@casys/mcp-bridge 0.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/esm/_dnt.shims.d.ts +2 -0
- package/esm/_dnt.shims.d.ts.map +1 -0
- package/esm/_dnt.shims.js +57 -0
- package/esm/adapters/base-adapter.d.ts +25 -0
- package/esm/adapters/base-adapter.d.ts.map +1 -0
- package/esm/adapters/base-adapter.js +86 -0
- package/esm/adapters/line/adapter.d.ts +11 -0
- package/esm/adapters/line/adapter.d.ts.map +1 -0
- package/esm/adapters/line/adapter.js +10 -0
- package/esm/adapters/line/types.d.ts +25 -0
- package/esm/adapters/line/types.d.ts.map +1 -0
- package/esm/adapters/line/types.js +4 -0
- package/esm/adapters/telegram/adapter.d.ts +11 -0
- package/esm/adapters/telegram/adapter.d.ts.map +1 -0
- package/esm/adapters/telegram/adapter.js +10 -0
- package/esm/adapters/telegram/platform-adapter.d.ts +40 -0
- package/esm/adapters/telegram/platform-adapter.d.ts.map +1 -0
- package/esm/adapters/telegram/platform-adapter.js +214 -0
- package/esm/adapters/telegram/sdk-bridge.d.ts +8 -0
- package/esm/adapters/telegram/sdk-bridge.d.ts.map +1 -0
- package/esm/adapters/telegram/sdk-bridge.js +22 -0
- package/esm/adapters/telegram/types.d.ts +93 -0
- package/esm/adapters/telegram/types.d.ts.map +1 -0
- package/esm/adapters/telegram/types.js +6 -0
- package/esm/client/bridge.js +424 -0
- package/esm/core/adapter.d.ts +88 -0
- package/esm/core/adapter.d.ts.map +1 -0
- package/esm/core/adapter.js +10 -0
- package/esm/core/bridge-client.d.ts +77 -0
- package/esm/core/bridge-client.d.ts.map +1 -0
- package/esm/core/bridge-client.js +275 -0
- package/esm/core/message-router.d.ts +71 -0
- package/esm/core/message-router.d.ts.map +1 -0
- package/esm/core/message-router.js +187 -0
- package/esm/core/protocol.d.ts +116 -0
- package/esm/core/protocol.d.ts.map +1 -0
- package/esm/core/protocol.js +203 -0
- package/esm/core/resource-resolver.d.ts +27 -0
- package/esm/core/resource-resolver.d.ts.map +1 -0
- package/esm/core/resource-resolver.js +85 -0
- package/esm/core/transport.d.ts +46 -0
- package/esm/core/transport.d.ts.map +1 -0
- package/esm/core/transport.js +85 -0
- package/esm/core/types.d.ts +187 -0
- package/esm/core/types.d.ts.map +1 -0
- package/esm/core/types.js +35 -0
- package/esm/mod.d.ts +36 -0
- package/esm/mod.d.ts.map +1 -0
- package/esm/mod.js +33 -0
- package/esm/package.json +3 -0
- package/esm/resource-server/csp.d.ts +36 -0
- package/esm/resource-server/csp.d.ts.map +1 -0
- package/esm/resource-server/csp.js +36 -0
- package/esm/resource-server/injector.d.ts +18 -0
- package/esm/resource-server/injector.d.ts.map +1 -0
- package/esm/resource-server/injector.js +39 -0
- package/esm/resource-server/server.d.ts +107 -0
- package/esm/resource-server/server.d.ts.map +1 -0
- package/esm/resource-server/server.js +483 -0
- package/esm/resource-server/session.d.ts +60 -0
- package/esm/resource-server/session.d.ts.map +1 -0
- package/esm/resource-server/session.js +86 -0
- package/esm/resource-server/telegram-auth.d.ts +45 -0
- package/esm/resource-server/telegram-auth.d.ts.map +1 -0
- package/esm/resource-server/telegram-auth.js +161 -0
- package/package.json +31 -0
- package/script/_dnt.shims.d.ts +2 -0
- package/script/_dnt.shims.d.ts.map +1 -0
- package/script/_dnt.shims.js +60 -0
- package/script/adapters/base-adapter.d.ts +25 -0
- package/script/adapters/base-adapter.d.ts.map +1 -0
- package/script/adapters/base-adapter.js +113 -0
- package/script/adapters/line/adapter.d.ts +11 -0
- package/script/adapters/line/adapter.d.ts.map +1 -0
