@derive-to/artifacts 0.0.0-stage → 0.6.0

package/dist/server/kit/observe.js

@@ -0,0 +1,24 @@
+import { routePath } from "hono/route";
+/** Never let a broken observer break a request. */
+export const safely = (observe) => (observation) => {
+    try {
+        observe?.(observation);
+    }
+    catch {
+        // Observers are best-effort by contract.
+    }
+};
+/** Time every route, named by its pattern so metrics group sensibly. */
+export const observeRoutes = (observe) => async (c, next) => {
+    const started = performance.now();
+    await next();
+    observe({
+        kind: "route",
+        name: `${c.req.method} ${routePath(c, -1)}`,
+        ms: performance.now() - started,
+        ok: c.res.status < 400,
+        status: c.res.status,
+        actor: c.get("actor")?.id ?? null,
+    });
+};
+//# sourceMappingURL=observe.js.map

package/dist/server/kit/observe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observe.js","sourceRoot":"","sources":["../../../src/server/kit/observe.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAkBtC,mDAAmD;AACnD,MAAM,CAAC,MAAM,MAAM,GACjB,CAAC,OAA4B,EAAW,EAAE,CAC1C,CAAC,WAAW,EAAE,EAAE;IACd,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,CAAA;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;AACH,CAAC,CAAA;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GACxB,CAAC,OAAgB,EAA0B,EAAE,CAC7C,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAChB,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;IACjC,MAAM,IAAI,EAAE,CAAA;IACZ,OAAO,CAAC;QACN,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;QAC3C,EAAE,EAAE,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO;QAC/B,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG;QACtB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM;QACpB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,IAAI;KAClC,CAAC,CAAA;AACJ,CAAC,CAAA"}

package/dist/server/kit/plugin.d.ts

@@ -0,0 +1,34 @@
+import type { Hono } from "hono";
+import type { ArtifactFeature } from "../../protocol/index.js";
+import type { Core } from "../core/index.js";
+import type { Env } from "../http/gates.js";
+import type { AfterHooks, BeforeHooks } from "./events.js";
+import type { ToolDef } from "./tool.js";
+/** What a plugin adds once the kit is running. Every part is optional. */
+export interface PluginParts {
+    /** HTTP routes for your page, mounted beside the kit's. Gate each with `kit.gates`. */
+    routes?: Hono<Env>;
+    /** MCP tools for agents ("model") or for artifacts ("app"). */
+    tools?: readonly ToolDef[];
+    /** Refuse an action before it happens. */
+    before?: BeforeHooks;
+    /** React after it happened. */
+    after?: AfterHooks;
+}
+export interface ArtifactPlugin {
+    id: string;
+    /** Announced to artifacts and pages, so each side uses only what exists. */
+    features?: readonly ArtifactFeature[];
+    /** Guidance for agents, added to the MCP server's instructions. */
+    instructions?: string;
+    /** Scripts loaded into every artifact after the runtime, such as custom elements. */
+    sandbox?: readonly string[];
+    /** Adjust an artifact's HTML as it is served (never as stored), such as marking which
+     *  text came from the source. */
+    servePage?: (html: string) => string;
+    setup?: (kit: Core) => PluginParts;
+}
+/** Identity: the type is the documentation. Take your app's answers as options:
+ *  `export const notify = (o: { deliver: … }) => definePlugin({ id: "notify", … })` */
+export declare const definePlugin: (plugin: ArtifactPlugin) => ArtifactPlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/server/kit/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/server/kit/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAExC,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,MAAM,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAClB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAA;IAC1B,0CAA0C;IAC1C,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,+BAA+B;IAC/B,KAAK,CAAC,EAAE,UAAU,CAAA;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAA;IACV,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IACrC,mEAAmE;IACnE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qFAAqF;IACrF,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B;qCACiC;IACjC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACpC,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAA;CACnC;AAED;uFACuF;AACvF,eAAO,MAAM,YAAY,WAAY,cAAc,KAAG,cAAwB,CAAA"}

package/dist/server/kit/plugin.js

@@ -0,0 +1,4 @@
+/** Identity: the type is the documentation. Take your app's answers as options:
+ *  `export const notify = (o: { deliver: … }) => definePlugin({ id: "notify", … })` */
+export const definePlugin = (plugin) => plugin;
+//# sourceMappingURL=plugin.js.map

package/dist/server/kit/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/server/kit/plugin.ts"],"names":[],"mappings":"AAiCA;uFACuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,MAAsB,EAAkB,EAAE,CAAC,MAAM,CAAA"}

