@vornrun/connector-sdk 0.7.0-beta.13 → 0.7.0-beta.15

package/dist/cli.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { B as BundleRequest, a as BundleOutput } from './packaging-DFTuP4fr.js';
+import { B as BundleRequest, a as BundleOutput, C as CheckFinding } from './check-Cv6UNBA4.js';
 
 interface CliDeps {
     load(modulePath: string): Promise<unknown>;
@@ -9,6 +9,8 @@ interface CliDeps {
     cwd?: string;
     /** Replaced in tests so pack does not shell out to a bundler. */
     bundle?(request: BundleRequest): Promise<BundleOutput>;
+    /** Replaced in tests so pack does not start the staged bundle. */
+    launch?(dir: string): Promise<CheckFinding[]>;
     /** Writes a scaffold file or a receipt; replaced in tests so nothing touches disk. */
     writeFile?(path: string, contents: string): Promise<void>;
     /** Replaced in tests beside writeFile. */

package/dist/cli.js

@@ -10,7 +10,7 @@ import {
   runPoll,
   scaffoldFiles,
   serveConnector
-} from "./chunk-XOP6JKBX.js";
+} from "./chunk-FHGC7LE7.js";
 
 // src/cli.ts
 import { fileURLToPath, pathToFileURL } from "url";
@@ -36,8 +36,9 @@ Options:
   --receipt <file>              Where check writes what it verified, as JSON
   --out <dir>                   Directory new and pack write to
   --name <name>                 Display name for a new connector
-  --repo-conventions            Scaffold a package shaped for the connectors repository`;
-var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["live", "mock", "repo-conventions"]);
+  --repo-conventions            Scaffold a package shaped for the connectors repository
+  --extension                   Scaffold an extension \u2014 footers, panes and link handlers`;
+var BOOLEAN_FLAGS = /* @__PURE__ */ new Set(["live", "mock", "repo-conventions", "extension"]);
 function parseArgs(args) {
   const flags = {};
   const positional = [];
@@ -67,7 +68,7 @@ function pickConnector(loaded, modulePath) {
   const connector = candidate;
   if (!connector || typeof connector !== "object" || !Array.isArray(connector.triggers)) {
     throw new Error(
-      `${modulePath} does not export a connector built with defineConnector() (default or named "connector")`
+      `${modulePath} does not export a connector built with defineConnector() or defineExtension() (default or named "connector")`
     );
   }
   return connector;
@@ -93,7 +94,8 @@ ${USAGE}`);
     const files = scaffoldFiles({
       id: modulePath,
       ...flags2.name !== void 0 && { name: flags2.name },
-      ...flags2["repo-conventions"] === "true" && { repoConventions: true }
+      ...flags2["repo-conventions"] === "true" && { repoConventions: true },
+      ...flags2.extension === "true" && { kind: "extension" }
     });
     const root = join(flags2.out ?? deps.cwd ?? ".", modulePath);
     if ((deps.exists ?? existsSync)(root)) {
@@ -171,7 +173,8 @@ ${connector.id} passed with ${findings.length} warning(s)`
         entry: modulePath,
         ...flags.out !== void 0 && { outDir: flags.out },
         ...deps.cwd !== void 0 && { resolveDir: deps.cwd },
-        ...deps.bundle !== void 0 && { bundle: deps.bundle }
+        ...deps.bundle !== void 0 && { bundle: deps.bundle },
+        ...deps.launch !== void 0 && { launch: deps.launch }
       });
       if (result.findings.length > 0) deps.write(formatFindings(result.findings));
       const errors = result.findings.filter((item) => item.level === "error");

