@jxsuite/server 4.1.0 → 4.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jxsuite/server",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "description": "Jx development server with live reload, server-side proxy, and studio integration",
   "license": "MIT",
   "repository": {
@@ -18,6 +18,7 @@
     "./ai-api": "./src/ai-api.ts",
     "./data": "./src/data-api.ts",
     "./import-api": "./src/import-api.ts",
+    "./catalog": "./src/extension-catalog.ts",
     "./packages": "./src/packages.ts",
     "./project-server": "./src/project-server.ts",
     "./oauth-loopback": "./src/oauth-loopback.ts",
@@ -39,22 +40,23 @@
     "upgrade": "bun update --latest && bun install"
   },
   "dependencies": {
-    "@jxsuite/collab": "^0.8.5",
-    "@jxsuite/compiler": "^3.1.0",
-    "@jxsuite/create": "^1.3.9",
-    "@jxsuite/import": "^0.40.1",
-    "@jxsuite/protocol": "^2.2.0",
-    "@jxsuite/runtime": "^3.1.0",
-    "@jxsuite/schema": "^2.1.0",
-    "@jxsuite/site": "^1.1.0",
-    "@jxsuite/starters": "^1.7.0",
+    "@jxsuite/catalog": "^0.1.0",
+    "@jxsuite/collab": "^0.9.0",
+    "@jxsuite/compiler": "^4.0.0",
+    "@jxsuite/create": "^1.3.10",
+    "@jxsuite/import": "^0.40.2",
+    "@jxsuite/protocol": "^2.3.0",
+    "@jxsuite/runtime": "^4.0.0",
+    "@jxsuite/schema": "^2.2.0",
+    "@jxsuite/site": "^2.0.0",
+    "@jxsuite/starters": "^1.8.0",
     "chokidar": "^5.0.0",
     "kysely": "^0.29.5",
-    "zod": "^4.5.4"
+    "zod": "^4.6.4"
   },
   "devDependencies": {
-    "@jxsuite/auth": "^0.5.7",
-    "@jxsuite/connector": "^0.5.7",
-    "@jxsuite/parser": "^1.7.0"
+    "@jxsuite/auth": "^0.6.0",
+    "@jxsuite/connector": "^0.6.0",
+    "@jxsuite/parser": "^1.8.0"
   }
 }

package/src/ai-api.ts

@@ -38,7 +38,14 @@ interface ToolCallDelta {
 interface OpenAIStreamChunk {
   choices?: {
     index?: number;
-    delta?: { content?: string; tool_calls?: ToolCallDelta[] };
+    delta?: {
+      content?: string;
+      /** Thinking models' chain-of-thought: DeepSeek/Volcengine spell it this way… */
+      reasoning_content?: string;
+      /** …and OpenRouter this way. Both carry the same thing. */
+      reasoning?: string;
+      tool_calls?: ToolCallDelta[];
+    };
     finish_reason?: string | null;
   }[];
 }
@@ -350,6 +357,15 @@ export async function handleChat(req: Request): Promise<Response> {
               writeSSE(controller, { type: "delta", content: delta.content });
             }
 
+            /* Chain-of-thought, under either of the two names providers give it. Forwarded rather
+               than dropped: DeepSeek's thinking mode requires every prior turn's reasoning back on
+               any request carrying `tools`, so a proxy that swallows these frames makes the NEXT
+               round a 400 the client cannot repair. */
+            const reasoning = delta.reasoning_content ?? delta.reasoning;
+            if (typeof reasoning === "string" && reasoning) {
+              writeSSE(controller, { type: "reasoning", content: reasoning });
+            }
+
             // Tool calls
             if (delta.tool_calls) {
               for (const tc of delta.tool_calls) {

