llm_meta_widget 0.8.6 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 83ad21e8631c42b769a30bc71493cf7b73590f16e62a6bdd5747d147e4aeb9c5
-  data.tar.gz: e65e1289d90bff0db65c8905f4018f2eddaa48e680f1d17afe709a9ac2a59a5f
+  metadata.gz: 56c8bf50409745cc9a6cc372bdf40c8e36bd546fce37eee67c6dbce16157bedd
+  data.tar.gz: 2506d6fc96004902b4618ff7a759a1139a13bae69ca4b272e6841326d55397ee
 SHA512:
-  metadata.gz: de457ef4d34b201e3d0cfd5e53b3171fa1e9ed88aaa99da68a92fe00a0fe82769942ac25783982ba9397544e2018e645755b6a5f3cc5cfa62d11d2e173648c3b
-  data.tar.gz: 3d28002e0c0d593cf6b287943e32863a341aaeee82da14b0fd01aa23e46cad77722c434bc06e6b19c792c30dd95c61bd90e0ccb6de694565c845a4ab69ed223a
+  metadata.gz: d9bcd580647795a610c6c7612a36e2fe60fbd9962d1842fd03c07702933d9b7cbfa1850f969b25dec0a719387b33f227729da747d7702d45d2be953ba3efaa14
+  data.tar.gz: 31c03d36d61ceece0ae0e4ea4b93fa9a78ed2bea461b6ff155f9e9ac9f8e6d2f589b2f7a8efc348258323574b3e1e6d8cea9cbd07b25ec937936f235d797ffb1

data/app/assets/javascripts/llm_meta_widget/config.js

@@ -26,8 +26,11 @@
 export const DEFAULTS = Object.freeze({
   API_KEY_UUID:           "ollama-local",
   ACTIONS_SCHEMA_ID:      "ai-actions",
+  PAGE_CARD_ID:           "ai-page",
   STATE_GLOBAL:           "aiState",
   ACTIONS_GLOBAL:         "aiActions",
+  PROMPTS_GLOBAL:         "aiPrompts",
+  RESOURCES_GLOBAL:       "aiResources",
   REMOTE_TOOLS_SCHEMA_ID: "remote-mcp-tools",
   LLM_PROVIDER:           "llm_meta_server",
   MAX_ROUNDS:             3,
@@ -59,9 +62,12 @@ export function readConfig(el) {
     API_KEY_UUID:           str("api-key-uuid", DEFAULTS.API_KEY_UUID),
     MODEL:                  str("model", null),
     ACTIONS_SCHEMA_ID:      str("actions-schema-id", DEFAULTS.ACTIONS_SCHEMA_ID),
+    PAGE_CARD_ID:           str("page-card-id", DEFAULTS.PAGE_CARD_ID),
     GREETING:               str("greeting", null),
     STATE_GLOBAL:           str("state-global", DEFAULTS.STATE_GLOBAL),
     ACTIONS_GLOBAL:         str("actions-global", DEFAULTS.ACTIONS_GLOBAL),
+    PROMPTS_GLOBAL:         str("prompts-global", DEFAULTS.PROMPTS_GLOBAL),
+    RESOURCES_GLOBAL:       str("resources-global", DEFAULTS.RESOURCES_GLOBAL),
     REMOTE_TOOLS_SCHEMA_ID: str("remote-tools-schema-id", DEFAULTS.REMOTE_TOOLS_SCHEMA_ID),
     MAX_ROUNDS:             int("max-rounds", DEFAULTS.MAX_ROUNDS),
     WELL_KNOWN_URLS:        wellKnown === null

