@stackable-labs/mcp-app-extension 2.2.0 → 2.4.0

package/README.md

@@ -15,7 +15,7 @@ Both transports expose the same tool surface: `list_apps`, `list_extensions`, `g
 
 Drop into your project root (or `~/.claude.json` for user-scoped setup). Both entries can coexist — Claude Code routes tool calls per-server.
 
-**Dev (against deployed `api-dev-use1.stackablelabs.io`):**
+**Dev (against deployed `api-x-dev.stackablelabs.io`):**
 
 ```json
 {
@@ -33,8 +33,8 @@ Drop into your project root (or `~/.claude.json` for user-scoped setup). Both en
         "@stackable-labs/mcp-app-extension@latest"
       ],
       "env": {
-        "MCP_API_BASE_URL": "https://mcp-dev.stackablelabs.io",
-        "ADMIN_API_BASE_URL": "https://api-dev-use1.stackablelabs.io/admin"
+        "MCP_LABS_API_BASE_URL": "https://mcp-dev.stackablelabs.io",
+        "ADMIN_LABS_API_BASE_URL": "https://api-x-dev.stackablelabs.io/admin"
       }
     }
   }
@@ -65,8 +65,10 @@ Both optional — defaults point at prod. Override per-stage as needed.
 
 | Env var | Default | Purpose |
 |---------|---------|---------|
-| `MCP_API_BASE_URL` | `https://mcp.stackablelabs.io` | MCP host root. OAuth discovery URL is derived as `${mcpBase}/.well-known/oauth-authorization-server`. |
-| `ADMIN_API_BASE_URL` | `https://api-use1.stackablelabs.io/admin` | Admin API endpoint for platform tool calls (`list_apps`, etc.). |
+| `MCP_LABS_API_BASE_URL` | `https://mcp.stackablelabs.io` | MCP host root. OAuth discovery URL is derived as `${mcpBase}/.well-known/oauth-authorization-server`. |
+| `ADMIN_LABS_API_BASE_URL` | `https://api-x.stackablelabs.io/admin` | Admin API endpoint for platform tool calls (`list_apps`, etc.). |
+
+> **Renamed (2026-07):** `MCP_API_BASE_URL` → `MCP_LABS_API_BASE_URL`, `ADMIN_API_BASE_URL` → `ADMIN_LABS_API_BASE_URL`. The old names still work as a deprecated fallback — update your config; they'll be removed in a later release.
 
 HTTP transport reads URLs from the deployed Lambda's env (set via CDK + `packages/infra/cdk/.env.{stage}` — not client-controlled).
 
@@ -87,7 +89,7 @@ To test a local build via stdio, point the `.mcp.json` `command`/`args` at the b
 ```json
 {
   "command": "node",
-  "args": ["/absolute/path/to/packages/mcp/app-extension/dist/index.js"],
-  "env": { "MCP_API_BASE_URL": "...", "ADMIN_API_BASE_URL": "..." }
+  "args": ["/absolute/path/to/packages/mcp/labs-app-extension/dist/index.js"],
+  "env": { "MCP_LABS_API_BASE_URL": "...", "ADMIN_LABS_API_BASE_URL": "..." }
 }
 ```

package/dist/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { IDENTITY_EVENT, ACTIVITY_EVENT, SURFACE_TARGET, TEMPLATE_FLAVORS, MESSAGING_ACTION_EXAMPLES, PERMISSIONS, CAPABILITY_PERMISSION_MAP, HOOK_PERMISSION_MAP, ALLOWED_ICONS, UI_TAGS, UI_TAG_CATEGORIES, UI_TAG_ATTRIBUTES, tagToComponentName, EVENT_HOOK_PERMISSION_MAP, MESSAGING_SEND_EXAMPLES } from '@stackable-labs/sdk-extension-contracts';
-import { validatePatternFormat } from '@stackable-labs/lib-contracts';
 import fs4, { readFile, mkdir, writeFile, constants } from 'fs/promises';
 import path, { join } from 'path';
 import os, { homedir } from 'os';
+import { IDENTITY_EVENT, ACTIVITY_EVENT, SURFACE_TARGET, TEMPLATE_FLAVORS, MESSAGING_ACTION_EXAMPLES, PERMISSIONS, CAPABILITY_PERMISSION_MAP, HOOK_PERMISSION_MAP, ALLOWED_ICONS, UI_TAGS, UI_TAG_CATEGORIES, UI_TAG_ATTRIBUTES, tagToComponentName, EVENT_HOOK_PERMISSION_MAP, MESSAGING_SEND_EXAMPLES } from '@stackable-labs/sdk-extension-contracts';
 import { z } from 'zod';
+import { validatePatternFormat } from '@stackable-labs/lib-contracts';
 import { createServer } from 'http';
 import process6 from 'process';
 import { Buffer as Buffer$1 } from 'buffer';
