@extension.dev/mcp 6.2.0 → 6.3.0

package/.claude-plugin/marketplace.json

@@ -10,7 +10,7 @@
       "name": "extension-mcp",
       "source": "./",
       "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox.",
-      "version": "6.2.0",
+      "version": "6.3.0",
       "category": "development",
       "author": {
         "name": "Cezar Augusto"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "extension-mcp",
   "description": "MCP tools for browser extension development: scaffold from 60+ templates, run the dev server with HMR, inspect the live DOM and logs, and publish store-ready builds for Chrome, Edge, and Firefox. Ships /extension, /extension-add, /extension-debug, and /extension-publish commands.",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "author": {
     "name": "Cezar Augusto",
     "email": "hello@extension.dev",

package/CHANGELOG.md

@@ -1,5 +1,69 @@
 # Changelog
 
+## 6.4.0
+
+A build on your machine can now become a link someone else can open.
+
+### Changed
+
+- **`extension_preview_web` with `share:true` uploads the build you just
+  made.** It used to route sharing through `extension_publish`, which takes no
+  project path and uploads nothing: it flips a share link on whatever build the
+  token's project last pushed from its own CI. So the link rendered a different
+  build than the one on disk, and said so in a caveat. It now POSTs the resolved
+  `dist/<browser>` to the platform's artifact store and returns a
+  `preview.extension.dev` link that renders those exact bytes, for a recipient
+  with no install, no sign-in, and no dev server. `share.serves` reports
+  `uploaded-local-build`; the `requiredBackend` spec that described this as
+  missing is gone because it is built.
+- `share` now returns `expiresAt` and `revokeUrl`. Shared builds expire, and
+  `DELETE`ing `revokeUrl` with the same token kills the link immediately, which
+  is the part a TTL alone cannot do when a link reaches the wrong person.
+- The `channel` argument is removed from `extension_preview_web`. It only ever
+  selected which promoted CI build to render, and this tool no longer renders
+  promoted builds. `extension_publish` and `extension_release_promote` are
+  unchanged and remain the path for released, channel-scoped builds.
+
+## 6.3.0
+
+Private projects stop reading as empty, and the links this server hands back
+stop being login-only.
+
+### Fixed
+
+- **Registry reads work for PRIVATE projects.** `extension_release_list`,
+  `extension_store_status`, `extension_deploy` and `extension_publish` read the
+  project's state from `registry.extension.land`, which answers 401 for a
+  private project. That 401 was reported as "no registry data", so a project the
+  operator owns and is logged into looked like it had no builds at all. A 401 or
+  403 now mints a short-lived read token and retries once. Public projects are
+  untouched: still one request, still no call to the platform.
+- The stored login token is never used as the `?t=` URL parameter even though it
+  would verify. It is long-lived, and a credential in a query string is kept by
+  every proxy and access log on the path, so it is traded for a ten-minute token
+  first. Requires the bearer path on `POST /api/access-grant`.
+
+### Added
+
+- **Public build links.** `extension_release_list` returns a `publicUrl` for
+  every channel and build plus a `publicProjectUrl`, and
+  `extension_release_promote` returns `publicChannelUrl` and `publicBuildUrl`.
+  Every link these tools returned before pointed at the console, which requires
+  a login and workspace membership, so it was a dead end for the teammate or
+  reviewer the operator wanted to send it to. The public pages carry the
+  per-browser downloads, the run-locally and integrity dialogs, and what's new.
+  For a private project the response says plainly that an outside recipient
+  still needs a share link from `extension_publish`.
+- `api` is accepted by `extension_release_list` and `extension_store_status`,
+  matching the other hosted-facing tools. It picks the platform the read token
+  is minted against and the origin the returned links point at.
+
+### Changed
+
+- Depends on `@extension.dev/urls` `^0.3.0` for the new `userland` origin and
+  its whole-URL builders, so a build link this server returns cannot drift from
+  the routes the viewer serves.
+
 ## 6.2.0
 
