@casys/mcp-bridge 0.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (131) hide show
  1. package/esm/_dnt.shims.d.ts +2 -0
  2. package/esm/_dnt.shims.d.ts.map +1 -0
  3. package/esm/_dnt.shims.js +57 -0
  4. package/esm/adapters/base-adapter.d.ts +25 -0
  5. package/esm/adapters/base-adapter.d.ts.map +1 -0
  6. package/esm/adapters/base-adapter.js +86 -0
  7. package/esm/adapters/line/adapter.d.ts +11 -0
  8. package/esm/adapters/line/adapter.d.ts.map +1 -0
  9. package/esm/adapters/line/adapter.js +10 -0
  10. package/esm/adapters/line/types.d.ts +25 -0
  11. package/esm/adapters/line/types.d.ts.map +1 -0
  12. package/esm/adapters/line/types.js +4 -0
  13. package/esm/adapters/telegram/adapter.d.ts +11 -0
  14. package/esm/adapters/telegram/adapter.d.ts.map +1 -0
  15. package/esm/adapters/telegram/adapter.js +10 -0
  16. package/esm/adapters/telegram/platform-adapter.d.ts +40 -0
  17. package/esm/adapters/telegram/platform-adapter.d.ts.map +1 -0
  18. package/esm/adapters/telegram/platform-adapter.js +214 -0
  19. package/esm/adapters/telegram/sdk-bridge.d.ts +8 -0
  20. package/esm/adapters/telegram/sdk-bridge.d.ts.map +1 -0
  21. package/esm/adapters/telegram/sdk-bridge.js +22 -0
  22. package/esm/adapters/telegram/types.d.ts +93 -0
  23. package/esm/adapters/telegram/types.d.ts.map +1 -0
  24. package/esm/adapters/telegram/types.js +6 -0
  25. package/esm/client/bridge.js +424 -0
  26. package/esm/core/adapter.d.ts +88 -0
  27. package/esm/core/adapter.d.ts.map +1 -0
  28. package/esm/core/adapter.js +10 -0
  29. package/esm/core/bridge-client.d.ts +77 -0
  30. package/esm/core/bridge-client.d.ts.map +1 -0
  31. package/esm/core/bridge-client.js +275 -0
  32. package/esm/core/message-router.d.ts +71 -0
  33. package/esm/core/message-router.d.ts.map +1 -0
  34. package/esm/core/message-router.js +187 -0
  35. package/esm/core/protocol.d.ts +116 -0
  36. package/esm/core/protocol.d.ts.map +1 -0
  37. package/esm/core/protocol.js +203 -0
  38. package/esm/core/resource-resolver.d.ts +27 -0
  39. package/esm/core/resource-resolver.d.ts.map +1 -0
  40. package/esm/core/resource-resolver.js +85 -0
  41. package/esm/core/transport.d.ts +46 -0
  42. package/esm/core/transport.d.ts.map +1 -0
  43. package/esm/core/transport.js +85 -0
  44. package/esm/core/types.d.ts +187 -0
  45. package/esm/core/types.d.ts.map +1 -0
  46. package/esm/core/types.js +35 -0
  47. package/esm/mod.d.ts +36 -0
  48. package/esm/mod.d.ts.map +1 -0
  49. package/esm/mod.js +33 -0
  50. package/esm/package.json +3 -0
  51. package/esm/resource-server/csp.d.ts +36 -0
  52. package/esm/resource-server/csp.d.ts.map +1 -0
  53. package/esm/resource-server/csp.js +36 -0
  54. package/esm/resource-server/injector.d.ts +18 -0
  55. package/esm/resource-server/injector.d.ts.map +1 -0
  56. package/esm/resource-server/injector.js +39 -0
  57. package/esm/resource-server/server.d.ts +107 -0
  58. package/esm/resource-server/server.d.ts.map +1 -0
  59. package/esm/resource-server/server.js +483 -0
  60. package/esm/resource-server/session.d.ts +60 -0
  61. package/esm/resource-server/session.d.ts.map +1 -0
  62. package/esm/resource-server/session.js +86 -0
  63. package/esm/resource-server/telegram-auth.d.ts +45 -0
  64. package/esm/resource-server/telegram-auth.d.ts.map +1 -0
  65. package/esm/resource-server/telegram-auth.js +161 -0
  66. package/package.json +31 -0
  67. package/script/_dnt.shims.d.ts +2 -0
  68. package/script/_dnt.shims.d.ts.map +1 -0
