@copilotkit/mcp-apps-renderer 1.71.2

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License
+
+Copyright (c) Atai Barkai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/README.md

@@ -0,0 +1,45 @@
+# @copilotkit/mcp-apps-renderer
+
+Framework-agnostic MCP Apps host for CopilotKit: the app↔host protocol on top of
+[`@modelcontextprotocol/ext-apps`](https://www.npmjs.com/package/@modelcontextprotocol/ext-apps)
+(AppBridge + PostMessage transport, sandbox proxy, per-thread request queue,
+`ui/message` / `ui/open-link` / `tools/call` proxy, tool input/result forwarding,
+`ui/request-display-mode`). The React / Vue / Angular renderers consume it as thin
+adapters: they create the sandbox iframe and wire reactive state, while all
+protocol logic lives in `bindMcpApp`.
+
+## Entry points
+
+| Import                                   | Contents                                                                 | Bundle                                                                                                           |
+| ---------------------------------------- | ------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
+| `@copilotkit/mcp-apps-renderer`          | `bindMcpApp` + the full session API                                      | **ESM only** — it wraps the ESM-only ext-apps bridge, and is meant to be loaded lazily via a dynamic `import()`. |
+| `@copilotkit/mcp-apps-renderer/activity` | `MCPAppsActivityType`, `MCPAppsActivityContentSchema`, `ɵrunMcpFollowUp` | ESM + CJS. Bridge-free: importing it to register the activity does **not** pull the ext-apps bundle.             |
+
+The root is ESM-only on purpose: `@modelcontextprotocol/ext-apps` ships ESM only,
+so a CommonJS root would emit a `require()` of an ES module and fail with
+`ERR_REQUIRE_ESM`. Consume `bindMcpApp` via a dynamic `import()` (which resolves
+ESM from any module system), and import the bridge-free `/activity` surface for
+synchronous activity registration.
+
+## Script-tag / UMD usage
+
+This package also ships a UMD build of the bridge-free `/activity` entry:
+`dist/activity.umd.js`, which defines the global
+`CopilotKitMcpAppsRendererActivity`.
+
+`@copilotkit/react-core`'s UMD build references that global (it externalizes
+`@copilotkit/mcp-apps-renderer/activity` to register the built-in MCP Apps
+activity). **Script-tag consumers of react-core's UMD must therefore load
+`activity.umd.js` before `@copilotkit/react-core`'s UMD bundle**, alongside the
+other UMD globals it depends on (React, `CopilotKitCore`,
+`CopilotKitA2UIRenderer`, …):
+
+```html
+<!-- ...React, @copilotkit/core, @copilotkit/a2ui-renderer, etc. first... -->
+<script src="https://unpkg.com/@copilotkit/mcp-apps-renderer/dist/activity.umd.js"></script>
+<script src="https://unpkg.com/@copilotkit/react-core/dist/index.umd.js"></script>
+```
+
+Only the bridge-free `/activity` surface has a UMD build; the ext-apps bridge
+itself (`bindMcpApp`) is loaded lazily via `import()` and is not part of the UMD
+graph, so it only loads when an MCP App is actually rendered.

package/dist/activity.cjs

@@ -0,0 +1,9 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_constants = require('./constants.cjs');
+const require_content_schema = require('./content-schema.cjs');
+const require_follow_up = require('./follow-up.cjs');
+
+exports.MCPAppsActivityContentSchema = require_content_schema.MCPAppsActivityContentSchema;
+exports.MCPAppsActivityType = require_constants.MCPAppsActivityType;
+exports.MCP_OPEN_LINK_BLOCKED_SCHEMES = require_constants.MCP_OPEN_LINK_BLOCKED_SCHEMES;
+exports.ɵrunMcpFollowUp = require_follow_up.ɵrunMcpFollowUp;

package/dist/activity.d.cts

@@ -0,0 +1,4 @@
+import { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES } from "./constants.cjs";
+import { MCPAppsActivityContent, MCPAppsActivityContentSchema } from "./content-schema.cjs";
+import { ɵMcpFollowUpHost, ɵrunMcpFollowUp } from "./follow-up.cjs";
+export { MCPAppsActivityContent, MCPAppsActivityContentSchema, MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES, ɵMcpFollowUpHost, ɵrunMcpFollowUp };

package/dist/activity.d.mts

@@ -0,0 +1,4 @@
+import { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES } from "./constants.mjs";
+import { MCPAppsActivityContent, MCPAppsActivityContentSchema } from "./content-schema.mjs";
+import { ɵMcpFollowUpHost, ɵrunMcpFollowUp } from "./follow-up.mjs";
+export { MCPAppsActivityContent, MCPAppsActivityContentSchema, MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES, ɵMcpFollowUpHost, ɵrunMcpFollowUp };

package/dist/activity.mjs

@@ -0,0 +1,5 @@
+import { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES } from "./constants.mjs";
+import { MCPAppsActivityContentSchema } from "./content-schema.mjs";
+import { ɵrunMcpFollowUp } from "./follow-up.mjs";
+
+export { MCPAppsActivityContentSchema, MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES, ɵrunMcpFollowUp };

