@astral-mcp/projection 0.2.0 → 0.4.0

package/dist/index.d.mts

@@ -326,7 +326,7 @@ declare function openBlob(blob: string, options: OpenBlobOptions): BlobPayload;
  * CI instead of silently minting blobs with a stale version stamp.
  */
 /** `@astral-mcp/projection` package version (must match packages/projection/package.json). */
-declare const LIB_VERSION = "0.2.0";
+declare const LIB_VERSION = "0.4.0";
 /** Pinned XState version (must match the exact pin in package.json — D2). */
 declare const XSTATE_VERSION = "5.32.5";
 //#endregion
@@ -410,6 +410,19 @@ interface ExecuteMachineDeps {
    * `McpRequestContext.era`; `undefined` is treated as legacy.
    */
   protocolEra?: ProtocolEra;
+  /**
+   * Opt-in legacy-client compatibility (R28 amendment): when true, a
+   * suspension on a pre-2026-07-28 connection is returned as a normal
+   * `input_required` result and the SDK's serving layer fulfils it through
+   * old-style server→client `elicitation/create` requests, re-invoking this
+   * adapter with a byte-exact `requestState` echo and the collected
+   * `inputResponses` — the same retry envelope as a real MRTR retry, so
+   * every sealing/verification invariant runs unchanged. Cost: the
+   * `tools/call` stays open on this instance while the human answers, so
+   * statelessness (R27) is suspended for that call (free over stdio; needs
+   * session affinity over legacy HTTP). Default false: fail fast per R28.
+   */
+  legacyElicitation?: boolean;
 }
 /**
  * Run `execute_machine` for one `tools/call`, whether it is a first attempt
@@ -435,6 +448,8 @@ interface ProjectionResource {
   description: string;
   mimeType: string;
   text: string;
+  /** Resource-level metadata (e.g. the MCP Apps `ui` object). */
+  _meta?: Record<string, unknown>;
 }
 declare const EXAMPLE_HAPPY_PATH = "import { setup, assign } from 'xstate';\nimport { toolCall } from '@astral-mcp/tools';\n\n// Read a file and return its contents. Read-only calls run immediately,\n// so this whole machine completes in one round trip.\nexport default setup({}).createMachine({\n  id: 'readNotes',\n  context: ({ input }) => ({ path: input?.path ?? '/notes.txt', text: null }),\n  initial: 'reading',\n  states: {\n    reading: {\n      entry: toolCall('read_file', ({ context }) => ({ path: context.path })),\n      on: {\n        TOOL_RESULT: {\n          target: 'done',\n          actions: assign({ text: ({ event }) => event.result }),\n        },\n        TOOL_ERROR: {\n          target: 'failed',\n          actions: assign({ text: ({ event }) => `error: ${event.error.message}` }),\n        },\n      },\n    },\n    done: { type: 'final' },\n    failed: { type: 'final' },\n  },\n  output: ({ context }) => ({ text: context.text }),\n});\n";
 declare const EXAMPLE_DENIAL_FALLBACK = "import { setup, assign } from 'xstate';\nimport { toolCall } from '@astral-mcp/tools';\n\n// Write a file, but keep going if the user declines. TOOL_DENIED is an\n// ordinary transition — denial is never an automatic abort.\nexport default setup({}).createMachine({\n  id: 'writeWithFallback',\n  context: { status: 'pending', note: null },\n  initial: 'writing',\n  states: {\n    writing: {\n      entry: toolCall('write_file', () => ({ path: '/notes.txt', content: 'hello' })),\n      on: {\n        TOOL_RESULT: {\n          target: 'summarizing',\n          actions: assign({ status: 'written' }),\n        },\n        TOOL_DENIED: {\n          // The user said no: record it and carry on with the read-only\n          // part of the work instead of failing the whole workflow.\n          target: 'summarizing',\n          actions: assign({\n            status: 'skipped',\n            note: ({ event }) => event.reason ?? 'declined by user',\n          }),\n        },\n        TOOL_ERROR: {\n          target: 'summarizing',\n          actions: assign({ status: 'failed' }),\n        },\n      },\n    },\n    summarizing: {\n      entry: toolCall('list_dir', () => ({ path: '/' })),\n      on: {\n        TOOL_RESULT: { target: 'done' },\n        TOOL_ERROR: { target: 'done' },\n      },\n    },\n    done: { type: 'final' },\n  },\n  output: ({ context }) => ({ status: context.status, note: context.note }),\n});\n";
@@ -464,6 +479,17 @@ interface WrapOptions {
   redact?: RedactionHook;
   /** Replaces the library's code-mode preamble (R29). */
   codeModePreamble?: string;
+  /** Compatibility switches for pre-2026-07-28 clients. */
+  compat?: {
+    /**
+     * Serve approval suspensions to legacy clients through the SDK's
+     * server→client `elicitation/create` shim instead of failing fast
+     * (R28 amendment; DECISIONS D6). The client must declare the
+     * `elicitation` capability. Statelessness is suspended for the open
+     * call — free over stdio, needs session affinity over legacy HTTP.
+     */
+    legacyElicitation?: boolean;
+  };
   /** Identity the servers built by `createServer` advertise. */
   serverInfo?: Implementation;
 }
@@ -508,6 +534,40 @@ interface ProjectionFacade {
  */
 declare function wrapMcpServer(source: McpServer | Client, options: WrapOptions): Promise<ProjectionFacade>;
 //#endregion
+//#region src/apps/dashboard.d.ts
+/**
+ * MCP Apps workflow dashboard (PRD §12.1, second fenced use case).
+ *
+ * A static, library-authored HTML app that renders an `execute_machine`
+ * result — output, approval audit trail, console logs, or the structured
+ * error — inside the host's sandboxed iframe, per the MCP Apps extension
+ * (SEP-1865, spec 2026-01-26).
+ *
+ * Security posture (the §12.1 design constraint, satisfied by construction):
+ * - The HTML is a compile-time constant. No model-authored code, no
+ *   template interpolation, no VM: UI rendering can never reach the tools
+ *   bridge because nothing dynamic executes server-side at all.
+ * - Model-controlled data (outputs, audit args, log lines, error text)
+ *   enters the DOM exclusively through `textContent` — the app never uses
+ *   innerHTML — so hostile strings render inert (S6 extended to the app).
+ * - The app requests no host capabilities: `appCapabilities: {}`. It cannot
+ *   call tools, open links, or write context; it only listens.
+ *
+ * Wire contract implemented (app side):
+ * - `ui/initialize` request → await result → `ui/notifications/initialized`.
+ * - Listens for `ui/notifications/tool-input`, `ui/notifications/tool-result`
+ *   and `ui/notifications/tool-cancelled`; ignores everything else.
+ * - The result payload is the standard `CallToolResult` from
+ *   `execute_machine`: `structuredContent` is either
+ *   `{ output, approvals, logs }` or (with `isError`) the structured error
+ *   `{ phase, message, hint, logs }`.