- package/script/adapters/line/adapter.js +14 -0
- package/script/adapters/line/types.d.ts +25 -0
- package/script/adapters/line/types.d.ts.map +1 -0
- package/script/adapters/line/types.js +5 -0
- package/script/adapters/telegram/adapter.d.ts +11 -0
- package/script/adapters/telegram/adapter.d.ts.map +1 -0
- package/script/adapters/telegram/adapter.js +14 -0
- package/script/adapters/telegram/platform-adapter.d.ts +40 -0
- package/script/adapters/telegram/platform-adapter.d.ts.map +1 -0
- package/script/adapters/telegram/platform-adapter.js +241 -0
- package/script/adapters/telegram/sdk-bridge.d.ts +8 -0
- package/script/adapters/telegram/sdk-bridge.d.ts.map +1 -0
- package/script/adapters/telegram/sdk-bridge.js +48 -0
- package/script/adapters/telegram/types.d.ts +93 -0
- package/script/adapters/telegram/types.d.ts.map +1 -0
- package/script/adapters/telegram/types.js +7 -0
- package/script/client/bridge.js +424 -0
- package/script/core/adapter.d.ts +88 -0
- package/script/core/adapter.d.ts.map +1 -0
- package/script/core/adapter.js +11 -0
- package/script/core/bridge-client.d.ts +77 -0
- package/script/core/bridge-client.d.ts.map +1 -0
- package/script/core/bridge-client.js +302 -0
- package/script/core/message-router.d.ts +71 -0
- package/script/core/message-router.d.ts.map +1 -0
- package/script/core/message-router.js +191 -0
- package/script/core/protocol.d.ts +116 -0
- package/script/core/protocol.d.ts.map +1 -0
- package/script/core/protocol.js +230 -0
- package/script/core/resource-resolver.d.ts +27 -0
- package/script/core/resource-resolver.d.ts.map +1 -0
- package/script/core/resource-resolver.js +89 -0
- package/script/core/transport.d.ts +46 -0
- package/script/core/transport.d.ts.map +1 -0
- package/script/core/transport.js +112 -0
- package/script/core/types.d.ts +187 -0
- package/script/core/types.d.ts.map +1 -0
- package/script/core/types.js +38 -0
- package/script/mod.d.ts +36 -0
- package/script/mod.d.ts.map +1 -0
- package/script/mod.js +76 -0
- package/script/package.json +3 -0
- package/script/resource-server/csp.d.ts +36 -0
- package/script/resource-server/csp.d.ts.map +1 -0
- package/script/resource-server/csp.js +39 -0
- package/script/resource-server/injector.d.ts +18 -0
- package/script/resource-server/injector.d.ts.map +1 -0
- package/script/resource-server/injector.js +42 -0
- package/script/resource-server/server.d.ts +107 -0
- package/script/resource-server/server.d.ts.map +1 -0
- package/script/resource-server/server.js +487 -0
- package/script/resource-server/session.d.ts +60 -0
- package/script/resource-server/session.d.ts.map +1 -0
- package/script/resource-server/session.js +90 -0
- package/script/resource-server/telegram-auth.d.ts +45 -0
- package/script/resource-server/telegram-auth.d.ts.map +1 -0
- package/script/resource-server/telegram-auth.js +164 -0
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Core types for the MCP Apps Bridge protocol.
|
|
3
|
+
*
|
|
4
|
+
* Defines the message envelope, resource URIs, adapter configuration,
|
|
5
|
+
* and tool declarations used throughout the bridge.
|
|
6
|
+
*/
|
|
7
|
+
// ---------------------------------------------------------------------------
|
|
8
|
+
// MCP Apps JSON-RPC method constants
|
|
9
|
+
// ---------------------------------------------------------------------------
|
|
10
|
+
/**
|
|
11
|
+
* Well-known JSON-RPC method names used in the MCP Apps protocol (SEP-1865).
|
|
12
|
+
*
|
|
13
|
+
* App -> Host requests.