data/app/assets/javascripts/llm_meta_widget/element.js

@@ -22,7 +22,9 @@ import { runChatLoop, fetchMcpManifest, listMcpPrompts, getMcpPrompt,
          listMcpResources, readMcpResource, promptMessagesToText,
          loadHostResource, resourceLinesForTurn, resolvePromptArguments,
          promptButtonProps, promptArgumentSummary, fetchOllamaModels,
-         createConversationStore, conversationKeyFor } from "./orchestrator.js";
+         createConversationStore, conversationKeyFor,
+         readStaticPrimitivesCard, getPagePrompt,
+         planPageResources, pageResourceLinesForTurn } from "./orchestrator.js";
 import { marked } from "./marked.esm.js";
 import { readConfig } from "./config.js";
 import conversationCss from "../../stylesheets/llm_meta_widget/conversation.css";
@@ -132,9 +134,12 @@ function boot(cfg) {
   var API_KEY_UUID           = cfg.API_KEY_UUID;
   var MODEL                  = cfg.MODEL;
   var ACTIONS_SCHEMA_ID      = cfg.ACTIONS_SCHEMA_ID;
+  var PAGE_CARD_ID           = cfg.PAGE_CARD_ID;
   var GREETING               = cfg.GREETING;
   var STATE_GLOBAL           = cfg.STATE_GLOBAL;
   var ACTIONS_GLOBAL         = cfg.ACTIONS_GLOBAL;
+  var PROMPTS_GLOBAL         = cfg.PROMPTS_GLOBAL;
+  var RESOURCES_GLOBAL       = cfg.RESOURCES_GLOBAL;
   var REMOTE_TOOLS_SCHEMA_ID = cfg.REMOTE_TOOLS_SCHEMA_ID;
   var MAX_ROUNDS             = cfg.MAX_ROUNDS;
   var WELL_KNOWN_URLS        = cfg.WELL_KNOWN_URLS;
@@ -295,8 +300,17 @@ function boot(cfg) {
   			model: MODEL
   		});
   	}
+  	// The page card is the same static-primitives envelope a server puts in
+  	// its Server Card, delivered in the document. Its `tools` REPLACE the
+  	// older #ai-actions schema tag rather than merging with it: two sources
+  	// for one list means a reader has to work out which the page meant, and a
+  	// handler in window.aiActions answers to a name either way.
+  	var pageCardEl = document.getElementById(PAGE_CARD_ID);
+  	var pageCard = readStaticPrimitivesCard(pageCardEl ? pageCardEl.textContent : null);
   	var actionsSchemaEl = document.getElementById(ACTIONS_SCHEMA_ID);
-  	var localTools = actionsSchemaEl ? JSON.parse(actionsSchemaEl.textContent) : [];
+  	var localTools = pageCard.tools.length
+  		? pageCard.tools
+  		: (actionsSchemaEl ? JSON.parse(actionsSchemaEl.textContent) : []);
   	var remoteToolsEl = document.getElementById(REMOTE_TOOLS_SCHEMA_ID);
   	// remoteTools is a mutable live list: starts from the schema-provided
   	// baseline (if any), then the level-1 picker adds/removes entries as
@@ -576,7 +590,12 @@ function boot(cfg) {
   	// Fetch well-known MCP manifests at boot. Auto-discovers same origin
   	// if WELL_KNOWN_URLS is null; empty array disables entirely.
   	var hostWideTools = [];
-  	var hostWidePrompts = [];
+  	// The page's own prompts sit in the same list as the hub's: to a visitor
+  	// they are the same affordance. `source` is what routes prompts/get —
+  	// a page prompt has no endpoint to ask.
+  	var hostWidePrompts = pageCard.prompts.map(function(p) {
+  		return Object.assign({}, p, { source: "page" });
+  	});
   	var resourceContext = null;   // payload of the host's reference resource
   	var resourcePlan = null;      // the pre-flight decision, kept so Clear can re-arm the gate
 
@@ -585,11 +604,30 @@ function boot(cfg) {
   	// is 218 dictionaries / ~35KB / ~10k tokens.
   	var RESOURCE_BUDGET_BYTES = 8000;
 
+  	// The page's own resources, planned once from the card. Unlike the hub's
+  	// single reference resource these are a list: a page declares one per
+  	// thing it knows, each with its own description.
+  	var pageResourcePlans = planPageResources({
+  		entries:     pageCard.resources,
+  		budgetBytes: RESOURCE_BUDGET_BYTES,
+  		onSkip: function(plan) {
+  			console.info("[llm_meta_widget] not attaching " + plan.uri +
+  			             " (" + plan.reason + ", size=" + plan.size + ")");
+  		}
+  	});
+  	var pageResourceCache = {};
+
 
   	// Before anything asynchronous: if this page was navigated away from and
   	// back, the visitor should see their conversation immediately.
   	restoreConversation();
 
+  	// Looked up BEFORE the discovery IIFE, not after it. That block calls
+  	// renderPromptButtons(), and with no well-known URLs to fetch it has no
+  	// await at all — so it ran while this was still undefined and the render
+  	// bailed at its own guard. A page that declares its own prompts is
+  	// exactly the case with nothing to await.
+  	var promptsEl = root.querySelector(".lmw-prompts");
   	var wellKnownReady = (async function() {
   		var urls = WELL_KNOWN_URLS === null
   			? [ window.location.origin + "/.well-known/mcp.json" ]
@@ -646,7 +684,6 @@ function boot(cfg) {
   	// the message (prompts/get), then drops the text into the textarea and
   	// submits — so it travels the exact path a typed message does.
 
