@mastra/mcp-apps-components 0.0.0 → 0.1.0-alpha.0

package/dist/define-mcp-app-resource.d.ts

@@ -0,0 +1,16 @@
+import type { McpAppResource } from './types.js';
+export type McpAppResourceOptions = {
+    name?: string;
+    description?: string;
+};
+/**
+ * Declares the server side of an app built from `src/apps/<app>`: a function returning the
+ * resource to register under a `ui://` URI in `MCPServer`'s `appResources`.
+ *
+ * The page is passed inline rather than as a file path: deployers bundle this package into the
+ * server output, where no sibling HTML file exists (and Cloudflare has no filesystem at all).
+ * Apps reach Mastra through their server's tools, never the network, so the resource keeps
+ * hosts' default CSP.
+ */
+export declare function defineMcpAppResource(html: string, defaults: Required<McpAppResourceOptions>): ({ name, description, }?: McpAppResourceOptions) => McpAppResource;
+//# sourceMappingURL=define-mcp-app-resource.d.ts.map

package/dist/define-mcp-app-resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-mcp-app-resource.d.ts","sourceRoot":"","sources":["../src/define-mcp-app-resource.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAE9C,MAAM,MAAM,qBAAqB,GAAG;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,qBAAqB,CAAC,6BAIvF,qBAAqB,KAAQ,cAAc,CAK/C"}

package/dist/observability-protocol.d.ts

@@ -0,0 +1,62 @@
+import { z } from 'zod';
+/**
+ * The app-only tools apps read observability data through, with the server route each one runs.
+ * Apps run in a sandboxed iframe that hosts may forbid from reaching the server, so their requests
+ * travel as calls to these tools over the host's existing MCP connection instead.
+ */
+export declare const OBSERVABILITY_APP_TOOLS: {
+    readonly observabilityAggregateTraces: {
+        readonly method: 'POST';
+        readonly path: '/observability/traces/aggregate';
+    };
+    readonly observabilityAggregateSpans: {
+        readonly method: 'POST';
+        readonly path: '/observability/spans/aggregate';
+    };
+    readonly observabilityMetricAggregate: {
+        readonly method: 'POST';
+        readonly path: '/observability/metrics/aggregate';
+    };
+    readonly observabilityMetricBreakdown: {
+        readonly method: 'POST';
+        readonly path: '/observability/metrics/breakdown';
+    };
+    readonly observabilityMetricTimeSeries: {
+        readonly method: 'POST';
+        readonly path: '/observability/metrics/timeseries';
+    };
+    readonly observabilityMetricPercentiles: {
+        readonly method: 'POST';
+        readonly path: '/observability/metrics/percentiles';
+    };
+    readonly observabilityListScores: {
+        readonly method: 'GET';
+        readonly path: '/observability/scores';
+    };
+    readonly observabilityScoreAggregate: {
+        readonly method: 'POST';
+        readonly path: '/observability/scores/aggregate';
+    };
+    readonly observabilityScoreBreakdown: {
+        readonly method: 'POST';
+        readonly path: '/observability/scores/breakdown';
+    };
+    readonly observabilityScoreTimeSeries: {
+        readonly method: 'POST';
+        readonly path: '/observability/scores/timeseries';
+    };
+    readonly observabilityScorePercentiles: {
+        readonly method: 'POST';
+        readonly path: '/observability/scores/percentiles';
+    };
+};
+export type ObservabilityAppToolName = keyof typeof OBSERVABILITY_APP_TOOLS;
+/** A GET route's query string, one entry per key; repeated keys become arrays. */
+export declare const routeQuerySchema: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+/** What each tool answers: the route's own status and body, as it would over HTTP. */
+export declare const routeResponseSchema: z.ZodObject<{
+    status: z.ZodNumber;
+    body: z.ZodUnknown;
+}, z.core.$strip>;
+export type RouteResponse = z.output<typeof routeResponseSchema>;
+//# sourceMappingURL=observability-protocol.d.ts.map

package/dist/observability-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-protocol.d.ts","sourceRoot":"","sources":["../src/observability-protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;iBACF,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,iCAAiC;;;iBACxD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,gCAAgC;;;iBACrD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,kCAAkC;;;iBACxD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,kCAAkC;;;iBACvD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,mCAAmC;;;iBACxD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,oCAAoC;;;iBACjE,MAAM,EAAE,KAAK;iBAAE,IAAI,EAAE,uBAAuB;;;iBACxC,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,iCAAiC;;;iBACvD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,iCAAiC;;;iBACtD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,kCAAkC;;;iBACvD,MAAM,EAAE,MAAM;iBAAE,IAAI,EAAE,mCAAmC;;CACf,CAAC;AAE9E,MAAM,MAAM,wBAAwB,GAAG,MAAM,OAAO,uBAAuB,CAAC;AAE5E,kFAAkF;AAClF,eAAO,MAAM,gBAAgB,uFAAmE,CAAC;AAEjG,sFAAsF;AACtF,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/observability-tools.cjs