package/src/extension-catalog.ts

@@ -0,0 +1,218 @@
+/**
+ * Catalog — what THIS backend can offer a project (specs/extensions.md §9.2).
+ *
+ * The available half of the pair whose enabled half is `buildExtensionsPayload`. Two sources, and
+ * the split is the point:
+ *
+ * 1. The shipped first-party catalogue (`@jxsuite/catalog`), which is data generated from the
+ *    `extensions/` tree, so core keeps no dependency on an extension package (§2).
+ * 2. The project's own dependencies, scanned for anything exporting a `jx-extension.json`.
+ *
+ * Both are then annotated with two facts only a backend holds: whether the PROJECT resolves the
+ * package, and whether THIS HOST does. Those are probed rather than declared, because what a
+ * desktop build stages and what a Worker bundles are different facts and neither is knowable from a
+ * package list — which is also why the catalogue is a platform capability instead of a constant.
+ *
+ * **`installed` is answered here rather than by the client**, because `listPackages` does not mean
+ * one thing across backends: the dev server's own packages route drops a declared dependency it
+ * cannot resolve under `node_modules`, while desktop's reads the manifest and keeps it. A surface
+ * deciding "do I need to install this first?" from that would be right on one backend and wrong on
+ * the other.
+ *
+ * @docs extending/extensions/first-party
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { listCatalog } from "@jxsuite/catalog";
+import { buildExtensionRegistry } from "@jxsuite/schema/extension-registry";
+import { createNodeFormatIO, probeExtension } from "@jxsuite/compiler/format-host";
+import type { ExtensionCatalogEntry, ExtensionSectionInfo } from "@jxsuite/protocol";
+
+/** The well-known manifest filename, mirroring `@jxsuite/schema`'s `EXTENSION_MANIFEST`. */
+const MANIFEST = "jx-extension.json";
+
+interface PackageJson {
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  jx?: string;
+}
+
+/** Read a project's package.json, or null when it has none or it will not parse. */
+function readPackageJson(projectRoot: string): PackageJson | null {
+  const path = resolve(projectRoot, "package.json");
+  if (!existsSync(path)) {
+    return null;
+  }
+  try {
+    return JSON.parse(readFileSync(path, "utf8")) as PackageJson;
+  } catch {
+    // A project mid-edit should cost the catalogue its discovered half, not the whole response.
+    return null;
+  }
+}
+
+/** Every dependency name a project declares, runtime and dev alike. */
+function declaredDependencies(projectRoot: string): string[] {
+  const pkg = readPackageJson(projectRoot);
+  return pkg === null
+    ? []
+    : [...Object.keys(pkg.dependencies ?? {}), ...Object.keys(pkg.devDependencies ?? {})];
+}
+
+/**
+ * Load one extension through the REGISTRY rather than reading its manifest directly.
+ *
+ * Discovery and enablement then agree by construction: this is the same loader `project.json` will
+ * run, so a package that builds here is one that will build there, and a package that throws here
+ * throws with the message that names the fix. `FormatEntry`'s constructor is pure data and never
+ * imports an implementation module, so this stays JSON reads.
+ *
+ * @param {string} projectRoot
+ * @param {string} name - Bare package specifier
+ * @returns {Promise<{ sections; formats; title?; description? } | { problem: string }>}
+ */
+async function loadEntry(
+  projectRoot: string,
+  name: string,
+): Promise<
+  | { description?: string; formats: string[]; sections: ExtensionSectionInfo[]; title?: string }
+  | { problem: string }
+> {
+  try {
+    const registry = await buildExtensionRegistry(
+      [name],
+      createNodeFormatIO(projectRoot),
+      resolve(projectRoot, "project.json"),
+    );
+    const [info] = registry.extensions;
+    if (!info) {
+      return { problem: `"${name}" did not load as an extension` };
+    }
+    const sections: ExtensionSectionInfo[] = [];
+    const formats = new Set<string>();
+    for (const cls of info.classes) {
+      if (cls.project) {
+        const { key, title } = cls.project;
+        sections.push({ key, ...(typeof title === "string" ? { title } : {}) });
+      }
+      for (const ext of cls.extensions) {
+        formats.add(ext);
+      }
+    }
+    return {
+      formats: [...formats].toSorted(),
+      sections,
+      ...(info.manifest.title === undefined ? {} : { title: info.manifest.title }),
+      ...(info.manifest.description === undefined
+        ? {}
+        : { description: info.manifest.description }),
+    };
+  } catch (error) {
+    return { problem: error instanceof Error ? error.message : String(error) };
+  }
+}
+
+/**
+ * Whether a package that failed to resolve nonetheless MEANT to be an extension.
+ *
+ * `"jx"` is not what a host resolves — the registry goes through the exports map and nothing else,
+ * which is why the probe is authoritative. But reading it separates "this package got its exports
+ * map wrong" from "this package is not an extension", and that is the difference between a silent
+ * omission and a row that says what is broken. It is the first job the field has ever had.
+ *
+ * @param {string} projectRoot
+ * @param {string} name
+ * @returns {boolean}
+ */
+function declaresJxField(projectRoot: string, name: string): boolean {
+  const path = resolve(projectRoot, "node_modules", name, "package.json");
+  if (!existsSync(path)) {
+    return false;
+  }
+  try {
+    return typeof (JSON.parse(readFileSync(path, "utf8")) as PackageJson).jx === "string";
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The catalogue for one project: the shipped first-party entries, then anything its own
+ * dependencies declare.
+ *
+ * Every first-party entry is returned whether or not the project has it, because the whole purpose
+ * is to advertise what could be turned on. A discovered entry is only ever one the project already
+ * depends on.
+ *
+ * @param {string} projectRoot - Absolute path to the project
+ * @returns {Promise<ExtensionCatalogEntry[]>}
+ */
+export async function buildExtensionCatalog(projectRoot: string): Promise<ExtensionCatalogEntry[]> {
+  const entries: ExtensionCatalogEntry[] = [];
+  const seen = new Set<string>();
+
+  for (const meta of listCatalog()) {
+    seen.add(meta.name);
+    const found = probeExtension(projectRoot, meta.name);
+    entries.push({
+      description: meta.description,
+      docs: meta.docs,
+      installed: found.project,
+      name: meta.name,
+      sections: meta.sections,
+      source: "first-party",
+      title: meta.title,
+      ...(meta.formats ? { formats: meta.formats } : {}),
+      ...(meta.requires ? { requires: meta.requires } : {}),
+      // Bundled means "resolves without a project install": the host answers for it, and the
+      // Project does not have to.
+      ...(found.host && !found.project ? { bundled: true } : {}),
+    });
+  }
+
+  for (const name of declaredDependencies(projectRoot)) {
+    if (seen.has(name)) {
+      continue;
+    }
+    seen.add(name);
+    const found = probeExtension(projectRoot, name);
+    if (!found.project) {
+      if (declaresJxField(projectRoot, name)) {
+        entries.push({
+          installed: true,
+          name,
+          problem:
+            `declares "jx" but does not export "./${MANIFEST}", so no host can resolve its ` +
+            `manifest — add that entry to its exports map`,
+          sections: [],
+          source: "project",
+        });
+      }
+      continue;
+    }
+    const loaded = await loadEntry(projectRoot, name);
+    if ("problem" in loaded) {
+      entries.push({
+        installed: true,
+        name,
+        problem: loaded.problem,
+        sections: [],
+        source: "project",
+      });
+      continue;
+    }
+    entries.push({
+      installed: true,
+      name,
+      sections: loaded.sections,
+      source: "project",
+      ...(loaded.title === undefined ? {} : { title: loaded.title }),
+      ...(loaded.description === undefined ? {} : { description: loaded.description }),
+      ...(loaded.formats.length > 0 ? { formats: loaded.formats } : {}),
+      ...(found.host ? { bundled: true } : {}),
+    });
+  }
+
+  return entries;
+}

