@mcp-native/core 0.0.2 → 0.1.0

package/README.md

@@ -1,3 +1,139 @@
+<div align="center">
+
 # @mcp-native/core
 
-Protocol-independent runtime contracts and action routing for MCP Native.
+### Transport-neutral MCP runtime contracts and safe action routing
+
+[![npm](https://img.shields.io/npm/v/@mcp-native/core)](https://www.npmjs.com/package/@mcp-native/core)
+[![downloads](https://img.shields.io/npm/dm/@mcp-native/core)](https://www.npmjs.com/package/@mcp-native/core)
+[![license](https://img.shields.io/npm/l/@mcp-native/core)](https://github.com/pablospaniard/mcp-native/blob/main/LICENSE)
+
+[GitHub](https://github.com/pablospaniard/mcp-native) · [Architecture](https://github.com/pablospaniard/mcp-native/blob/main/docs/RFC-0001-architecture.md) · [Standards status](https://github.com/pablospaniard/mcp-native/blob/main/docs/standards-compatibility.md) · [Security](https://github.com/pablospaniard/mcp-native/blob/main/SECURITY.md)
+
+</div>
+
+> **Experimental:** this package is an early proof of concept. Its public API may change before `1.0.0`.
+
+`@mcp-native/core` is the protocol- and renderer-independent foundation of MCP Native. It defines the small MCP client boundary consumed by the runtime and routes declared actions without depending on A2UI, React Native, WebViews, or a specific MCP SDK transport.
+
+## Install
+
+```bash
+npm install @mcp-native/core
+```
+
+The package is ESM-only and includes TypeScript declarations.
+
+## Quick start
+
+Adapt any MCP client to the `McpClient` interface, then use `McpNativeRuntime` to coordinate operations:
+
+```ts
+import { McpNativeRuntime, createAllowlistActionPolicy, type McpClient } from "@mcp-native/core";
+
+const client: McpClient = {
+  async listTools() {
+    return {
+      tools: [
+        {
+          name: "save_profile",
+          description: "Save profile details",
+          inputSchema: { type: "object" },
+        },
+      ],
+    };
+  },
+  async callTool(name, arguments_) {
+    return {
+      content: [{ type: "text", text: `Called ${name}` }],
+      structuredContent: { name, arguments: arguments_ },
+    };
+  },
+  async readResource(uri) {
+    return {
+      contents: [{ uri, mimeType: "text/plain", text: "Hello from MCP" }],
+    };
+  },
+};
+
+const runtime = new McpNativeRuntime(client, {
+  actionPolicy: createAllowlistActionPolicy([
+    { name: "save_profile", arguments: { displayName: "Ada" } },
+  ]),
+});
+
+await runtime.dispatch({
+  type: "tool",
+  name: "save_profile",
+  arguments: { displayName: "Ada" },
+});
+```
+
+## Public API
+
+| Export                                                                                       | Purpose                                                                                     |
+| -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- |
+| `McpNativeRuntime`                                                                           | Delegates tool listing, tool calls, resource reads, and declared actions to an `McpClient`. |
+| `McpClient`                                                                                  | Minimal interface implemented by an SDK- or transport-specific adapter.                     |
+| `McpTool`, `McpListToolsResult`, `McpResource`, `McpReadResourceResult`, `McpToolCallResult` | Transport-neutral MCP data contracts used by the runtime.                                   |
+| `McpContent` and its discriminated content interfaces                                        | Exact text, image, audio, resource-link, and embedded-resource shapes.                      |
+| `McpAnnotations`, `McpToolAnnotations`, `McpIcon`, `McpCacheScope`                           | Official metadata, presentation hints, and response-cache contracts.                        |
+| `ToolAction`, `McpNativeAction`                                                              | Declarative actions that can be dispatched through the runtime.                             |
+| `McpNativeRuntimeOptions`, `McpNativeActionPolicy`                                           | Host policy controlling which validated surface actions `dispatch()` may execute.           |
+| `createAllowlistActionPolicy`, `McpNativeToolAllowlistEntry`                                 | Fail-closed helper that authorizes tools by name and exact or predicated arguments.         |
+| `McpNativeActionDeniedError`                                                                 | Fail-closed error for actions not explicitly allowed by the host.                           |
+| `parseMcpNativeAction`, `parseJsonObject`, `parseJsonValue`                                  | Strict validators that return safely reconstructed untrusted data.                          |
+| `JSON_MAX_DEPTH`, `JSON_MAX_VALUES`, `JSON_MAX_STRING_LENGTH`                                | Fixed complexity limits applied by the public JSON validators.                              |
+| `JsonValidationError`                                                                        | Error for non-JSON, circular, non-plain, or non-finite input.                               |
+| `JsonPrimitive`, `JsonValue`, `JsonObject`                                                   | JSON-safe value types for untrusted protocol data.                                          |
+
+## Pre-1.0 MCP result migration
+
+The initial `0.0.x` proof of concept returned one `McpResource` directly from `readResource`. The official SDK returns a content collection, so implementations now return `McpReadResourceResult`:
+
+```ts
+// Before
+return { uri, text: "Hello" };
+
+// Current RFC-0001 contract
+return { contents: [{ uri, text: "Hello" }] };
+```
+
+Preserving the collection avoids silently discarding valid resource items.
