@stackable-labs/embeddables 2.21.1 → 2.23.0

package/README.md

@@ -58,13 +58,29 @@ import '@stackable-labs/embeddables/styles';
 
 ## Dev Overrides
 
-For local development against a deployed host app, the SDK supports runtime `bundleUrl` overrides via query parameter. Append to your host app URL:
+For local development against a deployed host app, the SDK supports runtime `bundleUrl` overrides via the `_stackable_dev` (and `_stackable_staging`) query parameter. Append to your host app URL:
+
+**Blob format (default — emitted by the CLI when authenticated):** the value after the colon is a `base64url`-encoded JSON `{url, token}` blob; the token is short-lived and verified by the host.
+
+```
+?_stackable_dev=ext-123:eyJ1cmwiOiJodHRwczovL2FiYy50cnljbG91ZGZsYXJlLmNvbSIsInRva2VuIjoiZXlKaGJHY2lPaUpJVXp...
+```
+
+**Legacy format (fallback — no token):**
+
+```
+?_stackable_dev=ext-123:https://abc.trycloudflare.com
+```
+
+`_stackable_staging` uses the same blob format and **always requires the token** (no legacy fallback).
+
+For multiple extensions, comma-join entries in a single param (mixed blob + legacy is fine — the parser tries each entry independently):
 
 ```
-?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+?_stackable_dev=ext-123:eyJ1cmwi...,ext-456:eyJ1cmwi...
 ```
 
-`ExtensionSetup` automatically detects the `_stackable_dev` param, validates the URL against a domain allowlist (localhost, trycloudflare.com, ngrok-free.app), and swaps the `bundleUrl` for matching extensions. A floating "🔧 Dev Mode" badge appears when overrides are active, with a "Clear" button to remove them.
+`ExtensionSetup` automatically detects both params, validates the URL against a domain allowlist (localhost, trycloudflare.com, ngrok-free.app), verifies the token when present, and swaps the `bundleUrl` for matching extensions. A floating "🔧 Dev Mode" badge appears when overrides are active, with a "Clear" button to remove them.
 
 No host app code changes required — this is built into `ExtensionSetup`.
 

package/dist/embeddables/src/WidgetApp.d.ts

@@ -14,9 +14,10 @@ interface WidgetAppProps {
     colors?: WidgetColors;
     instanceId: string;
     customerId?: string;
-    customerEmail?: string;
     customerName?: string;
+    customerEmail?: string;
+    customerProvider?: string;
     snippetKey: string;
 }
-export declare const WidgetApp: ({ queryApiBase, apiBase, appId, theme, icon, iconUrl, position, offsetX, offsetY, colors, instanceId, customerId, customerEmail, customerName, snippetKey, }: WidgetAppProps) => import("react/jsx-runtime").JSX.Element;
+export declare const WidgetApp: ({ queryApiBase, apiBase, appId, theme, icon, iconUrl, position, offsetX, offsetY, colors, snippetKey, instanceId, customerId, customerName, customerEmail, customerProvider, }: WidgetAppProps) => import("react/jsx-runtime").JSX.Element;
 export {};

package/dist/embeddables/src/components/ExtensionSetup.d.ts

@@ -12,8 +12,9 @@ export interface ExtensionSetupProps {
     appId?: string;
     instanceId?: string;
     customerId?: string;
-    customerEmail?: string;
     customerName?: string;
+    customerEmail?: string;
+    customerProvider?: string;
     children: React.ReactNode;
 }
-export declare const ExtensionSetup: ({ instanceId, queryApiBase, apiBase, appId, children, customerId, customerEmail, customerName, }: ExtensionSetupProps) => import("react/jsx-runtime").JSX.Element | null;
+export declare const ExtensionSetup: ({ instanceId, queryApiBase, apiBase, appId, children, customerId, customerName, customerEmail, customerProvider, }: ExtensionSetupProps) => import("react/jsx-runtime").JSX.Element | null;

package/dist/embeddables/src/lib/identity-claims.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Host-side identity-claim filtering.
+ *
+ * When an extension's useExtendIdentity handler returns claims, the host
+ * filters the result per-extension against `manifest.identityClaims` before
+ * merging into `identityState.user.metadata` and forwarding to the JWT
+ * signing endpoint as `custom_claims`.
+ *
+ * Standard JWT claims (external_id, email, name) are exempt — they're part
+ * of the documented signing contract and may be overridden by any extension
+ * with `identity:extend` permission without explicit declaration.
+ *
+ * Undeclared custom keys are dropped with a console.warn so extension authors
+ * see the signal during local development and Studio preview.
+ */
+import { STANDARD_IDENTITY_CLAIM_KEYS } from '@stackable-labs/sdk-extension-contracts';
+/** Re-export so existing test imports from this module keep working. */
+export { STANDARD_IDENTITY_CLAIM_KEYS };
+/**
+ * Filter raw claims returned from a useExtendIdentity handler against the
+ * extension's manifest.identityClaims declaration.
+ *
+ * - Standard JWT claims (external_id, email, name) always allowed
+ * - Custom keys must be in `declared`
+ * - Undeclared keys dropped with a console.warn referencing the extension id
+ */
+export declare const filterByDeclaration: (raw: Record<string, unknown>, declared: Set<string>, extensionId: string) => Record<string, unknown>;