@crewx/sdk 0.9.0-rc.124 → 0.9.0-rc.125

package/dist/mcp-app/dev-checks.d.ts

@@ -0,0 +1,27 @@
+export type AppDevCheckItem = {
+    readonly rule: 'manifest' | 'external_resource' | 'output_unsafe_string' | 'output_invalid' | 'output_size' | 'call_duration';
+    readonly severity: 'error' | 'warning' | 'ok';
+    readonly code: string;
+    readonly where: string;
+    readonly detail?: Record<string, string | number>;
+};
+export type ExternalResourceKind = 'script' | 'style' | 'image' | 'font' | 'media' | 'frame' | 'object' | 'form' | 'navigation' | 'css' | 'script_network';
+export interface ExternalResourceFinding {
+    readonly line: number;
+    readonly column: number;
+    readonly url: string;
+    readonly directive: string;
+    readonly kind: ExternalResourceKind;
+}
+export interface InspectSkillBackendOutputOptions {
+    readonly actionId: string;
+    readonly dataPaths?: readonly string[];
+    readonly durationMs?: number;
+    readonly timedOut?: boolean;
+}
+export interface ScanExternalResourcesOptions {
+    readonly csp: string;
+}
+export declare function inspectSkillBackendOutput(stdoutText: string, options: InspectSkillBackendOutputOptions): AppDevCheckItem[];
+export declare function scanExternalResources(html: string, options: ScanExternalResourcesOptions): ExternalResourceFinding[];
+export declare function externalResourceCheckItems(entryRelativePath: string, findings: readonly ExternalResourceFinding[]): AppDevCheckItem[];

