@casys/mcp-bridge 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/esm/_dnt.shims.d.ts +2 -0
  2. package/esm/_dnt.shims.d.ts.map +1 -0
  3. package/esm/_dnt.shims.js +57 -0
  4. package/esm/adapters/base-adapter.d.ts +25 -0
  5. package/esm/adapters/base-adapter.d.ts.map +1 -0
  6. package/esm/adapters/base-adapter.js +86 -0
  7. package/esm/adapters/line/adapter.d.ts +11 -0
  8. package/esm/adapters/line/adapter.d.ts.map +1 -0
  9. package/esm/adapters/line/adapter.js +10 -0
  10. package/esm/adapters/line/types.d.ts +25 -0
  11. package/esm/adapters/line/types.d.ts.map +1 -0
  12. package/esm/adapters/line/types.js +4 -0
  13. package/esm/adapters/telegram/adapter.d.ts +11 -0
  14. package/esm/adapters/telegram/adapter.d.ts.map +1 -0
  15. package/esm/adapters/telegram/adapter.js +10 -0
  16. package/esm/adapters/telegram/platform-adapter.d.ts +40 -0
  17. package/esm/adapters/telegram/platform-adapter.d.ts.map +1 -0
  18. package/esm/adapters/telegram/platform-adapter.js +214 -0
  19. package/esm/adapters/telegram/sdk-bridge.d.ts +8 -0
  20. package/esm/adapters/telegram/sdk-bridge.d.ts.map +1 -0
  21. package/esm/adapters/telegram/sdk-bridge.js +22 -0
  22. package/esm/adapters/telegram/types.d.ts +93 -0
  23. package/esm/adapters/telegram/types.d.ts.map +1 -0
  24. package/esm/adapters/telegram/types.js +6 -0
  25. package/esm/client/bridge.js +424 -0
  26. package/esm/core/adapter.d.ts +88 -0
  27. package/esm/core/adapter.d.ts.map +1 -0
  28. package/esm/core/adapter.js +10 -0
  29. package/esm/core/bridge-client.d.ts +77 -0
  30. package/esm/core/bridge-client.d.ts.map +1 -0
  31. package/esm/core/bridge-client.js +275 -0
  32. package/esm/core/message-router.d.ts +71 -0
  33. package/esm/core/message-router.d.ts.map +1 -0
  34. package/esm/core/message-router.js +187 -0
  35. package/esm/core/protocol.d.ts +116 -0
  36. package/esm/core/protocol.d.ts.map +1 -0
  37. package/esm/core/protocol.js +203 -0
  38. package/esm/core/resource-resolver.d.ts +27 -0
  39. package/esm/core/resource-resolver.d.ts.map +1 -0
  40. package/esm/core/resource-resolver.js +85 -0
  41. package/esm/core/transport.d.ts +46 -0
  42. package/esm/core/transport.d.ts.map +1 -0
  43. package/esm/core/transport.js +85 -0
  44. package/esm/core/types.d.ts +187 -0
  45. package/esm/core/types.d.ts.map +1 -0
  46. package/esm/core/types.js +35 -0
  47. package/esm/mod.d.ts +36 -0
  48. package/esm/mod.d.ts.map +1 -0
  49. package/esm/mod.js +33 -0
  50. package/esm/package.json +3 -0
  51. package/esm/resource-server/csp.d.ts +36 -0
  52. package/esm/resource-server/csp.d.ts.map +1 -0
  53. package/esm/resource-server/csp.js +36 -0
  54. package/esm/resource-server/injector.d.ts +18 -0
  55. package/esm/resource-server/injector.d.ts.map +1 -0
  56. package/esm/resource-server/injector.js +39 -0
  57. package/esm/resource-server/server.d.ts +107 -0
  58. package/esm/resource-server/server.d.ts.map +1 -0
  59. package/esm/resource-server/server.js +483 -0
  60. package/esm/resource-server/session.d.ts +60 -0
  61. package/esm/resource-server/session.d.ts.map +1 -0
  62. package/esm/resource-server/session.js +86 -0
  63. package/esm/resource-server/telegram-auth.d.ts +45 -0
  64. package/esm/resource-server/telegram-auth.d.ts.map +1 -0
  65. package/esm/resource-server/telegram-auth.js +161 -0
  66. package/package.json +31 -0
  67. package/script/_dnt.shims.d.ts +2 -0
  68. package/script/_dnt.shims.d.ts.map +1 -0
  69. package/script/_dnt.shims.js +60 -0
  70. package/script/adapters/base-adapter.d.ts +25 -0
  71. package/script/adapters/base-adapter.d.ts.map +1 -0
  72. package/script/adapters/base-adapter.js +113 -0
  73. package/script/adapters/line/adapter.d.ts +11 -0
  74. package/script/adapters/line/adapter.d.ts.map +1 -0
  75. package/script/adapters/line/adapter.js +14 -0
  76. package/script/adapters/line/types.d.ts +25 -0
  77. package/script/adapters/line/types.d.ts.map +1 -0
  78. package/script/adapters/line/types.js +5 -0
  79. package/script/adapters/telegram/adapter.d.ts +11 -0
  80. package/script/adapters/telegram/adapter.d.ts.map +1 -0
  81. package/script/adapters/telegram/adapter.js +14 -0
  82. package/script/adapters/telegram/platform-adapter.d.ts +40 -0
  83. package/script/adapters/telegram/platform-adapter.d.ts.map +1 -0
  84. package/script/adapters/telegram/platform-adapter.js +241 -0
  85. package/script/adapters/telegram/sdk-bridge.d.ts +8 -0
  86. package/script/adapters/telegram/sdk-bridge.d.ts.map +1 -0
  87. package/script/adapters/telegram/sdk-bridge.js +48 -0
  88. package/script/adapters/telegram/types.d.ts +93 -0
  89. package/script/adapters/telegram/types.d.ts.map +1 -0
  90. package/script/adapters/telegram/types.js +7 -0
  91. package/script/client/bridge.js +424 -0
  92. package/script/core/adapter.d.ts +88 -0
  93. package/script/core/adapter.d.ts.map +1 -0
  94. package/script/core/adapter.js +11 -0
  95. package/script/core/bridge-client.d.ts +77 -0
  96. package/script/core/bridge-client.d.ts.map +1 -0
  97. package/script/core/bridge-client.js +302 -0
  98. package/script/core/message-router.d.ts +71 -0
  99. package/script/core/message-router.d.ts.map +1 -0
  100. package/script/core/message-router.js +191 -0
  101. package/script/core/protocol.d.ts +116 -0
  102. package/script/core/protocol.d.ts.map +1 -0
  103. package/script/core/protocol.js +230 -0
  104. package/script/core/resource-resolver.d.ts +27 -0
  105. package/script/core/resource-resolver.d.ts.map +1 -0
  106. package/script/core/resource-resolver.js +89 -0
  107. package/script/core/transport.d.ts +46 -0