package/dist/activity.umd.js

@@ -0,0 +1,91 @@
+(function(global, factory) {
+  typeof exports === 'object' && typeof module !== 'undefined' ?  factory(exports, require('zod')) :
+  typeof define === 'function' && define.amd ? define(['exports', 'zod'], factory) :
+  (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory((global.CopilotKitMcpAppsRendererActivity = {}), global.Zod));
+})(this, function(exports, zod) {
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+
+//#region src/constants.ts
+/**
+	* Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.
+	*/
+	const MCPAppsActivityType = "mcp-apps";
+	/**
+	* URL schemes a widget may NOT open via ui/open-link. The ext-apps schema
+	* validates `url` as a plain string only (noopener/noreferrer does not restrict
+	* the scheme), so ui/open-link could otherwise become an XSS vector.
+	*
+	* We use a denylist rather than an allowlist on purpose: deep links use
+	* arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,
+	* `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them
+	* just hands off to an OS handler - it does not execute script in the page, so
+	* it is not an XSS risk. Universal links / App Links are plain `https:` URLs and
+	* pass regardless. What IS dangerous is the small, well-known set of schemes
+	* that execute script or render attacker HTML in the page context; block those
+	* and allow everything else (including deep links).
+	*/
+	const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+		"javascript:",
+		"data:",
+		"vbscript:",
+		"blob:",
+		"file:"
+	]);
+
+//#endregion
+//#region src/content-schema.ts
+/**
+	* Zod schema for MCP Apps activity content (middleware 0.0.2 format). The
+	* framework activity registries validate the activity content with this before
+	* handing it to the renderer/session.
+	*/
+	const MCPAppsActivityContentSchema = zod.z.object({
+		result: zod.z.object({
+			content: zod.z.array(zod.z.any()).optional(),
+			structuredContent: zod.z.any().optional(),
+			isError: zod.z.boolean().optional()
+		}),
+		resourceUri: zod.z.string(),
+		serverHash: zod.z.string(),
+		serverId: zod.z.string().optional(),
+		toolInput: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+	});
+
+//#endregion
+//#region src/follow-up.ts
+/**
+	* Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued
+	* for (issue #5819).
+	*
+	* The MCP request queue delays follow-up work until the agent is idle. There is
+	* a single shared registry agent per id, and switching threads overwrites its
+	* `threadId`/`messages` in place. So if the host switches threads while a
+	* follow-up is queued, running it now would execute against — and stream into —
+	* the now-foreground thread.
+	*
+	* - **Same thread** (the common case): run on the shared agent, unchanged.
+	* - **Thread changed**: the shared agent has moved on, so the follow-up can no
+	*   longer run in its originating thread's context. Drop it rather than leak it
+	*   into the current thread. (The MCP app already received its `ui/message` ack
+	*   at enqueue time; only the optional agent turn is skipped.)
+	*
+	* @internal exported for testing.
+	*/
+	async function ɵrunMcpFollowUp({ host, agent, capturedThreadId }) {
+		const currentThreadId = agent.threadId || "default";
+		const originThreadId = capturedThreadId || "default";
+		if (currentThreadId === originThreadId) return host.runAgent({ agent });
+		console.warn(`[MCPAppsRenderer] ui/message follow-up dropped: the thread changed (${originThreadId} → ${currentThreadId}) between enqueue and execution, so running it would leak into the now-foreground thread.`);
+		return {
+			result: void 0,
+			newMessages: []
+		};
+	}
+
+//#endregion
+exports.MCPAppsActivityContentSchema = MCPAppsActivityContentSchema;
+exports.MCPAppsActivityType = MCPAppsActivityType;
+exports.MCP_OPEN_LINK_BLOCKED_SCHEMES = MCP_OPEN_LINK_BLOCKED_SCHEMES;
+exports.ɵrunMcpFollowUp = ɵrunMcpFollowUp;
+});
+//# sourceMappingURL=activity.umd.js.map

