@frontmcp/sdk 0.6.0 → 0.6.2

package/src/mcp-apps/csp.js

@@ -1,267 +0,0 @@
-"use strict";
-/**
- * @file csp.ts
- * @description Content Security Policy generation for MCP Apps.
- *
- * Generates CSP headers per the MCP Apps specification for iframe sandboxing.
- *
- * @module @frontmcp/sdk/mcp-apps/csp
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.EXTENDED_SANDBOX_PERMISSIONS = exports.SANDBOX_PERMISSIONS = exports.DEFAULT_CSP_DIRECTIVES = void 0;
-exports.buildCSPHeader = buildCSPHeader;
-exports.buildCSPDirectives = buildCSPDirectives;
-exports.buildSandboxAttribute = buildSandboxAttribute;
-exports.buildCSPMetaTag = buildCSPMetaTag;
-exports.isDomainAllowed = isDomainAllowed;
-exports.mergeCSP = mergeCSP;
-exports.parseCSPHeader = parseCSPHeader;
-// ============================================
-// Default CSP Values
-// ============================================
-/**
- * Default CSP directives per MCP Apps spec.
- * These are the baseline security restrictions.
- */
-exports.DEFAULT_CSP_DIRECTIVES = [
-    { name: 'default-src', values: ["'none'"] },
-    { name: 'script-src', values: ["'self'", "'unsafe-inline'"] },
-    { name: 'style-src', values: ["'self'", "'unsafe-inline'"] },
-    { name: 'img-src', values: ["'self'", 'data:'] },
-    { name: 'font-src', values: ["'self'"] },
-    { name: 'connect-src', values: ["'none'"] },
-    { name: 'frame-src', values: ["'none'"] },
-    { name: 'object-src', values: ["'none'"] },
-    { name: 'base-uri', values: ["'self'"] },
-    { name: 'form-action', values: ["'self'"] },
-];
-/**
- * Sandbox attribute values for iframe.
- * Minimum required permissions per MCP Apps spec.
- */
-exports.SANDBOX_PERMISSIONS = ['allow-scripts', 'allow-same-origin'];
-/**
- * Extended sandbox permissions that may be granted.
- */
-exports.EXTENDED_SANDBOX_PERMISSIONS = [
-    ...exports.SANDBOX_PERMISSIONS,
-    'allow-forms',
-    'allow-popups',
-    'allow-popups-to-escape-sandbox',
-];
-// ============================================
-// CSP Generation Functions
-// ============================================
-/**
- * Build CSP header string from MCP Apps CSP configuration.
- *
- * @param csp - MCP Apps CSP configuration
- * @returns CSP header string
- *
- * @example
- * ```typescript
- * const csp = buildCSPHeader({
- *   connectDomains: ['https://api.example.com'],
- *   resourceDomains: ['https://cdn.example.com'],
- * });
- * // Returns: "default-src 'none'; script-src 'self' 'unsafe-inline' https://cdn.example.com; ..."
- * ```
- */
-function buildCSPHeader(csp) {
-    const directives = buildCSPDirectives(csp);
-    return directives.map((d) => `${d.name} ${d.values.join(' ')}`).join('; ');
-}
-/**
- * Build CSP directives array from MCP Apps CSP configuration.
- *
- * @param csp - MCP Apps CSP configuration
- * @returns Array of CSP directives
- */
-function buildCSPDirectives(csp) {
-    // Start with defaults
-    const directives = new Map();
-    for (const directive of exports.DEFAULT_CSP_DIRECTIVES) {
-        directives.set(directive.name, [...directive.values]);
-    }
-    if (csp) {
-        // Add connect domains
-        if (csp.connectDomains && csp.connectDomains.length > 0) {
-            const connectSrc = directives.get('connect-src') || [];
-            // Replace 'none' with actual domains
-            const filteredConnect = connectSrc.filter((v) => v !== "'none'");
-            directives.set('connect-src', [...filteredConnect, "'self'", ...csp.connectDomains]);
-        }
-        // Add resource domains to appropriate directives
-        if (csp.resourceDomains && csp.resourceDomains.length > 0) {
-            const resourceDomains = csp.resourceDomains;
-            // script-src
-            const scriptSrc = directives.get('script-src') || [];
-            directives.set('script-src', [...scriptSrc, ...resourceDomains]);
-            // style-src
-            const styleSrc = directives.get('style-src') || [];
-            directives.set('style-src', [...styleSrc, ...resourceDomains]);
-            // img-src
-            const imgSrc = directives.get('img-src') || [];
-            directives.set('img-src', [...imgSrc, ...resourceDomains]);
-            // font-src
-            const fontSrc = directives.get('font-src') || [];
-            directives.set('font-src', [...fontSrc, ...resourceDomains]);
-        }
-    }
-    // Convert map to array
-    return Array.from(directives.entries()).map(([name, values]) => ({
-        name,
-        values: [...new Set(values)], // Deduplicate
-    }));
-}
-/**
- * Build sandbox attribute value for iframe.
