@nimbus-dev/connectors 0.1.0

package/connectors/snyk/src/server.ts

@@ -0,0 +1,144 @@
+import { z } from "zod";
+import { matchesResult } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSnykAggregatedIssues } from "./search-filter.ts";
+
+const SNYK_API = "https://api.snyk.io";
+
+function authHeader(): Record<string, string> {
+  const t = process.env["SNYK_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SNYK_TOKEN is not set");
+  }
+  return { Authorization: `token ${t}`, Accept: "application/json" };
+}
+
+async function snykGet(path: string): Promise<unknown> {
+  const res = await fetch(`${SNYK_API}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Snyk ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+async function snykPost(path: string, body: unknown): Promise<unknown> {
+  const res = await fetch(`${SNYK_API}${path}`, {
+    method: "POST",
+    headers: { ...authHeader(), "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Snyk ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  if (text.trim() === "") {
+    return {};
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-snyk", (reg) => {
+  reg(
+    "snyk_list",
+    "List Snyk projects for an org, or aggregated issues for a project. When projectId is omitted, returns the org's project list. Severities default to all four (critical/high/medium/low).",
+    z.object({
+      orgId: z.string().min(1),
+      projectId: z.string().min(1).optional(),
+      severities: z
+        .array(z.enum(["critical", "high", "medium", "low"]))
+        .min(1)
+        .optional(),
+      limit: z.number().int().min(1).max(1000).optional(),
+    }),
+    async (p) => {
+      if (p.projectId === undefined) {
+        return jsonResult(await snykGet(`/v1/org/${encodeURIComponent(p.orgId)}/projects`));
+      }
+      const severities = p.severities ?? ["critical", "high", "medium", "low"];
+      const body = {
+        filters: {
+          severities,
+          types: ["vuln", "license"],
+          ignored: false,
+          patched: false,
+        },
+      };
+      const path = `/v1/org/${encodeURIComponent(p.orgId)}/project/${encodeURIComponent(p.projectId)}/aggregated-issues`;
+      const data = await snykPost(path, body);
+      if (p.limit !== undefined && data !== null && typeof data === "object") {
+        const issues = (data as { issues?: unknown[] }).issues;
+        if (Array.isArray(issues) && issues.length > p.limit) {
+          return jsonResult({
+            ...(data as Record<string, unknown>),
+            issues: issues.slice(0, p.limit),
+          });
+        }
+      }
+      return jsonResult(data);
+    },
+  );
+
+  reg(
+    "snyk_get",
+    "Fetch one Snyk issue by id from an org + project. Returns the aggregated-issue envelope for the matching `issue.id`; throws when no match is found.",
+    z.object({
+      orgId: z.string().min(1),
+      projectId: z.string().min(1),
+      issueId: z.string().min(1),
+    }),
+    async (p) => {
+      const body = {
+        filters: {
+          severities: ["critical", "high", "medium", "low"],
+          types: ["vuln", "license"],
+          ignored: false,
+          patched: false,
+        },
+      };
+      const path = `/v1/org/${encodeURIComponent(p.orgId)}/project/${encodeURIComponent(p.projectId)}/aggregated-issues`;
+      const root = await snykPost(path, body);
+      const issues = (root as { issues?: unknown[] } | null)?.issues;
+      if (!Array.isArray(issues)) {
+        throw new TypeError(`Snyk: project ${p.projectId} returned no issues envelope`);
+      }
+      const match = issues.find((it) => {
+        if (it === null || typeof it !== "object") {
+          return false;
+        }
+        const id = (it as { id?: unknown }).id;
+        return typeof id === "string" && id === p.issueId;
+      });
+      if (match === undefined) {
+        throw new Error(`Snyk: issue ${p.issueId} not found in project ${p.projectId}`);
+      }
+      return jsonResult(match);
+    },
+  );
+
+  reg(
+    "snyk_search",
+    "Substring search across a project's aggregated issues. Matches the query against `issueData.title`, `issueData.cve`, and `pkgName` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      orgId: z.string().min(1),
+      projectId: z.string().min(1),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      const body = {
+        filters: {
+          severities: ["critical", "high", "medium", "low"],
+          types: ["vuln", "license"],
+          ignored: false,
+          patched: false,
+        },
+      };
+      const path = `/v1/org/${encodeURIComponent(p.orgId)}/project/${encodeURIComponent(p.projectId)}/aggregated-issues`;
+      const root = await snykPost(path, body);
+      const issues = (root as { issues?: unknown[] } | null)?.issues;
+      return matchesResult(issues, filterSnykAggregatedIssues, p);
+    },
+  );
+});