|
|
14
|
+
*/
|
|
15
|
+
export const McpAppsMethod = {
|
|
16
|
+
// Initialization handshake
|
|
17
|
+
UI_INITIALIZE: "ui/initialize",
|
|
18
|
+
UI_NOTIFICATIONS_INITIALIZED: "ui/notifications/initialized",
|
|
19
|
+
// App -> Host requests
|
|
20
|
+
TOOLS_CALL: "tools/call",
|
|
21
|
+
RESOURCES_READ: "resources/read",
|
|
22
|
+
UI_OPEN_LINK: "ui/open-link",
|
|
23
|
+
UI_MESSAGE: "ui/message",
|
|
24
|
+
UI_UPDATE_MODEL_CONTEXT: "ui/update-model-context",
|
|
25
|
+
UI_REQUEST_DISPLAY_MODE: "ui/request-display-mode",
|
|
26
|
+
NOTIFICATIONS_MESSAGE: "notifications/message",
|
|
27
|
+
// Host -> App notifications
|
|
28
|
+
UI_TOOL_INPUT: "ui/notifications/tool-input",
|
|
29
|
+
UI_TOOL_INPUT_PARTIAL: "ui/notifications/tool-input-partial",
|
|
30
|
+
UI_TOOL_RESULT: "ui/notifications/tool-result",
|
|
31
|
+
UI_TOOL_CANCELLED: "ui/notifications/tool-cancelled",
|
|
32
|
+
UI_HOST_CONTEXT_CHANGED: "ui/notifications/host-context-changed",
|
|
33
|
+
UI_SIZE_CHANGED: "ui/notifications/size-changed",
|
|
34
|
+
UI_RESOURCE_TEARDOWN: "ui/resource-teardown",
|
|
35
|
+
};
|
package/esm/mod.d.ts
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @module @casys/mcp-bridge
|
|
3
|
+
*
|
|
4
|
+
* Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
|
|
5
|
+
* messaging platforms such as Telegram Mini Apps and LINE LIFF.
|
|
6
|
+
*
|
|
7
|
+
* Entry point for Deno.
|
|
8
|
+
*/
|
|
9
|
+
export type { AdapterConfig, BridgeOptions, ContainerDimensions, DisplayMode, HostCapabilities, HostContext, HostContextStyles, LifecycleEvent, McpAppPermission, McpAppsErrorResponse, McpAppsMessage, McpAppsNotification, McpAppsRequest, McpAppsResponse, McpToolDeclaration, McpToolUiCsp, McpToolUiMeta, ResourceUri, SafeAreaInsets, } from "./core/types.js";
|
|
10
|
+
export { McpAppsMethod } from "./core/types.js";
|
|
11
|
+
export type { LifecycleEventHandler, McpAppsAdapter, MessageHandler, PlatformAdapter, } from "./core/adapter.js";
|
|
12
|
+
export { MessageRouter } from "./core/message-router.js";
|
|
13
|
+
export type { NotificationHandler, RequestHandler } from "./core/message-router.js";
|
|
14
|
+
export { parseResourceUri, resolveToHttp } from "./core/resource-resolver.js";
|
|
15
|
+
export { buildDisplayModeRequest, buildErrorResponse, buildHostContextChangedNotification, buildInitializedNotification, buildInitializeResponse, buildLogNotification, buildMessageRequest, buildOpenLinkRequest, buildResourceReadRequest, buildResourceTeardownRequest, buildSuccessResponse, buildToolCallRequest, buildToolCancelledNotification, buildToolInputNotification, buildToolResultNotification, buildUpdateModelContextRequest, isErrorResponse, isJsonRpcMessage, isNotification, isRequest, isResponse, JsonRpcErrorCode, nextRequestId, } from "./core/protocol.js";
|
|
16
|
+
export { WebSocketTransport } from "./core/transport.js";
|
|
17
|
+
export type { BridgeTransport, TransportMessageHandler, TransportStateHandler, } from "./core/transport.js";
|
|
18
|
+
export { BridgeClient } from "./core/bridge-client.js";
|
|
19
|
+
export type { BridgeClientOptions } from "./core/bridge-client.js";
|
|
20
|
+
export { BasePostMessageAdapter } from "./adapters/base-adapter.js";
|
|
21
|
+
export { TelegramAdapter } from "./adapters/telegram/adapter.js";
|
|
22
|
+
export { TelegramPlatformAdapter } from "./adapters/telegram/platform-adapter.js";
|
|
23
|
+
export type { TelegramAdapterConfig, TelegramEventType, TelegramSafeAreaInset, TelegramThemeParams, TelegramWebApp, } from "./adapters/telegram/types.js";
|
|
24
|
+
export { getTelegramWebApp } from "./adapters/telegram/sdk-bridge.js";
|
|
25
|
+
export { LineAdapter } from "./adapters/line/adapter.js";
|
|
26
|
+
export type { LineAdapterConfig, LiffSdk } from "./adapters/line/types.js";
|
|
27
|
+
export { buildCspHeader } from "./resource-server/csp.js";
|
|
28
|
+
export type { CspOptions } from "./resource-server/csp.js";
|
|
29
|
+
export { injectBridgeScript } from "./resource-server/injector.js";
|
|
30
|
+
export { SessionStore } from "./resource-server/session.js";
|
|
31
|
+
export type { BridgeSession, PendingNotification } from "./resource-server/session.js";
|
|
32
|
+
export { startResourceServer, buildToolResultFromData } from "./resource-server/server.js";
|
|
33
|
+
export type { ResourceServer, ResourceServerConfig, ToolResultData } from "./resource-server/server.js";
|
|
34
|
+
export { validateTelegramInitData } from "./resource-server/telegram-auth.js";
