@stackable-labs/mcp-app-extension 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,9 +1,6 @@
 #!/usr/bin/env node
-import { readFile } from 'fs/promises';
-import { join } from 'path';
-import { homedir } from 'os';
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { IDENTITY_EVENTS, ACTIVITY_EVENTS, SURFACE_TARGETS, PERMISSIONS, CAPABILITY_PERMISSION_MAP, ALLOWED_ICONS, UI_TAGS, UI_TAG_ATTRIBUTES, tagToComponentName } from '@stackable-labs/sdk-extension-contracts';
 import { z } from 'zod';
 
@@ -3780,200 +3777,212 @@ var STANDALONE_CLIENT = {
 var package_default = {
   version: "0.0.0"};
 
-// src/index.ts
+// src/server.ts
 var MCP_CLIENT_NAME = STANDALONE_CLIENT.MCP;
 var DEFAULT_ADMIN_API_URL = "https://api-use1.stackablelabs.io/admin";
-var getAuthToken = async () => {
-  const authFile = join(homedir(), ".stackable", "auth.json");
-  let state;
-  try {
-    const content = await readFile(authFile, "utf8");
-    state = JSON.parse(content);
-  } catch {
-    throw new Error("Not authenticated. Run 'stackable-app-extension auth login' first.");
-  }
-  const [, payload] = state.token.split(".");
-  if (payload) {
+var textContent = (text) => ({ content: [{ type: "text", text }] });
+var errorContent = (text) => ({ content: [{ type: "text", text }], isError: true });
+var createMcpServer = (options = {}) => {
+  const server2 = new McpServer({
+    name: "stackable-extension-dev",
+    version: package_default.version
+  });
+  const getAuthToken = async () => {
+    if (options.authContext?.token) {
+      return options.authContext.token;
+    }
+    const { readFile } = await import('fs/promises');
+    const { join } = await import('path');
+    const { homedir } = await import('os');
+    const authFile = join(homedir(), ".stackable", "auth.json");
+    let state;
     try {
-      const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
-      if (decoded.exp && Date.now() >= decoded.exp * 1e3) {
-        throw new Error("Session expired. Run 'stackable-app-extension auth login' to re-authenticate.");
+      const content = await readFile(authFile, "utf8");
+      state = JSON.parse(content);
+    } catch {
+      throw new Error("Not authenticated. Run 'stackable-app-extension auth login' first.");
+    }
+    const [, payload] = state.token.split(".");
+    if (payload) {
+      try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        if (decoded.exp && Date.now() >= decoded.exp * 1e3) {
+          throw new Error("Session expired. Run 'stackable-app-extension auth login' to re-authenticate.");
+        }
+      } catch (err) {
+        if (err instanceof Error && err.message.includes("expired")) {
+          throw err;
+        }
       }
+    }
+    return state.token;
+  };
+  const authHeaders = (token) => ({
+    authorization: `Bearer ${token}`,
+    "content-type": "application/json",
+    "x-client-name": MCP_CLIENT_NAME
+  });
+  const callApi = async (path) => {
+    const token = await getAuthToken();
+    const baseUrl = process.env.ADMIN_API_BASE_URL ?? DEFAULT_ADMIN_API_URL;
+    const res = await fetch(`${baseUrl}${path}`, { headers: authHeaders(token) });
+    if (!res.ok) {
+      return errorContent(`API error: ${res.status} ${res.statusText}`);
+    }
+    const data = await res.json();
+    return textContent(JSON.stringify(data, null, 2));
+  };
+  const withAuth = async (fn) => {
+    try {
+      return await fn();
     } catch (err) {
-      if (err instanceof Error && err.message.includes("expired")) {
-        throw err;
-      }
+      return errorContent(err.message);
     }
+  };
+  const registrySkills = listSkills("registry");
+  for (const skill of registrySkills) {
+    server2.registerResource(
+      skill.id,
+      `sdk://${skill.id}`,
+      { description: skill.description, mimeType: "text/markdown" },
+      async (uri) => ({
+        contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
+      })
+    );
   }
-  return state.token;
-};
-var authHeaders = (token) => ({
-  authorization: `Bearer ${token}`,
-  "content-type": "application/json",
-  "x-client-name": MCP_CLIENT_NAME
-});
-var textContent = (text) => ({ content: [{ type: "text", text }] });
-var errorContent = (text) => ({ content: [{ type: "text", text }], isError: true });
-var callApi = async (path) => {
-  const token = await getAuthToken();
-  const baseUrl = process.env.ADMIN_API_BASE_URL ?? DEFAULT_ADMIN_API_URL;