+ */
+/** URI the dashboard is served under. MCP Apps mandates the ui:// scheme. */
+declare const DASHBOARD_RESOURCE_URI = "ui://projection/dashboard.html";
+/** MIME type the MCP Apps spec mandates for app HTML resources. */
+declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
+declare const DASHBOARD_HTML = "<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\" />\n<title>Projection workflow dashboard</title>\n<style>\n  :root {\n    color-scheme: light dark;\n    --bg: #ffffff; --fg: #1a1a2e; --muted: #6b7280; --line: #e5e7eb;\n    --ok: #047857; --ok-bg: #ecfdf5; --err: #b91c1c; --err-bg: #fef2f2;\n    --chip: #eef2ff; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;\n  }\n  @media (prefers-color-scheme: dark) {\n    :root {\n      --bg: #111318; --fg: #e5e7eb; --muted: #9ca3af; --line: #2a2f3a;\n      --ok: #34d399; --ok-bg: #06281f; --err: #f87171; --err-bg: #2d1215;\n      --chip: #1e2433;\n    }\n  }\n  html, body { margin: 0; padding: 0; background: var(--bg); color: var(--fg);\n    font: 14px/1.5 system-ui, sans-serif; }\n  main { padding: 16px; max-width: 720px; }\n  h1 { font-size: 15px; margin: 0 0 12px; display: flex; gap: 8px; align-items: center; }\n  .chip { font-size: 12px; padding: 2px 10px; border-radius: 999px; background: var(--chip); }\n  .chip.ok { color: var(--ok); background: var(--ok-bg); }\n  .chip.err { color: var(--err); background: var(--err-bg); }\n  section { margin: 14px 0; }\n  section > h2 { font-size: 12px; text-transform: uppercase; letter-spacing: .06em;\n    color: var(--muted); margin: 0 0 6px; }\n  pre { margin: 0; padding: 10px; background: var(--chip); border-radius: 8px;\n    font-family: var(--mono); font-size: 12px; overflow-x: auto; white-space: pre-wrap; }\n  table { border-collapse: collapse; width: 100%; font-size: 13px; }\n  th, td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--line);\n    vertical-align: top; }\n  th { color: var(--muted); font-weight: 500; }\n  td.args { font-family: var(--mono); font-size: 12px; }\n  .log { font-family: var(--mono); font-size: 12px; padding: 2px 0; }\n  .log .level { color: var(--muted); margin-right: 6px; }\n  .hint { color: var(--muted); font-size: 13px; margin-top: 6px; }\n  .hidden { display: none; }\n  #waiting { color: var(--muted); }\n</style>\n</head>\n<body>\n<main>\n  <h1>Projection workflow <span id=\"status\" class=\"chip\">waiting…</span></h1>\n  <p id=\"waiting\">Waiting for the workflow result from the host…</p>\n  <section id=\"output-section\" class=\"hidden\"><h2>Output</h2><pre id=\"output\"></pre></section>\n  <section id=\"error-section\" class=\"hidden\"><h2>Error</h2>\n    <pre id=\"error\"></pre><p id=\"error-hint\" class=\"hint\"></p></section>\n  <section id=\"approvals-section\" class=\"hidden\"><h2>Approval audit trail</h2>\n    <table><thead><tr><th>Tool</th><th>Decision</th><th>Arguments</th></tr></thead>\n    <tbody id=\"approvals\"></tbody></table></section>\n  <section id=\"logs-section\" class=\"hidden\"><h2>Console</h2><div id=\"logs\"></div></section>\n</main>\n<script>\n'use strict';\n(function () {\n  var nextId = 1;\n  var pending = new Map();\n\n  function post(message) { window.parent.postMessage(message, '*'); }\n  function request(method, params) {\n    return new Promise(function (resolve, reject) {\n      var id = nextId++;\n      pending.set(id, { resolve: resolve, reject: reject });\n      post({ jsonrpc: '2.0', id: id, method: method, params: params });\n    });\n  }\n  function notify(method, params) {\n    var message = { jsonrpc: '2.0', method: method };\n    if (params !== undefined) message.params = params;\n    post(message);\n  }\n\n  function byId(id) { return document.getElementById(id); }\n  function show(id) { byId(id).classList.remove('hidden'); }\n  function setStatus(text, cls) {\n    var chip = byId('status');\n    chip.textContent = text;\n    chip.className = 'chip' + (cls ? ' ' + cls : '');\n    byId('waiting').classList.add('hidden');\n  }\n  function pretty(value) {\n    try { return JSON.stringify(value, null, 2); } catch (e) { return String(value); }\n  }\n\n  // All model-controlled data enters the DOM via textContent only.\n  function renderResult(result) {\n    var structured = (result && result.structuredContent) || {};\n    if (result && result.isError) {\n      setStatus('failed: ' + String(structured.phase || 'error'), 'err');\n      byId('error').textContent =\n        String(structured.message || 'unknown error');\n      byId('error-hint').textContent = String(structured.hint || '');\n      show('error-section');\n    } else {\n      setStatus('completed', 'ok');\n      byId('output').textContent = pretty(\n        structured.output === undefined ? null : structured.output,\n      );\n      show('output-section');\n    }\n    var approvals = Array.isArray(structured.approvals) ? structured.approvals : [];\n    if (approvals.length > 0) {\n      var tbody = byId('approvals');\n      approvals.forEach(function (entry) {\n        var row = document.createElement('tr');\n        var tool = document.createElement('td');\n        tool.textContent = String(entry.tool || '');\n        var decision = document.createElement('td');\n        decision.textContent = String(entry.decision || '');\n        var args = document.createElement('td');\n        args.className = 'args';\n        args.textContent = pretty(entry.args || {});\n        row.appendChild(tool); row.appendChild(decision); row.appendChild(args);\n        tbody.appendChild(row);\n      });\n      show('approvals-section');\n    }\n    var logs = Array.isArray(structured.logs) ? structured.logs : [];\n    if (logs.length > 0) {\n      var list = byId('logs');\n      logs.forEach(function (entry) {\n        var line = document.createElement('div');\n        line.className = 'log';\n        var level = document.createElement('span');\n        level.className = 'level';\n        level.textContent = '[' + String(entry.level || 'log') + ']';\n        line.appendChild(level);\n        line.appendChild(document.createTextNode(String(entry.message || '')));\n        list.appendChild(line);\n      });\n      show('logs-section');\n    }\n  }\n\n  window.addEventListener('message', function (event) {\n    // Only the embedding host may speak: forged tool-results from a hostile\n    // embedder could otherwise spoof the displayed audit trail.\n    if (event.source !== window.parent) return;\n    var message = event.data;\n    if (!message || message.jsonrpc !== '2.0') return;\n    if (message.id !== undefined && message.method === undefined) {\n      var waiter = pending.get(message.id);\n      if (waiter) {\n        pending.delete(message.id);\n        if (message.error) waiter.reject(message.error);\n        else waiter.resolve(message.result);\n      }\n      return;\n    }\n    if (message.method === 'ui/notifications/tool-input') {\n      setStatus('running…');\n      return;\n    }\n    if (message.method === 'ui/notifications/tool-result') {\n      renderResult(message.params);\n      return;\n    }\n    if (message.method === 'ui/notifications/tool-cancelled') {\n      var reason = message.params && message.params.reason;\n      setStatus('cancelled', 'err');\n      byId('error').textContent = String(reason || 'cancelled by the host');\n      show('error-section');\n      return;\n    }\n    // Host -> app REQUESTS (id + method) get an empty result: answers ping\n    // and ui/resource-teardown so hosts don't stall on their SHOULD-wait.\n    if (message.id !== undefined && message.method !== undefined) {\n      post({ jsonrpc: '2.0', id: message.id, result: {} });\n    }\n  });\n\n  // Handshake: initialize, then signal readiness. The host MUST NOT push\n  // tool data before ui/notifications/initialized.\n  request('ui/initialize', { appCapabilities: {} }).then(function () {\n    notify('ui/notifications/initialized');\n  });\n})();\n</script>\n</body>\n</html>\n";
+//#endregion
 //#region src/errors.d.ts
 /**
  * Error carrying the structured `isError` body every failure returns (R25).