 The URL layer stops being a copy. This server used to carry byte-identical

package/dist/module.js

@@ -17,7 +17,7 @@ import node_net from "node:net";
 import { extensionInstall, extensionUninstall, getManagedBrowsersCacheRoot } from "extension-install";
 import { promisify } from "node:util";
 __webpack_require__.add({
-    "./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/origins.cjs" (__unused_rspack_module, exports) {
+    "./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/origins.cjs" (__unused_rspack_module, exports) {
         var __nested_rspack_require_18_37__ = {};
         (()=>{
             __nested_rspack_require_18_37__.d = (exports1, definition)=>{
@@ -55,6 +55,7 @@ __webpack_require__.add({
             preview: "https://preview.extension.dev",
             templates: "https://templates.extension.dev",
             intelligence: "https://intelligence.extension.dev",
+            userland: "https://extension.dev",
             registry: "https://registry.extension.land",
             media: "https://media.extension.land"
         };
@@ -65,6 +66,7 @@ __webpack_require__.add({
             preview: "http://preview.extension.localhost",
             templates: "http://templates.extension.localhost",
             intelligence: "http://intelligence.extension.localhost",
+            userland: "http://userland.extension.localhost",
             registry: "https://registry.extension.land",
             media: "https://media.extension.land"
         };
@@ -93,6 +95,7 @@ __webpack_require__.add({
                 preview: pick("preview"),
                 templates: pick("templates"),
                 intelligence: pick("intelligence"),
+                userland: pick("userland"),
                 registry: pick("registry"),
                 media: pick("media")
             };
@@ -111,7 +114,7 @@ __webpack_require__.add({
             value: true
         });
     },
-    "./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/paths.cjs" (__unused_rspack_module, exports) {
+    "./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/paths.cjs" (__unused_rspack_module, exports) {
         var __nested_rspack_require_18_37__ = {};
         (()=>{
             __nested_rspack_require_18_37__.d = (exports1, definition)=>{
@@ -143,6 +146,7 @@ __webpack_require__.add({
             inspectTabPath: ()=>inspectTabPath,
             previewSharePath: ()=>previewSharePath,
             templateTabPath: ()=>templateTabPath,
+            withQuery: ()=>withQuery,
             wwwDevicePath: ()=>wwwDevicePath,
             wwwImportPath: ()=>wwwImportPath,
             wwwNewPath: ()=>wwwNewPath,
@@ -212,6 +216,7 @@ __webpack_require__.add({
         exports.inspectTabPath = __nested_rspack_exports__.inspectTabPath;
         exports.previewSharePath = __nested_rspack_exports__.previewSharePath;
         exports.templateTabPath = __nested_rspack_exports__.templateTabPath;
+        exports.withQuery = __nested_rspack_exports__.withQuery;
         exports.wwwDevicePath = __nested_rspack_exports__.wwwDevicePath;
         exports.wwwImportPath = __nested_rspack_exports__.wwwImportPath;
         exports.wwwNewPath = __nested_rspack_exports__.wwwNewPath;
@@ -223,6 +228,7 @@ __webpack_require__.add({
             "inspectTabPath",
             "previewSharePath",
             "templateTabPath",
+            "withQuery",
             "wwwDevicePath",
             "wwwImportPath",
             "wwwNewPath",
@@ -231,6 +237,171 @@ __webpack_require__.add({
         Object.defineProperty(exports, "__esModule", {
             value: true
         });
+    },
+    "./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/userland.cjs" (__unused_rspack_module, exports) {
+        var __nested_rspack_require_18_37__ = {};
+        (()=>{
+            __nested_rspack_require_18_37__.d = (exports1, definition)=>{
+                for(var key in definition)if (__nested_rspack_require_18_37__.o(definition, key) && !__nested_rspack_require_18_37__.o(exports1, key)) Object.defineProperty(exports1, key, {
+                    enumerable: true,
+                    get: definition[key]
+                });
+            };
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+        })();
+        (()=>{
+            __nested_rspack_require_18_37__.r = (exports1)=>{
+                if ("u" > typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+                    value: 'Module'
+                });
+                Object.defineProperty(exports1, '__esModule', {
+                    value: true
+                });
+            };
+        })();
+        var __nested_rspack_exports__ = {};
+        __nested_rspack_require_18_37__.r(__nested_rspack_exports__);
+        __nested_rspack_require_18_37__.d(__nested_rspack_exports__, {
+            userlandBuildUrl: ()=>userlandBuildUrl,
+            USERLAND_BUILD_TABS: ()=>USERLAND_BUILD_TABS,
+            userlandUrl: ()=>userlandUrl,
+            UserlandProjectPage: ()=>UserlandProjectPage,
+            UserlandDialog: ()=>UserlandDialog,
+            userlandChannelUrl: ()=>userlandChannelUrl,
+            userlandProjectPath: ()=>userlandProjectPath,
+            isUserlandBuildTab: ()=>isUserlandBuildTab,
+            userlandDialogUrl: ()=>userlandDialogUrl,
+            userlandHostMode: ()=>userlandHostMode,
+            userlandOrigin: ()=>userlandOrigin
+        });
+        const PROD_ORIGINS = {
+            www: "https://www.extension.dev",
+            console: "https://console.extension.dev",
+            inspect: "https://inspect.extension.dev",
+            preview: "https://preview.extension.dev",
+            templates: "https://templates.extension.dev",
+            intelligence: "https://intelligence.extension.dev",
+            userland: "https://extension.dev",
+            registry: "https://registry.extension.land",
+            media: "https://media.extension.land"
+        };
+        function strip(value) {
+            return String(value ?? "").trim().replace(/\/+$/, "");
+        }
+        function isLocalOrigin(url) {
+            const raw = strip(url);
+            if (!raw) return false;
+            let host;
+            try {
+                host = new URL(raw).hostname;
+            } catch  {
+                return false;
+            }
+            return "localhost" === host || "127.0.0.1" === host || "::1" === host || "[::1]" === host || "extension.localhost" === host || host.endsWith(".extension.localhost");
+        }
+        function withQuery(path, query) {
+            if (!query) return path;
+            const params = new URLSearchParams();
+            for (const [key, value] of Object.entries(query))if (null != value && "" !== value) params.set(key, String(value));
+            const qs = params.toString();