- *
- * @param options - Sandbox options
- * @returns Sandbox attribute value string
- *
- * @example
- * ```typescript
- * const sandbox = buildSandboxAttribute({ allowForms: true });
- * // Returns: "allow-scripts allow-same-origin allow-forms"
- * ```
- */
-function buildSandboxAttribute(options) {
-    const permissions = [...exports.SANDBOX_PERMISSIONS];
-    if (options?.allowForms) {
-        permissions.push('allow-forms');
-    }
-    if (options?.allowPopups) {
-        permissions.push('allow-popups');
-    }
-    if (options?.allowPopupsToEscapeSandbox) {
-        permissions.push('allow-popups-to-escape-sandbox');
-    }
-    return permissions.join(' ');
-}
-/**
- * Build CSP meta tag for embedding in HTML.
- *
- * @param csp - MCP Apps CSP configuration
- * @returns HTML meta tag string
- *
- * @example
- * ```typescript
- * const meta = buildCSPMetaTag({ connectDomains: ['https://api.example.com'] });
- * // Returns: <meta http-equiv="Content-Security-Policy" content="...">
- * ```
- */
-function buildCSPMetaTag(csp) {
-    const header = buildCSPHeader(csp);
-    return `<meta http-equiv="Content-Security-Policy" content="${escapeHtmlAttribute(header)}">`;
-}
-/**
- * Validate domain against CSP configuration.
- *
- * @param domain - Domain to validate
- * @param csp - CSP configuration
- * @param type - Type of access ('connect' or 'resource')
- * @returns Whether the domain is allowed
- */
-function isDomainAllowed(domain, csp, type) {
-    if (!csp)
-        return false;
-    const domains = type === 'connect' ? csp.connectDomains : csp.resourceDomains;
-    if (!domains || domains.length === 0)
-        return false;
-    // Check if domain matches any allowed domain
-    return domains.some((allowed) => {
-        try {
-            const allowedUrl = new URL(allowed);
-            const testUrl = new URL(domain);
-            // Match protocol and hostname
-            return allowedUrl.protocol === testUrl.protocol && allowedUrl.hostname === testUrl.hostname;
-        }
-        catch {
-            // If URL parsing fails, do exact string match
-            return allowed === domain;
-        }
-    });
-}
-/**
- * Merge two CSP configurations.
- *
- * @param base - Base CSP configuration
- * @param override - Override CSP configuration
- * @returns Merged CSP configuration
- */
-function mergeCSP(base, override) {
-    const merged = {};
-    // Merge connect domains
-    const connectDomains = new Set();
-    if (base?.connectDomains) {
-        base.connectDomains.forEach((d) => connectDomains.add(d));
-    }
-    if (override?.connectDomains) {
-        override.connectDomains.forEach((d) => connectDomains.add(d));
-    }
-    if (connectDomains.size > 0) {
-        merged.connectDomains = Array.from(connectDomains);
-    }
-    // Merge resource domains
-    const resourceDomains = new Set();
-    if (base?.resourceDomains) {
-        base.resourceDomains.forEach((d) => resourceDomains.add(d));
-    }
-    if (override?.resourceDomains) {
-        override.resourceDomains.forEach((d) => resourceDomains.add(d));
-    }
-    if (resourceDomains.size > 0) {
-        merged.resourceDomains = Array.from(resourceDomains);
-    }
-    return merged;
-}
-// ============================================
-// Helper Functions
-// ============================================
-/**
- * Escape string for use in HTML attribute.
- */
-function escapeHtmlAttribute(str) {
-    return str
-        .replace(/&/g, '&amp;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;');
-}
-/**
- * Parse CSP header string back to configuration.
- * Useful for testing and debugging.
- */
-function parseCSPHeader(header) {
-    const csp = {};
-    const connectDomains = [];
-    const resourceDomains = [];
-    const directives = header.split(';').map((d) => d.trim());
-    for (const directive of directives) {
-        const [name, ...values] = directive.split(/\s+/);
-        if (name === 'connect-src') {
-            for (const value of values) {
-                if (value.startsWith('https://') || value.startsWith('http://')) {
-                    connectDomains.push(value);
-                }
-            }
-        }
-        if (['script-src', 'style-src', 'img-src', 'font-src'].includes(name)) {
-            for (const value of values) {
-                if (value.startsWith('https://') || value.startsWith('http://')) {
-                    resourceDomains.push(value);
-                }
-            }
-        }
-    }
-    if (connectDomains.length > 0) {
-        csp.connectDomains = [...new Set(connectDomains)];
-    }
-    if (resourceDomains.length > 0) {
-        csp.resourceDomains = [...new Set(resourceDomains)];
