feat: Add deleteProject() / deleteScreen() SDK methods and MCP tools (API key support) #364

Summary

The SDK and Stitch MCP server currently lack first-class support for deleting projects and deleting screens. Integrators building programmatic UI design workflows (create → iterate → delete) must resort to undocumented REST endpoints or manual cleanup in the Stitch web UI.

Current SDK surface

The public API supports creating and reading resources, but not deleting them:

Available MCP tools today (from listTools()):

create_project, get_project, list_projects, list_screens, get_screen,
generate_screen_from_text, edit_screens, generate_variants

No delete_project or delete_screen tool is exposed.

Impact

Downstream apps that manage Stitch projects on behalf of users cannot reliably clean up remote resources when a local project or screen is removed. In practice we observe:

1. No MCP delete tools — listTools() returns no delete/remove tools; callers must probe for undocumented tool names.
2. REST delete requires OAuth — Direct calls to the Stitch REST API fail with API keys:
   • DELETE /v1/projects/{projectId} → 403 PERMISSION_DENIED or 401 ("API keys are not supported by this API. Expected OAuth2 access token")
   • DELETE /v1/projects/{projectId}/screens/{screenId} → same
   • POST /v1/projects/{projectId}:delete / screens:batchDelete → 404 NOT_FOUND (not exposed via MCP httpPost)
3. Partial canvas-only workaround — Removing a screen from the project canvas via PATCH screenInstances sometimes works with API keys, but does not delete the underlying screen resource.

Users are forced to manually delete projects/screens at stitch.withgoogle.com, breaking automated agent and BYOK integration flows.

Requested API

SDK (domain classes)

// Stitch / Project
await project.delete(); // or stitch.deleteProject(projectId)
// Screen
await screen.delete(); // deletes screen resource + removes from canvas

Both methods should:

• Work with STITCH_API_KEY (BYOK), not only OAuth
• Throw typed StitchError with NOT_FOUND if already deleted (idempotent)
• Return void on success

MCP tools

REST (if applicable)

Document and enable with API keys:

• DELETE https://stitch.googleapis.com/v1/projects/{projectId}
• DELETE https://stitch.googleapis.com/v1/projects/{projectId}/screens/{screenId}

Expected behavior

import { stitch } from "@google/stitch-sdk";
const project = stitch.project("1234567890");
const screens = await project.screens();
// Delete a single screen
await screens[0].delete();
expect(await project.screens()).not.toContainEqual(screens[0]);
// Delete entire project
await project.delete();
expect(await stitch.projects()).not.toContainEqual(expect.objectContaining({ projectId: "1234567890" }));

Environment

• @google/stitch-sdk ^0.3.5
• Auth: STITCH_API_KEY (BYOK)
• Node.js 22

Happy to share integration details or help test a fix.