-  	var promptsEl = root.querySelector(".lmw-prompts");
 
   	function renderPromptButtons() {
   		if (!promptsEl) return;
@@ -769,7 +806,9 @@ function boot(cfg) {
 
   		button.disabled = true;
   		try {
-  			var result = await getMcpPrompt({ endpoint: prompt.endpoint, name: prompt.name, args: args });
+  			var result = prompt.source === "page"
+  				? await getPagePrompt({ name: prompt.name, args: args, prompts: window[PROMPTS_GLOBAL] })
+  				: await getMcpPrompt({ endpoint: prompt.endpoint, name: prompt.name, args: args });
   			var text = promptMessagesToText(result);
   			if (!text) { appendTurn("error", "The server returned an empty prompt."); return; }
   			inputEl.value = text;
@@ -1054,7 +1093,18 @@ function boot(cfg) {
   			budgetBytes: RESOURCE_BUDGET_BYTES
   		});
   		resourceContext = turn.cached;
-  		return turn.lines;
+
+  		// The page's own resources ride in the same per-turn slot as the hub's.
+  		// Volatile ones are re-read here, which is the whole point: a form field
+  		// read at boot is already stale by the time anyone sends a message.
+  		var page = await pageResourceLinesForTurn({
+  			plans:       pageResourcePlans,
+  			resources:   window[RESOURCES_GLOBAL],
+  			budgetBytes: RESOURCE_BUDGET_BYTES,
+  			cache:       pageResourceCache
+  		});
+  		pageResourceCache = page.cache;
+  		return turn.lines.concat(page.lines);
   	}
 
   	// Per-turn AbortController — lets the Clear button (or a new submit)