-    }
-    return csp;
-}
-//# sourceMappingURL=csp.js.map

package/src/mcp-apps/csp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../../src/mcp-apps/csp.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AA+EH,wCAGC;AAQD,gDA4CC;AAcD,sDAoBC;AAcD,0CAGC;AAUD,0CAoBC;AASD,4BA4BC;AAsBD,wCAoCC;AA/RD,+CAA+C;AAC/C,qBAAqB;AACrB,+CAA+C;AAE/C;;;GAGG;AACU,QAAA,sBAAsB,GAAmB;IACpD,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC3C,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE;IAC7D,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EAAE;IAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE;IAChD,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC3C,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IACzC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1C,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;IACxC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE;CAC5C,CAAC;AAEF;;;GAGG;AACU,QAAA,mBAAmB,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAU,CAAC;AAEnF;;GAEG;AACU,QAAA,4BAA4B,GAAG;IAC1C,GAAG,2BAAmB;IACtB,aAAa;IACb,cAAc;IACd,gCAAgC;CACxB,CAAC;AAEX,+CAA+C;AAC/C,2BAA2B;AAC3B,+CAA+C;AAE/C;;;;;;;;;;;;;;GAcG;AACH,SAAgB,cAAc,CAAC,GAAgB;IAC7C,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,GAAgB;IACjD,sBAAsB;IACtB,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IAE/C,KAAK,MAAM,SAAS,IAAI,8BAAsB,EAAE,CAAC;QAC/C,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,GAAG,EAAE,CAAC;QACR,sBAAsB;QACtB,IAAI,GAAG,CAAC,cAAc,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;YACvD,qCAAqC;YACrC,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC;YACjE,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,GAAG,eAAe,EAAE,QAAQ,EAAE,GAAG,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;QACvF,CAAC;QAED,iDAAiD;QACjD,IAAI,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1D,MAAM,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;YAE5C,aAAa;YACb,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACrD,UAAU,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,GAAG,SAAS,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;YAEjE,YAAY;YACZ,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACnD,UAAU,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;YAE/D,UAAU;YACV,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC/C,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;YAE3D,WAAW;YACX,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,eAAe,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI;QACJ,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,cAAc;KAC7C,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,qBAAqB,CAAC,OAIrC;IACC,MAAM,WAAW,GAAa,CAAC,GAAG,2BAAmB,CAAC,CAAC;IAEvD,IAAI,OAAO,EAAE,UAAU,EAAE,CAAC;QACxB,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAClC,CAAC;IAED,IAAI,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,eAAe,CAAC,GAAgB;IAC9C,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,uDAAuD,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;AAChG,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,eAAe,CAAC,MAAc,EAAE,GAA2B,EAAE,IAA4B;IACvG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAEvB,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC;IAE9E,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnD,6CAA6C;IAC7C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;YAEhC,8BAA8B;YAC9B,OAAO,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,OAAO,OAAO,KAAK,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,QAAQ,CAAC,IAA4B,EAAE,QAAgC;IACrF,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,wBAAwB;IACxB,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,IAAI,IAAI,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC7B,QAAQ,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,yBAAyB;IACzB,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1C,IAAI,IAAI,EAAE,eAAe,EAAE,CAAC;QAC1B,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,QAAQ,EAAE,eAAe,EAAE,CAAC;QAC9B,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,+CAA+C;AAC/C,mBAAmB;AACnB,+CAA+C;AAE/C;;GAEG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAc;IAC3C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAE1D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAChE,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,GAAG,CAAC,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC;IACpD,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,GAAG,CAAC,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC","sourcesContent":["/**\n * @file csp.ts\n * @description Content Security Policy generation for MCP Apps.\n *\n * Generates CSP headers per the MCP Apps specification for iframe sandboxing.