+
+Tool listings likewise preserve result metadata and cache hints, so `listTools()` now returns an object:
+
+```ts
+// Before
+return [{ name: "save", inputSchema: { type: "object" } }];
+
+// Current RFC-0001 contract
+return { tools: [{ name: "save", inputSchema: { type: "object" } }] };
+```
+
+Content blocks now use MCP's official discriminated fields. Replace `{ type: "text", data: { text } }` with `{ type: "text", text }`; resource links similarly expose `name`, `uri`, and `mimeType` directly.
+
+## Design boundaries
+
+- No React Native dependency.
+- No A2UI or WebView dependency.
+- No transport or official MCP SDK dependency.
+- No remote code loading or execution.
+- Surface-driven `dispatch()` is denied unless the host's action policy explicitly allows it.
+- Direct `callTool()` is a lower-level API for trusted host code. It validates JSON arguments but does not apply the surface action policy.
+- Prefer `createAllowlistActionPolicy()` so surface authorization covers tool arguments, not only tool names.
+- Untrusted JSON is reconstructed without prototype mutation and rejects cycles, non-plain objects, non-finite numbers, excessive depth, excessive value counts, and oversized strings or object keys.
+- Declared actions reject fields outside the exact `{ type, name, arguments? }` contract.
+- Host applications remain responsible for authentication, permissions, transport security, and user approval.
+
+## Related packages
+
+- [`@mcp-native/a2ui`](https://www.npmjs.com/package/@mcp-native/a2ui) validates declarative surfaces and actions.
+- [`@mcp-native/mcp`](https://github.com/pablospaniard/mcp-native/tree/main/packages/mcp) adapts connected official SDK clients to this package's contracts.
+- [`@mcp-native/react-native`](https://www.npmjs.com/package/@mcp-native/react-native) converts validated surfaces into trusted native render plans.
+- [`@mcp-native/webview`](https://www.npmjs.com/package/@mcp-native/webview) defines the HTML compatibility policy boundary.
+- [`mcp-native`](https://www.npmjs.com/package/mcp-native) re-exports the runtime and UI APIs.
+
+## License
+
+[MIT](https://github.com/pablospaniard/mcp-native/blob/main/LICENSE)

package/dist/index.d.ts

@@ -3,33 +3,135 @@ export type JsonValue = JsonPrimitive | JsonObject | readonly JsonValue[];
 export interface JsonObject {
     readonly [key: string]: JsonValue;
 }
+/** Maximum nesting depth accepted by the public JSON validators (root is depth 0). */
+export declare const JSON_MAX_DEPTH = 64;
+/** Maximum number of values accepted in one JSON graph. */
+export declare const JSON_MAX_VALUES = 10000;
+/** Maximum UTF-16 code units accepted in one JSON string. */
+export declare const JSON_MAX_STRING_LENGTH = 65536;
+/** Thrown when an untrusted value cannot be represented as JSON data. */
+export declare class JsonValidationError extends TypeError {
+    constructor(message: string);
+}
+/**
+ * Validates and safely reconstructs an untrusted JSON object.
+ *
+ * The returned object keeps keys such as `__proto__` as ordinary own data
+ * properties instead of invoking legacy prototype setters.