@@ -858,5 +918,5 @@ declare function runSegment(options: RunSegmentOptions): Promise<SegmentOutcome>
  */
 declare const AUTHORING_CONTRACT = "Projection authoring contract (execute_machine)\n\nWrite ONE module whose only top-level statements are imports and a single\ndefault-exported XState v5 machine. The module is re-evaluated on every\napproval round trip, so top-level side effects are rejected.\n\n  import { setup } from 'xstate';\n  import { toolCall } from '@astral-mcp/tools';\n\n  export default setup({}).createMachine({ /* ... */ });\n\nRules:\n1. Default-export a machine built with XState v5 setup(...).createMachine(...).\n   XState v4 Machine(...) is rejected.\n2. Machine context must be JSON-serializable at all times. No Map, Set, Date,\n   class instances, functions, undefined, bigint or symbols in context.\n3. Request tools with the toolCall action. NEVER wrap a tool call in\n   fromPromise/invoke — restored snapshots restart invoked actors, which\n   would re-execute an approved write. Machines using invoke are rejected.\n4. After a toolCall, wait in a state for one of these events:\n     TOOL_RESULT { callId, result }   the call succeeded\n     TOOL_ERROR  { callId, error }    the call failed\n     TOOL_DENIED { callId, reason }   the user declined, or policy denies it\n   Denial is not an abort: handle TOOL_DENIED and continue or finish.\n   IMPORTANT: if your machine has more than one call outstanding at the same\n   time (parallel regions), give each toolCall an explicit id and guard every\n   waiting state with whenCall(id) — events reach every region that can\n   handle them, so an unguarded region will consume another call's result:\n\n     import { toolCall, whenCall } from '@astral-mcp/tools';\n     entry: toolCall('write_file', () => ({ path: '/a' }), { id: 'a' }),\n     on: { TOOL_RESULT: { guard: whenCall('a'), target: 'done' } },\n5. Read-only tools run immediately. Every other tool pauses the machine for\n   user approval; the arguments captured at that moment are the arguments\n   that execute.\n6. Only 'xstate' and '@astral-mcp/tools' resolve as imports. There is no\n   filesystem, no network, no fetch. All working state lives in context.\n7. Finish by reaching a final state. Use the machine's output for the result.\n\nExample — happy path with a read-only call:\n\n  import { setup, assign } from 'xstate';\n  import { toolCall } from '@astral-mcp/tools';\n\n  export default setup({}).createMachine({\n    id: 'readNotes',\n    context: ({ input }) => ({ path: input?.path ?? '/notes.txt', text: null }),\n    initial: 'reading',\n    states: {\n      reading: {\n        entry: toolCall('read_file', ({ context }) => ({ path: context.path })),\n        on: {\n          TOOL_RESULT: { target: 'done', actions: assign({ text: ({ event }) => event.result }) },\n          TOOL_ERROR: 'failed',\n        },\n      },\n      done: { type: 'final' },\n      failed: { type: 'final' },\n    },\n    output: ({ context }) => ({ text: context.text }),\n  });\n\nExample — handling a denied approval:\n\n  import { setup, assign } from 'xstate';\n  import { toolCall } from '@astral-mcp/tools';\n\n  export default setup({}).createMachine({\n    id: 'writeNotes',\n    context: { status: 'pending' },\n    initial: 'writing',\n    states: {\n      writing: {\n        entry: toolCall('write_file', () => ({ path: '/notes.txt', content: 'hello' })),\n        on: {\n          TOOL_RESULT: { target: 'done', actions: assign({ status: 'written' }) },\n          TOOL_DENIED: { target: 'done', actions: assign({ status: 'skipped' }) },\n          TOOL_ERROR: { target: 'done', actions: assign({ status: 'failed' }) },\n        },\n      },\n      done: { type: 'final' },\n    },\n    output: ({ context }) => ({ status: context.status }),\n  });\n";
 //#endregion
-export { APPROVAL_SCHEMA, AUTHORING_CONTRACT, ApprovalVerdict, AuditEntry, BLOB_SCHEMA_VERSION, BlobPayload, BlobSealerConfig, type CallToolResult, type ContentBlock, DEFAULT_CAPS, DEFAULT_CODE_MODE_PREAMBLE, DEFAULT_MAX_BLOB_BYTES, DEFAULT_SERVER_ALIAS, DEFAULT_TTL_MS, Diagnostic, ENVELOPE_PREFIX, EXAMPLE_DENIAL_FALLBACK, EXAMPLE_HAPPY_PATH, type ElicitationCopy, type ElicitationCopyOptions, ErrorPhase, type ExecuteMachineArgs, type ExecuteMachineDeps, type GeneratedToolTypes, HostEvent, type InputRequest, type InputRequests, type InputRequiredResult, type InputResponse, type InputResponseView, type InputResponses, Introspector, LIB_VERSION, LogEntry, LogLevel, MAX_CAPS, MRTR_PROTOCOL_REVISION, type OpenBlobOptions, POLICY_DENIED_REASON, PendingToolCall, PolicyDecision, PolicyOverrides, ProjectionConfig, ProjectionError, type ProjectionFacade, type ProjectionResource, type ProtocolEra, RESOURCE_URIS, RedactionHook, type RegisterOptions, type ResolvedCallPolicy, ResourceCaps, type RetryEnvelope, type RunSegmentOptions, type SandboxSession, type SandboxSessionOptions, type SandboxToolCall, type SandboxToolCallHandler, SegmentOutcome, ServerAlias, ServerCatalog, StructuredError, TOOLS_MODULE_SPECIFIER, TOOL_CALL_HOST_GLOBAL, ToolAnnotations, ToolCallOutcome, type ToolCallResult, ToolCatalog, ToolCatalogEntry, ToolExecutor, type WrapOptions, XSTATE_VERSION, acceptedContent, buildBlobPayload, buildElicitationCopy, buildInstructions, buildResources, capLength, clampCaps, createIntrospector, createSandboxSession, decidePolicy, discoverApis, executeMachine, findTool, generateToolTypes, hashCode, inputRequired, inputResponse, isInputRequiredResult, isRecord, neutralizeControlChars, openBlob, policyDeniedReason, resolveCallPolicy, runSegment, schemaRequiresArgs, schemaToTsType, sealBlob, supportsMrtr, toStructuredError, wrapMcpServer };