package/dist/index.d.ts

@@ -1,7 +1,11 @@
-import { C as ConnectorDefinition, b as Connector, c as ConnectorConfig, T as TriggerDefinition, P as PollContext, d as PollOutcome, e as ConnectorItem, N as NormalizedItem, f as PostReceiveOp, A as ActionRequest, B as BundleRequest, a as BundleOutput, g as CheckFinding } from './packaging-DFTuP4fr.js';
-export { h as ActionContext, i as ActionDefinition, j as ActionInputField, k as ActionInputOption, l as ActionInputType, m as ActionOutputField, n as AuthRung, o as CHECK_OWNERS, p as CheckCode, q as CheckOptions, r as ConformanceRun, s as ConnectionSetup, t as ConnectorAuth, u as ConnectorConfigField, v as ConnectorHarness, w as ConnectorIcon, x as ConnectorManifest, y as ConnectorVerification, D as DedupeStrategy, z as DefaultWorkflow, F as FetchContext, H as HarnessOptions, M as MANIFEST_TOOL, E as MAX_PACK_BYTES, G as MAX_POLL_PAGES, I as MockCall, J as MockRoute, K as MockRouteMissError, L as MockRun, O as OPTIONS_TOOL, Q as OptionsContext, R as OptionsLoader, S as PREFLIGHT_TOOL, U as PaginationStrategy, V as PollPage, W as PreflightResult, X as ResilientFetchOptions, Y as RetryPolicy, Z as RunActionOptions, _ as RunPollOptions, $ as StatusSuggestion, a0 as backoffMs, a1 as bundleDependencyFindings, a2 as checkConnector, a3 as connectionSetup, a4 as connectorManifest, a5 as createConnectorHarness, a6 as drainPoll, a7 as esbuildBundle, a8 as escapedMockHttp, a9 as formatFindings, aa as lifecycleScriptFindings, ab as pollToolName, ac as readNearestPackageJson, ad as resilientFetch, ae as retryAfterMs, af as runAction, ag as runConformance, ah as runOptions, ai as runPoll, aj as withMockHttp } from './packaging-DFTuP4fr.js';
+import { E as ExtensionPermission, b as ExtensionHostMethod, c as ConnectorDefinition, d as Connector, e as ExtensionDefinition, f as ConnectorConfig, g as ExtensionHost, T as TriggerDefinition, P as PollContext, h as PollOutcome, i as ConnectorItem, N as NormalizedItem, j as PostReceiveOp, A as ActionRequest, B as BundleRequest, a as BundleOutput, C as CheckFinding } from './check-Cv6UNBA4.js';
+export { k as ActionContext, l as ActionDefinition, m as ActionInputField, n as ActionInputOption, o as ActionInputType, p as ActionOutputField, q as ActivationPredicate, r as AuthRung, s as CHECK_OWNERS, t as CheckCode, u as CheckOptions, v as ConformanceRun, w as ConnectionSetup, x as ConnectorAuth, y as ConnectorConfigField, z as ConnectorHarness, D as ConnectorIcon, F as ConnectorKind, G as ConnectorManifest, H as ConnectorVerification, I as DedupeStrategy, J as DefaultWorkflow, K as ExtensionAgent, L as ExtensionContext, M as ExtensionContributions, O as ExtensionPlatform, Q as ExtensionUsage, R as ExtensionUsageWindow, S as FetchContext, U as FooterContribution, V as FooterItem, W as HarnessOptions, X as LinkContext, Y as LinkHandled, Z as LinkHandlerContribution, _ as MANIFEST_TOOL, $ as MAX_PACK_BYTES, a0 as MAX_POLL_PAGES, a1 as ManifestContributions, a2 as MockCall, a3 as MockHostAnswers, a4 as MockHostRun, a5 as MockRoute, a6 as MockRouteMissError, a7 as MockRun, a8 as OPTIONS_TOOL, a9 as OptionsContext, aa as OptionsLoader, ab as PREFLIGHT_TOOL, ac as PaginationStrategy, ad as PaneContribution, ae as PollPage, af as PreflightResult, ag as ResilientFetchOptions, ah as RetryPolicy, ai as RunActionOptions, aj as RunPollOptions, ak as StatusSuggestion, al as backoffMs, am as bundleDependencyFindings, an as bundledRequireFindings, ao as checkConnector, ap as connectionSetup, aq as connectorManifest, ar as createConnectorHarness, as as drainPoll, at as esbuildBundle, au as escapedMockHttp, av as footerToolName, aw as formatFindings, ax as handlerToolName, ay as lifecycleScriptFindings, az as mockExtensionHost, aA as pollToolName, aB as readNearestPackageJson, aC as resilientFetch, aD as retryAfterMs, aE as runAction, aF as runConformance, aG as runOptions, aH as runPoll, aI as withMockHttp } from './check-Cv6UNBA4.js';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 
+/** Everything an extension may ask the host for; anything else is not grantable. */
+declare const EXTENSION_PERMISSIONS: ExtensionPermission[];
+/** What each host method costs, read by the bridge that grants it and the check that gates it. */
+declare const HOST_PERMISSIONS: Record<ExtensionHostMethod, ExtensionPermission>;
 /** Environment variable a config field reads from, e.g. `apiToken` → `API_TOKEN`. */
 declare function envNameFor(key: string, explicit?: string): string;
 /**
@@ -12,6 +16,15 @@ declare function envNameFor(key: string, explicit?: string): string;
  * MCP tool once the connector is already installed in someone's app.
  */
 declare function defineConnector(definition: ConnectorDefinition): Connector;
+/**
+ * Validate an extension and fill in its defaults.
+ *
+ * An extension is a pack like a connector, so it goes through the same
+ * manifest, pack, check and catalog; what differs is that it contributes to a
+ * session card rather than polling a service. Failing here — at import time —
+ * keeps a mistyped permission or an unreachable page from reaching a card.
+ */
+declare function defineExtension(definition: ExtensionDefinition): Connector;
 /**
  * Read the connector's declared config out of the environment. Vorn supplies
  * these through the connection's `env` / `secretEnv` maps, so a missing
@@ -20,6 +33,32 @@ declare function defineConnector(definition: ConnectorDefinition): Connector;
  */
 declare function resolveConfig(connector: Connector, env?: NodeJS.ProcessEnv): ConnectorConfig;
 