+ */
+export declare function parseJsonObject(value: unknown, path?: string): JsonObject;
+/** Validates and safely reconstructs an untrusted JSON value. */
+export declare function parseJsonValue(value: unknown, path?: string): JsonValue;
+export type McpRole = "assistant" | "user";
+export interface McpAnnotations {
+    readonly audience?: readonly McpRole[];
+    readonly priority?: number;
+    readonly lastModified?: string;
+}
+export interface McpIcon {
+    readonly src: string;
+    readonly mimeType?: string;
+    readonly sizes?: readonly string[];
+    readonly theme?: "dark" | "light";
+}
+export interface McpToolAnnotations {
+    readonly title?: string;
+    readonly readOnlyHint?: boolean;
+    readonly destructiveHint?: boolean;
+    readonly idempotentHint?: boolean;
+    readonly openWorldHint?: boolean;
+}
 export interface McpTool {
+    readonly icons?: readonly McpIcon[];
     readonly name: string;
+    readonly title?: string;
     readonly description?: string;
     readonly inputSchema: JsonObject;
+    readonly outputSchema?: JsonObject;
+    readonly annotations?: McpToolAnnotations;
+    readonly _meta?: JsonObject;
+}
+export interface McpTextContent {
+    readonly type: "text";
+    readonly text: string;
+    readonly annotations?: McpAnnotations;
+    readonly _meta?: JsonObject;
+}
+export interface McpImageContent {
+    readonly type: "image";
+    readonly data: string;
+    readonly mimeType: string;
+    readonly annotations?: McpAnnotations;
+    readonly _meta?: JsonObject;
+}
+export interface McpAudioContent {
+    readonly type: "audio";
+    readonly data: string;
+    readonly mimeType: string;
+    readonly annotations?: McpAnnotations;
+    readonly _meta?: JsonObject;
+}
+export interface McpResourceLink {
+    readonly type: "resource_link";
+    readonly icons?: readonly McpIcon[];
+    readonly name: string;
+    readonly title?: string;
+    readonly uri: string;
+    readonly description?: string;
+    readonly mimeType?: string;
+    readonly annotations?: McpAnnotations;
+    readonly size?: number;
+    readonly _meta?: JsonObject;
 }
-export interface McpContent {
-    readonly type: string;
-    readonly data: JsonObject;
+interface McpResourceContentsBase {
+    readonly uri: string;
+    readonly mimeType?: string;
+    readonly _meta?: JsonObject;
+}
+export interface McpTextResourceContents extends McpResourceContentsBase {
+    readonly text: string;
+    readonly blob?: never;
+}
+export interface McpBlobResourceContents extends McpResourceContentsBase {
+    readonly blob: string;
+    readonly text?: never;
 }
+export type McpResource = McpTextResourceContents | McpBlobResourceContents;
+export interface McpEmbeddedResource {
+    readonly type: "resource";
+    readonly resource: McpResource;
+    readonly annotations?: McpAnnotations;
+    readonly _meta?: JsonObject;
+}
+export type McpContent = McpAudioContent | McpEmbeddedResource | McpImageContent | McpResourceLink | McpTextContent;
 export interface McpToolCallResult {
     readonly content: readonly McpContent[];
     readonly isError?: boolean;
+    readonly structuredContent?: JsonValue;
+    readonly _meta?: JsonObject;
 }
-export interface McpResource {
-    readonly uri: string;
-    readonly mimeType?: string;
-    readonly text?: string;
-    readonly blob?: string;
+export type McpCacheScope = "private" | "public";
+export interface McpListToolsResult {
+    readonly tools: readonly McpTool[];
+    readonly nextCursor?: string;
+    readonly ttlMs?: number;
+    readonly cacheScope?: McpCacheScope;
+    readonly _meta?: JsonObject;
+}
+export interface McpReadResourceResult {
+    readonly contents: readonly McpResource[];
+    readonly ttlMs?: number;
+    readonly cacheScope?: McpCacheScope;
+    readonly _meta?: JsonObject;
 }
 /**
  * The small client boundary consumed by the runtime. SDK-specific clients can
  * implement this interface without coupling the core package to a transport.