@@ -0,0 +1,118 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let zod = require("zod");
+let _mastra_core_request_context = require("@mastra/core/request-context");
+let _mastra_core_tools = require("@mastra/core/tools");
+let _mastra_server_handlers_observability = require("@mastra/server/handlers/observability");
+let _mastra_server_server_adapter = require("@mastra/server/server-adapter");
+// src/observability-protocol.ts
+/**
+* The app-only tools apps read observability data through, with the server route each one runs.
+* Apps run in a sandboxed iframe that hosts may forbid from reaching the server, so their requests
+* travel as calls to these tools over the host's existing MCP connection instead.
+*/
+const OBSERVABILITY_APP_TOOLS = {
+	observabilityAggregateTraces: {
+		method: "POST",
+		path: "/observability/traces/aggregate"
+	},
+	observabilityAggregateSpans: {
+		method: "POST",
+		path: "/observability/spans/aggregate"
+	},
+	observabilityMetricAggregate: {
+		method: "POST",
+		path: "/observability/metrics/aggregate"
+	},
+	observabilityMetricBreakdown: {
+		method: "POST",
+		path: "/observability/metrics/breakdown"
+	},
+	observabilityMetricTimeSeries: {
+		method: "POST",
+		path: "/observability/metrics/timeseries"
+	},
+	observabilityMetricPercentiles: {
+		method: "POST",
+		path: "/observability/metrics/percentiles"
+	},
+	observabilityListScores: {
+		method: "GET",
+		path: "/observability/scores"
+	},
+	observabilityScoreAggregate: {
+		method: "POST",
+		path: "/observability/scores/aggregate"
+	},
+	observabilityScoreBreakdown: {
+		method: "POST",
+		path: "/observability/scores/breakdown"
+	},
+	observabilityScoreTimeSeries: {
+		method: "POST",
+		path: "/observability/scores/timeseries"
+	},
+	observabilityScorePercentiles: {
+		method: "POST",
+		path: "/observability/scores/percentiles"
+	}
+};
+/** A GET route's query string, one entry per key; repeated keys become arrays. */
+const routeQuerySchema = zod.z.record(zod.z.string(), zod.z.union([zod.z.string(), zod.z.array(zod.z.string())]));
+/** What each tool answers: the route's own status and body, as it would over HTTP. */
+const routeResponseSchema = zod.z.object({
+	status: zod.z.number().int(),
+	body: zod.z.unknown()
+});
+// src/observability-tools.ts
+/** The server route behind each tool. */
+const OBSERVABILITY_APP_TOOL_ROUTES = {
+	observabilityAggregateTraces: _mastra_server_handlers_observability.AGGREGATE_TRACES,
+	observabilityAggregateSpans: _mastra_server_handlers_observability.AGGREGATE_SPANS,
+	observabilityMetricAggregate: _mastra_server_handlers_observability.GET_METRIC_AGGREGATE,
+	observabilityMetricBreakdown: _mastra_server_handlers_observability.GET_METRIC_BREAKDOWN,
+	observabilityMetricTimeSeries: _mastra_server_handlers_observability.GET_METRIC_TIME_SERIES,
+	observabilityMetricPercentiles: _mastra_server_handlers_observability.GET_METRIC_PERCENTILES,
+	observabilityListScores: _mastra_server_handlers_observability.LIST_SCORES,
+	observabilityScoreAggregate: _mastra_server_handlers_observability.GET_SCORE_AGGREGATE,
+	observabilityScoreBreakdown: _mastra_server_handlers_observability.GET_SCORE_BREAKDOWN,
+	observabilityScoreTimeSeries: _mastra_server_handlers_observability.GET_SCORE_TIME_SERIES,
+	observabilityScorePercentiles: _mastra_server_handlers_observability.GET_SCORE_PERCENTILES
+};
+function isMastra(value) {
+	return typeof value?.getServer === "function";
+}
+function routeTool(id) {
+	const route = OBSERVABILITY_APP_TOOL_ROUTES[id];
+	const readsQuery = OBSERVABILITY_APP_TOOLS[id].method === "GET";
+	return (0, _mastra_core_tools.createTool)({
+		id,
+		description: route.openapi?.summary ?? `${route.method} ${route.path}`,
+		inputSchema: readsQuery ? routeQuerySchema : route.bodySchema,
+		outputSchema: routeResponseSchema,
+		mcp: { _meta: { ui: { visibility: ["app"] } } },
+		execute: async (input, { mastra, requestContext, abortSignal }) => {
+			if (!isMastra(mastra)) return {
+				status: 503,
+				body: { error: `${id} needs a Mastra instance.` }
+			};
+			return (0, _mastra_server_server_adapter.invokeRoute)(route, {
+				mastra,
+				requestContext: requestContext ?? new _mastra_core_request_context.RequestContext(),
+				...readsQuery ? { query: routeQuerySchema.parse(input) } : { body: input },
+				abortSignal
+			});
+		}
+	});
+}
+/**
+* The app-only tools apps from this package read observability data through. Register them on
+* the MCP server that serves the apps. Each runs its Mastra route in-process as the caller, with
+* the route's own input validation, authentication, RBAC permission and FGA checks, so an app
+* sees exactly the data the signed-in user can read over HTTP.
+*/
+const observabilityAppTools = Object.fromEntries(Object.keys(OBSERVABILITY_APP_TOOLS).map((id) => [id, routeTool(id)]));
+exports.OBSERVABILITY_APP_TOOLS = OBSERVABILITY_APP_TOOLS;
+exports.OBSERVABILITY_APP_TOOL_ROUTES = OBSERVABILITY_APP_TOOL_ROUTES;
+exports.observabilityAppTools = observabilityAppTools;
+
+//# sourceMappingURL=observability-tools.cjs.map

