@jimhoyd/urlcode 0.4.6 → 0.4.8

package/recipes/redirect/tests/requests.json

@@ -12,8 +12,30 @@
     "status": 301,
     "expectBody": ""
   },
+  {
+    "path": "/users/42",
+    "status": 308,
+    "expectHeaders": {
+      "location": "https://example.com/profiles/42"
+    }
+  },
+  {
+    "path": "/users/42/extra",
+    "status": 404
+  },
+  {
+    "path": "/users/42",
+    "method": "HEAD",
+    "status": 308,
+    "expectBody": ""
+  },
   {
     "path": "/missing",
     "status": 404
+  },
+  {
+    "path": "/docs",
+    "method": "DELETE",
+    "status": 405
   }
 ]

package/recipes/redirect/urlcode.yaml

@@ -1,9 +1,19 @@
 version: "1"
 routes:
   /docs:
-    description: Move documentation and preserve only the declared campaign key.
+    description: Permanent move, forwarding only the declared campaign key.
     redirect:
       url: https://example.com/documentation
       status: 301
       query:
         pass: [campaign]
+  /users/{id}:
+    description: Parameterized redirect; the id segment carries straight through.
+    parameters:
+      - name: id
+        in: path
+        required: true
+        schema: {type: string, minLength: 1, maxLength: 64}
+    redirect:
+      url: https://example.com/profiles/{id}
+      status: 308

package/skills/urlcode/SKILL.md

@@ -34,6 +34,8 @@ When the MCP server was started with an operator host file, `get_extensions`
 returns installed extension configuration/policy schemas, declared project
 hook contracts, supported authoring surfaces and fast checks. Otherwise use `urlcode extensions --project DIR --host-file
 ABSOLUTE_HOST --json` when the operator has supplied that host file.
+If the project commits `urlcode.extensions.lock.json`, call `get_extension_artifacts`, then `get_extension_artifact` for only the locked schema, example or README needed; without MCP, run `urlcode extension-artifacts inspect --project DIR --json` before reading its cache.
+These are verified, inert authoring inputs, not proof of an installed executable extension. Fetch or update one only when the user requests that project change and names an immutable `extensions@v…` release.
 Without the server, run the CLI equivalents and read only the output:
 
 ```sh

package/starters/default/AGENTS.md

@@ -22,7 +22,7 @@ static serving and authentication. Read this file before changing anything.
 
 When present, `.mcp.json` registers the read-only `urlcode mcp` server; prefer its
 tools (also `get_manifest`) to reading documents. Inspect `get_extensions` before
-replacing extension behavior. `--allow-authoring` is an operator opt-in; never add it.
+replacing extension behavior. `--allow-authoring` is an operator opt-in; never add it. For a committed artifact lock, use `get_extension_artifacts`/`get_extension_artifact`; they expose verified inert data and never activate an extension.
 
 ## What the runtime provides (this version)