  108. package/script/core/transport.d.ts.map +1 -0
  109. package/script/core/transport.js +112 -0
  110. package/script/core/types.d.ts +187 -0
  111. package/script/core/types.d.ts.map +1 -0
  112. package/script/core/types.js +38 -0
  113. package/script/mod.d.ts +36 -0
  114. package/script/mod.d.ts.map +1 -0
  115. package/script/mod.js +76 -0
  116. package/script/package.json +3 -0
  117. package/script/resource-server/csp.d.ts +36 -0
  118. package/script/resource-server/csp.d.ts.map +1 -0
  119. package/script/resource-server/csp.js +39 -0
  120. package/script/resource-server/injector.d.ts +18 -0
  121. package/script/resource-server/injector.d.ts.map +1 -0
  122. package/script/resource-server/injector.js +42 -0
  123. package/script/resource-server/server.d.ts +107 -0
  124. package/script/resource-server/server.d.ts.map +1 -0
  125. package/script/resource-server/server.js +487 -0
  126. package/script/resource-server/session.d.ts +60 -0
  127. package/script/resource-server/session.d.ts.map +1 -0
  128. package/script/resource-server/session.js +90 -0
  129. package/script/resource-server/telegram-auth.d.ts +45 -0
  130. package/script/resource-server/telegram-auth.d.ts.map +1 -0
  131. package/script/resource-server/telegram-auth.js +164 -0
@@ -0,0 +1,187 @@
1
+ /**
2
+ * Core types for the MCP Apps Bridge protocol.
3
+ *
4
+ * Defines the message envelope, resource URIs, adapter configuration,
5
+ * and tool declarations used throughout the bridge.
6
+ */
7
+ /** A JSON-RPC 2.0 request sent between host and MCP App. */
8
+ export interface McpAppsRequest {
9
+ readonly jsonrpc: "2.0";
10
+ readonly id: string | number;
11
+ readonly method: string;
12
+ readonly params?: Record<string, unknown>;
13
+ }
14
+ /** A JSON-RPC 2.0 success response. */
15
+ export interface McpAppsResponse {
16
+ readonly jsonrpc: "2.0";
17
+ readonly id: string | number;
18
+ readonly result: unknown;
19
+ }
20
+ /** A JSON-RPC 2.0 error response. */
21
+ export interface McpAppsErrorResponse {
22
+ readonly jsonrpc: "2.0";
23
+ readonly id: string | number | null;
24
+ readonly error: {
25
+ readonly code: number;
26
+ readonly message: string;
27
+ readonly data?: unknown;
28
+ };
29
+ }
30
+ /** A JSON-RPC 2.0 notification (no id, no response expected). */
31
+ export interface McpAppsNotification {
32
+ readonly jsonrpc: "2.0";
33
+ readonly method: string;
34
+ readonly params?: Record<string, unknown>;
35
+ }
36
+ /** Union of all JSON-RPC message shapes. */
37
+ export type McpAppsMessage = McpAppsRequest | McpAppsResponse | McpAppsErrorResponse | McpAppsNotification;
38
+ /** Parsed representation of a `ui://` resource URI. */
39
+ export interface ResourceUri {
40
+ /** The raw URI string, e.g. `ui://my-app/index.html`. */
41
+ readonly raw: string;
42
+ /** Server / app identifier (host portion of the URI). */
43
+ readonly server: string;
44
+ /** Path within the app, e.g. `/index.html`. */
45
+ readonly path: string;
46
+ /** Optional query parameters. */
47
+ readonly query: Record<string, string>;
48
+ }
49
+ /** Platform-specific configuration supplied when initializing an adapter. */
50
+ export interface AdapterConfig {
51
+ /** Base URL where the resource server is reachable by the client. */
52
+ readonly resourceBaseUrl: string;
53
+ /** Optional platform-specific settings (e.g. Telegram bot token). */
54
+ readonly platformOptions?: Record<string, unknown>;
55
+ }
56
+ /** Global bridge options shared across all adapters. */
57
+ export interface BridgeOptions {
58
+ /** Port for the local resource server. Defaults to 0 (OS-assigned). */
59
+ readonly resourceServerPort?: number;
60
+ /** Origin allowlist for CORS. Defaults to `["*"]`. */
61
+ readonly allowedOrigins?: readonly string[];
62
+ /** Enable debug logging. */
63
+ readonly debug?: boolean;
64
+ }
65
+ /** UI metadata attached to an MCP tool via `_meta`. */
66
+ export interface McpToolUiMeta {
67
+ /** Resource URI pointing to the interactive UI for this tool. */
68
+ readonly resourceUri: string;
69
+ /** Optional human-readable label for the UI. */
70
+ readonly label?: string;
71
+ /** Optional width hint in pixels. */
72
+ readonly width?: number;
73
+ /** Optional height hint in pixels. */
74
+ readonly height?: number;
75
+ }
76
+ /** CSP (Content Security Policy) metadata for an MCP App resource. */
77
+ export interface McpToolUiCsp {
78
+ /** Allowed script-src origins. */
79
+ readonly scriptSources?: readonly string[];
80
+ /** Allowed connect-src origins. */
81
+ readonly connectSources?: readonly string[];
82
+ /** Allowed frame-ancestors origins. */
83
+ readonly frameAncestors?: readonly string[];
84
+ }
85
+ /** Iframe sandbox permission flags that an MCP App can request. */
86
+ export type McpAppPermission = "allow-downloads" | "allow-forms" | "allow-modals" | "allow-popups" | "allow-same-origin" | "allow-scripts" | "camera" | "microphone" | "geolocation" | "clipboard-read" | "clipboard-write";
87
+ /** An MCP tool declaration that carries `_meta.ui`. */
88
+ export interface McpToolDeclaration {
89
+ readonly name: string;
90
+ readonly description?: string;
91
+ readonly inputSchema: Record<string, unknown>;
92
+ readonly _meta?: {
93
+ readonly ui?: McpToolUiMeta & {
94
+ /** CSP directives for the UI resource. */
95
+ readonly csp?: McpToolUiCsp;
96
+ /** Additional sandbox permissions requested by the app. */
97
+ readonly permissions?: readonly McpAppPermission[];
98
+ };
99
+ };
100
+ }
101
+ /**
102
+ * Well-known JSON-RPC method names used in the MCP Apps protocol (SEP-1865).