@@ -15,6 +15,69 @@ import { promisify } from 'util';
 import childProcess, { execFile } from 'child_process';
 import fs3 from 'fs';
 
+// ../../lib/utils-auth/src/constants.ts
+var STANDALONE_CLIENT_DATA = {
+  STACKABLE_LABS: {
+    CLI: { name: "@stackable-labs/cli-app-extension", authFile: "cli-auth.json" },
+    MCP: { name: "@stackable-labs/mcp-app-extension", authFile: "mcp-auth.json" }
+  },
+  STACKABLE_OPS: {
+    MCP: { name: "@stackable-ops/mcp", authFile: "mcp-ops-auth.json" }
+  }
+};
+var projectField = (field) => Object.fromEntries(
+  Object.entries(STANDALONE_CLIENT_DATA).map(([org, roles]) => [
+    org,
+    Object.fromEntries(Object.entries(roles).map(([role, entry]) => [role, entry[field]]))
+  ])
+);
+var STANDALONE_CLIENT = projectField("name");
+var STANDALONE_CLIENT_AUTH_FILE = projectField("authFile");
+Object.values(STANDALONE_CLIENT_DATA).flatMap((roles) => Object.values(roles).map((entry) => entry.name));
+
+// ../../lib/utils-auth/src/cli/shared.ts
+var AUTH_DIR = join(homedir(), ".stackable");
+join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.CLI);
+join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.MCP);
+var resolveAuthFile = (filename) => join(AUTH_DIR, filename ?? STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.CLI);
+var readAuthState = async (filename) => {
+  try {
+    const content = await readFile(resolveAuthFile(filename), "utf8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+};
+var writeAuthState = async (state, filename) => {
+  await mkdir(AUTH_DIR, { recursive: true, mode: 448 });
+  await writeFile(resolveAuthFile(filename), JSON.stringify(state, null, 2), { mode: 384 });
+};
+var decodeJwtPayload = (token) => {
+  try {
+    const [, payload] = token.split(".");
+    if (!payload) {
+      return null;
+    }
+    const json = Buffer.from(payload, "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+};
+var getToken = async (filename) => {
+  const state = await readAuthState(filename);
+  if (!state) {
+    throw new Error("Not authenticated. Run `stackable-app-extension auth login` first.");
+  }
+  const payload = decodeJwtPayload(state.token);
+  if (payload?.exp && typeof payload.exp === "number") {
+    if (Date.now() >= payload.exp * 1e3) {
+      throw new Error("Session expired. Run `stackable-app-extension auth login` to re-authenticate.");
+    }
+  }
+  return state.token;
+};
+
 // ../../sdk/extension/ai-docs/src/generated/template-content.ts
 var PATTERN_SECTIONS = [
   {
@@ -2912,7 +2975,7 @@ Both workflows produce the same output \u2014 a Stackable extension that runs in
 };
 
 // ../../sdk/extension/ai-docs/src/generators/ai-accelerated-development.ts
-var DEFAULT_MCP_API_BASE_URL = "https://mcp.stackablelabs.io";
+var DEFAULT_MCP_LABS_API_BASE_URL = "https://mcp.stackablelabs.io";
 var generateAIAcceleratedDevelopment = () => {
   const fm = frontmatter({
     root: false,
@@ -2920,8 +2983,8 @@ var generateAIAcceleratedDevelopment = () => {
     description: "AI-Accelerated Development: AI Extension Studio, Agent Skills, the live MCP server, and the Claude Code plugin \u2014 and how to choose between them.",
     globs: ["*"]
   });
-  const mcpApiBaseUrl = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL;
-  const mcpEndpointUrl = `${mcpApiBaseUrl}/app-extension`;
+  const mcpApiBaseUrl2 = process.env.MCP_LABS_API_BASE_URL ?? DEFAULT_MCP_LABS_API_BASE_URL;
+  const mcpEndpointUrl = `${mcpApiBaseUrl2}/app-extension`;
   return `${fm}
 
 # AI-Accelerated Development
@@ -5637,6 +5700,15 @@ pair(EXAMPLE_SNIPPETS, EXAMPLE_SNIPPETS2);
 pair(CAPABILITY_SNIPPETS, CAPABILITY_SNIPPETS2);
 pair(EVENT_SNIPPETS, EVENT_SNIPPETS2);
 