data/app/assets/javascripts/llm_meta_widget/llm-meta-widget.js

@@ -483,6 +483,17 @@ async function readMcpResource({ endpoint, uri, signal }) {
     label: `readMcpResource(${uri})`
   });
 }
+async function getPagePrompt({ name, args, prompts }) {
+  const handler = prompts && prompts[name];
+  if (typeof handler !== "function") {
+    throw new Error('the page declares prompt "' + name + '" but no handler answers to that name');
+  }
+  const result = await handler(args || {});
+  if (typeof result === "string") {
+    return { messages: [{ role: "user", content: { type: "text", text: result } }] };
+  }
+  return result || { messages: [] };
+}
 function promptMessagesToText(result) {
   return (result?.messages || []).map((m) => {
     const c = m.content;
@@ -549,8 +560,40 @@ function parseSseFrame(raw) {
   return { name, data };
 }
 var STATIC_PRIMITIVES_META = "io.modelcontextprotocol/static-primitives";
+function readStaticPrimitivesCard(text, warn = console.warn) {
+  const empty = { tools: [], prompts: [], resources: [] };
+  if (typeof text !== "string" || text.trim() === "") return empty;
+  let doc;
+  try {
+    doc = JSON.parse(text);
+  } catch (e) {
+    warn("[llm-meta-widget] page card is not valid JSON; ignoring it:", e.message);
+    return empty;
+  }
+  const ext = doc && doc._meta && doc._meta[STATIC_PRIMITIVES_META] || null;
+  if (!ext) {
+    warn(`[llm-meta-widget] page card has no _meta["${STATIC_PRIMITIVES_META}"]; ignoring it`);
+    return empty;
+  }
+  const named = (arr, kind) => (Array.isArray(arr) ? arr : []).filter((e) => {
+    const ok = e && typeof e.name === "string" && e.name.trim() !== "";
+    if (!ok) warn(`[llm-meta-widget] page card: dropping a ${kind} with no name`);
+    return ok;
+  });
+  return {
+    tools: named(ext.tools, "tool"),
+    prompts: named(ext.prompts, "prompt"),
+    // Resources are addressed by uri, not name — resources/read takes the uri.
+    resources: (Array.isArray(ext.resources) ? ext.resources : []).filter((e) => {
+      const ok = e && typeof e.uri === "string" && e.uri.trim() !== "";
+      if (!ok) warn("[llm-meta-widget] page card: dropping a resource with no uri");
+      return ok;
+    })
+  };
+}
 var VOLATILITIES = ["stable", "volatile"];
 var usableSize = (n) => typeof n === "number" && isFinite(n) ? n : null;
+var pickDeclared = (own, fromMeta) => own === void 0 ? fromMeta : own;
 function resourceHints(entry) {
   const meta = entry && entry._meta && entry._meta[STATIC_PRIMITIVES_META] || {};
   return {
@@ -566,8 +609,13 @@ function resourceHints(entry) {
     get sizeBytes() {
       return this.size;
     },
-    volatility: VOLATILITIES.indexOf(meta.volatility) === -1 ? "stable" : meta.volatility,
-    autoAttach: typeof meta.autoAttach === "boolean" ? meta.autoAttach : true
+    // Same rule as `size`: the entry's own field wins, `_meta` is the fallback.
+    // SEP-0000 defines these ON the Resource object; a server puts them in
+    // `_meta` only because the extension is not merged yet. A PAGE card's
+    // entries already sit inside the extension block, so for them the fields
+    // are simply top-level — reading both is what lets one planner serve both.
+    volatility: VOLATILITIES.indexOf(pickDeclared(entry && entry.volatility, meta.volatility)) === -1 ? "stable" : pickDeclared(entry && entry.volatility, meta.volatility),
+    autoAttach: typeof pickDeclared(entry && entry.autoAttach, meta.autoAttach) === "boolean" ? pickDeclared(entry && entry.autoAttach, meta.autoAttach) : true
   };
 }
 function planResourceAttachment(entry, budgetBytes) {
@@ -611,6 +659,45 @@ async function readResourceContext({ endpoint, uri, name, read, budgetBytes }) {
     return null;
   }
 }
+function planPageResources({ entries, budgetBytes, onSkip }) {
+  return (entries || []).map((entry) => {
+    const plan = planResourceAttachment(entry, budgetBytes);
+    plan.name = entry.name || entry.uri;
+    plan.description = entry.description || "";
+    if (!plan.fetch && onSkip) onSkip(plan);
+    return plan;
+  }).filter((plan) => plan.fetch);
+}
+function pageResourceLine(plan, text) {
+  return "- " + plan.name + (plan.description ? " (" + plan.description + ")" : "") + ": " + text;
+}
+async function pageResourceLinesForTurn({ plans, resources, budgetBytes, cache = {} }) {
+  const lines = [];
+  for (const plan of plans || []) {
+    let text = plan.volatility === "volatile" ? null : cache[plan.uri];
+    if (text === null || text === void 0) {
+      text = await readPageResource({ uri: plan.uri, resources, budgetBytes });
+      if (plan.volatility !== "volatile" && text !== null) cache[plan.uri] = text;
+    }
+    if (text !== null) lines.push(pageResourceLine(plan, text));
+  }
+  return { lines, cache };
+}
+async function readPageResource({ uri, resources, budgetBytes }) {
+  const handler = resources && resources[uri];
+  if (typeof handler !== "function") {
+    console.warn('[llm-meta-widget] the page declares resource "' + uri + '" but no handler answers to that uri');
+    return null;
+  }
+  try {
+    const value = await handler();
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    return trimResourceText(text === void 0 ? "" : text, budgetBytes);