package/dist/activity.umd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.umd.js","names":["z"],"sources":["../src/constants.ts","../src/content-schema.ts","../src/follow-up.ts"],"sourcesContent":["/**\n * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.\n */\nexport const MCPAppsActivityType = \"mcp-apps\";\n\n/**\n * URL schemes a widget may NOT open via ui/open-link. The ext-apps schema\n * validates `url` as a plain string only (noopener/noreferrer does not restrict\n * the scheme), so ui/open-link could otherwise become an XSS vector.\n *\n * We use a denylist rather than an allowlist on purpose: deep links use\n * arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,\n * `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them\n * just hands off to an OS handler - it does not execute script in the page, so\n * it is not an XSS risk. Universal links / App Links are plain `https:` URLs and\n * pass regardless. What IS dangerous is the small, well-known set of schemes\n * that execute script or render attacker HTML in the page context; block those\n * and allow everything else (including deep links).\n */\nexport const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([\n  \"javascript:\",\n  \"data:\",\n  \"vbscript:\",\n  \"blob:\",\n  \"file:\",\n]);\n","import { z } from \"zod\";\n\n/**\n * Zod schema for MCP Apps activity content (middleware 0.0.2 format). The\n * framework activity registries validate the activity content with this before\n * handing it to the renderer/session.\n */\nexport const MCPAppsActivityContentSchema = z.object({\n  result: z.object({\n    content: z.array(z.any()).optional(),\n    structuredContent: z.any().optional(),\n    isError: z.boolean().optional(),\n  }),\n  // Resource URI to fetch (e.g., \"ui://server/dashboard\")\n  resourceUri: z.string(),\n  // MD5 hash of server config (renamed from serverId in 0.0.1)\n  serverHash: z.string(),\n  // Optional stable server ID from config (takes precedence over serverHash)\n  serverId: z.string().optional(),\n  // Original tool input arguments\n  toolInput: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type MCPAppsActivityContent = z.infer<\n  typeof MCPAppsActivityContentSchema\n>;\n","import type { AbstractAgent, RunAgentResult } from \"@ag-ui/client\";\n\n/**\n * The subset of `CopilotKitCore` that {@link ɵrunMcpFollowUp} depends on.\n * Declared structurally so the runner can be unit-tested without a full core.\n */\nexport interface ɵMcpFollowUpHost {\n  runAgent(params: { agent: AbstractAgent }): Promise<RunAgentResult>;\n}\n\n/**\n * Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued\n * for (issue #5819).\n *\n * The MCP request queue delays follow-up work until the agent is idle. There is\n * a single shared registry agent per id, and switching threads overwrites its\n * `threadId`/`messages` in place. So if the host switches threads while a\n * follow-up is queued, running it now would execute against — and stream into —\n * the now-foreground thread.\n *\n * - **Same thread** (the common case): run on the shared agent, unchanged.\n * - **Thread changed**: the shared agent has moved on, so the follow-up can no\n *   longer run in its originating thread's context. Drop it rather than leak it\n *   into the current thread. (The MCP app already received its `ui/message` ack\n *   at enqueue time; only the optional agent turn is skipped.)\n *\n * @internal exported for testing.\n */\nexport async function ɵrunMcpFollowUp({\n  host,\n  agent,\n  capturedThreadId,\n}: {\n  host: ɵMcpFollowUpHost;\n  agent: AbstractAgent;\n  capturedThreadId: string;\n}): Promise<RunAgentResult> {\n  const currentThreadId = agent.threadId || \"default\";\n  const originThreadId = capturedThreadId || \"default\";\n\n  if (currentThreadId === originThreadId) {\n    return host.runAgent({ agent });\n  }\n\n  console.warn(\n    \"[MCPAppsRenderer] ui/message follow-up dropped: the thread changed \" +\n      `(${originThreadId} → ${currentThreadId}) between enqueue and execution, ` +\n      \"so running it would leak into the now-foreground thread.\",\n  );\n  return { result: undefined, newMessages: [] };\n}\n"],"mappings":";;;;;;;;;;;CAGA,MAAa,sBAAsB;;;;;;;;;;;;;;;CAgBnC,MAAa,gCAAgC,IAAI,IAAI;EACnD;EACA;EACA;EACA;EACA;EACD,CAAC;;;;;;;;;CClBF,MAAa,+BAA+BA,MAAE,OAAO;EACnD,QAAQA,MAAE,OAAO;GACf,SAASA,MAAE,MAAMA,MAAE,KAAK,CAAC,CAAC,UAAU;GACpC,mBAAmBA,MAAE,KAAK,CAAC,UAAU;GACrC,SAASA,MAAE,SAAS,CAAC,UAAU;GAChC,CAAC;EAEF,aAAaA,MAAE,QAAQ;EAEvB,YAAYA,MAAE,QAAQ;EAEtB,UAAUA,MAAE,QAAQ,CAAC,UAAU;EAE/B,WAAWA,MAAE,OAAOA,MAAE,QAAQ,EAAEA,MAAE,SAAS,CAAC,CAAC,UAAU;EACxD,CAAC;;;;;;;;;;;;;;;;;;;;;;CCOF,eAAsB,gBAAgB,EACpC,MACA,OACA,oBAK0B;EAC1B,MAAM,kBAAkB,MAAM,YAAY;EAC1C,MAAM,iBAAiB,oBAAoB;AAE3C,MAAI,oBAAoB,eACtB,QAAO,KAAK,SAAS,EAAE,OAAO,CAAC;AAGjC,UAAQ,KACN,uEACM,eAAe,KAAK,gBAAgB,2FAE3C;AACD,SAAO;GAAE,QAAQ;GAAW,aAAa,EAAE;GAAE"}