package/dist/server/kit/tool.d.ts

@@ -0,0 +1,54 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import * as z from "zod/mini";
+import { type Actor, type Principal, type Verb } from "../../protocol/index.js";
+import type { Access as AccessService } from "../core/access.js";
+import type { ArtifactRow } from "../ports.js";
+import type { Observe } from "./observe.js";
+/** Who may call a tool: a verb on the artifact named by `artifactId`, any signed-in actor,
+ *  or anyone. Every tool names one; the kit checks it before the tool runs. */
+export type ToolAccess = Verb | "signedIn" | "public";
+/** What a tool runs with, by its access: a verb gives the artifact (and, beyond viewing, a
+ *  signed-in actor). `who` is the full principal, for a tool that asks the gate again. */
+export type ToolScope<A extends ToolAccess> = {
+    space: string;
+    who: Principal;
+} & (A extends "view" ? {
+    actor: Actor | null;
+    artifact: ArtifactRow;
+} : A extends Verb ? {
+    actor: Actor;
+    artifact: ArtifactRow;
+} : A extends "signedIn" ? {
+    actor: Actor;
+} : {
+    actor: Actor | null;
+});
+export interface ToolDef<S extends z.ZodMiniObject = z.ZodMiniObject, A extends ToolAccess = ToolAccess> {
+    name: `artifact_${string}`;
+    description?: string;
+    /** "model" for agents, "app" for the artifact itself (MCP Apps visibility). */
+    visibility: readonly ("model" | "app")[];
+    access: A;
+    /** Arguments, besides `artifactId`, which the kit adds for verb access. */
+    input: S;
+    /** Hosts require a real click or keypress for tools that write. Defaults to true for
+     *  "view" and "public" access and false otherwise. */
+    readOnly?: boolean;
+    run(args: z.output<S>, scope: ToolScope<A>): Promise<Record<string, unknown>>;
+    /** Text for the model when the structured result is for an app (a page of HTML). */
+    summarize?(result: Record<string, unknown>): string;
+}
+/** Identity: the type is the documentation. */
+export declare const defineTool: <S extends z.ZodMiniObject, A extends ToolAccess>(def: ToolDef<S, A>) => ToolDef<S, A>;
+export interface ToolContext {
+    access: AccessService;
+    who: Principal;
+    space: string;
+    observe?: Observe | undefined;
+}
+/** Run one tool in-process, exactly as MCP would: validated input, the same access check,
+ *  the same result. For hosts whose own agents act on artifacts without an MCP round trip.
+ *  Throws the kit's explained errors (`ArtifactError`). */
+export declare const invokeTool: (def: ToolDef, raw: Record<string, unknown>, context: ToolContext) => Promise<Record<string, unknown>>;
+export declare const registerTools: (server: McpServer, tools: readonly ToolDef[], context: ToolContext) => void;
+//# sourceMappingURL=tool.d.ts.map

package/dist/server/kit/tool.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.d.ts","sourceRoot":"","sources":["../../../src/server/kit/tool.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAC7D,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EACL,KAAK,KAAK,EAEV,KAAK,SAAS,EAEd,KAAK,IAAI,EACV,MAAM,yBAAyB,CAAA;AAChC,OAAO,KAAK,EAAE,MAAM,IAAI,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAIhE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AAE3C;+EAC+E;AAC/E,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;AAErD;0FAC0F;AAC1F,MAAM,MAAM,SAAS,CAAC,CAAC,SAAS,UAAU,IAAI;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAAG,CAAC,CAAC,SAAS,MAAM,GAC/F;IAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GAC9C,CAAC,SAAS,IAAI,GACZ;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,WAAW,CAAA;CAAE,GACvC,CAAC,SAAS,UAAU,GAClB;IAAE,KAAK,EAAE,KAAK,CAAA;CAAE,GAChB;IAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAA;CAAE,CAAC,CAAA;AAEhC,MAAM,WAAW,OAAO,CACtB,CAAC,SAAS,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,EAC3C,CAAC,SAAS,UAAU,GAAG,UAAU;IAEjC,IAAI,EAAE,YAAY,MAAM,EAAE,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,UAAU,EAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAA;IACxC,MAAM,EAAE,CAAC,CAAA;IACT,2EAA2E;IAC3E,KAAK,EAAE,CAAC,CAAA;IACR;0DACsD;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IAC7E,oFAAoF;IACpF,SAAS,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAA;CACpD;AAED,+CAA+C;AAC/C,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC,SAAS,UAAU,OACnE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,KACjB,OAAO,CAAC,CAAC,EAAE,CAAC,CAAQ,CAAA;AAqBvB,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,aAAa,CAAA;IACrB,GAAG,EAAE,SAAS,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAC9B;AAQD;;2DAE2D;AAC3D,eAAO,MAAM,UAAU,QAChB,OAAO,OACP,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACnB,WAAW,KACnB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGjC,CAAA;AAED,eAAO,MAAM,aAAa,WAChB,SAAS,SACV,SAAS,OAAO,EAAE,WAChB,WAAW,SA0BrB,CAAA"}