package/dist/observability-tools.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-tools.cjs","names":["z","AGGREGATE_TRACES","AGGREGATE_SPANS","GET_METRIC_AGGREGATE","GET_METRIC_BREAKDOWN","GET_METRIC_TIME_SERIES","GET_METRIC_PERCENTILES","LIST_SCORES","GET_SCORE_AGGREGATE","GET_SCORE_BREAKDOWN","GET_SCORE_TIME_SERIES","GET_SCORE_PERCENTILES","createTool","invokeRoute","RequestContext"],"sources":["../src/observability-protocol.ts","../src/observability-tools.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * The app-only tools apps read observability data through, with the server route each one runs.\n * Apps run in a sandboxed iframe that hosts may forbid from reaching the server, so their requests\n * travel as calls to these tools over the host's existing MCP connection instead.\n */\nexport const OBSERVABILITY_APP_TOOLS = {\n  observabilityAggregateTraces: { method: 'POST', path: '/observability/traces/aggregate' },\n  observabilityAggregateSpans: { method: 'POST', path: '/observability/spans/aggregate' },\n  observabilityMetricAggregate: { method: 'POST', path: '/observability/metrics/aggregate' },\n  observabilityMetricBreakdown: { method: 'POST', path: '/observability/metrics/breakdown' },\n  observabilityMetricTimeSeries: { method: 'POST', path: '/observability/metrics/timeseries' },\n  observabilityMetricPercentiles: { method: 'POST', path: '/observability/metrics/percentiles' },\n  observabilityListScores: { method: 'GET', path: '/observability/scores' },\n  observabilityScoreAggregate: { method: 'POST', path: '/observability/scores/aggregate' },\n  observabilityScoreBreakdown: { method: 'POST', path: '/observability/scores/breakdown' },\n  observabilityScoreTimeSeries: { method: 'POST', path: '/observability/scores/timeseries' },\n  observabilityScorePercentiles: { method: 'POST', path: '/observability/scores/percentiles' },\n} as const satisfies Record<string, { method: 'GET' | 'POST'; path: string }>;\n\nexport type ObservabilityAppToolName = keyof typeof OBSERVABILITY_APP_TOOLS;\n\n/** A GET route's query string, one entry per key; repeated keys become arrays. */\nexport const routeQuerySchema = z.record(z.string(), z.union([z.string(), z.array(z.string())]));\n\n/** What each tool answers: the route's own status and body, as it would over HTTP. */\nexport const routeResponseSchema = z.object({\n  status: z.number().int(),\n  body: z.unknown(),\n});\n\nexport type RouteResponse = z.output<typeof routeResponseSchema>;\n","import type { Mastra } from '@mastra/core/mastra';\nimport { RequestContext } from '@mastra/core/request-context';\nimport { createTool } from '@mastra/core/tools';\nimport {\n  AGGREGATE_SPANS,\n  AGGREGATE_TRACES,\n  GET_METRIC_AGGREGATE,\n  GET_METRIC_BREAKDOWN,\n  GET_METRIC_PERCENTILES,\n  GET_METRIC_TIME_SERIES,\n  GET_SCORE_AGGREGATE,\n  GET_SCORE_BREAKDOWN,\n  GET_SCORE_PERCENTILES,\n  GET_SCORE_TIME_SERIES,\n  LIST_SCORES,\n} from '@mastra/server/handlers/observability';\nimport { invokeRoute } from '@mastra/server/server-adapter';\nimport type { ServerRoute } from '@mastra/server/server-adapter';\nimport { OBSERVABILITY_APP_TOOLS, routeQuerySchema, routeResponseSchema } from './observability-protocol';\nimport type { ObservabilityAppToolName, RouteResponse } from './observability-protocol';\n\nexport { OBSERVABILITY_APP_TOOLS } from './observability-protocol';\nexport type { ObservabilityAppToolName, RouteResponse } from './observability-protocol';\n\n/** The server route behind each tool. */\nexport const OBSERVABILITY_APP_TOOL_ROUTES: Record<ObservabilityAppToolName, ServerRoute> = {\n  observabilityAggregateTraces: AGGREGATE_TRACES,\n  observabilityAggregateSpans: AGGREGATE_SPANS,\n  observabilityMetricAggregate: GET_METRIC_AGGREGATE,\n  observabilityMetricBreakdown: GET_METRIC_BREAKDOWN,\n  observabilityMetricTimeSeries: GET_METRIC_TIME_SERIES,\n  observabilityMetricPercentiles: GET_METRIC_PERCENTILES,\n  observabilityListScores: LIST_SCORES,\n  observabilityScoreAggregate: GET_SCORE_AGGREGATE,\n  observabilityScoreBreakdown: GET_SCORE_BREAKDOWN,\n  observabilityScoreTimeSeries: GET_SCORE_TIME_SERIES,\n  observabilityScorePercentiles: GET_SCORE_PERCENTILES,\n};\n\n// Structural, not `instanceof`: a second installed copy of @mastra/core has its own Mastra class.