  */
 export interface McpClient {
-    listTools(): Promise<readonly McpTool[]>;
+    listTools(): Promise<McpListToolsResult>;
     callTool(name: string, arguments_: JsonObject): Promise<McpToolCallResult>;
-    readResource(uri: string): Promise<McpResource>;
+    readResource(uri: string): Promise<McpReadResourceResult>;
 }
 export interface ToolAction {
     readonly type: "tool";
@@ -37,6 +139,42 @@ export interface ToolAction {
     readonly arguments?: JsonObject;
 }
 export type McpNativeAction = ToolAction;
+/** Validates and safely reconstructs a surface-declared native action. */
+export declare function parseMcpNativeAction(value: unknown, path?: string): McpNativeAction;
+/** A host-owned policy deciding which validated tool actions may execute. */
+export type McpNativeActionPolicy = (action: McpNativeAction) => boolean | Promise<boolean>;
+/**
+ * An allowlist entry that authorizes a tool by name and either exact arguments
+ * or a host-provided argument predicate. Name-only allowlists are intentionally
+ * unsupported — omit `arguments` to require empty/missing arguments, or supply
+ * `authorizeArguments` for dynamic checks.
+ *
+ * `authorizeArguments` may be sync or async, but must resolve to a boolean.
+ * Only an explicit `true` authorizes; thenables are awaited so a denied async
+ * predicate cannot be treated as a truthy Promise object.
+ */
+export type McpNativeToolAllowlistEntry = {
+    readonly name: string;
+    /** Exact JSON arguments required. Omit to allow only empty/missing arguments. */
+    readonly arguments?: JsonObject;
+} | {
+    readonly name: string;
+    readonly authorizeArguments: (arguments_?: JsonObject) => boolean | Promise<boolean>;
+};
+/** Builds a fail-closed action policy from an explicit tool/argument allowlist. */
+export declare function createAllowlistActionPolicy(allowlist: readonly McpNativeToolAllowlistEntry[]): McpNativeActionPolicy;
+export interface McpNativeRuntimeOptions {
+    /**
+     * Authorizes surface-driven actions through `dispatch()` only. When omitted,
+     * `dispatch()` denies every action. Trusted host code can continue to use
+     * `callTool()` directly after JSON argument validation.
+     */
+    readonly actionPolicy?: McpNativeActionPolicy;
+}
+export declare class McpNativeActionDeniedError extends Error {
+    readonly toolName: string;
+    constructor(toolName: string);
+}
 /**
  * Coordinates MCP operations without knowing about A2UI, React Native, or any
  * other renderer. It deliberately routes declared actions instead of loading
@@ -44,10 +182,11 @@ export type McpNativeAction = ToolAction;
  */
 export declare class McpNativeRuntime {
     #private;
-    constructor(client: McpClient);
-    listTools(): Promise<readonly McpTool[]>;
+    constructor(client: McpClient, options?: McpNativeRuntimeOptions);
+    listTools(): Promise<McpListToolsResult>;
     callTool(name: string, arguments_?: JsonObject): Promise<McpToolCallResult>;
-    readResource(uri: string): Promise<McpResource>;
+    readResource(uri: string): Promise<McpReadResourceResult>;
     dispatch(action: McpNativeAction): Promise<McpToolCallResult>;
 }
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,SAAS,EAAE,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;CAClC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,IAAI,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC;AAEzC;;;;GAIG;AACH,qBAAa,gBAAgB;;IAG3B,YAAY,MAAM,EAAE,SAAS,EAE5B;IAED,SAAS,IAAI,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAEvC;IAED,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,UAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE9E;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAE9C;IAED,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAE5D;CACF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAE7D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,SAAS,EAAE,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,sFAAsF;AACtF,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,2DAA2D;AAC3D,eAAO,MAAM,eAAe,QAAS,CAAC;AACtC,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAE7C,yEAAyE;AACzE,qBAAa,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAU,GAAG,UAAU,CAE1E;AAED,iEAAiE;AACjE,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAU,GAAG,SAAS,CAExE;AAED,MAAM,MAAM,OAAO,GAAG,WAAW,GAAG,MAAM,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC;IACjC,QAAQ,CAAC,YAAY,CAAC,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,kBAAkB,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,UAAU,uBAAuB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,WAAW,uBAAwB,SAAQ,uBAAuB;IACtE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;CACvB;AAED,MAAM,MAAM,WAAW,GAAG,uBAAuB,GAAG,uBAAuB,CAAC;AAE5E,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;IAC/B,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,MAAM,UAAU,GAClB,eAAe,