package/dist/server/kit/tool.js

@@ -0,0 +1,56 @@
+import * as z from "zod/mini";
+import { artifactIdInput, VERBS, } from "../../protocol/index.js";
+import { parseInput, signInRequired } from "../core/errors.js";
+import { run } from "../mcp/result.js";
+import { describedForMcp } from "../mcp/schema.js";
+/** Identity: the type is the documentation. */
+export const defineTool = (def) => def;
+const isVerb = (access) => VERBS.includes(access);
+const scopeFor = async ({ access, who, space }, required, args) => {
+    const { actor } = who;
+    if (required === "public")
+        return { actor, who, space };
+    if (required === "signedIn") {
+        if (!actor)
+            throw signInRequired("Sign in first.");
+        return { actor, who, space };
+    }
+    const id = args.artifactId ?? "";
+    if (required === "view")
+        return { actor, who, space, artifact: await access.require(who, "view", id, space) };
+    return { ...(await access.act(who, required, id, space)), who, space };
+};
+/** Register tools on a per-request MCP server bound to `actor`. Access is enforced here,
+ *  once, for the kit's tools and every plugin's. */
+/** A tool's full input schema: what it declares, plus `artifactId` for verb access. */
+const inputOf = (def) => isVerb(def.access) ? z.extend(def.input, { artifactId: artifactIdInput }) : def.input;
+/** Run one tool in-process, exactly as MCP would: validated input, the same access check,
+ *  the same result. For hosts whose own agents act on artifacts without an MCP round trip.
+ *  Throws the kit's explained errors (`ArtifactError`). */
+export const invokeTool = async (def, raw, context) => {
+    const args = parseInput(inputOf(def), raw, "input");
+    return def.run(args, await scopeFor(context, def.access, args));
+};
+export const registerTools = (server, tools, context) => {
+    for (const def of tools) {
+        const input = inputOf(def);
+        const readOnly = def.readOnly ?? (def.access === "view" || def.access === "public");
+        server.registerTool(def.name, {
+            ...(def.description ? { description: def.description } : {}),
+            inputSchema: describedForMcp(input),
+            annotations: { readOnlyHint: readOnly },
+            _meta: { ui: { visibility: [...def.visibility] } },
+        }, async (args) => {
+            const started = performance.now();
+            const result = await run(async () => {
+                const parsed = parseInput(input, args, "input");
+                return def.run(parsed, await scopeFor(context, def.access, parsed));
+            }, def.summarize?.bind(def));
+            const ms = performance.now() - started;
+            const actor = context.who.actor?.id ?? null;
+            context.observe?.({ kind: "tool", name: def.name, ms, ok: !result.isError, actor });
+            return result;
+        });
+    }
+};
+//# sourceMappingURL=tool.js.map

package/dist/server/kit/tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool.js","sourceRoot":"","sources":["../../../src/server/kit/tool.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EAEL,eAAe,EAEf,KAAK,GAEN,MAAM,yBAAyB,CAAA;AAEhC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAC9D,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAqClD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,GAAkB,EACH,EAAE,CAAC,GAAG,CAAA;AAEvB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAkB,EAAE,CAAE,KAA2B,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAEpG,MAAM,QAAQ,GAAG,KAAK,EACpB,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAe,EACnC,QAAoB,EACpB,IAA6B,EAC4D,EAAE;IAC3F,MAAM,EAAE,KAAK,EAAE,GAAG,GAAG,CAAA;IACrB,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IACvD,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK;YAAE,MAAM,cAAc,CAAC,gBAAgB,CAAC,CAAA;QAClD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IACD,MAAM,EAAE,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAA;IAChC,IAAI,QAAQ,KAAK,MAAM;QACrB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAA;IACtF,OAAO,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;AACxE,CAAC,CAAA;AASD;oDACoD;AACpD,uFAAuF;AACvF,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAA;AAEvF;;2DAE2D;AAC3D,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAC7B,GAAY,EACZ,GAA4B,EAC5B,OAAoB,EACc,EAAE;IACpC,MAAM,IAAI,GAA4B,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,CAAA;IAC5E,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;AACjE,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,MAAiB,EACjB,KAAyB,EACzB,OAAoB,EACpB,EAAE;IACF,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QAC1B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAA;QACnF,MAAM,CAAC,YAAY,CACjB,GAAG,CAAC,IAAI,EACR;YACE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC;YACnC,WAAW,EAAE,EAAE,YAAY,EAAE,QAAQ,EAAE;YACvC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE;SACnD,EACD,KAAK,EAAE,IAA6B,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;YACjC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,MAAM,GAA4B,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;gBACxE,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;YACrE,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YAC5B,MAAM,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAA;YACtC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,CAAA;YAC3C,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;YACnF,OAAO,MAAM,CAAA;QACf,CAAC,CACF,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/server/kit/wire.d.ts

@@ -0,0 +1,9 @@
+import type { Backend, WiredBackend } from "../ports.js";
+import type { ArtifactPlugin } from "./plugin.js";
+/** Decide the bus: the backend's own, an in-process one when it has none, or none at all
+ *  when live updates are off. Presence is nothing but live updates, so it refuses here. */
+export declare const wireBackend: ({ store, blobs, bus }: Backend, live: boolean, plugins: readonly ArtifactPlugin[]) => WiredBackend;
+/** The features every artifact lists: `live` when the server pushes changes, then each
+ *  plugin's, once each. */
+export declare const featuresOf: (live: boolean, plugins: readonly ArtifactPlugin[]) => string[];
+//# sourceMappingURL=wire.d.ts.map

package/dist/server/kit/wire.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.d.ts","sourceRoot":"","sources":["../../../src/server/kit/wire.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAEjD;2FAC2F;AAC3F,eAAO,MAAM,WAAW,0BACC,OAAO,QACxB,OAAO,WACJ,SAAS,cAAc,EAAE,KACjC,YAIF,CAAA;AAED;2BAC2B;AAC3B,eAAO,MAAM,UAAU,SAAU,OAAO,WAAW,SAAS,cAAc,EAAE,aAE3E,CAAA"}

