@extenshi/mcp 0.24.0 → 0.25.0

package/README.md

@@ -125,9 +125,12 @@ stdio or CLI. See the [development workflow](https://docs.extenshi.io/developers
 | `scan_extension` | Pre-publish security scan of a local artifact (.zip/.crx/.xpi), with live progress | 1 scan |
 | `publish_extension` | Publish to Chrome/Firefox/Edge with your own store credentials (fully local) | Free |
 | `get_build_map` | The author's build map of `projectDir` (`npx @extenshi/cli map`): progress, steps waiting on the author, steps that can start now, every step's current task, and the variants offered with the author's answer. Local server only | Free (no key) |
+| `show_build_map` | Draw the build map in the conversation in a client that shows MCP Apps (Claude), optionally open at one step, where the author picks variants, marks their own tasks or skips a step; elsewhere returns the link to the author's map. Local server only | Free (no key) |
 | `report_build_step` | Report on a build map step (start, progress, done with hashed file proof, stop), or record the author's answer from the chat (`choice` / `redo`). Local server only | Free (no key) |
 | `request_build_review` | Offer the author 1–8 variants to choose from on the map (icon concepts, screenshots, listing copy), each a preview page or image in the project; returns the link to the step. Local server only | Free (no key) |
 
+In a client that shows [MCP Apps](https://modelcontextprotocol.io/extensions/apps/overview), `show_build_map` draws the map in the conversation (the page `ui://extenshi/build-map`). The page calls three app-only tools, `build_map_view`, `build_map_answer` and `build_map_file`; the server keeps them from any client that does not advertise `io.modelcontextprotocol/ui`.
+
 ### Identifying an extension by its store id
 
 `get_extension`, `get_reviews`, `get_security` and `scan_extension` accept **either** the numeric

package/dist/build-map-app.d.ts

@@ -0,0 +1,135 @@
+/**
+ * The build map in a chat (plan 2026-11-03-extension-build-map §6.6, phase 4):
+ * MCP Apps (2026-01-26) on the local (stdio) server.
+ *
+ * show_build_map (tools.ts) links to the page `ui://extenshi/build-map`, the
+ * same page `extenshi map` serves (build-map-page.ts, a byte-identical copy of
+ * the CLI's) built with `app`. A client that shows apps draws it in the
+ * conversation; the page then talks to the host, which calls three tools on
+ * this server for it, tools the host keeps from the model (`visibility: app`):
+ *
+ *   - build_map_view: the snapshot the page draws. While the author's map server
+ *     runs, its snapshot as it is (the project facts are read by the CLI only);
+ *     otherwise one derived from the state file, which says it has no facts.
+ *   - build_map_answer: the author's answers, the same three writes the map
+ *     server takes from its page (a mark, a route, a pick or another round),
+ *     to the same state file under the same lock, checked the same way.
+ *   - build_map_file: a variant's thumbnail as a data: URL, since the page in a
+ *     chat may show data: images only (the default MCP Apps CSP).
+ *
+ * The answers are the author's (`via: 'map'`, who `you`), so build_map_answer
+ * refuses unless the client said it shows apps, and index.ts removes all three
+ * tools from a client that did not: a client that ignores `visibility` would
+ * otherwise list them to the model.
+ *
+ * Local only: the hosted connector has no access to the author's files and
+ * registers none of this.