package/dist/constants.cjs

@@ -0,0 +1,32 @@
+
+//#region src/constants.ts
+/**
+* Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.
+*/
+const MCPAppsActivityType = "mcp-apps";
+/**
+* URL schemes a widget may NOT open via ui/open-link. The ext-apps schema
+* validates `url` as a plain string only (noopener/noreferrer does not restrict
+* the scheme), so ui/open-link could otherwise become an XSS vector.
+*
+* We use a denylist rather than an allowlist on purpose: deep links use
+* arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,
+* `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them
+* just hands off to an OS handler - it does not execute script in the page, so
+* it is not an XSS risk. Universal links / App Links are plain `https:` URLs and
+* pass regardless. What IS dangerous is the small, well-known set of schemes
+* that execute script or render attacker HTML in the page context; block those
+* and allow everything else (including deep links).
+*/
+const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:",
+	"file:"
+]);
+
+//#endregion
+exports.MCPAppsActivityType = MCPAppsActivityType;
+exports.MCP_OPEN_LINK_BLOCKED_SCHEMES = MCP_OPEN_LINK_BLOCKED_SCHEMES;
+//# sourceMappingURL=constants.cjs.map

package/dist/constants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.cjs","names":[],"sources":["../src/constants.ts"],"sourcesContent":["/**\n * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.\n */\nexport const MCPAppsActivityType = \"mcp-apps\";\n\n/**\n * URL schemes a widget may NOT open via ui/open-link. The ext-apps schema\n * validates `url` as a plain string only (noopener/noreferrer does not restrict\n * the scheme), so ui/open-link could otherwise become an XSS vector.\n *\n * We use a denylist rather than an allowlist on purpose: deep links use\n * arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,\n * `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them\n * just hands off to an OS handler - it does not execute script in the page, so\n * it is not an XSS risk. Universal links / App Links are plain `https:` URLs and\n * pass regardless. What IS dangerous is the small, well-known set of schemes\n * that execute script or render attacker HTML in the page context; block those\n * and allow everything else (including deep links).\n */\nexport const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([\n  \"javascript:\",\n  \"data:\",\n  \"vbscript:\",\n  \"blob:\",\n  \"file:\",\n]);\n"],"mappings":";;;;;AAGA,MAAa,sBAAsB;;;;;;;;;;;;;;;AAgBnC,MAAa,gCAAgC,IAAI,IAAI;CACnD;CACA;CACA;CACA;CACA;CACD,CAAC"}

package/dist/constants.d.cts

@@ -0,0 +1,23 @@
+//#region src/constants.d.ts
+/**
+ * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.
+ */
+declare const MCPAppsActivityType = "mcp-apps";
+/**
+ * URL schemes a widget may NOT open via ui/open-link. The ext-apps schema
+ * validates `url` as a plain string only (noopener/noreferrer does not restrict
+ * the scheme), so ui/open-link could otherwise become an XSS vector.
+ *
+ * We use a denylist rather than an allowlist on purpose: deep links use
+ * arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,
+ * `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them
+ * just hands off to an OS handler - it does not execute script in the page, so
+ * it is not an XSS risk. Universal links / App Links are plain `https:` URLs and
+ * pass regardless. What IS dangerous is the small, well-known set of schemes
+ * that execute script or render attacker HTML in the page context; block those
+ * and allow everything else (including deep links).
+ */
+declare const MCP_OPEN_LINK_BLOCKED_SCHEMES: Set<string>;
+//#endregion
+export { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES };
+//# sourceMappingURL=constants.d.cts.map

package/dist/constants.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.cts","names":[],"sources":["../src/constants.ts"],"mappings":";;AAGA;;cAAa,mBAAA;;;AAgBb;;;;;;;;;;;;cAAa,6BAAA,EAA6B,GAAA"}

package/dist/constants.d.mts

@@ -0,0 +1,23 @@
+//#region src/constants.d.ts
+/**
+ * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.
+ */
+declare const MCPAppsActivityType = "mcp-apps";
+/**
+ * URL schemes a widget may NOT open via ui/open-link. The ext-apps schema
+ * validates `url` as a plain string only (noopener/noreferrer does not restrict
+ * the scheme), so ui/open-link could otherwise become an XSS vector.
+ *
+ * We use a denylist rather than an allowlist on purpose: deep links use
+ * arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,
+ * `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them
+ * just hands off to an OS handler - it does not execute script in the page, so
+ * it is not an XSS risk. Universal links / App Links are plain `https:` URLs and
+ * pass regardless. What IS dangerous is the small, well-known set of schemes
+ * that execute script or render attacker HTML in the page context; block those
+ * and allow everything else (including deep links).
+ */
+declare const MCP_OPEN_LINK_BLOCKED_SCHEMES: Set<string>;
+//#endregion
+export { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES };
+//# sourceMappingURL=constants.d.mts.map

package/dist/constants.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.mts","names":[],"sources":["../src/constants.ts"],"mappings":";;AAGA;;cAAa,mBAAA;;;AAgBb;;;;;;;;;;;;cAAa,6BAAA,EAA6B,GAAA"}

