws: 404s (never-built projects),
+ * network failures, and non-JSON bodies all come back as `{ok:false}` so
+ * callers can degrade honestly instead of crashing the verb.
+ *
+ * PRIVATE PROJECTS: a private project answers 401 here. When `ref` is given and
+ * the caller holds a credential for that project, the 401 triggers one mint of
+ * a short-lived access token and a single retry with `?t=`. Without `ref` the
+ * behaviour is exactly as before, so this stays a drop-in for public reads:
+ * public projects still complete in one round trip and never touch the
+ * platform. See registry-access.ts for why the stored token is traded rather
+ * than sent as `?t=` directly.
  */
-export declare function fetchRegistryJson<T = unknown>(url: string, fetchImpl?: typeof fetch): Promise<RegistryFetchResult<T>>;
+export declare function fetchRegistryJson<T = unknown>(url: string, fetchImpl?: typeof fetch, options?: {
+    ref?: ProjectRef | null;
+    api?: string;
+    tokens?: RegistryAccessTokens;
+}): Promise<RegistryFetchResult<T>>;
 export interface ChannelEntry {
     channel: string;
     sha: string;

package/dist/src/tools/release-list.d.ts

@@ -12,6 +12,10 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            api: {
+                type: string;
+                description: string;
+            };
         };
         required: never[];
     };
@@ -19,4 +23,5 @@ export declare const schema: {
 export declare function handler(args: {
     workspace?: string;
     project?: string;
+    api?: string;
 }): Promise<string>;

package/dist/src/tools/store-status.d.ts

@@ -12,6 +12,10 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            api: {
+                type: string;
+                description: string;
+            };
         };
         required: never[];
     };
@@ -52,5 +56,6 @@ export declare function normalizeStoresStatus(json: unknown): NormalizedStoresSt
 export declare function handler(args: {
     workspace?: string;
     project?: string;
+    api?: string;
 }): Promise<string>;
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "6.1.0",
+  "version": "6.3.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 33 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",
@@ -97,6 +97,7 @@
     "ws": "^8.20.0"
   },
   "devDependencies": {
+    "@extension.dev/urls": "^0.3.0",
     "@rslib/core": "^0.19.4",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^25.2.0",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "6.1.0",
+  "version": "6.3.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "6.1.0",
+      "version": "6.3.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/dist/src/lib/urls-origins.d.ts

@@ -1,34 +0,0 @@
-/** The set of app/service origins the fleet links between. */
-export interface Origins {
-    www: string;
-    console: string;
-    inspect: string;
-    templates: string;
-    intelligence: string;
-    /** Public release-state JSON host (registry.extension.land). */
-    registry: string;
-    /** Content-addressed template corpus host (media.extension.land). */
-    media: string;
-}
-/** Production origins. The prod fallback for every resolver in the fleet. */
-export declare const PROD_ORIGINS: Origins;
-export declare const DEV_LOCALHOST_ORIGINS: Origins;
-/**
- * True for `localhost`, `127.0.0.1`, `[::1]`, or any `*.extension.localhost`
- * host -- the shapes the dev proxy serves. Anything unparseable is treated as
- * not-local so an odd value falls back to prod rather than leaking a dev host.
- */
-export declare function isLocalOrigin(url: string | undefined | null): boolean;
-/**
- * Resolve the full origin set from a caller's overrides.
- *
- * Precedence per origin: explicit override -> derived base (dev vs prod) ->
- * prod. The base is chosen by whether the environment looks local: if any of
- * `www`/`console`/`hint` points at a local host, unset origins derive from the
- * Caddy dev map instead of prod. This is what lets an operator set only
- * `EXTENSION_DEV_API_URL=http://localhost:3100` and still get a console link at
- * `console.extension.localhost` rather than one that silently points at prod.
- */
-export declare function resolveOrigins(overrides?: Partial<Origins>, opts?: {
-    hint?: string;
-}): Origins;

package/dist/src/lib/urls-paths.d.ts

@@ -1,56 +0,0 @@
-/** A project is addressed by its workspace slug + project slug across the fleet. */
-export interface ProjectRef {
-    workspace: string;
-    project: string;
-}
-/** `/:workspace` (or a sub-page like `settings` / `settings/:section`). */
-export declare function consoleWorkspacePath(workspace: string, page?: string): string;
-/**
- * `/:workspace/:project/<page>`. Pass a page tail from `ConsoleProjectPage`
- * (e.g. `ConsoleProjectPage.builds`) rather than hand-typing it, so a route
- * rename is a one-line change here instead of a scattered string edit.
- */
-export declare function consoleProjectPath(ref: ProjectRef, page?: string): string;
-/**
- * Named project-page tails. Values are the exact segments under
- * `/:username/:reponame/` in console's route table; deep pages take ids.
- */
-export declare const ConsoleProjectPage: {
-    readonly overview: "";
-    readonly onboard: "onboard";
-    readonly activity: "activity";
-    readonly builds: "builds";
-    readonly build: (buildId: string, browser?: string) => string;
-    readonly releases: "releases";
-    readonly releasesNew: "releases/new";
-    readonly release: (releaseId: string) => string;
-    readonly stores: "stores";
-    readonly storesNew: "stores/new";
-    readonly store: (store: string) => string;
-    readonly storeSubmissions: (store: string) => string;
-    readonly storeSubmissionNew: (store: string) => string;
-    readonly storeSubmission: (store: string, submissionId: string) => string;
-    readonly projectSettings: "project-settings";
-    readonly projectSettingsSection: (section: string) => string;
-    /** Where CLI/MCP tokens are minted and revoked. */
-    readonly accessTokens: "settings/access-tokens";
-};
-export type QueryValue = string | number | boolean | null | undefined;
-/**
- * `/new?...` -- project creation. The public deep-link contract: external
- * READMEs use `extension.dev/new?template=<slug>`, which www normalizes to
- * `/import` preserving every param. Do not change the `template` key.
- */
-export declare function wwwNewPath(query?: Record<string, QueryValue>): string;
-/** `/import?...` -- the ported import/deploy flow templates' Deploy buttons target. */
-export declare function wwwImportPath(query?: Record<string, QueryValue>): string;
-/** `/device` -- CLI/MCP device-code consent. Lives on www, never console. */
-export declare function wwwDevicePath(): string;
-/** `/templates` and `/templates/:slug` -- externally linkable gallery entry on www. */
-export declare function wwwTemplatesPath(slug?: string): string;
-export type TemplateTab = "preview" | "instructions" | "source";
-/** `/:slug` for the default `preview` tab, else `/:slug/<tab>`. */
-export declare function templateTabPath(slug: string, tab?: TemplateTab): string;
-export type InspectTab = "preview" | "details" | "source" | "trace";
-/** `/` for the default `preview` tab, else `/details` / `/source` / `/trace`. */
-export declare function inspectTabPath(tab?: InspectTab): string;