+export { APPROVAL_SCHEMA, AUTHORING_CONTRACT, ApprovalVerdict, AuditEntry, BLOB_SCHEMA_VERSION, BlobPayload, BlobSealerConfig, type CallToolResult, type ContentBlock, DASHBOARD_HTML, DASHBOARD_RESOURCE_URI, DEFAULT_CAPS, DEFAULT_CODE_MODE_PREAMBLE, DEFAULT_MAX_BLOB_BYTES, DEFAULT_SERVER_ALIAS, DEFAULT_TTL_MS, Diagnostic, ENVELOPE_PREFIX, EXAMPLE_DENIAL_FALLBACK, EXAMPLE_HAPPY_PATH, type ElicitationCopy, type ElicitationCopyOptions, ErrorPhase, type ExecuteMachineArgs, type ExecuteMachineDeps, type GeneratedToolTypes, HostEvent, type InputRequest, type InputRequests, type InputRequiredResult, type InputResponse, type InputResponseView, type InputResponses, Introspector, LIB_VERSION, LogEntry, LogLevel, MAX_CAPS, MCP_APP_MIME_TYPE, MRTR_PROTOCOL_REVISION, type OpenBlobOptions, POLICY_DENIED_REASON, PendingToolCall, PolicyDecision, PolicyOverrides, ProjectionConfig, ProjectionError, type ProjectionFacade, type ProjectionResource, type ProtocolEra, RESOURCE_URIS, RedactionHook, type RegisterOptions, type ResolvedCallPolicy, ResourceCaps, type RetryEnvelope, type RunSegmentOptions, type SandboxSession, type SandboxSessionOptions, type SandboxToolCall, type SandboxToolCallHandler, SegmentOutcome, ServerAlias, ServerCatalog, StructuredError, TOOLS_MODULE_SPECIFIER, TOOL_CALL_HOST_GLOBAL, ToolAnnotations, ToolCallOutcome, type ToolCallResult, ToolCatalog, ToolCatalogEntry, ToolExecutor, type WrapOptions, XSTATE_VERSION, acceptedContent, buildBlobPayload, buildElicitationCopy, buildInstructions, buildResources, capLength, clampCaps, createIntrospector, createSandboxSession, decidePolicy, discoverApis, executeMachine, findTool, generateToolTypes, hashCode, inputRequired, inputResponse, isInputRequiredResult, isRecord, neutralizeControlChars, openBlob, policyDeniedReason, resolveCallPolicy, runSegment, schemaRequiresArgs, schemaToTsType, sealBlob, supportsMrtr, toStructuredError, wrapMcpServer };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/blob/sealer.ts","../src/blob/versions.ts","../src/mrtr/protocol.ts","../src/mrtr/adapter.ts","../src/mrtr/discover.ts","../src/wrap.ts","../src/errors.ts","../src/introspector/introspector.ts","../src/typegen/generate.ts","../src/typegen/json-schema.ts","../src/text-safety.ts","../src/policy/decision.ts","../src/policy/elicitation.ts","../src/sandbox/session.ts","../src/machine-host/host.ts","../src/machine-host/contract.ts"],"mappings":";;;;;;;;;;;;;KAcY;cAEC,sBAAsB;;UAGlB;EACf;EACA;EACA;EACA;;UAGe;;EAEf;EACA;;EAEA,aAAa;;EAEb,eAAe;EACf,cAAc;;UAGC;;EAEf,SAAS,IAAI,aAAa;;UAGX;EACf,OAAO;;EAEP;;EAEA;EACA,OAAO;;;;;;;;;;iBAmBO,SAAS,SAAS,eAAe,eAAe;;iBAahD,SAAS,iBAAiB,SAAS;;UAKlC;EACf,SACE,OAAO,aACP,cACA,MAAM,0BACL,QAAQ;;KAGD;EACR;EAAU;;EAAsB;EAAW;IAAS;IAAiB;;;KAM7D;UAEK;;GAEd,mBAAmB;;;UAQL;;EAEf;EACA;EACA,MAAM;;EAEN;;;KAIU;EACN;EAAqB;EAAgB;;EACrC;EAAoB;EAAgB;IAAS;IAAiB;;;EAC9D;EAAqB;EAAgB;;KAM/B;UASK;EACf;;EAEA;EACA;;UAGe;EACf,OAAO;EACP;EACA,aAAa;;EAEb;EACA,MAAM;;KAGI;UAEK;EACf,OAAO;EACP;;EAEA;;EAEA;;UAOe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;cAGW,cAAc;cAad,UAAU;;iBAmCP,UAAU,WAAW,QAAQ,gBAAgB;cAehD;UAEI;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;;;;;;;EAQxB,OAAO;;EAEP;;EAEA;;EAEA;;EAEA;;UAGe;;EAEf,KAAK;;EAEL,eAAe;;EAEf;;EAEA;;;KAQU;EAAoB;;EAAuB;EAAkB;;;KAG7D;EAEN;;EAEA;;EAEA,OAAO;EACP,MAAM;;EAGN;;EAEA,SAAS,eAAe;;EAExB;EACA;EACA,OAAO;EACP,MAAM;;EAGN;EACA,OAAO;;UAGI;EACf;EACA;EACA,MAAM;EACN;EACA;;UAOe;;;;;GAKd,kBAAkB,MAAM,0BAA0B;;UAGpC;;EAEf,OAAO,QAAQ;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET;;;;;cCtSW;;cAGA;;cAGA;;iBA8MG,SAAS;UAIR;;EAEf;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;EAExB,QAAQ;;EAER;;EAEA;;EAEA;;;;;;iBAOc,iBAAiB,OAAO,wBAAwB;;;;;;;;;iBA2BhD,SAAS,SAAS,aAAa,QAAQ;UA2BtC;;EAEf;;EAEA;EACA,QAAQ;;EAER;;;;;;;;;;;;;;;;;iBAkBc,SAAS,cAAc,SAAS,kBAAkB;;;;;;;;;;;;;;;cCxXrD;;cAGA;;;;;;;;KC0BD,iBAAiB;;;;;;;;;;;;;UAcZ;;EAEf;;EAEA,iBAAiB,mBAAiB;;;;;;;;;;;cAgBvB,iBAAiB;;;;;;;;;;;cAqBjB;;;;;;;;;;;iBAYG,aAAa,KAAK;;;UCpEjB,2BAA2B;;EAE1C;EACA;;EAEA;;UAGe;EACf,SAAS;EACT;EACA,UAAU;EACV,MAAM;EACN,OAAO,QAAQ;EACf,SAAS;EACT,SAAS;;;;;;EAMT,cAAc;;;;;;;;;iBAUM,eACpB,MAAM,oBACN,MAAM,qBACL,QAAQ;;;;cC5DE;;;;;;;UAQI;EACf;EACA;EACA;EACA;EACA;;cAGW;cA8BA;;iBA8CG,eAAe,SAAS,eAAe,cAAc;;;;;iBAqCrD,aAAa,SAAS,eAAe,mBAAmB;;;;;cA4B3D;iBAEG,kBAAkB,SAAS,eAAe;;;UClHzC;;EAEf,MAAM;;EAEN,OAAO,QAAQ;;EAEf,SAAS;;EAET,SAAS;;EAET;;EAEA,aAAa;;;UAIE;;;;;;EAMf,MAAM;;UAGS;;WAEN,SAAS;;WAET;;WAEA;;WAEA,WAAW;;;;;;WAMX,eAAe;;EAGxB,eAAe,MAAM,oBAAoB,MAAM,cAAc,QAAQ;;EAErE,gBAAgB;;EAEhB,aAAa,MAAM,kBAAkB;;EAErC,WAAW,QAAQ,WAAW,UAAU;;EAExC,SAAS;;;;;;iBAeW,cACpB,QAAQ,YAAY,QACpB,SAAS,cACR,QAAQ;;;;;;cC3HE,wBAAwB;WAC1B,OAAO;WACP,aAAa;WACb;EACT,MAAM;EAGJ,YAAA,OAAO,YACP,iBACA;IAAW,cAAc;IAAc;IAAe,OAAO;IAAY;;EAU3E,gBAAgB;;;iBAYF,kBAAkB,cAAc,OAAM,aAAkB;;;;KCE5D,eAAe,YAAY;;;;;;KAO3B,sBAAsB,OAAO,aAAa;;;;;;cAmJzC,wBAAwB;;UAI5B;SAKM,OAAO,SAAS,sBAAsB,QAAQ;;MAgEvD,WAAW;;EAKT,WAAW,QAAQ;;;;;;;;;;;;EAsBnB,SACJ,OAAO,aACP,cACA,MAAM,0BACL,QAAQ;;;;;EAyCL,SAAS;;;;;;;iBAWK,mBAAmB,SAAS,sBAAsB,QAAQ;;;;;;;cCzUnE;;;;;;;;;;;;;;;;;;;;;cAsBA;;UAGI;;EAEf;;EAEA;;EAEA;;;;;;;;;iBA2Oc,kBAAkB,SAAS,cAAc,gBAAgB;;;;;;;;;;iBC/CzD,eAAe,iBAAiB;;;;;iBAQhC,mBAAmB;;;;;;;;;;;;;;;;;;;;;iBCrNnB,uBACd,cACA;