+  } catch (e) {
+    console.warn('[llm-meta-widget] reading "' + uri + '" failed:', e && e.message);
+    return null;
+  }
+}
 async function loadHostResource({ endpoint, budgetBytes, list: list2, read, onSkip }) {
   const resources = await list2({ endpoint });
   const candidate = (resources || []).filter((r) => (r.mimeType || "") === "application/json")[0];
@@ -2904,8 +2991,11 @@ var lexer = _Lexer.lex;
 var DEFAULTS = Object.freeze({
   API_KEY_UUID: "ollama-local",
   ACTIONS_SCHEMA_ID: "ai-actions",
+  PAGE_CARD_ID: "ai-page",
   STATE_GLOBAL: "aiState",
   ACTIONS_GLOBAL: "aiActions",
+  PROMPTS_GLOBAL: "aiPrompts",
+  RESOURCES_GLOBAL: "aiResources",
   REMOTE_TOOLS_SCHEMA_ID: "remote-mcp-tools",
   LLM_PROVIDER: "llm_meta_server",
   MAX_ROUNDS: 3
@@ -2939,9 +3029,12 @@ function readConfig(el) {
     API_KEY_UUID: str("api-key-uuid", DEFAULTS.API_KEY_UUID),
     MODEL: str("model", null),
     ACTIONS_SCHEMA_ID: str("actions-schema-id", DEFAULTS.ACTIONS_SCHEMA_ID),
+    PAGE_CARD_ID: str("page-card-id", DEFAULTS.PAGE_CARD_ID),
     GREETING: str("greeting", null),
     STATE_GLOBAL: str("state-global", DEFAULTS.STATE_GLOBAL),
     ACTIONS_GLOBAL: str("actions-global", DEFAULTS.ACTIONS_GLOBAL),
+    PROMPTS_GLOBAL: str("prompts-global", DEFAULTS.PROMPTS_GLOBAL),
+    RESOURCES_GLOBAL: str("resources-global", DEFAULTS.RESOURCES_GLOBAL),
     REMOTE_TOOLS_SCHEMA_ID: str("remote-tools-schema-id", DEFAULTS.REMOTE_TOOLS_SCHEMA_ID),
     MAX_ROUNDS: int("max-rounds", DEFAULTS.MAX_ROUNDS),
     WELL_KNOWN_URLS: wellKnown === null ? null : wellKnown.trim() === "" ? [] : splitList(wellKnown),
@@ -3658,9 +3751,12 @@ function boot(cfg) {
   var API_KEY_UUID = cfg.API_KEY_UUID;
   var MODEL = cfg.MODEL;
   var ACTIONS_SCHEMA_ID = cfg.ACTIONS_SCHEMA_ID;
+  var PAGE_CARD_ID = cfg.PAGE_CARD_ID;
   var GREETING = cfg.GREETING;
   var STATE_GLOBAL = cfg.STATE_GLOBAL;
   var ACTIONS_GLOBAL = cfg.ACTIONS_GLOBAL;
+  var PROMPTS_GLOBAL = cfg.PROMPTS_GLOBAL;
+  var RESOURCES_GLOBAL = cfg.RESOURCES_GLOBAL;
   var REMOTE_TOOLS_SCHEMA_ID = cfg.REMOTE_TOOLS_SCHEMA_ID;
   var MAX_ROUNDS = cfg.MAX_ROUNDS;
   var WELL_KNOWN_URLS = cfg.WELL_KNOWN_URLS;
@@ -3791,8 +3887,10 @@ function boot(cfg) {
       model: MODEL
     });
   }
+  var pageCardEl = document.getElementById(PAGE_CARD_ID);
+  var pageCard = readStaticPrimitivesCard(pageCardEl ? pageCardEl.textContent : null);
   var actionsSchemaEl = document.getElementById(ACTIONS_SCHEMA_ID);
-  var localTools = actionsSchemaEl ? JSON.parse(actionsSchemaEl.textContent) : [];
+  var localTools = pageCard.tools.length ? pageCard.tools : actionsSchemaEl ? JSON.parse(actionsSchemaEl.textContent) : [];
   var remoteToolsEl = document.getElementById(REMOTE_TOOLS_SCHEMA_ID);
   var baselineRemoteTools = remoteToolsEl ? JSON.parse(remoteToolsEl.textContent) : [];
   var remoteTools = baselineRemoteTools.slice();
@@ -4015,11 +4113,22 @@ function boot(cfg) {
     }
   }
   var hostWideTools = [];
-  var hostWidePrompts = [];
+  var hostWidePrompts = pageCard.prompts.map(function(p) {
+    return Object.assign({}, p, { source: "page" });
+  });
   var resourceContext = null;
   var resourcePlan = null;
   var RESOURCE_BUDGET_BYTES = 8e3;
+  var pageResourcePlans = planPageResources({
+    entries: pageCard.resources,
+    budgetBytes: RESOURCE_BUDGET_BYTES,
+    onSkip: function(plan) {
+      console.info("[llm_meta_widget] not attaching " + plan.uri + " (" + plan.reason + ", size=" + plan.size + ")");
+    }
+  });
+  var pageResourceCache = {};
   restoreConversation();
+  var promptsEl = root.querySelector(".lmw-prompts");
   var wellKnownReady = (async function() {
     var urls = WELL_KNOWN_URLS === null ? [window.location.origin + "/.well-known/mcp.json"] : WELL_KNOWN_URLS;
     for (var i = 0; i < urls.length; i++) {
@@ -4053,7 +4162,6 @@ function boot(cfg) {
     renderPromptButtons();
     renderWelcome();
   })();
-  var promptsEl = root.querySelector(".lmw-prompts");
   function renderPromptButtons() {
     if (!promptsEl) return;
     promptsEl.textContent = "";
@@ -4150,7 +4258,7 @@ function boot(cfg) {
     }
     button.disabled = true;
     try {
-      var result = await getMcpPrompt({ endpoint: prompt.endpoint, name: prompt.name, args });
+      var result = prompt.source === "page" ? await getPagePrompt({ name: prompt.name, args, prompts: window[PROMPTS_GLOBAL] }) : await getMcpPrompt({ endpoint: prompt.endpoint, name: prompt.name, args });
       var text = promptMessagesToText(result);
       if (!text) {
         appendTurn("error", "The server returned an empty prompt.");
@@ -4364,7 +4472,14 @@ function boot(cfg) {
       budgetBytes: RESOURCE_BUDGET_BYTES
     });
     resourceContext = turn.cached;
-    return turn.lines;
+    var page = await pageResourceLinesForTurn({
+      plans: pageResourcePlans,
+      resources: window[RESOURCES_GLOBAL],
+      budgetBytes: RESOURCE_BUDGET_BYTES,
+      cache: pageResourceCache
+    });
+    pageResourceCache = page.cache;
+    return turn.lines.concat(page.lines);
   }
   var currentAbort = null;
   clearBtn.addEventListener("click", function() {