  69. package/script/_dnt.shims.js +60 -0
  70. package/script/adapters/base-adapter.d.ts +25 -0
  71. package/script/adapters/base-adapter.d.ts.map +1 -0
  72. package/script/adapters/base-adapter.js +113 -0
  73. package/script/adapters/line/adapter.d.ts +11 -0
  74. package/script/adapters/line/adapter.d.ts.map +1 -0
  75. package/script/adapters/line/adapter.js +14 -0
  76. package/script/adapters/line/types.d.ts +25 -0
  77. package/script/adapters/line/types.d.ts.map +1 -0
  78. package/script/adapters/line/types.js +5 -0
  79. package/script/adapters/telegram/adapter.d.ts +11 -0
  80. package/script/adapters/telegram/adapter.d.ts.map +1 -0
  81. package/script/adapters/telegram/adapter.js +14 -0
  82. package/script/adapters/telegram/platform-adapter.d.ts +40 -0
  83. package/script/adapters/telegram/platform-adapter.d.ts.map +1 -0
  84. package/script/adapters/telegram/platform-adapter.js +241 -0
  85. package/script/adapters/telegram/sdk-bridge.d.ts +8 -0
  86. package/script/adapters/telegram/sdk-bridge.d.ts.map +1 -0
  87. package/script/adapters/telegram/sdk-bridge.js +48 -0
  88. package/script/adapters/telegram/types.d.ts +93 -0
  89. package/script/adapters/telegram/types.d.ts.map +1 -0
  90. package/script/adapters/telegram/types.js +7 -0
  91. package/script/client/bridge.js +424 -0
  92. package/script/core/adapter.d.ts +88 -0
  93. package/script/core/adapter.d.ts.map +1 -0
  94. package/script/core/adapter.js +11 -0
  95. package/script/core/bridge-client.d.ts +77 -0
  96. package/script/core/bridge-client.d.ts.map +1 -0
  97. package/script/core/bridge-client.js +302 -0
  98. package/script/core/message-router.d.ts +71 -0
  99. package/script/core/message-router.d.ts.map +1 -0
  100. package/script/core/message-router.js +191 -0
  101. package/script/core/protocol.d.ts +116 -0
  102. package/script/core/protocol.d.ts.map +1 -0
  103. package/script/core/protocol.js +230 -0
  104. package/script/core/resource-resolver.d.ts +27 -0
  105. package/script/core/resource-resolver.d.ts.map +1 -0
  106. package/script/core/resource-resolver.js +89 -0
  107. package/script/core/transport.d.ts +46 -0
  108. package/script/core/transport.d.ts.map +1 -0
  109. package/script/core/transport.js +112 -0
  110. package/script/core/types.d.ts +187 -0
  111. package/script/core/types.d.ts.map +1 -0
  112. package/script/core/types.js +38 -0
  113. package/script/mod.d.ts +36 -0
  114. package/script/mod.d.ts.map +1 -0
  115. package/script/mod.js +76 -0
  116. package/script/package.json +3 -0
  117. package/script/resource-server/csp.d.ts +36 -0
  118. package/script/resource-server/csp.d.ts.map +1 -0
  119. package/script/resource-server/csp.js +39 -0
  120. package/script/resource-server/injector.d.ts +18 -0
  121. package/script/resource-server/injector.d.ts.map +1 -0
  122. package/script/resource-server/injector.js +42 -0
  123. package/script/resource-server/server.d.ts +107 -0
  124. package/script/resource-server/server.d.ts.map +1 -0
  125. package/script/resource-server/server.js +487 -0
  126. package/script/resource-server/session.d.ts +60 -0
  127. package/script/resource-server/session.d.ts.map +1 -0
  128. package/script/resource-server/session.js +90 -0
  129. package/script/resource-server/telegram-auth.d.ts +45 -0
  130. package/script/resource-server/telegram-auth.d.ts.map +1 -0
  131. package/script/resource-server/telegram-auth.js +164 -0
@@ -0,0 +1,35 @@
1
+ /**
2
+ * Core types for the MCP Apps Bridge protocol.
