Extensions
Extensions
Extensions are the opt-in capabilities that turn a kernel into a product: validation, auth, authorization, resources, OpenAPI, testing, agent tooling, telemetry. Each is a package that attaches through a blueprint and providers, never by the core reaching out to it.
#How an extension attaches
The pattern is always the same: install the package, add its blueprint (or its decorators) to the manifest, and its services and middleware become available. The kernel needs no knowledge of any of them; they plug in, it does not plug out.
The core stays small. Capability arrives as packages that graft on, and never the other way around.
#The catalog
| Extension | Type | Description |
|---|---|---|
| @stone-js/validation | validation | One schema, enforced on the API and the frontend form. |
| @stone-js/auth | authentication | Stateless JWT / OAuth, edge-native, no session. |
| @stone-js/authz | authorization | Isomorphic RBAC + ABAC: one rule set for API and UI. |
| @stone-js/resources | output shaping | Deliberate projections from model to public shape. |
| @stone-js/openapi | contract | A public OpenAPI document derived from your schemas. |
| @stone-js/testing | testing | Boot the real app in memory; dispatch real events. |
| @stone-js/mcp-dev | agents / dev | Serve the framework + your app to a coding agent via `stone mcp`. |
| @stone-js/telemetry | observability | Spans and metrics with pluggable exporters. |