+ */
+import type { FastMCP } from 'fastmcp';
+import { z } from 'zod';
+/** A thumbnail larger than this shows as its number. */
+export declare const THUMB_MAX_BYTES: number;
+/** The bodies the map server's /api/confirm, /api/route and /api/review take (build-map-server.ts). */
+declare const ANSWERS: {
+    readonly confirm: z.ZodObject<{
+        node: z.ZodString;
+        task: z.ZodNumber;
+        done: z.ZodBoolean;
+        note: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    }, "strip", z.ZodTypeAny, {
+        node: string;
+        task: number;
+        done: boolean;
+        note?: string | undefined;
+    }, {
+        node: string;
+        task: number;
+        done: boolean;
+        note?: string | undefined;
+    }>;
+    readonly route: z.ZodObject<{
+        node: z.ZodString;
+        how: z.ZodNullable<z.ZodEnum<["self", "skip"]>>;
+        value: z.ZodOptional<z.ZodString>;
+        since: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        note: z.ZodEffects<z.ZodOptional<z.ZodString>, string | undefined, string | undefined>;
+    }, "strip", z.ZodTypeAny, {
+        node: string;
+        how: "self" | "skip" | null;
+        value?: string | undefined;
+        note?: string | undefined;
+        since?: string | null | undefined;
+    }, {
+        node: string;
+        how: "self" | "skip" | null;
+        value?: string | undefined;
+        note?: string | undefined;
+        since?: string | null | undefined;
+    }>;
+    readonly review: z.ZodObject<{
+        node: z.ZodString;
+        round: z.ZodNumber;
+        revision: z.ZodOptional<z.ZodNumber>;
+        choice: z.ZodOptional<z.ZodString>;
+        redo: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        node: string;
+        round: number;
+        redo?: string | undefined;
+        choice?: string | undefined;
+        revision?: number | undefined;
+    }, {
+        node: string;
+        round: number;
+        redo?: string | undefined;
+        choice?: string | undefined;
+        revision?: number | undefined;
+    }>;
+};
+export type BuildMapAnswerKind = keyof typeof ANSWERS;
+/** Like the map server's answer: ok, or the HTTP status it would send and why. */
+export type BuildMapAnswerResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+    message: string;
+};
+export type BuildMapFileRef = {
+    step: string;
+    round: number;
+    variant: string;
+    which: 'image' | 'preview';
+};
+export type BuildMapApp = {
+    /** The page, built for a chat. */
+    page(): string;
+    /** The snapshot to draw; `unchanged` when it is the one `since` names. */
+    view(projectDir?: string, since?: string): Promise<{
+        etag: string;
+        unchanged: true;
+    } | {
+        etag: string;
+        snapshot: Record<string, unknown>;
+    }>;
+    answer(projectDir: string | undefined, kind: BuildMapAnswerKind, body: unknown): Promise<BuildMapAnswerResult>;
+    /** A variant's image as a data: URL, when it is an image the map may show. */
+    file(projectDir: string | undefined, ref: BuildMapFileRef): Promise<{
+        src?: string;
+    }>;
+};
+export declare function buildMapApp(options: {
+    version: string;
+    /** Whether the client shows apps, so the page's answers are the author's. */
+    writable: () => boolean;
+    cwd?: string;
+}): BuildMapApp;
+/**
+ * The page resource and its three app-only tools. Not through registerTools:
+ * they are not the agent's tools (no guide entry, no docs table), and the page
+ * calls build_map_view every few seconds, which must not reach the usage events.
+ */
+export declare function registerBuildMapApp(server: FastMCP, app: BuildMapApp): void;
+export {};
+//# sourceMappingURL=build-map-app.d.ts.map

package/dist/build-map-app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-map-app.d.ts","sourceRoot":"","sources":["../src/build-map-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAiBH,OAAO,KAAK,EAAE,OAAO,EAAkB,MAAM,SAAS,CAAA;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAMvB,wDAAwD;AACxD,eAAO,MAAM,eAAe,QAAa,CAAA;AASzC,uGAAuG;AACvG,QAAA,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuBH,CAAA;AAEV,MAAM,MAAM,kBAAkB,GAAG,MAAM,OAAO,OAAO,CAAA;AAErD,kFAAkF;AAClF,MAAM,MAAM,oBAAoB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAA;AAEhE,MAAM,MAAM,eAAe,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAAA;AAE1G,MAAM,MAAM,WAAW,GAAG;IACzB,kCAAkC;IAClC,IAAI,IAAI,MAAM,CAAA;IACd,0EAA0E;IAC1E,IAAI,CACH,UAAU,CAAC,EAAE,MAAM,EACnB,KAAK,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAA;IACnG,MAAM,CACL,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,OAAO,GACX,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAChC,8EAA8E;IAC9E,IAAI,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CACrF,CAAA;AAeD,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,6EAA6E;IAC7E,QAAQ,EAAE,MAAM,OAAO,CAAA;IACvB,GAAG,CAAC,EAAE,MAAM,CAAA;CACZ,GAAG,WAAW,CAoGd;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,GAAG,IAAI,CA6D3E"}

package/dist/build-map-app.js

@@ -0,0 +1,238 @@
+/**
+ * The build map in a chat (plan 2026-11-03-extension-build-map §6.6, phase 4):
+ * MCP Apps (2026-01-26) on the local (stdio) server.