\nfunction isMastra(value: unknown): value is Mastra {\n  return typeof (value as Partial<Mastra> | undefined)?.getServer === 'function';\n}\n\nfunction routeTool(id: ObservabilityAppToolName) {\n  const route = OBSERVABILITY_APP_TOOL_ROUTES[id];\n  const readsQuery = OBSERVABILITY_APP_TOOLS[id].method === 'GET';\n\n  return createTool({\n    id,\n    description: route.openapi?.summary ?? `${route.method} ${route.path}`,\n    inputSchema: readsQuery ? routeQuerySchema : route.bodySchema,\n    outputSchema: routeResponseSchema,\n    // Apps call it; hosts keep it away from the model.\n    mcp: { _meta: { ui: { visibility: ['app'] } } },\n    execute: async (input, { mastra, requestContext, abortSignal }): Promise<RouteResponse> => {\n      if (!isMastra(mastra)) return { status: 503, body: { error: `${id} needs a Mastra instance.` } };\n      return invokeRoute(route, {\n        mastra,\n        // Without the caller's context, a server with auth refuses the call.\n        requestContext: requestContext ?? new RequestContext(),\n        ...(readsQuery ? { query: routeQuerySchema.parse(input) } : { body: input }),\n        abortSignal,\n      });\n    },\n  });\n}\n\n/**\n * The app-only tools apps from this package read observability data through. Register them on\n * the MCP server that serves the apps. Each runs its Mastra route in-process as the caller, with\n * the route's own input validation, authentication, RBAC permission and FGA checks, so an app\n * sees exactly the data the signed-in user can read over HTTP.\n */\nexport const observabilityAppTools = Object.fromEntries(\n  (Object.keys(OBSERVABILITY_APP_TOOLS) as ObservabilityAppToolName[]).map(id => [id, routeTool(id)]),\n) as Record<ObservabilityAppToolName, ReturnType<typeof routeTool>>;\n"],"mappings":";;;;;;;;;;;;AAOA,MAAa,0BAA0B;CACrC,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACxF,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAiC;CACtF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,+BAA+B;EAAE,QAAQ;EAAQ,MAAM;CAAoC;CAC3F,gCAAgC;EAAE,QAAQ;EAAQ,MAAM;CAAqC;CAC7F,yBAAyB;EAAE,QAAQ;EAAO,MAAM;CAAwB;CACxE,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACvF,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACvF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,+BAA+B;EAAE,QAAQ;EAAQ,MAAM;CAAoC;AAC7F;;AAKA,MAAa,mBAAmBA,IAAAA,EAAE,OAAOA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,MAAM,CAACA,IAAAA,EAAE,OAAO,GAAGA,IAAAA,EAAE,MAAMA,IAAAA,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;;AAG/F,MAAa,sBAAsBA,IAAAA,EAAE,OAAO;CAC1C,QAAQA,IAAAA,EAAE,OAAO,CAAC,CAAC,IAAI;CACvB,MAAMA,IAAAA,EAAE,QAAQ;AAClB,CAAC;;;ACLD,MAAa,gCAA+E;CAC1F,8BAA8BC,sCAAAA;CAC9B,6BAA6BC,sCAAAA;CAC7B,8BAA8BC,sCAAAA;CAC9B,8BAA8BC,sCAAAA;CAC9B,+BAA+BC,sCAAAA;CAC/B,gCAAgCC,sCAAAA;CAChC,yBAAyBC,sCAAAA;CACzB,6BAA6BC,sCAAAA;CAC7B,6BAA6BC,sCAAAA;CAC7B,8BAA8BC,sCAAAA;CAC9B,+BAA+BC,sCAAAA;AACjC;AAGA,SAAS,SAAS,OAAiC;CACjD,OAAO,OAAQ,OAAuC,cAAc;AACtE;AAEA,SAAS,UAAU,IAA8B;CAC/C,MAAM,QAAQ,8BAA8B;CAC5C,MAAM,aAAa,wBAAwB,GAAG,CAAC,WAAW;CAE1D,QAAA,GAAOC,mBAAAA,WAAAA,CAAW;EAChB;EACA,aAAa,MAAM,SAAS,WAAW,GAAG,MAAM,OAAO,GAAG,MAAM;EAChE,aAAa,aAAa,mBAAmB,MAAM;EACnD,cAAc;EAEd,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE;EAC9C,SAAS,OAAO,OAAO,EAAE,QAAQ,gBAAgB,kBAA0C;GACzF,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,OAAO,GAAG,GAAG,2BAA2B;GAAE;GAC/F,QAAA,GAAOC,8BAAAA,YAAAA,CAAY,OAAO;IACxB;IAEA,gBAAgB,kBAAkB,IAAIC,6BAAAA,eAAe;IACrD,GAAI,aAAa,EAAE,OAAO,iBAAiB,MAAM,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM;IAC1E;GACF,CAAC;EACH;CACF,CAAC;AACH;;;;;;;AAQA,MAAa,wBAAwB,OAAO,YACzC,OAAO,KAAK,uBAAuB,CAAC,CAAgC,KAAI,OAAM,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CACpG"}