+// ../../lib/utils-mcp/src/index.ts
+var textContent = (text) => ({
+  content: [{ type: "text", text }]
+});
+var errorContent = (text) => ({
+  isError: true,
+  content: [{ type: "text", text }]
+});
+
 // ../../lib/utils-js/src/crypto.ts
 var getCrypto = () => {
   if (typeof globalThis !== "undefined" && globalThis.crypto) {
@@ -5676,142 +5748,33 @@ var getDigest = async (input, encoding = "hex") => {
 var getNonce = () => getRandomBytes(16, "base64url");
 var getVerifier = () => getRandomBytes(32, "base64url");
 
-// ../../lib/utils-auth/src/constants.ts
-var STANDALONE_CLIENT_DATA = {
-  CLI: { name: "@stackable-labs/cli-app-extension", authFile: "cli-auth.json" },
-  MCP: { name: "@stackable-labs/mcp-app-extension", authFile: "mcp-auth.json" }
-};
-var STANDALONE_CLIENT = Object.fromEntries(
-  Object.entries(STANDALONE_CLIENT_DATA).map(([k, v]) => [k, v.name])
-);
-var STANDALONE_CLIENT_AUTH_FILE = Object.fromEntries(
-  Object.entries(STANDALONE_CLIENT_DATA).map(([k, v]) => [k, v.authFile])
-);
-Object.values(STANDALONE_CLIENT);
-
 // ../../lib/utils-auth/src/index.ts
-var deriveClientId = async (clientName) => (await getDigest(clientName)).slice(0, 32);
-var AUTH_DIR = join(homedir(), ".stackable");
-join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.CLI);
-var MCP_AUTH_FILE = join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.MCP);
-var resolveAuthFile = (filename) => join(AUTH_DIR, filename ?? STANDALONE_CLIENT_AUTH_FILE.CLI);
-var readAuthState = async (filename) => {
-  try {
-    const content = await readFile(resolveAuthFile(filename), "utf8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-};
-var writeAuthState = async (state, filename) => {
-  await mkdir(AUTH_DIR, { recursive: true, mode: 448 });
-  await writeFile(resolveAuthFile(filename), JSON.stringify(state, null, 2), { mode: 384 });
-};
-var decodeJwtPayload = (token) => {
-  try {
-    const [, payload] = token.split(".");
-    if (!payload) {
-      return null;
-    }
-    const json = Buffer.from(payload, "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-};
-var getToken = async (filename) => {
-  const state = await readAuthState(filename);
-  if (!state) {
-    throw new Error("Not authenticated. Run `stackable-app-extension auth login` first.");
-  }
-  const payload = decodeJwtPayload(state.token);
-  if (payload?.exp && typeof payload.exp === "number") {
-    if (Date.now() >= payload.exp * 1e3) {
-      throw new Error("Session expired. Run `stackable-app-extension auth login` to re-authenticate.");
-    }
-  }
-  return state.token;
-};
+var deriveDcrClientId = async (clientName) => (await getDigest(clientName)).slice(0, 32);
+var deriveClientId = async (clientName) => deriveDcrClientId(clientName);
 
 // package.json
 var package_default = {
   version: "0.0.0"};
-
-// src/server.ts
-var MCP_CLIENT_NAME = STANDALONE_CLIENT.MCP;
-var DEFAULT_ADMIN_API_URL = "https://api-use1.stackablelabs.io/admin";
-var DEFAULT_MCP_API_BASE_URL2 = "https://mcp.stackablelabs.io";
-var textContent = (text) => ({ content: [{ type: "text", text }] });
-var errorContent = (text) => ({ content: [{ type: "text", text }], isError: true });
-var createMcpServer = (options = {}) => {
-  const server2 = new McpServer({
-    name: "stackable-extension-dev",
-    version: package_default.version
-  });
-  const getAuthToken = async () => {
-    if (options.authContext?.token) {
-      return options.authContext.token;
-    }
-    try {
-      return await getToken(STANDALONE_CLIENT_AUTH_FILE.MCP);
-    } catch {
-    }
-    if (!options.performOAuthFlow) {
-      throw new Error(
-        "No auth token available. Provide authContext (server) or performOAuthFlow (CLI)."