package/src/studio-api.ts

@@ -1497,6 +1497,26 @@ export async function handleStudioApi(
     }
   }
 
+  // What this backend can OFFER, enabled or not (specs/extensions.md §9.2) — the shipped
+  // First-party catalogue plus any dependency of THIS project exporting a jx-extension.json, each
+  // Marked with whether the project resolves it and whether this host does.
+  //
+  // Deliberately NOT a field on /__studio/formats. That route builds the project's registry and
+  // Fails when a declared extension does not resolve, which is exactly the state a reader is in
+  // When they need the catalogue to repair it; riding on formats would make the answer unavailable
+  // Precisely when it is the fix.
+  if (path === "/__studio/catalog" && req.method === "GET") {
+    const dir = url.searchParams.get("dir") || activeProjectRoot || root;
+    const projectRoot = isAbsolute(dir) ? dir : resolve(root, dir);
+    try {
+      assertAccessible(projectRoot, root, activeProjectRoot);
+      const { buildExtensionCatalog } = await import("./extension-catalog.ts");
+      return Response.json(await buildExtensionCatalog(projectRoot));
+    } catch (error) {
+      return problem("invalidRequest", errorMessage(error));
+    }
+  }
+
   // Pre-bundled per-project entry schemas (project.schema.json / document.schema.json) for the
   // Studio's editor — regenerated on demand when missing or older than project.json, then bundled
   // Into self-contained compound documents so no relative $ref resolution is needed client-side.
@@ -1846,7 +1866,13 @@ export async function handleStudioApi(
         if (fp.includes("..")) {
           return problem("invalidRequest", "Invalid path");
         }
-        const content = await runGit(["show", `${ref}:${fp}`]);
+        /* `./` IS LOAD-BEARING. `git show <rev>:<path>` resolves <path> from the REPOSITORY ROOT,
+           whatever the cwd is; only a `./` prefix makes it relative to the cwd. Every other verb
+           here — status, diff, checkout — is cwd-relative, and so is the `readFile` the studio
+           pairs this with, so without it a project nested inside its repo compared two DIFFERENT
+           FILES: the working copy of `examples/package.json` against the committed root
+           `package.json`, with no error anywhere and a plausible-looking diff. */
+        const content = await runGit(["show", `${ref}:./${fp}`]);
         return Response.json({ content });
       }