package/dist/constants.mjs

@@ -0,0 +1,30 @@
+//#region src/constants.ts
+/**
+* Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.
+*/
+const MCPAppsActivityType = "mcp-apps";
+/**
+* URL schemes a widget may NOT open via ui/open-link. The ext-apps schema
+* validates `url` as a plain string only (noopener/noreferrer does not restrict
+* the scheme), so ui/open-link could otherwise become an XSS vector.
+*
+* We use a denylist rather than an allowlist on purpose: deep links use
+* arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,
+* `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them
+* just hands off to an OS handler - it does not execute script in the page, so
+* it is not an XSS risk. Universal links / App Links are plain `https:` URLs and
+* pass regardless. What IS dangerous is the small, well-known set of schemes
+* that execute script or render attacker HTML in the page context; block those
+* and allow everything else (including deep links).
+*/
+const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([
+	"javascript:",
+	"data:",
+	"vbscript:",
+	"blob:",
+	"file:"
+]);
+
+//#endregion
+export { MCPAppsActivityType, MCP_OPEN_LINK_BLOCKED_SCHEMES };
+//# sourceMappingURL=constants.mjs.map

package/dist/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":[],"sources":["../src/constants.ts"],"sourcesContent":["/**\n * Activity type for MCP Apps events - must match the middleware's MCPAppsActivityType.\n */\nexport const MCPAppsActivityType = \"mcp-apps\";\n\n/**\n * URL schemes a widget may NOT open via ui/open-link. The ext-apps schema\n * validates `url` as a plain string only (noopener/noreferrer does not restrict\n * the scheme), so ui/open-link could otherwise become an XSS vector.\n *\n * We use a denylist rather than an allowlist on purpose: deep links use\n * arbitrary, app-defined schemes (`myapp:`, `whatsapp:`, `slack:`, `spotify:`,\n * `sms:`, ...) that an allowlist could never enumerate, and `window.open`ing them\n * just hands off to an OS handler - it does not execute script in the page, so\n * it is not an XSS risk. Universal links / App Links are plain `https:` URLs and\n * pass regardless. What IS dangerous is the small, well-known set of schemes\n * that execute script or render attacker HTML in the page context; block those\n * and allow everything else (including deep links).\n */\nexport const MCP_OPEN_LINK_BLOCKED_SCHEMES = new Set([\n  \"javascript:\",\n  \"data:\",\n  \"vbscript:\",\n  \"blob:\",\n  \"file:\",\n]);\n"],"mappings":";;;;AAGA,MAAa,sBAAsB;;;;;;;;;;;;;;;AAgBnC,MAAa,gCAAgC,IAAI,IAAI;CACnD;CACA;CACA;CACA;CACA;CACD,CAAC"}

package/dist/content-schema.cjs

@@ -0,0 +1,23 @@
+let zod = require("zod");
+
+//#region src/content-schema.ts
+/**
+* Zod schema for MCP Apps activity content (middleware 0.0.2 format). The
+* framework activity registries validate the activity content with this before
+* handing it to the renderer/session.
+*/
+const MCPAppsActivityContentSchema = zod.z.object({
+	result: zod.z.object({
+		content: zod.z.array(zod.z.any()).optional(),
+		structuredContent: zod.z.any().optional(),
+		isError: zod.z.boolean().optional()
+	}),
+	resourceUri: zod.z.string(),
+	serverHash: zod.z.string(),
+	serverId: zod.z.string().optional(),
+	toolInput: zod.z.record(zod.z.string(), zod.z.unknown()).optional()
+});
+
+//#endregion
+exports.MCPAppsActivityContentSchema = MCPAppsActivityContentSchema;
+//# sourceMappingURL=content-schema.cjs.map

package/dist/content-schema.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-schema.cjs","names":["z"],"sources":["../src/content-schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Zod schema for MCP Apps activity content (middleware 0.0.2 format). The\n * framework activity registries validate the activity content with this before\n * handing it to the renderer/session.\n */\nexport const MCPAppsActivityContentSchema = z.object({\n  result: z.object({\n    content: z.array(z.any()).optional(),\n    structuredContent: z.any().optional(),\n    isError: z.boolean().optional(),\n  }),\n  // Resource URI to fetch (e.g., \"ui://server/dashboard\")\n  resourceUri: z.string(),\n  // MD5 hash of server config (renamed from serverId in 0.0.1)\n  serverHash: z.string(),\n  // Optional stable server ID from config (takes precedence over serverHash)\n  serverId: z.string().optional(),\n  // Original tool input arguments\n  toolInput: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type MCPAppsActivityContent = z.infer<\n  typeof MCPAppsActivityContentSchema\n>;\n"],"mappings":";;;;;;;;AAOA,MAAa,+BAA+BA,MAAE,OAAO;CACnD,QAAQA,MAAE,OAAO;EACf,SAASA,MAAE,MAAMA,MAAE,KAAK,CAAC,CAAC,UAAU;EACpC,mBAAmBA,MAAE,KAAK,CAAC,UAAU;EACrC,SAASA,MAAE,SAAS,CAAC,UAAU;EAChC,CAAC;CAEF,aAAaA,MAAE,QAAQ;CAEvB,YAAYA,MAAE,QAAQ;CAEtB,UAAUA,MAAE,QAAQ,CAAC,UAAU;CAE/B,WAAWA,MAAE,OAAOA,MAAE,QAAQ,EAAEA,MAAE,SAAS,CAAC,CAAC,UAAU;CACxD,CAAC"}

