@stackable-labs/cli-app-extension 1.88.3 → 1.90.0

package/dist/index.js

@@ -1526,12 +1526,13 @@ export const appStore = createStore<AppState>({
   {
     path: "surfaces/Content.tsx",
     title: "Content Surface with Loading State",
-    code: `import { ui, useStore, useContextData, Surface } from '@stackable-labs/sdk-extension-react'
+    code: `import { ui, useStore, useContextData, useSettings, Surface } from '@stackable-labs/sdk-extension-react'
 import { appStore } from '../store'
 
 export function Content() {
   const viewState = useStore(appStore, (s) => s.viewState)
   const { loading } = useContextData()
+  const settings = useSettings() // Non-secret settings from settingsSchema
 
   if (loading) {
     return (
@@ -1626,19 +1627,33 @@ export function createApi(query: QueryFn) {
 }
 
 // \u2500\u2500 data.fetch wrapper \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+//
+// For API keys and secrets, use {{settings.xxx}} placeholders in headers.
+// The proxy resolves them server-side \u2014 the real secret never enters extension code.
+// Declare secret fields in manifest.json settingsSchema with "secret": true.
 
 const API_BASE_URL = import.meta.env.VITE_API_BASE_URL as string
 
 export function createFetchApi(fetch: FetchFn) {
   return {
     async getItems(): Promise<unknown[]> {
-      const result = await fetch(\`\${API_BASE_URL}/items\`, { method: 'GET' })
+      const result = await fetch(\`\${API_BASE_URL}/items\`, {
+        method: 'GET',
+        headers: {
+          'X-API-Key': '{{settings.apiKey}}',
+        },
+      })
       if (!result.ok) throw new Error(\`getItems failed: \${result.status}\`)
       return result.data as unknown[]
     },
 
     async getItem(itemId: string): Promise<unknown> {
-      const result = await fetch(\`\${API_BASE_URL}/items/\${itemId}\`, { method: 'GET' })
+      const result = await fetch(\`\${API_BASE_URL}/items/\${itemId}\`, {
+        method: 'GET',
+        headers: {
+          'X-API-Key': '{{settings.apiKey}}',
+        },
+      })
       if (!result.ok) throw new Error(\`getItem failed: \${result.status}\`)
       return result.data as unknown
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackable-labs/cli-app-extension",
-  "version": "1.88.3",
+  "version": "1.90.0",
   "type": "module",
   "private": false,
   "bin": {