GACf,mBAAmB,GACnB,eAAe,GACf,eAAe,GACf,cAAc,CAAC;AAEnB,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,UAAU,EAAE,CAAC;IACxC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,SAAS,OAAO,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAC3E,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3D;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC;AAEzC,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,SAAW,GAAG,eAAe,CAyBrF;AAED,6EAA6E;AAC7E,MAAM,MAAM,qBAAqB,GAAG,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AAE5F;;;;;;;;;GASG;AACH,MAAM,MAAM,2BAA2B,GACnC;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,kBAAkB,EAAE,CAAC,UAAU,CAAC,EAAE,UAAU,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtF,CAAC;AAEN,mFAAmF;AACnF,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,SAAS,2BAA2B,EAAE,GAChD,qBAAqB,CA+CvB;AAED,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAED,qBAAa,0BAA2B,SAAQ,KAAK;IACnD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,YAAY,QAAQ,EAAE,MAAM,EAI3B;CACF;AAED;;;;GAIG;AACH,qBAAa,gBAAgB;;IAI3B,YAAY,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,uBAA4B,EAGnE;IAED,SAAS,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAEvC;IAEK,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,GAAE,UAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAOpF;IAED,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAExD;IAEK,QAAQ,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAUlE;CACF"}

package/dist/index.js

@@ -1,3 +1,104 @@
+/** Maximum nesting depth accepted by the public JSON validators (root is depth 0). */
+export const JSON_MAX_DEPTH = 64;
+/** Maximum number of values accepted in one JSON graph. */
+export const JSON_MAX_VALUES = 10_000;
+/** Maximum UTF-16 code units accepted in one JSON string. */
+export const JSON_MAX_STRING_LENGTH = 65_536;
+/** Thrown when an untrusted value cannot be represented as JSON data. */
+export class JsonValidationError extends TypeError {
+    constructor(message) {
+        super(message);
+        this.name = "JsonValidationError";
+    }
+}
+/**
+ * Validates and safely reconstructs an untrusted JSON object.
+ *
+ * The returned object keeps keys such as `__proto__` as ordinary own data
+ * properties instead of invoking legacy prototype setters.
+ */
+export function parseJsonObject(value, path = "value") {
+    return parseJsonObjectWithState(value, path, createJsonValidationState(), 0);
+}
+/** Validates and safely reconstructs an untrusted JSON value. */
+export function parseJsonValue(value, path = "value") {
+    return parseJsonValueWithState(value, path, createJsonValidationState(), 0);
+}
+/** Validates and safely reconstructs a surface-declared native action. */
+export function parseMcpNativeAction(value, path = "action") {
+    const action = expectPlainObject(value, path);
+    expectOnlyKeys(action, ["arguments", "name", "type"], path);
+    if (action.type !== "tool") {
+        throw new JsonValidationError(`Expected the string "tool" at ${path}.type`);
+    }
+    if (typeof action.name !== "string") {
+        throw new JsonValidationError(`Expected a string at ${path}.name`);
+    }
+    if (action.name.length === 0) {
+        throw new JsonValidationError(`Expected a non-empty string at ${path}.name`);
+    }
+    if (action.name.length > JSON_MAX_STRING_LENGTH) {
+        throw new JsonValidationError(`String at ${path}.name exceeds maximum length of ${JSON_MAX_STRING_LENGTH}`);
+    }
+    return {
+        type: "tool",
+        name: action.name,
+        ...(action.arguments === undefined
+            ? {}
+            : { arguments: parseJsonObject(action.arguments, `${path}.arguments`) }),
+    };
+}
+/** Builds a fail-closed action policy from an explicit tool/argument allowlist. */
+export function createAllowlistActionPolicy(allowlist) {
+    const entries = allowlist.map((entry) => {
+        if (typeof entry.name !== "string" || entry.name.length === 0) {
+            throw new JsonValidationError("Expected a non-empty allowlist tool name");
+        }
+        if ("authorizeArguments" in entry) {
+            if (typeof entry.authorizeArguments !== "function") {
+                throw new JsonValidationError(`Expected authorizeArguments to be a function for tool ${entry.name}`);
+            }
+            return entry;
+        }
+        return {
+            name: entry.name,
+            arguments: entry.arguments === undefined
+                ? undefined
+                : parseJsonObject(entry.arguments, `allowlist.${entry.name}.arguments`),
+        };
+    });
+    return async (action) => {
+        for (const entry of entries) {
+            if (entry.name !== action.name) {
+                continue;
+            }
+            if ("authorizeArguments" in entry) {
+                // Predicates must run sequentially so a denied match does not race later entries.