package/dist/mcp-app/discovery.d.ts

@@ -1,14 +1,45 @@
+import type { UiDefinitionLineageEntry } from '../ui-instance/lineage.js';
 import type { JsonObject, UiDefinition } from '../ui-instance/types.js';
 import type { UiPluginHandlerMetadata, UiPluginManifestV2, UiPluginNormalizedManifestV2 } from '../ui-plugin/types.js';
 import { AppDiscoveryFsError, NodeAppDiscoveryFs, NodeAppDiscoveryFsAdapter, defaultAppDiscoveryFs, defaultNodeAppDiscoveryFs, type AppDiscoveryFsErrorCode } from './node-app-discovery-fs.js';
 import type { McpAppRegistry } from './types.js';
 export type WorkspaceAppSource = 'apps' | 'skills';
+export type WorkspaceAppDiscoverySource = WorkspaceAppSource | 'bundled';
+export interface ProductAppBundleInput {
+    readonly root: string;
+    readonly expectedIndexHash: string;
+}
+export interface ProductAppBundleProvenance {
+    readonly kind: 'bundled';
+    readonly indexHash: string;
+    readonly packageDir: string;
+}
+export interface ProductAppBundleFileHash {
+    readonly path: string;
+    readonly sha256: string;
+}
+export interface ProductAppBundleDefinitionIdentity {
+    readonly id: string;
+    readonly version: number;
+    readonly hash: string;
+}
+export interface ProductAppBundlePackageIndex {
+    readonly packageDir: string;
+    readonly appId: string;
+    readonly definition: ProductAppBundleDefinitionIdentity;
+    readonly lineage: readonly UiDefinitionLineageEntry[];
+    readonly files: readonly ProductAppBundleFileHash[];
+}
+export interface ProductAppBundleIndex {
+    readonly version: 1;
+    readonly packages: readonly ProductAppBundlePackageIndex[];
+}
 export type WorkspaceAppDiscoveryIncompleteReason = 'time_limit';
-export type WorkspaceAppDiagnosticCode = 'MANIFEST_MISSING' | 'MANIFEST_INVALID' | 'ENTRY_INVALID' | 'INITIAL_STATE_INVALID' | 'DUPLICATE_ID' | 'RESERVED_ID' | 'PATH_ESCAPED' | 'LIMIT_EXCEEDED' | 'EXEC_DENIED';
+export type WorkspaceAppDiagnosticCode = 'MANIFEST_MISSING' | 'MANIFEST_INVALID' | 'ENTRY_INVALID' | 'INITIAL_STATE_INVALID' | 'DUPLICATE_ID' | 'RESERVED_ID' | 'BUNDLE_INTEGRITY' | 'LINEAGE_INVALID' | 'LINEAGE_STALE' | 'PATH_ESCAPED' | 'LIMIT_EXCEEDED' | 'EXEC_DENIED';
 export interface WorkspaceAppDiagnostic {
     readonly code: WorkspaceAppDiagnosticCode;
     readonly pluginId?: string;
-    readonly source: WorkspaceAppSource;
+    readonly source: WorkspaceAppDiscoverySource;
     readonly relativePath: string;
 }
 export type McpAppDiscoveryDiagnostic = WorkspaceAppDiagnostic;
@@ -46,12 +77,14 @@ export interface WorkspaceAppDiscoveryOptions {
     readonly reservedAppIds?: Iterable<string>;
     readonly reservedDefinitionIds?: Iterable<string>;
     readonly reservedToolNames?: Iterable<string>;
+    readonly productBundle?: ProductAppBundleInput;
 }
 export interface WorkspaceAppToolNames {
     readonly read: string;
     readonly action?: string;
 }
 export interface WorkspaceAppResourceSnapshot {
+    readonly provenance?: ProductAppBundleProvenance;
     readonly entry: {
         readonly path: 'ui/index.html';
         readonly hash: string;
@@ -63,12 +96,11 @@ export interface WorkspaceAppResourceSnapshot {
         readonly bytes: readonly number[];
     };
 }
-export interface WorkspaceAppCandidate {
+interface WorkspaceAppCandidateBase {
     readonly appId: string;
     readonly pluginId: string;
     readonly definitionId: string;
     readonly version: number;
-    readonly source: WorkspaceAppSource;
     readonly relativePath: string;
     readonly manifest: UiPluginManifestV2;
     readonly normalized: UiPluginNormalizedManifestV2;
@@ -88,11 +120,21 @@ export interface WorkspaceAppCandidate {
     readonly sourceHash: string;
     readonly toolNames: WorkspaceAppToolNames;
 }
+export type WorkspaceAppCandidate = WorkspaceAppCandidateBase & ({
+    readonly source: WorkspaceAppSource;
+    readonly provenance?: never;
+    readonly lineage?: never;
+} | {
+    readonly source?: never;
+    readonly provenance: ProductAppBundleProvenance;
+    readonly lineage: readonly UiDefinitionLineageEntry[];
+});
 export interface WorkspaceAppDiscoveryResult {
     readonly apps: readonly WorkspaceAppCandidate[];
     readonly diagnostics: readonly WorkspaceAppDiagnostic[];
     readonly complete: boolean;
     readonly incompleteReason?: WorkspaceAppDiscoveryIncompleteReason;
+    readonly productBundleIndexHash?: string;
     readonly candidates?: readonly WorkspaceAppCandidate[];
 }
 export declare const WORKSPACE_APP_TOOL_PREFIX = "crewx_local_app_";