-  const res = await fetch(`${baseUrl}${path}`, { headers: authHeaders(token) });
-  if (!res.ok) {
-    return errorContent(`API error: ${res.status} ${res.statusText}`);
-  }
-  const data = await res.json();
-  return textContent(JSON.stringify(data, null, 2));
-};
-var withAuth = async (fn) => {
-  try {
-    return await fn();
-  } catch (err) {
-    return errorContent(err.message);
-  }
-};
-var server = new McpServer({
-  name: "stackable-extension-dev",
-  version: package_default.version
-});
-var registrySkills = listSkills("registry");
-for (const skill of registrySkills) {
-  server.registerResource(
-    skill.id,
-    `sdk://${skill.id}`,
-    { description: skill.description, mimeType: "text/markdown" },
-    async (uri) => ({
-      contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
-    })
-  );
-}
-server.registerTool("list_skills", {
-  description: "List all available SDK skills with descriptions"
-}, async () => textContent(JSON.stringify(registrySkills.map(getSkillMetadata), null, 2)));
-server.registerTool("lookup_skill", {
-  description: "Look up a specific SDK skill by ID or search by keyword. Returns full skill content for ID lookup, or matching skill metadata for keyword search.",
-  inputSchema: { id: z.string().optional().describe('Exact skill ID (e.g. "capabilities", "patterns")'), query: z.string().optional().describe("Search keywords to find relevant skills") }
-}, async ({ id, query }) => {
-  if (id) {
-    const body = lookupSkill(registrySkills, id);
-    if (!body) {
-      return errorContent(`No skill found with ID "${id}". Use list_skills to see available IDs.`);
+  server2.registerTool("list_skills", {
+    description: "List all available SDK skills with descriptions"
+  }, async () => textContent(JSON.stringify(registrySkills.map(getSkillMetadata), null, 2)));
+  server2.registerTool("lookup_skill", {
+    description: "Look up a specific SDK skill by ID or search by keyword. Returns full skill content for ID lookup, or matching skill metadata for keyword search.",
+    inputSchema: { id: z.string().optional().describe('Exact skill ID (e.g. "capabilities", "patterns")'), query: z.string().optional().describe("Search keywords to find relevant skills") }
+  }, async ({ id, query }) => {
+    if (id) {
+      const body = lookupSkill(registrySkills, id);
+      if (!body) {
+        return errorContent(`No skill found with ID "${id}". Use list_skills to see available IDs.`);
+      }
+      return textContent(body);
     }
-    return textContent(body);
-  }
-  if (query) {
-    const matches = findRelevantSkills(registrySkills, query);
-    if (matches.length === 0) {
-      return errorContent(`No skills matched "${query}". Use list_skills to see available skills.`);
+    if (query) {
+      const matches = findRelevantSkills(registrySkills, query);
+      if (matches.length === 0) {
+        return errorContent(`No skills matched "${query}". Use list_skills to see available skills.`);
+      }
+      return textContent(JSON.stringify(matches.map(getSkillMetadata), null, 2));
     }
-    return textContent(JSON.stringify(matches.map(getSkillMetadata), null, 2));
-  }
-  return errorContent('Provide either "id" or "query" parameter.');
-});
-server.registerTool("validate_manifest", {
-  description: "Validate an extension manifest.json. Checks required fields, valid permissions, targets, and allowedDomains consistency with permissions.",
-  inputSchema: { manifestContent: z.string().describe("The full manifest.json content as a string") }
-}, async ({ manifestContent }) => {
-  const errors = [];
-  let manifest;
-  try {
-    manifest = JSON.parse(manifestContent);
-  } catch {
-    return errorContent("Invalid JSON: could not parse manifest content.");
-  }
-  if (!manifest.name || typeof manifest.name !== "string") {
-    errors.push('Missing or invalid "name" field (must be a non-empty string).');
-  }
-  if (!manifest.version || typeof manifest.version !== "string") {
-    errors.push('Missing or invalid "version" field (must be a non-empty string).');
-  }
-  if (!Array.isArray(manifest.targets) || manifest.targets.length === 0) {
-    errors.push('Missing or empty "targets" array. At least one surface target is required.');
-  }
-  if (!Array.isArray(manifest.permissions)) {
-    errors.push('Missing "permissions" array.');
-  } else {
-    const validPermissions = new Set(PERMISSIONS);