+ *
+ * show_build_map (tools.ts) links to the page `ui://extenshi/build-map`, the
+ * same page `extenshi map` serves (build-map-page.ts, a byte-identical copy of
+ * the CLI's) built with `app`. A client that shows apps draws it in the
+ * conversation; the page then talks to the host, which calls three tools on
+ * this server for it, tools the host keeps from the model (`visibility: app`):
+ *
+ *   - build_map_view: the snapshot the page draws. While the author's map server
+ *     runs, its snapshot as it is (the project facts are read by the CLI only);
+ *     otherwise one derived from the state file, which says it has no facts.
+ *   - build_map_answer: the author's answers, the same three writes the map
+ *     server takes from its page (a mark, a route, a pick or another round),
+ *     to the same state file under the same lock, checked the same way.
+ *   - build_map_file: a variant's thumbnail as a data: URL, since the page in a
+ *     chat may show data: images only (the default MCP Apps CSP).
+ *
+ * The answers are the author's (`via: 'map'`, who `you`), so build_map_answer
+ * refuses unless the client said it shows apps, and index.ts removes all three
+ * tools from a client that did not: a client that ignores `visibility` would
+ * otherwise list them to the model.
+ *
+ * Local only: the hosted connector has no access to the author's files and
+ * registers none of this.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import path from 'node:path';
+import { answerBuildReview, BUILD_EVIDENCE_NOTE_MAX, BUILD_REVIEW_FEEDBACK_MAX, BUILD_ROUTE_TEXT_MAX, BuildConfirmError, BuildRouteError, BuildStepError, confirmBuildTask, deriveBuildMap, setBuildRoute, } from '@extenshi/contracts';
+import { z } from 'zod';
+import { reviewFileOnDisk, serverSnapshot } from './build-map-agent.js';
+import { buildMapPage } from './build-map-page.js';
+import { MAP_PROTOCOL, readMapState, resolveMapHome, updateMapState } from './build-map-store.js';
+import { BUILD_MAP_UI, MCP_APP_MIME } from './build-map-ui.js';
+/** A thumbnail larger than this shows as its number. */
+export const THUMB_MAX_BYTES = 512 * 1024;
+const noteField = z
+    .string()
+    .max(BUILD_EVIDENCE_NOTE_MAX * 4)
+    .optional()
+    .transform((note) => (note?.trim() ? note : undefined));
+const nodeField = z.string().min(1).max(64);
+/** The bodies the map server's /api/confirm, /api/route and /api/review take (build-map-server.ts). */
+const ANSWERS = {
+    confirm: z.object({ node: nodeField, task: z.number().int().min(0), done: z.boolean(), note: noteField }),
+    route: z.object({
+        node: nodeField,
+        how: z.enum(['self', 'skip']).nullable(),
+        value: z
+            .string()
+            .max(BUILD_ROUTE_TEXT_MAX * 2)
+            .optional(),
+        since: z.string().nullable().optional(),
+        note: noteField,
+    }),
+    review: z.object({
+        node: nodeField,
+        round: z.number().int().min(1),
+        revision: z.number().int().min(1).optional(),
+        choice: z.string().min(1).max(16).optional(),
+        redo: z
+            .string()
+            .min(1)
+            .max(BUILD_REVIEW_FEEDBACK_MAX * 2)
+            .optional(),
+    }),
+};
+const refused = (status, error, message) => ({
+    ok: false,
+    status,
+    error,
+    message,
+});
+/** The snapshot without the time it was made, which changes on every read. */
+function etagOf(snapshot) {
+    const { generatedAt: _generatedAt, ...rest } = snapshot;
+    return createHash('sha256').update(JSON.stringify(rest)).digest('base64url').slice(0, 22);
+}
+export function buildMapApp(options) {
+    const cwd = options.cwd ?? process.cwd();
+    const homeOf = async (projectDir) => (await resolveMapHome(path.resolve(cwd, projectDir ?? '.'))).home;
+    return {
+        page() {
+            return buildMapPage({ nonce: randomBytes(16).toString('base64url'), app: { version: options.version } });
+        },
+        async view(projectDir, since) {
+            const home = await homeOf(projectDir);
+            const writable = options.writable();
+            const running = await serverSnapshot(home);
+            let snapshot;
+            if (running)
+                snapshot = { ...running.snapshot, app: { facts: true, url: running.url, writable } };
+            else {
+                const read = await readMapState(home);