package/connectors/sonarqube/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.sonarqube",
+  "displayName": "SonarQube / SonarCloud",
+  "version": "0.1.0",
+  "description": "SonarQube + SonarCloud REST connector (issues, projects). Read-only; surfaces severity, type (BUG/VULNERABILITY/CODE_SMELL), rule, file/line into the local index. Self-hosted SonarQube via `sonarqube.url` is a known Task 14 runtime-merge follow-up — the SaaS host (sonarcloud.io) is the only one in the static sandbox manifest today.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["sonarcloud.io"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/sonarqube/src/search-filter.ts

@@ -0,0 +1,28 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type SonarSearchMatchOptions = SearchMatchOptions;
+
+function stringArray(value: unknown): string[] {
+  return Array.isArray(value) ? value.filter((t): t is string => typeof t === "string") : [];
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  const tags = stringArray(row["tags"]);
+  return [
+    stringField(row, "message"),
+    stringField(row, "rule"),
+    stringField(row, "component"),
+    tags.join(" "),
+  ];
+}
+
+export const filterSonarIssues = makeQueryFilter(fieldsOf);

package/connectors/sonarqube/src/server.ts

@@ -0,0 +1,115 @@
+import { z } from "zod";
+import { matchesResult } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSonarIssues } from "./search-filter.ts";
+
+const DEFAULT_API = "https://sonarcloud.io";
+const ISSUE_TYPES = ["BUG", "VULNERABILITY", "CODE_SMELL"] as const;
+const OPEN_STATUSES = ["OPEN", "CONFIRMED", "REOPENED"] as const;
+
+function stripTrailingSlashes(s: string): string {
+  let end = s.length;
+  while (end > 0 && s.codePointAt(end - 1) === 47) end -= 1;
+  return s.slice(0, end);
+}
+
+function apiBase(): string {
+  const raw = process.env["SONARQUBE_URL"]?.trim();
+  if (raw === undefined || raw === "") {
+    return DEFAULT_API;
+  }
+  return stripTrailingSlashes(raw);
+}
+
+function authHeader(): Record<string, string> {
+  const t = process.env["SONARQUBE_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SONARQUBE_TOKEN is not set");
+  }
+  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
+}
+
+async function sonarGet(path: string): Promise<unknown> {
+  const res = await fetch(`${apiBase()}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`SonarQube ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-sonarqube", (reg) => {
+  reg(
+    "sonarqube_list",
+    "List SonarQube projects, or issues for a project. When projectKey is omitted, returns the project list (SonarCloud requires `SONARQUBE_ORGANIZATION` env; self-hosted ignores it). When projectKey is provided, returns open issues (status OPEN/CONFIRMED/REOPENED) for that project.",
+    z.object({
+      projectKey: z.string().min(1).optional(),
+      types: z.array(z.enum(ISSUE_TYPES)).min(1).optional(),
+      severities: z
+        .array(z.enum(["BLOCKER", "CRITICAL", "MAJOR", "MINOR", "INFO"]))
+        .min(1)
+        .optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      if (p.projectKey === undefined) {
+        const org = process.env["SONARQUBE_ORGANIZATION"]?.trim();
+        const search = new URLSearchParams({ qualifiers: "TRK", ps: "100" });
+        if (org !== undefined && org !== "") {
+          search.set("organization", org);
+        }
+        return jsonResult(await sonarGet(`/api/components/search?${search.toString()}`));
+      }
+      const types = p.types ?? ISSUE_TYPES;
+      const search = new URLSearchParams({
+        componentKeys: p.projectKey,
+        types: types.join(","),
+        statuses: OPEN_STATUSES.join(","),
+        ps: String(p.limit ?? 100),
+      });
+      if (p.severities !== undefined && p.severities.length > 0) {
+        search.set("severities", p.severities.join(","));
+      }
+      return jsonResult(await sonarGet(`/api/issues/search?${search.toString()}`));
+    },
+  );
+
+  reg(
+    "sonarqube_get",
+    "Fetch one SonarQube issue by key. Returns the matching issue envelope from `/api/issues/search?issues=<key>`; throws when no match is found.",
+    z.object({
+      issueKey: z.string().min(1),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({ issues: p.issueKey, ps: "1" });
+      const root = await sonarGet(`/api/issues/search?${search.toString()}`);
+      const issues = (root as { issues?: unknown[] } | null)?.issues;
+      if (!Array.isArray(issues) || issues.length === 0) {
+        throw new Error(`SonarQube: issue ${p.issueKey} not found`);
+      }
+      return jsonResult(issues[0]);
+    },
+  );
+
+  reg(
+    "sonarqube_search",
+    "Substring search across a project's open issues. Matches the query against `message`, `rule`, `component`, and `tags` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({
+      projectKey: z.string().min(1),
+      query: z.string().min(1),
+      limit: z.number().int().min(1).max(200).optional(),
+    }),
+    async (p) => {
+      const search = new URLSearchParams({
+        componentKeys: p.projectKey,
+        types: ISSUE_TYPES.join(","),
+        statuses: OPEN_STATUSES.join(","),
+        ps: "500",
+      });
+      const root = await sonarGet(`/api/issues/search?${search.toString()}`);
+      const issues = (root as { issues?: unknown[] } | null)?.issues;
+      return matchesResult(issues, filterSonarIssues, p);
+    },
+  );
+});

