@widgetic/cli 0.1.2 → 0.1.3

package/README.md

@@ -145,7 +145,7 @@ The gateway (`Services/api-gateway-service`) builds a package, [`@widgetic/api-c
 There is nothing to keep in step by hand: the commands are a function of the contracts, and four guards fail when they are not.
 
 - **Tests.** `test/command-snapshot.test.ts` holds the command tree (names, flags, groups) to a checked-in snapshot, so a new endpoint, a renamed tool or a changed flag shows up as a diff somebody reads; `test/command-reference.test.ts` does the same for the generated reference in `docs/commands`; the generator tests fail on an operation or a tool that has no command, or two with one name.
-- **The release gate** (`npm run check:release`, run by the publish script before the version is raised, and by the `publish` job of `.gitlab-ci.yml`). It fails unless the contracts the commands were generated from are a release, are the newest `latest` of `@widgetic/api-contracts` on npm, and the tool names and the tool contract version are the ones production's MCP `tools/list` answers. It asks production with the key of `WIDGETIC_API_KEY` or of `widgetic auth login`. That key has to be made with full access: the MCP endpoint refuses a key limited to some scopes (read only, content or custom), and a key for a CI variable is best made on an account that is used for nothing else. Nothing is published and no version is raised when it fails.
+- **The release gate** (`npm run check:release`, run by the publish script before the version is raised, and by the `publish` job of `.gitlab-ci.yml`). It fails unless the contracts the commands were generated from are a release, are the newest `latest` of `@widgetic/api-contracts` on npm, and the tool names and the tool contract version are the ones production's MCP server serves. It reads that from `/.well-known/widgetic-mcp-contract` on production's MCP host, a public document (the contract version, the number of tools and their names; no key, no cookie, no description of any tool, a redirect is never followed). A document that is there but cannot be trusted (an error, something that is not JSON, another schema, a count that is not the length of the list) fails the gate: it never sends the gate to look somewhere else. Only while production runs a gateway older than the release that adds the document (it answers `404`) does the gate ask the MCP server itself, with the key of `WIDGETIC_API_KEY` or of `widgetic auth login`: `initialize`, then `tools/list`. That key has to be made with full access: the MCP endpoint refuses a key limited to some scopes (read only, content or custom), and a key for a CI variable is best made on an account that is used for nothing else. With neither the document nor a key the gate fails, and says which of the two is missing. The report says which one it relied on. Nothing is published and no version is raised when it fails.
 - **At run time.** When an MCP command opens a session and the server's tool contract is not the one the CLI was built for, the CLI says so once in 24 hours on stderr (never with `--json`), and `widgetic doctor` always shows the two versions.
 - **The server can refuse an old CLI.** Every request carries `X-SDK-Version: @widgetic/cli/<version>` (MCP: the client's `clientInfo`). The gateway counts the versions it sees and can answer `426` to one that is too old: exit code 7.
 
@@ -159,7 +159,7 @@ npm run check          # typecheck, tests, prettier
 npm run build          # dist/ (and generated/)
 npm run docs           # write docs/commands from the installed contracts
 npm run snapshot       # write the command snapshot from the installed contracts
-npm run check:release  # the release gate (needs the network and a key)
+npm run check:release  # the release gate (needs the network; a key only while production publishes no contract document)
 ```
 
 Tests run the real program in-process against a fake environment (`test/helpers/fake-environment.ts`): a fetch that answers from a function and records what it was asked, streams that collect the output, no terminal, no real network, and a package manager that is a function (nothing is ever installed by a test). A fake MCP server (`test/helpers/fake-mcp-server.ts`) answers the MCP tests. The question on the terminal is the one thing the fake replaces whole, so `test/terminal.test.ts` runs the real one on streams of its own.

package/dist/overlay.js

@@ -37,6 +37,7 @@ export function isWaitTool(tool) {
  * and `test/overlay.test.ts` fails until somebody writes its line.
  */
 export const API_GROUP_SUMMARIES = {
+    'brand-kit': 'Your Brand Kit: the colors, fonts, icons, corner radius and notes for the AI that every new widget follows.',
     canvases: 'The canvases that hold your widgets: create, list, read, update and delete them.',
     compositions: 'What is made from a widget: its content, design, preview, versions, data and embed settings.',
     credits: "An account's credit balance and credit ledger.",

package/generated/contracts.json

@@ -1 +1 @@
-{"package":"@widgetic/api-contracts","version":"1.11.109","publishTag":"latest","source":{"commit":"21238b5bbb97b100ef2edb0d9d98d167467e8d18","branch":null,"dirty":false,"atOriginMain":true},"openApi":{"file":"openapi-public.json","sha256":"750e774e958a819377963d0a6f7a2feb2e7b70327b614053fdbe748e3e5e5865","paths":120,"operations":161,"servers":["https://api.widgetic.com/v1"]},"mcp":{"file":"mcp-tools.json","sha256":"9d6494d8d1d227e1752a170339d63853b52770812e9283cda2ca66981edd72c6","contractVersion":"1.12.0","serverName":"widgetic","tools":32}}
+{"package":"@widgetic/api-contracts","version":"1.11.111","publishTag":"latest","source":{"commit":"fa75adf8384a27c620fb9d0d99b65db4f25ca7b5","branch":null,"dirty":false,"atOriginMain":true},"openApi":{"file":"openapi-public.json","sha256":"f268893f66578ba4099660fb42b4f8f1c3c56bc0672f1190b4bb12b905f34e6c","paths":124,"operations":169,"servers":["https://api.widgetic.com/v1"]},"mcp":{"file":"mcp-tools.json","sha256":"e6ca36563883e9d31597f201bcc0276babede3b901310558d291bff349ddbae3","contractVersion":"1.14.0","serverName":"widgetic","tools":34}}