|
|
35
|
+
export type { TelegramAuthResult } from "./resource-server/telegram-auth.js";
|
|
36
|
+
//# sourceMappingURL=mod.d.ts.map
|
package/esm/mod.d.ts.map
ADDED
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../src/mod.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,aAAa,EACb,aAAa,EACb,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,WAAW,EACX,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,oBAAoB,EACpB,cAAc,EACd,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,WAAW,EACX,cAAc,GACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAGhD,YAAY,EACV,qBAAqB,EACrB,cAAc,EACd,cAAc,EACd,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AACzD,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAG9E,OAAO,EACL,uBAAuB,EACvB,kBAAkB,EAClB,mCAAmC,EACnC,4BAA4B,EAC5B,uBAAuB,EACvB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,4BAA4B,EAC5B,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,0BAA0B,EAC1B,2BAA2B,EAC3B,8BAA8B,EAC9B,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,SAAS,EACT,UAAU,EACV,gBAAgB,EAChB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,YAAY,EACV,eAAe,EACf,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,YAAY,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAGnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAGpE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAClF,YAAY,EACV,qBAAqB,EACrB,iBAAiB,EACjB,qBAAqB,EACrB,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAGtE,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,YAAY,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,YAAY,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACvF,OAAO,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAC3F,YAAY,EAAE,cAAc,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACxG,OAAO,EAAE,wBAAwB,EAAE,MAAM,oCAAoC,CAAC;AAC9E,YAAY,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC"}
|
package/esm/mod.js
ADDED
|
@@ -0,0 +1,33 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* @module @casys/mcp-bridge
|
|
3
|
+
*
|
|
4
|
+
* Bridge MCP Apps (interactive UI delivered via the MCP protocol) to
|
|
5
|
+
* messaging platforms such as Telegram Mini Apps and LINE LIFF.
|
|
6
|
+
*
|
|
7
|
+
* Entry point for Deno.
|
|
8
|
+
*/
|
|
9
|
+
export { McpAppsMethod } from "./core/types.js";
|
|
10
|
+
// Message router
|
|
11
|
+
export { MessageRouter } from "./core/message-router.js";
|
|
12
|
+
// Resource resolver
|
|
13
|
+
export { parseResourceUri, resolveToHttp } from "./core/resource-resolver.js";
|
|
14
|
+
// Protocol builders and validators
|
|
15
|
+
export { buildDisplayModeRequest, buildErrorResponse, buildHostContextChangedNotification, buildInitializedNotification, buildInitializeResponse, buildLogNotification, buildMessageRequest, buildOpenLinkRequest, buildResourceReadRequest, buildResourceTeardownRequest, buildSuccessResponse, buildToolCallRequest, buildToolCancelledNotification, buildToolInputNotification, buildToolResultNotification, buildUpdateModelContextRequest, isErrorResponse, isJsonRpcMessage, isNotification, isRequest, isResponse, JsonRpcErrorCode, nextRequestId, } from "./core/protocol.js";
|
|
16
|
+
// Transport
|
|
17
|
+
export { WebSocketTransport } from "./core/transport.js";
|
|
18
|
+
// Bridge client
|
|
19
|
+
export { BridgeClient } from "./core/bridge-client.js";
|
|
20
|
+
// Base adapter (for custom platform implementations)
|
|
21
|
+
export { BasePostMessageAdapter } from "./adapters/base-adapter.js";
|
|
22
|
+
// Adapters — Telegram
|
|
23
|
+
export { TelegramAdapter } from "./adapters/telegram/adapter.js";
|
|
24
|
+
export { TelegramPlatformAdapter } from "./adapters/telegram/platform-adapter.js";
|
|
25
|
+
export { getTelegramWebApp } from "./adapters/telegram/sdk-bridge.js";
|
|
26
|
+
// Adapters — LINE
|
|
27
|
+
export { LineAdapter } from "./adapters/line/adapter.js";
|
|
28
|
+
// Resource server
|
|
29
|
+
export { buildCspHeader } from "./resource-server/csp.js";
|
|
30
|
+
export { injectBridgeScript } from "./resource-server/injector.js";
|
|
31
|
+
export { SessionStore } from "./resource-server/session.js";
|
|
32
|
+
export { startResourceServer, buildToolResultFromData } from "./resource-server/server.js";
|
|
33
|
+
export { validateTelegramInitData } from "./resource-server/telegram-auth.js";
|
package/esm/package.json
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Content Security Policy helpers for the resource server.