package/connectors/stackoverflow/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.stackoverflow",
+  "displayName": "Stack Overflow for Teams",
+  "version": "0.1.0",
+  "description": "Stack Overflow for Teams connector (read-only). Surfaces the team's private Q&A `questions` as `stackoverflow:question` items in the local index — the title, the question body, the tags, the score / view count / answer count, the answered flag, and the asking user. Useful for answering knowledge questions (\"how do we handle retries?\", \"who knows about the billing pipeline?\") without leaving Nimbus. Bearer API-token auth (`Authorization: Bearer <token>` — a Stack Overflow for Teams Personal Access Token; never logged) plus the `Accept: application/json` request header. The SaaS host (api.stackoverflowteams.com) is fixed; the team slug is URL-encoded into the request path. The v3 API page-paginates the `/v3/teams/<team>/questions` endpoint by page number (1-based, page_size=100), returning the `{ items, totalCount, pageSize, page, totalPages, sort, order }` envelope. `creationDate` / `lastActivityDate` / `lastEditDate` are ISO-8601 (converted to epoch-ms on index). `webUrl` is the per-question canonical URL. Answers, articles, tags-as-items, and users-as-items are deferred follow-ups; v1 indexes questions only.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.stackoverflowteams.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/stackoverflow/src/search-filter.ts

@@ -0,0 +1,52 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type StackOverflowSearchMatchOptions = SearchMatchOptions;
+
+function tagText(row: Record<string, unknown>): string {
+  const tags = row["tags"];
+  if (!Array.isArray(tags)) {
+    return "";
+  }
+  const names: string[] = [];
+  for (const t of tags) {
+    if (typeof t === "string") {
+      names.push(t);
+    } else if (t !== null && typeof t === "object") {
+      const name = (t as Record<string, unknown>)["name"];
+      if (typeof name === "string") {
+        names.push(name);
+      }
+    }
+  }
+  return names.join(" ");
+}
+
+function ownerName(row: Record<string, unknown>): string {
+  const owner = row["owner"];
+  if (owner === null || typeof owner !== "object") {
+    return "";
+  }
+  const name = (owner as Record<string, unknown>)["name"];
+  return typeof name === "string" ? name : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [
+    stringField(row, "title"),
+    stringField(row, "body"),
+    stringField(row, "bodyMarkdown"),
+    tagText(row),
+    ownerName(row),
+  ];
+}
+
+export const filterStackOverflowQuestions = makeQueryFilter(fieldsOf);