+            return qs ? `${path}?${qs}` : path;
+        }
+        const userland_seg = (value)=>encodeURIComponent(String(value));
+        const USERLAND_BUILD_TABS = [
+            "preview",
+            "whats-new",
+            "usage"
+        ];
+        function isUserlandBuildTab(value) {
+            return USERLAND_BUILD_TABS.includes(value);
+        }
+        const UserlandDialog = {
+            run: "run",
+            integrity: "integrity"
+        };
+        const DNS_LABEL = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i;
+        function userland_strip(value) {
+            return String(value ?? "").trim().replace(/\/+$/, "");
+        }
+        function userlandHostMode(base) {
+            return isLocalOrigin(userland_strip(base) || PROD_ORIGINS.userland) ? "path" : "subdomain";
+        }
+        function userlandOrigin(workspace, options = {}) {
+            const base = userland_strip(options.base) || PROD_ORIGINS.userland;
+            if ("path" === userlandHostMode(base)) return base;
+            const slug = String(workspace ?? "").trim().toLowerCase();
+            if (!DNS_LABEL.test(slug)) throw new Error(`Workspace slug ${JSON.stringify(workspace)} cannot be a subdomain label; userland production hosts are <workspace>.extension.dev.`);
+            const url = new URL(base);
+            url.hostname = `${slug}.${url.hostname}`;
+            return userland_strip(url.toString());
+        }
+        const UserlandProjectPage = {
+            overview: "",
+            build: (buildId)=>`builds/${userland_seg(buildId)}`,
+            buildTab: (buildId, tab = "preview")=>"preview" === tab ? `builds/${userland_seg(buildId)}` : `builds/${userland_seg(buildId)}/${tab}`,
+            browserBuild: (buildId, browser)=>`builds/${userland_seg(buildId)}/${userland_seg(browser)}`,
+            channel: (channel)=>`channels/${userland_seg(channel)}`,
+            channelShortcut: (channel)=>userland_seg(channel),
+            channelBrowser: (browser, channel)=>`channels/${userland_seg(browser)}/${userland_seg(channel)}`,
+            version: (version)=>`versions/${userland_seg(version)}`,
+            versionBrowser: (browser, version)=>`versions/${userland_seg(browser)}/${userland_seg(version)}`
+        };
+        function userlandProjectPath(ref, page = "", options = {}) {
+            const head = "subdomain" === userlandHostMode(options.base) ? `/${userland_seg(ref.project)}` : `/${userland_seg(ref.workspace)}/${userland_seg(ref.project)}`;
+            const tail = String(page ?? "").replace(/^\/+/, "");
+            return tail ? `${head}/${tail}` : head;
+        }
+        function userlandUrl(ref, page = "", options = {}) {
+            const origin = userlandOrigin(ref.workspace, options);
+            const path = userlandProjectPath(ref, page, options);
+            return `${origin}${withQuery(path, options.query)}`;
+        }
+        function userlandBuildUrl(ref, buildId, options = {}) {
+            const page = options.browser ? UserlandProjectPage.browserBuild(buildId, options.browser) : UserlandProjectPage.build(buildId);
+            return userlandUrl(ref, page, options);
+        }
+        function userlandDialogUrl(ref, buildId, browser, dialog, options = {}) {
+            return userlandUrl(ref, UserlandProjectPage.browserBuild(buildId, browser), {
+                ...options,
+                query: {
+                    ...options.query ?? {},
+                    dialog
+                }
+            });
+        }
+        function userlandChannelUrl(ref, channel, options = {}) {
+            const page = options.browser ? UserlandProjectPage.channelBrowser(options.browser, channel) : options.shortcut ? UserlandProjectPage.channelShortcut(channel) : UserlandProjectPage.channel(channel);
+            return userlandUrl(ref, page, options);
+        }
+        exports.USERLAND_BUILD_TABS = __nested_rspack_exports__.USERLAND_BUILD_TABS;
+        exports.UserlandDialog = __nested_rspack_exports__.UserlandDialog;
+        exports.UserlandProjectPage = __nested_rspack_exports__.UserlandProjectPage;
+        exports.isUserlandBuildTab = __nested_rspack_exports__.isUserlandBuildTab;
+        exports.userlandBuildUrl = __nested_rspack_exports__.userlandBuildUrl;
+        exports.userlandChannelUrl = __nested_rspack_exports__.userlandChannelUrl;
+        exports.userlandDialogUrl = __nested_rspack_exports__.userlandDialogUrl;
+        exports.userlandHostMode = __nested_rspack_exports__.userlandHostMode;
+        exports.userlandOrigin = __nested_rspack_exports__.userlandOrigin;
+        exports.userlandProjectPath = __nested_rspack_exports__.userlandProjectPath;
+        exports.userlandUrl = __nested_rspack_exports__.userlandUrl;
+        for(var __webpack_i__ in __nested_rspack_exports__)if (-1 === [
+            "USERLAND_BUILD_TABS",
+            "UserlandDialog",
+            "UserlandProjectPage",
+            "isUserlandBuildTab",
+            "userlandBuildUrl",
+            "userlandChannelUrl",
+            "userlandDialogUrl",
+            "userlandHostMode",
+            "userlandOrigin",
+            "userlandProjectPath",
+            "userlandUrl"
+        ].indexOf(__webpack_i__)) exports[__webpack_i__] = __nested_rspack_exports__[__webpack_i__];
+        Object.defineProperty(exports, "__esModule", {
+            value: true
+        });
     }
 });
 var add_feature_namespaceObject = {};
@@ -439,7 +610,7 @@ __webpack_require__.d(whoami_namespaceObject, {
     handler: ()=>whoami_handler,
     schema: ()=>whoami_schema
 });
-var package_namespaceObject = JSON.parse('{"rE":"6.1.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
+var package_namespaceObject = JSON.parse('{"rE":"6.3.0","El":{"OP":"4.0.16-canary.1784889479.74e12044"}}');
 function credentialsPath() {
     if ("win32" === process.platform) {
         const base = process.env.APPDATA || process.env.LOCALAPPDATA || node_path.join(node_os.homedir(), "AppData", "Roaming");
@@ -512,8 +683,240 @@ function readValidCredentials(nowSeconds = Math.floor(Date.now() / 1000)) {
     if (creds.expiresAt && creds.expiresAt <= nowSeconds) return null;
     return creds;
 }
-const origins = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/origins.cjs");
-const paths_0 = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.2.0/node_modules/@extension.dev/urls/dist/paths.cjs");
+const origins = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/origins.cjs");
+const DEFAULT_API = origins.PROD_ORIGINS.www;
+function tokenTtlNote(workspaceSlug, projectSlug) {
+    const tokensUrl = workspaceSlug && projectSlug ? consoleProjectUrl({
+        workspace: workspaceSlug,
+        project: projectSlug
+    }, "settings/access-tokens") : consoleBase();