data/app/assets/javascripts/llm_meta_widget/orchestrator.js

@@ -730,6 +730,28 @@ export async function readMcpResource({ endpoint, uri, signal }) {
 // The spec allows `content` to be an object or an array of content blocks;
 // anything non-text is dropped, which is worth knowing — a prompt carrying an
 // image would silently lose it on this path.
+// A prompt the PAGE declared, resolved against its handler map. This is
+// prompts/get for a surface with no transport: the card carries the metadata
+// (name, description, arguments — what prompts/list returns) and the handler
+// returns the filled messages, exactly as a server's prompts/get would.
+//
+// Keyed by `name` because that is what prompts/get takes. Accepts a plain
+// string as well as a messages array: a page prompt is usually one block of
+// text, and making every host write the envelope by hand would be a tax with
+// no benefit — promptMessagesToText flattens both to the same thing.
+export async function getPagePrompt({ name, args, prompts }) {
+  const handler = prompts && prompts[name]
+  if (typeof handler !== "function") {
+    throw new Error('the page declares prompt "' + name + '" but no handler answers to that name')
+  }
+
+  const result = await handler(args || {})
+  if (typeof result === "string") {
+    return { messages: [ { role: "user", content: { type: "text", text: result } } ] }
+  }
+  return result || { messages: [] }
+}
+
 export function promptMessagesToText(result) {
   return (result?.messages || [])
     .map((m) => {
@@ -840,9 +862,63 @@ function parseSseFrame(raw) {
 // the first turn only.
 export const STATIC_PRIMITIVES_META = "io.modelcontextprotocol/static-primitives"
 