103
+ *
104
+ * App -> Host requests.
105
+ */
106
+ export declare const McpAppsMethod: {
107
+ readonly UI_INITIALIZE: "ui/initialize";
108
+ readonly UI_NOTIFICATIONS_INITIALIZED: "ui/notifications/initialized";
109
+ readonly TOOLS_CALL: "tools/call";
110
+ readonly RESOURCES_READ: "resources/read";
111
+ readonly UI_OPEN_LINK: "ui/open-link";
112
+ readonly UI_MESSAGE: "ui/message";
113
+ readonly UI_UPDATE_MODEL_CONTEXT: "ui/update-model-context";
114
+ readonly UI_REQUEST_DISPLAY_MODE: "ui/request-display-mode";
115
+ readonly NOTIFICATIONS_MESSAGE: "notifications/message";
116
+ readonly UI_TOOL_INPUT: "ui/notifications/tool-input";
117
+ readonly UI_TOOL_INPUT_PARTIAL: "ui/notifications/tool-input-partial";
118
+ readonly UI_TOOL_RESULT: "ui/notifications/tool-result";
119
+ readonly UI_TOOL_CANCELLED: "ui/notifications/tool-cancelled";
120
+ readonly UI_HOST_CONTEXT_CHANGED: "ui/notifications/host-context-changed";
121
+ readonly UI_SIZE_CHANGED: "ui/notifications/size-changed";
122
+ readonly UI_RESOURCE_TEARDOWN: "ui/resource-teardown";
123
+ };
124
+ /** Dimensions of the container rendering the MCP App. */
125
+ export interface ContainerDimensions {
126
+ readonly width?: number;
127
+ readonly maxWidth?: number;
128
+ readonly height?: number;
129
+ readonly maxHeight?: number;
130
+ }
131
+ /** Safe area insets (e.g. notch, status bar) from the platform. */
132
+ export interface SafeAreaInsets {
133
+ readonly top: number;
134
+ readonly right: number;
135
+ readonly bottom: number;
136
+ readonly left: number;
137
+ }
138
+ /** Host theme and style information provided to the MCP App. */
139
+ export interface HostContextStyles {
140
+ /** CSS custom properties for theming (e.g. `--color-background-primary`). */
141
+ readonly variables?: Record<string, string>;
142
+ /** Optional CSS with font declarations. */
143
+ readonly css?: {
144
+ readonly fonts?: string;
145
+ };
146
+ }
147
+ /**
148
+ * Host context provided to an MCP App during `ui/initialize`.
149
+ *
150
+ * Contains theme, dimensions, locale, and other environment info
151
+ * needed for the app to adapt to its container.
152
+ */
153
+ export interface HostContext {
154
+ readonly theme: "light" | "dark";
155
+ readonly styles?: HostContextStyles;
156
+ readonly containerDimensions?: ContainerDimensions;
157
+ readonly platform?: "web" | "desktop" | "mobile";
158
+ readonly locale?: string;
159
+ readonly timeZone?: string;
160
+ readonly safeAreaInsets?: SafeAreaInsets;
161
+ }
162
+ /** Display mode an MCP App can request via `ui/request-display-mode`. */
163
+ export type DisplayMode = "inline" | "fullscreen" | "pip";
164
+ /**
165
+ * Capabilities the host exposes to the MCP App during `ui/initialize`.
166
+ */
167
+ export interface HostCapabilities {
168
+ readonly serverTools?: {
169
+ readonly listChanged?: boolean;
170
+ };
171
+ readonly serverResources?: {
172
+ readonly listChanged?: boolean;
173
+ };
174
+ readonly logging?: Record<string, never>;
175
+ readonly openLinks?: Record<string, never>;
176
+ }
177
+ /**
178
+ * Lifecycle events generated by platform adapters.
179
+ *
180
+ * The bridge translates these into MCP Apps notifications
181
+ * (e.g. `ui/notifications/host-context-changed`).