+    return `extension.dev CLI tokens live at most 7 days (server-enforced). CI pipelines must re-mint before expiry on the console's Access tokens page: ${tokensUrl}`;
+}
+function resolveApiBase(api) {
+    return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
+}
+function safeApiBase(raw) {
+    let parsed;
+    try {
+        parsed = new URL(raw);
+    } catch  {
+        return {
+            ok: false,
+            message: `Invalid platform URL: ${raw}`
+        };
+    }
+    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
+    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
+        ok: false,
+        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
+    };
+    return {
+        ok: true,
+        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
+    };
+}
+async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
+    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
+    if (override) return {
+        provider: "github",
+        clientId: override,
+        scope: "read:user",
+        deviceCodeUrl: "/api/cli/device/code",
+        deviceTokenUrl: "/api/cli/device/token",
+        verificationUri: "https://github.com/login/device"
+    };
+    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
+        headers: {
+            accept: "application/json"
+        }
+    });
+    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
+    const data = await res.json().catch(()=>({}));
+    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
+    const clientId = String(data.githubClientId || "").trim();
+    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
+    return {
+        provider,
+        clientId,
+        scope: String(data.scope || "read:user"),
+        deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
+        deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
+        verificationUri: String(data.verificationUri || "https://github.com/login/device")
+    };
+}
+function persistTokenResponse(args) {
+    const token = String(args.data.token || "").trim();
+    if (!token) throw new Error("Login returned no token.");
+    const creds = {
+        version: 1,
+        token,
+        workspaceSlug: String(args.data.workspaceSlug || ""),
+        projectSlug: String(args.data.projectSlug || ""),
+        expiresAt: Number(args.data.expiresAt || 0),
+        api: args.apiBase,
+        provider: args.provider
+    };
+    writeCredentials(creds);
+    return creds;
+}
+async function exchangeAndPersist(args) {
+    const doFetch = args.fetchImpl ?? fetch;
+    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
+        method: "POST",
+        headers: {
+            "content-type": "application/json",
+            accept: "application/json"
+        },
+        body: JSON.stringify({
+            githubToken: args.githubToken,
+            project: args.project
+        })
+    });
+    const text = await res.text();
+    let data;
+    try {
+        data = JSON.parse(text);
+    } catch  {
+        data = {
+            message: text
+        };
+    }
+    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
+    return persistTokenResponse({
+        apiBase: args.apiBase,
+        data,
+        provider: "github"
+    });
+}
+function _define_property(obj, key, value) {
+    if (key in obj) Object.defineProperty(obj, key, {
+        value: value,
+        enumerable: true,
+        configurable: true,
+        writable: true
+    });
+    else obj[key] = value;
+    return obj;
+}
+const REFRESH_LEAD_SECONDS = 60;
+function cacheKey(ref) {
+    return `${ref.workspace.toLowerCase()}/${ref.project.toLowerCase()}`;
+}
+class RegistryAccessTokens {
+    peek(ref) {
+        const entry = this.cache.get(cacheKey(ref));
+        if (!entry || "fresh" !== entry.kind) return "";
+        return entry.expiresAt - REFRESH_LEAD_SECONDS > this.nowSeconds() ? entry.token : "";
+    }
+    async get(ref, apiHint) {
+        const key = cacheKey(ref);
+        const entry = this.cache.get(key);
+        if (entry?.kind === "pending") return entry.promise;
+        const cached = this.peek(ref);
+        if (cached) return {
+            status: "ok",
+            token: cached,
+            expiresAt: this.cache.get(key).expiresAt
+        };
+        const promise = this.mint(ref, apiHint);
+        this.cache.set(key, {
+            kind: "pending",
+            promise
+        });
+        const result = await promise;
+        if ("ok" === result.status) this.cache.set(key, {
+            kind: "fresh",
+            token: result.token,
+            expiresAt: result.expiresAt
+        });
+        else this.cache.delete(key);
+        return result;
+    }
+    async mint(ref, apiHint) {
+        const creds = readCredentials();
+        const token = String(process.env.EXTENSION_DEV_TOKEN || creds?.token || "").trim();
+        if (!token) return {
+            status: "no-credential"
+        };
+        if (creds?.workspaceSlug && creds?.projectSlug && !process.env.EXTENSION_DEV_TOKEN) {
+            const same = creds.workspaceSlug.toLowerCase() === ref.workspace.toLowerCase() && creds.projectSlug.toLowerCase() === ref.project.toLowerCase();
+            if (!same) return {
+                status: "no-credential"
+            };
+        }
+        const check = safeApiBase(resolveApiBase(apiHint || creds?.api));
+        if (!check.ok) return {
+            status: "denied",
+            message: check.message
+        };
+        let res;
+        try {
+            res = await this.fetchImpl(`${check.base}/api/access-grant`, {
+                method: "POST",
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    "content-type": "application/json"
+                },
+                body: JSON.stringify({
+                    workspaceSlug: ref.workspace,
+                    projectSlug: ref.project
+                })
+            });
+        } catch (err) {
+            return {
+                status: "denied",
+                message: `Could not reach the access-grant endpoint: ${err?.message || err}`
+            };
+        }
+        if (400 === res.status) return {
+            status: "public"
+        };
+        if (!res.ok) return {
+            status: "denied",
+            httpStatus: res.status,
+            message: `access-grant returned ${res.status}`
+        };
+        let data;
+        try {
+            data = JSON.parse(await res.text());
+        } catch  {
+            return {
+                status: "denied",
+                message: "access-grant did not return JSON"
+            };
+        }
+        const minted = String(data?.token || "").trim();
+        if (!minted) return {
+            status: "denied",
+            message: "access-grant returned no token"
+        };
+        return {