-      );
-    }
-    const MCP_API_BASE_URL = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL2;
-    return options.performOAuthFlow(`${MCP_API_BASE_URL}/.well-known/oauth-authorization-server`);
-  };
-  const authHeaders = (token) => ({
-    authorization: `Bearer ${token}`,
-    "content-type": "application/json",
-    "x-client-name": MCP_CLIENT_NAME
-  });
-  const callApi = async (path2) => {
-    const token = await getAuthToken();
-    const ADMIN_API_BASE_URL = process.env.ADMIN_API_BASE_URL ?? DEFAULT_ADMIN_API_URL;
-    const url = `${ADMIN_API_BASE_URL}${path2}`;
-    let res;
-    try {
-      res = await fetch(url, { headers: authHeaders(token) });
-    } catch (err) {
-      return errorContent(
-        `Network error calling ${url}: ${err.message}. Check ADMIN_API_BASE_URL env var (currently "${ADMIN_API_BASE_URL}").`
-      );
-    }
-    if (!res.ok) {
-      return errorContent(`API error: ${res.status} ${res.statusText} (${url})`);
-    }
-    const data = await res.json();
-    return textContent(JSON.stringify(data, null, 2));
-  };
-  const withAuth = async (fn) => {
-    try {
-      return await fn();
-    } catch (err) {
-      const e = err;
-      if (e.message.includes("fetch")) {
-        const MCP_API_BASE_URL = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL2;
-        return errorContent(
-          `MCP auth flow failed: ${e.message}. Check MCP_API_BASE_URL env var (currently "${MCP_API_BASE_URL}"). To re-auth from scratch: rm ${MCP_AUTH_FILE}`
-        );
-      }
-      return errorContent(e.message);
-    }
-  };
+var registerAppTools = (server2, ctx) => {
+  server2.registerTool("list_apps", {
+    description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
+  }, async () => ctx.withAuth(() => ctx.callApi("/app-extension")));
+  server2.registerTool("list_extensions", {
+    description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/extensions`)));
+  server2.registerTool("get_extension", {
+    description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
+  }, async ({ appId, extensionId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
+  server2.registerTool("list_instances", {
+    description: "List instances under an app. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/instances`)));
+};
+var apps_default = registerAppTools;
+var registerSkillTools = (server2) => {
   const registrySkills = listSkills("registry");
-  for (const skill of registrySkills) {
-    server2.registerResource(
-      skill.id,
-      `sdk://${skill.id}`,
-      { description: skill.description, mimeType: "text/markdown" },
-      async (uri) => ({
-        contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
-      })
-    );
-  }
   server2.registerTool("list_skills", {
     description: "List all available SDK skills with descriptions"
   }, async () => textContent(JSON.stringify(registrySkills.map(getSkillMetadata), null, 2)));
@@ -5835,6 +5798,9 @@ var createMcpServer = (options = {}) => {
     }
     return errorContent('Provide either "id" or "query" parameter.');
   });
+};
+var skills_default = registerSkillTools;
+var registerValidationTools = (server2) => {
   server2.registerTool("validate_manifest", {
     description: "Validate an extension manifest.json. Checks required fields, valid permissions, targets, and allowedDomains consistency with permissions.",
     inputSchema: { manifestContent: z.string().describe("The full manifest.json content as a string") }
@@ -5929,21 +5895,94 @@ ${errors.map((e) => `- ${e}`).join("\n")}`);
     return textContent(`Permission analysis:
 ${issues.map((i) => `- ${i}`).join("\n")}`);
   });
-  server2.registerTool("list_apps", {
-    description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
-  }, async () => withAuth(() => callApi("/app-extension")));
-  server2.registerTool("list_extensions", {
-    description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID") }
-  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions`)));
-  server2.registerTool("get_extension", {
-    description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
-  }, async ({ appId, extensionId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
-  server2.registerTool("list_instances", {
-    description: "List instances under an app. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID") }
-  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/instances`)));
+};
+var validation_default = registerValidationTools;
+
+// src/tools/index.ts
+var toolRegistrars = [
+  skills_default,
+  validation_default,
+  apps_default
+];
+
+// src/server.ts
+var MCP_LABS_AUTH_FILE2 = STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.MCP;
+var MCP_LABS_CLIENT_NAME = STANDALONE_CLIENT.STACKABLE_LABS.MCP;
+var DEFAULT_MCP_LABS_API_BASE_URL2 = "https://mcp.stackablelabs.io";
+var DEFAULT_ADMIN_LABS_API_URL = "https://api-x.stackablelabs.io/admin";
+var adminApiBaseUrl = () => process.env.ADMIN_LABS_API_BASE_URL ?? DEFAULT_ADMIN_LABS_API_URL;
+var mcpApiBaseUrl = () => process.env.MCP_LABS_API_BASE_URL ?? DEFAULT_MCP_LABS_API_BASE_URL2;
+var createMcpServer = (options = {}) => {
+  const server2 = new McpServer({
+    name: "stackable-extension-dev",
+    version: package_default.version
+  });
+  const getAuthToken = async () => {
+    if (options.authContext?.token) {
+      return options.authContext.token;
+    }
+    try {
+      return await getToken(MCP_LABS_AUTH_FILE2);
+    } catch {
+    }
+    if (!options.performOAuthFlow) {
+      throw new Error(
+        "No auth token available. Provide authContext (server) or performOAuthFlow (CLI)."