182
+ */
183
+ export interface LifecycleEvent {
184
+ readonly type: "theme-changed" | "viewport-changed" | "activated" | "deactivated" | "teardown";
185
+ readonly reason?: string;
186
+ }
187
+ //# sourceMappingURL=types.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/core/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,KAAK,EAAE;QACd,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAED,iEAAiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GACtB,cAAc,GACd,eAAe,GACf,oBAAoB,GACpB,mBAAmB,CAAC;AAMxB,uDAAuD;AACvD,MAAM,WAAW,WAAW;IAC1B,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,+CAA+C;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACxC;AAMD,6EAA6E;AAC7E,MAAM,WAAW,aAAa;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,qEAAqE;IACrE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpD;AAED,wDAAwD;AACxD,MAAM,WAAW,aAAa;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,sDAAsD;IACtD,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,4BAA4B;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;CAC1B;AAMD,uDAAuD;AACvD,MAAM,WAAW,aAAa;IAC5B,iEAAiE;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,gDAAgD;IAChD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,sCAAsC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,sEAAsE;AACtE,MAAM,WAAW,YAAY;IAC3B,kCAAkC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,mCAAmC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,uCAAuC;IACvC,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GACxB,iBAAiB,GACjB,aAAa,GACb,cAAc,GACd,cAAc,GACd,mBAAmB,GACnB,eAAe,GACf,QAAQ,GACR,YAAY,GACZ,aAAa,GACb,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,uDAAuD;AACvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,QAAQ,CAAC,KAAK,CAAC,EAAE;QACf,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG;YAC5B,0CAA0C;YAC1C,QAAQ,CAAC,GAAG,CAAC,EAAE,YAAY,CAAC;YAC5B,2DAA2D;YAC3D,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;SACpD,CAAC;KACH,CAAC;CACH;AAMD;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;CAsBhB,CAAC;AAMX,yDAAyD;AACzD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,mEAAmE;AACnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,MAAM,WAAW,iBAAiB;IAChC,6EAA6E;IAC7E,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,2CAA2C;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,GAAG,SAAS,GAAG,QAAQ,CAAC;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC;CAC1C;AAED,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,YAAY,GAAG,KAAK,CAAC;AAM1D;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC9D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC5C;AAMD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,WAAW,GACX,aAAa,GACb,UAAU,CAAC;IACf,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B"}
@@ -0,0 +1,38 @@
1
+ "use strict";
2
+ /**
3
+ * Core types for the MCP Apps Bridge protocol.
4
+ *
5
+ * Defines the message envelope, resource URIs, adapter configuration,
6
+ * and tool declarations used throughout the bridge.
7
+ */
8
+ Object.defineProperty(exports, "__esModule", { value: true });
9
+ exports.McpAppsMethod = void 0;
10
+ // ---------------------------------------------------------------------------
11
+ // MCP Apps JSON-RPC method constants
12
+ // ---------------------------------------------------------------------------
13
+ /**
14
+ * Well-known JSON-RPC method names used in the MCP Apps protocol (SEP-1865).
15
+ *
16
+ * App -> Host requests.
17
+ */
18
+ exports.McpAppsMethod = {
19
+ // Initialization handshake
20
+ UI_INITIALIZE: "ui/initialize",
21
+ UI_NOTIFICATIONS_INITIALIZED: "ui/notifications/initialized",
22
+ // App -> Host requests
23
+ TOOLS_CALL: "tools/call",
24
+ RESOURCES_READ: "resources/read",
25
+ UI_OPEN_LINK: "ui/open-link",
26
+ UI_MESSAGE: "ui/message",
27
+ UI_UPDATE_MODEL_CONTEXT: "ui/update-model-context",
28
+ UI_REQUEST_DISPLAY_MODE: "ui/request-display-mode",
29
+ NOTIFICATIONS_MESSAGE: "notifications/message",
30
+ // Host -> App notifications
31
+ UI_TOOL_INPUT: "ui/notifications/tool-input",
32
+ UI_TOOL_INPUT_PARTIAL: "ui/notifications/tool-input-partial",
33
+ UI_TOOL_RESULT: "ui/notifications/tool-result",
34
+ UI_TOOL_CANCELLED: "ui/notifications/tool-cancelled",
35
+ UI_HOST_CONTEXT_CHANGED: "ui/notifications/host-context-changed",
36
+ UI_SIZE_CHANGED: "ui/notifications/size-changed",
37
+ UI_RESOURCE_TEARDOWN: "ui/resource-teardown",
38
+ };
@@ -0,0 +1,36 @@
1
+ /**
2
+ * @module @casys/mcp-bridge
3
+ *
4
+ * Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
5
+ * messaging platforms such as Telegram Mini Apps and LINE LIFF.
6
+ *
7
+ * Entry point for Deno.