+            status: "ok",
+            token: minted,
+            expiresAt: Number(data?.expiresAt || 0)
+        };
+    }
+    constructor(options){
+        _define_property(this, "cache", new Map());
+        _define_property(this, "fetchImpl", void 0);
+        _define_property(this, "nowSeconds", void 0);
+        this.fetchImpl = options?.fetchImpl ?? fetch;
+        this.nowSeconds = options?.nowSeconds ?? (()=>Math.floor(Date.now() / 1000));
+    }
+}
+const defaultRegistryAccessTokens = new RegistryAccessTokens();
+function withAccessToken(url, token) {
+    if (!token) return url;
+    try {
+        const u = new URL(url);
+        u.searchParams.set("t", token);
+        return u.toString();
+    } catch  {
+        return url;
+    }
+}
+const paths_0 = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/paths.cjs");
+const userland = __webpack_require__("./node_modules/.pnpm/@extension.dev+urls@0.3.0/node_modules/@extension.dev/urls/dist/userland.cjs");
 origins.PROD_ORIGINS.registry;
 function mcpOrigins(apiHint) {
     const www = String(apiHint || process.env.EXTENSION_DEV_API_URL || "").trim() || void 0;
@@ -522,6 +925,7 @@ function mcpOrigins(apiHint) {
         console: process.env.EXTENSION_DEV_CONSOLE_URL,
         inspect: process.env.EXTENSION_DEV_INSPECT_URL,
         preview: process.env.EXTENSION_DEV_PREVIEW_URL,
+        userland: process.env.EXTENSION_DEV_USERLAND_URL,
         registry: process.env.EXTENSION_DEV_REGISTRY_URL,
         media: process.env.EXTENSION_MEDIA_ORIGIN
     }, {
@@ -558,33 +962,75 @@ function consoleProjectUrl(ref, page, apiHint) {
     if (!ref) return base;
     return `${base}${(0, paths_0.consoleProjectPath)(ref, page)}`;
 }
-async function fetchRegistryJson(url, fetchImpl = fetch) {
+function userlandProjectUrl(ref, page = "", apiHint) {
+    if (!ref) return "";
+    try {
+        return (0, userland.userlandUrl)(ref, page, {
+            base: mcpOrigins(apiHint).userland
+        });
+    } catch  {
+        return "";
+    }
+}
+async function readJson(url, res) {
+    try {
+        const text = await res.text();
+        return {
+            ok: true,
+            json: JSON.parse(text)
+        };
+    } catch  {
+        return {
+            ok: false,
+            message: `${url} did not return valid JSON`
+        };
+    }
+}
+async function fetchRegistryJson(url, fetchImpl = fetch, options) {
+    const tokens = options?.tokens ?? defaultRegistryAccessTokens;
+    const ref = options?.ref ?? null;
+    const cached = ref ? tokens.peek(ref) : "";
+    const firstUrl = cached ? withAccessToken(url, cached) : url;
     let res;
     try {
-        res = await fetchImpl(url);
+        res = await fetchImpl(firstUrl);
     } catch (err) {
         return {
             ok: false,
             message: `Could not reach ${url}: ${err?.message || err}`
         };
     }
-    if (!res.ok) return {
+    if (res.ok) return readJson(url, res);
+    const authFailed = 401 === res.status || 403 === res.status;
+    if (!authFailed || !ref) return {
         ok: false,
         status: res.status,
         message: `${url} returned ${res.status}`
     };
-    try {
-        const text = await res.text();
+    const grant = await tokens.get(ref, options?.api);
+    if ("ok" !== grant.status) {
+        const detail = "no-credential" === grant.status ? "This project is private. Run extension_login for it, or set EXTENSION_DEV_TOKEN." : "public" === grant.status ? "The platform reports this project is public, but the registry refused the read." : grant.message;
         return {
-            ok: true,
-            json: JSON.parse(text)
+            ok: false,
+            status: res.status,
+            message: `${url} returned ${res.status}. ${detail}`
         };
-    } catch  {
+    }
+    let retried;
+    try {
+        retried = await fetchImpl(withAccessToken(url, grant.token));
+    } catch (err) {
         return {
             ok: false,
-            message: `${url} did not return valid JSON`
+            message: `Could not reach ${url}: ${err?.message || err}`
         };
     }
+    if (!retried.ok) return {
+        ok: false,
+        status: retried.status,
+        message: `${url} returned ${retried.status} even with an access token`
+    };
+    return readJson(url, retried);
 }
 function parseChannels(json) {
     if (!json || "object" != typeof json || Array.isArray(json)) return [];
@@ -3353,7 +3799,7 @@ function summarizeConsoleMessages(messages) {
         topMessages: topMessages.sort((a, b)=>b.count - a.count).slice(0, 10)
     };
 }
-function _define_property(obj, key, value) {
+function cdp_connection_define_property(obj, key, value) {
     if (key in obj) Object.defineProperty(obj, key, {
         value: value,
         enumerable: true,
@@ -3471,11 +3917,11 @@ class CDPConnection {
         };
     }
     constructor(){
-        _define_property(this, "ws", null);
-        _define_property(this, "messageId", 0);
-        _define_property(this, "eventListeners", new Set());
-        _define_property(this, "pendingRequests", new Map());
-        _define_property(this, "consoleMessages", []);
+        cdp_connection_define_property(this, "ws", null);
+        cdp_connection_define_property(this, "messageId", 0);
+        cdp_connection_define_property(this, "eventListeners", new Set());
+        cdp_connection_define_property(this, "pendingRequests", new Map());
+        cdp_connection_define_property(this, "consoleMessages", []);
     }
 }
 const PAGE_HTML_SCRIPT = `(() => {
@@ -6205,110 +6651,6 @@ async function dom_inspect_handler(args) {
         return raw;
     }
 }
-const DEFAULT_API = origins.PROD_ORIGINS.www;
-function tokenTtlNote(workspaceSlug, projectSlug) {
-    const tokensUrl = workspaceSlug && projectSlug ? consoleProjectUrl({
-        workspace: workspaceSlug,
-        project: projectSlug
-    }, "settings/access-tokens") : consoleBase();
-    return `extension.dev CLI tokens live at most 7 days (server-enforced). CI pipelines must re-mint before expiry on the console's Access tokens page: ${tokensUrl}`;
-}
-function resolveApiBase(api) {
-    return String(api || process.env.EXTENSION_DEV_API_URL || DEFAULT_API).replace(/\/+$/, "");
-}
-function safeApiBase(raw) {
-    let parsed;
-    try {
-        parsed = new URL(raw);
-    } catch  {
-        return {
-            ok: false,
-            message: `Invalid platform URL: ${raw}`
-        };
-    }
-    const isLocalhost = "localhost" === parsed.hostname || "127.0.0.1" === parsed.hostname || "[::1]" === parsed.hostname || "::1" === parsed.hostname;
-    if ("https:" !== parsed.protocol && !("http:" === parsed.protocol && isLocalhost)) return {
-        ok: false,
-        message: `Refusing to send the access token to ${raw}: use https (http is allowed only for localhost).`