+// ---- page card --------------------------------------------------------
+//
+// The same `io.modelcontextprotocol/static-primitives` envelope a server puts
+// in its Server Card, delivered in the DOCUMENT instead: one <script> of JSON
+// declaring the page's own tools, prompts and resources. SEP-2575 already says
+// the Server Card and server/discover are two deliveries of one content; a page
+// is a third, with no transport at all.
+//
+// Parsing only. What a declaration MEANS is resolved elsewhere: tool handlers
+// live in window.aiActions keyed by `name`, and reads will be keyed by the
+// protocol's own identifier — `name` for prompts, `uri` for resources, because
+// that is what prompts/get and resources/read take.
+//
+// Malformed input must never take the page down: a card is host-authored and a
+// typo in it should cost that one entry, not the assistant. Everything
+// unparseable returns empty arrays and says so on the console, which is how
+// aiState already treats a reader missing its description.
+export function readStaticPrimitivesCard(text, warn = console.warn) {
+  const empty = { tools: [], prompts: [], resources: [] }
+  if (typeof text !== "string" || text.trim() === "") return empty
+
+  let doc
+  try {
+    doc = JSON.parse(text)
+  } catch (e) {
+    warn("[llm-meta-widget] page card is not valid JSON; ignoring it:", e.message)
+    return empty
+  }
+
+  const ext = (doc && doc._meta && doc._meta[STATIC_PRIMITIVES_META]) || null
+  if (!ext) {
+    warn(`[llm-meta-widget] page card has no _meta["${STATIC_PRIMITIVES_META}"]; ignoring it`)
+    return empty
+  }
+
+  const named = (arr, kind) => (Array.isArray(arr) ? arr : []).filter((e) => {
+    const ok = e && typeof e.name === "string" && e.name.trim() !== ""
+    if (!ok) warn(`[llm-meta-widget] page card: dropping a ${kind} with no name`)
+    return ok
+  })
+
+  return {
+    tools: named(ext.tools, "tool"),
+    prompts: named(ext.prompts, "prompt"),
+    // Resources are addressed by uri, not name — resources/read takes the uri.
+    resources: (Array.isArray(ext.resources) ? ext.resources : []).filter((e) => {
+      const ok = e && typeof e.uri === "string" && e.uri.trim() !== ""
+      if (!ok) warn("[llm-meta-widget] page card: dropping a resource with no uri")
+      return ok
+    })
+  }
+}
+
 const VOLATILITIES = [ "stable", "volatile" ]
 
 const usableSize = (n) => (typeof n === "number" && isFinite(n) ? n : null)
+const pickDeclared = (own, fromMeta) => (own === undefined ? fromMeta : own)
 
 export function resourceHints(entry) {
   const meta = (entry && entry._meta && entry._meta[STATIC_PRIMITIVES_META]) || {}
@@ -857,8 +933,17 @@ export function resourceHints(entry) {
     // it returns is public API. Dropped at 0.9.0 together with the
     // `_meta.sizeBytes` fallback above — one deprecation, one bump.
     get sizeBytes() { return this.size },
-    volatility: VOLATILITIES.indexOf(meta.volatility) === -1 ? "stable" : meta.volatility,
-    autoAttach: typeof meta.autoAttach === "boolean" ? meta.autoAttach : true
+    // Same rule as `size`: the entry's own field wins, `_meta` is the fallback.
+    // SEP-0000 defines these ON the Resource object; a server puts them in
+    // `_meta` only because the extension is not merged yet. A PAGE card's
+    // entries already sit inside the extension block, so for them the fields
+    // are simply top-level — reading both is what lets one planner serve both.
+    volatility: VOLATILITIES.indexOf(pickDeclared(entry && entry.volatility, meta.volatility)) === -1
+      ? "stable"
+      : pickDeclared(entry && entry.volatility, meta.volatility),
+    autoAttach: typeof pickDeclared(entry && entry.autoAttach, meta.autoAttach) === "boolean"
+      ? pickDeclared(entry && entry.autoAttach, meta.autoAttach)
+      : true
   }
 }
 
@@ -920,6 +1005,65 @@ async function readResourceContext({ endpoint, uri, name, read, budgetBytes }) {
   }
 }
 