package/dist/mcp-app/index.d.ts

@@ -4,7 +4,7 @@ export { INSTALLED_APP_ENTRY, InstalledAppRefError, buildInstalledAppRef, valida
 export type { BuildInstalledAppRefInput, InstalledAppPackageFile, InstalledAppRef, InstalledAppRefErrorCode, } from './installed-app-ref.js';
 export { MAX_HTML_LENGTH, createMcpAppRegistry, createBuiltinMcpAppRegistry, buildMcpAppLocalRegistration, createMcpAppLocalRegistration, registerLocalMcpApp, createMcpAppWorkspaceRegistry, createWorkspaceAppRegistry, createWorkspaceMcpAppRegistry, registerMcpApp, resolveMcpAppResource, resolveLocalMcpAppResource, requireMcpAppResource, toMcpAppToolRegistration, } from './registry.js';
 export { AppDiscoveryFsError, NodeAppDiscoveryFs, NodeAppDiscoveryFsAdapter, defaultAppDiscoveryFs, defaultNodeAppDiscoveryFs, deriveWorkspaceAppToolName, deriveWorkspaceAppToolNames, discoverWorkspaceAppCandidates, discoverWorkspaceApps, LOCAL_APP_TOOL_PREFIX, MCP_APP_WORKSPACE_TOOL_PREFIX, scanWorkspaceApps, WORKSPACE_APP_TOOL_PREFIX, } from './discovery.js';
-export type { AppDiscoveryBytes, AppDiscoveryDiagnostic, AppDiscoveryDirectoryEntry, AppDiscoveryDirectoryEntryKind, AppDiscoveryDirectoryListing, AppDiscoveryFileSystem, AppDiscoveryFsErrorCode, AppDiscoveryMaybePromise, WorkspaceAppDiscoveryOptions as AppDiscoveryOptions, McpAppDiscoveryDiagnostic, WorkspaceAppBuiltinCatalog, WorkspaceAppCandidate, WorkspaceAppDiscoveryIncompleteReason, WorkspaceAppDiscoveryOptions, WorkspaceAppDiscoveryResult, WorkspaceAppDiagnostic, WorkspaceAppDiagnosticCode, WorkspaceAppResourceSnapshot, WorkspaceAppReservedCatalog, WorkspaceAppSource, WorkspaceAppToolNames, } from './discovery.js';
+export type { AppDiscoveryBytes, AppDiscoveryDiagnostic, AppDiscoveryDirectoryEntry, AppDiscoveryDirectoryEntryKind, AppDiscoveryDirectoryListing, AppDiscoveryFileSystem, AppDiscoveryFsErrorCode, AppDiscoveryMaybePromise, WorkspaceAppDiscoveryOptions as AppDiscoveryOptions, McpAppDiscoveryDiagnostic, WorkspaceAppBuiltinCatalog, WorkspaceAppCandidate, WorkspaceAppDiscoveryIncompleteReason, WorkspaceAppDiscoveryOptions, WorkspaceAppDiscoveryResult, WorkspaceAppDiagnostic, WorkspaceAppDiagnosticCode, WorkspaceAppDiscoverySource, WorkspaceAppResourceSnapshot, WorkspaceAppReservedCatalog, WorkspaceAppSource, WorkspaceAppToolNames, ProductAppBundleDefinitionIdentity, ProductAppBundleFileHash, ProductAppBundleIndex, ProductAppBundleInput, ProductAppBundlePackageIndex, ProductAppBundleProvenance, } from './discovery.js';
 export { createWorkspaceAppCatalog, discoverWorkspaceAppCatalog, hashAppDefinition, hashCrewxAppDefinition, listWorkspaceApps, } from './catalog.js';