EAAW;;;iBAMG,UAAU,cAAc;;;;;;;;;;;;;;;;iBCNxB,aAAa,OAAO,kBAAkB,YAAY,kBAAkB;;KAaxE;EACN;EAAU,UAAU;EAAgB,OAAO;;EAC3C;EAAW,OAAO;;;;;;;;;;;iBAWR,kBACd,MAAM,iBACN,SAAS,eACT,YAAY,kBACX;;;;;;cAyBU;;;;;;iBAOG,mBAAmB;;;;UChElB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;UAGe;;EAEf,SAAS;;EAET;;;;;;;;;iBAsBc,qBACd,MAAM,iBACN,OAAO,kBACP,UAAS,yBACR;;;;UChDc;EACf;EACA,MAAM;;;;;;;;;;;KAYI,0BAA0B,MAAM,8BAA8B;UAEzD;;EAEf;;EAEA;;EAEA,OAAO,QAAQ;;;;;;EAMf;;EAEA,YAAY;;EAEZ;;;;;;;;UASe;;WAEN,MAAM;;WAEN;;;;;;EAMT,SAAS,iBAAiB;;EAE1B,WAAW;;EAEX,WAAW;;;;;;;iBA6OS,qBACpB,SAAS,wBACR,QAAQ;;;UCrRM;;EAEf;EACA;;EAEA;;EAEA,SAAS;;EAET;;EAEA,UAAU;;EAEV,OAAO,QAAQ;;EAEf,SAAS;;EAET;;;;;;EAMA;IACE;;IAEA,SAAS,eAAe;;IAExB,UAAU,eAAe;;IAEzB,QAAQ;;IAER;;;;;;;;;;;;;;;iBAgBkB,WAAW,SAAS,oBAAoB,QAAQ;;;;;;;cCUzD"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/blob/sealer.ts","../src/blob/versions.ts","../src/mrtr/protocol.ts","../src/mrtr/adapter.ts","../src/mrtr/discover.ts","../src/wrap.ts","../src/apps/dashboard.ts","../src/errors.ts","../src/introspector/introspector.ts","../src/typegen/generate.ts","../src/typegen/json-schema.ts","../src/text-safety.ts","../src/policy/decision.ts","../src/policy/elicitation.ts","../src/sandbox/session.ts","../src/machine-host/host.ts","../src/machine-host/contract.ts"],"mappings":";;;;;;;;;;;;;KAcY;cAEC,sBAAsB;;UAGlB;EACf;EACA;EACA;EACA;;UAGe;;EAEf;EACA;;EAEA,aAAa;;EAEb,eAAe;EACf,cAAc;;UAGC;;EAEf,SAAS,IAAI,aAAa;;UAGX;EACf,OAAO;;EAEP;;EAEA;EACA,OAAO;;;;;;;;;;iBAmBO,SAAS,SAAS,eAAe,eAAe;;iBAahD,SAAS,iBAAiB,SAAS;;UAKlC;EACf,SACE,OAAO,aACP,cACA,MAAM,0BACL,QAAQ;;KAGD;EACR;EAAU;;EAAsB;EAAW;IAAS;IAAiB;;;KAM7D;UAEK;;GAEd,mBAAmB;;;UAQL;;EAEf;EACA;EACA,MAAM;;EAEN;;;KAIU;EACN;EAAqB;EAAgB;;EACrC;EAAoB;EAAgB;IAAS;IAAiB;;;EAC9D;EAAqB;EAAgB;;KAM/B;UASK;EACf;;EAEA;EACA;;UAGe;EACf,OAAO;EACP;EACA,aAAa;;EAEb;EACA,MAAM;;KAGI;UAEK;EACf,OAAO;EACP;;EAEA;;EAEA;;UAOe;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;cAGW,cAAc;cAad,UAAU;;iBAmCP,UAAU,WAAW,QAAQ,gBAAgB;cAehD;UAEI;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;;;;;;;EAQxB,OAAO;;EAEP;;EAEA;;EAEA;;EAEA;;UAGe;;EAEf,KAAK;;EAEL,eAAe;;EAEf;;EAEA;;;KAQU;EAAoB;;EAAuB;EAAkB;;;KAG7D;EAEN;;EAEA;;EAEA,OAAO;EACP,MAAM;;EAGN;;EAEA,SAAS,eAAe;;EAExB;EACA;EACA,OAAO;EACP,MAAM;;EAGN;EACA,OAAO;;UAGI;EACf;EACA;EACA,MAAM;EACN;EACA;;UAOe;;;;;GAKd,kBAAkB,MAAM,0BAA0B;;UAGpC;;EAEf,OAAO,QAAQ;;EAEf,SAAS;;EAET,MAAM;;EAEN,SAAS;;EAET;;;;;cCtSW;;cAGA;;cAGA;;iBA8MG,SAAS;UAIR;;EAEf;;EAEA;;EAEA;;EAEA,SAAS,eAAe;;EAExB,QAAQ;;EAER;;EAEA;;EAEA;;;;;;iBAOc,iBAAiB,OAAO,wBAAwB;;;;;;;;;iBA2BhD,SAAS,SAAS,aAAa,QAAQ;UA2BtC;;EAEf;;EAEA;EACA,QAAQ;;EAER;;;;;;;;;;;;;;;;;iBAkBc,SAAS,cAAc,SAAS,kBAAkB;;;;;;;;;;;;;;;cCxXrD;;cAGA;;;;;;;;KC0BD,iBAAiB;;;;;;;;;;;;;UAcZ;;EAEf;;EAEA,iBAAiB,mBAAiB;;;;;;;;;;;cAgBvB,iBAAiB;;;;;;;;;;;cAqBjB;;;;;;;;;;;iBAYG,aAAa,KAAK;;;UCpEjB,2BAA2B;;EAE1C;EACA;;EAEA;;UAGe;EACf,SAAS;EACT;EACA,UAAU;EACV,MAAM;EACN,OAAO,QAAQ;EACf,SAAS;EACT,SAAS;;;;;;EAMT,cAAc;;;;;;;;;;;;;EAad;;;;;;;;;iBAUoB,eACpB,MAAM,oBACN,MAAM,qBACL,QAAQ;;;;cCxEE;;;;;;;UAQI;EACf;EACA;EACA;EACA;EACA;;EAEA,QAAQ;;cAGG;cA8BA;;iBA8CG,eAAe,SAAS,eAAe,cAAc;;;;;iBAiDrD,aAAa,SAAS,eAAe,mBAAmB;;;;;cA8B3D;iBAEG,kBAAkB,SAAS,eAAe;;;UCjIzC;;EAEf,MAAM;;EAEN,OAAO,QAAQ;;EAEf,SAAS;;EAET,SAAS;;EAET;;EAEA;;;;;;;;IAQE;;;EAGF,aAAa;;;UAIE;;;;;;EAMf,MAAM;;UAGS;;WAEN,SAAS;;WAET;;WAEA;;WAEA,WAAW;;;;;;WAMX,eAAe;;EAGxB,eAAe,MAAM,oBAAoB,MAAM,cAAc,QAAQ;;EAErE,gBAAgB;;EAEhB,aAAa,MAAM,kBAAkB;;EAErC,WAAW,QAAQ,WAAW,UAAU;;EAExC,SAAS;;;;;;iBAeW,cACpB,QAAQ,YAAY,QACpB,SAAS,cACR,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cChHE;;cAGA;cAEA;;;;;;cC7BA,wBAAwB;WAC1B,OAAO;WACP,aAAa;WACb;EACT,MAAM;EAGJ,YAAA,OAAO,YACP,iBACA;IAAW,cAAc;IAAc;IAAe,OAAO;IAAY;;EAU3E,gBAAgB;;;iBAYF,kBAAkB,cAAc,OAAM,aAAkB;;;;KCE5D,eAAe,YAAY;;;;;;KAO3B,sBAAsB,OAAO,aAAa;;;;;;cAmJzC,wBAAwB;;UAI5B;SAKM,OAAO,SAAS,sBAAsB,QAAQ;;MAgEvD,WAAW;;EAKT,WAAW,QAAQ;;;;;;;;;;;;EAsBnB,SACJ,OAAO,aACP,cACA,MAAM,0BACL,QAAQ;;;;;EAyCL,SAAS;;;;;;;iBAWK,mBAAmB,SAAS,sBAAsB,QAAQ;;;;;;;cCzUnE;;;;;;;;;;;;;;;;;;;;;cAsBA;;UAGI;;EAEf;;EAEA;;EAEA;;;;;;;;;iBA2Oc,kBAAkB,SAAS,cAAc,gBAAgB;;;;;;;;;;iBC/CzD,eAAe,iBAAiB;;;;;iBAQhC,mBAAmB;;;;;;;;;;;;;;;;;;;;;iBCrNnB,uBACd,cACA;EAAW;;;iBAMG,UAAU,cAAc;;;;;;;;;;;;;;;;iBCNxB,aAAa,OAAO,kBAAkB,YAAY,kBAAkB;;KAaxE;EACN;EAAU,UAAU;EAAgB,OAAO;;EAC3C;EAAW,OAAO;;;;;;;;;;;iBAWR,kBACd,MAAM,iBACN,SAAS,eACT,YAAY,kBACX;;;;;;cAyBU;;;;;;iBAOG,mBAAmB;;;;UChElB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;UAGe;;EAEf,SAAS;;EAET;;;;;;;;;iBAsBc,qBACd,MAAM,iBACN,OAAO,kBACP,UAAS,yBACR;;;;UChDc;EACf;EACA,MAAM;;;;;;;;;;;KAYI,0BAA0B,MAAM,8BAA8B;UAEzD;;EAEf;;EAEA;;EAEA,OAAO,QAAQ;;;;;;EAMf;;EAEA,YAAY;;EAEZ;;;;;;;;UASe;;WAEN,MAAM;;WAEN;;;;;;EAMT,SAAS,iBAAiB;;EAE1B,WAAW;;EAEX,WAAW;;;;;;;iBA6OS,qBACpB,SAAS,wBACR,QAAQ;;;UCrRM;;EAEf;EACA;;EAEA;;EAEA,SAAS;;EAET;;EAEA,UAAU;;EAEV,OAAO,QAAQ;;EAEf,SAAS;;EAET;;;;;;EAMA;IACE;;IAEA,SAAS,eAAe;;IAExB,UAAU,eAAe;;IAEzB,QAAQ;;IAER;;;;;;;;;;;;;;;iBAgBkB,WAAW,SAAS,oBAAoB,QAAQ;;;;;;;cCUzD"}

package/dist/index.mjs

@@ -7,6 +7,223 @@ import { deflateRawSync, inflateRawSync } from "node:zlib";
 import { getModuleLoader, getTypescriptSupport, loadQuickJs } from "@sebastianwessel/quickjs";
 import { readFileSync, readdirSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+//#region src/apps/dashboard.ts
+/**
+* MCP Apps workflow dashboard (PRD §12.1, second fenced use case).
+*
+* A static, library-authored HTML app that renders an `execute_machine`
+* result — output, approval audit trail, console logs, or the structured