|
|
3
|
+
*
|
|
4
|
+
* Generates CSP headers that allow the MCP App UI to function within
|
|
5
|
+
* platform WebViews while maintaining security.
|
|
6
|
+
*/
|
|
7
|
+
/** Options for generating a CSP header. */
|
|
8
|
+
export interface CspOptions {
|
|
9
|
+
/** Additional allowed script sources (e.g. platform SDK URLs). */
|
|
10
|
+
readonly scriptSources?: readonly string[];
|
|
11
|
+
/** Additional allowed connect sources (e.g. API endpoints). */
|
|
12
|
+
readonly connectSources?: readonly string[];
|
|
13
|
+
/** Additional allowed frame ancestors. */
|
|
14
|
+
readonly frameAncestors?: readonly string[];
|
|
15
|
+
/**
|
|
16
|
+
* If true, use `'unsafe-inline'` for scripts and styles (default).
|
|
17
|
+
* If false, only external scripts/styles from `'self'` are allowed.
|
|
18
|
+
* Use `false` when the MCP App HTML has no inline `<script>` or `<style>` tags.
|
|
19
|
+
*/
|
|
20
|
+
readonly allowInline?: boolean;
|
|
21
|
+
}
|
|
22
|
+
/**
|
|
23
|
+
* Build a Content-Security-Policy header value.
|
|
24
|
+
*
|
|
25
|
+
* Uses `default-src 'none'` as the base (deny-all), then explicitly allows
|
|
26
|
+
* only what MCP App UIs need:
|
|
27
|
+
* - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
|
|
28
|
+
* - Connections to `'self'` (+ custom sources for APIs/WebSocket)
|
|
29
|
+
* - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
|
|
30
|
+
* - Images from `'self'` and `data:`
|
|
31
|
+
* - Fonts from `'self'`
|
|
32
|
+
* - Frame ancestors from `'self'` (+ custom for platform embedding)
|
|
33
|
+
* - `base-uri 'self'` to prevent base tag injection
|
|
34
|
+
*/
|
|
35
|
+
export declare function buildCspHeader(options?: CspOptions): string;
|
|
36
|
+
//# sourceMappingURL=csp.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/resource-server/csp.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2CAA2C;AAC3C,MAAM,WAAW,UAAU;IACzB,kEAAkE;IAClE,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,+DAA+D;IAC/D,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,0CAA0C;IAC1C,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C;;;;OAIG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,OAAO,GAAE,UAAe,GAAG,MAAM,CAkB/D"}
|
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Content Security Policy helpers for the resource server.
|
|
3
|
+
*
|
|
4
|
+
* Generates CSP headers that allow the MCP App UI to function within
|
|
5
|
+
* platform WebViews while maintaining security.
|
|
6
|
+
*/
|
|
7
|
+
/**
|
|
8
|
+
* Build a Content-Security-Policy header value.