 export type { CrewxAppBuiltinCatalog, CrewxAppCapability, CrewxAppCatalogOptions, CrewxAppCatalogResult, CrewxAppDefinitionHashInput, CrewxAppDefinitionSummary, CrewxAppDiagnostic, CrewxAppDiagnosticCode, CrewxAppDiagnosticSource, CrewxAppInstalledProjection, CrewxAppLocalDefinitionRef, CrewxAppOrigin, CrewxAppOwnership, CrewxAppShareability, CrewxAppSharingAvailability, CrewxAppSummary, } from './types.js';
 export { MCP_APP_PROJECTION_MAX_BYTES, buildMcpAppStateDescriptor, buildMcpAppStateProjections, buildTerminalMcpAppStateDescriptor, buildTerminalMcpAppStateProjections, createMcpAppToolResult, serializeMcpAppStateJson, serializeMcpAppStateXml, } from './projection.js';
@@ -18,6 +18,8 @@ export { buildStateSetHandler, createStateSetHandler, } from './state-set.js';
 export type { StateSetHandlerBuildInput } from './state-set.js';
 export { SKILL_BACKEND_DEFAULT_TIMEOUT_MS, SKILL_BACKEND_MAX_INPUT_BYTES, SKILL_BACKEND_MAX_OUTPUT_BYTES, SKILL_BACKEND_SCHEMA_VERSION, buildSkillBackendHandler, } from './skill-backend.js';
 export type { SkillBackendExecutionPort, SkillBackendExecutionRequest, SkillBackendExecutionResponse, SkillBackendHandlerBuildInput, SkillBackendInfrastructureErrorCode, SkillBackendPayload, } from './skill-backend.js';
+export { externalResourceCheckItems, inspectSkillBackendOutput, scanExternalResources, } from './dev-checks.js';
+export type { AppDevCheckItem, ExternalResourceFinding, ExternalResourceKind, InspectSkillBackendOutputOptions, ScanExternalResourcesOptions, } from './dev-checks.js';
 export { MCP_APP_HOST_TOOL_ALLOWLIST, MCP_APP_LOCAL_RESOURCE_MIME_TYPE, MCP_APP_RESOURCE_MIME_TYPE, MCP_APP_RESOURCE_URI_PREFIX, } from './types.js';
 export type { McpAppActionDispatcherToolInput, McpAppActionToolDescriptor, McpAppActionToolInput, McpAppButtonDescriptor, McpAppButtonInput, McpAppDescriptor, McpAppDescriptorInput, McpAppInputSchema, McpAppTone, McpUiResourceCsp, McpAppRegistry, McpAppResource, McpAppServerStateInput, McpAppStateDescriptor, McpAppStateProjections, McpAppHostToolInput, McpAppHostToolName, McpAppReadToolInput, McpAppSingleActionToolInput, McpAppToolCommonInput, McpAppToolDescriptor, McpAppToolInput, McpAppToolMetadata, McpAppToolRegistration, McpAppToolResult, McpAppToolVisibility, McpAppInstanceResourceBinding, McpAppMcpResourceBinding, McpAppResourceBinding, McpAppLocalResource, McpAppLocalRegistrationInput, McpAppLocalReadToolDescriptor, McpAppLocalActionToolDescriptor, McpAppLocalSingleActionToolDescriptor, McpAppLocalToolDiagnostic, McpAppLocalToolDescriptor, McpAppLocalRegistration, McpAppBuiltinRegistration, McpAppResolvedRegistration, McpAppLocalLauncher, McpAppBuiltinLauncher, McpAppLauncher, WorkspaceAppLauncher, WorkspaceAppResolvedRegistration, McpAppWorkspaceRegistry, WorkspaceAppRegistry, McpAppWorkspaceRegistryInput, } from './types.js';
 export { buildWorkspaceAppSnapshot, discoverWorkspaceAppSnapshot, reconfirmWorkspaceAppSnapshot, } from './workspace-snapshot.js';

