@axiom-lattice/gateway 8.3.0 → 9.0.0

package/dist/{chunk-W3YH4S6G.mjs → chunk-SIMEG2JT.mjs}

@@ -57,8 +57,25 @@ function buildAgentCardForAssistant(params) {
   };
 }
 
+// src/utils/request-base-url.ts
+function firstHeader(value) {
+  const raw = Array.isArray(value) ? value[0] : value;
+  if (typeof raw !== "string") return void 0;
+  const first = raw.split(",")[0]?.trim();
+  return first ? first : void 0;
+}
+function resolveRequestBaseUrl(request) {
+  const forwardedProto = firstHeader(
+    request.headers["x-forwarded-proto"]
+  )?.toLowerCase();
+  const protocol = forwardedProto === "http" || forwardedProto === "https" ? forwardedProto : request.protocol;
+  const host = firstHeader(request.headers["x-forwarded-host"]) ?? request.host;
+  return `${protocol}://${host}`;
+}
+
 export {
   deriveAgentSkills,
-  buildAgentCardForAssistant
+  buildAgentCardForAssistant,
+  resolveRequestBaseUrl
 };
-//# sourceMappingURL=chunk-W3YH4S6G.mjs.map
+//# sourceMappingURL=chunk-SIMEG2JT.mjs.map

package/dist/chunk-SIMEG2JT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/services/a2a/A2AAgentCardBuilder.ts","../src/utils/request-base-url.ts"],"sourcesContent":["import type { AgentCard, A2ASkill, AgentMiddlewareConfig } from \"@axiom-lattice/protocols\";\n\n/** Minimal assistant shape needed to derive a card from its own definition. */\nexport interface CardAssistant {\n  id: string;\n  name: string;\n  description?: string;\n  graphDefinition?: {\n    middleware?: AgentMiddlewareConfig[];\n  } | null;\n}\n\n/**\n * Parameters for building a per-assistant A2A AgentCard.\n */\nexport interface BuildAgentCardParams {\n  assistant: CardAssistant;\n  /** Gateway origin, e.g. \"https://gw.example.com\". */\n  baseUrl: string;\n  /** Optional JSON-RPC endpoint path override (official `/a2a/:id` alias). */\n  jsonRpcPath?: string;\n  /** Advertise push notification support; defaults to `true`. */\n  pushNotifications?: boolean;\n}\n\n/**\n * Derive the card's advertised skills from the agent's own definition: every\n * enabled middleware contributes a skill (id = middleware type, name/description\n * from its config). No manual `a2aExposure` declaration — the card reflects\n * what the agent is actually built from.\n */\nexport function deriveAgentSkills(assistant: CardAssistant): A2ASkill[] {\n  const enabled = assistant.graphDefinition?.middleware?.filter((m) => m.enabled) ?? [];\n  return enabled.map((m) => ({\n    id: m.type || m.id,\n    name: m.name || m.type || m.id,\n    description: m.description || \"\",\n    tags: [],\n    examples: [],\n  }));\n}\n\n/**\n * Build an A2A 0.3 AgentCard (discovery document) for a single assistant.\n *\n * `url` points at the assistant's JSON-RPC endpoint (also advertised via\n * `additionalInterfaces`). Skills are derived from the agent definition;\n * input/output modes default to text.\n */\nexport function buildAgentCardForAssistant(params: BuildAgentCardParams): AgentCard {\n  const { assistant, baseUrl } = params;\n  const jsonRpcUrl = `${baseUrl}${\n    params.jsonRpcPath ?? `/api/a2a/agents/${assistant.id}/jsonrpc`\n  }`;\n\n  return {\n    name: assistant.name,\n    description: assistant.description ?? \"\",\n    url: jsonRpcUrl,\n    protocolVersion: \"0.3.0\",\n    version: \"1.0.0\",\n    supportsAuthenticatedExtendedCard: true,\n    defaultInputModes: [\"text\"],\n    defaultOutputModes: [\"text\"],\n    capabilities: {\n      streaming: true,\n      pushNotifications: params.pushNotifications ?? true,\n      stateTransitionHistory: true,\n      extensions: [\n        {\n          uri: \"https://axiom-lattice.dev/a2a/extensions/push-notifications-experimental\",\n          description:\n            \"Push notifications are experimental and best-effort. Delivery is at-most-once; clients should poll tasks/get or use tasks/resubscribe for reliability.