\n *\n * @module @frontmcp/sdk/mcp-apps/csp\n */\n\nimport type { McpAppsCSP } from './types';\n\n// ============================================\n// CSP Directive Types\n// ============================================\n\n/**\n * Individual CSP directive.\n */\nexport interface CSPDirective {\n  name: string;\n  values: string[];\n}\n\n/**\n * Complete CSP configuration.\n */\nexport interface CSPConfig {\n  directives: CSPDirective[];\n}\n\n// ============================================\n// Default CSP Values\n// ============================================\n\n/**\n * Default CSP directives per MCP Apps spec.\n * These are the baseline security restrictions.\n */\nexport const DEFAULT_CSP_DIRECTIVES: CSPDirective[] = [\n  { name: 'default-src', values: [\"'none'\"] },\n  { name: 'script-src', values: [\"'self'\", \"'unsafe-inline'\"] },\n  { name: 'style-src', values: [\"'self'\", \"'unsafe-inline'\"] },\n  { name: 'img-src', values: [\"'self'\", 'data:'] },\n  { name: 'font-src', values: [\"'self'\"] },\n  { name: 'connect-src', values: [\"'none'\"] },\n  { name: 'frame-src', values: [\"'none'\"] },\n  { name: 'object-src', values: [\"'none'\"] },\n  { name: 'base-uri', values: [\"'self'\"] },\n  { name: 'form-action', values: [\"'self'\"] },\n];\n\n/**\n * Sandbox attribute values for iframe.\n * Minimum required permissions per MCP Apps spec.\n */\nexport const SANDBOX_PERMISSIONS = ['allow-scripts', 'allow-same-origin'] as const;\n\n/**\n * Extended sandbox permissions that may be granted.\n */\nexport const EXTENDED_SANDBOX_PERMISSIONS = [\n  ...SANDBOX_PERMISSIONS,\n  'allow-forms',\n  'allow-popups',\n  'allow-popups-to-escape-sandbox',\n] as const;\n\n// ============================================\n// CSP Generation Functions\n// ============================================\n\n/**\n * Build CSP header string from MCP Apps CSP configuration.\n *\n * @param csp - MCP Apps CSP configuration\n * @returns CSP header string\n *\n * @example\n * ```typescript\n * const csp = buildCSPHeader({\n *   connectDomains: ['https://api.example.com'],\n *   resourceDomains: ['https://cdn.example.com'],\n * });\n * // Returns: \"default-src 'none'; script-src 'self' 'unsafe-inline' https://cdn.example.com; ...\"\n * ```\n */\nexport function buildCSPHeader(csp?: McpAppsCSP): string {\n  const directives = buildCSPDirectives(csp);\n  return directives.map((d) => `${d.name} ${d.values.join(' ')}`).join('; ');\n}\n\n/**\n * Build CSP directives array from MCP Apps CSP configuration.\n *\n * @param csp - MCP Apps CSP configuration\n * @returns Array of CSP directives\n */\nexport function buildCSPDirectives(csp?: McpAppsCSP): CSPDirective[] {\n  // Start with defaults\n  const directives = new Map<string, string[]>();\n\n  for (const directive of DEFAULT_CSP_DIRECTIVES) {\n    directives.set(directive.name, [...directive.values]);\n  }\n\n  if (csp) {\n    // Add connect domains\n    if (csp.connectDomains && csp.connectDomains.length > 0) {\n      const connectSrc = directives.get('connect-src') || [];\n      // Replace 'none' with actual domains\n      const filteredConnect = connectSrc.filter((v) => v !== \"'none'\");\n      directives.set('connect-src', [...filteredConnect, \"'self'\", ...csp.connectDomains]);\n    }\n\n    // Add resource domains to appropriate directives\n    if (csp.resourceDomains && csp.resourceDomains.length > 0) {\n      const resourceDomains = csp.resourceDomains;\n\n      // script-src\n      const scriptSrc = directives.get('script-src') || [];\n      directives.set('script-src', [...scriptSrc, ...resourceDomains]);\n\n      // style-src\n      const styleSrc = directives.get('style-src') || [];\n      directives.set('style-src', [...styleSrc, ...resourceDomains]);\n\n      // img-src\n      const imgSrc = directives.get('img-src') || [];\n      directives.set('img-src', [...imgSrc, ...resourceDomains]);\n\n      // font-src\n      const fontSrc = directives.get('font-src') || [];\n      directives.set('font-src', [...fontSrc, ...resourceDomains]);\n    }\n  }\n\n  // Convert map to array\n  return Array.from(directives.entries()).map(([name, values]) => ({\n    name,\n    values: [...new Set(values)], // Deduplicate\n  }));\n}\n\n/**\n * Build sandbox attribute value for iframe.\n *\n * @param options - Sandbox options\n * @returns Sandbox attribute value string\n *\n * @example\n * ```typescript\n * const sandbox = buildSandboxAttribute({ allowForms: true });\n * // Returns: \"allow-scripts allow-same-origin allow-forms\"\n * ```\n */\nexport function buildSandboxAttribute(options?: {\n  allowForms?: boolean;\n  allowPopups?: boolean;\n  allowPopupsToEscapeSandbox?: boolean;\n}): string {\n  const permissions: string[] = [...SANDBOX_PERMISSIONS];\n\n  if (options?.allowForms) {\n    permissions.push('allow-forms');\n  }\n\n  if (options?.allowPopups) {\n    permissions.push('allow-popups');\n  }\n\n  if (options?.allowPopupsToEscapeSandbox) {\n    permissions.push('allow-popups-to-escape-sandbox');\n  }\n\n  return permissions.join(' ');\n}\n\n/**\n * Build CSP meta tag for embedding in HTML.