|
|
9
|
+
*
|
|
10
|
+
* Uses `default-src 'none'` as the base (deny-all), then explicitly allows
|
|
11
|
+
* only what MCP App UIs need:
|
|
12
|
+
* - Scripts from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
|
|
13
|
+
* - Connections to `'self'` (+ custom sources for APIs/WebSocket)
|
|
14
|
+
* - Styles from `'self'` (+ `'unsafe-inline'` if `allowInline` is true)
|
|
15
|
+
* - Images from `'self'` and `data:`
|
|
16
|
+
* - Fonts from `'self'`
|
|
17
|
+
* - Frame ancestors from `'self'` (+ custom for platform embedding)
|
|
18
|
+
* - `base-uri 'self'` to prevent base tag injection
|
|
19
|
+
*/
|
|
20
|
+
export function buildCspHeader(options = {}) {
|
|
21
|
+
const allowInline = options.allowInline !== false; // default true for backwards compat
|
|
22
|
+
const inlineDirective = allowInline ? " 'unsafe-inline'" : "";
|
|
23
|
+
const scriptSrc = [`'self'${inlineDirective}`, ...(options.scriptSources ?? [])].join(" ");
|
|
24
|
+
const connectSrc = ["'self'", ...(options.connectSources ?? [])].join(" ");
|
|
25
|
+
const frameAncestors = ["'self'", ...(options.frameAncestors ?? [])].join(" ");
|
|
26
|
+
return [
|
|
27
|
+
`default-src 'none'`,
|
|
28
|
+
`script-src ${scriptSrc}`,
|
|
29
|
+
`style-src 'self'${inlineDirective}`,
|
|
30
|
+
`img-src 'self' data:`,
|
|
31
|
+
`font-src 'self'`,
|
|
32
|
+
`connect-src ${connectSrc}`,
|
|
33
|
+
`frame-ancestors ${frameAncestors}`,
|
|
34
|
+
`base-uri 'self'`,
|
|
35
|
+
].join("; ");
|
|
36
|
+
}
|
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Script injector for the resource server.
|
|
3
|
+
*
|
|
4
|
+
* Injects the MCP Apps Bridge client-side script into HTML responses
|
|
5
|
+
* so that the UI can communicate with the host application.
|
|
6
|
+
*/
|
|
7
|
+
/**
|
|
8
|
+
* Inject the bridge client script tag into an HTML string.
|
|
9
|
+
*
|
|
10
|
+
* The script is inserted just before `</head>` (or `</body>` as fallback,
|
|
11
|
+
* or appended if neither tag is found).
|
|
12
|
+
*
|
|
13
|
+
* @param html - The original HTML content.
|
|
14
|
+
* @param scriptUrl - URL of the bridge client script to inject.
|
|
15
|
+
* @returns The modified HTML with the script tag inserted.
|
|
16
|
+
*/
|
|
17
|
+
export declare function injectBridgeScript(html: string, scriptUrl: string): string;
|
|
18
|
+
//# sourceMappingURL=injector.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"injector.d.ts","sourceRoot":"","sources":["../../src/resource-server/injector.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAiB1E"}
|
|
@@ -0,0 +1,39 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Script injector for the resource server.
|
|
3
|
+
*
|
|
4
|
+
* Injects the MCP Apps Bridge client-side script into HTML responses
|
|
5
|
+
* so that the UI can communicate with the host application.
|
|
6
|
+
*/
|
|
7
|
+
/**
|
|
8
|
+
* Inject the bridge client script tag into an HTML string.
|
|
9
|
+
*
|
|
10
|
+
* The script is inserted just before `</head>` (or `</body>` as fallback,
|
|
11
|
+
* or appended if neither tag is found).
|
|
12
|
+
*
|
|
13
|
+
* @param html - The original HTML content.
|
|
14
|
+
* @param scriptUrl - URL of the bridge client script to inject.
|
|
15
|
+
* @returns The modified HTML with the script tag inserted.