+                const { state } = read;
+                snapshot = {
+                    protocol: MAP_PROTOCOL,
+                    home,
+                    project: { name: path.basename(home) },
+                    checkouts: 1,
+                    view: deriveBuildMap(state, { done: {} }),
+                    reviews: state.reviews,
+                    log: state.log,
+                    evidence: state.evidence,
+                    routes: state.routes,
+                    offer: state.offer,
+                    ...(read.problem ? { problem: read.problem } : {}),
+                    generatedAt: new Date().toISOString(),
+                    app: { facts: false, writable },
+                };
+            }
+            const etag = etagOf(snapshot);
+            return since === etag ? { etag, unchanged: true } : { etag, snapshot };
+        },
+        async answer(projectDir, kind, body) {
+            if (!options.writable())
+                return refused(403, 'not_an_app', 'Only the build map drawn in a chat that shows MCP Apps answers here. An agent records the author’s answer from the chat with report_build_step.');
+            const schema = ANSWERS[kind];
+            const parsed = schema?.safeParse(body);
+            if (!parsed?.success)
+                return refused(400, 'bad_request', `That is not a ${kind} answer the map takes.`);
+            const home = await homeOf(projectDir);
+            const at = new Date().toISOString();
+            try {
+                if (kind === 'confirm') {
+                    const change = parsed.data;
+                    await updateMapState(home, (state) => confirmBuildTask(state, { ...change, at }));
+                }
+                else if (kind === 'route') {
+                    const change = parsed.data;
+                    // The credits the author's map server knows: "did it myself" opens once the free ones are spent.
+                    const account = (await serverSnapshot(home))?.snapshot.account;
+                    const credits = account?.signedIn ? account.credits : undefined;
+                    await updateMapState(home, (state) => setBuildRoute(state, { ...change, credits, at }));
+                }
+                else {
+                    const change = parsed.data;
+                    // The view the page showed: a changed pick sends the steps built from the old one back to run again.
+                    const view = (await serverSnapshot(home))?.snapshot.view;
+                    await updateMapState(home, (state) => answerBuildReview(state, view, { ...change, via: 'map', at }));
+                }
+            }
+            catch (error) {
+                if (error instanceof BuildConfirmError)
+                    return refused(error.code === 'out_of_order' ? 409 : 400, error.code, error.message);
+                if (error instanceof BuildRouteError)
+                    return refused(error.code === 'stale' || error.code === 'credits' ? 409 : 400, error.code, error.message);
+                if (error instanceof BuildStepError)
+                    return refused(error.code === 'stale' ? 409 : 400, error.code, error.message);
+                throw error;
+            }
+            return { ok: true };
+        },
+        async file(projectDir, ref) {
+            const home = await homeOf(projectDir);
+            const { state } = await readMapState(home);
+            const review = state.reviews[ref.step];
+            const variants = review?.round === ref.round
+                ? review.variants
+                : review?.history.find((round) => round.round === ref.round)?.variants;
+            const variant = variants?.find((candidate) => candidate.id === ref.variant);
+            const stored = ref.which === 'image' ? variant?.image : variant?.preview;
+            const file = stored ? await reviewFileOnDisk(home, stored) : undefined;
+            if (!file || !file.type.startsWith('image/') || file.bytes > THUMB_MAX_BYTES)
+                return {};
+            return { src: `data:${file.type};base64,${(await readFile(file.file)).toString('base64')}` };
+        },
+    };
+}
+/**
+ * The page resource and its three app-only tools. Not through registerTools:
+ * they are not the agent's tools (no guide entry, no docs table), and the page
+ * calls build_map_view every few seconds, which must not reach the usage events.