+* error — inside the host's sandboxed iframe, per the MCP Apps extension
+* (SEP-1865, spec 2026-01-26).
+*
+* Security posture (the §12.1 design constraint, satisfied by construction):
+* - The HTML is a compile-time constant. No model-authored code, no
+*   template interpolation, no VM: UI rendering can never reach the tools
+*   bridge because nothing dynamic executes server-side at all.
+* - Model-controlled data (outputs, audit args, log lines, error text)
+*   enters the DOM exclusively through `textContent` — the app never uses
+*   innerHTML — so hostile strings render inert (S6 extended to the app).
+* - The app requests no host capabilities: `appCapabilities: {}`. It cannot
+*   call tools, open links, or write context; it only listens.
+*
+* Wire contract implemented (app side):
+* - `ui/initialize` request → await result → `ui/notifications/initialized`.
+* - Listens for `ui/notifications/tool-input`, `ui/notifications/tool-result`
+*   and `ui/notifications/tool-cancelled`; ignores everything else.
+* - The result payload is the standard `CallToolResult` from
+*   `execute_machine`: `structuredContent` is either
+*   `{ output, approvals, logs }` or (with `isError`) the structured error
+*   `{ phase, message, hint, logs }`.
+*/
+/** URI the dashboard is served under. MCP Apps mandates the ui:// scheme. */
+const DASHBOARD_RESOURCE_URI = "ui://projection/dashboard.html";
+/** MIME type the MCP Apps spec mandates for app HTML resources. */
+const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
+const DASHBOARD_HTML = `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<title>Projection workflow dashboard</title>
+<style>
+  :root {
+    color-scheme: light dark;
+    --bg: #ffffff; --fg: #1a1a2e; --muted: #6b7280; --line: #e5e7eb;
+    --ok: #047857; --ok-bg: #ecfdf5; --err: #b91c1c; --err-bg: #fef2f2;
+    --chip: #eef2ff; --mono: ui-monospace, SFMono-Regular, Menlo, monospace;
+  }
+  @media (prefers-color-scheme: dark) {
+    :root {
+      --bg: #111318; --fg: #e5e7eb; --muted: #9ca3af; --line: #2a2f3a;
+      --ok: #34d399; --ok-bg: #06281f; --err: #f87171; --err-bg: #2d1215;
+      --chip: #1e2433;
+    }
+  }
+  html, body { margin: 0; padding: 0; background: var(--bg); color: var(--fg);
+    font: 14px/1.5 system-ui, sans-serif; }
+  main { padding: 16px; max-width: 720px; }
+  h1 { font-size: 15px; margin: 0 0 12px; display: flex; gap: 8px; align-items: center; }
+  .chip { font-size: 12px; padding: 2px 10px; border-radius: 999px; background: var(--chip); }
+  .chip.ok { color: var(--ok); background: var(--ok-bg); }
+  .chip.err { color: var(--err); background: var(--err-bg); }
+  section { margin: 14px 0; }
+  section > h2 { font-size: 12px; text-transform: uppercase; letter-spacing: .06em;
+    color: var(--muted); margin: 0 0 6px; }
+  pre { margin: 0; padding: 10px; background: var(--chip); border-radius: 8px;
+    font-family: var(--mono); font-size: 12px; overflow-x: auto; white-space: pre-wrap; }
+  table { border-collapse: collapse; width: 100%; font-size: 13px; }
+  th, td { text-align: left; padding: 6px 8px; border-bottom: 1px solid var(--line);
+    vertical-align: top; }
+  th { color: var(--muted); font-weight: 500; }
+  td.args { font-family: var(--mono); font-size: 12px; }
+  .log { font-family: var(--mono); font-size: 12px; padding: 2px 0; }
+  .log .level { color: var(--muted); margin-right: 6px; }
+  .hint { color: var(--muted); font-size: 13px; margin-top: 6px; }
+  .hidden { display: none; }
+  #waiting { color: var(--muted); }
+</style>
+</head>
+<body>
+<main>
+  <h1>Projection workflow <span id="status" class="chip">waiting…</span></h1>
+  <p id="waiting">Waiting for the workflow result from the host…</p>
+  <section id="output-section" class="hidden"><h2>Output</h2><pre id="output"></pre></section>
+  <section id="error-section" class="hidden"><h2>Error</h2>
+    <pre id="error"></pre><p id="error-hint" class="hint"></p></section>
+  <section id="approvals-section" class="hidden"><h2>Approval audit trail</h2>
+    <table><thead><tr><th>Tool</th><th>Decision</th><th>Arguments</th></tr></thead>
+    <tbody id="approvals"></tbody></table></section>
+  <section id="logs-section" class="hidden"><h2>Console</h2><div id="logs"></div></section>
+</main>
+<script>
+'use strict';
+(function () {
+  var nextId = 1;
+  var pending = new Map();
+
+  function post(message) { window.parent.postMessage(message, '*'); }
+  function request(method, params) {
+    return new Promise(function (resolve, reject) {
+      var id = nextId++;
+      pending.set(id, { resolve: resolve, reject: reject });
+      post({ jsonrpc: '2.0', id: id, method: method, params: params });
+    });
+  }
+  function notify(method, params) {
+    var message = { jsonrpc: '2.0', method: method };
+    if (params !== undefined) message.params = params;
+    post(message);
+  }
+
+  function byId(id) { return document.getElementById(id); }
+  function show(id) { byId(id).classList.remove('hidden'); }
+  function setStatus(text, cls) {
+    var chip = byId('status');
+    chip.textContent = text;
+    chip.className = 'chip' + (cls ? ' ' + cls : '');
+    byId('waiting').classList.add('hidden');
+  }
+  function pretty(value) {
+    try { return JSON.stringify(value, null, 2); } catch (e) { return String(value); }
+  }
+
+  // All model-controlled data enters the DOM via textContent only.