-    };
-    return {
-        ok: true,
-        base: `${parsed.origin}${parsed.pathname}`.replace(/\/+$/, "")
-    };
-}
-async function fetchLoginConfig(apiBase, fetchImpl = fetch) {
-    const override = String(process.env.EXTENSION_DEV_GITHUB_CLIENT_ID || "").trim();
-    if (override) return {
-        provider: "github",
-        clientId: override,
-        scope: "read:user",
-        deviceCodeUrl: "/api/cli/device/code",
-        deviceTokenUrl: "/api/cli/device/token",
-        verificationUri: "https://github.com/login/device"
-    };
-    const res = await fetchImpl(`${apiBase}/api/cli/login/config`, {
-        headers: {
-            accept: "application/json"
-        }
-    });
-    if (!res.ok) throw new Error(`Could not fetch login config from ${apiBase} (${res.status}).`);
-    const data = await res.json().catch(()=>({}));
-    const provider = "extensiondev" === data.provider ? "extensiondev" : "github";
-    const clientId = String(data.githubClientId || "").trim();
-    if ("github" === provider && !clientId) throw new Error("Login is not configured on the server (no GitHub client id). Set EXTENSION_DEV_GITHUB_CLIENT_ID to override.");
-    return {
-        provider,
-        clientId,
-        scope: String(data.scope || "read:user"),
-        deviceCodeUrl: String(data.deviceCodeUrl || "/api/cli/device/code"),
-        deviceTokenUrl: String(data.deviceTokenUrl || "/api/cli/device/token"),
-        verificationUri: String(data.verificationUri || "https://github.com/login/device")
-    };
-}
-function persistTokenResponse(args) {
-    const token = String(args.data.token || "").trim();
-    if (!token) throw new Error("Login returned no token.");
-    const creds = {
-        version: 1,
-        token,
-        workspaceSlug: String(args.data.workspaceSlug || ""),
-        projectSlug: String(args.data.projectSlug || ""),
-        expiresAt: Number(args.data.expiresAt || 0),
-        api: args.apiBase,
-        provider: args.provider
-    };
-    writeCredentials(creds);
-    return creds;
-}
-async function exchangeAndPersist(args) {
-    const doFetch = args.fetchImpl ?? fetch;
-    const res = await doFetch(`${args.apiBase}/api/cli/login/exchange`, {
-        method: "POST",
-        headers: {
-            "content-type": "application/json",
-            accept: "application/json"
-        },
-        body: JSON.stringify({
-            githubToken: args.githubToken,
-            project: args.project
-        })
-    });
-    const text = await res.text();
-    let data;
-    try {
-        data = JSON.parse(text);
-    } catch  {
-        data = {
-            message: text
-        };
-    }
-    if (!res.ok) throw new Error(`Login exchange failed (${res.status}): ${data.message || "unknown error"}`);
-    return persistTokenResponse({
-        apiBase: args.apiBase,
-        data,
-        provider: "github"
-    });
-}
 function resolveToken() {
     const fromEnv = String(process.env.EXTENSION_DEV_TOKEN || "").trim();
     if (fromEnv) return fromEnv;
@@ -6430,7 +6772,10 @@ async function publish_handler(args) {
     const ref = resolveProjectRef();
     if (ref) {
         const buildsUrl = registryFileUrl(ref, "builds/index.json");
-        const buildsRes = await fetchRegistryJson(buildsUrl);
+        const buildsRes = await fetchRegistryJson(buildsUrl, fetch, {
+            ref,
+            api: args.api
+        });
         if (buildsRes.ok) {
             const items = parseBuildIndex(buildsRes.json);
             const pinned = args.buildSha ? items.find((item)=>{
@@ -6552,7 +6897,10 @@ async function release_promote_handler(args) {
             enrich.hint = "Run extension_release_list to see this project's channels, their promoted shas, and recent builds.";
             if (ref) {
                 const channelsUrl = registryFileUrl(ref, "channels.json");
-                const channelsRes = await fetchRegistryJson(channelsUrl);
+                const channelsRes = await fetchRegistryJson(channelsUrl, fetch, {
+                    ref,
+                    api: args.api
+                });
                 if (channelsRes.ok) {
                     const rows = parseChannels(channelsRes.json).filter((c)=>c.sha);
                     enrich.validChannelShas = Object.fromEntries(rows.map((c)=>[
@@ -6575,11 +6923,23 @@ async function release_promote_handler(args) {
             ...enrich
         });
     }
-    return JSON.stringify(data);
+    const promotedRef = resolveProjectRef();
+    const publicChannelUrl = userlandProjectUrl(promotedRef, userland.UserlandProjectPage.channel(channel), args.api);
+    const publicBuildUrl = userlandProjectUrl(promotedRef, userland.UserlandProjectPage.build(buildId), args.api);
+    const enriched = data && "object" == typeof data && !Array.isArray(data) ? {
+        ...data,
+        ...publicChannelUrl ? {
+            publicChannelUrl
+        } : {},
+        ...publicBuildUrl ? {
+            publicBuildUrl
+        } : {}
+    } : data;
+    return JSON.stringify(enriched);
 }
 const release_list_schema = {
     name: "extension_release_list",
-    description: "List the project's release channels (channel -> promoted build sha) and recent builds from the public registry (registry.extension.land), so you can pick a valid buildSha for extension_release_promote, extension_deploy, or extension_publish. Read-only, no dispatch. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another public project. Also returns the registry URLs it read and the console Builds page URL.",
+    description: "List the project's release channels (channel -> promoted build sha) and recent builds from the registry (registry.extension.land), so you can pick a valid buildSha for extension_release_promote, extension_deploy, or extension_publish. Read-only, no dispatch. Defaults to the logged-in project (extension_login); pass workspace + project to inspect another project. Works for PRIVATE projects too when your stored login covers them. Returns the registry URLs it read, the console Builds page URL (needs a login), and a publicUrl per channel and build on the public viewer (no login needed for a public project).",
     inputSchema: {
         type: "object",
         properties: {
@@ -6590,6 +6950,10 @@ const release_list_schema = {
             project: {
                 type: "string",
                 description: "Project slug override (defaults to the stored login's project)."
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). Used to resolve link origins and, for a private project, to mint a short-lived read token."
             }
         },
         required: []
@@ -6612,12 +6976,21 @@ async function release_list_handler(args) {
     const metaUrl = registryFileUrl(ref, "meta.json");