+ */
+export function registerBuildMapApp(server, app) {
+    // The page they belong to, and only the page may call them (MCP Apps visibility).
+    const appOnly = { ui: { resourceUri: BUILD_MAP_UI, visibility: ['app'] } };
+    const projectDir = z.string().min(1).optional();
+    const json = (value) => JSON.stringify(value);
+    server.addResource({
+        uri: BUILD_MAP_UI,
+        name: 'Extension Build Map',
+        description: 'The author’s build map of the extension project, drawn in the conversation.',
+        mimeType: MCP_APP_MIME,
+        load: async () => 
+        // _meta reaches the client as it is: no outside origins (the default CSP), and a border around the map.
+        ({
+            text: app.page(),
+            mimeType: MCP_APP_MIME,
+            _meta: { ui: { prefersBorder: true } },
+        }),
+    });
+    server.addTool({
+        name: 'build_map_view',
+        description: 'The build map page reads its snapshot. Called by the page only.',
+        annotations: { title: 'Build map: read for the page', readOnlyHint: true, openWorldHint: false },
+        _meta: appOnly,
+        parameters: z.object({ projectDir, since: z.string().max(64).optional() }),
+        execute: async (args) => json(await app.view(args.projectDir, args.since)),
+    });
+    server.addTool({
+        name: 'build_map_answer',
+        description: 'The author answers on the build map page: marks a task, does a step themselves or skips it, picks a variant or asks for another round. Called by the page only, when the author clicks.',
+        annotations: {
+            title: 'Build map: the author’s answer',
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        _meta: appOnly,
+        parameters: z.object({
+            projectDir,
+            kind: z.enum(['confirm', 'route', 'review']),
+            body: z.record(z.string(), z.unknown()),
+        }),
+        execute: async (args) => json(await app.answer(args.projectDir, args.kind, args.body)),
+    });
+    server.addTool({
+        name: 'build_map_file',
+        description: 'The build map page loads a variant thumbnail. Called by the page only.',
+        annotations: { title: 'Build map: a variant thumbnail', readOnlyHint: true, openWorldHint: false },
+        _meta: appOnly,
+        parameters: z.object({
+            projectDir,
+            step: z.string().min(1).max(64),
+            round: z.number().int().min(1),
+            variant: z.string().min(1).max(16),
+            which: z.enum(['image', 'preview']),
+        }),
+        execute: async (args) => {
+            const { projectDir: dir, ...ref } = args;
+            return json(await app.file(dir, ref));
+        },
+    });
+}
+//# sourceMappingURL=build-map-app.js.map

package/dist/build-map-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-map-app.js","sourceRoot":"","sources":["../src/build-map-app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EACN,iBAAiB,EACjB,uBAAuB,EACvB,yBAAyB,EACzB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,cAAc,EACd,aAAa,GACb,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACjG,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAE9D,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,GAAG,IAAI,CAAA;AAEzC,MAAM,SAAS,GAAG,CAAC;KACjB,MAAM,EAAE;KACR,GAAG,CAAC,uBAAuB,GAAG,CAAC,CAAC;KAChC,QAAQ,EAAE;KACV,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAA;AACxD,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AAE3C,uGAAuG;AACvG,MAAM,OAAO,GAAG;IACf,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IACzG,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACf,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE;QACxC,KAAK,EAAE,CAAC;aACN,MAAM,EAAE;aACR,GAAG,CAAC,oBAAoB,GAAG,CAAC,CAAC;aAC7B,QAAQ,EAAE;QACZ,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;QACvC,IAAI,EAAE,SAAS;KACf,CAAC;IACF,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC5C,IAAI,EAAE,CAAC;aACL,MAAM,EAAE;aACR,GAAG,CAAC,CAAC,CAAC;aACN,GAAG,CAAC,yBAAyB,GAAG,CAAC,CAAC;aAClC,QAAQ,EAAE;KACZ,CAAC;CACO,CAAA;AA4BV,MAAM,OAAO,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe,EAAwB,EAAE,CAAC,CAAC;IAC1F,EAAE,EAAE,KAAK;IACT,MAAM;IACN,KAAK;IACL,OAAO;CACP,CAAC,CAAA;AAEF,8EAA8E;AAC9E,SAAS,MAAM,CAAC,QAAiC;IAChD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAA;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC1F,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,OAK3B;IACA,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;IACxC,MAAM,MAAM,GAAG,KAAK,EAAE,UAAmB,EAAE,EAAE,CAC5C,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAElE,OAAO