\",\n          params: {\n            experimental: true,\n            reliable: false,\n            delivery: \"at-most-once\",\n          },\n          required: false,\n        },\n      ],\n    },\n    skills: deriveAgentSkills(assistant),\n    additionalInterfaces: [{ transport: \"JSONRPC\", url: jsonRpcUrl }],\n    securitySchemes: {\n      bearer: {\n        type: \"http\",\n        scheme: \"Bearer\",\n        description: \"API key sent as an Authorization Bearer token\",\n      },\n      apiKeyHeader: {\n        type: \"apiKey\",\n        in: \"header\",\n        name: \"x-api-key\",\n        description: \"API key sent via the x-api-key header\",\n      },\n    },\n    security: [{ bearer: [] }, { apiKeyHeader: [] }],\n  };\n}\n","import type { FastifyRequest } from \"fastify\";\n\n/** First non-empty value from a possibly comma-separated / array header. */\nfunction firstHeader(value: string | string[] | undefined): string | undefined {\n  const raw = Array.isArray(value) ? value[0] : value;\n  if (typeof raw !== \"string\") return undefined;\n  const first = raw.split(\",\")[0]?.trim();\n  return first ? first : undefined;\n}\n\n/**\n * Resolve the externally visible base URL for a request.\n *\n * @param request - Incoming Fastify request.\n * @returns `scheme://host[:port]` using the first forwarded value when present.\n *\n * @remarks\n * TLS is normally terminated by a reverse proxy, so the gateway itself sees\n * `http`. Prefer `X-Forwarded-Proto`/`X-Forwarded-Host` (first value) and fall\n * back to the direct request. Only `http` and `https` schemes are accepted, so\n * a malformed forwarded header cannot produce an invalid or unsafe public URL.\n * Deployments that do not send these headers should configure their proxy or\n * provide an explicit public base URL.\n */\nexport function resolveRequestBaseUrl(request: FastifyRequest): string {\n  const forwardedProto = firstHeader(\n    request.headers[\"x-forwarded-proto\"],\n  )?.toLowerCase();\n  const protocol =\n    forwardedProto === \"http\" || forwardedProto === \"https\"\n      ? forwardedProto\n      : request.protocol;\n  const host = firstHeader(request.headers[\"x-forwarded-host\"]) ?? request.host;\n  return `${protocol}://${host}`;\n}\n"],"mappings":";AA+BO,SAAS,kBAAkB,WAAsC;AACtE,QAAM,UAAU,UAAU,iBAAiB,YAAY,OAAO,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC;AACpF,SAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,IACzB,IAAI,EAAE,QAAQ,EAAE;AAAA,IAChB,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE;AAAA,IAC5B,aAAa,EAAE,eAAe;AAAA,IAC9B,MAAM,CAAC;AAAA,IACP,UAAU,CAAC;AAAA,EACb,EAAE;AACJ;AASO,SAAS,2BAA2B,QAAyC;AAClF,QAAM,EAAE,WAAW,QAAQ,IAAI;AAC/B,QAAM,aAAa,GAAG,OAAO,GAC3B,OAAO,eAAe,mBAAmB,UAAU,EAAE,UACvD;AAEA,SAAO;AAAA,IACL,MAAM,UAAU;AAAA,IAChB,aAAa,UAAU,eAAe;AAAA,IACtC,KAAK;AAAA,IACL,iBAAiB;AAAA,IACjB,SAAS;AAAA,IACT,mCAAmC;AAAA,IACnC,mBAAmB,CAAC,MAAM;AAAA,IAC1B,oBAAoB,CAAC,MAAM;AAAA,IAC3B,cAAc;AAAA,MACZ,WAAW;AAAA,MACX,mBAAmB,OAAO,qBAAqB;AAAA,MAC/C,wBAAwB;AAAA,MACxB,YAAY;AAAA,QACV;AAAA,UACE,KAAK;AAAA,UACL,aACE;AAAA,UACF,QAAQ;AAAA,YACN,cAAc;AAAA,YACd,UAAU;AAAA,YACV,UAAU;AAAA,UACZ;AAAA,UACA,UAAU;AAAA,QACZ;AAAA,MACF;AAAA,IACF;AAAA,IACA,QAAQ,kBAAkB,SAAS;AAAA,IACnC,sBAAsB,CAAC,EAAE,WAAW,WAAW,KAAK,WAAW,CAAC;AAAA,IAChE,iBAAiB;AAAA,MACf,QAAQ;AAAA,QACN,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,cAAc;AAAA,QACZ,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,UAAU,CAAC,EAAE,QAAQ,CAAC,EAAE,GAAG,EAAE,cAAc,CAAC,EAAE,CAAC;AAAA,EACjD;AACF;;;AChGA,SAAS,YAAY,OAA0D;AAC7E,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,MAAM,CAAC,IAAI;AAC9C,MAAI,OAAO,QAAQ,SAAU,QAAO;AACpC,QAAM,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AACtC,SAAO,QAAQ,QAAQ;AACzB;AAgBO,SAAS,sBAAsB,SAAiC;AACrE,QAAM,iBAAiB;AAAA,IACrB,QAAQ,QAAQ,mBAAmB;AAAA,EACrC,GAAG,YAAY;AACf,QAAM,WACJ,mBAAmB,UAAU,mBAAmB,UAC5C,iBACA,QAAQ;AACd,QAAM,OAAO,YAAY,QAAQ,QAAQ,kBAAkB,CAAC,KAAK,QAAQ;AACzE,SAAO,GAAG,QAAQ,MAAM,IAAI;AAC9B;","names":[]}

package/dist/chunk-T2HIWZGP.mjs

@@ -0,0 +1,580 @@
+import {
+  PluginToolScopeError,
+  invokePluginTool
+} from "./chunk-XUWD4VKY.mjs";
+
+// src/routes/mcp-apps.ts
+import {
+  parseMcpUiRef
+} from "@axiom-lattice/protocols";
+import {
+  getSandboxPluginCatalog,
+  mcpManager,
+  resolvePluginConnections,
+  verifyMcpUiScope
+} from "@axiom-lattice/core";
+
+// src/services/mcp-ui/UiResourceResolver.ts
+import { createHash } from "crypto";
+var DEFAULT_TTL_MS = 5 * 60 * 1e3;
+function publicFieldsOf(payload) {
+  return {
+    mimeType: payload.mimeType,
+    html: payload.html,
+    ...payload.csp !== void 0 ? { csp: payload.csp } : {},
+    ...payload.permissions !== void 0 ? { permissions: payload.permissions } : {},
+    ...payload.prefersBorder !== void 0 ? { prefersBorder: payload.prefersBorder } : {}
+  };
+}
+var UiResourceResolver = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.inFlight = /* @__PURE__ */ new Map();
+  }
+  keyOf(ref) {
+    return ref.kind === "mcp" ? `mcp\0${ref.serverKey}\0${ref.resourceUri}` : `plugin\0${ref.pluginType}\0${ref.resource}`;
+  }
+  fullKey(tenantId, ref) {
+    return `${tenantId}\0${this.keyOf(ref)}`;
+  }
+  /**
+   * Resolve a UI resource for a tenant.
+   *
+   * @param tenantId Tenant scope.
+   * @param ref The fence ref.
+   * @returns Public UI resource payload (no cache metadata).
+   */
+  async resolve(tenantId, ref) {
+    const key = this.fullKey(tenantId, ref);
+    const ttl = this.deps.ttlMs ?? DEFAULT_TTL_MS;
+    const cached = await this.deps.store.get(key);
+    if (cached && Date.now() - cached.fetchedAt < ttl) return publicFieldsOf(cached);
+    const existing = this.inFlight.get(key);
+    if (existing) return existing;
+    const promise = this.fetchAndCache(tenantId, ref, key, cached);
+    this.inFlight.set(key, promise);
+    try {
+      return await promise;
+    } finally {
+      this.inFlight.delete(key);
+    }
+  }
+  /**
+   * Evict the cached entry for a tenant/ref.
+   *
+   * @param tenantId Tenant scope.
+   * @param ref The fence ref.
+   */
+  async invalidate(tenantId, ref) {
+    await this.deps.store.delete(this.fullKey(tenantId, ref));
+  }
+  /**
+   * Evict every cached plugin UI resource for a tenant.
+   *
+   * @param tenantId Tenant whose plugin UI resources to drop.
+   * @remarks Called when a tenant's plugin catalog changes so an edited
+   * `ui/*.html` is re-fetched instead of being served from the TTL cache
+   * (which is keyed by ref identity, not content).
