@guuey/mcp-apps-host 0.27.0 → 0.28.1

package/dist/block-ui.d.ts

@@ -105,9 +105,26 @@ export declare function toolResultUiResource(block: Extract<AgBlock, {
  */
 export declare function uiLocator(uiData: JsonValue | undefined): string | undefined;
 /**
- * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * The `ui://` locator a `tool-result` block carries, from ANY channel it
  * can arrive on — the single seam every locator reader goes through.
  *
+ * `_meta.ui.resourceUri` is read FIRST. Under AgJSON draft.4 (core 0.7.0) a
+ * kept-open result's later `tool.done` replaces the payload as a unit, so a
+ * final that omits `uiData` / `structuredContent` CLEARS them on the fold,
+ * while `_meta` (a descriptor) survives an omitting final. The view's
+ * identity lives there by the spec's own rule. Reading the payload channels
+ * alone would take a folded card dark. Under 0.6.x both channels were kept,
+ * so this order gives the same answer on either version.
+ *
+ * Producers differ in what they put on `_meta.ui`. A server that only MARKS
+ * a result as UI (`_meta.ui: {}`) and carries the locator in
+ * `structuredContent` names no locator here, so the payload order decides:
+ * the same answer as before. A server that states `_meta.ui.resourceUri`
+ * gets that one, even when its payload names another, because the spec makes
+ * `_meta.ui` the durable identity. Note that a kept-open result (`more:
+ * true`) is what exercises the clearing; a producer that never keeps results
+ * open never folds an omitting final.
+ *
  * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
  * sibling: WITH the sibling it is surface data and the normalizer stamps
  * `uiData`; WITHOUT it, it is model-channel data and lands in
@@ -115,10 +132,16 @@ export declare function uiLocator(uiData: JsonValue | undefined): string | undef
  * posture; any plain-locator MCP server) therefore delivers a locator that
  * is byte-identical in shape but lives one field over — reading `uiData`
  * alone renders NOTHING for it (dark, not "expired"), and the persistence
- * projector minted no placeholder row (the read plane 404s). `uiData` wins
- * when both carry one (guuey#209 route-A finding).
+ * projector minted no placeholder row (the read plane 404s). Between the
+ * payload channels `uiData` wins when both carry one (guuey#209 route-A
+ * finding). The pod's `blockLocator` (nocode-runtime live-cards.ts) and the
+ * persisted door's `snapshotCarriesLocator` (publicApi ui-resource.ts) apply
+ * the same order, so live and persisted guards recognize one locator set.
  */
 export declare function toolResultLocator(block: {
+    _meta?: {
+        [key: string]: JsonValue;
+    };
     uiData?: JsonValue;
     structuredContent?: JsonValue;
 }): string | undefined;

package/dist/block-ui.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"block-ui.d.ts","sourceRoot":"","sources":["../src/block-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAExF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAK5F;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,oBAAoB,GAAG,SAAS,CAMlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAyBlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,oBAAoB,GAAG,SAAS,CAUlC;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI3E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,CAAC;CAC/B,GAAG,MAAM,GAAG,SAAS,CAErB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAU/E"}
+{"version":3,"file":"block-ui.d.ts","sourceRoot":"","sources":["../src/block-ui.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,CAAC,IAAI;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAExF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAK5F;AAED;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,SAAS,GAAG,SAAS,GACzB,oBAAoB,GAAG,SAAS,CAMlC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAyBlF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC,GAC/C,oBAAoB,GAAG,SAAS,CAUlC;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI3E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE;IACvC,KAAK,CAAC,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC;IACrC,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,iBAAiB,CAAC,EAAE,SAAS,CAAC;CAC/B,GAAG,MAAM,GAAG,SAAS,CAErB;AAED,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,SAAS,GAAG,oBAAoB,GAAG,SAAS,CAU5F;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAU/E"}