package/dist/content-schema.d.cts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+
+//#region src/content-schema.d.ts
+/**
+ * Zod schema for MCP Apps activity content (middleware 0.0.2 format). The
+ * framework activity registries validate the activity content with this before
+ * handing it to the renderer/session.
+ */
+declare const MCPAppsActivityContentSchema: z.ZodObject<{
+  result: z.ZodObject<{
+    content: z.ZodOptional<z.ZodArray<z.ZodAny, "many">>;
+    structuredContent: z.ZodOptional<z.ZodAny>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+  }, "strip", z.ZodTypeAny, {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  }, {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  }>;
+  resourceUri: z.ZodString;
+  serverHash: z.ZodString;
+  serverId: z.ZodOptional<z.ZodString>;
+  toolInput: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+  result: {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  };
+  resourceUri: string;
+  serverHash: string;
+  serverId?: string | undefined;
+  toolInput?: Record<string, unknown> | undefined;
+}, {
+  result: {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  };
+  resourceUri: string;
+  serverHash: string;
+  serverId?: string | undefined;
+  toolInput?: Record<string, unknown> | undefined;
+}>;
+type MCPAppsActivityContent = z.infer<typeof MCPAppsActivityContentSchema>;
+//#endregion
+export { MCPAppsActivityContent, MCPAppsActivityContentSchema };
+//# sourceMappingURL=content-schema.d.cts.map

package/dist/content-schema.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-schema.d.cts","names":[],"sources":["../src/content-schema.ts"],"mappings":";;;;;AAOA;;;cAAa,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgB7B,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAC9B,4BAAA"}

package/dist/content-schema.d.mts

@@ -0,0 +1,51 @@
+import { z } from "zod";
+
+//#region src/content-schema.d.ts
+/**
+ * Zod schema for MCP Apps activity content (middleware 0.0.2 format). The
+ * framework activity registries validate the activity content with this before
+ * handing it to the renderer/session.
+ */
+declare const MCPAppsActivityContentSchema: z.ZodObject<{
+  result: z.ZodObject<{
+    content: z.ZodOptional<z.ZodArray<z.ZodAny, "many">>;
+    structuredContent: z.ZodOptional<z.ZodAny>;
+    isError: z.ZodOptional<z.ZodBoolean>;
+  }, "strip", z.ZodTypeAny, {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  }, {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  }>;
+  resourceUri: z.ZodString;
+  serverHash: z.ZodString;
+  serverId: z.ZodOptional<z.ZodString>;
+  toolInput: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+}, "strip", z.ZodTypeAny, {
+  result: {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  };
+  resourceUri: string;
+  serverHash: string;
+  serverId?: string | undefined;
+  toolInput?: Record<string, unknown> | undefined;
+}, {
+  result: {
+    content?: any[] | undefined;
+    structuredContent?: any;
+    isError?: boolean | undefined;
+  };
+  resourceUri: string;
+  serverHash: string;
+  serverId?: string | undefined;
+  toolInput?: Record<string, unknown> | undefined;
+}>;
+type MCPAppsActivityContent = z.infer<typeof MCPAppsActivityContentSchema>;
+//#endregion
+export { MCPAppsActivityContent, MCPAppsActivityContentSchema };
+//# sourceMappingURL=content-schema.d.mts.map

package/dist/content-schema.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-schema.d.mts","names":[],"sources":["../src/content-schema.ts"],"mappings":";;;;;AAOA;;;cAAa,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAgB7B,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAC9B,4BAAA"}

package/dist/content-schema.mjs

@@ -0,0 +1,23 @@
+import { z } from "zod";
+
+//#region src/content-schema.ts
+/**
+* Zod schema for MCP Apps activity content (middleware 0.0.2 format). The
+* framework activity registries validate the activity content with this before
+* handing it to the renderer/session.
+*/
+const MCPAppsActivityContentSchema = z.object({
+	result: z.object({
+		content: z.array(z.any()).optional(),
+		structuredContent: z.any().optional(),
+		isError: z.boolean().optional()
+	}),
+	resourceUri: z.string(),
+	serverHash: z.string(),
+	serverId: z.string().optional(),
+	toolInput: z.record(z.string(), z.unknown()).optional()
+});
+
+//#endregion
+export { MCPAppsActivityContentSchema };
+//# sourceMappingURL=content-schema.mjs.map