+   */
+  async invalidateTenantPlugins(tenantId) {
+    await this.deps.store.deleteByPrefix(`${tenantId}\0plugin\0`);
+  }
+  async fetchAndCache(tenantId, ref, key, cached) {
+    try {
+      const fresh = ref.kind === "mcp" ? await this.deps.fetchMcp(tenantId, ref.serverKey, ref.resourceUri) : await this.deps.fetchPlugin(tenantId, ref.pluginType, ref.resource);
+      const entry = {
+        ...publicFieldsOf(fresh),
+        hash: createHash("sha256").update(fresh.html).digest("hex"),
+        fetchedAt: Date.now()
+      };
+      await this.deps.store.set(key, entry);
+      return publicFieldsOf(fresh);
+    } catch (error) {
+      if (cached) return { ...publicFieldsOf(cached), stale: true };
+      throw error;
+    }
+  }
+};
+
+// src/services/mcp-ui/McpUiResourceCacheStore.ts
+var InMemoryMcpUiResourceCacheStore = class {
+  constructor() {
+    this.map = /* @__PURE__ */ new Map();
+  }
+  async get(key) {
+    return this.map.get(key);
+  }
+  async set(key, entry) {
+    this.map.set(key, entry);
+  }
+  async delete(key) {
+    this.map.delete(key);
+  }
+  async deleteByPrefix(prefix) {
+    for (const key of this.map.keys()) {
+      if (key.startsWith(prefix)) this.map.delete(key);
+    }
+  }
+};
+
+// src/services/mcp-ui/buildCsp.ts
+var DEFAULT_CSP = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "media-src 'self' data:",
+  // Fonts are restricted to the document origin; declared `resourceDomains`
+  // are the only origins ever added (no `data:` — a base64-embedded font must
+  // be served from a declared origin).
+  "font-src 'self'",
+  "object-src 'none'",
+  "connect-src 'none'",
+  "frame-src 'none'",
+  "base-uri 'self'"
+].join("; ");
+var ORIGIN_PATTERN = /^(https?|wss?):\/\/(\*\.)?[^\s;,'"*]+$/;
+function declaredOrigins(domains) {
+  if (!Array.isArray(domains)) return [];
+  return domains.filter((domain) => typeof domain === "string" && ORIGIN_PATTERN.test(domain));
+}
+function buildCsp(csp) {
+  if (!csp) return DEFAULT_CSP;
+  const resourceOrigins = declaredOrigins(csp.resourceDomains);
+  const resource = resourceOrigins.join(" ");
+  const withResourceOrigins = (base) => resource ? `${base} ${resource}` : base;
+  const img = ["'self'", "data:", ...resourceOrigins].join(" ");
+  const connect = declaredOrigins(csp.connectDomains);
+  const frame = declaredOrigins(csp.frameDomains);
+  const baseUri = declaredOrigins(csp.baseUriDomains);
+  const parts = [
+    "default-src 'none'",
+    withResourceOrigins("script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'"),
+    withResourceOrigins("style-src 'self' 'unsafe-inline'"),
+    `img-src ${img}`,
+    `media-src ${["'self'", "data:", ...resourceOrigins].join(" ")}`,
+    withResourceOrigins("font-src 'self'"),
+    "object-src 'none'",
+    `connect-src ${connect.length ? connect.join(" ") : "'none'"}`,
+    `frame-src ${frame.length ? frame.join(" ") : "'none'"}`,
+    `base-uri ${baseUri.length ? baseUri.join(" ") : "'self'"}`
+  ];
+  return parts.join("; ");
+}
+
+// src/services/mcp-ui/sandboxPage.ts
+var DEFAULT_CSP_LITERAL = JSON.stringify(buildCsp(void 0));
+var SANDBOX_HTML = `<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1" />
+    <title>MCP App Sandbox</title>
+    <style>html, body { margin: 0; height: 100%; }</style>
+  </head>
+  <body>
+    <script>
+      (function () {
+        var HOST_READY = "ui/notifications/sandbox-proxy-ready";
+        var RESOURCE_READY = "ui/notifications/sandbox-resource-ready";
+        var CONTROL_PREFIX = "ui/notifications/sandbox-";
+        var DEFAULT_CSP = ${DEFAULT_CSP_LITERAL};
+
+        function withCsp(html, csp) {
+          var policy = typeof csp === "string" && csp.length > 0 ? csp : DEFAULT_CSP;
+          var escaped = policy.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
+          var meta = '<meta http-equiv="Content-Security-Policy" content="' + escaped + '">';
+          // Insert at the very start (after an optional doctype) so the parser
+          // places the meta in the implicit head. Never search for a literal
+          // <head>: a resource could hide a decoy inside a comment/string and
+          // slip its real head past the splice.