package/connectors/stackoverflow/src/server.ts

@@ -0,0 +1,81 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterStackOverflowQuestions } from "./search-filter.ts";
+
+const BASE = "https://api.stackoverflowteams.com";
+
+function apiToken(): string {
+  const t = process.env["STACKOVERFLOW_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("STACKOVERFLOW_TOKEN is not set");
+  }
+  return t;
+}
+
+function teamSlug(): string {
+  const t = process.env["STACKOVERFLOW_TEAM"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("STACKOVERFLOW_TEAM is not set");
+  }
+  return t;
+}
+
+function authHeader(): Record<string, string> {
+  return { Authorization: `Bearer ${apiToken()}`, Accept: "application/json" };
+}
+
+async function stackOverflowGet(path: string): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Stack Overflow ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function questionsBasePath(): string {
+  return `/v3/teams/${encodeURIComponent(teamSlug())}/questions`;
+}
+
+await runReadOnlyMcpConnector("nimbus-stackoverflow", (reg) => {
+  reg(
+    "stackoverflow_list",
+    "List the team's Stack Overflow for Teams questions (`GET /v3/teams/<team>/questions?page=1&pagesize=100&sort=creation&order=desc`). Returns the `{ items: [...], totalCount, pageSize, page, totalPages, sort, order }` envelope — `items` holds the question objects.",
+    z.object({}),
+    async () => {
+      return jsonResult(
+        await stackOverflowGet(
+          `${questionsBasePath()}?page=1&pagesize=100&sort=creation&order=desc`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "stackoverflow_get",
+    "Fetch one Stack Overflow for Teams question by its id (`GET /v3/teams/<team>/questions/{id}`). Returns the question object directly (NOT wrapped in an `{ items }` envelope). Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(
+        await stackOverflowGet(`${questionsBasePath()}/${encodeURIComponent(p.id)}`),
+      );
+    },
+  );
+
+  reg(
+    "stackoverflow_search",
+    "Substring search across the team's Stack Overflow for Teams questions (first page only). Matches the query against the question title, body, tags, and the asking user's name (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await stackOverflowGet(
+        `${questionsBasePath()}?page=1&pagesize=100&sort=creation&order=desc`,
+      );
+      const items = (root as { items?: unknown[] } | null)?.items;
+      return matchesResult(items, filterStackOverflowQuestions, p);
+    },
+  );
+});

package/connectors/storybook/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.storybook",
+  "displayName": "Storybook",
+  "version": "0.1.0",
+  "description": "Storybook component/story manifest connector (Tier-5 local class). Indexes the story-level metadata from a local Storybook manifest — the index.json (Storybook v7+) or legacy stories.json (v6) that `storybook build` writes to disk — as `storybook:story` items: story id, component title, story name, import path, tags, and entry type. This gives design-system component coverage and lets you recall 'which stories cover the Button component'. It is a pure filesystem read of one JSON manifest under the configured Storybook output directory: NO browser is launched, NO dev server is contacted, and NO component code is executed. The user points the connector at their Storybook output dir (e.g. storybook-static) via the non-secret path `storybook.dir`; read tools are `storybook_list`, `storybook_get`, `storybook_search`. The configured directory arrives as the scoped environment variable STORYBOOK_DIR and is added to the sandbox filesystem.read allow-list at spawn time. No network access.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/storybook/src/server.ts

@@ -0,0 +1,6 @@
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { registerStorybookTools } from "./tools.ts";
+
+await runReadOnlyMcpConnector("nimbus-storybook", (reg) => {
+  registerStorybookTools(reg);
+});

package/connectors/storybook/src/storybook-parse.ts

@@ -0,0 +1,67 @@
+import { readFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { parseStorybookIndex, type StorybookStory } from "@nimbus-dev/sdk";
+
+export type { StorybookStory };
+export { parseStorybookIndex };
+
+/**
+ * Local-only reader for a Storybook component/story manifest. This module is the
+ * MCP-server-side counterpart of the gateway's `mapStorybookStoryToItem` mapper:
+ * it reads the `index.json` (v7+) or legacy `stories.json` (v6) manifest that
+ * `storybook build` writes to disk and returns story-level METADATA.
+ *
+ * No browser, no dev-server connection, no code execution — a pure filesystem
+ * read of one JSON manifest under the configured Storybook output dir.
+ */
+
+const MAX_FILE_BYTES = 16 * 1024 * 1024;
+const MANIFEST_NAMES = ["index.json", "stories.json"] as const;
+
+/**
+ * Resolve the configured Storybook dir from the environment. Throws when unset so
+ * the MCP tools surface a clear error rather than reading an empty path.
+ */
+export function storybookDir(): string {
+  const dir = process.env["STORYBOOK_DIR"]?.trim();
+  if (dir === undefined || dir === "") {
+    throw new Error("STORYBOOK_DIR is not set");
+  }
+  return resolve(dir);
+}
+
+async function readManifest(root: string): Promise<unknown> {
+  for (const name of MANIFEST_NAMES) {
+    try {
+      const buf = await readFile(join(root, name));
+      if (buf.byteLength > MAX_FILE_BYTES) {
+        return null;
+      }
+      return JSON.parse(buf.toString("utf8")) as unknown;
+    } catch {
+      // try the next candidate name
+    }
+  }
+  return null;
+}
+
+/** Read + parse all stories from the manifest under the configured dir. */
+export async function loadStories(): Promise<StorybookStory[]> {
+  const parsed = await readManifest(storybookDir());
+  return parsed === null ? [] : parseStorybookIndex(parsed);
+}
+
+/** Substring search over story id / component title / story name / tags. */
+export function filterStories(stories: readonly StorybookStory[], query: string): StorybookStory[] {
+  const q = query.trim().toLowerCase();
+  if (q === "") {
+    return [...stories];
+  }
+  return stories.filter(
+    (s) =>
+      s.id.toLowerCase().includes(q) ||
+      (s.title ?? "").toLowerCase().includes(q) ||
+      (s.name ?? "").toLowerCase().includes(q) ||
+      s.tags.some((t) => t.toLowerCase().includes(q)),
+  );
+}