package/dist/server/kit/wire.js

@@ -0,0 +1,14 @@
+import { memoryBus, silentBus } from "../adapters/memory-bus.js";
+/** Decide the bus: the backend's own, an in-process one when it has none, or none at all
+ *  when live updates are off. Presence is nothing but live updates, so it refuses here. */
+export const wireBackend = ({ store, blobs, bus }, live, plugins) => {
+    if (!live && plugins.some((plugin) => plugin.features?.includes("presence")))
+        throw new Error("Presence needs live updates: leave `live` on, or drop presence.");
+    return { store, blobs, bus: live ? (bus ?? memoryBus()) : silentBus };
+};
+/** The features every artifact lists: `live` when the server pushes changes, then each
+ *  plugin's, once each. */
+export const featuresOf = (live, plugins) => [
+    ...new Set([...(live ? ["live"] : []), ...plugins.flatMap((plugin) => plugin.features ?? [])]),
+];
+//# sourceMappingURL=wire.js.map

package/dist/server/kit/wire.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire.js","sourceRoot":"","sources":["../../../src/server/kit/wire.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAIhE;2FAC2F;AAC3F,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAW,EAC9B,IAAa,EACb,OAAkC,EACpB,EAAE;IAChB,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAA;IACpF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAA;AACvE,CAAC,CAAA;AAED;2BAC2B;AAC3B,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,IAAa,EAAE,OAAkC,EAAE,EAAE,CAAC;IAC/E,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;CAC/F,CAAA"}

package/dist/server/kit.d.ts

@@ -0,0 +1,25 @@
+/** The zod (mini) the kit validates with. Build tool inputs and component props with it, so
+ *  schemas and the kit never come from two different zod installs. */
+export * as z from "zod/mini";
+export { memory, memoryBlobs, memoryBus, memoryStore } from "./adapters/memory.js";
+export { type AssetPolicy, DEFAULT_ASSET_POLICY, SOURCE_ASSET_POLICY } from "./core/assets.js";
+export { sha256 } from "./core/blobs.js";
+export { ArtifactError, fail } from "./core/errors.js";
+export type { Core as Kit, PageKit } from "./core/index.js";
+export type { SourceContent, SourceRenderer } from "./core/source.js";
+export { byHostname, type Fetcher } from "./hosts.js";
+export { type ArtifactKit, type ArtifactServerOptions, createArtifactKit, createArtifactServer, } from "./http/app.js";
+export { readJson } from "./http/body.js";
+export type { Env } from "./http/gates.js";
+export { actorOf } from "./http/gates.js";
+export type { AfterHooks, BeforeHooks, KitChecks, KitEvents } from "./kit/events.js";
+export type { Observation, Observe } from "./kit/observe.js";
+export { type ArtifactPlugin, definePlugin, type PluginParts } from "./kit/plugin.js";
+export { defineTool, type ToolAccess, type ToolDef, type ToolScope } from "./kit/tool.js";
+export { type CommentsOptions, type Component, type ComponentPackOptions, comments, componentPack, type InlineEditingOptions, inlineEditing, type LimitedAction, type McpAuthOptions, type MentionsOptions, type ModerationInput, type ModerationOptions, mcpAuth, mentions, moderation, type Notice, type NotificationsOptions, notifications, presence, type RateLimitOptions, rateLimit, type SharedStateOptions, type SourceEditor, type StarterKitOptions, sharedState, starterKit, type WebhookOptions, webhook, } from "./plugins/index.js";
+export type * from "./ports.js";
+export type { KitAssets } from "./sandbox/assets.js";
+export { buildCsp } from "./sandbox/csp.js";
+export { injectRuntime } from "./sandbox/inject.js";
+export { createSandboxServer, type SandboxOptions } from "./sandbox/server.js";
+//# sourceMappingURL=kit.d.ts.map

package/dist/server/kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kit.d.ts","sourceRoot":"","sources":["../../src/server/kit.ts"],"names":[],"mappings":"AAAA;sEACsE;AACtE,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClF,OAAO,EAAE,KAAK,WAAW,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AACtD,YAAY,EAAE,IAAI,IAAI,GAAG,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAC3D,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzC,YAAY,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAA;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AACzC,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AACpF,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC5D,OAAO,EAAE,KAAK,cAAc,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,KAAK,OAAO,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,oBAAoB,EACzB,QAAQ,EACR,aAAa,EACb,KAAK,oBAAoB,EACzB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,OAAO,EACP,QAAQ,EACR,UAAU,EACV,KAAK,MAAM,EACX,KAAK,oBAAoB,EACzB,aAAa,EACb,QAAQ,EACR,KAAK,gBAAgB,EACrB,SAAS,EACT,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,WAAW,EACX,UAAU,EACV,KAAK,cAAc,EACnB,OAAO,GACR,MAAM,oBAAoB,CAAA;AAC3B,mBAAmB,YAAY,CAAA;AAC/B,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,KAAK,cAAc,EAAE,MAAM,qBAAqB,CAAA"}

package/dist/server/kit.js

@@ -0,0 +1,18 @@
+/** The zod (mini) the kit validates with. Build tool inputs and component props with it, so
+ *  schemas and the kit never come from two different zod installs. */
+export * as z from "zod/mini";
+export { memory, memoryBlobs, memoryBus, memoryStore } from "./adapters/memory.js";
+export { DEFAULT_ASSET_POLICY, SOURCE_ASSET_POLICY } from "./core/assets.js";
+export { sha256 } from "./core/blobs.js";
+export { ArtifactError, fail } from "./core/errors.js";
+export { byHostname } from "./hosts.js";
+export { createArtifactKit, createArtifactServer, } from "./http/app.js";
+export { readJson } from "./http/body.js";
+export { actorOf } from "./http/gates.js";
+export { definePlugin } from "./kit/plugin.js";
+export { defineTool } from "./kit/tool.js";
+export { comments, componentPack, inlineEditing, mcpAuth, mentions, moderation, notifications, presence, rateLimit, sharedState, starterKit, webhook, } from "./plugins/index.js";
+export { buildCsp } from "./sandbox/csp.js";
+export { injectRuntime } from "./sandbox/inject.js";
+export { createSandboxServer } from "./sandbox/server.js";
+//# sourceMappingURL=kit.js.map