|
|
16
|
+
*/
|
|
17
|
+
export function injectBridgeScript(html, scriptUrl) {
|
|
18
|
+
const scriptTag = `<script src="${escapeAttr(scriptUrl)}"></script>`;
|
|
19
|
+
// Prefer injection before </head>
|
|
20
|
+
const headCloseIdx = html.indexOf("</head>");
|
|
21
|
+
if (headCloseIdx >= 0) {
|
|
22
|
+
return html.slice(0, headCloseIdx) + scriptTag + "\n" + html.slice(headCloseIdx);
|
|
23
|
+
}
|
|
24
|
+
// Fallback: before </body>
|
|
25
|
+
const bodyCloseIdx = html.indexOf("</body>");
|
|
26
|
+
if (bodyCloseIdx >= 0) {
|
|
27
|
+
return html.slice(0, bodyCloseIdx) + scriptTag + "\n" + html.slice(bodyCloseIdx);
|
|
28
|
+
}
|
|
29
|
+
// Last resort: append
|
|
30
|
+
return html + "\n" + scriptTag;
|
|
31
|
+
}
|
|
32
|
+
/** Escape a string for safe use in an HTML attribute value. */
|
|
33
|
+
function escapeAttr(value) {
|
|
34
|
+
return value
|
|
35
|
+
.replace(/&/g, "&")
|
|
36
|
+
.replace(/"/g, """)
|
|
37
|
+
.replace(/</g, "<")
|
|
38
|
+
.replace(/>/g, ">");
|
|
39
|
+
}
|
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* HTTP resource server for MCP Apps Bridge.
|
|
3
|
+
*
|
|
4
|
+
* Serves `ui://` resources as HTTP pages, injects bridge.js, sets CSP
|
|
5
|
+
* headers, and provides a WebSocket endpoint for bidirectional JSON-RPC
|
|
6
|
+
* communication between the BridgeClient (in the webview) and the MCP server.
|
|
7
|
+
*
|
|
8
|
+
* Endpoints:
|
|
9
|
+
* - `GET /app/<server>/<path>` — Serve MCP App HTML with injected bridge.js
|
|
10
|
+
* - `GET /bridge.js?platform=<p>&session=<s>` — Serve the bridge client script
|
|
11
|
+
* - `GET /health` — Health check
|
|
12
|
+
* - `WS /bridge?session=<id>` — WebSocket for JSON-RPC messaging
|
|
13
|
+
*
|
|
14
|
+
* Uses Deno.serve() for the HTTP server.
|
|
15
|
+
*/
|
|
16
|
+
import type { BridgeOptions, McpAppsMessage } from "../core/types.js";
|
|
17
|
+
import type { CspOptions } from "./csp.js";
|
|
18
|
+
import { SessionStore } from "./session.js";
|
|
19
|
+
import type { BridgeSession, PendingNotification } from "./session.js";
|
|
20
|
+
/** Resource server configuration. */
|
|
21
|
+
export interface ResourceServerConfig {
|
|
22
|
+
/** Directory containing UI assets, keyed by server name (from ui:// URI). */
|
|
23
|
+
readonly assetDirectories: Record<string, string>;
|
|
24
|
+
/** Platform name for bridge.js configuration. */
|
|
25
|
+
readonly platform: "telegram" | "line";
|
|
26
|
+
/** Bridge options (port, CORS, debug). */
|
|
27
|
+
readonly options?: BridgeOptions;
|
|
28
|
+
/** Custom CSP options applied to served HTML pages. */
|
|
29
|
+
readonly csp?: CspOptions;
|
|
30
|
+
/**
|
|
31
|
+
* Telegram bot token for HMAC-SHA256 validation of initData.
|
|
32
|
+
* Required when platform is "telegram". If omitted for telegram,
|
|
33
|
+
* the server will throw at startup (fail-fast).
|
|
34
|
+
*/
|
|
35
|
+
readonly telegramBotToken?: string;
|
|
36
|
+
/**
|
|
37
|
+
* Handler called when a JSON-RPC message is received from a webview.
|
|
38
|
+
* The server forwards tool calls here; the handler should call the
|
|
39
|
+
* MCP server and return a response.
|
|
40
|
+
* Only called for authenticated sessions.
|
|
41
|
+
*/
|
|
42
|
+
readonly onMessage?: (session: BridgeSession, message: McpAppsMessage) => Promise<McpAppsMessage | null>;
|
|
43
|
+
/**
|
|
44
|
+
* Optional handler for custom HTTP routes.
|
|
45
|
+
* Called for requests that don't match built-in routes
|
|
46
|
+
* (/health, /session, /bridge, /bridge.js, /app/).