+  function renderResult(result) {
+    var structured = (result && result.structuredContent) || {};
+    if (result && result.isError) {
+      setStatus('failed: ' + String(structured.phase || 'error'), 'err');
+      byId('error').textContent =
+        String(structured.message || 'unknown error');
+      byId('error-hint').textContent = String(structured.hint || '');
+      show('error-section');
+    } else {
+      setStatus('completed', 'ok');
+      byId('output').textContent = pretty(
+        structured.output === undefined ? null : structured.output,
+      );
+      show('output-section');
+    }
+    var approvals = Array.isArray(structured.approvals) ? structured.approvals : [];
+    if (approvals.length > 0) {
+      var tbody = byId('approvals');
+      approvals.forEach(function (entry) {
+        var row = document.createElement('tr');
+        var tool = document.createElement('td');
+        tool.textContent = String(entry.tool || '');
+        var decision = document.createElement('td');
+        decision.textContent = String(entry.decision || '');
+        var args = document.createElement('td');
+        args.className = 'args';
+        args.textContent = pretty(entry.args || {});
+        row.appendChild(tool); row.appendChild(decision); row.appendChild(args);
+        tbody.appendChild(row);
+      });
+      show('approvals-section');
+    }
+    var logs = Array.isArray(structured.logs) ? structured.logs : [];
+    if (logs.length > 0) {
+      var list = byId('logs');
+      logs.forEach(function (entry) {
+        var line = document.createElement('div');
+        line.className = 'log';
+        var level = document.createElement('span');
+        level.className = 'level';
+        level.textContent = '[' + String(entry.level || 'log') + ']';
+        line.appendChild(level);
+        line.appendChild(document.createTextNode(String(entry.message || '')));
+        list.appendChild(line);
+      });
+      show('logs-section');
+    }
+  }
+
+  window.addEventListener('message', function (event) {
+    // Only the embedding host may speak: forged tool-results from a hostile
+    // embedder could otherwise spoof the displayed audit trail.
+    if (event.source !== window.parent) return;
+    var message = event.data;
+    if (!message || message.jsonrpc !== '2.0') return;
+    if (message.id !== undefined && message.method === undefined) {
+      var waiter = pending.get(message.id);
+      if (waiter) {
+        pending.delete(message.id);
+        if (message.error) waiter.reject(message.error);
+        else waiter.resolve(message.result);
+      }
+      return;
+    }
+    if (message.method === 'ui/notifications/tool-input') {
+      setStatus('running…');
+      return;
+    }
+    if (message.method === 'ui/notifications/tool-result') {
+      renderResult(message.params);
+      return;
+    }
+    if (message.method === 'ui/notifications/tool-cancelled') {
+      var reason = message.params && message.params.reason;
+      setStatus('cancelled', 'err');
+      byId('error').textContent = String(reason || 'cancelled by the host');
+      show('error-section');
+      return;
+    }
+    // Host -> app REQUESTS (id + method) get an empty result: answers ping
+    // and ui/resource-teardown so hosts don't stall on their SHOULD-wait.
+    if (message.id !== undefined && message.method !== undefined) {
+      post({ jsonrpc: '2.0', id: message.id, result: {} });
+    }
+  });
+
+  // Handshake: initialize, then signal readiness. The host MUST NOT push
+  // tool data before ui/notifications/initialized.
+  request('ui/initialize', { appCapabilities: {} }).then(function () {
+    notify('ui/notifications/initialized');
+  });
+})();
+<\/script>
+</body>
+</html>
+`;
+//#endregion
 //#region src/errors.ts
 /**
 * Error carrying the structured `isError` body every failure returns (R25).
@@ -378,7 +595,7 @@ const BLOB_SCHEMA_VERSION = 1;
 * CI instead of silently minting blobs with a stale version stamp.