8
+ */
9
+ export type { AdapterConfig, BridgeOptions, ContainerDimensions, DisplayMode, HostCapabilities, HostContext, HostContextStyles, LifecycleEvent, McpAppPermission, McpAppsErrorResponse, McpAppsMessage, McpAppsNotification, McpAppsRequest, McpAppsResponse, McpToolDeclaration, McpToolUiCsp, McpToolUiMeta, ResourceUri, SafeAreaInsets, } from "./core/types.js";
10
+ export { McpAppsMethod } from "./core/types.js";
11
+ export type { LifecycleEventHandler, McpAppsAdapter, MessageHandler, PlatformAdapter, } from "./core/adapter.js";
12
+ export { MessageRouter } from "./core/message-router.js";
13
+ export type { NotificationHandler, RequestHandler } from "./core/message-router.js";
14
+ export { parseResourceUri, resolveToHttp } from "./core/resource-resolver.js";
15
+ export { buildDisplayModeRequest, buildErrorResponse, buildHostContextChangedNotification, buildInitializedNotification, buildInitializeResponse, buildLogNotification, buildMessageRequest, buildOpenLinkRequest, buildResourceReadRequest, buildResourceTeardownRequest, buildSuccessResponse, buildToolCallRequest, buildToolCancelledNotification, buildToolInputNotification, buildToolResultNotification, buildUpdateModelContextRequest, isErrorResponse, isJsonRpcMessage, isNotification, isRequest, isResponse, JsonRpcErrorCode, nextRequestId, } from "./core/protocol.js";
16
+ export { WebSocketTransport } from "./core/transport.js";
17
+ export type { BridgeTransport, TransportMessageHandler, TransportStateHandler, } from "./core/transport.js";
18
+ export { BridgeClient } from "./core/bridge-client.js";
19
+ export type { BridgeClientOptions } from "./core/bridge-client.js";
20
+ export { BasePostMessageAdapter } from "./adapters/base-adapter.js";
21
+ export { TelegramAdapter } from "./adapters/telegram/adapter.js";
22
+ export { TelegramPlatformAdapter } from "./adapters/telegram/platform-adapter.js";
23
+ export type { TelegramAdapterConfig, TelegramEventType, TelegramSafeAreaInset, TelegramThemeParams, TelegramWebApp, } from "./adapters/telegram/types.js";
24
+ export { getTelegramWebApp } from "./adapters/telegram/sdk-bridge.js";
25
+ export { LineAdapter } from "./adapters/line/adapter.js";
26
+ export type { LineAdapterConfig, LiffSdk } from "./adapters/line/types.js";
27
+ export { buildCspHeader } from "./resource-server/csp.js";
28
+ export type { CspOptions } from "./resource-server/csp.js";
29
+ export { injectBridgeScript } from "./resource-server/injector.js";
30
+ export { SessionStore } from "./resource-server/session.js";
31
+ export type { BridgeSession, PendingNotification } from "./resource-server/session.js";
32
+ export { startResourceServer, buildToolResultFromData } from "./resource-server/server.js";
33
+ export type { ResourceServer, ResourceServerConfig, ToolResultData } from "./resource-server/server.js";
34
+ export { validateTelegramInitData } from "./resource-server/telegram-auth.js";
35
+ export type { TelegramAuthResult } from "./resource-server/telegram-auth.js";
36
+ //# sourceMappingURL=mod.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD,YAAY,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG9E,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mCAAmC,EACnC,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC"}
package/script/mod.js ADDED
@@ -0,0 +1,76 @@
1
+ "use strict";
2
+ /**
3
+ * @module @casys/mcp-bridge
4
+ *
5
+ * Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
6
+ * messaging platforms such as Telegram Mini Apps and LINE LIFF.
7
+ *
8
+ * Entry point for Deno.
9
+ */
10
+ Object.defineProperty(exports, "__esModule", { value: true });
11
+ exports.validateTelegramInitData = exports.buildToolResultFromData = exports.startResourceServer = exports.SessionStore = exports.injectBridgeScript = exports.buildCspHeader = exports.LineAdapter = exports.getTelegramWebApp = exports.TelegramPlatformAdapter = exports.TelegramAdapter = exports.BasePostMessageAdapter = exports.BridgeClient = exports.WebSocketTransport = exports.nextRequestId = exports.JsonRpcErrorCode = exports.isResponse = exports.isRequest = exports.isNotification = exports.isJsonRpcMessage = exports.isErrorResponse = exports.buildUpdateModelContextRequest = exports.buildToolResultNotification = exports.buildToolInputNotification = exports.buildToolCancelledNotification = exports.buildToolCallRequest = exports.buildSuccessResponse = exports.buildResourceTeardownRequest = exports.buildResourceReadRequest = exports.buildOpenLinkRequest = exports.buildMessageRequest = exports.buildLogNotification = exports.buildInitializeResponse = exports.buildInitializedNotification = exports.buildHostContextChangedNotification = exports.buildErrorResponse = exports.buildDisplayModeRequest = exports.resolveToHttp = exports.parseResourceUri = exports.MessageRouter = exports.McpAppsMethod = void 0;
12
+ var types_js_1 = require("./core/types.js");
13
+ Object.defineProperty(exports, "McpAppsMethod", { enumerable: true, get: function () { return types_js_1.McpAppsMethod; } });
14
+ // Message router
15
+ var message_router_js_1 = require("./core/message-router.js");
16
+ Object.defineProperty(exports, "MessageRouter", { enumerable: true, get: function () { return message_router_js_1.MessageRouter; } });
17
+ // Resource resolver
18
+ var resource_resolver_js_1 = require("./core/resource-resolver.js");
19
+ Object.defineProperty(exports, "parseResourceUri", { enumerable: true, get: function () { return resource_resolver_js_1.parseResourceUri; } });
20
+ Object.defineProperty(exports, "resolveToHttp", { enumerable: true, get: function () { return resource_resolver_js_1.resolveToHttp; } });
21
+ // Protocol builders and validators
22
+ var protocol_js_1 = require("./core/protocol.js");
23
+ Object.defineProperty(exports, "buildDisplayModeRequest", { enumerable: true, get: function () { return protocol_js_1.buildDisplayModeRequest; } });
24
+ Object.defineProperty(exports, "buildErrorResponse", { enumerable: true, get: function () { return protocol_js_1.buildErrorResponse; } });
25
+ Object.defineProperty(exports, "buildHostContextChangedNotification", { enumerable: true, get: function () { return protocol_js_1.buildHostContextChangedNotification; } });