|
|
47
|
+
*
|
|
48
|
+
* Return values:
|
|
49
|
+
* - `Response` — sent directly to the client (no bridge injection)
|
|
50
|
+
* - `{ html: string; pendingNotifications?: PendingNotification[] }` —
|
|
51
|
+
* HTML content; bridge.js will be injected, a session created, and
|
|
52
|
+
* CSP headers set automatically. If `pendingNotifications` is provided,
|
|
53
|
+
* they are buffered on the session and sent via WebSocket when the
|
|
54
|
+
* client connects (e.g. `ui/notifications/tool-result`).
|
|
55
|
+
* - `null` — the server responds with 404
|
|
56
|
+
*/
|
|
57
|
+
readonly onHttpRequest?: (request: Request) => Promise<Response | {
|
|
58
|
+
html: string;
|
|
59
|
+
pendingNotifications?: PendingNotification[];
|
|
60
|
+
} | null>;
|
|
61
|
+
}
|
|
62
|
+
/** Tool result data to be pushed to an MCP App via WebSocket. */
|
|
63
|
+
export interface ToolResultData {
|
|
64
|
+
readonly content: ReadonlyArray<{
|
|
65
|
+
type: string;
|
|
66
|
+
text?: string;
|
|
67
|
+
data?: string;
|
|
68
|
+
mimeType?: string;
|
|
69
|
+
}>;
|
|
70
|
+
readonly isError?: boolean;
|
|
71
|
+
}
|
|
72
|
+
/** A running resource server instance. */
|
|
73
|
+
export interface ResourceServer {
|
|
74
|
+
/** The base URL at which the server is listening. */
|
|
75
|
+
readonly baseUrl: string;
|
|
76
|
+
/** The session store (for inspection/testing). */
|
|
77
|
+
readonly sessions: SessionStore;
|
|
78
|
+
/**
|
|
79
|
+
* Store a tool result for later delivery to an MCP App.
|
|
80
|
+
* Returns an opaque reference ID. Pass it in the page URL (e.g. `?ref=abc`).
|
|
81
|
+
*
|
|
82
|
+
* When the page is served via `onHttpRequest` returning `{ html }`, the
|
|
83
|
+
* server automatically extracts `?ref=` from the request URL, looks up
|
|
84
|
+
* the stored result, and buffers it as a `ui/notifications/tool-result`
|
|
85
|
+
* notification on the session. No manual handling is needed.
|
|
86
|
+
*
|
|
87
|
+
* Stored results auto-expire after 5 minutes.
|
|
88
|
+
*/
|
|
89
|
+
storeToolResult(result: ToolResultData): string;
|
|
90
|
+
/**
|
|
91
|
+
* Retrieve and consume a stored tool result by reference.
|
|
92
|
+
* Returns `undefined` if the ref doesn't exist or has expired.
|
|
93
|
+
* The result is deleted after retrieval (single-use).
|
|
94
|
+
*/
|
|
95
|
+
consumeToolResult(ref: string): ToolResultData | undefined;
|
|
96
|
+
/** Stop the server and release resources. */
|
|
97
|
+
stop(): Promise<void>;
|
|
98
|
+
}
|
|
99
|
+
/**
|
|
100
|
+
* Start the resource server.
|
|
101
|
+
*
|
|
102
|
+
* @returns A running ResourceServer with baseUrl and stop() method.
|
|
103
|
+
*/
|
|
104
|
+
export declare function startResourceServer(config: ResourceServerConfig): ResourceServer;
|
|
105
|
+
/** Build a `ui/notifications/tool-result` pending notification from ToolResultData. */
|
|
106
|
+
export declare function buildToolResultFromData(data: ToolResultData): PendingNotification;
|
|
107
|
+
//# sourceMappingURL=server.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/resource-server/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAGtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAOvE,qCAAqC;AACrC,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,UAAU,GAAG,MAAM,CAAC;IACvC,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,uDAAuD;IACvD,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,CACnB,OAAO,EAAE,aAAa,EACtB,OAAO,EAAE,cAAc,KACpB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC;IACpC;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,CACvB,OAAO,EAAE,OAAO,KACb,OAAO,CAAC,QAAQ,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,mBAAmB,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAChG;AAED,iEAAiE;AACjE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACnG,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,0CAA0C;AAC1C,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC;;;;;;;;;;OAUG;IACH,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChD;;;;OAIG;IACH,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS,CAAC;IAC3D,6CAA6C;IAC7C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AAoDD;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,oBAAoB,GAC3B,cAAc,CA0dhB;AAaD,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,cAAc,GAAG,mBAAmB,CAMjF"}
|