     const buildsUrl = registryFileUrl(ref, "builds/index.json");
     const [channelsRes, metaRes, buildsRes] = await Promise.all([
-        fetchRegistryJson(channelsUrl),
-        fetchRegistryJson(metaUrl),
-        fetchRegistryJson(buildsUrl)
+        fetchRegistryJson(channelsUrl, fetch, {
+            ref,
+            api: args.api
+        }),
+        fetchRegistryJson(metaUrl, fetch, {
+            ref,
+            api: args.api
+        }),
+        fetchRegistryJson(buildsUrl, fetch, {
+            ref,
+            api: args.api
+        })
     ]);
-    const buildsPageUrl = consoleProjectUrl(ref, "builds");
-    if (!channelsRes.ok && !metaRes.ok && !buildsRes.ok) return release_list_fail("ReleaseListNotFound", `No registry data for ${ref.workspace}/${ref.project} (${channelsUrl} returned ${channelsRes.status ?? "no response"}). The project may have no builds yet, be private (private registry data needs a share token), or the workspace/project slugs may be wrong. The console Builds page is the authoritative view: ${buildsPageUrl}`, {
+    const buildsPageUrl = consoleProjectUrl(ref, "builds", args.api);
+    if (!channelsRes.ok && !metaRes.ok && !buildsRes.ok) return release_list_fail("ReleaseListNotFound", `No registry data for ${ref.workspace}/${ref.project} (${channelsUrl} returned ${channelsRes.status ?? "no response"}). The project may have no builds yet, or the workspace/project slugs may be wrong. If it is private, make sure extension_login covers this exact project (a token scoped elsewhere cannot read it). The console Builds page is the authoritative view: ${buildsPageUrl}`, {
         workspace: ref.workspace,
         project: ref.project,
         registryUrl: channelsUrl,
@@ -6628,6 +7001,16 @@ async function release_list_handler(args) {
     recentBuilds.sort((a, b)=>String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
     const meta = metaRes.ok ? metaRes.json : void 0;
     const promotable = Array.from(new Set(channels.map((c)=>c.sha).filter(Boolean)));
+    const isPrivate = "private" === String(meta?.visibility || "").toLowerCase();
+    const publicProjectUrl = userlandProjectUrl(ref, "", args.api);
+    const channelsWithUrls = channels.map((c)=>({
+            ...c,
+            publicUrl: userlandProjectUrl(ref, userland.UserlandProjectPage.channel(c.channel), args.api)
+        }));
+    const buildsWithUrls = recentBuilds.map((b)=>({
+            ...b,
+            publicUrl: userlandProjectUrl(ref, userland.UserlandProjectPage.build(b.sha), args.api)
+        }));
     const result = {
         ok: true,
         workspace: ref.workspace,
@@ -6638,10 +7021,16 @@ async function release_list_handler(args) {
         ...meta?.visibility ? {
             visibility: meta.visibility
         } : {},
-        channels,
-        recentBuilds,
+        channels: channelsWithUrls,
+        recentBuilds: buildsWithUrls,
         registryUrl: channelsUrl,
         buildsPageUrl,
+        ...publicProjectUrl ? {
+            publicProjectUrl
+        } : {},
+        ...publicProjectUrl ? {
+            publicUrlNote: isPrivate ? "publicUrl links open only for workspace members. This project is private, so an outside recipient needs a share link from extension_publish." : "publicUrl links are the public build pages: no login needed, and they carry the per-browser downloads and the run locally instructions."
+        } : {},
         message: promotable.length > 0 || recentBuilds.length > 0 ? `Promotable shas: channels currently pin ${promotable.length > 0 ? promotable.join(", ") : "none"}; recent builds add ${recentBuilds.filter((b)=>"success" === b.status).map((b)=>b.sha).join(", ") || "none"}. Use one of these as buildId/buildSha for promote/deploy/publish.` : `No channels or builds are recorded on the registry yet for ${ref.workspace}/${ref.project}. Push a commit to produce a build, then check ${buildsPageUrl}.`
     };
     if (!channelsRes.ok) result.channelsUnavailable = `channels.json unreadable: ${channelsRes.message}`;
@@ -6789,8 +7178,14 @@ async function deploy_handler(args) {
         let channelRows = null;
         if (ref) {
             const [healthRes, channelsRes] = await Promise.all([
-                fetchRegistryJson(registryFileUrl(ref, "stores/health.json")),
-                fetchRegistryJson(registryFileUrl(ref, "channels.json"))
+                fetchRegistryJson(registryFileUrl(ref, "stores/health.json"), fetch, {
+                    ref,
+                    api: args.api
+                }),
+                fetchRegistryJson(registryFileUrl(ref, "channels.json"), fetch, {
+                    ref,
+                    api: args.api
+                })
             ]);
             if (healthRes.ok) {
                 const stores = healthRes.json?.stores;
@@ -6873,6 +7268,10 @@ const store_status_schema = {
             project: {
                 type: "string",
                 description: "Project slug override (defaults to the stored login's project)."
+            },
+            api: {
+                type: "string",
+                description: "Platform base URL (defaults to https://www.extension.dev or EXTENSION_DEV_API_URL). Used to resolve link origins and, for a private project, to mint a short-lived read token."
             }
         },
         required: []
@@ -6972,11 +7371,20 @@ async function store_status_handler(args) {
     const healthUrl = registryFileUrl(ref, "stores/health.json");
     const statusUrl = registryFileUrl(ref, "stores/status.json");
     const submissionsUrl = registryFileUrl(ref, "stores/submissions.json");
-    const consoleStoresUrl = consoleProjectUrl(ref, "stores");
+    const consoleStoresUrl = consoleProjectUrl(ref, "stores", args.api);
     const [healthRes, statusRes, submissionsRes] = await Promise.all([
-        fetchRegistryJson(healthUrl),
-        fetchRegistryJson(statusUrl),
-        fetchRegistryJson(submissionsUrl)
+        fetchRegistryJson(healthUrl, fetch, {
+            ref,
+            api: args.api
+        }),
+        fetchRegistryJson(statusUrl, fetch, {
+            ref,
+            api: args.api
+        }),
+        fetchRegistryJson(submissionsUrl, fetch, {
+            ref,
+            api: args.api
+        })
     ]);
     if (!healthRes.ok && !statusRes.ok && !submissionsRes.ok) return store_status_fail("StoreStatusNotFound", `No store data on the registry for ${ref.workspace}/${ref.project} (${healthUrl} returned ${healthRes.status ?? "no response"}). The project may have no stores configured yet, be private (private registry data needs a share token), or the workspace/project slugs may be wrong. Configure stores at ${consoleStoresUrl}/new; the console Stores page is the authoritative view: ${consoleStoresUrl}`, {
         workspace: ref.workspace,