26
+ Object.defineProperty(exports, "buildInitializedNotification", { enumerable: true, get: function () { return protocol_js_1.buildInitializedNotification; } });
27
+ Object.defineProperty(exports, "buildInitializeResponse", { enumerable: true, get: function () { return protocol_js_1.buildInitializeResponse; } });
28
+ Object.defineProperty(exports, "buildLogNotification", { enumerable: true, get: function () { return protocol_js_1.buildLogNotification; } });
29
+ Object.defineProperty(exports, "buildMessageRequest", { enumerable: true, get: function () { return protocol_js_1.buildMessageRequest; } });
30
+ Object.defineProperty(exports, "buildOpenLinkRequest", { enumerable: true, get: function () { return protocol_js_1.buildOpenLinkRequest; } });
31
+ Object.defineProperty(exports, "buildResourceReadRequest", { enumerable: true, get: function () { return protocol_js_1.buildResourceReadRequest; } });
32
+ Object.defineProperty(exports, "buildResourceTeardownRequest", { enumerable: true, get: function () { return protocol_js_1.buildResourceTeardownRequest; } });
33
+ Object.defineProperty(exports, "buildSuccessResponse", { enumerable: true, get: function () { return protocol_js_1.buildSuccessResponse; } });
34
+ Object.defineProperty(exports, "buildToolCallRequest", { enumerable: true, get: function () { return protocol_js_1.buildToolCallRequest; } });
35
+ Object.defineProperty(exports, "buildToolCancelledNotification", { enumerable: true, get: function () { return protocol_js_1.buildToolCancelledNotification; } });
36
+ Object.defineProperty(exports, "buildToolInputNotification", { enumerable: true, get: function () { return protocol_js_1.buildToolInputNotification; } });
37
+ Object.defineProperty(exports, "buildToolResultNotification", { enumerable: true, get: function () { return protocol_js_1.buildToolResultNotification; } });
38
+ Object.defineProperty(exports, "buildUpdateModelContextRequest", { enumerable: true, get: function () { return protocol_js_1.buildUpdateModelContextRequest; } });
39
+ Object.defineProperty(exports, "isErrorResponse", { enumerable: true, get: function () { return protocol_js_1.isErrorResponse; } });
40
+ Object.defineProperty(exports, "isJsonRpcMessage", { enumerable: true, get: function () { return protocol_js_1.isJsonRpcMessage; } });
41
+ Object.defineProperty(exports, "isNotification", { enumerable: true, get: function () { return protocol_js_1.isNotification; } });
42
+ Object.defineProperty(exports, "isRequest", { enumerable: true, get: function () { return protocol_js_1.isRequest; } });
43
+ Object.defineProperty(exports, "isResponse", { enumerable: true, get: function () { return protocol_js_1.isResponse; } });
44
+ Object.defineProperty(exports, "JsonRpcErrorCode", { enumerable: true, get: function () { return protocol_js_1.JsonRpcErrorCode; } });
45
+ Object.defineProperty(exports, "nextRequestId", { enumerable: true, get: function () { return protocol_js_1.nextRequestId; } });
46
+ // Transport
47
+ var transport_js_1 = require("./core/transport.js");
48
+ Object.defineProperty(exports, "WebSocketTransport", { enumerable: true, get: function () { return transport_js_1.WebSocketTransport; } });
49
+ // Bridge client
50
+ var bridge_client_js_1 = require("./core/bridge-client.js");
51
+ Object.defineProperty(exports, "BridgeClient", { enumerable: true, get: function () { return bridge_client_js_1.BridgeClient; } });
52
+ // Base adapter (for custom platform implementations)
53
+ var base_adapter_js_1 = require("./adapters/base-adapter.js");
54
+ Object.defineProperty(exports, "BasePostMessageAdapter", { enumerable: true, get: function () { return base_adapter_js_1.BasePostMessageAdapter; } });
55
+ // Adapters — Telegram
56
+ var adapter_js_1 = require("./adapters/telegram/adapter.js");
57
+ Object.defineProperty(exports, "TelegramAdapter", { enumerable: true, get: function () { return adapter_js_1.TelegramAdapter; } });
58
+ var platform_adapter_js_1 = require("./adapters/telegram/platform-adapter.js");
59
+ Object.defineProperty(exports, "TelegramPlatformAdapter", { enumerable: true, get: function () { return platform_adapter_js_1.TelegramPlatformAdapter; } });
60
+ var sdk_bridge_js_1 = require("./adapters/telegram/sdk-bridge.js");
61
+ Object.defineProperty(exports, "getTelegramWebApp", { enumerable: true, get: function () { return sdk_bridge_js_1.getTelegramWebApp; } });
62
+ // Adapters — LINE
63
+ var adapter_js_2 = require("./adapters/line/adapter.js");
64
+ Object.defineProperty(exports, "LineAdapter", { enumerable: true, get: function () { return adapter_js_2.LineAdapter; } });
65
+ // Resource server
66
+ var csp_js_1 = require("./resource-server/csp.js");
67
+ Object.defineProperty(exports, "buildCspHeader", { enumerable: true, get: function () { return csp_js_1.buildCspHeader; } });
68
+ var injector_js_1 = require("./resource-server/injector.js");
69
+ Object.defineProperty(exports, "injectBridgeScript", { enumerable: true, get: function () { return injector_js_1.injectBridgeScript; } });
70
+ var session_js_1 = require("./resource-server/session.js");
71
+ Object.defineProperty(exports, "SessionStore", { enumerable: true, get: function () { return session_js_1.SessionStore; } });
72
+ var server_js_1 = require("./resource-server/server.js");
73
+ Object.defineProperty(exports, "startResourceServer", { enumerable: true, get: function () { return server_js_1.startResourceServer; } });
74
+ Object.defineProperty(exports, "buildToolResultFromData", { enumerable: true, get: function () { return server_js_1.buildToolResultFromData; } });
75
+ var telegram_auth_js_1 = require("./resource-server/telegram-auth.js");
76
+ Object.defineProperty(exports, "validateTelegramInitData", { enumerable: true, get: function () { return telegram_auth_js_1.validateTelegramInitData; } });
@@ -0,0 +1,3 @@
1
+ {
2
+ "type": "commonjs"
3
+ }
@@ -0,0 +1,36 @@
1
+ /**
2
+ * Content Security Policy helpers for the resource server.
3
+ *
4
+ * Generates CSP headers that allow the MCP App UI to function within
5
+ * platform WebViews while maintaining security.