+/**
+ * How an extension asks the host for what it was granted.
+ *
+ * The extension runs as its own process, so the bridge is an HTTP endpoint the
+ * host serves and names in the environment, with a token that says which
+ * extension is calling. The host grants exactly the permissions the manifest
+ * declared, which is why a call outside them comes back refused rather than
+ * empty — the same answer the check's stub gives, so an extension meets the
+ * rule once rather than twice.
+ */
+/** Where the host answers, and the token that says who is asking. */
+declare const HOST_URL_ENV = "VORN_EXTENSION_HOST";
+declare const HOST_TOKEN_ENV = "VORN_EXTENSION_TOKEN";
+/** The host refused a call the extension's manifest never asked for. */
+declare class PermissionDeniedError extends Error {
+    constructor(method: string, detail: string);
+}
+interface HostBridgeOptions {
+    sessionId: string;
+    env?: NodeJS.ProcessEnv;
+    /** Replaced in tests so nothing opens a socket. */
+    fetchImpl?: typeof fetch;
+}
+/** The host as an extension process reaches it, over the bridge Vorn served it. */
+declare function createExtensionHost(options: HostBridgeOptions): ExtensionHost;
+
 /**
  * Run a declarative trigger: call the author's `fetch`, then apply the chosen
  * dedupe strategy.
@@ -115,8 +154,12 @@ interface PackOptions {
     sdkModule?: string;
     /** Size ceiling for the written archive; defaults to `MAX_PACK_BYTES`. */
     maxBytes?: number;
+    /** Size ceiling for what the archive unpacks to; defaults to `MAX_UNPACKED_BYTES`. */
+    maxUnpackedBytes?: number;
     /** Replaced in tests so packing does not shell out to a bundler. */
     bundle?(request: BundleRequest): Promise<BundleOutput>;
+    /** Replaced in tests whose subject is the archive rather than the launch; defaults to starting it for real. */
+    launch?(dir: string): Promise<CheckFinding[]>;
 }
 interface PackResult {
     findings: CheckFinding[];
@@ -133,6 +176,8 @@ interface ConnectorServerOptions {
     /** Resolved connector configuration. Defaults to reading `process.env`. */
     config?: ConnectorConfig;
     now?: () => string;
+    /** The host an extension's contributions talk to; defaults to the bridge Vorn served. */
+    host?(sessionId: string): ExtensionHost;
 }
 /**
  * Expose a connector as an MCP server.
@@ -165,6 +210,8 @@ interface ScaffoldOptions {
     description?: string;
     /** Emit the shape the connectors repository expects of a package inside it. */
     repoConventions?: boolean;
+    /** What to start: a connector that polls a service, or an extension that contributes to a card. */
+    kind?: 'connector' | 'extension';
 }
 interface ScaffoldFile {
     /** Relative to the directory the connector is created in. */
@@ -173,7 +220,7 @@ interface ScaffoldFile {
 }
 /** `acme-tickets` → `Acme Tickets`, so a generated name reads like a name. */
 declare function titleCase(id: string): string;
-/** Every file a new connector starts with, ready to build, check and pack. */
+/** Every file a new connector or extension starts with, ready to build, check and pack. */
 declare function scaffoldFiles(options: ScaffoldOptions): ScaffoldFile[];
 