\n *\n * @param csp - MCP Apps CSP configuration\n * @returns HTML meta tag string\n *\n * @example\n * ```typescript\n * const meta = buildCSPMetaTag({ connectDomains: ['https://api.example.com'] });\n * // Returns: <meta http-equiv=\"Content-Security-Policy\" content=\"...\">\n * ```\n */\nexport function buildCSPMetaTag(csp?: McpAppsCSP): string {\n  const header = buildCSPHeader(csp);\n  return `<meta http-equiv=\"Content-Security-Policy\" content=\"${escapeHtmlAttribute(header)}\">`;\n}\n\n/**\n * Validate domain against CSP configuration.\n *\n * @param domain - Domain to validate\n * @param csp - CSP configuration\n * @param type - Type of access ('connect' or 'resource')\n * @returns Whether the domain is allowed\n */\nexport function isDomainAllowed(domain: string, csp: McpAppsCSP | undefined, type: 'connect' | 'resource'): boolean {\n  if (!csp) return false;\n\n  const domains = type === 'connect' ? csp.connectDomains : csp.resourceDomains;\n\n  if (!domains || domains.length === 0) return false;\n\n  // Check if domain matches any allowed domain\n  return domains.some((allowed) => {\n    try {\n      const allowedUrl = new URL(allowed);\n      const testUrl = new URL(domain);\n\n      // Match protocol and hostname\n      return allowedUrl.protocol === testUrl.protocol && allowedUrl.hostname === testUrl.hostname;\n    } catch {\n      // If URL parsing fails, do exact string match\n      return allowed === domain;\n    }\n  });\n}\n\n/**\n * Merge two CSP configurations.\n *\n * @param base - Base CSP configuration\n * @param override - Override CSP configuration\n * @returns Merged CSP configuration\n */\nexport function mergeCSP(base: McpAppsCSP | undefined, override: McpAppsCSP | undefined): McpAppsCSP {\n  const merged: McpAppsCSP = {};\n\n  // Merge connect domains\n  const connectDomains = new Set<string>();\n  if (base?.connectDomains) {\n    base.connectDomains.forEach((d) => connectDomains.add(d));\n  }\n  if (override?.connectDomains) {\n    override.connectDomains.forEach((d) => connectDomains.add(d));\n  }\n  if (connectDomains.size > 0) {\n    merged.connectDomains = Array.from(connectDomains);\n  }\n\n  // Merge resource domains\n  const resourceDomains = new Set<string>();\n  if (base?.resourceDomains) {\n    base.resourceDomains.forEach((d) => resourceDomains.add(d));\n  }\n  if (override?.resourceDomains) {\n    override.resourceDomains.forEach((d) => resourceDomains.add(d));\n  }\n  if (resourceDomains.size > 0) {\n    merged.resourceDomains = Array.from(resourceDomains);\n  }\n\n  return merged;\n}\n\n// ============================================\n// Helper Functions\n// ============================================\n\n/**\n * Escape string for use in HTML attribute.\n */\nfunction escapeHtmlAttribute(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#39;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;');\n}\n\n/**\n * Parse CSP header string back to configuration.\n * Useful for testing and debugging.\n */\nexport function parseCSPHeader(header: string): McpAppsCSP {\n  const csp: McpAppsCSP = {};\n  const connectDomains: string[] = [];\n  const resourceDomains: string[] = [];\n\n  const directives = header.split(';').map((d) => d.trim());\n\n  for (const directive of directives) {\n    const [name, ...values] = directive.split(/\\s+/);\n\n    if (name === 'connect-src') {\n      for (const value of values) {\n        if (value.startsWith('https://') || value.startsWith('http://')) {\n          connectDomains.push(value);\n        }\n      }\n    }\n\n    if (['script-src', 'style-src', 'img-src', 'font-src'].includes(name)) {\n      for (const value of values) {\n        if (value.startsWith('https://') || value.startsWith('http://')) {\n          resourceDomains.push(value);\n        }\n      }\n    }\n  }\n\n  if (connectDomains.length > 0) {\n    csp.connectDomains = [...new Set(connectDomains)];\n  }\n\n  if (resourceDomains.length > 0) {\n    csp.resourceDomains = [...new Set(resourceDomains)];\n  }\n\n  return csp;\n}\n"]}

package/src/mcp-apps/index.js

@@ -1,91 +0,0 @@
-"use strict";
-/**
- * @file index.ts
- * @description MCP Apps module barrel exports.
- *
- * Provides support for the MCP Apps extension specification:
- * https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx
- *
- * @example
- * ```typescript
- * import {
- *   generateMcpAppsTemplate,
- *   buildCSPHeader,
- *   MCP_APPS_MIME_TYPE,
- *   type McpAppsHostContext,
- * } from '@frontmcp/sdk/mcp-apps';
- * ```
- *
- * @module @frontmcp/sdk/mcp-apps
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.extractBodyContent = exports.createSimpleMcpAppsTemplate = exports.wrapInMcpAppsTemplate = exports.generateMcpAppsTemplate = exports.parseCSPHeader = exports.mergeCSP = exports.isDomainAllowed = exports.buildCSPMetaTag = exports.buildSandboxAttribute = exports.buildCSPDirectives = exports.buildCSPHeader = exports.EXTENDED_SANDBOX_PERMISSIONS = exports.SANDBOX_PERMISSIONS = exports.DEFAULT_CSP_DIRECTIVES = exports.DEFAULT_PROTOCOL_VERSION = exports.parseHostContext = exports.parseUIResource = exports.isValidProtocolVersion = exports.isValidUIResourceUri = exports.ToolUIMetaSchema = exports.McpAppsExtensionCapabilitySchema = exports.McpUiMessageParamsSchema = exports.McpUiOpenLinkParamsSchema = exports.McpUiHostContextChangeParamsSchema = exports.McpUiSizeChangeParamsSchema = exports.McpUiToolCancelledParamsSchema = exports.McpUiToolResultParamsSchema = exports.McpUiToolInputPartialParamsSchema = exports.McpUiToolInputParamsSchema = exports.McpUiInitializeResultSchema = exports.McpUiInitializeParamsSchema = exports.JsonRpcNotificationSchema = exports.JsonRpcResponseSchema = exports.JsonRpcRequestSchema = exports.JsonRpcErrorSchema = exports.McpAppsHostContextSchema = exports.ToolInfoSchema = exports.ViewportInfoSchema = exports.SafeAreaInsetsSchema = exports.DeviceCapabilitiesSchema = exports.UIResourceSchema = exports.UIResourceMetaSchema = exports.McpAppsCSPSchema = exports.ThemeSchema = exports.McpAppsPlatformSchema = exports.McpAppsDisplayModeSchema = exports.McpAppsMimeTypeSchema = exports.MCP_APPS_PROTOCOL_VERSION = exports.MCP_APPS_METHODS = exports.MCP_APPS_MIME_TYPE = void 0;
-// Types
-var types_1 = require("./types");
-// MIME types
-Object.defineProperty(exports, "MCP_APPS_MIME_TYPE", { enumerable: true, get: function () { return types_1.MCP_APPS_MIME_TYPE; } });
-// Method names
-Object.defineProperty(exports, "MCP_APPS_METHODS", { enumerable: true, get: function () { return types_1.MCP_APPS_METHODS; } });
-// Protocol version
-Object.defineProperty(exports, "MCP_APPS_PROTOCOL_VERSION", { enumerable: true, get: function () { return types_1.MCP_APPS_PROTOCOL_VERSION; } });
-// Schemas
-var schemas_1 = require("./schemas");
-// Basic schemas
-Object.defineProperty(exports, "McpAppsMimeTypeSchema", { enumerable: true, get: function () { return schemas_1.McpAppsMimeTypeSchema; } });
-Object.defineProperty(exports, "McpAppsDisplayModeSchema", { enumerable: true, get: function () { return schemas_1.McpAppsDisplayModeSchema; } });
-Object.defineProperty(exports, "McpAppsPlatformSchema", { enumerable: true, get: function () { return schemas_1.McpAppsPlatformSchema; } });
-Object.defineProperty(exports, "ThemeSchema", { enumerable: true, get: function () { return schemas_1.ThemeSchema; } });
-Object.defineProperty(exports, "McpAppsCSPSchema", { enumerable: true, get: function () { return schemas_1.McpAppsCSPSchema; } });
-// Resource schemas
-Object.defineProperty(exports, "UIResourceMetaSchema", { enumerable: true, get: function () { return schemas_1.UIResourceMetaSchema; } });
-Object.defineProperty(exports, "UIResourceSchema", { enumerable: true, get: function () { return schemas_1.UIResourceSchema; } });
-// Context schemas
-Object.defineProperty(exports, "DeviceCapabilitiesSchema", { enumerable: true, get: function () { return schemas_1.DeviceCapabilitiesSchema; } });
-Object.defineProperty(exports, "SafeAreaInsetsSchema", { enumerable: true, get: function () { return schemas_1.SafeAreaInsetsSchema; } });
-Object.defineProperty(exports, "ViewportInfoSchema", { enumerable: true, get: function () { return schemas_1.ViewportInfoSchema; } });
-Object.defineProperty(exports, "ToolInfoSchema", { enumerable: true, get: function () { return schemas_1.ToolInfoSchema; } });
-Object.defineProperty(exports, "McpAppsHostContextSchema", { enumerable: true, get: function () { return schemas_1.McpAppsHostContextSchema; } });
-// JSON-RPC schemas
-Object.defineProperty(exports, "JsonRpcErrorSchema", { enumerable: true, get: function () { return schemas_1.JsonRpcErrorSchema; } });
-Object.defineProperty(exports, "JsonRpcRequestSchema", { enumerable: true, get: function () { return schemas_1.JsonRpcRequestSchema; } });
-Object.defineProperty(exports, "JsonRpcResponseSchema", { enumerable: true, get: function () { return schemas_1.JsonRpcResponseSchema; } });