6
+ */
7
+ /** Options for generating a CSP header. */
8
+ export interface CspOptions {
9
+ /** Additional allowed script sources (e.g. platform SDK URLs). */
10
+ readonly scriptSources?: readonly string[];
11
+ /** Additional allowed connect sources (e.g. API endpoints). */
12
+ readonly connectSources?: readonly string[];
13
+ /** Additional allowed frame ancestors. */
14
+ readonly frameAncestors?: readonly string[];
15
+ /**
16
+ * If true, use `'unsafe-inline'` for scripts and styles (default).
17
+ * If false, only external scripts/styles from `'self'` are allowed.
18
+ * Use `false` when the MCP App HTML has no inline `<script>` or `<style>` tags.
19
+ */
20
+ readonly allowInline?: boolean;
21
+ }
22
+ /**
23
+ * Build a Content-Security-Policy header value.
24
+ *
25
+ * Uses `default-src 'none'` as the base (deny-all), then explicitly allows
26
+ * only what MCP App UIs need:
27
+ * - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
28
+ * - Connections to `'self'` (+ custom sources for APIs/WebSocket)
29
+ * - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
30
+ * - Images from `'self'` and `data:`
31
+ * - Fonts from `'self'`
32
+ * - Frame ancestors from `'self'` (+ custom for platform embedding)
33
+ * - `base-uri 'self'` to prevent base tag injection
34
+ */
35
+ export declare function buildCspHeader(options?: CspOptions): string;
36
+ //# sourceMappingURL=csp.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/resource-server/csp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,UAAe,GAAG,MAAM,CAkB/D"}
@@ -0,0 +1,39 @@
1
+ "use strict";
2
+ /**
3
+ * Content Security Policy helpers for the resource server.
4
+ *
5
+ * Generates CSP headers that allow the MCP App UI to function within
6
+ * platform WebViews while maintaining security.
7
+ */
8
+ Object.defineProperty(exports, "__esModule", { value: true });
9
+ exports.buildCspHeader = buildCspHeader;
10
+ /**
11
+ * Build a Content-Security-Policy header value.
12
+ *
13
+ * Uses `default-src 'none'` as the base (deny-all), then explicitly allows
14
+ * only what MCP App UIs need:
15
+ * - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
16
+ * - Connections to `'self'` (+ custom sources for APIs/WebSocket)
17
+ * - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
18
+ * - Images from `'self'` and `data:`
19
+ * - Fonts from `'self'`
20
+ * - Frame ancestors from `'self'` (+ custom for platform embedding)
21
+ * - `base-uri 'self'` to prevent base tag injection
22
+ */
23
+ function buildCspHeader(options = {}) {
24
+ const allowInline = options.allowInline !== false; // default true for backwards compat
25
+ const inlineDirective = allowInline ? " 'unsafe-inline'" : "";
26
+ const scriptSrc = [`'self'${inlineDirective}`, ...(options.scriptSources ?? [])].join(" ");
27
+ const connectSrc = ["'self'", ...(options.connectSources ?? [])].join(" ");
28
+ const frameAncestors = ["'self'", ...(options.frameAncestors ?? [])].join(" ");
29
+ return [
30
+ `default-src 'none'`,
31
+ `script-src ${scriptSrc}`,
32
+ `style-src 'self'${inlineDirective}`,
33
+ `img-src 'self' data:`,
34
+ `font-src 'self'`,
35
+ `connect-src ${connectSrc}`,
36
+ `frame-ancestors ${frameAncestors}`,
37
+ `base-uri 'self'`,
38
+ ].join("; ");
39
+ }
@@ -0,0 +1,18 @@
1
+ /**
2
+ * Script injector for the resource server.
3
+ *
4
+ * Injects the MCP Apps Bridge client-side script into HTML responses
5
+ * so that the UI can communicate with the host application.
6
+ */
7
+ /**
8
+ * Inject the bridge client script tag into an HTML string.
9
+ *
10
+ * The script is inserted just before `</head>` (or `</body>` as fallback,
11
+ * or appended if neither tag is found).
12
+ *
13
+ * @param html - The original HTML content.
14
+ * @param scriptUrl - URL of the bridge client script to inject.
15
+ * @returns The modified HTML with the script tag inserted.
16
+ */
17
+ export declare function injectBridgeScript(html: string, scriptUrl: string): string;
18
+ //# sourceMappingURL=injector.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"injector.d.ts","sourceRoot":"","sources":["../../src/resource-server/injector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiB1E"}
@@ -0,0 +1,42 @@
1
+ "use strict";
2
+ /**
3
+ * Script injector for the resource server.
4
+ *
5
+ * Injects the MCP Apps Bridge client-side script into HTML responses
6
+ * so that the UI can communicate with the host application.
7
+ */
8
+ Object.defineProperty(exports, "__esModule", { value: true });
9
+ exports.injectBridgeScript = injectBridgeScript;
10
+ /**
11
+ * Inject the bridge client script tag into an HTML string.
12
+ *
13
+ * The script is inserted just before `</head>` (or `</body>` as fallback,
14
+ * or appended if neither tag is found).
15
+ *
16
+ * @param html - The original HTML content.
17
+ * @param scriptUrl - URL of the bridge client script to inject.
18
+ * @returns The modified HTML with the script tag inserted.
19
+ */
20
+ function injectBridgeScript(html, scriptUrl) {
21
+ const scriptTag = `<script src="${escapeAttr(scriptUrl)}"></script>`;
22
+ // Prefer injection before </head>
23
+ const headCloseIdx = html.indexOf("</head>");
24
+ if (headCloseIdx >= 0) {
25
+ return html.slice(0, headCloseIdx) + scriptTag + "\n" + html.slice(headCloseIdx);
26
+ }
27
+ // Fallback: before </body>
28
+ const bodyCloseIdx = html.indexOf("</body>");
29
+ if (bodyCloseIdx >= 0) {
30
+ return html.slice(0, bodyCloseIdx) + scriptTag + "\n" + html.slice(bodyCloseIdx);
31
+ }
32
+ // Last resort: append
33
+ return html + "\n" + scriptTag;
34
+ }
35
+ /** Escape a string for safe use in an HTML attribute value. */
36
+ function escapeAttr(value) {
37
+ return value
38
+ .replace(/&/g, "&amp;")
39
+ .replace(/"/g, "&quot;")
40
+ .replace(/</g, "&lt;")
41
+ .replace(/>/g, "&gt;");
42
+ }
@@ -0,0 +1,107 @@
1
+ /**
2
+ * HTTP resource server for MCP Apps Bridge.