package/dist/mcp-app/skill-backend.d.ts

@@ -22,6 +22,7 @@ export type SkillBackendExecutionResponse = {
     readonly result?: JsonObject;
 };
 export interface SkillBackendExecutionRequest {
+    readonly requestId?: string;
     readonly instanceId: string;
     readonly appId: string;
     readonly definitionId: string;

package/dist/mcp-app/types.d.ts

@@ -1,5 +1,5 @@
 import type { JsonObject, UiDefinition, UiDefinitionRef, UiDefinitionDisplayMode, UiDefinitionUsage, UiInstance, UiInstanceStatus, UiActionConfirmation, UiActionHandlerRegistration } from '../ui-instance/types.js';
-import type { AppDiscoveryFileSystem } from './discovery.js';
+import type { AppDiscoveryFileSystem, ProductAppBundleInput, ProductAppBundleProvenance } from './discovery.js';
 export declare const MCP_APP_RESOURCE_MIME_TYPE: "text/html;profile=mcp-app";
 export declare const MCP_APP_RESOURCE_URI_PREFIX = "ui://crewx/";
 export type McpAppToolVisibility = 'model' | 'app';
@@ -184,6 +184,7 @@ export interface McpAppLocalLauncher {
     readonly tone?: McpAppTone;
     readonly builtinOnly: false;
     readonly definition: UiDefinitionRef;
+    readonly provenance?: ProductAppBundleProvenance;
     readonly entryHash: string;
     readonly resourceBinding: McpAppInstanceResourceBinding;
     readonly tools: readonly McpAppLocalToolDescriptor[];
@@ -363,9 +364,10 @@ export interface CrewxAppSummary {
     readonly marketplaceContentId?: string;
     readonly slug?: string;
     readonly definitionHash: string;
+    readonly provenance?: ProductAppBundleProvenance;
 }
-export type CrewxAppDiagnosticCode = 'MANIFEST_MISSING' | 'MANIFEST_INVALID' | 'ENTRY_INVALID' | 'INITIAL_STATE_INVALID' | 'DUPLICATE_ID' | 'RESERVED_ID' | 'PATH_ESCAPED' | 'LIMIT_EXCEEDED' | 'EXEC_DENIED' | 'SKILL_INVALID' | 'SKILL_READ_FAILED' | 'INSTALLED_MISSING' | 'INSTALLED_CONTENT_ID_MISSING' | 'INSTALLED_IDENTITY_MISMATCH' | 'BUILTIN_INVALID';
-export type CrewxAppDiagnosticSource = 'apps' | 'skills' | 'node_modules' | 'builtin' | 'installed';
+export type CrewxAppDiagnosticCode = 'MANIFEST_MISSING' | 'MANIFEST_INVALID' | 'ENTRY_INVALID' | 'INITIAL_STATE_INVALID' | 'DUPLICATE_ID' | 'RESERVED_ID' | 'BUNDLE_INTEGRITY' | 'LINEAGE_INVALID' | 'LINEAGE_STALE' | 'PATH_ESCAPED' | 'LIMIT_EXCEEDED' | 'EXEC_DENIED' | 'SKILL_INVALID' | 'SKILL_READ_FAILED' | 'INSTALLED_MISSING' | 'INSTALLED_CONTENT_ID_MISSING' | 'INSTALLED_IDENTITY_MISMATCH' | 'BUILTIN_INVALID';
+export type CrewxAppDiagnosticSource = 'apps' | 'skills' | 'bundled' | 'node_modules' | 'builtin' | 'installed';
 export interface CrewxAppDiagnostic {
     readonly code: CrewxAppDiagnosticCode;
     readonly source: CrewxAppDiagnosticSource;
@@ -384,6 +386,7 @@ export interface CrewxAppInstalledProjection {
 export type CrewxAppBuiltinCatalog = Pick<McpAppRegistry, 'listMcpApps' | 'listMcpAppTools'>;
 export interface CrewxAppCatalogOptions {
     readonly filesystem?: AppDiscoveryFileSystem;
+    readonly productBundle?: ProductAppBundleInput;
     readonly builtinCatalog?: CrewxAppBuiltinCatalog;
     readonly installed?: readonly CrewxAppInstalledProjection[];
 }

package/dist/mcp-app/workspace-snapshot.d.ts

@@ -1,11 +1,12 @@
-import { type AppDiscoveryFileSystem, type WorkspaceAppDiscoveryIncompleteReason, type WorkspaceAppDiagnostic, type WorkspaceAppDiscoveryOptions, type WorkspaceAppDiscoveryResult, type WorkspaceAppSource } from './discovery.js';
+import { type AppDiscoveryFileSystem, type WorkspaceAppDiscoveryIncompleteReason, type WorkspaceAppDiagnostic, type WorkspaceAppDiscoveryOptions, type WorkspaceAppDiscoveryResult, type WorkspaceAppSource, type ProductAppBundleProvenance } from './discovery.js';
 import { type SkillBackendExecutionPort } from './skill-backend.js';
 import type { JsonObject, UiActionHandlerRegistration, UiDefinition, UiDefinitionRef } from '../ui-instance/types.js';
 import type { McpAppLauncher, McpAppLocalResource, McpAppRegistry, McpAppWorkspaceRegistry } from './types.js';
 export interface WorkspaceAppSnapshotResource extends McpAppLocalResource {
     readonly appId: string;
     readonly definition: UiDefinitionRef;
-    readonly source: WorkspaceAppSource;
+    readonly source?: WorkspaceAppSource;
+    readonly provenance?: ProductAppBundleProvenance;
 }
 export interface WorkspaceAppSnapshotInitialState {
     readonly appId: string;