-    for (const perm of manifest.permissions) {
-      if (!validPermissions.has(perm)) {
-        errors.push(`Invalid permission "${perm}". Valid permissions: ${PERMISSIONS.join(", ")}`);
+    return errorContent('Provide either "id" or "query" parameter.');
+  });
+  server2.registerTool("validate_manifest", {
+    description: "Validate an extension manifest.json. Checks required fields, valid permissions, targets, and allowedDomains consistency with permissions.",
+    inputSchema: { manifestContent: z.string().describe("The full manifest.json content as a string") }
+  }, async ({ manifestContent }) => {
+    const errors = [];
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestContent);
+    } catch {
+      return errorContent("Invalid JSON: could not parse manifest content.");
+    }
+    if (!manifest.name || typeof manifest.name !== "string") {
+      errors.push('Missing or invalid "name" field (must be a non-empty string).');
+    }
+    if (!manifest.version || typeof manifest.version !== "string") {
+      errors.push('Missing or invalid "version" field (must be a non-empty string).');
+    }
+    if (!Array.isArray(manifest.targets) || manifest.targets.length === 0) {
+      errors.push('Missing or empty "targets" array. At least one surface target is required.');
+    }
+    if (!Array.isArray(manifest.permissions)) {
+      errors.push('Missing "permissions" array.');
+    } else {
+      const validPermissions = new Set(PERMISSIONS);
+      for (const perm of manifest.permissions) {
+        if (!validPermissions.has(perm)) {
+          errors.push(`Invalid permission "${perm}". Valid permissions: ${PERMISSIONS.join(", ")}`);
+        }
       }
     }
-  }
-  if (!Array.isArray(manifest.allowedDomains)) {
-    errors.push('Missing "allowedDomains" array. Use an empty array if no external API calls are needed.');
-  }
-  const permissions = manifest.permissions ?? [];
-  if (permissions.includes("data:fetch") && Array.isArray(manifest.allowedDomains) && manifest.allowedDomains.length === 0) {
-    errors.push('"data:fetch" permission declared but "allowedDomains" is empty. Add the domains your extension needs to fetch from.');
-  }
-  if (errors.length === 0) {
-    return textContent("Manifest is valid.");
-  }
-  return errorContent(`Manifest validation failed:
+    if (!Array.isArray(manifest.allowedDomains)) {
+      errors.push('Missing "allowedDomains" array. Use an empty array if no external API calls are needed.');
+    }
+    const permissions = manifest.permissions ?? [];
+    if (permissions.includes("data:fetch") && Array.isArray(manifest.allowedDomains) && manifest.allowedDomains.length === 0) {
+      errors.push('"data:fetch" permission declared but "allowedDomains" is empty. Add the domains your extension needs to fetch from.');
+    }
+    if (errors.length === 0) {
+      return textContent("Manifest is valid.");
+    }
+    return errorContent(`Manifest validation failed:
 ${errors.map((e) => `- ${e}`).join("\n")}`);
-});
-server.registerTool("validate_permissions", {
-  description: "Static analysis: match declared manifest permissions against actual capability and event hook usage in source files. Detects unused permissions and missing permissions.",
-  inputSchema: {
-    manifestContent: z.string().describe("The full manifest.json content as a string"),
-    sourceFiles: z.record(z.string(), z.string()).describe("Map of filename \u2192 source content for all extension source files")
-  }
-}, async ({ manifestContent, sourceFiles }) => {
-  let manifest;
-  try {
-    manifest = JSON.parse(manifestContent);
-  } catch {
-    return errorContent("Invalid JSON: could not parse manifest content.");
-  }
-  const declaredPermissions = new Set(manifest.permissions ?? []);
-  const usedPermissions = /* @__PURE__ */ new Set();
-  const allSource = Object.values(sourceFiles).join("\n");
-  for (const [capability, permission] of Object.entries(CAPABILITY_PERMISSION_MAP)) {
-    if (allSource.includes(capability)) {
-      usedPermissions.add(permission);
+  });
+  server2.registerTool("validate_permissions", {
+    description: "Static analysis: match declared manifest permissions against actual capability and event hook usage in source files. Detects unused permissions and missing permissions.",
+    inputSchema: {
+      manifestContent: z.string().describe("The full manifest.json content as a string"),