package/dist/content-schema.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-schema.mjs","names":[],"sources":["../src/content-schema.ts"],"sourcesContent":["import { z } from \"zod\";\n\n/**\n * Zod schema for MCP Apps activity content (middleware 0.0.2 format). The\n * framework activity registries validate the activity content with this before\n * handing it to the renderer/session.\n */\nexport const MCPAppsActivityContentSchema = z.object({\n  result: z.object({\n    content: z.array(z.any()).optional(),\n    structuredContent: z.any().optional(),\n    isError: z.boolean().optional(),\n  }),\n  // Resource URI to fetch (e.g., \"ui://server/dashboard\")\n  resourceUri: z.string(),\n  // MD5 hash of server config (renamed from serverId in 0.0.1)\n  serverHash: z.string(),\n  // Optional stable server ID from config (takes precedence over serverHash)\n  serverId: z.string().optional(),\n  // Original tool input arguments\n  toolInput: z.record(z.string(), z.unknown()).optional(),\n});\n\nexport type MCPAppsActivityContent = z.infer<\n  typeof MCPAppsActivityContentSchema\n>;\n"],"mappings":";;;;;;;;AAOA,MAAa,+BAA+B,EAAE,OAAO;CACnD,QAAQ,EAAE,OAAO;EACf,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,UAAU;EACpC,mBAAmB,EAAE,KAAK,CAAC,UAAU;EACrC,SAAS,EAAE,SAAS,CAAC,UAAU;EAChC,CAAC;CAEF,aAAa,EAAE,QAAQ;CAEvB,YAAY,EAAE,QAAQ;CAEtB,UAAU,EAAE,QAAQ,CAAC,UAAU;CAE/B,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,SAAS,CAAC,CAAC,UAAU;CACxD,CAAC"}

package/dist/follow-up.cjs

@@ -0,0 +1,34 @@
+
+//#region src/follow-up.ts
+/**
+* Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued
+* for (issue #5819).
+*
+* The MCP request queue delays follow-up work until the agent is idle. There is
+* a single shared registry agent per id, and switching threads overwrites its
+* `threadId`/`messages` in place. So if the host switches threads while a
+* follow-up is queued, running it now would execute against — and stream into —
+* the now-foreground thread.
+*
+* - **Same thread** (the common case): run on the shared agent, unchanged.
+* - **Thread changed**: the shared agent has moved on, so the follow-up can no
+*   longer run in its originating thread's context. Drop it rather than leak it
+*   into the current thread. (The MCP app already received its `ui/message` ack
+*   at enqueue time; only the optional agent turn is skipped.)
+*
+* @internal exported for testing.
+*/
+async function ɵrunMcpFollowUp({ host, agent, capturedThreadId }) {
+	const currentThreadId = agent.threadId || "default";
+	const originThreadId = capturedThreadId || "default";
+	if (currentThreadId === originThreadId) return host.runAgent({ agent });
+	console.warn(`[MCPAppsRenderer] ui/message follow-up dropped: the thread changed (${originThreadId} → ${currentThreadId}) between enqueue and execution, so running it would leak into the now-foreground thread.`);
+	return {
+		result: void 0,
+		newMessages: []
+	};
+}
+
+//#endregion
+exports.ɵrunMcpFollowUp = ɵrunMcpFollowUp;
+//# sourceMappingURL=follow-up.cjs.map

package/dist/follow-up.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"follow-up.cjs","names":[],"sources":["../src/follow-up.ts"],"sourcesContent":["import type { AbstractAgent, RunAgentResult } from \"@ag-ui/client\";\n\n/**\n * The subset of `CopilotKitCore` that {@link ɵrunMcpFollowUp} depends on.\n * Declared structurally so the runner can be unit-tested without a full core.\n */\nexport interface ɵMcpFollowUpHost {\n  runAgent(params: { agent: AbstractAgent }): Promise<RunAgentResult>;\n}\n\n/**\n * Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued\n * for (issue #5819).\n *\n * The MCP request queue delays follow-up work until the agent is idle. There is\n * a single shared registry agent per id, and switching threads overwrites its\n * `threadId`/`messages` in place. So if the host switches threads while a\n * follow-up is queued, running it now would execute against — and stream into —\n * the now-foreground thread.\n *\n * - **Same thread** (the common case): run on the shared agent, unchanged.\n * - **Thread changed**: the shared agent has moved on, so the follow-up can no\n *   longer run in its originating thread's context. Drop it rather than leak it\n *   into the current thread. (The MCP app already received its `ui/message` ack\n *   at enqueue time; only the optional agent turn is skipped.)\n *\n * @internal exported for testing.\n */\nexport async function ɵrunMcpFollowUp({\n  host,\n  agent,\n  capturedThreadId,\n}: {\n  host: ɵMcpFollowUpHost;\n  agent: AbstractAgent;\n  capturedThreadId: string;\n}): Promise<RunAgentResult> {\n  const currentThreadId = agent.threadId || \"default\";\n  const originThreadId = capturedThreadId || \"default\";\n\n  if (currentThreadId === originThreadId) {\n    return host.runAgent({ agent });\n  }\n\n  console.warn(\n    \"[MCPAppsRenderer] ui/message follow-up dropped: the thread changed \" +\n      `(${originThreadId} → ${currentThreadId}) between enqueue and execution, ` +\n      \"so running it would leak into the now-foreground thread.\",\n  );\n  return { result: undefined, newMessages: [] };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,gBAAgB,EACpC,MACA,OACA,oBAK0B;CAC1B,MAAM,kBAAkB,MAAM,YAAY;CAC1C,MAAM,iBAAiB,oBAAoB;AAE3C,KAAI,oBAAoB,eACtB,QAAO,KAAK,SAAS,EAAE,OAAO,CAAC;AAGjC,SAAQ,KACN,uEACM,eAAe,KAAK,gBAAgB,2FAE3C;AACD,QAAO;EAAE,QAAQ;EAAW,aAAa,EAAE;EAAE"}