+          var doctype = /^\\s*<!doctype[^>]*>/i.exec(html);
+          if (doctype) {
+            return html.slice(0, doctype[0].length) + meta + html.slice(doctype[0].length);
+          }
+          return meta + html;
+        }
+
+        // Size reporter injected into every View document. The host renders the
+        // View inside an opaque-origin iframe it cannot measure, so auto-height
+        // only happens when the View posts ui/notifications/size-changed. Most
+        // hand-written plugin apps never do; this script makes every app report
+        // its own content size. It only measures and postMessages \u2014 it never
+        // mutates the app's DOM.
+        var SIZE_REPORTER = [
+          "(function(){",
+          "function send(){",
+          "try{",
+          "var d=document.documentElement,b=document.body;",
+          "var w=Math.ceil(Math.max(d?d.scrollWidth:0,b?b.scrollWidth:0));",
+          "var h=Math.ceil(Math.max(d?d.scrollHeight:0,b?b.scrollHeight:0));",
+          "window.parent.postMessage({jsonrpc:'2.0',method:'ui/notifications/size-changed',params:{width:w,height:h}},'*');",
+          "}catch(e){}",
+          "}",
+          "send();",
+          "window.addEventListener('load',send);",
+          "if(typeof ResizeObserver!=='undefined'){",
+          "var ro=new ResizeObserver(send);",
+          "ro.observe(document.documentElement);",
+          "if(document.body)ro.observe(document.body);",
+          "}else{window.addEventListener('resize',send);}",
+          "})();"
+        ].join("");
+
+        function withSizeReporter(html) {
+          // Split the closing tag so this template literal never contains a
+          // literal script terminator that would end the sandbox page's own
+          // script block during HTML parsing.
+          var tag = "<scr" + "ipt>" + SIZE_REPORTER + "<" + "/scr" + "ipt>";
+          var lower = html.toLowerCase();
+          var bodyEnd = lower.lastIndexOf("</body>");
+          if (bodyEnd >= 0) return html.slice(0, bodyEnd) + tag + html.slice(bodyEnd);
+          return html + tag;
+        }
+
+        var inner = null;
+
+        window.parent.postMessage({ jsonrpc: "2.0", method: HOST_READY, params: {} }, "*");
+
+        window.addEventListener("message", function (event) {
+          if (event.source !== window.parent) return;
+          var data = event.data;
+          if (!data || typeof data !== "object") return;
+
+          if (data.method === RESOURCE_READY) {
+            var params = data.params || {};
+            if (inner && inner.parentNode) inner.parentNode.removeChild(inner);
+            inner = document.createElement("iframe");
+            inner.setAttribute("sandbox", params.sandbox || "allow-scripts");
+            inner.setAttribute("srcdoc", withCsp(withSizeReporter(String(params.html || "")), params.csp));
+            inner.style.cssText = "width:100%;height:100%;border:0;display:block";
+            document.body.appendChild(inner);
+            return;
+          }
+
+          if (typeof data.method === "string" && data.method.indexOf(CONTROL_PREFIX) === 0) return;
+          if (inner && inner.contentWindow) inner.contentWindow.postMessage(data, "*");
+        });
+
+        window.addEventListener("message", function (event) {
+          if (inner && event.source === inner.contentWindow) {
+            var data = event.data;
+            if (data && typeof data === "object" && typeof data.method === "string"
+              && data.method.indexOf(CONTROL_PREFIX) === 0) return;
+            window.parent.postMessage(event.data, "*");
+          }
+        });
+      })();
+    </script>
+  </body>
+</html>
+`;
+
+// src/services/plugins/tenantPluginResolver.ts
+import { listTenantPlugins } from "@axiom-lattice/core";
+async function resolveTenantPluginByType(tenantId, type) {
+  return (await listTenantPlugins(tenantId)).find((p) => p.meta.type === type);
+}
+
+// src/routes/mcp-apps.ts
+var SANDBOX_HTML_CONTENT_TYPE = "text/html; charset=utf-8";
+var PluginMethodNotSupportedError = class extends Error {
+  /**
+   * @param method - Unsupported JSON-RPC method.