3
+ *
4
+ * Defines the message envelope, resource URIs, adapter configuration,
5
+ * and tool declarations used throughout the bridge.
6
+ */
7
+ // ---------------------------------------------------------------------------
8
+ // MCP Apps JSON-RPC method constants
9
+ // ---------------------------------------------------------------------------
10
+ /**
11
+ * Well-known JSON-RPC method names used in the MCP Apps protocol (SEP-1865).
12
+ *
13
+ * App -> Host requests.
14
+ */
15
+ export const McpAppsMethod = {
16
+ // Initialization handshake
17
+ UI_INITIALIZE: "ui/initialize",
18
+ UI_NOTIFICATIONS_INITIALIZED: "ui/notifications/initialized",
19
+ // App -> Host requests
20
+ TOOLS_CALL: "tools/call",
21
+ RESOURCES_READ: "resources/read",
22
+ UI_OPEN_LINK: "ui/open-link",
23
+ UI_MESSAGE: "ui/message",
24
+ UI_UPDATE_MODEL_CONTEXT: "ui/update-model-context",
25
+ UI_REQUEST_DISPLAY_MODE: "ui/request-display-mode",
26
+ NOTIFICATIONS_MESSAGE: "notifications/message",
27
+ // Host -> App notifications
28
+ UI_TOOL_INPUT: "ui/notifications/tool-input",
29
+ UI_TOOL_INPUT_PARTIAL: "ui/notifications/tool-input-partial",
30
+ UI_TOOL_RESULT: "ui/notifications/tool-result",
31
+ UI_TOOL_CANCELLED: "ui/notifications/tool-cancelled",
32
+ UI_HOST_CONTEXT_CHANGED: "ui/notifications/host-context-changed",
33
+ UI_SIZE_CHANGED: "ui/notifications/size-changed",
34
+ UI_RESOURCE_TEARDOWN: "ui/resource-teardown",
35
+ };
package/esm/mod.d.ts ADDED
@@ -0,0 +1,36 @@
1
+ /**
2
+ * @module @casys/mcp-bridge
3
+ *
4
+ * Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
5
+ * messaging platforms such as Telegram Mini Apps and LINE LIFF.
6
+ *
7
+ * Entry point for Deno.
8
+ */
9
+ export type { AdapterConfig, BridgeOptions, ContainerDimensions, DisplayMode, HostCapabilities, HostContext, HostContextStyles, LifecycleEvent, McpAppPermission, McpAppsErrorResponse, McpAppsMessage, McpAppsNotification, McpAppsRequest, McpAppsResponse, McpToolDeclaration, McpToolUiCsp, McpToolUiMeta, ResourceUri, SafeAreaInsets, } from "./core/types.js";
10
+ export { McpAppsMethod } from "./core/types.js";
11
+ export type { LifecycleEventHandler, McpAppsAdapter, MessageHandler, PlatformAdapter, } from "./core/adapter.js";
12
+ export { MessageRouter } from "./core/message-router.js";
13
+ export type { NotificationHandler, RequestHandler } from "./core/message-router.js";
14
+ export { parseResourceUri, resolveToHttp } from "./core/resource-resolver.js";
15
+ export { buildDisplayModeRequest, buildErrorResponse, buildHostContextChangedNotification, buildInitializedNotification, buildInitializeResponse, buildLogNotification, buildMessageRequest, buildOpenLinkRequest, buildResourceReadRequest, buildResourceTeardownRequest, buildSuccessResponse, buildToolCallRequest, buildToolCancelledNotification, buildToolInputNotification, buildToolResultNotification, buildUpdateModelContextRequest, isErrorResponse, isJsonRpcMessage, isNotification, isRequest, isResponse, JsonRpcErrorCode, nextRequestId, } from "./core/protocol.js";
16
+ export { WebSocketTransport } from "./core/transport.js";
17
+ export type { BridgeTransport, TransportMessageHandler, TransportStateHandler, } from "./core/transport.js";
18
+ export { BridgeClient } from "./core/bridge-client.js";
19
+ export type { BridgeClientOptions } from "./core/bridge-client.js";
20
+ export { BasePostMessageAdapter } from "./adapters/base-adapter.js";
21
+ export { TelegramAdapter } from "./adapters/telegram/adapter.js";
22
+ export { TelegramPlatformAdapter } from "./adapters/telegram/platform-adapter.js";
23