 */
 /** `@astral-mcp/projection` package version (must match packages/projection/package.json). */
-const LIB_VERSION = "0.2.0";
+const LIB_VERSION = "0.4.0";
 /** Pinned XState version (must match the exact pin in package.json — D2). */
 const XSTATE_VERSION = "5.32.5";
 //#endregion
@@ -604,7 +821,7 @@ function openBlob(blob, options) {
 	}
 	if (!isRecord(payload)) throw verificationError("blob payload malformed: not a JSON object", HINT_CORRUPT);
 	if (payload["v"] !== 1) throw verificationError(`unknown blob schema version ${JSON.stringify(payload["v"])} (this library expects 1)`, HINT_VERSION);
-	if (payload["libv"] !== "0.2.0") throw verificationError(`library version mismatch: blob was sealed by @astral-mcp/projection ${JSON.stringify(payload["libv"])}, this instance runs ${LIB_VERSION}`, HINT_VERSION);
+	if (payload["libv"] !== "0.4.0") throw verificationError(`library version mismatch: blob was sealed by @astral-mcp/projection ${JSON.stringify(payload["libv"])}, this instance runs ${LIB_VERSION}`, HINT_VERSION);
 	if (payload["xstatev"] !== "5.32.5") throw verificationError(`xstate version mismatch: blob snapshot was produced under xstate ${JSON.stringify(payload["xstatev"])}, this instance runs ${XSTATE_VERSION}`, HINT_VERSION);
 	assertPayloadShape(payload);
 	const verified = payload;
@@ -2170,7 +2387,7 @@ function suspendResult(outcome, args, deps, caps) {
 		hint,
 		logs: outcome.logs
 	});
-	if (!supportsMrtr(deps.protocolEra)) return fail("protocol", `this machine needs approval for a non-read-only tool call, which requires MCP protocol revision ${MRTR_PROTOCOL_REVISION} or later (this request is being served on the ${deps.protocolEra ?? "legacy"} protocol era)`, "Author a machine that only calls read-only tools, or connect with a client that negotiates the 2026-07-28 revision (SDK v2: `versionNegotiation: { mode: \"auto\" }`).");
+	if (!supportsMrtr(deps.protocolEra) && deps.legacyElicitation !== true) return fail("protocol", `this machine needs approval for a non-read-only tool call, which requires MCP protocol revision ${MRTR_PROTOCOL_REVISION} or later (this request is being served on the ${deps.protocolEra ?? "legacy"} protocol era)`, "Author a machine that only calls read-only tools, or connect with a client that negotiates the 2026-07-28 revision (SDK v2: `versionNegotiation: { mode: \"auto\" }`).");
 	if (outcome.trip > caps.maxRoundTrips) return fail("terminal", `this workflow reached the limit of ${caps.maxRoundTrips} approval round trips`, `Restructure the machine to need at most ${caps.maxRoundTrips} approval round trips.`);
 	const inputRequests = {};
 	for (const [key, call] of Object.entries(outcome.pending)) {
@@ -2368,6 +2585,14 @@ function buildResources(catalog, dts) {
 			description: "Example machine: continues gracefully when approval is declined.",
 			mimeType: "text/plain",
 			text: EXAMPLE_DENIAL_FALLBACK
+		},
+		{
+			uri: DASHBOARD_RESOURCE_URI,
+			name: "dashboard.html",
+			description: "Workflow result dashboard rendered by MCP Apps hosts.",
+			mimeType: MCP_APP_MIME_TYPE,
+			text: DASHBOARD_HTML,
+			_meta: { ui: { prefersBorder: true } }
 		}
 	];
 }
@@ -2385,7 +2610,7 @@ function discoverApis(catalog, overview) {
 		"",
 		AUTHORING_CONTRACT
 	].join("\n");
-	const links = buildResources(catalog, "").map((resource) => ({
+	const links = buildResources(catalog, "").filter((resource) => !resource.uri.startsWith("ui://")).map((resource) => ({
 		type: "resource_link",
 		uri: resource.uri,
 		name: resource.name,
@@ -2850,7 +3075,8 @@ var Facade = class {
 			...options.caps !== void 0 ? { caps: options.caps } : {},
 			...options.policy !== void 0 ? { policy: options.policy } : {},
 			...options.redact !== void 0 ? { redact: options.redact } : {},
-			...era !== void 0 ? { protocolEra: era } : {}
+			...era !== void 0 ? { protocolEra: era } : {},
+			...options.compat?.legacyElicitation === true ? { legacyElicitation: true } : {}
 		});
 	}
 	discoverApis() {
@@ -2866,7 +3092,10 @@ var Facade = class {
 		const server = new McpServer(this.deps.options.serverInfo ?? {
 			name: `projection-${this.deps.catalog.alias}`,
 			version: "0.1.0"
-		}, { instructions: this.instructions });
+		}, {
+			instructions: this.instructions,
+			inputRequired: { maxRounds: clampCaps(this.deps.options.caps ?? {}).maxRoundTrips }
+		});
 		this.registerOn(server, ctx);
 		return server;
 	}
@@ -2875,7 +3104,8 @@ var Facade = class {
 		server.registerTool("execute_machine", {
 			title: "Execute a state machine",
 			description: EXECUTE_MACHINE_DESCRIPTION,
-			inputSchema: EXECUTE_MACHINE_INPUT_SCHEMA
+			inputSchema: EXECUTE_MACHINE_INPUT_SCHEMA,
+			_meta: { ui: { resourceUri: DASHBOARD_RESOURCE_URI } }
 		}, async (args, ctx) => await this.executeMachine({
 			code: args.code,
 			...args.lang !== void 0 ? { lang: args.lang } : {},
@@ -2890,7 +3120,8 @@ var Facade = class {
 		}, () => this.discoverApis());
 		for (const resource of this.resources) server.registerResource(resource.name, resource.uri, {
 			description: resource.description,
-			mimeType: resource.mimeType
+			mimeType: resource.mimeType,
+			...resource._meta !== void 0 ? { _meta: resource._meta } : {}
 		}, () => ({ contents: [{
 			uri: resource.uri,
 			mimeType: resource.mimeType,
@@ -2924,6 +3155,6 @@ const EXECUTE_MACHINE_INPUT_SCHEMA = z.object({
 	input: z.unknown().optional().describe("Passed to the machine as its `input`.")
 });
 //#endregion
-export { APPROVAL_SCHEMA, AUTHORING_CONTRACT, BLOB_SCHEMA_VERSION, DEFAULT_CAPS, DEFAULT_CODE_MODE_PREAMBLE, DEFAULT_MAX_BLOB_BYTES, DEFAULT_SERVER_ALIAS, DEFAULT_TTL_MS, ENVELOPE_PREFIX, EXAMPLE_DENIAL_FALLBACK, EXAMPLE_HAPPY_PATH, Introspector, LIB_VERSION, MAX_CAPS, MRTR_PROTOCOL_REVISION, POLICY_DENIED_REASON, ProjectionError, RESOURCE_URIS, TOOLS_MODULE_SPECIFIER, TOOL_CALL_HOST_GLOBAL, XSTATE_VERSION, acceptedContent, buildBlobPayload, buildElicitationCopy, buildInstructions, buildResources, capLength, clampCaps, createIntrospector, createSandboxSession, decidePolicy, discoverApis, executeMachine, findTool, generateToolTypes, hashCode, inputRequired, inputResponse, isInputRequiredResult, isRecord, neutralizeControlChars, openBlob, policyDeniedReason, resolveCallPolicy, runSegment, schemaRequiresArgs, schemaToTsType, sealBlob, supportsMrtr, toStructuredError, wrapMcpServer };
+export { APPROVAL_SCHEMA, AUTHORING_CONTRACT, BLOB_SCHEMA_VERSION, DASHBOARD_HTML, DASHBOARD_RESOURCE_URI, DEFAULT_CAPS, DEFAULT_CODE_MODE_PREAMBLE, DEFAULT_MAX_BLOB_BYTES, DEFAULT_SERVER_ALIAS, DEFAULT_TTL_MS, ENVELOPE_PREFIX, EXAMPLE_DENIAL_FALLBACK, EXAMPLE_HAPPY_PATH, Introspector, LIB_VERSION, MAX_CAPS, MCP_APP_MIME_TYPE, MRTR_PROTOCOL_REVISION, POLICY_DENIED_REASON, ProjectionError, RESOURCE_URIS, TOOLS_MODULE_SPECIFIER, TOOL_CALL_HOST_GLOBAL, XSTATE_VERSION, acceptedContent, buildBlobPayload, buildElicitationCopy, buildInstructions, buildResources, capLength, clampCaps, createIntrospector, createSandboxSession, decidePolicy, discoverApis, executeMachine, findTool, generateToolTypes, hashCode, inputRequired, inputResponse, isInputRequiredResult, isRecord, neutralizeControlChars, openBlob, policyDeniedReason, resolveCallPolicy, runSegment, schemaRequiresArgs, schemaToTsType, sealBlob, supportsMrtr, toStructuredError, wrapMcpServer };
 
 //# sourceMappingURL=index.mjs.map