;QACN,IAAI;YACH,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACzG,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK;YAC3B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAA;YACnC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAA;YAC1C,IAAI,QAAiC,CAAA;YACrC,IAAI,OAAO;gBAAE,QAAQ,GAAG,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAA;iBAC5F,CAAC;gBACL,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;gBACrC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;gBACtB,QAAQ,GAAG;oBACV,QAAQ,EAAE,YAAY;oBACtB,IAAI;oBACJ,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;oBACtC,SAAS,EAAE,CAAC;oBACZ,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;oBACzC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,GAAG,EAAE,KAAK,CAAC,GAAG;oBACd,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAClD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACrC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE;iBAC/B,CAAA;YACF,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC7B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QACvE,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI;YAClC,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;gBACtB,OAAO,OAAO,CACb,GAAG,EACH,YAAY,EACZ,iJAAiJ,CACjJ,CAAA;YACF,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;YAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,iBAAiB,IAAI,wBAAwB,CAAC,CAAA;YACvG,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACrC,MAAM,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;YACnC,IAAI,CAAC;gBACJ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;oBACxB,MAAM,MAAM,GAAG,MAAM,CAAC,IAA4C,CAAA;oBAClE,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBAClF,CAAC;qBAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,IAA0C,CAAA;oBAChE,iGAAiG;oBACjG,MAAM,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,OAE3C,CAAA;oBACZ,MAAM,OAAO,GAAG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;oBAC/D,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACxF,CAAC;qBAAM,CAAC;oBACP,MAAM,MAAM,GAAG,MAAM,CAAC,IAA2C,CAAA;oBACjE,qGAAqG;oBACrG,MAAM,IAAI,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAA;oBACxD,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;gBACrG,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,iBAAiB;oBACrC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBACrF,IAAI,KAAK,YAAY,eAAe;oBACnC,OAAO,OAAO,CACb,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAC9D,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,OAAO,CACb,CAAA;gBACF,IAAI,KAAK,YAAY,cAAc;oBAClC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAA;gBAC9E,MAAM,KAAK,CAAA;YACZ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACpB,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG;YACzB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAA;YACrC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;YAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACtC,MAAM,QAAQ,GACb,MAAM,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK;gBAC1B,CAAC,CAAC,MAAM,CAAC,QAAQ;gBACjB,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;YACxE,MAAM,OAAO,GAAG,QAAQ,EAAE,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,CAAC,CAAA;YAC3E,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAA;YACxE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;YACtE,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,KAAK,GAAG,eAAe;gBAAE,OAAO,EAAE,CAAA;YACvF,OAAO,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC,IAAI,WAAW,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAA;QAC7F,CAAC;KACD,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAe,EAAE,GAAgB;IACpE,kFAAkF;IAClF,MAAM,OAAO,GAAG,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;IAC1E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC/C,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;IACtD,MAAM,CAAC,WAAW,CAAC;QAClB,GAAG,EAAE,YAAY;QACjB,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,6EAA6E;QAC1F,QAAQ,EAAE,YAAY;QACtB,IAAI,EAAE,KAAK,IAAI,EAAE;QAChB,wGAAwG;QACxG,CAAC;YACA,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE;YAChB,QAAQ,EAAE,YAAY;YACtB,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE;SACtC,CAAmB;KACrB,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,iEAAiE;QAC9E,WAAW,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;QAChG,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC1E,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;KAC1E,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,EAAE,kBAAkB;QACxB,WAAW,EACV,yLAAyL;QAC1L,WAAW,EAAE;YACZ,KAAK,EAAE,gCAAgC;YACvC,YAAY,EAAE,KAAK;YACnB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