@stackable-labs/mcp-app-extension 1.21.0 → 1.22.0

package/dist/index.js

@@ -1897,15 +1897,19 @@ The dev command:
 The CLI outputs a query param like:
 
 \`\`\`
-?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+?_stackable_dev=ext-123:eyJ1cmwiOiJodHRwczovL2FiYy50cnljbG91ZGZsYXJlLmNvbSIsInRva2VuIjoiZXlKaGJHY2lPaUpJVXp...
 \`\`\`
 
-Copy this and **append it to the host site's URL** (the site or product where your
-extension is installed/authorized) to load your local extension instead of the
-production bundle. For example:
+The value after the colon is a \`base64url\`-encoded JSON \`{url, token}\` blob (the
+default, when the CLI obtained a dev session token) or a plain URL (legacy
+fallback when no token was available).
+
+Copy the full param and **append it to the host site's URL** (the site or product
+where your extension is installed/authorized) to load your local extension instead
+of the production bundle. For example:
 
 \`\`\`
-https://your-host-site.com/dashboard?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+https://your-host-site.com/dashboard?_stackable_dev=ext-123:eyJ1cmwi...
 \`\`\`
 
 This override is **browser-session only** \u2014 no database changes, no shared state.
@@ -2086,16 +2090,27 @@ ${CLI.dev}
 
 ### Host-Site Override
 
-The CLI outputs a query param like:
+The CLI outputs a query param you append to your deployed host site's URL (the
+site or product where your extension is installed/authorized) to load your local
+extension instead of the production bundle. The override is browser-session only \u2014
+no DB changes, no shared state. Each developer gets isolated overrides.
+
+**Blob format (default \u2014 when authenticated):** the value after the colon is a
+\`base64url\`-encoded JSON \`{url, token}\` blob; the token is verified by the host:
+
+\`\`\`
+?_stackable_dev=ext-123:eyJ1cmwiOiJodHRwczovL2FiYy50cnljbG91ZGZsYXJlLmNvbSIsInRva2VuIjoiZXlKaGJHY2lPaUpJVXp...
+\`\`\`
+
+**Legacy format (fallback \u2014 when no token):** plain URL after the colon:
 
 \`\`\`
-?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+?_stackable_dev=ext-123:https://abc.trycloudflare.com
 \`\`\`
 
-Append this to your deployed host site's URL (the site or product where your
-extension is installed/authorized) to load your local extension instead of the production
-bundle. The override is browser-session only \u2014 no DB changes, no shared state.
-Each developer gets isolated overrides.
+The CLI also surfaces a \`_stackable_staging=...\` variant (blob-only) for testing
+against staging-mode handling. For multiple extensions, comma-join entries in a
+single param \u2014 mixed blob + legacy is fine.
 
 ## validate *(coming soon)*
 

package/dist/server.js

@@ -1890,15 +1890,19 @@ The dev command:
 The CLI outputs a query param like:
 
 \`\`\`
-?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+?_stackable_dev=ext-123:eyJ1cmwiOiJodHRwczovL2FiYy50cnljbG91ZGZsYXJlLmNvbSIsInRva2VuIjoiZXlKaGJHY2lPaUpJVXp...
 \`\`\`
 
-Copy this and **append it to the host site's URL** (the site or product where your
-extension is installed/authorized) to load your local extension instead of the
-production bundle. For example:
+The value after the colon is a \`base64url\`-encoded JSON \`{url, token}\` blob (the
+default, when the CLI obtained a dev session token) or a plain URL (legacy
+fallback when no token was available).
+
+Copy the full param and **append it to the host site's URL** (the site or product
+where your extension is installed/authorized) to load your local extension instead
+of the production bundle. For example:
 
 \`\`\`
-https://your-host-site.com/dashboard?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+https://your-host-site.com/dashboard?_stackable_dev=ext-123:eyJ1cmwi...
 \`\`\`
 
 This override is **browser-session only** \u2014 no database changes, no shared state.
@@ -2079,16 +2083,27 @@ ${CLI.dev}
 
 ### Host-Site Override
 
-The CLI outputs a query param like:
+The CLI outputs a query param you append to your deployed host site's URL (the
+site or product where your extension is installed/authorized) to load your local
+extension instead of the production bundle. The override is browser-session only \u2014
+no DB changes, no shared state. Each developer gets isolated overrides.
+
+**Blob format (default \u2014 when authenticated):** the value after the colon is a
+\`base64url\`-encoded JSON \`{url, token}\` blob; the token is verified by the host:
+
+\`\`\`
+?_stackable_dev=ext-123:eyJ1cmwiOiJodHRwczovL2FiYy50cnljbG91ZGZsYXJlLmNvbSIsInRva2VuIjoiZXlKaGJHY2lPaUpJVXp...
+\`\`\`
+
+**Legacy format (fallback \u2014 when no token):** plain URL after the colon:
 
 \`\`\`
-?_stackable_dev=ext-123%3Ahttps%3A%2F%2Fabc.trycloudflare.com
+?_stackable_dev=ext-123:https://abc.trycloudflare.com
 \`\`\`
 
-Append this to your deployed host site's URL (the site or product where your
-extension is installed/authorized) to load your local extension instead of the production
-bundle. The override is browser-session only \u2014 no DB changes, no shared state.
-Each developer gets isolated overrides.
+The CLI also surfaces a \`_stackable_staging=...\` variant (blob-only) for testing
+against staging-mode handling. For multiple extensions, comma-join entries in a
+single param \u2014 mixed blob + legacy is fine.
 
 ## validate *(coming soon)*
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackable-labs/mcp-app-extension",
-  "version": "1.21.0",
+  "version": "1.22.0",
   "type": "module",
   "bin": {
     "mcp-app-extension": "./dist/index.js"