package/dist/observability-tools.d.ts

@@ -0,0 +1,18 @@
+import type { ServerRoute } from '@mastra/server/server-adapter';
+import type { ObservabilityAppToolName } from './observability-protocol.js';
+export { OBSERVABILITY_APP_TOOLS } from './observability-protocol.js';
+export type { ObservabilityAppToolName, RouteResponse } from './observability-protocol.js';
+/** The server route behind each tool. */
+export declare const OBSERVABILITY_APP_TOOL_ROUTES: Record<ObservabilityAppToolName, ServerRoute>;
+declare function routeTool(id: ObservabilityAppToolName): import("@mastra/core/tools").Tool<unknown, {
+    status: number;
+    body: unknown;
+}, unknown, unknown, import("@mastra/core/tools").ToolExecutionContext<unknown, unknown, unknown>, "observabilityAggregateSpans" | "observabilityAggregateTraces" | "observabilityListScores" | "observabilityMetricAggregate" | "observabilityMetricBreakdown" | "observabilityMetricPercentiles" | "observabilityMetricTimeSeries" | "observabilityScoreAggregate" | "observabilityScoreBreakdown" | "observabilityScorePercentiles" | "observabilityScoreTimeSeries", unknown>;
+/**
+ * The app-only tools apps from this package read observability data through. Register them on
+ * the MCP server that serves the apps. Each runs its Mastra route in-process as the caller, with
+ * the route's own input validation, authentication, RBAC permission and FGA checks, so an app
+ * sees exactly the data the signed-in user can read over HTTP.
+ */
+export declare const observabilityAppTools: Record<ObservabilityAppToolName, ReturnType<typeof routeTool>>;
+//# sourceMappingURL=observability-tools.d.ts.map

package/dist/observability-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-tools.d.ts","sourceRoot":"","sources":["../src/observability-tools.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAEjE,OAAO,KAAK,EAAE,wBAAwB,EAAiB,MAAM,0BAA0B,CAAC;AAExF,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,YAAY,EAAE,wBAAwB,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAExF,yCAAyC;AACzC,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,wBAAwB,EAAE,WAAW,CAYvF,CAAC;AAOF,iBAAS,SAAS,CAAC,EAAE,EAAE,wBAAwB;;;kdAsB9C;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAE7B,MAAM,CAAC,wBAAwB,EAAE,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC"}

package/dist/observability-tools.js

@@ -0,0 +1,115 @@
+import { z } from "zod";
+import { RequestContext } from "@mastra/core/request-context";
+import { createTool } from "@mastra/core/tools";
+import { AGGREGATE_SPANS, AGGREGATE_TRACES, GET_METRIC_AGGREGATE, GET_METRIC_BREAKDOWN, GET_METRIC_PERCENTILES, GET_METRIC_TIME_SERIES, GET_SCORE_AGGREGATE, GET_SCORE_BREAKDOWN, GET_SCORE_PERCENTILES, GET_SCORE_TIME_SERIES, LIST_SCORES } from "@mastra/server/handlers/observability";
+import { invokeRoute } from "@mastra/server/server-adapter";
+// src/observability-protocol.ts
+/**
+* The app-only tools apps read observability data through, with the server route each one runs.
+* Apps run in a sandboxed iframe that hosts may forbid from reaching the server, so their requests
+* travel as calls to these tools over the host's existing MCP connection instead.
+*/
+const OBSERVABILITY_APP_TOOLS = {
+	observabilityAggregateTraces: {
+		method: "POST",
+		path: "/observability/traces/aggregate"
+	},
+	observabilityAggregateSpans: {
+		method: "POST",
+		path: "/observability/spans/aggregate"
+	},
+	observabilityMetricAggregate: {
+		method: "POST",
+		path: "/observability/metrics/aggregate"
+	},
+	observabilityMetricBreakdown: {
+		method: "POST",
+		path: "/observability/metrics/breakdown"
+	},
+	observabilityMetricTimeSeries: {
+		method: "POST",
+		path: "/observability/metrics/timeseries"
+	},
+	observabilityMetricPercentiles: {
+		method: "POST",
+		path: "/observability/metrics/percentiles"
+	},
+	observabilityListScores: {
+		method: "GET",
+		path: "/observability/scores"
+	},
+	observabilityScoreAggregate: {
+		method: "POST",
+		path: "/observability/scores/aggregate"
+	},
+	observabilityScoreBreakdown: {
+		method: "POST",
+		path: "/observability/scores/breakdown"
+	},
+	observabilityScoreTimeSeries: {
+		method: "POST",
+		path: "/observability/scores/timeseries"
+	},
+	observabilityScorePercentiles: {
+		method: "POST",
+		path: "/observability/scores/percentiles"
+	}
+};
+/** A GET route's query string, one entry per key; repeated keys become arrays. */
+const routeQuerySchema = z.record(z.string(), z.union([z.string(), z.array(z.string())]));
+/** What each tool answers: the route's own status and body, as it would over HTTP. */
+const routeResponseSchema = z.object({
+	status: z.number().int(),
+	body: z.unknown()
+});
+// src/observability-tools.ts
+/** The server route behind each tool. */
+const OBSERVABILITY_APP_TOOL_ROUTES = {
+	observabilityAggregateTraces: AGGREGATE_TRACES,
+	observabilityAggregateSpans: AGGREGATE_SPANS,
+	observabilityMetricAggregate: GET_METRIC_AGGREGATE,
+	observabilityMetricBreakdown: GET_METRIC_BREAKDOWN,
+	observabilityMetricTimeSeries: GET_METRIC_TIME_SERIES,
+	observabilityMetricPercentiles: GET_METRIC_PERCENTILES,
+	observabilityListScores: LIST_SCORES,
+	observabilityScoreAggregate: GET_SCORE_AGGREGATE,
+	observabilityScoreBreakdown: GET_SCORE_BREAKDOWN,
+	observabilityScoreTimeSeries: GET_SCORE_TIME_SERIES,
+	observabilityScorePercentiles: GET_SCORE_PERCENTILES
+};
+function isMastra(value) {
+	return typeof value?.getServer === "function";
+}
+function routeTool(id) {
+	const route = OBSERVABILITY_APP_TOOL_ROUTES[id];
+	const readsQuery = OBSERVABILITY_APP_TOOLS[id].method === "GET";
+	return createTool({
+		id,
+		description: route.openapi?.summary ?? `${route.method} ${route.path}`,
+		inputSchema: readsQuery ? routeQuerySchema : route.bodySchema,
+		outputSchema: routeResponseSchema,
+		mcp: { _meta: { ui: { visibility: ["app"] } } },
+		execute: async (input, { mastra, requestContext, abortSignal }) => {
+			if (!isMastra(mastra)) return {
+				status: 503,
+				body: { error: `${id} needs a Mastra instance.` }
+			};
+			return invokeRoute(route, {
+				mastra,
+				requestContext: requestContext ?? new RequestContext(),
+				...readsQuery ? { query: routeQuerySchema.parse(input) } : { body: input },
+				abortSignal
+			});
+		}
+	});
+}
+/**
+* The app-only tools apps from this package read observability data through. Register them on
+* the MCP server that serves the apps. Each runs its Mastra route in-process as the caller, with
+* the route's own input validation, authentication, RBAC permission and FGA checks, so an app
+* sees exactly the data the signed-in user can read over HTTP.
+*/
+const observabilityAppTools = Object.fromEntries(Object.keys(OBSERVABILITY_APP_TOOLS).map((id) => [id, routeTool(id)]));
+export { OBSERVABILITY_APP_TOOLS, OBSERVABILITY_APP_TOOL_ROUTES, observabilityAppTools };
+
+//# sourceMappingURL=observability-tools.js.map

