@extenshi/mcp/dist/scan.d.ts

Extenshi MCP server — bring the extension catalog (search, security, market research) and pre-publish scanning into your AI tools

/**
 * Scan an extension artifact against the Extenshi scan backend and RETURN the
 * report (no printing) — the MCP-friendly counterpart to the CLI's `runScan`.
 *
 * It replicates the exact request `@extenshi/cli` makes
 * (`POST {scanUrl}/api/v1/scan`, multipart `apiKey` + `artifact` + optional
 * `extensionId`, SSE progress, 240s timeout, server-side credit
 * consume→commit→refund) so the MCP `scan_extension` tool and the CLI bill and
 * behave identically. The network + SSE logic is vendored (not imported) to
 * keep this package independently publishable — npm rejects `workspace:*`.
 *
 * Errors surface as `ScanError` carrying the HTTP status + machine `errorCode`
 * so the caller can render the right next-step instruction.
 */
export interface ScanProgress {
    stage?: string;
    scanner?: string | null;
    completed?: number;
    total?: number | null;
    pct?: number;
}
export interface ScanArtifactOptions {
    artifactPath: string;
    apiKey: string;
    /** Scan backend base URL, no trailing slash (e.g. https://scan.extenshi.io). */
    scanUrl: string;
    /** Numeric catalog ID — required to spend a FREE credit on an unverified extension. */
    extensionId?: string;
    /** Called for each upstream progress event so the caller can stream it. */
    onProgress?: (p: ScanProgress) => void;
}
/** A scan failure that carries the HTTP status and the backend's machine code. */
export declare class ScanError extends Error {
    status?: number;
    errorCode?: string;
    retryAfterSec?: number;
    constructor(message: string, opts?: {
        status?: number;
        errorCode?: string;
        retryAfterSec?: number;
    });
}
export type ScanReport = Record<string, unknown>;
/**
 * Why a parsed scan response is not a usable report, or null when it is. The
 * backend has already committed the credit by the time a result arrives, so an
 * unusable body must surface as an error naming the job — never as an empty
 * success the caller cannot tell apart from a clean scan.
 */
export declare function scanReportProblem(report: unknown): string | null;
export declare function scanArtifact(opts: ScanArtifactOptions): Promise<ScanReport>;
//# sourceMappingURL=scan.d.ts.map