package/dist/src/lib/registry-access.d.ts

@@ -0,0 +1,45 @@
+import type { ProjectRef } from "./registry";
+export type AccessGrant = {
+    status: "ok";
+    token: string;
+    expiresAt: number;
+}
+/** Project is public; no token is needed and none was minted. */
+ | {
+    status: "public";
+}
+/** No stored credential, or it does not cover the requested project. */
+ | {
+    status: "no-credential";
+}
+/** Reached the platform and it refused (401/403/5xx, network, bad body). */
+ | {
+    status: "denied";
+    httpStatus?: number;
+    message: string;
+};
+export interface AccessTokenCacheOptions {
+    fetchImpl?: typeof fetch;
+    /** Test-only clock override, unix epoch seconds. */
+    nowSeconds?: () => number;
+}
+/**
+ * Per-process cache of minted tokens. Concurrent readers of the same project
+ * share one in-flight mint: a single tool call fans out over meta.json,
+ * channels.json and builds/index.json, and three cold 401s must not become
+ * three mint round-trips.
+ */
+export declare class RegistryAccessTokens {
+    private readonly cache;
+    private readonly fetchImpl;
+    private readonly nowSeconds;
+    constructor(options?: AccessTokenCacheOptions);
+    /** A cached, still-valid token, or "" if none. Never mints. */
+    peek(ref: ProjectRef): string;
+    get(ref: ProjectRef, apiHint?: string): Promise<AccessGrant>;
+    private mint;
+}
+/** Process-wide default, so one tool call's fan-out shares one mint. */
+export declare const defaultRegistryAccessTokens: RegistryAccessTokens;
+/** Append `?t=<token>` to a registry URL. */
+export declare function withAccessToken(url: string, token: string): string;

package/dist/src/lib/registry.d.ts

@@ -1,3 +1,4 @@
+import { type RegistryAccessTokens } from "./registry-access";
 import { type Origins } from "@extension.dev/urls/origins";
 export declare const REGISTRY_BASE_DEFAULT: string;
 /**
@@ -37,6 +38,20 @@ export declare function registryFileUrl(ref: ProjectRef, file: string): string;
  * `EXTENSION_DEV_API_URL`/`EXTENSION_DEV_CONSOLE_URL`.
  */
 export declare function consoleProjectUrl(ref: ProjectRef | null, page: string, apiHint?: string): string;
+/**
+ * The PUBLIC page for a project, a build, or a channel on userland.
+ *
+ * The sibling of consoleProjectUrl, and the one to hand to a human who is not
+ * the operator: the console links every tool already returns require a login
+ * and workspace membership, so they are dead ends for a teammate, a reviewer,
+ * or anyone reading a PR. These carry the per-browser downloads, the run
+ * locally and integrity dialogs, and the what's new tab.
+ *
+ * A PRIVATE project's page still needs a `?share=` token, which only
+ * extension_publish can mint; callers should say so rather than imply the bare
+ * URL will open for anyone.
+ */
+export declare function userlandProjectUrl(ref: ProjectRef | null, page?: string, apiHint?: string): string;
 export type RegistryFetchResult<T> = {
     ok: true;
     json: T;
@@ -46,11 +61,23 @@ export type RegistryFetchResult<T> = {
     message: string;
 };
 /**
- * Fetch a registry JSON file. Never throws: 404s (private or never-built
- * projects), network failures, and non-JSON bodies all come back as
- * `{ok:false}` so callers can degrade honestly instead of crashing the verb.
+ * Fetch a registry JSON file. Never throws: 404s (never-built projects),
+ * network failures, and non-JSON bodies all come back as `{ok:false}` so
+ * callers can degrade honestly instead of crashing the verb.
+ *
+ * PRIVATE PROJECTS: a private project answers 401 here. When `ref` is given and
+ * the caller holds a credential for that project, the 401 triggers one mint of
+ * a short-lived access token and a single retry with `?t=`. Without `ref` the
+ * behaviour is exactly as before, so this stays a drop-in for public reads:
+ * public projects still complete in one round trip and never touch the
+ * platform. See registry-access.ts for why the stored token is traded rather
+ * than sent as `?t=` directly.
  */
-export declare function fetchRegistryJson<T = unknown>(url: string, fetchImpl?: typeof fetch): Promise<RegistryFetchResult<T>>;
+export declare function fetchRegistryJson<T = unknown>(url: string, fetchImpl?: typeof fetch, options?: {
+    ref?: ProjectRef | null;
+    api?: string;
+    tokens?: RegistryAccessTokens;
+}): Promise<RegistryFetchResult<T>>;
 export interface ChannelEntry {
     channel: string;
     sha: string;

package/dist/src/tools/release-list.d.ts

@@ -12,6 +12,10 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            api: {
+                type: string;
+                description: string;
+            };
         };
         required: never[];
     };
@@ -19,4 +23,5 @@ export declare const schema: {
 export declare function handler(args: {
     workspace?: string;
     project?: string;
+    api?: string;
 }): Promise<string>;

package/dist/src/tools/store-status.d.ts

@@ -12,6 +12,10 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            api: {
+                type: string;
+                description: string;
+            };
         };
         required: never[];
     };
@@ -52,5 +56,6 @@ export declare function normalizeStoresStatus(json: unknown): NormalizedStoresSt
 export declare function handler(args: {
     workspace?: string;
     project?: string;
+    api?: string;
 }): Promise<string>;
 export {};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@extension.dev/mcp",
   "type": "module",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "description": "MCP server that lets AI agents (Claude Code, Claude Desktop, Cursor, Copilot, Codex) build, run, inspect, and publish browser extensions. 33 tools for scaffolding, live DOM inspection, log streaming, and store-ready builds across Chrome, Edge, Firefox, Safari, and every Chromium- or Gecko-based browser (Brave, Opera, Vivaldi, Yandex, Waterfox, LibreWolf). Powered by extension.dev and Extension.js.",
   "mcpName": "io.github.extensiondev/mcp",
   "license": "Apache-2.0",
@@ -97,7 +97,7 @@
     "ws": "^8.20.0"
   },
   "devDependencies": {
-    "@extension.dev/urls": "^0.2.0",
+    "@extension.dev/urls": "^0.3.0",
     "@rslib/core": "^0.19.4",
     "@types/cross-spawn": "^6.0.6",
     "@types/node": "^25.2.0",

package/server.json

@@ -7,13 +7,13 @@
     "source": "github"
   },
   "websiteUrl": "https://extension.dev",
-  "version": "6.2.0",
+  "version": "6.3.0",
   "packages": [
     {
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@extension.dev/mcp",
-      "version": "6.2.0",
+      "version": "6.3.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"