@gea-ai/extensions-sdk 0.1.260825-alpha.4 → 0.1.260827-alpha.0

package/README.md

@@ -606,9 +606,15 @@ canonical Tool-output continuation API. Call the host-owned
 newly created stream as shown above. If this action is omitted, display-only
 YAML continues to render and interactive request controls are not mounted.
 
-Interactive YAML is joined to its request tool part only when the YAML `root`
-exactly matches `tool.input.requestKey`; submission then targets that part's
-runtime `toolCallId`.
+Interactive YAML is read directly from `tool.input.yaml` without a Markdown
+fence and rendered at that request tool part's position. Submission targets the
+same part's runtime `toolCallId` and sends the complete current form state.
+Legacy request-key parts and interactive YAML copied into assistant text are
+not mounted. During `input-streaming`, partial YAML is display-only: the
+renderer shows a loading placeholder or a locked last-valid preview and never
+calls the host. `input-available` triggers final strict validation and unlocks
+the form; the existing persisted `messageId` plus `toolCallId` submission path
+is unchanged.
 
 ## Host Context, Theme, And Locale
 
@@ -694,6 +700,13 @@ resource handles from that bootstrap and exposes them as typed `app.resources`
 when the frontend uses `useExtensionApp()` from a runtime created with the
 declaration.
 
+Declared resource handles are an authoring and lifecycle convenience, not an
+additional permission boundary. The curated `app.gea.context` methods may also
+operate on existing Context resources. Every call runs as the current signed-in
+user and keeps the target Context route's ordinary API-scope, organization,
+workspace, resource, and row-scope authorization; an Extension never gains
+permissions that the user does not already have.
+
 > **Warning:** Syncing a declaration that removes resources may deactivate
 > their bindings immediately, including bindings used by the currently
 > published extension. The underlying workspace resources and their data are

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gea-ai/extensions-sdk",
-  "version": "0.1.260825-alpha.4",
+  "version": "0.1.260827-alpha.0",
   "private": false,
   "homepage": "https://musegea.com/developers/extensions",
   "license": "Apache-2.0",
@@ -52,7 +52,7 @@
   "dependencies": {
     "@tanstack/react-query": "^5.101.0",
     "zod": "4.3.6",
-    "@gea-ai/contract": "0.1.260825-alpha.4"
+    "@gea-ai/contract": "0.1.260827-alpha.0"
   },
   "devDependencies": {
     "@types/react": "^19.2.0",