package/dist/follow-up.d.cts

@@ -0,0 +1,42 @@
+import { AbstractAgent, RunAgentResult } from "@ag-ui/client";
+
+//#region src/follow-up.d.ts
+/**
+ * The subset of `CopilotKitCore` that {@link ɵrunMcpFollowUp} depends on.
+ * Declared structurally so the runner can be unit-tested without a full core.
+ */
+interface ɵMcpFollowUpHost {
+  runAgent(params: {
+    agent: AbstractAgent;
+  }): Promise<RunAgentResult>;
+}
+/**
+ * Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued
+ * for (issue #5819).
+ *
+ * The MCP request queue delays follow-up work until the agent is idle. There is
+ * a single shared registry agent per id, and switching threads overwrites its
+ * `threadId`/`messages` in place. So if the host switches threads while a
+ * follow-up is queued, running it now would execute against — and stream into —
+ * the now-foreground thread.
+ *
+ * - **Same thread** (the common case): run on the shared agent, unchanged.
+ * - **Thread changed**: the shared agent has moved on, so the follow-up can no
+ *   longer run in its originating thread's context. Drop it rather than leak it
+ *   into the current thread. (The MCP app already received its `ui/message` ack
+ *   at enqueue time; only the optional agent turn is skipped.)
+ *
+ * @internal exported for testing.
+ */
+declare function ɵrunMcpFollowUp({
+  host,
+  agent,
+  capturedThreadId
+}: {
+  host: ɵMcpFollowUpHost;
+  agent: AbstractAgent;
+  capturedThreadId: string;
+}): Promise<RunAgentResult>;
+//#endregion
+export { ɵMcpFollowUpHost, ɵrunMcpFollowUp };
+//# sourceMappingURL=follow-up.d.cts.map

package/dist/follow-up.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"follow-up.d.cts","names":[],"sources":["../src/follow-up.ts"],"mappings":";;;;;AAMA;;UAAiB,gBAAA;EACf,QAAA,CAAS,MAAA;IAAU,KAAA,EAAO,aAAA;EAAA,IAAkB,OAAA,CAAQ,cAAA;AAAA;;;;;;;;;;AAqBtD;;;;;;;;;iBAAsB,eAAA,CAAA;EACpB,IAAA;EACA,KAAA;EACA;AAAA;EAEA,IAAA,EAAM,gBAAA;EACN,KAAA,EAAO,aAAA;EACP,gBAAA;AAAA,IACE,OAAA,CAAQ,cAAA"}

package/dist/follow-up.d.mts

@@ -0,0 +1,42 @@
+import { AbstractAgent, RunAgentResult } from "@ag-ui/client";
+
+//#region src/follow-up.d.ts
+/**
+ * The subset of `CopilotKitCore` that {@link ɵrunMcpFollowUp} depends on.
+ * Declared structurally so the runner can be unit-tested without a full core.
+ */
+interface ɵMcpFollowUpHost {
+  runAgent(params: {
+    agent: AbstractAgent;
+  }): Promise<RunAgentResult>;
+}
+/**
+ * Run an MCP app `ui/message` follow-up, scoped to the thread it was enqueued
+ * for (issue #5819).
+ *
+ * The MCP request queue delays follow-up work until the agent is idle. There is
+ * a single shared registry agent per id, and switching threads overwrites its
+ * `threadId`/`messages` in place. So if the host switches threads while a
+ * follow-up is queued, running it now would execute against — and stream into —
+ * the now-foreground thread.
+ *
+ * - **Same thread** (the common case): run on the shared agent, unchanged.
+ * - **Thread changed**: the shared agent has moved on, so the follow-up can no
+ *   longer run in its originating thread's context. Drop it rather than leak it
+ *   into the current thread. (The MCP app already received its `ui/message` ack
+ *   at enqueue time; only the optional agent turn is skipped.)
+ *
+ * @internal exported for testing.
+ */
+declare function ɵrunMcpFollowUp({
+  host,
+  agent,
+  capturedThreadId
+}: {
+  host: ɵMcpFollowUpHost;
+  agent: AbstractAgent;
+  capturedThreadId: string;
+}): Promise<RunAgentResult>;
+//#endregion
+export { ɵMcpFollowUpHost, ɵrunMcpFollowUp };
+//# sourceMappingURL=follow-up.d.mts.map

package/dist/follow-up.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"follow-up.d.mts","names":[],"sources":["../src/follow-up.ts"],"mappings":";;;;;AAMA;;UAAiB,gBAAA;EACf,QAAA,CAAS,MAAA;IAAU,KAAA,EAAO,aAAA;EAAA,IAAkB,OAAA,CAAQ,cAAA;AAAA;;;;;;;;;;AAqBtD;;;;;;;;;iBAAsB,eAAA,CAAA;EACpB,IAAA;EACA,KAAA;EACA;AAAA;EAEA,IAAA,EAAM,gBAAA;EACN,KAAA,EAAO,aAAA;EACP,gBAAA;AAAA,IACE,OAAA,CAAQ,cAAA"}