3
+ *
4
+ * Serves `ui://` resources as HTTP pages, injects bridge.js, sets CSP
5
+ * headers, and provides a WebSocket endpoint for bidirectional JSON-RPC
6
+ * communication between the BridgeClient (in the webview) and the MCP server.
7
+ *
8
+ * Endpoints:
9
+ * - `GET /app/<server>/<path>` — Serve MCP App HTML with injected bridge.js
10
+ * - `GET /bridge.js?platform=<p>&session=<s>` — Serve the bridge client script
11
+ * - `GET /health` — Health check
12
+ * - `WS /bridge?session=<id>` — WebSocket for JSON-RPC messaging
13
+ *
14
+ * Uses Deno.serve() for the HTTP server.
15
+ */
16
+ import type { BridgeOptions, McpAppsMessage } from "../core/types.js";
17
+ import type { CspOptions } from "./csp.js";
18
+ import { SessionStore } from "./session.js";
19
+ import type { BridgeSession, PendingNotification } from "./session.js";
20
+ /** Resource server configuration. */
21
+ export interface ResourceServerConfig {
22
+ /** Directory containing UI assets, keyed by server name (from ui:// URI). */
23
+ readonly assetDirectories: Record<string, string>;
24
+ /** Platform name for bridge.js configuration. */
25
+ readonly platform: "telegram" | "line";
26
+ /** Bridge options (port, CORS, debug). */
27
+ readonly options?: BridgeOptions;
28
+ /** Custom CSP options applied to served HTML pages. */
29
+ readonly csp?: CspOptions;
30
+ /**
31
+ * Telegram bot token for HMAC-SHA256 validation of initData.
32
+ * Required when platform is "telegram". If omitted for telegram,
33
+ * the server will throw at startup (fail-fast).
34
+ */
35
+ readonly telegramBotToken?: string;
36
+ /**
37
+ * Handler called when a JSON-RPC message is received from a webview.
38
+ * The server forwards tool calls here; the handler should call the
39
+ * MCP server and return a response.
40
+ * Only called for authenticated sessions.
41
+ */
42
+ readonly onMessage?: (session: BridgeSession, message: McpAppsMessage) => Promise<McpAppsMessage | null>;
43
+ /**
44
+ * Optional handler for custom HTTP routes.
45
+ * Called for requests that don't match built-in routes
46
+ * (/health, /session, /bridge, /bridge.js, /app/).
47
+ *
48
+ * Return values:
49
+ * - `Response` — sent directly to the client (no bridge injection)
50
+ * - `{ html: string; pendingNotifications?: PendingNotification[] }` —
51
+ * HTML content; bridge.js will be injected, a session created, and
52
+ * CSP headers set automatically. If `pendingNotifications` is provided,
53
+ * they are buffered on the session and sent via WebSocket when the
54
+ * client connects (e.g. `ui/notifications/tool-result`).
55
+ * - `null` — the server responds with 404
56
+ */
57
+ readonly onHttpRequest?: (request: Request) => Promise<Response | {
58
+ html: string;
59
+ pendingNotifications?: PendingNotification[];
60
+ } | null>;
61
+ }
62
+ /** Tool result data to be pushed to an MCP App via WebSocket. */
63
+ export interface ToolResultData {
64
+ readonly content: ReadonlyArray<{
65
+ type: string;
66
+ text?: string;
67
+ data?: string;
68
+ mimeType?: string;
69
+ }>;
70
+ readonly isError?: boolean;
71
+ }
72
+ /** A running resource server instance. */
73
+ export interface ResourceServer {
74
+ /** The base URL at which the server is listening. */
75
+ readonly baseUrl: string;
76
+ /** The session store (for inspection/testing). */
77
+ readonly sessions: SessionStore;
78
+ /**
79
+ * Store a tool result for later delivery to an MCP App.
80
+ * Returns an opaque reference ID. Pass it in the page URL (e.g. `?ref=abc`).
81
+ *
82
+ * When the page is served via `onHttpRequest` returning `{ html }`, the
83
+ * server automatically extracts `?ref=` from the request URL, looks up
84
+ * the stored result, and buffers it as a `ui/notifications/tool-result`
85
+ * notification on the session. No manual handling is needed.
86
+ *
87
+ * Stored results auto-expire after 5 minutes.
88
+ */
89
+ storeToolResult(result: ToolResultData): string;
90
+ /**
91
+ * Retrieve and consume a stored tool result by reference.
92
+ * Returns `undefined` if the ref doesn't exist or has expired.
93
+ * The result is deleted after retrieval (single-use).
94
+ */
95
+ consumeToolResult(ref: string): ToolResultData | undefined;
96
+ /** Stop the server and release resources. */
97
+ stop(): Promise<void>;
98
+ }
99
+ /**
100
+ * Start the resource server.
101
+ *
102
+ * @returns A running ResourceServer with baseUrl and stop() method.
103
+ */
104
+ export declare function startResourceServer(config: ResourceServerConfig): ResourceServer;
105
+ /** Build a `ui/notifications/tool-result` pending notification from ToolResultData. */
106
+ export declare function buildToolResultFromData(data: ToolResultData): PendingNotification;
107
+ //# sourceMappingURL=server.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/resource-server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAOvE,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,QAAQ,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC3D,6CAA6C;IAC7C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAoDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CA0dhB;AAaD,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,mBAAmB,CAMjF"}