package/dist/observability-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"observability-tools.js","names":[],"sources":["../src/observability-protocol.ts","../src/observability-tools.ts"],"sourcesContent":["import { z } from 'zod';\n\n/**\n * The app-only tools apps read observability data through, with the server route each one runs.\n * Apps run in a sandboxed iframe that hosts may forbid from reaching the server, so their requests\n * travel as calls to these tools over the host's existing MCP connection instead.\n */\nexport const OBSERVABILITY_APP_TOOLS = {\n  observabilityAggregateTraces: { method: 'POST', path: '/observability/traces/aggregate' },\n  observabilityAggregateSpans: { method: 'POST', path: '/observability/spans/aggregate' },\n  observabilityMetricAggregate: { method: 'POST', path: '/observability/metrics/aggregate' },\n  observabilityMetricBreakdown: { method: 'POST', path: '/observability/metrics/breakdown' },\n  observabilityMetricTimeSeries: { method: 'POST', path: '/observability/metrics/timeseries' },\n  observabilityMetricPercentiles: { method: 'POST', path: '/observability/metrics/percentiles' },\n  observabilityListScores: { method: 'GET', path: '/observability/scores' },\n  observabilityScoreAggregate: { method: 'POST', path: '/observability/scores/aggregate' },\n  observabilityScoreBreakdown: { method: 'POST', path: '/observability/scores/breakdown' },\n  observabilityScoreTimeSeries: { method: 'POST', path: '/observability/scores/timeseries' },\n  observabilityScorePercentiles: { method: 'POST', path: '/observability/scores/percentiles' },\n} as const satisfies Record<string, { method: 'GET' | 'POST'; path: string }>;\n\nexport type ObservabilityAppToolName = keyof typeof OBSERVABILITY_APP_TOOLS;\n\n/** A GET route's query string, one entry per key; repeated keys become arrays. */\nexport const routeQuerySchema = z.record(z.string(), z.union([z.string(), z.array(z.string())]));\n\n/** What each tool answers: the route's own status and body, as it would over HTTP. */\nexport const routeResponseSchema = z.object({\n  status: z.number().int(),\n  body: z.unknown(),\n});\n\nexport type RouteResponse = z.output<typeof routeResponseSchema>;\n","import type { Mastra } from '@mastra/core/mastra';\nimport { RequestContext } from '@mastra/core/request-context';\nimport { createTool } from '@mastra/core/tools';\nimport {\n  AGGREGATE_SPANS,\n  AGGREGATE_TRACES,\n  GET_METRIC_AGGREGATE,\n  GET_METRIC_BREAKDOWN,\n  GET_METRIC_PERCENTILES,\n  GET_METRIC_TIME_SERIES,\n  GET_SCORE_AGGREGATE,\n  GET_SCORE_BREAKDOWN,\n  GET_SCORE_PERCENTILES,\n  GET_SCORE_TIME_SERIES,\n  LIST_SCORES,\n} from '@mastra/server/handlers/observability';\nimport { invokeRoute } from '@mastra/server/server-adapter';\nimport type { ServerRoute } from '@mastra/server/server-adapter';\nimport { OBSERVABILITY_APP_TOOLS, routeQuerySchema, routeResponseSchema } from './observability-protocol';\nimport type { ObservabilityAppToolName, RouteResponse } from './observability-protocol';\n\nexport { OBSERVABILITY_APP_TOOLS } from './observability-protocol';\nexport type { ObservabilityAppToolName, RouteResponse } from './observability-protocol';\n\n/** The server route behind each tool. */\nexport const OBSERVABILITY_APP_TOOL_ROUTES: Record<ObservabilityAppToolName, ServerRoute> = {\n  observabilityAggregateTraces: AGGREGATE_TRACES,\n  observabilityAggregateSpans: AGGREGATE_SPANS,\n  observabilityMetricAggregate: GET_METRIC_AGGREGATE,\n  observabilityMetricBreakdown: GET_METRIC_BREAKDOWN,\n  observabilityMetricTimeSeries: GET_METRIC_TIME_SERIES,\n  observabilityMetricPercentiles: GET_METRIC_PERCENTILES,\n  observabilityListScores: LIST_SCORES,\n  observabilityScoreAggregate: GET_SCORE_AGGREGATE,\n  observabilityScoreBreakdown: GET_SCORE_BREAKDOWN,\n  observabilityScoreTimeSeries: GET_SCORE_TIME_SERIES,\n  observabilityScorePercentiles: GET_SCORE_PERCENTILES,\n};\n\n// Structural, not `instanceof`: a second installed copy of @mastra/core has its own Mastra class.