+      );
+    }
+    return options.performOAuthFlow(`${mcpApiBaseUrl()}/.well-known/oauth-authorization-server`);
+  };
+  const authHeaders = (token) => ({
+    authorization: `Bearer ${token}`,
+    "content-type": "application/json",
+    "x-client-name": MCP_LABS_CLIENT_NAME
+  });
+  const callApi = async (path2) => {
+    const token = await getAuthToken();
+    const adminBase = adminApiBaseUrl();
+    const url = `${adminBase}${path2}`;
+    let res;
+    try {
+      res = await fetch(url, { headers: authHeaders(token) });
+    } catch (err) {
+      return errorContent(
+        `Network error calling ${url}: ${err.message}. Check ADMIN_LABS_API_BASE_URL env var (currently "${adminBase}").`
+      );
+    }
+    if (!res.ok) {
+      return errorContent(`API error: ${res.status} ${res.statusText} (${url})`);
+    }
+    const data = await res.json();
+    return textContent(JSON.stringify(data, null, 2));
+  };
+  const withAuth = async (fn) => {
+    try {
+      return await fn();
+    } catch (err) {
+      const e = err;
+      if (e.message.includes("fetch")) {
+        return errorContent(
+          `MCP auth flow failed: ${e.message}. Check MCP_LABS_API_BASE_URL env var (currently "${mcpApiBaseUrl()}"). To re-auth from scratch: rm ${MCP_LABS_AUTH_FILE2}`
+        );
+      }
+      return errorContent(e.message);
+    }
+  };
+  const registrySkills = listSkills("registry");
+  for (const skill of registrySkills) {
+    server2.registerResource(
+      skill.id,
+      `sdk://${skill.id}`,
+      { description: skill.description, mimeType: "text/markdown" },
+      async (uri) => ({
+        contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
+      })
+    );
+  }
+  const ctx = { withAuth, callApi };
+  for (const register of toolRegistrars) {
+    register(server2, ctx);
+  }
   return server2;
 };
 var isDockerCached;
@@ -6437,7 +6476,7 @@ var registerClient = async (registrationEndpoint) => {
     method: "POST",
     headers: { "content-type": "application/json" },
     body: JSON.stringify({
-      client_name: STANDALONE_CLIENT.MCP,
+      client_name: STANDALONE_CLIENT.STACKABLE_LABS.MCP,
       redirect_uris: ["http://127.0.0.1/callback"]
     })
   });
@@ -6474,7 +6513,7 @@ var decodeJwtPayload2 = (token) => {
 };
 var performOAuthFlow = async (discoveryUrl) => {
   const discovery = await fetchDiscovery(discoveryUrl);
-  let clientId = await deriveClientId(STANDALONE_CLIENT.MCP);
+  let clientId = await deriveClientId(STANDALONE_CLIENT.STACKABLE_LABS.MCP);
   if (discovery.registration_endpoint) {
     clientId = await registerClient(discovery.registration_endpoint);
   }
@@ -6557,7 +6596,7 @@ var performOAuthFlow = async (discoveryUrl) => {
       orgId: payload.orgId,
       userId: payload.sub
     },
-    STANDALONE_CLIENT_AUTH_FILE.MCP
+    STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.MCP
   );
   return tokenResponse.access_token;
 };

package/dist/server.js

@@ -1,13 +1,72 @@
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-import { IDENTITY_EVENT, ACTIVITY_EVENT, SURFACE_TARGET, TEMPLATE_FLAVORS, MESSAGING_ACTION_EXAMPLES, PERMISSIONS, CAPABILITY_PERMISSION_MAP, HOOK_PERMISSION_MAP, ALLOWED_ICONS, UI_TAGS, UI_TAG_CATEGORIES, UI_TAG_ATTRIBUTES, tagToComponentName, EVENT_HOOK_PERMISSION_MAP, MESSAGING_SEND_EXAMPLES } from '@stackable-labs/sdk-extension-contracts';
-import { validatePatternFormat } from '@stackable-labs/lib-contracts';
 import { readFile } from 'fs/promises';
 import { join } from 'path';
 import { homedir } from 'os';
+import { IDENTITY_EVENT, ACTIVITY_EVENT, SURFACE_TARGET, TEMPLATE_FLAVORS, MESSAGING_ACTION_EXAMPLES, PERMISSIONS, CAPABILITY_PERMISSION_MAP, HOOK_PERMISSION_MAP, ALLOWED_ICONS, UI_TAGS, UI_TAG_CATEGORIES, UI_TAG_ATTRIBUTES, tagToComponentName, EVENT_HOOK_PERMISSION_MAP, MESSAGING_SEND_EXAMPLES } from '@stackable-labs/sdk-extension-contracts';
 import { z } from 'zod';
+import { validatePatternFormat } from '@stackable-labs/lib-contracts';
 
 // src/server.ts
 
+// ../../lib/utils-auth/src/constants.ts
+var STANDALONE_CLIENT_DATA = {
+  STACKABLE_LABS: {
+    CLI: { name: "@stackable-labs/cli-app-extension", authFile: "cli-auth.json" },
+    MCP: { name: "@stackable-labs/mcp-app-extension", authFile: "mcp-auth.json" }
+  },
+  STACKABLE_OPS: {
+    MCP: { name: "@stackable-ops/mcp", authFile: "mcp-ops-auth.json" }
+  }
+};
+var projectField = (field) => Object.fromEntries(
+  Object.entries(STANDALONE_CLIENT_DATA).map(([org, roles]) => [
+    org,
+    Object.fromEntries(Object.entries(roles).map(([role, entry]) => [role, entry[field]]))
+  ])
+);
+var STANDALONE_CLIENT = projectField("name");
+var STANDALONE_CLIENT_AUTH_FILE = projectField("authFile");
+Object.values(STANDALONE_CLIENT_DATA).flatMap((roles) => Object.values(roles).map((entry) => entry.name));
+
+// ../../lib/utils-auth/src/cli/shared.ts
+var AUTH_DIR = join(homedir(), ".stackable");
+join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.CLI);
+join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.MCP);
+var resolveAuthFile = (filename) => join(AUTH_DIR, filename ?? STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.CLI);
