@stackable-labs/sdk-extension-contracts 1.5.0 → 1.6.0

package/dist/api.d.ts

@@ -1,8 +1,6 @@
 export interface ApiRequest {
-    action: 'getOrder' | 'getOrders' | 'getCustomer';
-    orderId?: string;
-    customerId?: string;
-    email?: string;
+    action: string;
+    [key: string]: unknown;
 }
 export interface ApiResponse<T = unknown> {
     success: boolean;

package/dist/capabilities.d.ts

@@ -3,6 +3,23 @@
  * Defines the host-mediated APIs that extensions can call via RPC.
  */
 import type { ApiRequest } from './api';
+/** Payload for data.fetch capability */
+export interface FetchRequest {
+    /** Full URL to fetch — must be on the extension's allowedDomains */
+    url: string;
+    /** HTTP method (default: 'GET') */
+    method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+    /** Optional request headers */
+    headers?: Record<string, string>;
+    /** Optional request body (JSON-serializable) */
+    body?: unknown;
+}
+/** Response returned to the extension */
+export interface FetchResponse {
+    status: number;
+    ok: boolean;
+    data: unknown;
+}
 /** Payload for actions.toast capability */
 export interface ToastPayload {
     message: string;
@@ -24,6 +41,9 @@ export interface ContextData {
 export type CapabilityCall = {
     type: 'data.query';
     payload: ApiRequest;
+} | {
+    type: 'data.fetch';
+    payload: FetchRequest;
 } | {
     type: 'actions.toast';
     payload: ToastPayload;

package/dist/manifest.d.ts

@@ -17,6 +17,13 @@ export interface ExtensionManifest {
     targets: string[];
     /** Permissions required by this extension */
     permissions: Permission[];
+    /**
+     * Hostnames this extension is permitted to reach via data.fetch.
+     * Example: ["api.myservice.com", "cdn.myservice.com"]
+     * Must be exact hostname strings — no wildcards, no paths.
+     * Use an empty array for extensions that do not use data.fetch.
+     */
+    allowedDomains: string[];
 }
 /**
  * Registry entry for an installed extension (returned by /api/extensions).

package/dist/permissions.d.ts

@@ -3,7 +3,7 @@
  * Extensions declare required permissions in their manifest.
  * Host enforces: capability calls must be a subset of granted permissions.
  */
-export declare const PERMISSIONS: readonly ["context:read", "data:query", "actions:toast", "actions:invoke"];
+export declare const PERMISSIONS: readonly ["context:read", "data:query", "data:fetch", "actions:toast", "actions:invoke"];
 export type Permission = (typeof PERMISSIONS)[number];
 /**
  * Maps capability types to the permission required to use them.

package/dist/permissions.js

@@ -6,6 +6,7 @@
 export const PERMISSIONS = [
     'context:read',
     'data:query',
+    'data:fetch',
     'actions:toast',
     'actions:invoke'
 ];
@@ -15,6 +16,7 @@ export const PERMISSIONS = [
 export const CAPABILITY_PERMISSION_MAP = {
     'context.read': 'context:read',
     'data.query': 'data:query',
+    'data.fetch': 'data:fetch',
     'actions.toast': 'actions:toast',
     'actions.invoke': 'actions:invoke',
 };

package/dist/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,YAAY;IACZ,eAAe;IACf,gBAAgB;CACR,CAAA;AAIV;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA+B;IACnE,cAAc,EAAE,cAAc;IAC9B,YAAY,EAAE,YAAY;IAC1B,eAAe,EAAE,eAAe;IAChC,gBAAgB,EAAE,gBAAgB;CACnC,CAAA"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,cAAc;IACd,YAAY;IACZ,YAAY;IACZ,eAAe;IACf,gBAAgB;CACR,CAAA;AAIV;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAA+B;IACnE,cAAc,EAAE,cAAc;IAC9B,YAAY,EAAE,YAAY;IAC1B,YAAY,EAAE,YAAY;IAC1B,eAAe,EAAE,eAAe;IAChC,gBAAgB,EAAE,gBAAgB;CACnC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stackable-labs/sdk-extension-contracts",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",