;SACpB;QACD,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU;YACV,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;SACvC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;KACtF,CAAC,CAAA;IACF,MAAM,CAAC,OAAO,CAAC;QACd,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,wEAAwE;QACrF,WAAW,EAAE,EAAE,KAAK,EAAE,gCAAgC,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE;QAClG,KAAK,EAAE,OAAO;QACd,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;YACpB,UAAU;YACV,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;YAClC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;SACnC,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YACvB,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,GAAG,EAAE,GAAG,IAAI,CAAA;YACxC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;QACtC,CAAC;KACD,CAAC,CAAA;AACH,CAAC"}

package/dist/build-map-page.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The build map page `extenshi map` serves (plan 2026-11-03-extension-build-map
+ * §4, §6.6). One self-contained HTML document — no network, no fonts to fetch —
+ * drawn from the static graph inlined here and the live snapshot the local
+ * server pushes over SSE (`/events`). Phase 1 is read-only, with three
+ * exceptions, all posted with the page token (build-map-server.ts):
+ *   - a task only the author can do outside extenshi (`confirm` in the graph,
+ *     such as a store account) gets a "Mark as done" button (/api/confirm);
+ *   - a step the author can do themselves or skip (`manual` / `skip` in the
+ *     graph) gets a form with what to give, and a skip button (/api/route).
+ *     The store submits show what an upload by hand needs: the package on
+ *     disk, the dashboard, the values to paste, the steps left to do there;
+ *   - a step that spends credits (`credits` in the graph) shows what is left
+ *     of its pool, and to an author with no account a sign-in for the free
+ *     credits (/api/login) with the pairing code to check (phase 1g). Its own
+ *     mark opens only once the free credits of that pool are spent.
+ * The header also offers an Update button while a newer @extenshi/cli is out
+ * (snap.update): it restarts the map on that release (/api/update), and the
+ * page reloads when the new server answers on the same port.
+ *
+ * The same page is the map in a chat (plan phase 4): the local MCP server
+ * (@extenshi/mcp, which keeps a byte-identical copy of this file) serves it as
+ * an MCP Apps resource with `app: true`. There it has no server to fetch from:
+ * it talks to the host over postMessage (JSON-RPC, MCP Apps 2026-01-26), reads
+ * the snapshot through the app-only tool `build_map_view` every few seconds,
+ * writes the author's answers through `build_map_answer` and loads variant
+ * thumbnails through `build_map_file`. Links open through the host. Sign-in
+ * stays on the browser map, which runs the pairing.
+ *
+ * Look and interaction follow the prototype in
+ * internal-docs/prototypes/extension-progress-map/index.html (catalog design
+ * tokens, both themes, pan/zoom, inspector). Everything the project or an agent
+ * wrote (extension name, fact sentences, log lines) reaches the DOM through
+ * textContent or `esc()`, never as markup.
+ *
+ * The client script is plain ES2017 inside a template literal: it must not
+ * contain backticks or `${`, so it concatenates strings.
+ */
+/**
+ * `token` authorises the page's writes (/api/confirm); without it, as in a
+ * saved copy, the page shows no write buttons. The token belongs to one server
+ * run, so `instance` names that run: when the page reconnects to a server
+ * restarted on the same port, the stream's hello carries another instance and
+ * the page reloads for the new token. `protocol` does the same when a newer
+ * server takes over the port.
+ *
+ * `app` makes it the map in a chat (see the top of this file): no token, no
+ * stream; the host and the MCP server's app-only tools stand in for both.
+ */
+export declare function buildMapPage(options: {
+    nonce: string;
+    token?: string;
+    instance?: string;
+    app?: {
+        version: string;
+    };
+}): string;
+//# sourceMappingURL=build-map-page.d.ts.map

package/dist/build-map-page.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-map-page.d.ts","sourceRoot":"","sources":["../src/build-map-page.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAwEH;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE;IACrC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,GAAG,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CACzB,GAAG,MAAM,CA8BT"}