+var readAuthState = async (filename) => {
+  try {
+    const content = await readFile(resolveAuthFile(filename), "utf8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+};
+var decodeJwtPayload = (token) => {
+  try {
+    const [, payload] = token.split(".");
+    if (!payload) {
+      return null;
+    }
+    const json = Buffer.from(payload, "base64url").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+};
+var getToken = async (filename) => {
+  const state = await readAuthState(filename);
+  if (!state) {
+    throw new Error("Not authenticated. Run `stackable-app-extension auth login` first.");
+  }
+  const payload = decodeJwtPayload(state.token);
+  if (payload?.exp && typeof payload.exp === "number") {
+    if (Date.now() >= payload.exp * 1e3) {
+      throw new Error("Session expired. Run `stackable-app-extension auth login` to re-authenticate.");
+    }
+  }
+  return state.token;
+};
+
 // ../../sdk/extension/ai-docs/src/generated/template-content.ts
 var PATTERN_SECTIONS = [
   {
@@ -2905,7 +2964,7 @@ Both workflows produce the same output \u2014 a Stackable extension that runs in
 };
 
 // ../../sdk/extension/ai-docs/src/generators/ai-accelerated-development.ts
-var DEFAULT_MCP_API_BASE_URL = "https://mcp.stackablelabs.io";
+var DEFAULT_MCP_LABS_API_BASE_URL = "https://mcp.stackablelabs.io";
 var generateAIAcceleratedDevelopment = () => {
   const fm = frontmatter({
     root: false,
@@ -2913,8 +2972,8 @@ var generateAIAcceleratedDevelopment = () => {
     description: "AI-Accelerated Development: AI Extension Studio, Agent Skills, the live MCP server, and the Claude Code plugin \u2014 and how to choose between them.",
     globs: ["*"]
   });
-  const mcpApiBaseUrl = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL;
-  const mcpEndpointUrl = `${mcpApiBaseUrl}/app-extension`;
+  const mcpApiBaseUrl2 = process.env.MCP_LABS_API_BASE_URL ?? DEFAULT_MCP_LABS_API_BASE_URL;
+  const mcpEndpointUrl = `${mcpApiBaseUrl2}/app-extension`;
   return `${fm}
 
 # AI-Accelerated Development
@@ -5630,137 +5689,38 @@ pair(EXAMPLE_SNIPPETS, EXAMPLE_SNIPPETS2);
 pair(CAPABILITY_SNIPPETS, CAPABILITY_SNIPPETS2);
 pair(EVENT_SNIPPETS, EVENT_SNIPPETS2);
 
-// ../../lib/utils-auth/src/constants.ts
-var STANDALONE_CLIENT_DATA = {
-  CLI: { name: "@stackable-labs/cli-app-extension", authFile: "cli-auth.json" },
-  MCP: { name: "@stackable-labs/mcp-app-extension", authFile: "mcp-auth.json" }
-};
-var STANDALONE_CLIENT = Object.fromEntries(
-  Object.entries(STANDALONE_CLIENT_DATA).map(([k, v]) => [k, v.name])
-);
-var STANDALONE_CLIENT_AUTH_FILE = Object.fromEntries(
-  Object.entries(STANDALONE_CLIENT_DATA).map(([k, v]) => [k, v.authFile])
-);
-Object.values(STANDALONE_CLIENT);
-
-// ../../lib/utils-auth/src/index.ts
-var AUTH_DIR = join(homedir(), ".stackable");
-join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.CLI);
-var MCP_AUTH_FILE = join(AUTH_DIR, STANDALONE_CLIENT_AUTH_FILE.MCP);
-var resolveAuthFile = (filename) => join(AUTH_DIR, filename ?? STANDALONE_CLIENT_AUTH_FILE.CLI);
-var readAuthState = async (filename) => {
-  try {
-    const content = await readFile(resolveAuthFile(filename), "utf8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-};
-var decodeJwtPayload = (token) => {
-  try {
-    const [, payload] = token.split(".");
-    if (!payload) {
-      return null;
-    }
-    const json = Buffer.from(payload, "base64url").toString("utf8");
-    return JSON.parse(json);
-  } catch {
-    return null;
-  }
-};
-var getToken = async (filename) => {
-  const state = await readAuthState(filename);
-  if (!state) {
-    throw new Error("Not authenticated. Run `stackable-app-extension auth login` first.");
-  }
-  const payload = decodeJwtPayload(state.token);
-  if (payload?.exp && typeof payload.exp === "number") {
-    if (Date.now() >= payload.exp * 1e3) {
-      throw new Error("Session expired. Run `stackable-app-extension auth login` to re-authenticate.");
-    }
-  }
-  return state.token;
-};
+// ../../lib/utils-mcp/src/index.ts
+var textContent = (text) => ({
+  content: [{ type: "text", text }]
+});
+var errorContent = (text) => ({
+  isError: true,
+  content: [{ type: "text", text }]
+});
 
 // package.json
 var package_default = {
   version: "0.0.0"};
-
-// src/server.ts
-var MCP_CLIENT_NAME = STANDALONE_CLIENT.MCP;
-var DEFAULT_ADMIN_API_URL = "https://api-use1.stackablelabs.io/admin";
-var DEFAULT_MCP_API_BASE_URL2 = "https://mcp.stackablelabs.io";
-var textContent = (text) => ({ content: [{ type: "text", text }] });
-var errorContent = (text) => ({ content: [{ type: "text", text }], isError: true });
-var createMcpServer = (options = {}) => {
-  const server = new McpServer({
-    name: "stackable-extension-dev",
-    version: package_default.version
-  });
-  const getAuthToken = async () => {
-    if (options.authContext?.token) {
-      return options.authContext.token;
-    }
-    try {
-      return await getToken(STANDALONE_CLIENT_AUTH_FILE.MCP);
-    } catch {
-    }
-    if (!options.performOAuthFlow) {
-      throw new Error(
-        "No auth token available. Provide authContext (server) or performOAuthFlow (CLI)."