+   */
+  constructor(method) {
+    super(`plugin backend does not support ${method}`);
+    this.name = "PluginMethodNotSupportedError";
+  }
+};
+var McpAppScopeError = class extends Error {
+  /**
+   * @param status - HTTP status to return.
+   * @param code - Stable machine-readable denial code.
+   */
+  constructor(status, code) {
+    super(code);
+    this.status = status;
+    this.code = code;
+    this.name = "McpAppScopeError";
+  }
+};
+function denyScope(status, code, detail) {
+  console.warn(JSON.stringify({ event: "mcp-apps:scope-denied", ...detail, code }));
+  return new McpAppScopeError(status, code);
+}
+var ALLOWED_METHODS = /* @__PURE__ */ new Set(["tools/call", "tools/list", "resources/read"]);
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function makeMcpAppHandlers(deps) {
+  return {
+    /**
+     * Resolve the `mcp_app` UI resource for a parsed ref.
+     *
+     * @param tenantId Tenant scope.
+     * @param rawRef Untrusted ref payload.
+     * @returns The resource payload plus a ready-to-use `cspPolicy` string
+     * ({@link buildCsp}, always non-empty), or a 400/502 error envelope.
+     */
+    async resource(tenantId, rawRef) {
+      const ref = parseMcpUiRef(rawRef);
+      if (!ref) return { status: 400, body: { error: "INVALID_REF" } };
+      if (ref.kind === "plugin" && ref.pluginType === "") {
+        return { status: 400, body: { error: "INVALID_REF" } };
+      }
+      try {
+        const payload = await deps.resolveUiResource(tenantId, ref);
+        return { status: 200, body: { ...payload, cspPolicy: buildCsp(payload.csp) } };
+      } catch (error) {
+        console.warn(JSON.stringify({
+          event: "mcp-apps:resource-failed",
+          tenantId,
+          kind: ref.kind,
+          error: error instanceof Error ? error.message : String(error)
+        }));
+        return { status: 502, body: { error: "RESOURCE_UNAVAILABLE" } };
+      }
+    },
+    /**
+     * Proxy an allow-listed JSON-RPC method for a parsed ref.
+     *
+     * @param tenantId Tenant scope.
+     * @param rawRef Untrusted ref payload.
+     * @param method JSON-RPC method name.
+     * @param params JSON-RPC params.
+     * @param context Request-scoped run context forwarded to `tools/call`.
+     * @returns The backend result, or a 400/403/502 error envelope.
+     */
+    async rpc(tenantId, rawRef, method, params, context) {
+      const ref = parseMcpUiRef(rawRef);
+      if (!ref) return { status: 400, body: { error: "INVALID_REF" } };
+      if (!ALLOWED_METHODS.has(method)) return { status: 403, body: { error: "METHOD_NOT_ALLOWED" } };
+      try {
+        if (method === "tools/call") {
+          const name = typeof params.name === "string" ? params.name : "";
+          if (name === "") return { status: 400, body: { error: "INVALID_PARAMS" } };
+          if ("pluginType" in ref && ref.pluginType === "") {
+            return { status: 400, body: { error: "INVALID_REF" } };
+          }
+          return {
+            status: 200,
+            body: await deps.callTool(tenantId, ref, name, asRecord(params.arguments) ?? {}, context)
+          };
+        }
+        if (method === "resources/read") {
+          const uri = typeof params.uri === "string" ? params.uri : "";
+          if (uri === "") return { status: 400, body: { error: "INVALID_PARAMS" } };
+          return { status: 200, body: await deps.readResource(tenantId, ref, uri) };
+        }
+        return { status: 200, body: { tools: await deps.listTools(tenantId, ref) } };
+      } catch (error) {
+        if (error instanceof McpAppScopeError) {
+          return { status: error.status, body: { error: error.code } };
+        }
+        if (error instanceof PluginToolScopeError) {
+          return { status: 403, body: { error: "PLUGIN_TOOL_SCOPE" } };
+        }
+        if (error instanceof PluginMethodNotSupportedError) {
+          return { status: 403, body: { error: "PLUGIN_METHOD_UNSUPPORTED" } };