+ export type { TelegramAdapterConfig, TelegramEventType, TelegramSafeAreaInset, TelegramThemeParams, TelegramWebApp, } from "./adapters/telegram/types.js";
24
+ export { getTelegramWebApp } from "./adapters/telegram/sdk-bridge.js";
25
+ export { LineAdapter } from "./adapters/line/adapter.js";
26
+ export type { LineAdapterConfig, LiffSdk } from "./adapters/line/types.js";
27
+ export { buildCspHeader } from "./resource-server/csp.js";
28
+ export type { CspOptions } from "./resource-server/csp.js";
29
+ export { injectBridgeScript } from "./resource-server/injector.js";
30
+ export { SessionStore } from "./resource-server/session.js";
31
+ export type { BridgeSession, PendingNotification } from "./resource-server/session.js";
32
+ export { startResourceServer, buildToolResultFromData } from "./resource-server/server.js";
33
+ export type { ResourceServer, ResourceServerConfig, ToolResultData } from "./resource-server/server.js";
34
+ export { validateTelegramInitData } from "./resource-server/telegram-auth.js";
35
+ export type { TelegramAuthResult } from "./resource-server/telegram-auth.js";
36
+ //# sourceMappingURL=mod.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD,YAAY,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG9E,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mCAAmC,EACnC,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC"}
package/esm/mod.js ADDED
@@ -0,0 +1,33 @@
1
+ /**
2
+ * @module @casys/mcp-bridge
3
+ *
4
+ * Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
5
+ * messaging platforms such as Telegram Mini Apps and LINE LIFF.
6
+ *
7
+ * Entry point for Deno.
8
+ */
9
+ export { McpAppsMethod } from "./core/types.js";
10
+ // Message router
11
+ export { MessageRouter } from "./core/message-router.js";
12
+ // Resource resolver
13
+ export { parseResourceUri, resolveToHttp } from "./core/resource-resolver.js";
14
+ // Protocol builders and validators
15
+ export { buildDisplayModeRequest, buildErrorResponse, buildHostContextChangedNotification, buildInitializedNotification, buildInitializeResponse, buildLogNotification, buildMessageRequest, buildOpenLinkRequest, buildResourceReadRequest, buildResourceTeardownRequest, buildSuccessResponse, buildToolCallRequest, buildToolCancelledNotification, buildToolInputNotification, buildToolResultNotification, buildUpdateModelContextRequest, isErrorResponse, isJsonRpcMessage, isNotification, isRequest, isResponse, JsonRpcErrorCode, nextRequestId, } from "./core/protocol.js";
16
+ // Transport
17
+ export { WebSocketTransport } from "./core/transport.js";
18
+ // Bridge client
19
+ export { BridgeClient } from "./core/bridge-client.js";
20
+ // Base adapter (for custom platform implementations)
21
+ export { BasePostMessageAdapter } from "./adapters/base-adapter.js";
22
+ // Adapters — Telegram
23
+ export { TelegramAdapter } from "./adapters/telegram/adapter.js";
24
+ export { TelegramPlatformAdapter } from "./adapters/telegram/platform-adapter.js";
25
+ export { getTelegramWebApp } from "./adapters/telegram/sdk-bridge.js";
26
+ // Adapters — LINE
27
+ export { LineAdapter } from "./adapters/line/adapter.js";
28
+ // Resource server
29
+ export { buildCspHeader } from "./resource-server/csp.js";
30
+ export { injectBridgeScript } from "./resource-server/injector.js";
31
+ export { SessionStore } from "./resource-server/session.js";
32
+ export { startResourceServer, buildToolResultFromData } from "./resource-server/server.js";
33
+ export { validateTelegramInitData } from "./resource-server/telegram-auth.js";
@@ -0,0 +1,3 @@
1
+ {
2
+ "type": "module"
3
+ }
@@ -0,0 +1,36 @@
1
+ /**
2
+ * Content Security Policy helpers for the resource server.