-      );
-    }
-    const MCP_API_BASE_URL = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL2;
-    return options.performOAuthFlow(`${MCP_API_BASE_URL}/.well-known/oauth-authorization-server`);
-  };
-  const authHeaders = (token) => ({
-    authorization: `Bearer ${token}`,
-    "content-type": "application/json",
-    "x-client-name": MCP_CLIENT_NAME
-  });
-  const callApi = async (path) => {
-    const token = await getAuthToken();
-    const ADMIN_API_BASE_URL = process.env.ADMIN_API_BASE_URL ?? DEFAULT_ADMIN_API_URL;
-    const url = `${ADMIN_API_BASE_URL}${path}`;
-    let res;
-    try {
-      res = await fetch(url, { headers: authHeaders(token) });
-    } catch (err) {
-      return errorContent(
-        `Network error calling ${url}: ${err.message}. Check ADMIN_API_BASE_URL env var (currently "${ADMIN_API_BASE_URL}").`
-      );
-    }
-    if (!res.ok) {
-      return errorContent(`API error: ${res.status} ${res.statusText} (${url})`);
-    }
-    const data = await res.json();
-    return textContent(JSON.stringify(data, null, 2));
-  };
-  const withAuth = async (fn) => {
-    try {
-      return await fn();
-    } catch (err) {
-      const e = err;
-      if (e.message.includes("fetch")) {
-        const MCP_API_BASE_URL = process.env.MCP_API_BASE_URL ?? DEFAULT_MCP_API_BASE_URL2;
-        return errorContent(
-          `MCP auth flow failed: ${e.message}. Check MCP_API_BASE_URL env var (currently "${MCP_API_BASE_URL}"). To re-auth from scratch: rm ${MCP_AUTH_FILE}`
-        );
-      }
-      return errorContent(e.message);
-    }
-  };
+var registerAppTools = (server, ctx) => {
+  server.registerTool("list_apps", {
+    description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
+  }, async () => ctx.withAuth(() => ctx.callApi("/app-extension")));
+  server.registerTool("list_extensions", {
+    description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/extensions`)));
+  server.registerTool("get_extension", {
+    description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
+  }, async ({ appId, extensionId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
+  server.registerTool("list_instances", {
+    description: "List instances under an app. Requires CLI auth.",
+    inputSchema: { appId: z.string().describe("App ID") }
+  }, async ({ appId }) => ctx.withAuth(() => ctx.callApi(`/app-extension/${appId}/instances`)));
+};
+var apps_default = registerAppTools;
+var registerSkillTools = (server) => {
   const registrySkills = listSkills("registry");
-  for (const skill of registrySkills) {
-    server.registerResource(
-      skill.id,
-      `sdk://${skill.id}`,
-      { description: skill.description, mimeType: "text/markdown" },
-      async (uri) => ({
-        contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
-      })
-    );
-  }
   server.registerTool("list_skills", {
     description: "List all available SDK skills with descriptions"
   }, async () => textContent(JSON.stringify(registrySkills.map(getSkillMetadata), null, 2)));
@@ -5784,6 +5744,9 @@ var createMcpServer = (options = {}) => {
     }
     return errorContent('Provide either "id" or "query" parameter.');
   });
+};
+var skills_default = registerSkillTools;
+var registerValidationTools = (server) => {
   server.registerTool("validate_manifest", {
     description: "Validate an extension manifest.json. Checks required fields, valid permissions, targets, and allowedDomains consistency with permissions.",
     inputSchema: { manifestContent: z.string().describe("The full manifest.json content as a string") }
@@ -5878,21 +5841,94 @@ ${errors.map((e) => `- ${e}`).join("\n")}`);
     return textContent(`Permission analysis:
 ${issues.map((i) => `- ${i}`).join("\n")}`);
   });
-  server.registerTool("list_apps", {
-    description: "List available apps for development with IDs, names, and targets. Requires CLI auth."