+        }
+        const context2 = { tenantId, kind: ref.kind, method };
+        if (method === "resources/read") context2.uri = typeof params.uri === "string" ? params.uri : "";
+        if (method === "tools/call") context2.name = typeof params.name === "string" ? params.name : "";
+        console.warn(JSON.stringify({
+          event: "mcp-apps:rpc-failed",
+          ...context2,
+          error: error instanceof Error ? error.message : String(error)
+        }));
+        return { status: 502, body: { error: "RPC_FAILED" } };
+      }
+    }
+  };
+}
+async function fetchPluginUiResource(backend, tenantId, pluginType, resource) {
+  const plugin = await backend.resolvePlugin(tenantId, pluginType);
+  if (!plugin) throw new Error(`plugin "${pluginType}" not found`);
+  const tool = (plugin.meta.tools ?? []).find((t) => t.ui?.resource === resource);
+  if (!tool?.ui) throw new Error(`plugin "${pluginType}" has no tool declaring ui resource "${resource}"`);
+  const inline = plugin.meta.uiResources?.[resource];
+  if (inline) {
+    return {
+      mimeType: inline.mimeType ?? "text/html;profile=mcp-app",
+      html: inline.html,
+      csp: inline.csp ?? tool.ui.csp,
+      permissions: tool.ui.permissions,
+      prefersBorder: tool.ui.prefersBorder
+    };
+  }
+  const html = await backend.catalog.readPluginFile(tenantId, pluginType, resource);
+  return {
+    mimeType: "text/html",
+    html,
+    csp: tool.ui.csp,
+    permissions: tool.ui.permissions,
+    prefersBorder: tool.ui.prefersBorder
+  };
+}
+async function callPluginTool(backend, tenantId, ref, name, args, context, deps) {
+  const scope = ref.scope ? (deps?.verifyScope ?? verifyMcpUiScope)(ref.scope) : null;
+  if (ref.scope && !scope) {
+    throw denyScope(403, "SCOPE_INVALID", {
+      tenantId,
+      pluginType: ref.pluginType,
+      tool: name
+    });
+  }
+  if (scope) {
+    const mismatched = scope.tid !== tenantId || scope.plugin !== ref.pluginType || scope.resource !== ref.resource;
+    if (mismatched) {
+      throw denyScope(403, "SCOPE_MISMATCH", {
+        tenantId,
+        pluginType: ref.pluginType,
+        tool: name,
+        jti: scope.jti,
+        threadId: scope.thid
+      });
+    }
+  }
+  const manifest = await backend.catalog.getValidatedManifest(tenantId, ref.pluginType);
+  const rawConnectionKey = args.connectionKey;
+  const explicit = typeof rawConnectionKey === "string" ? rawConnectionKey : void 0;
+  const scoped = scope?.ck;
+  const connectionRelevant = Boolean(manifest?.connection) || scoped !== void 0;
+  if (connectionRelevant && (explicit !== void 0 ? explicit !== scoped : rawConnectionKey !== void 0)) {
+    throw denyScope(403, "CONNECTION_NOT_ALLOWED", {
+      tenantId,
+      pluginType: ref.pluginType,
+      tool: name,
+      jti: scope?.jti,
+      threadId: scope?.thid
+    });
+  }
+  let connection;
+  let connectionKey;
+  if (scoped !== void 0) {
+    const resolveConnections = deps?.resolveConnections ?? resolvePluginConnections;
+    const resolved = await resolveConnections(
+      ref.pluginType,
+      { connections: [scoped] },
+      { tenantId }
+    );
+    if (resolved.length === 0) {
+      throw denyScope(403, "CONNECTION_NOT_ALLOWED", {
+        tenantId,
+        pluginType: ref.pluginType,
+        tool: name,
+        jti: scope?.jti,
+        threadId: scope?.thid
+      });
+    }
+    connection = resolved[0].config;
+    connectionKey = resolved[0].key;
+  }
+  if (manifest?.connection && !connectionKey) {
+    throw denyScope(409, "CONNECTION_REQUIRED", {
+      tenantId,
+      pluginType: ref.pluginType,
+      tool: name,
+      jti: scope?.jti,
+      threadId: scope?.thid
+    });
+  }
+  const identity = scope ? {
+    workspaceId: scope.wid,
+    projectId: scope.pid,
+    threadId: scope.thid,
+    assistantId: scope.aid
+  } : {
+    workspaceId: context?.workspaceId,
+    projectId: context?.projectId
+  };