package/dist/server/kit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kit.js","sourceRoot":"","sources":["../../src/server/kit.ts"],"names":[],"mappings":"AAAA;sEACsE;AACtE,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAA;AAClF,OAAO,EAAoB,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAA;AAC9F,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAA;AACxC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAGtD,OAAO,EAAE,UAAU,EAAgB,MAAM,YAAY,CAAA;AACrD,OAAO,EAGL,iBAAiB,EACjB,oBAAoB,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAA;AAGzC,OAAO,EAAuB,YAAY,EAAoB,MAAM,iBAAiB,CAAA;AACrF,OAAO,EAAE,UAAU,EAAiD,MAAM,eAAe,CAAA;AACzF,OAAO,EAIL,QAAQ,EACR,aAAa,EAEb,aAAa,EAMb,OAAO,EACP,QAAQ,EACR,UAAU,EAGV,aAAa,EACb,QAAQ,EAER,SAAS,EAIT,WAAW,EACX,UAAU,EAEV,OAAO,GACR,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAuB,MAAM,qBAAqB,CAAA"}

package/dist/server/mcp/result.d.ts

@@ -0,0 +1,5 @@
+import type { CallToolResult } from "@modelcontextprotocol/server";
+/** Run a tool body, turning the core's explained errors into tool errors the caller can read
+ *  (and a model can recover from) instead of protocol failures. */
+export declare const run: (body: () => Promise<Record<string, unknown>>, summarize?: (data: Record<string, unknown>) => string) => Promise<CallToolResult>;
+//# sourceMappingURL=result.d.ts.map

package/dist/server/mcp/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../../src/server/mcp/result.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAA;AAUlE;mEACmE;AACnE,eAAO,MAAM,GAAG,SACR,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,cAChC,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,KACpD,OAAO,CAAC,cAAc,CAYxB,CAAA"}

package/dist/server/mcp/result.js

@@ -0,0 +1,25 @@
+import { ArtifactError } from "../core/errors.js";
+/** A tool's answer: readable text for models, structured content for apps. `summary`
+ *  replaces the text when the data is meant for an app, not a model (a whole page of HTML). */
+const ok = (data, summary) => ({
+    content: [{ type: "text", text: summary ?? JSON.stringify(data) }],
+    structuredContent: data,
+});
+/** Run a tool body, turning the core's explained errors into tool errors the caller can read
+ *  (and a model can recover from) instead of protocol failures. */
+export const run = async (body, summarize) => {
+    try {
+        const data = await body();
+        return ok(data, summarize?.(data));
+    }
+    catch (error) {
+        if (!(error instanceof ArtifactError))
+            throw error;
+        return {
+            isError: true,
+            content: [{ type: "text", text: error.message }],
+            structuredContent: { error: error.message, code: error.code },
+        };
+    }
+};
+//# sourceMappingURL=result.js.map

package/dist/server/mcp/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../../src/server/mcp/result.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD;+FAC+F;AAC/F,MAAM,EAAE,GAAG,CAAC,IAA6B,EAAE,OAAgB,EAAkB,EAAE,CAAC,CAAC;IAC/E,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,iBAAiB,EAAE,IAAI;CACxB,CAAC,CAAA;AAEF;mEACmE;AACnE,MAAM,CAAC,MAAM,GAAG,GAAG,KAAK,EACtB,IAA4C,EAC5C,SAAqD,EAC5B,EAAE;IAC3B,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,EAAE,CAAA;QACzB,OAAO,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAA;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,CAAC,KAAK,YAAY,aAAa,CAAC;YAAE,MAAM,KAAK,CAAA;QAClD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAChD,iBAAiB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;SAC9D,CAAA;IACH,CAAC;AACH,CAAC,CAAA"}

package/dist/server/mcp/schema.d.ts

@@ -0,0 +1,7 @@
+import type { StandardSchemaWithJSON } from "@modelcontextprotocol/server";
+import type * as z from "zod/mini";
+/** The same schema for agents to read, with the SDK's own validation turned off: the kit
+ *  parses tool arguments itself (`parseInput`), so a bad argument is a tool result with a
+ *  registered code, exactly as REST answers it, instead of a protocol error without one. */
+export declare const describedForMcp: <S extends z.ZodMiniType>(schema: S) => StandardSchemaWithJSON<z.input<S>, z.output<S>>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/server/mcp/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/server/mcp/schema.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AAC1E,OAAO,KAAK,KAAK,CAAC,MAAM,UAAU,CAAA;AAiBlC;;4FAE4F;AAC5F,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,CAAC,CAAC,WAAW,UAAU,CAAC,KAQ3D,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CACpD,CAAA"}