+                // eslint-disable-next-line no-await-in-loop -- intentional fail-closed short-circuit
+                const allowed = await entry.authorizeArguments(action.arguments);
+                if (allowed === true) {
+                    return true;
+                }
+                if (allowed !== false) {
+                    throw new JsonValidationError(`authorizeArguments for tool ${entry.name} must return a boolean`);
+                }
+                continue;
+            }
+            if (jsonArgumentsMatch(entry.arguments, action.arguments)) {
+                return true;
+            }
+        }
+        return false;
+    };
+}
+export class McpNativeActionDeniedError extends Error {
+    toolName;
+    constructor(toolName) {
+        super(`MCP native action denied by host policy: ${toolName}`);
+        this.name = "McpNativeActionDeniedError";
+        this.toolName = toolName;
+    }
+}
 /**
  * Coordinates MCP operations without knowing about A2UI, React Native, or any
  * other renderer. It deliberately routes declared actions instead of loading
@@ -5,20 +106,164 @@
  */
 export class McpNativeRuntime {
     #client;
-    constructor(client) {
+    #actionPolicy;
+    constructor(client, options = {}) {
         this.#client = client;
+        this.#actionPolicy = options.actionPolicy;
     }
     listTools() {
         return this.#client.listTools();
     }
-    callTool(name, arguments_ = {}) {
-        return this.#client.callTool(name, arguments_);
+    async callTool(name, arguments_ = {}) {
+        const validatedAction = parseMcpNativeAction({
+            type: "tool",
+            name,
+            arguments: arguments_,
+        });
+        return this.#client.callTool(validatedAction.name, validatedAction.arguments ?? {});
     }
     readResource(uri) {
         return this.#client.readResource(uri);
     }
-    dispatch(action) {
-        return this.callTool(action.name, action.arguments ?? {});
+    async dispatch(action) {
+        const validatedAction = parseMcpNativeAction(action);
+        if (this.#actionPolicy === undefined) {
+            throw new McpNativeActionDeniedError(validatedAction.name);
+        }
+        const allowed = await this.#actionPolicy(validatedAction);
+        if (allowed !== true) {
+            throw new McpNativeActionDeniedError(validatedAction.name);
+        }
+        return this.#client.callTool(validatedAction.name, validatedAction.arguments ?? {});
+    }
+}
+function jsonArgumentsMatch(expected, actual) {
+    if (expected === undefined) {
+        return actual === undefined || Object.keys(actual).length === 0;
+    }
+    if (actual === undefined) {
+        return Object.keys(expected).length === 0;
+    }
+    return jsonValuesEqual(expected, actual);
+}
+function jsonValuesEqual(left, right) {
+    if (left === right) {
+        return true;
+    }
+    if (left === null || right === null || typeof left !== typeof right) {
+        return false;
+    }
+    if (typeof left !== "object" || typeof right !== "object") {
+        return false;
+    }
+    if (Array.isArray(left)) {
+        if (!Array.isArray(right) || left.length !== right.length) {
+            return false;
+        }
+        return left.every((value, index) => jsonValuesEqual(value, right[index]));
     }
+    if (Array.isArray(right)) {
+        return false;
+    }
+    const leftObject = left;
+    const rightObject = right;
+    const leftKeys = Object.keys(leftObject);
+    const rightKeys = Object.keys(rightObject);
+    if (leftKeys.length !== rightKeys.length) {
+        return false;
+    }
+    return leftKeys.every((key) => Object.hasOwn(rightObject, key) && jsonValuesEqual(leftObject[key], rightObject[key]));
+}
+function expectPlainObject(value, path) {
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+        throw new JsonValidationError(`Expected an object at ${path}`);
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+        throw new JsonValidationError(`Expected a plain object at ${path}`);
+    }
+    return value;
+}
+function createJsonValidationState() {
+    return { ancestors: new Set(), values: 0 };
+}
+function parseJsonObjectWithState(value, path, state, depth) {
+    consumeJsonBudget(state, path, depth);
+    const object = expectPlainObject(value, path);
+    if (state.ancestors.has(object)) {
+        throw new JsonValidationError(`Circular JSON value at ${path}`);
+    }
+    state.ancestors.add(object);