3
+ *
4
+ * Generates CSP headers that allow the MCP App UI to function within
5
+ * platform WebViews while maintaining security.
6
+ */
7
+ /** Options for generating a CSP header. */
8
+ export interface CspOptions {
9
+ /** Additional allowed script sources (e.g. platform SDK URLs). */
10
+ readonly scriptSources?: readonly string[];
11
+ /** Additional allowed connect sources (e.g. API endpoints). */
12
+ readonly connectSources?: readonly string[];
13
+ /** Additional allowed frame ancestors. */
14
+ readonly frameAncestors?: readonly string[];
15
+ /**
16
+ * If true, use `'unsafe-inline'` for scripts and styles (default).
17
+ * If false, only external scripts/styles from `'self'` are allowed.
18
+ * Use `false` when the MCP App HTML has no inline `<script>` or `<style>` tags.
19
+ */
20
+ readonly allowInline?: boolean;
21
+ }
22
+ /**
23
+ * Build a Content-Security-Policy header value.
24
+ *
25
+ * Uses `default-src 'none'` as the base (deny-all), then explicitly allows
26
+ * only what MCP App UIs need:
27
+ * - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
28
+ * - Connections to `'self'` (+ custom sources for APIs/WebSocket)
29
+ * - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
30
+ * - Images from `'self'` and `data:`
31
+ * - Fonts from `'self'`
32
+ * - Frame ancestors from `'self'` (+ custom for platform embedding)
33
+ * - `base-uri 'self'` to prevent base tag injection
34
+ */
35
+ export declare function buildCspHeader(options?: CspOptions): string;
36
+ //# sourceMappingURL=csp.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/resource-server/csp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,UAAe,GAAG,MAAM,CAkB/D"}
@@ -0,0 +1,36 @@
1
+ /**
2
+ * Content Security Policy helpers for the resource server.
3
+ *
4
+ * Generates CSP headers that allow the MCP App UI to function within
5
+ * platform WebViews while maintaining security.
6
+ */
7
+ /**
8
+ * Build a Content-Security-Policy header value.
9
+ *
10
+ * Uses `default-src 'none'` as the base (deny-all), then explicitly allows
11
+ * only what MCP App UIs need:
12
+ * - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
13
+ * - Connections to `'self'` (+ custom sources for APIs/WebSocket)
14
+ * - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
15
+ * - Images from `'self'` and `data:`
16
+ * - Fonts from `'self'`
17
+ * - Frame ancestors from `'self'` (+ custom for platform embedding)
18
+ * - `base-uri 'self'` to prevent base tag injection
19
+ */
20
+ export function buildCspHeader(options = {}) {
21
+ const allowInline = options.allowInline !== false; // default true for backwards compat
22
+ const inlineDirective = allowInline ? " 'unsafe-inline'" : "";
23
+ const scriptSrc = [`'self'${inlineDirective}`, ...(options.scriptSources ?? [])].join(" ");
24
+ const connectSrc = ["'self'", ...(options.connectSources ?? [])].join(" ");
25
+ const frameAncestors = ["'self'", ...(options.frameAncestors ?? [])].join(" ");
26
+ return [
27
+ `default-src 'none'`,
28
+ `script-src ${scriptSrc}`,
29
+ `style-src 'self'${inlineDirective}`,
30
+ `img-src 'self' data:`,
31
+ `font-src 'self'`,
32
+ `connect-src ${connectSrc}`,
33
+ `frame-ancestors ${frameAncestors}`,
34
+ `base-uri 'self'`,
35
+ ].join("; ");
36
+ }
@@ -0,0 +1,18 @@
1
+ /**
2
+ * Script injector for the resource server.