-Object.defineProperty(exports, "JsonRpcNotificationSchema", { enumerable: true, get: function () { return schemas_1.JsonRpcNotificationSchema; } });
-// Protocol message schemas
-Object.defineProperty(exports, "McpUiInitializeParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiInitializeParamsSchema; } });
-Object.defineProperty(exports, "McpUiInitializeResultSchema", { enumerable: true, get: function () { return schemas_1.McpUiInitializeResultSchema; } });
-Object.defineProperty(exports, "McpUiToolInputParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiToolInputParamsSchema; } });
-Object.defineProperty(exports, "McpUiToolInputPartialParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiToolInputPartialParamsSchema; } });
-Object.defineProperty(exports, "McpUiToolResultParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiToolResultParamsSchema; } });
-Object.defineProperty(exports, "McpUiToolCancelledParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiToolCancelledParamsSchema; } });
-Object.defineProperty(exports, "McpUiSizeChangeParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiSizeChangeParamsSchema; } });
-Object.defineProperty(exports, "McpUiHostContextChangeParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiHostContextChangeParamsSchema; } });
-Object.defineProperty(exports, "McpUiOpenLinkParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiOpenLinkParamsSchema; } });
-Object.defineProperty(exports, "McpUiMessageParamsSchema", { enumerable: true, get: function () { return schemas_1.McpUiMessageParamsSchema; } });
-// Extension schemas
-Object.defineProperty(exports, "McpAppsExtensionCapabilitySchema", { enumerable: true, get: function () { return schemas_1.McpAppsExtensionCapabilitySchema; } });
-Object.defineProperty(exports, "ToolUIMetaSchema", { enumerable: true, get: function () { return schemas_1.ToolUIMetaSchema; } });
-// Validation helpers
-Object.defineProperty(exports, "isValidUIResourceUri", { enumerable: true, get: function () { return schemas_1.isValidUIResourceUri; } });
-Object.defineProperty(exports, "isValidProtocolVersion", { enumerable: true, get: function () { return schemas_1.isValidProtocolVersion; } });
-Object.defineProperty(exports, "parseUIResource", { enumerable: true, get: function () { return schemas_1.parseUIResource; } });
-Object.defineProperty(exports, "parseHostContext", { enumerable: true, get: function () { return schemas_1.parseHostContext; } });
-Object.defineProperty(exports, "DEFAULT_PROTOCOL_VERSION", { enumerable: true, get: function () { return schemas_1.DEFAULT_PROTOCOL_VERSION; } });
-// CSP
-var csp_1 = require("./csp");
-Object.defineProperty(exports, "DEFAULT_CSP_DIRECTIVES", { enumerable: true, get: function () { return csp_1.DEFAULT_CSP_DIRECTIVES; } });
-Object.defineProperty(exports, "SANDBOX_PERMISSIONS", { enumerable: true, get: function () { return csp_1.SANDBOX_PERMISSIONS; } });
-Object.defineProperty(exports, "EXTENDED_SANDBOX_PERMISSIONS", { enumerable: true, get: function () { return csp_1.EXTENDED_SANDBOX_PERMISSIONS; } });
-Object.defineProperty(exports, "buildCSPHeader", { enumerable: true, get: function () { return csp_1.buildCSPHeader; } });
-Object.defineProperty(exports, "buildCSPDirectives", { enumerable: true, get: function () { return csp_1.buildCSPDirectives; } });
-Object.defineProperty(exports, "buildSandboxAttribute", { enumerable: true, get: function () { return csp_1.buildSandboxAttribute; } });
-Object.defineProperty(exports, "buildCSPMetaTag", { enumerable: true, get: function () { return csp_1.buildCSPMetaTag; } });
-Object.defineProperty(exports, "isDomainAllowed", { enumerable: true, get: function () { return csp_1.isDomainAllowed; } });
-Object.defineProperty(exports, "mergeCSP", { enumerable: true, get: function () { return csp_1.mergeCSP; } });
-Object.defineProperty(exports, "parseCSPHeader", { enumerable: true, get: function () { return csp_1.parseCSPHeader; } });
-// Template
-var template_1 = require("./template");
-Object.defineProperty(exports, "generateMcpAppsTemplate", { enumerable: true, get: function () { return template_1.generateMcpAppsTemplate; } });
-Object.defineProperty(exports, "wrapInMcpAppsTemplate", { enumerable: true, get: function () { return template_1.wrapInMcpAppsTemplate; } });
-Object.defineProperty(exports, "createSimpleMcpAppsTemplate", { enumerable: true, get: function () { return template_1.createSimpleMcpAppsTemplate; } });
-Object.defineProperty(exports, "extractBodyContent", { enumerable: true, get: function () { return template_1.extractBodyContent; } });
-//# sourceMappingURL=index.js.map