package/dist/server/mcp/schema.js

@@ -0,0 +1,27 @@
+import { toJSONSchema } from "zod/v4/core";
+/** MCP tool registration wants Standard Schema plus JSON Schema. zod/mini schemas carry the
+ *  first; this adds the second from zod's own converter, so the protocol's schemas are the
+ *  single source both for validation and for the schema agents see. */
+const forMcp = (schema) => {
+    const json = (io) => () => toJSONSchema(schema, { io, target: "draft-2020-12" });
+    return {
+        "~standard": {
+            ...schema["~standard"],
+            jsonSchema: { input: json("input"), output: json("output") },
+        },
+    };
+};
+/** The same schema for agents to read, with the SDK's own validation turned off: the kit
+ *  parses tool arguments itself (`parseInput`), so a bad argument is a tool result with a
+ *  registered code, exactly as REST answers it, instead of a protocol error without one. */
+export const describedForMcp = (schema) => {
+    const described = forMcp(schema);
+    const standard = described["~standard"];
+    return {
+        "~standard": {
+            ...standard,
+            validate: (value) => ({ value: value }),
+        },
+    };
+};
+//# sourceMappingURL=schema.js.map

package/dist/server/mcp/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/server/mcp/schema.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C;;uEAEuE;AACvE,MAAM,MAAM,GAAG,CAA0B,MAAS,EAAE,EAAE;IACpD,MAAM,IAAI,GAAG,CAAC,EAAsB,EAAE,EAAE,CAAC,GAAG,EAAE,CAC5C,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAA4B,CAAA;IAClF,OAAO;QACL,WAAW,EAAE;YACX,GAAG,MAAM,CAAC,WAAW,CAAC;YACtB,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;SAC7D;KACiD,CAAA;AACtD,CAAC,CAAA;AAED;;4FAE4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,CAA0B,MAAS,EAAE,EAAE;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,CAAA;IACvC,OAAO;QACL,WAAW,EAAE;YACX,GAAG,QAAQ;YACX,QAAQ,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAoB,EAAE,CAAC;SAChE;KACiD,CAAA;AACtD,CAAC,CAAA"}

package/dist/server/mcp/tools.d.ts

@@ -0,0 +1,35 @@
+import * as z from "zod/mini";
+import type { Core } from "../core/index.js";
+/** The kernel's agent tools: find, read, create, and revise artifacts. Hidden from artifacts,
+ *  so page code can never act through them. */
+export declare const artifactTools: ({ access, artifacts, assets }: Core) => (import("../kit/tool.js").ToolDef<z.ZodMiniObject<{
+    limit: z.ZodMiniOptional<z.ZodMiniNumber<unknown>>;
+    cursor: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    search: z.ZodMiniOptional<z.ZodMiniString<string>>;
+    mine: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniBoolean<boolean>, z.ZodMiniCodec<z.ZodMiniString<unknown>, z.ZodMiniBoolean<unknown>>]>>;
+}, z.core.$strip>, "signedIn"> | import("../kit/tool.js").ToolDef<z.ZodMiniObject<{
+    version: z.ZodMiniOptional<z.ZodMiniInt>;
+}, z.core.$strip>, "view"> | import("../kit/tool.js").ToolDef<z.ZodMiniObject<{
+    title: z.ZodMiniString<string>;
+    html: z.ZodMiniString<string>;
+    csp: z.ZodMiniDefault<z.ZodMiniObject<{
+        connectDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        resourceDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        frameDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        baseUriDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>, "signedIn"> | import("../kit/tool.js").ToolDef<z.ZodMiniObject<{
+    html: z.ZodMiniString<string>;
+    csp: z.ZodMiniDefault<z.ZodMiniObject<{
+        connectDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        resourceDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        frameDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+        baseUriDomains: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+    }, z.core.$strip>>;
+    expected: z.ZodMiniInt;
+    addresses: z.ZodMiniOptional<z.ZodMiniArray<z.ZodMiniString<string>>>;
+}, z.core.$strip>, "edit"> | import("../kit/tool.js").ToolDef<z.ZodMiniObject<{
+    data: z.ZodMiniBase64;
+    type: z.ZodMiniString<string>;
+}, z.core.$strip>, "edit">)[];
+//# sourceMappingURL=tools.d.ts.map

package/dist/server/mcp/tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.d.ts","sourceRoot":"","sources":["../../../src/server/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAS7B,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAK5C;+CAC+C;AAC/C,eAAO,MAAM,aAAa,kCAAmC,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6BAiEhE,CAAA"}