package/dist/migrations/0034_keen_fallen_one.sql

@@ -0,0 +1,36 @@
+CREATE TABLE IF NOT EXISTS `ui_instance_repins` (
+	`instance_id` text NOT NULL,
+	`from_version` integer NOT NULL,
+	`from_hash` text NOT NULL,
+	`to_version` integer NOT NULL,
+	`to_hash` text NOT NULL,
+	`from_revision` integer NOT NULL,
+	`to_revision` integer,
+	`status` text NOT NULL,
+	`code` text,
+	`attempts` integer DEFAULT 1 NOT NULL,
+	`first_at` integer NOT NULL,
+	`last_at` integer NOT NULL,
+	PRIMARY KEY(`instance_id`, `to_hash`),
+	CONSTRAINT "ui_instance_repins_instance_id_ck" CHECK(length("ui_instance_repins"."instance_id") BETWEEN 5 AND 128 AND "ui_instance_repins"."instance_id" GLOB 'uic_*'),
+	CONSTRAINT "ui_instance_repins_from_version_ck" CHECK("ui_instance_repins"."from_version" >= 1),
+	CONSTRAINT "ui_instance_repins_to_version_ck" CHECK("ui_instance_repins"."to_version" >= 1),
+	CONSTRAINT "ui_instance_repins_from_hash_ck" CHECK(length("ui_instance_repins"."from_hash") = 64 AND "ui_instance_repins"."from_hash" NOT GLOB '*[^0-9a-f]*'),
+	CONSTRAINT "ui_instance_repins_to_hash_ck" CHECK(length("ui_instance_repins"."to_hash") = 64 AND "ui_instance_repins"."to_hash" NOT GLOB '*[^0-9a-f]*'),
+	CONSTRAINT "ui_instance_repins_from_revision_ck" CHECK("ui_instance_repins"."from_revision" >= 0),
+	CONSTRAINT "ui_instance_repins_to_revision_ck" CHECK("ui_instance_repins"."to_revision" IS NULL OR "ui_instance_repins"."to_revision" >= 0),
+	CONSTRAINT "ui_instance_repins_status_ck" CHECK("ui_instance_repins"."status" IN ('applied', 'deferred', 'failed')),
+	CONSTRAINT "ui_instance_repins_attempts_ck" CHECK("ui_instance_repins"."attempts" >= 1),
+	CONSTRAINT "ui_instance_repins_dates_ck" CHECK("ui_instance_repins"."first_at" >= 0 AND "ui_instance_repins"."last_at" >= "ui_instance_repins"."first_at"),
+	CONSTRAINT "ui_instance_repins_result_ck" CHECK((
+        ("ui_instance_repins"."status" = 'applied' AND "ui_instance_repins"."code" IS NULL
+          AND "ui_instance_repins"."to_revision" = "ui_instance_repins"."from_revision" + 1)
+        OR
+        ("ui_instance_repins"."status" IN ('deferred', 'failed') AND "ui_instance_repins"."code" IS NOT NULL
+          AND "ui_instance_repins"."to_revision" IS NULL)
+      ))
+);
+--> statement-breakpoint
+ALTER TABLE `ui_action_receipts` ADD `definition_id` text;--> statement-breakpoint
+ALTER TABLE `ui_action_receipts` ADD `definition_version` integer;--> statement-breakpoint
+ALTER TABLE `ui_action_receipts` ADD `definition_hash` text;