+// ---- page resources ----------------------------------------------------
+//
+// resources/read for a surface with no transport. The card lists them, a
+// handler map keyed by URI reads them — URI because that is what
+// resources/read takes, and because the spec defines it as the unique
+// identifier while `name` is only required, never unique.
+//
+// Unlike a server endpoint, a page declares SEVERAL: PubDictionaries has six
+// readers, each with its own description. So these are planned and rendered as
+// a list, not as the single reference resource loadHostResource assumes.
+export function planPageResources({ entries, budgetBytes, onSkip }) {
+  return (entries || []).map((entry) => {
+    const plan = planResourceAttachment(entry, budgetBytes)
+    plan.name = entry.name || entry.uri
+    plan.description = entry.description || ""
+    if (!plan.fetch && onSkip) onSkip(plan)
+    return plan
+  }).filter((plan) => plan.fetch)
+}
+
+// One compact line per resource — the same shape the page-state annex uses,
+// NOT the block form a hub resource gets. Six block-form resources would cost
+// three lines each and repeat a header the model does not need; how to render
+// attached context is the client's decision, which the spec leaves open.
+export function pageResourceLine(plan, text) {
+  return "- " + plan.name + (plan.description ? " (" + plan.description + ")" : "") + ": " + text
+}
+
+export async function pageResourceLinesForTurn({ plans, resources, budgetBytes, cache = {} }) {
+  const lines = []
+  for (const plan of plans || []) {
+    let text = plan.volatility === "volatile" ? null : cache[plan.uri]
+    if (text === null || text === undefined) {
+      text = await readPageResource({ uri: plan.uri, resources, budgetBytes })
+      if (plan.volatility !== "volatile" && text !== null) cache[plan.uri] = text
+    }
+    if (text !== null) lines.push(pageResourceLine(plan, text))
+  }
+  return { lines, cache }
+}
+
+async function readPageResource({ uri, resources, budgetBytes }) {
+  const handler = resources && resources[uri]
+  if (typeof handler !== "function") {
+    console.warn('[llm-meta-widget] the page declares resource "' + uri + '" but no handler answers to that uri')
+    return null
+  }
+  try {
+    const value = await handler()
+    const text = typeof value === "string" ? value : JSON.stringify(value)
+    return trimResourceText(text === undefined ? "" : text, budgetBytes)
+  } catch (e) {
+    // Optional context — one broken reader must not cost the turn, exactly as
+    // a failed hub read does not.
+    console.warn('[llm-meta-widget] reading "' + uri + '" failed:', e && e.message)
+    return null
+  }
+}
+
 // The discovery sequence for one endpoint's reference resource, kept here
 // rather than in the panel so the decision AND the call site are testable
 // together: a gate nothing consults is exactly the bug this shape prevents.

data/app/helpers/llm_meta_widget/widget_helper.rb

@@ -39,8 +39,18 @@ module LlmMetaWidget
       # instead of this gem (same file, published to npm).
       element_path:            "/llm_meta_widget_assets/llm-meta-widget.js",
       actions_schema_id:       "ai-actions",
+      # The page card: the same static-primitives envelope a server puts in
+      # its Server Card, delivered in the document. Its `tools` replace the
+      # actions_schema_id block when the card declares any.
+      page_card_id:            "ai-page",
       state_global:            "aiState",
       actions_global:          "aiActions",
+      # Page-declared prompts resolve their messages here, keyed by name —
+      # prompts/get for a surface with no transport.
+      prompts_global:          "aiPrompts",
+      # Page-declared resources are read here, keyed by URI — resources/read
+      # for the same surface. URI, because that is what resources/read takes.
+      resources_global:        "aiResources",
       remote_tools_schema_id:  "remote-mcp-tools",
       # nil → widget auto-discovers same-origin /.well-known/mcp.json at boot;
       # explicit array → fetch those URLs; empty array → disable entirely.

data/app/views/llm_meta_widget/_chat_panel.html.erb

@@ -28,8 +28,11 @@
   <%= tag_attr("greeting", greeting) %>
   <%= tag_attr("max-rounds", max_rounds) %>
   <%= tag_attr("actions-schema-id", actions_schema_id) %>
+  <%= tag_attr("page-card-id", page_card_id) %>
   <%= tag_attr("state-global", state_global) %>
   <%= tag_attr("actions-global", actions_global) %>
+  <%= tag_attr("prompts-global", prompts_global) %>
+  <%= tag_attr("resources-global", resources_global) %>
   <%= tag_attr("remote-tools-schema-id", remote_tools_schema_id) %>
   <%# Pickers default to true in the element, so only emit the disabling value. %>
   <%= enable_model_picker ? "" : 'enable-model-picker="false"'.html_safe %>

data/lib/llm_meta_widget/version.rb

@@ -1,3 +1,3 @@
 module LlmMetaWidget
-  VERSION = "0.8.6"
+  VERSION = "0.9.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: llm_meta_widget
 version: !ruby/object:Gem::Version
-  version: 0.8.6
+  version: 0.9.0
 platform: ruby
 authors:
 - jdkim