package/dist/server/mcp/tools.js

@@ -0,0 +1,72 @@
+import * as z from "zod/mini";
+import { assetDataInput, createInput, listInput, publishInput, versionNumberInput, } from "../../protocol/index.js";
+import { fromBase64 } from "../core/base64.js";
+import { defineTool } from "../kit/tool.js";
+const forModel = ["model"];
+/** The kernel's agent tools: find, read, create, and revise artifacts. Hidden from artifacts,
+ *  so page code can never act through them. */
+export const artifactTools = ({ access, artifacts, assets }) => [
+    defineTool({
+        name: "artifact_list",
+        description: "List the artifacts you can see, newest first. Pass `cursor` from `next` for more.",
+        visibility: forModel,
+        access: "signedIn",
+        input: listInput,
+        run: async (a, { who, space }) => artifacts.list(who, { space, ...a }),
+    }),
+    defineTool({
+        name: "artifact_read",
+        description: "Read an artifact's HTML and metadata (latest version unless given).",
+        visibility: forModel,
+        access: "view",
+        input: z.object({ version: z.optional(versionNumberInput) }),
+        run: async (a, { who, artifact }) => ({
+            artifact: await artifacts.view(artifact, who),
+            ...(await artifacts.source(artifact, a.version ?? artifact.currentVersion)),
+        }),
+    }),
+    defineTool({
+        name: "artifact_create",
+        description: "Publish a new HTML artifact.",
+        visibility: forModel,
+        access: "signedIn",
+        input: createInput,
+        run: async (a, { actor, space }) => ({
+            artifact: await artifacts.create(await access.requireCreate({ actor, link: null }, space), {
+                space,
+                title: a.title,
+                html: a.html,
+                csp: a.csp,
+            }),
+        }),
+    }),
+    defineTool({
+        name: "artifact_publish",
+        description: "Publish a new version. `expected` is the version you read; if someone published since, it refuses. List the thread ids this version answers in `addresses` and they resolve with a note.",
+        visibility: forModel,
+        access: "edit",
+        input: publishInput,
+        run: async (a, { actor, artifact }) => ({
+            version: await artifacts.publish(actor, artifact, {
+                html: a.html,
+                csp: a.csp,
+                expected: a.expected,
+                addresses: a.addresses,
+            }),
+        }),
+    }),
+    defineTool({
+        name: "artifact_upload_asset",
+        description: "Upload an image or font (base64) and get the URL to embed in artifact HTML.",
+        visibility: forModel,
+        access: "edit",
+        input: z.object({
+            data: assetDataInput(assets.maxBytes),
+            type: z.string(),
+        }),
+        run: async (a, { artifact }) => ({
+            asset: await assets.upload(artifact, fromBase64(a.data), a.type),
+        }),
+    }),
+];
+//# sourceMappingURL=tools.js.map

package/dist/server/mcp/tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tools.js","sourceRoot":"","sources":["../../../src/server/mcp/tools.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EACL,cAAc,EACd,WAAW,EACX,SAAS,EACT,YAAY,EACZ,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAU,CAAA;AAEnC;+CAC+C;AAC/C,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAQ,EAAE,EAAE,CAAC;IACpE,UAAU,CAAC;QACT,IAAI,EAAE,eAAe;QACrB,WAAW,EACT,mFAAmF;QACrF,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,SAAS;QAChB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;KACvE,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,qEAAqE;QAClF,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACpC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC;YAC7C,GAAG,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;SAC5E,CAAC;KACH,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,iBAAiB;QACvB,WAAW,EAAE,8BAA8B;QAC3C,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,WAAW;QAClB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;YACnC,QAAQ,EAAE,MAAM,SAAS,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,CAAC,EAAE;gBACzF,KAAK;gBACL,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,EAAE,CAAC,CAAC,GAAG;aACX,CAAC;SACH,CAAC;KACH,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACT,0LAA0L;QAC5L,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,YAAY;QACnB,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YACtC,OAAO,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE;gBAChD,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,GAAG,EAAE,CAAC,CAAC,GAAG;gBACV,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,SAAS,EAAE,CAAC,CAAC,SAAS;aACvB,CAAC;SACH,CAAC;KACH,CAAC;IACF,UAAU,CAAC;QACT,IAAI,EAAE,uBAAuB;QAC7B,WAAW,EAAE,6EAA6E;QAC1F,UAAU,EAAE,QAAQ;QACpB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;YACd,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;SACjB,CAAC;QACF,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/B,KAAK,EAAE,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;SACjE,CAAC;KACH,CAAC;CACH,CAAA"}

package/dist/server/mcp/viewer.d.ts

@@ -0,0 +1,17 @@
+import type { McpServer } from "@modelcontextprotocol/server";
+import { type Principal } from "../../protocol/index.js";
+import type { Core } from "../core/index.js";
+export interface ViewerOptions {
+    /** The viewer bundle (`loadKitAssets().viewer`). */
+    viewer: string;
+    /** Where uploaded assets are served, so the viewer may load them. */
+    sandboxOrigin?: string | undefined;
+}
+/** Open any artifact inside Claude, ChatGPT, VS Code, or any MCP Apps host: one static viewer
+ *  template, and a tool whose result carries the artifact. Shared state then persists through
+ *  the app tools; comments and cursors stay in hosts that speak the extension. */
+export declare const registerViewer: (server: McpServer, core: Core, { who, space }: {
+    who: Principal;
+    space: string;
+}, options: ViewerOptions) => void;
+//# sourceMappingURL=viewer.d.ts.map

package/dist/server/mcp/viewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewer.d.ts","sourceRoot":"","sources":["../../../src/server/mcp/viewer.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAA;AAE7D,OAAO,EAGL,KAAK,SAAS,EAGf,MAAM,yBAAyB,CAAA;AAEhC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAI5C,MAAM,WAAW,aAAa;IAC5B,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;IACd,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC;AAUD;;kFAEkF;AAClF,eAAO,MAAM,cAAc,WACjB,SAAS,QACX,IAAI,kBACM;IAAE,GAAG,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,WACxC,aAAa,SA6CvB,CAAA"}