package/src/mcp-apps/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mcp-apps/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AAEH,QAAQ;AACR,iCAiDiB;AAhDf,aAAa;AACb,2GAAA,kBAAkB,OAAA;AA0ClB,eAAe;AACf,yGAAA,gBAAgB,OAAA;AAEhB,mBAAmB;AACnB,kHAAA,yBAAyB,OAAA;AAG3B,UAAU;AACV,qCA+CmB;AA9CjB,gBAAgB;AAChB,gHAAA,qBAAqB,OAAA;AACrB,mHAAA,wBAAwB,OAAA;AACxB,gHAAA,qBAAqB,OAAA;AACrB,sGAAA,WAAW,OAAA;AACX,2GAAA,gBAAgB,OAAA;AAEhB,mBAAmB;AACnB,+GAAA,oBAAoB,OAAA;AACpB,2GAAA,gBAAgB,OAAA;AAEhB,kBAAkB;AAClB,mHAAA,wBAAwB,OAAA;AACxB,+GAAA,oBAAoB,OAAA;AACpB,6GAAA,kBAAkB,OAAA;AAClB,yGAAA,cAAc,OAAA;AACd,mHAAA,wBAAwB,OAAA;AAExB,mBAAmB;AACnB,6GAAA,kBAAkB,OAAA;AAClB,+GAAA,oBAAoB,OAAA;AACpB,gHAAA,qBAAqB,OAAA;AACrB,oHAAA,yBAAyB,OAAA;AAEzB,2BAA2B;AAC3B,sHAAA,2BAA2B,OAAA;AAC3B,sHAAA,2BAA2B,OAAA;AAC3B,qHAAA,0BAA0B,OAAA;AAC1B,4HAAA,iCAAiC,OAAA;AACjC,sHAAA,2BAA2B,OAAA;AAC3B,yHAAA,8BAA8B,OAAA;AAC9B,sHAAA,2BAA2B,OAAA;AAC3B,6HAAA,kCAAkC,OAAA;AAClC,oHAAA,yBAAyB,OAAA;AACzB,mHAAA,wBAAwB,OAAA;AAExB,oBAAoB;AACpB,2HAAA,gCAAgC,OAAA;AAChC,2GAAA,gBAAgB,OAAA;AAEhB,qBAAqB;AACrB,+GAAA,oBAAoB,OAAA;AACpB,iHAAA,sBAAsB,OAAA;AACtB,0GAAA,eAAe,OAAA;AACf,2GAAA,gBAAgB,OAAA;AAChB,mHAAA,wBAAwB,OAAA;AAG1B,MAAM;AACN,6BAae;AAVb,6GAAA,sBAAsB,OAAA;AACtB,0GAAA,mBAAmB,OAAA;AACnB,mHAAA,4BAA4B,OAAA;AAC5B,qGAAA,cAAc,OAAA;AACd,yGAAA,kBAAkB,OAAA;AAClB,4GAAA,qBAAqB,OAAA;AACrB,sGAAA,eAAe,OAAA;AACf,sGAAA,eAAe,OAAA;AACf,+FAAA,QAAQ,OAAA;AACR,qGAAA,cAAc,OAAA;AAGhB,WAAW;AACX,uCAOoB;AAJlB,mHAAA,uBAAuB,OAAA;AACvB,iHAAA,qBAAqB,OAAA;AACrB,uHAAA,2BAA2B,OAAA;AAC3B,8GAAA,kBAAkB,OAAA","sourcesContent":["/**\n * @file index.ts\n * @description MCP Apps module barrel exports.\n *\n * Provides support for the MCP Apps extension specification:\n * https://github.com/modelcontextprotocol/ext-apps/blob/main/specification/draft/apps.mdx\n *\n * @example\n * ```typescript\n * import {\n *   generateMcpAppsTemplate,\n *   buildCSPHeader,\n *   MCP_APPS_MIME_TYPE,\n *   type McpAppsHostContext,\n * } from '@frontmcp/sdk/mcp-apps';\n * ```\n *\n * @module @frontmcp/sdk/mcp-apps\n */\n\n// Types\nexport {\n  // MIME types\n  MCP_APPS_MIME_TYPE,\n  type McpAppsMimeType,\n\n  // UI Resource types\n  type McpAppsCSP,\n  type UIResourceMeta,\n  type UIResource,\n\n  // Host context types\n  type McpAppsDisplayMode,\n  type McpAppsPlatform,\n  type DeviceCapabilities,\n  type SafeAreaInsets,\n  type ViewportInfo,\n  type ToolInfo,\n  type McpAppsHostContext,\n\n  // JSON-RPC types\n  type JsonRpcMessage,\n  type JsonRpcRequest,\n  type JsonRpcResponse,\n  type JsonRpcNotification,\n  type JsonRpcError,\n\n  // Protocol message types\n  type McpUiInitializeParams,\n  type McpUiInitializeResult,\n  type McpUiToolInputParams,\n  type McpUiToolInputPartialParams,\n  type McpUiToolResultParams,\n  type McpUiToolCancelledParams,\n  type McpUiSizeChangeParams,\n  type McpUiHostContextChangeParams,\n  type McpUiOpenLinkParams,\n  type McpUiMessageParams,\n\n  // Extension types\n  type McpAppsExtensionCapability,\n  type McpClientExtensions,\n  type ToolUIMeta,\n  type McpAppsToolResultMeta,\n\n  // Method names\n  MCP_APPS_METHODS,\n\n  // Protocol version\n  MCP_APPS_PROTOCOL_VERSION,\n} from './types';\n\n// Schemas\nexport {\n  // Basic schemas\n  McpAppsMimeTypeSchema,\n  McpAppsDisplayModeSchema,\n  McpAppsPlatformSchema,\n  ThemeSchema,\n  McpAppsCSPSchema,\n\n  // Resource schemas\n  UIResourceMetaSchema,\n  UIResourceSchema,\n\n  // Context schemas\n  DeviceCapabilitiesSchema,\n  SafeAreaInsetsSchema,\n  ViewportInfoSchema,\n  ToolInfoSchema,\n  McpAppsHostContextSchema,\n\n  // JSON-RPC schemas\n  JsonRpcErrorSchema,\n  JsonRpcRequestSchema,\n  JsonRpcResponseSchema,\n  JsonRpcNotificationSchema,\n\n  // Protocol message schemas\n  McpUiInitializeParamsSchema,\n  McpUiInitializeResultSchema,\n  McpUiToolInputParamsSchema,\n  McpUiToolInputPartialParamsSchema,\n  McpUiToolResultParamsSchema,\n  McpUiToolCancelledParamsSchema,\n  McpUiSizeChangeParamsSchema,\n  McpUiHostContextChangeParamsSchema,\n  McpUiOpenLinkParamsSchema,\n  McpUiMessageParamsSchema,\n\n  // Extension schemas\n  McpAppsExtensionCapabilitySchema,\n  ToolUIMetaSchema,\n\n  // Validation helpers\n  isValidUIResourceUri,\n  isValidProtocolVersion,\n  parseUIResource,\n  parseHostContext,\n  DEFAULT_PROTOCOL_VERSION,\n} from './schemas';\n\n// CSP\nexport {\n  type CSPDirective,\n  type CSPConfig,\n  DEFAULT_CSP_DIRECTIVES,\n  SANDBOX_PERMISSIONS,\n  EXTENDED_SANDBOX_PERMISSIONS,\n  buildCSPHeader,\n  buildCSPDirectives,\n  buildSandboxAttribute,\n  buildCSPMetaTag,\n  isDomainAllowed,\n  mergeCSP,\n  parseCSPHeader,\n} from './csp';\n\n// Template\nexport {\n  type McpAppsTemplateOptions,\n  type McpAppsBridgeConfig,\n  generateMcpAppsTemplate,\n  wrapInMcpAppsTemplate,\n  createSimpleMcpAppsTemplate,\n  extractBodyContent,\n} from './template';\n"]}