package/connectors/storybook/src/tools.ts

@@ -0,0 +1,68 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterStories, loadStories, type StorybookStory } from "./storybook-parse.ts";
+
+/**
+ * Storybook MCP tool surface. Reads the local Storybook manifest (index.json /
+ * stories.json) and returns story-level metadata — a pure filesystem read. No
+ * browser, no dev-server connection, no code execution.
+ */
+export const STORYBOOK_TOOL_NAMES = [
+  "storybook_list",
+  "storybook_get",
+  "storybook_search",
+] as const;
+
+function toEnvelope(s: StorybookStory): Record<string, unknown> {
+  return {
+    id: s.id,
+    title: s.title,
+    name: s.name,
+    importPath: s.importPath,
+    tags: [...s.tags],
+    type: s.entryType,
+  };
+}
+
+/**
+ * Register the read-only Storybook tools onto the given registrar. Shared
+ * between `server.ts` (live) and the contract test (introspection).
+ */
+export function registerStorybookTools(reg: ZodToolRegistrar): void {
+  reg(
+    "storybook_list",
+    "List stories from the local Storybook manifest (index.json / stories.json). Returns each story's id, component title, story name, import path, tags, and type. A pure filesystem read — no browser or dev server is contacted.",
+    z.object({ limit: z.number().int().min(1).max(2000).optional() }),
+    async (p) => {
+      const all = await loadStories();
+      const limit = p.limit ?? 500;
+      return jsonResult({ items: all.slice(0, limit).map(toEnvelope) });
+    },
+  );
+
+  reg(
+    "storybook_get",
+    "Fetch one story by its Storybook id (e.g. 'components-button--primary'). Returns the story's metadata, or null if absent.",
+    z.object({ id: z.string().min(1).max(512) }),
+    async (p) => {
+      const all = await loadStories();
+      const found = all.find((s) => s.id === p.id) ?? null;
+      return jsonResult(found === null ? { item: null } : { item: toEnvelope(found) });
+    },
+  );
+
+  reg(
+    "storybook_search",
+    "Substring search over stories (matches id, component title, story name, and tags). Returns the same view as storybook_list.",
+    z.object({
+      query: z.string().min(1).max(500),
+      limit: z.number().int().min(1).max(2000).optional(),
+    }),
+    async (p) => {
+      const all = await loadStories();
+      const matches = filterStories(all, p.query).slice(0, p.limit ?? 500);
+      return jsonResult({ matches: matches.map(toEnvelope) });
+    },
+  );
+}

package/connectors/stripe/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.stripe",
+  "displayName": "Stripe",
+  "version": "0.1.0",
+  "description": "Stripe billing connector (read-only). Surfaces the user's recent invoices as `stripe:invoice` items in the local index — invoice number, status (draft/open/paid/void/uncollectible), amount due/paid + currency, customer id/name/email, the hosted invoice + PDF URLs, the subscription id, and the created / due / billing-period dates. Useful for answering billing questions (\"which invoices are still open?\", \"what did ACME pay last month?\") without leaving Nimbus. Bearer secret-key auth. The SaaS host (api.stripe.com) is fixed. Stripe timestamps are epoch seconds (converted to ms on index). Customers / charges / payment intents / disputes / subscription events and the `stripe.refund.create` write are deferred follow-ups.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.stripe.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/stripe/src/search-filter.ts

@@ -0,0 +1,19 @@
+import {
+  fieldsFromKeys,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type StripeSearchMatchOptions = SearchMatchOptions;
+
+export const filterStripeInvoices = makeQueryFilter(
+  fieldsFromKeys([
+    "id",
+    "number",
+    "status",
+    "customer",
+    "customer_name",
+    "customer_email",
+    "description",
+  ]),
+);