package/dist/server/mcp/viewer.js

@@ -0,0 +1,47 @@
+import { RESOURCE_MIME_TYPE, registerAppResource, registerAppTool, } from "@modelcontextprotocol/ext-apps/server";
+import * as z from "zod/mini";
+import { artifactIdInput, OPEN_TOOL, VIEWER_URI, versionNumberInput, } from "../../protocol/index.js";
+import { parseInput } from "../core/errors.js";
+import { run } from "./result.js";
+import { describedForMcp } from "./schema.js";
+const page = (script) => `<!doctype html><html><head><meta charset="utf-8"><meta name="color-scheme" content="light dark">` +
+    `<style>html,body{margin:0;background:transparent}</style></head>` +
+    `<body><script>${script.replace(/<\/(script)/gi, "<\\/$1")}</script></body></html>`;
+const summarize = (data) => `Opened "${String(data["title"])}" (version ${String(data["version"])}).`;
+/** Open any artifact inside Claude, ChatGPT, VS Code, or any MCP Apps host: one static viewer
+ *  template, and a tool whose result carries the artifact. Shared state then persists through
+ *  the app tools; comments and cursors stay in hosts that speak the extension. */
+export const registerViewer = (server, core, { who, space }, options) => {
+    const csp = options.sandboxOrigin ? { resourceDomains: [options.sandboxOrigin] } : {};
+    registerAppResource(server, "Artifact viewer", VIEWER_URI, { mimeType: RESOURCE_MIME_TYPE }, async () => ({
+        contents: [
+            {
+                uri: VIEWER_URI,
+                mimeType: RESOURCE_MIME_TYPE,
+                text: page(options.viewer),
+                _meta: { ui: { csp, prefersBorder: false } },
+            },
+        ],
+    }));
+    const input = z.object({ artifactId: artifactIdInput, version: z.optional(versionNumberInput) });
+    registerAppTool(server, OPEN_TOOL, {
+        description: "Open an artifact so the person can see and use it here.",
+        inputSchema: describedForMcp(input),
+        _meta: { ui: { resourceUri: VIEWER_URI, visibility: ["model"] } },
+    }, (args) => run(async () => {
+        const { artifactId, version } = parseInput(input, args, "input");
+        const artifact = await core.access.require(who, "view", artifactId, space);
+        const n = version ?? artifact.currentVersion;
+        const { html, csp: artifactCsp } = await core.artifacts.content(artifact, n);
+        await core.access.require(who, "view", artifactId, space);
+        return {
+            artifactId,
+            version: n,
+            title: artifact.title,
+            html,
+            csp: artifactCsp,
+            ...(options.sandboxOrigin ? { assetOrigin: options.sandboxOrigin } : {}),
+        };
+    }, summarize));
+};
+//# sourceMappingURL=viewer.js.map

package/dist/server/mcp/viewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"viewer.js","sourceRoot":"","sources":["../../../src/server/mcp/viewer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,GAChB,MAAM,uCAAuC,CAAA;AAE9C,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAC7B,OAAO,EACL,eAAe,EACf,SAAS,EAET,UAAU,EACV,kBAAkB,GACnB,MAAM,yBAAyB,CAAA;AAChC,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAS7C,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,kGAAkG;IAClG,kEAAkE;IAClE,iBAAiB,MAAM,CAAC,OAAO,CAAC,eAAe,EAAE,QAAQ,CAAC,yBAAyB,CAAA;AAErF,MAAM,SAAS,GAAG,CAAC,IAA6B,EAAE,EAAE,CAClD,WAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAA;AAE3E;;kFAEkF;AAClF,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,MAAiB,EACjB,IAAU,EACV,EAAE,GAAG,EAAE,KAAK,EAAqC,EACjD,OAAsB,EACtB,EAAE;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IACrF,mBAAmB,CACjB,MAAM,EACN,iBAAiB,EACjB,UAAU,EACV,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAChC,KAAK,IAAI,EAAE,CAAC,CAAC;QACX,QAAQ,EAAE;YACR;gBACE,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,kBAAkB;gBAC5B,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC1B,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE;aAC7C;SACF;KACF,CAAC,CACH,CAAA;IACD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAA;IAChG,eAAe,CACb,MAAM,EACN,SAAS,EACT;QACE,WAAW,EAAE,yDAAyD;QACtE,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC;QACnC,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE;KAClE,EACD,CAAC,IAAI,EAAE,EAAE,CACP,GAAG,CAAC,KAAK,IAAI,EAAE;QACb,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;QAChE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QAC1E,MAAM,CAAC,GAAG,OAAO,IAAI,QAAQ,CAAC,cAAc,CAAA;QAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC5E,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;QACzD,OAAO;YACL,UAAU;YACV,OAAO,EAAE,CAAC;YACV,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,IAAI;YACJ,GAAG,EAAE,WAAW;YAChB,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzE,CAAA;IACH,CAAC,EAAE,SAAS,CAAC,CAChB,CAAA;AACH,CAAC,CAAA"}

package/dist/server/plugins/comments/index.d.ts

@@ -0,0 +1,8 @@
+import { type ArtifactPlugin } from "../../kit/plugin.js";
+import { type ThreadIdentity } from "./service.js";
+/** Comment threads anchored to text, for people (the rail) and agents (tools). */
+export interface CommentsOptions {
+    identity?: ThreadIdentity | undefined;
+}
+export declare const comments: (options?: CommentsOptions) => ArtifactPlugin;
+//# sourceMappingURL=index.d.ts.map

package/dist/server/plugins/comments/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/plugins/comments/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,KAAK,cAAc,EAAgB,MAAM,qBAAqB,CAAA;AAGvE,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,cAAc,CAAA;AAKjE,kFAAkF;AAClF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAA;CACtC;AAED,eAAO,MAAM,QAAQ,aAAa,eAAe,KAAQ,cAyErD,CAAA"}