+  return invokePluginTool(backend, tenantId, ref.pluginType, name, args, {
+    ...identity,
+    ...connection === void 0 ? {} : { connection }
+  });
+}
+function createDefaultPluginBackend() {
+  return {
+    resolvePlugin: (tenantId, type) => resolveTenantPluginByType(tenantId, type),
+    catalog: {
+      readPluginFile: (tenantId, pluginType, relPath) => getSandboxPluginCatalog().readPluginFile(tenantId, pluginType, relPath),
+      getValidatedManifest: (tenantId, pluginType) => getSandboxPluginCatalog().getValidatedManifest(tenantId, pluginType),
+      getExecutor: () => getSandboxPluginCatalog().getExecutor()
+    }
+  };
+}
+var uiResourceResolverSingleton;
+function getMcpUiResourceResolver() {
+  return uiResourceResolverSingleton;
+}
+function resolveMcpAppDeps(pluginBackend = createDefaultPluginBackend()) {
+  const uiResourceResolver = new UiResourceResolver({
+    store: new InMemoryMcpUiResourceCacheStore(),
+    fetchMcp: (tenantId, serverKey, resourceUri) => mcpManager.readUiResource(tenantId, serverKey, resourceUri),
+    fetchPlugin: (tenantId, pluginType, resource) => fetchPluginUiResource(pluginBackend, tenantId, pluginType, resource)
+  });
+  uiResourceResolverSingleton = uiResourceResolver;
+  return {
+    resolveUiResource: (tenantId, ref) => uiResourceResolver.resolve(tenantId, ref),
+    callTool: (tenantId, ref, name, args, context) => ref.kind === "mcp" ? mcpManager.callServerTool(tenantId, ref.serverKey, name, args) : callPluginTool(pluginBackend, tenantId, ref, name, args, context),
+    // Plugin refs reach these only after `tools/call`; the handler treats the
+    // rejection as an unsupported method (403). The branches are live because
+    // the pure handler deliberately delegates method policy to the deps.
+    readResource: (tenantId, ref, uri) => ref.kind === "mcp" ? mcpManager.readServerResource(tenantId, ref.serverKey, uri) : Promise.reject(new PluginMethodNotSupportedError("resources/read")),
+    listTools: (tenantId, ref) => ref.kind === "mcp" ? mcpManager.getAvailableTools(tenantId, ref.serverKey) : Promise.reject(new PluginMethodNotSupportedError("tools/list"))
+  };
+}
+function firstHeader(request, name) {
+  const header = request.headers[name];
+  return Array.isArray(header) ? header[0] : header;
+}
+function tenantOf(request) {
+  const user = request.user;
+  return user?.tenantId ?? firstHeader(request, "x-tenant-id") ?? "default";
+}
+function runContextOf(request) {
+  return {
+    tenantId: tenantOf(request),
+    workspaceId: firstHeader(request, "x-workspace-id"),
+    projectId: firstHeader(request, "x-project-id")
+  };
+}
+function registerMcpAppRoutes(fastify, deps = resolveMcpAppDeps()) {
+  const handlers = makeMcpAppHandlers(deps);
+  fastify.get("/mcp-apps/sandbox.html", async (_request, reply) => {
+    return reply.header("content-type", SANDBOX_HTML_CONTENT_TYPE).header("x-content-type-options", "nosniff").header("cache-control", "no-store").send(SANDBOX_HTML);
+  });
+  fastify.post("/api/mcp-apps/resource", async (request, reply) => {
+    const body = asRecord(request.body) ?? {};
+    const result = await handlers.resource(tenantOf(request), body.ref);
+    return reply.code(result.status).send(result.body);
+  });
+  fastify.post("/api/mcp-apps/rpc", async (request, reply) => {
+    const body = asRecord(request.body) ?? {};
+    const params = asRecord(body.params) ?? {};
+    const context = runContextOf(request);
+    const result = await handlers.rpc(
+      context.tenantId,
+      body.ref,
+      String(body.method ?? ""),
+      params,
+      context
+    );
+    return reply.code(result.status).send(result.body);
+  });
+}
+
+export {
+  listTenantPlugins,
+  resolveTenantPluginByType,
+  PluginMethodNotSupportedError,
+  McpAppScopeError,
+  makeMcpAppHandlers,
+  fetchPluginUiResource,
+  callPluginTool,
+  getMcpUiResourceResolver,
+  resolveMcpAppDeps,
+  registerMcpAppRoutes
+};
+//# sourceMappingURL=chunk-T2HIWZGP.mjs.map