+      sourceFiles: z.record(z.string(), z.string()).describe("Map of filename \u2192 source content for all extension source files")
     }
-  }
-  const eventHookMap = {
-    useIdentityEvent: "events:identity",
-    useMessagingEvent: "events:messaging",
-    useActivityEvent: "events:activity"
-  };
-  for (const [hook, permission] of Object.entries(eventHookMap)) {
-    if (allSource.includes(hook)) {
-      usedPermissions.add(permission);
+  }, async ({ manifestContent, sourceFiles }) => {
+    let manifest;
+    try {
+      manifest = JSON.parse(manifestContent);
+    } catch {
+      return errorContent("Invalid JSON: could not parse manifest content.");
     }
-  }
-  const issues = [];
-  for (const perm of declaredPermissions) {
-    if (!usedPermissions.has(perm)) {
-      issues.push(`Unused permission "${perm}" \u2014 declared in manifest but no matching capability/hook usage found in source.`);
+    const declaredPermissions = new Set(manifest.permissions ?? []);
+    const usedPermissions = /* @__PURE__ */ new Set();
+    const allSource = Object.values(sourceFiles).join("\n");
+    for (const [capability, permission] of Object.entries(CAPABILITY_PERMISSION_MAP)) {
+      if (allSource.includes(capability)) {
+        usedPermissions.add(permission);
+      }
     }
-  }
-  for (const perm of usedPermissions) {
-    if (!declaredPermissions.has(perm)) {
-      issues.push(`Missing permission "${perm}" \u2014 capability/hook used in source but not declared in manifest.`);
+    const eventHookMap = {
+      useIdentityEvent: "events:identity",
+      useMessagingEvent: "events:messaging",
+      useActivityEvent: "events:activity"
+    };
+    for (const [hook, permission] of Object.entries(eventHookMap)) {
+      if (allSource.includes(hook)) {
+        usedPermissions.add(permission);
+      }
     }
-  }
-  if (issues.length === 0) {
-    return textContent("Permissions are consistent with source code usage.");
-  }
-  return textContent(`Permission analysis:
+    const issues = [];
+    for (const perm of declaredPermissions) {
+      if (!usedPermissions.has(perm)) {
+        issues.push(`Unused permission "${perm}" \u2014 declared in manifest but no matching capability/hook usage found in source.`);
+      }
+    }
+    for (const perm of usedPermissions) {
+      if (!declaredPermissions.has(perm)) {
+        issues.push(`Missing permission "${perm}" \u2014 capability/hook used in source but not declared in manifest.`);
+      }
+    }
+    if (issues.length === 0) {
+      return textContent("Permissions are consistent with source code usage.");
+    }
+    return textContent(`Permission analysis:
 ${issues.map((i) => `- ${i}`).join("\n")}`);
-});
-server.registerTool("list_apps", {
-  description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
-}, async () => withAuth(() => callApi("/app-extension")));
-server.registerTool("list_extensions", {
-  description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
-  inputSchema: { appId: z.string().describe("App ID") }
-}, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions`)));
-server.registerTool("get_extension", {
-  description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
-  inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
-}, async ({ appId, extensionId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
-server.registerTool("list_instances", {
-  description: "List instances under an app. Requires CLI auth.",
-  inputSchema: { appId: z.string().describe("App ID") }
-}, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/instances`)));
+  });
+  server2.registerTool("list_apps", {
+    description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
+  }, async () => withAuth(() => callApi("/app-extension")));
+  server2.registerTool("list_extensions", {
+    description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions`)));
+  server2.registerTool("get_extension", {
+    description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
+  }, async ({ appId, extensionId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
+  server2.registerTool("list_instances", {
+    description: "List instances under an app. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/instances`)));
+  return server2;
+};
+
+// src/index.ts
+var server = createMcpServer();
 var transport = new StdioServerTransport();
 await server.connect(transport);