-export { ActionRequest, BundleOutput, BundleRequest, CheckFinding, Connector, ConnectorConfig, ConnectorDefinition, ConnectorItem, type ConnectorServerOptions, MAX_REQUEST_PAGES, NormalizedItem, type PackOptions, type PackResult, PollContext, PollOutcome, PostReceiveOp, type RequestScope, type ResolvedRequest, type ScaffoldFile, type ScaffoldOptions, type Substitution, TriggerDefinition, applyPostReceive, asOutput, createConnectorServer, defineConnector, envNameFor, executeRequest, nextLink, normalizeItem, normalizeItems, packConnector, packFileName, pollWithDedupe, resolveConfig, resolveRequest, resolveTemplates, scaffoldFiles, serveConnector, titleCase, valueAt };
+export { ActionRequest, BundleOutput, BundleRequest, CheckFinding, Connector, ConnectorConfig, ConnectorDefinition, ConnectorItem, type ConnectorServerOptions, EXTENSION_PERMISSIONS, ExtensionDefinition, ExtensionHost, ExtensionHostMethod, ExtensionPermission, HOST_PERMISSIONS, HOST_TOKEN_ENV, HOST_URL_ENV, type HostBridgeOptions, MAX_REQUEST_PAGES, NormalizedItem, type PackOptions, type PackResult, PermissionDeniedError, PollContext, PollOutcome, PostReceiveOp, type RequestScope, type ResolvedRequest, type ScaffoldFile, type ScaffoldOptions, type Substitution, TriggerDefinition, applyPostReceive, asOutput, createConnectorServer, createExtensionHost, defineConnector, defineExtension, envNameFor, executeRequest, nextLink, normalizeItem, normalizeItems, packConnector, packFileName, pollWithDedupe, resolveConfig, resolveRequest, resolveTemplates, scaffoldFiles, serveConnector, titleCase, valueAt };

package/dist/index.js

@@ -1,5 +1,9 @@
 import {
   CHECK_OWNERS,
+  EXTENSION_PERMISSIONS,
+  HOST_PERMISSIONS,
+  HOST_TOKEN_ENV,
+  HOST_URL_ENV,
   MANIFEST_TOOL,
   MAX_PACK_BYTES,
   MAX_POLL_PAGES,
@@ -7,23 +11,30 @@ import {
   MockRouteMissError,
   OPTIONS_TOOL,
   PREFLIGHT_TOOL,
+  PermissionDeniedError,
   applyPostReceive,
   asOutput,
   backoffMs,
   bundleDependencyFindings,
+  bundledRequireFindings,
   checkConnector,
   connectionSetup,
   connectorManifest,
   createConnectorHarness,
   createConnectorServer,
+  createExtensionHost,
   defineConnector,
+  defineExtension,
   drainPoll,
   envNameFor,
   esbuildBundle,
   escapedMockHttp,
   executeRequest,
+  footerToolName,
   formatFindings,
+  handlerToolName,
   lifecycleScriptFindings,
+  mockExtensionHost,
   nextLink,
   normalizeItem,
   normalizeItems,
@@ -46,9 +57,13 @@ import {
   titleCase,
   valueAt,
   withMockHttp
-} from "./chunk-XOP6JKBX.js";
+} from "./chunk-FHGC7LE7.js";
 export {
   CHECK_OWNERS,
+  EXTENSION_PERMISSIONS,
+  HOST_PERMISSIONS,
+  HOST_TOKEN_ENV,
+  HOST_URL_ENV,
   MANIFEST_TOOL,
   MAX_PACK_BYTES,
   MAX_POLL_PAGES,
@@ -56,23 +71,30 @@ export {
   MockRouteMissError,
   OPTIONS_TOOL,
   PREFLIGHT_TOOL,
+  PermissionDeniedError,
   applyPostReceive,
   asOutput,
   backoffMs,
   bundleDependencyFindings,
+  bundledRequireFindings,
   checkConnector,
   connectionSetup,
   connectorManifest,
   createConnectorHarness,
   createConnectorServer,
+  createExtensionHost,
   defineConnector,
+  defineExtension,
   drainPoll,
   envNameFor,
   esbuildBundle,
   escapedMockHttp,
   executeRequest,
+  footerToolName,
   formatFindings,
+  handlerToolName,
   lifecycleScriptFindings,
+  mockExtensionHost,
   nextLink,
   normalizeItem,
   normalizeItems,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vornrun/connector-sdk",
-  "version": "0.7.0-beta.13",
+  "version": "0.7.0-beta.15",
   "description": "Build and share Vorn pull connectors as ordinary npm packages",
   "type": "module",
   "license": "MIT",
@@ -39,7 +39,7 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "esbuild": "^0.28.2",
     "tar": "^7.5.21",
-    "zod": "^4.4.3"
+    "zod": "^4.5.4"
   },
   "devDependencies": {
     "tsup": "^8.5.1",