\nfunction isMastra(value: unknown): value is Mastra {\n  return typeof (value as Partial<Mastra> | undefined)?.getServer === 'function';\n}\n\nfunction routeTool(id: ObservabilityAppToolName) {\n  const route = OBSERVABILITY_APP_TOOL_ROUTES[id];\n  const readsQuery = OBSERVABILITY_APP_TOOLS[id].method === 'GET';\n\n  return createTool({\n    id,\n    description: route.openapi?.summary ?? `${route.method} ${route.path}`,\n    inputSchema: readsQuery ? routeQuerySchema : route.bodySchema,\n    outputSchema: routeResponseSchema,\n    // Apps call it; hosts keep it away from the model.\n    mcp: { _meta: { ui: { visibility: ['app'] } } },\n    execute: async (input, { mastra, requestContext, abortSignal }): Promise<RouteResponse> => {\n      if (!isMastra(mastra)) return { status: 503, body: { error: `${id} needs a Mastra instance.` } };\n      return invokeRoute(route, {\n        mastra,\n        // Without the caller's context, a server with auth refuses the call.\n        requestContext: requestContext ?? new RequestContext(),\n        ...(readsQuery ? { query: routeQuerySchema.parse(input) } : { body: input }),\n        abortSignal,\n      });\n    },\n  });\n}\n\n/**\n * The app-only tools apps from this package read observability data through. Register them on\n * the MCP server that serves the apps. Each runs its Mastra route in-process as the caller, with\n * the route's own input validation, authentication, RBAC permission and FGA checks, so an app\n * sees exactly the data the signed-in user can read over HTTP.\n */\nexport const observabilityAppTools = Object.fromEntries(\n  (Object.keys(OBSERVABILITY_APP_TOOLS) as ObservabilityAppToolName[]).map(id => [id, routeTool(id)]),\n) as Record<ObservabilityAppToolName, ReturnType<typeof routeTool>>;\n"],"mappings":";;;;;;;;;;;AAOA,MAAa,0BAA0B;CACrC,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACxF,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAiC;CACtF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,+BAA+B;EAAE,QAAQ;EAAQ,MAAM;CAAoC;CAC3F,gCAAgC;EAAE,QAAQ;EAAQ,MAAM;CAAqC;CAC7F,yBAAyB;EAAE,QAAQ;EAAO,MAAM;CAAwB;CACxE,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACvF,6BAA6B;EAAE,QAAQ;EAAQ,MAAM;CAAkC;CACvF,8BAA8B;EAAE,QAAQ;EAAQ,MAAM;CAAmC;CACzF,+BAA+B;EAAE,QAAQ;EAAQ,MAAM;CAAoC;AAC7F;;AAKA,MAAa,mBAAmB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;;AAG/F,MAAa,sBAAsB,EAAE,OAAO;CAC1C,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI;CACvB,MAAM,EAAE,QAAQ;AAClB,CAAC;;;ACLD,MAAa,gCAA+E;CAC1F,8BAA8B;CAC9B,6BAA6B;CAC7B,8BAA8B;CAC9B,8BAA8B;CAC9B,+BAA+B;CAC/B,gCAAgC;CAChC,yBAAyB;CACzB,6BAA6B;CAC7B,6BAA6B;CAC7B,8BAA8B;CAC9B,+BAA+B;AACjC;AAGA,SAAS,SAAS,OAAiC;CACjD,OAAO,OAAQ,OAAuC,cAAc;AACtE;AAEA,SAAS,UAAU,IAA8B;CAC/C,MAAM,QAAQ,8BAA8B;CAC5C,MAAM,aAAa,wBAAwB,GAAG,CAAC,WAAW;CAE1D,OAAO,WAAW;EAChB;EACA,aAAa,MAAM,SAAS,WAAW,GAAG,MAAM,OAAO,GAAG,MAAM;EAChE,aAAa,aAAa,mBAAmB,MAAM;EACnD,cAAc;EAEd,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE;EAC9C,SAAS,OAAO,OAAO,EAAE,QAAQ,gBAAgB,kBAA0C;GACzF,IAAI,CAAC,SAAS,MAAM,GAAG,OAAO;IAAE,QAAQ;IAAK,MAAM,EAAE,OAAO,GAAG,GAAG,2BAA2B;GAAE;GAC/F,OAAO,YAAY,OAAO;IACxB;IAEA,gBAAgB,kBAAkB,IAAI,eAAe;IACrD,GAAI,aAAa,EAAE,OAAO,iBAAiB,MAAM,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM;IAC1E;GACF,CAAC;EACH;CACF,CAAC;AACH;;;;;;;AAQA,MAAa,wBAAwB,OAAO,YACzC,OAAO,KAAK,uBAAuB,CAAC,CAAgC,KAAI,OAAM,CAAC,IAAI,UAAU,EAAE,CAAC,CAAC,CACpG"}