+    const result = {};
+    for (const [key, child] of Object.entries(object)) {
+        if (key.length > JSON_MAX_STRING_LENGTH) {
+            throw new JsonValidationError(`JSON object key at ${path} exceeds maximum length of ${JSON_MAX_STRING_LENGTH}`);
+        }
+        defineJsonProperty(result, key, parseJsonValueWithState(child, `${path}.${key}`, state, depth + 1));
+    }
+    state.ancestors.delete(object);
+    return result;
+}
+function parseJsonValueWithState(value, path, state, depth) {
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return parseJsonObjectWithState(value, path, state, depth);
+    }
+    consumeJsonBudget(state, path, depth);
+    if (value === null || typeof value === "boolean") {
+        return value;
+    }
+    if (typeof value === "string") {
+        if (value.length > JSON_MAX_STRING_LENGTH) {
+            throw new JsonValidationError(`String at ${path} exceeds maximum length of ${JSON_MAX_STRING_LENGTH}`);
+        }
+        return value;
+    }
+    if (typeof value === "number") {
+        if (!Number.isFinite(value)) {
+            throw new JsonValidationError(`Expected a finite number at ${path}`);
+        }
+        return value;
+    }
+    if (Array.isArray(value)) {
+        if (state.ancestors.has(value)) {
+            throw new JsonValidationError(`Circular JSON value at ${path}`);
+        }
+        state.ancestors.add(value);
+        const result = [];
+        for (let index = 0; index < value.length; index += 1) {
+            if (!Object.hasOwn(value, index)) {
+                throw new JsonValidationError(`Sparse JSON array item at ${path}[${index}]`);
+            }
+            result.push(parseJsonValueWithState(value[index], `${path}[${index}]`, state, depth + 1));
+        }
+        state.ancestors.delete(value);
+        return result;
+    }
+    throw new JsonValidationError(`Expected a JSON value at ${path}`);
+}
+function consumeJsonBudget(state, path, depth) {
+    if (depth > JSON_MAX_DEPTH) {
+        throw new JsonValidationError(`JSON value exceeds maximum depth of ${JSON_MAX_DEPTH} at ${path}`);
+    }
+    state.values += 1;
+    if (state.values > JSON_MAX_VALUES) {
+        throw new JsonValidationError(`JSON value exceeds maximum of ${JSON_MAX_VALUES} values`);
+    }
+}
+function expectOnlyKeys(object, allowedKeys, path) {
+    const allowed = new Set(allowedKeys);
+    for (const key of Object.keys(object)) {
+        if (!allowed.has(key)) {
+            throw new JsonValidationError(`Unsupported field ${JSON.stringify(key)} at ${path}`);
+        }
+    }
+}
+function defineJsonProperty(object, key, value) {
+    Object.defineProperty(object, key, {
+        value,
+        enumerable: true,
+        configurable: true,
+        writable: true,
+    });
 }
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiDA;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAY;IAE5B,YAAY,MAAiB;QAC3B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,UAAU,GAAe,EAAE;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,QAAQ,CAAC,MAAuB;QAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,2DAA2D;AAC3D,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAE7C,yEAAyE;AACzE,MAAM,OAAO,mBAAoB,SAAQ,SAAS;IAChD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,IAAI,GAAG,OAAO;IAC5D,OAAO,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,cAAc,CAAC,KAAc,EAAE,IAAI,GAAG,OAAO;IAC3D,OAAO,uBAAuB,CAAC,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAkJD,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,KAAc,EAAE,IAAI,GAAG,QAAQ;IAClE,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,cAAc,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,IAAI,OAAO,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,mBAAmB,CAAC,wBAAwB,IAAI,OAAO,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,mBAAmB,CAAC,kCAAkC,IAAI,OAAO,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;QAChD,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,mCAAmC,sBAAsB,EAAE,CAC7E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;YAChC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,YAAY,CAAC,EAAE,CAAC;KAC3E,CAAC;AACJ,CAAC;AA0BD,mFAAmF;AACnF,MAAM,UAAU,2BAA2B,CACzC,SAAiD;IAEjD,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,mBAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;YAClC,IAAI,OAAO,KAAK,CAAC,kBAAkB,KAAK,UAAU,EAAE,CAAC;gBACnD,MAAM,IAAI,mBAAmB,CAC3B,yDAAyD,KAAK,CAAC,IAAI,EAAE,CACtE,