-  }, async () => withAuth(() => callApi("/app-extension")));
-  server.registerTool("list_extensions", {
-    description: "List extensions under an app with status, version, and bundle URL. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID") }
-  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions`)));
-  server.registerTool("get_extension", {
-    description: "Get extension detail including manifest, permissions, and targets. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID"), extensionId: z.string().describe("Extension ID") }
-  }, async ({ appId, extensionId }) => withAuth(() => callApi(`/app-extension/${appId}/extensions/${extensionId}`)));
-  server.registerTool("list_instances", {
-    description: "List instances under an app. Requires CLI auth.",
-    inputSchema: { appId: z.string().describe("App ID") }
-  }, async ({ appId }) => withAuth(() => callApi(`/app-extension/${appId}/instances`)));
+};
+var validation_default = registerValidationTools;
+
+// src/tools/index.ts
+var toolRegistrars = [
+  skills_default,
+  validation_default,
+  apps_default
+];
+
+// src/server.ts
+var MCP_LABS_AUTH_FILE2 = STANDALONE_CLIENT_AUTH_FILE.STACKABLE_LABS.MCP;
+var MCP_LABS_CLIENT_NAME = STANDALONE_CLIENT.STACKABLE_LABS.MCP;
+var DEFAULT_MCP_LABS_API_BASE_URL2 = "https://mcp.stackablelabs.io";
+var DEFAULT_ADMIN_LABS_API_URL = "https://api-x.stackablelabs.io/admin";
+var adminApiBaseUrl = () => process.env.ADMIN_LABS_API_BASE_URL ?? DEFAULT_ADMIN_LABS_API_URL;
+var mcpApiBaseUrl = () => process.env.MCP_LABS_API_BASE_URL ?? DEFAULT_MCP_LABS_API_BASE_URL2;
+var createMcpServer = (options = {}) => {
+  const server = new McpServer({
+    name: "stackable-extension-dev",
+    version: package_default.version
+  });
+  const getAuthToken = async () => {
+    if (options.authContext?.token) {
+      return options.authContext.token;
+    }
+    try {
+      return await getToken(MCP_LABS_AUTH_FILE2);
+    } catch {
+    }
+    if (!options.performOAuthFlow) {
+      throw new Error(
+        "No auth token available. Provide authContext (server) or performOAuthFlow (CLI)."
+      );
+    }
+    return options.performOAuthFlow(`${mcpApiBaseUrl()}/.well-known/oauth-authorization-server`);
+  };
+  const authHeaders = (token) => ({
+    authorization: `Bearer ${token}`,
+    "content-type": "application/json",
+    "x-client-name": MCP_LABS_CLIENT_NAME
+  });
+  const callApi = async (path) => {
+    const token = await getAuthToken();
+    const adminBase = adminApiBaseUrl();
+    const url = `${adminBase}${path}`;
+    let res;
+    try {
+      res = await fetch(url, { headers: authHeaders(token) });
+    } catch (err) {
+      return errorContent(
+        `Network error calling ${url}: ${err.message}. Check ADMIN_LABS_API_BASE_URL env var (currently "${adminBase}").`
+      );
+    }
+    if (!res.ok) {
+      return errorContent(`API error: ${res.status} ${res.statusText} (${url})`);
+    }
+    const data = await res.json();
+    return textContent(JSON.stringify(data, null, 2));
+  };
+  const withAuth = async (fn) => {
+    try {
+      return await fn();
+    } catch (err) {
+      const e = err;
+      if (e.message.includes("fetch")) {
+        return errorContent(
+          `MCP auth flow failed: ${e.message}. Check MCP_LABS_API_BASE_URL env var (currently "${mcpApiBaseUrl()}"). To re-auth from scratch: rm ${MCP_LABS_AUTH_FILE2}`
+        );
+      }
+      return errorContent(e.message);
+    }
+  };
+  const registrySkills = listSkills("registry");
+  for (const skill of registrySkills) {
+    server.registerResource(
+      skill.id,
+      `sdk://${skill.id}`,
+      { description: skill.description, mimeType: "text/markdown" },
+      async (uri) => ({
+        contents: [{ uri: uri.href, text: getSkillBody(skill), mimeType: "text/markdown" }]
+      })
+    );
+  }
+  const ctx = { withAuth, callApi };
+  for (const register of toolRegistrars) {
+    register(server, ctx);
+  }
   return server;
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackable-labs/mcp-app-extension",
-  "version": "2.2.0",
+  "version": "2.4.0",
   "type": "module",
   "bin": {
     "mcp-app-extension": "./dist/index.js"