package/dist/types.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Structurally an `AppResource` from `@mastra/mcp`, so it drops into `MCPServer`'s `appResources`.
+ */
+export type McpAppResource = {
+    name: string;
+    description: string;
+    html: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC"}

package/package.json

@@ -1,11 +1,94 @@
 {
   "name": "@mastra/mcp-apps-components",
-  "version": "0.0.0",
-  "description": "Empty placeholder reserving @mastra/mcp-apps-components on npm. Until its first stable release, install @mastra/mcp-apps-components@alpha.",
+  "version": "0.1.0-alpha.0",
+  "description": "Prebuilt MCP Apps that render Mastra UI components, ready to register as MCP server app resources",
   "license": "Apache-2.0",
+  "type": "module",
+  "exports": {
+    "./dashboard-renderer": {
+      "import": {
+        "types": "./dist/dashboard-renderer.d.ts",
+        "default": "./dist/dashboard-renderer.js"
+      },
+      "require": {
+        "types": "./dist/dashboard-renderer.d.ts",
+        "default": "./dist/dashboard-renderer.cjs"
+      }
+    },
+    "./observability-tools": {
+      "import": {
+        "types": "./dist/observability-tools.d.ts",
+        "default": "./dist/observability-tools.js"
+      },
+      "require": {
+        "types": "./dist/observability-tools.d.ts",
+        "default": "./dist/observability-tools.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "homepage": "https://mastra.ai",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/mastra-ai/mastra.git",
     "directory": "packages/mcp-apps-components"
+  },
+  "bugs": {
+    "url": "https://github.com/mastra-ai/mastra/issues"
+  },
+  "peerDependencies": {
+    "@mastra/core": ">=1.81.0-0 <2.0.0-0",
+    "@mastra/mcp": ">=2.9.0-0 <3.0.0-0",
+    "@mastra/server": ">=1.83.0-0 <2.0.0-0",
+    "zod": "^4.2.0"
+  },
+  "devDependencies": {
+    "@hono/node-server": "^2.1.3",
+    "@modelcontextprotocol/client": "2.4.0",
+    "@modelcontextprotocol/core": "2.4.0",
+    "@modelcontextprotocol/ext-apps": "^2.0.3",
+    "@modelcontextprotocol/server": "2.4.0",
+    "@tailwindcss/vite": "4.3.3",
+    "@tanstack/react-query": "^5.104.5",
+    "@testing-library/react": "^16.3.3",
+    "@types/node": "22.19.15",
+    "@types/react": "^19.3.0",
+    "@types/react-dom": "^19.3.0",
+    "@vitejs/plugin-react": "^6.1.2",
+    "hono": "^4.13.13",
+    "jsdom": "^30.1.3",
+    "msw": "^2.15.0",
+    "react": "^19.3.1",
+    "react-dom": "^19.3.1",
+    "tailwindcss": "4.3.3",
+    "tsdown": "0.23.1",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vite": "^8.3.5",
+    "vite-plugin-singlefile": "^2.3.4",
+    "vitest": "5.1.0",
+    "zod": "^4.6.7",
+    "@internal/lint": "0.0.148",
+    "@mastra/client-js": "1.60.0-alpha.0",
+    "@mastra/core": "1.83.0-alpha.0",
+    "@mastra/hono": "1.7.25-alpha.0",
+    "@internal/types-builder": "0.0.123",
+    "@mastra/playground-ui": "69.0.0-alpha.0",
+    "@mastra/react": "1.15.0-alpha.0",
+    "@mastra/mcp": "2.9.0-alpha.0",
+    "@mastra/server": "1.83.0-alpha.0"
+  },
+  "engines": {
+    "node": ">=22.13.0"
+  },
+  "scripts": {
+    "build": "tsx scripts/build-apps.ts && tsdown --silent --config tsdown.config.ts",
+    "test": "vitest run --project 'unit:packages/mcp-apps-components'",
+    "typecheck": "tsc --noEmit",
+    "lint": "oxlint --type-aware .",
+    "lint:fix": "oxlint --type-aware --fix ."
   }
-}
+}