3
+ *
4
+ * Injects the MCP Apps Bridge client-side script into HTML responses
5
+ * so that the UI can communicate with the host application.
6
+ */
7
+ /**
8
+ * Inject the bridge client script tag into an HTML string.
9
+ *
10
+ * The script is inserted just before `</head>` (or `</body>` as fallback,
11
+ * or appended if neither tag is found).
12
+ *
13
+ * @param html - The original HTML content.
14
+ * @param scriptUrl - URL of the bridge client script to inject.
15
+ * @returns The modified HTML with the script tag inserted.
16
+ */
17
+ export declare function injectBridgeScript(html: string, scriptUrl: string): string;
18
+ //# sourceMappingURL=injector.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"injector.d.ts","sourceRoot":"","sources":["../../src/resource-server/injector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiB1E"}
@@ -0,0 +1,39 @@
1
+ /**
2
+ * Script injector for the resource server.
3
+ *
4
+ * Injects the MCP Apps Bridge client-side script into HTML responses
5
+ * so that the UI can communicate with the host application.
6
+ */
7
+ /**
8
+ * Inject the bridge client script tag into an HTML string.
9
+ *
10
+ * The script is inserted just before `</head>` (or `</body>` as fallback,
11
+ * or appended if neither tag is found).
12
+ *
13
+ * @param html - The original HTML content.
14
+ * @param scriptUrl - URL of the bridge client script to inject.
15
+ * @returns The modified HTML with the script tag inserted.
16
+ */
17
+ export function injectBridgeScript(html, scriptUrl) {
18
+ const scriptTag = `<script src="${escapeAttr(scriptUrl)}"></script>`;
19
+ // Prefer injection before </head>
20
+ const headCloseIdx = html.indexOf("</head>");
21
+ if (headCloseIdx >= 0) {
22
+ return html.slice(0, headCloseIdx) + scriptTag + "\n" + html.slice(headCloseIdx);
23
+ }
24
+ // Fallback: before </body>
25
+ const bodyCloseIdx = html.indexOf("</body>");
26
+ if (bodyCloseIdx >= 0) {
27
+ return html.slice(0, bodyCloseIdx) + scriptTag + "\n" + html.slice(bodyCloseIdx);
28
+ }
29
+ // Last resort: append
30
+ return html + "\n" + scriptTag;
31
+ }
32
+ /** Escape a string for safe use in an HTML attribute value. */
33
+ function escapeAttr(value) {
34
+ return value
35
+ .replace(/&/g, "&amp;")
36
+ .replace(/"/g, "&quot;")
37
+ .replace(/</g, "&lt;")
38
+ .replace(/>/g, "&gt;");
39
+ }
@@ -0,0 +1,107 @@
1
+ /**
2
+ * HTTP resource server for MCP Apps Bridge.
3
+ *
4
+ * Serves `ui://` resources as HTTP pages, injects bridge.js, sets CSP
5
+ * headers, and provides a WebSocket endpoint for bidirectional JSON-RPC
6
+ * communication between the BridgeClient (in the webview) and the MCP server.
7
+ *
8
+ * Endpoints:
9
+ * - `GET /app/<server>/<path>` — Serve MCP App HTML with injected bridge.js
10
+ * - `GET /bridge.js?platform=<p>&session=<s>` — Serve the bridge client script
11
+ * - `GET /health` — Health check
12
+ * - `WS /bridge?session=<id>` — WebSocket for JSON-RPC messaging
13
+ *
14
+ * Uses Deno.serve() for the HTTP server.
15
+ */
16
+ import type { BridgeOptions, McpAppsMessage } from "../core/types.js";
17
+ import type { CspOptions } from "./csp.js";
18
+ import { SessionStore } from "./session.js";
19
+ import type { BridgeSession, PendingNotification } from "./session.js";
20
+ /** Resource server configuration. */
21
+ export interface ResourceServerConfig {
22
+ /** Directory containing UI assets, keyed by server name (from ui:// URI). */
23
+ readonly assetDirectories: Record<string, string>;
24
+ /** Platform name for bridge.js configuration. */
25
+ readonly platform: "telegram" | "line";
26
+ /** Bridge options (port, CORS, debug). */
27
+ readonly options?: BridgeOptions;
28
+ /** Custom CSP options applied to served HTML pages. */
29
+ readonly csp?: CspOptions;
30
+ /**
31
+ * Telegram bot token for HMAC-SHA256 validation of initData.