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,SAAS,EACP,KAAK,CAAC,SAAS,KAAK,SAAS;gBAC3B,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE,aAAa,KAAK,CAAC,IAAI,YAAY,CAAC;SAC5E,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,IAAI,oBAAoB,IAAI,KAAK,EAAE,CAAC;gBAClC,kFAAkF;gBAClF,qFAAqF;gBACrF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjE,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;oBACtB,MAAM,IAAI,mBAAmB,CAC3B,+BAA+B,KAAK,CAAC,IAAI,wBAAwB,CAClE,CAAC;gBACJ,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,kBAAkB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC1D,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAWD,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IAC1C,QAAQ,CAAS;IAE1B,YAAY,QAAgB;QAC1B,KAAK,CAAC,4CAA4C,QAAQ,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,gBAAgB;IAClB,OAAO,CAAY;IACnB,aAAa,CAAoC;IAE1D,YAAY,MAAiB,EAAE,OAAO,GAA4B,EAAE;QAClE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,UAAU,GAAe,EAAE;QACtD,MAAM,eAAe,GAAG,oBAAoB,CAAC;YAC3C,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,SAAS,EAAE,UAAU;SACtB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,YAAY,CAAC,GAAW;QACtB,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAuB;QACpC,MAAM,eAAe,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,0BAA0B,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,eAAe,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;CACF;AAED,SAAS,kBAAkB,CACzB,QAAgC,EAChC,MAA8B;IAE9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,eAAe,CAAC,IAAe,EAAE,KAAgB;IACxD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,OAAO,KAAK,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAE,CAAC,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,UAAU,GAAG,IAAkB,CAAC;IACtC,MAAM,WAAW,GAAG,KAAmB,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QACzC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CACnB,CAAC,GAAG,EAAE,EAAE,CACN,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,GAAG,CAAE,EAAE,WAAW,CAAC,GAAG,CAAE,CAAC,CAC1F,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc,EAAE,IAAY;IACrD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,mBAAmB,CAAC,yBAAyB,IAAI,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAY,CAAC;IAC1D,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACzD,MAAM,IAAI,mBAAmB,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAOD,SAAS,yBAAyB;IAChC,OAAO,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc,EACd,IAAY,EACZ,KAA0B,EAC1B,KAAa;IAEb,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,GAAG,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YACxC,MAAM,IAAI,mBAAmB,CAC3B,sBAAsB,IAAI,8BAA8B,sBAAsB,EAAE,CACjF,CAAC;QACJ,CAAC;QACD,kBAAkB,CAChB,MAAM,EACN,GAAG,EACH,uBAAuB,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,KAAc,EACd,IAAY,EACZ,KAA0B,EAC1B,KAAa;IAEb,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO,wBAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC7D,CAAC;IAED,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,sBAAsB,EAAE,CAAC;YAC1C,MAAM,IAAI,mBAAmB,CAC3B,aAAa,IAAI,8BAA8B,sBAAsB,EAAE,CACxE,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,mBAAmB,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,IAAI,IAAI,KAAK,GAAG,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA0B,EAAE,IAAY,EAAE,KAAa;IAChF,IAAI,KAAK,GAAG,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,cAAc,OAAO,IAAI,EAAE,CACnE,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;IAClB,IAAI,KAAK,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,eAAe,SAAS,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CACrB,MAA+B,EAC/B,WAA8B,EAC9B,IAAY;IAEZ,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiC,EACjC,GAAW,EACX,KAAgB;IAEhB,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,EAAE;QACjC,KAAK;QACL,UAAU,EAAE,IAAI;QAChB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC"}

package/package.json

@@ -1,11 +1,21 @@
 {
   "name": "@mcp-native/core",
-  "version": "0.0.2",
+  "version": "0.1.0",
   "description": "Protocol-independent runtime primitives for MCP Native.",
+  "keywords": [
+    "mcp",
+    "model-context-protocol",
+    "runtime",
+    "typescript"
+  ],
+  "homepage": "https://github.com/pablospaniard/mcp-native#readme",
+  "bugs": {
+    "url": "https://github.com/pablospaniard/mcp-native/issues"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/pablospaniard/mcp-native.git",
+    "url": "git+https://github.com/pablospaniard/mcp-native.git",
     "directory": "packages/core"
   },
   "files": [