package/dist/block-ui.js

@@ -141,9 +141,26 @@ export function uiLocator(uiData) {
     return typeof uri === "string" && uri.startsWith("ui://") ? uri : undefined;
 }
 /**
- * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * The `ui://` locator a `tool-result` block carries, from ANY channel it
  * can arrive on — the single seam every locator reader goes through.
  *
+ * `_meta.ui.resourceUri` is read FIRST. Under AgJSON draft.4 (core 0.7.0) a
+ * kept-open result's later `tool.done` replaces the payload as a unit, so a
+ * final that omits `uiData` / `structuredContent` CLEARS them on the fold,
+ * while `_meta` (a descriptor) survives an omitting final. The view's
+ * identity lives there by the spec's own rule. Reading the payload channels
+ * alone would take a folded card dark. Under 0.6.x both channels were kept,
+ * so this order gives the same answer on either version.
+ *
+ * Producers differ in what they put on `_meta.ui`. A server that only MARKS
+ * a result as UI (`_meta.ui: {}`) and carries the locator in
+ * `structuredContent` names no locator here, so the payload order decides:
+ * the same answer as before. A server that states `_meta.ui.resourceUri`
+ * gets that one, even when its payload names another, because the spec makes
+ * `_meta.ui` the durable identity. Note that a kept-open result (`more:
+ * true`) is what exercises the clearing; a producer that never keeps results
+ * open never folds an omitting final.
+ *
  * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
  * sibling: WITH the sibling it is surface data and the normalizer stamps
  * `uiData`; WITHOUT it, it is model-channel data and lands in
@@ -151,11 +168,14 @@ export function uiLocator(uiData) {
  * posture; any plain-locator MCP server) therefore delivers a locator that
  * is byte-identical in shape but lives one field over — reading `uiData`
  * alone renders NOTHING for it (dark, not "expired"), and the persistence
- * projector minted no placeholder row (the read plane 404s). `uiData` wins
- * when both carry one (guuey#209 route-A finding).
+ * projector minted no placeholder row (the read plane 404s). Between the
+ * payload channels `uiData` wins when both carry one (guuey#209 route-A
+ * finding). The pod's `blockLocator` (nocode-runtime live-cards.ts) and the
+ * persisted door's `snapshotCarriesLocator` (publicApi ui-resource.ts) apply
+ * the same order, so live and persisted guards recognize one locator set.
  */
 export function toolResultLocator(block) {
-    return uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
+    return uiLocator(block._meta?.ui) ?? uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
 }
 export function snapshotUiResource(cardSnapshot) {
     if (!isJsonObject(cardSnapshot))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@guuey/mcp-apps-host",
-  "version": "0.27.0",
+  "version": "0.28.1",
   "description": "The MCP Apps (SEP-1865) Host role for guuey's chat surfaces — view-mount narrowing across UI channels, ui:// locator rehydration by resources/read, and the sandbox-trust channel contract. Vendor-neutral: any spec-following MCP App mounts through it.",
   "license": "MIT",
   "type": "module",
@@ -33,9 +33,9 @@
     }
   },
   "dependencies": {
-    "@ggui-ai/protocol": "0.20.0",
+    "@ggui-ai/protocol": "0.23.0",
     "@modelcontextprotocol/ext-apps": "^1.7.5",
-    "@silverprotocol/core": "0.6.7"
+    "@silverprotocol/core": "0.7.2"
   },
   "peerDependencies": {
     "react": ">=18"

package/src/block-ui.ts

@@ -176,9 +176,26 @@ export function uiLocator(uiData: JsonValue | undefined): string | undefined {
 }
 
 /**
- * The `ui://` locator a `tool-result` block carries, from EITHER channel it
+ * The `ui://` locator a `tool-result` block carries, from ANY channel it
  * can arrive on — the single seam every locator reader goes through.
  *
+ * `_meta.ui.resourceUri` is read FIRST. Under AgJSON draft.4 (core 0.7.0) a
+ * kept-open result's later `tool.done` replaces the payload as a unit, so a
+ * final that omits `uiData` / `structuredContent` CLEARS them on the fold,
+ * while `_meta` (a descriptor) survives an omitting final. The view's
+ * identity lives there by the spec's own rule. Reading the payload channels
+ * alone would take a folded card dark. Under 0.6.x both channels were kept,
+ * so this order gives the same answer on either version.
+ *
+ * Producers differ in what they put on `_meta.ui`. A server that only MARKS
+ * a result as UI (`_meta.ui: {}`) and carries the locator in
+ * `structuredContent` names no locator here, so the payload order decides:
+ * the same answer as before. A server that states `_meta.ui.resourceUri`
+ * gets that one, even when its payload names another, because the spec makes
+ * `_meta.ui` the durable identity. Note that a kept-open result (`more:
+ * true`) is what exercises the clearing; a producer that never keeps results
+ * open never folds an omitting final.
+ *
  * AgJSON §2.1 routes a tool result's `structuredContent` by its `_meta.ui`
  * sibling: WITH the sibling it is surface data and the normalizer stamps
  * `uiData`; WITHOUT it, it is model-channel data and lands in
@@ -186,14 +203,18 @@ export function uiLocator(uiData: JsonValue | undefined): string | undefined {
  * posture; any plain-locator MCP server) therefore delivers a locator that
  * is byte-identical in shape but lives one field over — reading `uiData`
  * alone renders NOTHING for it (dark, not "expired"), and the persistence
- * projector minted no placeholder row (the read plane 404s). `uiData` wins
- * when both carry one (guuey#209 route-A finding).
+ * projector minted no placeholder row (the read plane 404s). Between the
+ * payload channels `uiData` wins when both carry one (guuey#209 route-A
+ * finding). The pod's `blockLocator` (nocode-runtime live-cards.ts) and the
+ * persisted door's `snapshotCarriesLocator` (publicApi ui-resource.ts) apply
+ * the same order, so live and persisted guards recognize one locator set.
  */
 export function toolResultLocator(block: {
+  _meta?: { [key: string]: JsonValue };
   uiData?: JsonValue;
   structuredContent?: JsonValue;
 }): string | undefined {
-  return uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
+  return uiLocator(block._meta?.ui) ?? uiLocator(block.uiData) ?? uiLocator(block.structuredContent);
 }
 
 export function snapshotUiResource(cardSnapshot: JsonValue): McpUiResourcePayload | undefined {