32
+ * Required when platform is "telegram". If omitted for telegram,
33
+ * the server will throw at startup (fail-fast).
34
+ */
35
+ readonly telegramBotToken?: string;
36
+ /**
37
+ * Handler called when a JSON-RPC message is received from a webview.
38
+ * The server forwards tool calls here; the handler should call the
39
+ * MCP server and return a response.
40
+ * Only called for authenticated sessions.
41
+ */
42
+ readonly onMessage?: (session: BridgeSession, message: McpAppsMessage) => Promise<McpAppsMessage | null>;
43
+ /**
44
+ * Optional handler for custom HTTP routes.
45
+ * Called for requests that don't match built-in routes
46
+ * (/health, /session, /bridge, /bridge.js, /app/).
47
+ *
48
+ * Return values:
49
+ * - `Response` — sent directly to the client (no bridge injection)
50
+ * - `{ html: string; pendingNotifications?: PendingNotification[] }` —
51
+ * HTML content; bridge.js will be injected, a session created, and
52
+ * CSP headers set automatically. If `pendingNotifications` is provided,
53
+ * they are buffered on the session and sent via WebSocket when the
54
+ * client connects (e.g. `ui/notifications/tool-result`).
55
+ * - `null` — the server responds with 404
56
+ */
57
+ readonly onHttpRequest?: (request: Request) => Promise<Response | {
58
+ html: string;
59
+ pendingNotifications?: PendingNotification[];
60
+ } | null>;
61
+ }
62
+ /** Tool result data to be pushed to an MCP App via WebSocket. */
63
+ export interface ToolResultData {
64
+ readonly content: ReadonlyArray<{
65
+ type: string;
66
+ text?: string;
67
+ data?: string;
68
+ mimeType?: string;
69
+ }>;
70
+ readonly isError?: boolean;
71
+ }
72
+ /** A running resource server instance. */
73
+ export interface ResourceServer {
74
+ /** The base URL at which the server is listening. */
75
+ readonly baseUrl: string;
76
+ /** The session store (for inspection/testing). */
77
+ readonly sessions: SessionStore;
78
+ /**
79
+ * Store a tool result for later delivery to an MCP App.
80
+ * Returns an opaque reference ID. Pass it in the page URL (e.g. `?ref=abc`).
81
+ *
82
+ * When the page is served via `onHttpRequest` returning `{ html }`, the
83
+ * server automatically extracts `?ref=` from the request URL, looks up
84
+ * the stored result, and buffers it as a `ui/notifications/tool-result`
85
+ * notification on the session. No manual handling is needed.
86
+ *
87
+ * Stored results auto-expire after 5 minutes.
88
+ */
89
+ storeToolResult(result: ToolResultData): string;
90
+ /**
91
+ * Retrieve and consume a stored tool result by reference.
92
+ * Returns `undefined` if the ref doesn't exist or has expired.
93
+ * The result is deleted after retrieval (single-use).
94
+ */
95
+ consumeToolResult(ref: string): ToolResultData | undefined;
96
+ /** Stop the server and release resources. */
97
+ stop(): Promise<void>;
98
+ }
99
+ /**
100
+ * Start the resource server.
101
+ *
102
+ * @returns A running ResourceServer with baseUrl and stop() method.
103
+ */
104
+ export declare function startResourceServer(config: ResourceServerConfig): ResourceServer;
105
+ /** Build a `ui/notifications/tool-result` pending notification from ToolResultData. */
106
+ export declare function buildToolResultFromData(data: ToolResultData): PendingNotification;
107
+ //# sourceMappingURL=server.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/resource-server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAOvE,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,QAAQ,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC3D,6CAA6C;IAC7C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAoDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CA0dhB;AAaD,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,mBAAmB,CAMjF"}