@mcp-use/client 2.0.0-beta.15 → 2.0.0-beta.17

package/dist/react/view/types.d.ts

@@ -3,110 +3,193 @@ import type { CreateMessageRequest, CreateMessageResult, CreateMessageResultWith
 export type { McpUiDownloadFileRequest, McpUiDownloadFileResult, McpUiHostCapabilities, McpUiHostContext, McpUiResourceCsp, McpUiResourcePermissions, McpUiSupportedContentBlockModalities, };
 import type { Transport } from "@modelcontextprotocol/client";
 import type { ReactNode } from "react";
+/** Display mode requested by an MCP App. */
 export type ViewDisplayMode = "inline" | "pip" | "fullscreen";
+/** Policy used to enforce an MCP App's declared content security policy. */
 export type ViewCspMode = "permissive" | "widget-declared";
+/** Host operations and server metadata available to a live MCP App. */
 export interface ViewConnection {
+    /** Calls an MCP server tool. */
     callTool: (name: string, args?: Record<string, unknown>, options?: {
         timeout?: number;
         resetTimeoutOnProgress?: boolean;
     }) => Promise<unknown>;
+    /** Reads an MCP resource by URI. */
     readResource: (uri: string) => Promise<unknown>;
+    /** Tools available to the host, including app visibility metadata. */
     tools?: readonly {
+        /** Tool name. */
         name: string;
+        /** Optional tool metadata. */
         _meta?: {
+            /** MCP App-specific tool metadata. */
             ui?: {
+                /** Surfaces allowed to invoke or receive the tool. */
                 visibility?: readonly ("model" | "app")[];
             };
         };
     }[];
+    /** Resources available to the host. */
     resources?: readonly {
+        /** Resource URI. */
         uri: string;
+        /** Optional resource metadata. */
         _meta?: {
+            /** MCP App-specific resource metadata. */
             ui?: unknown;
         };
     }[];
 }
+/** Live or preloaded content used to initialize a {@link ViewRenderer}. */
 export type ViewRendererSource = {
+    /** Selects live resource resolution. */
     kind: "live";
+    /** MCP connection used to read the resource and call tools. */
     connection: ViewConnection;
+    /** URI of the MCP App resource to load. */
     resourceUri: string;
 } | {
+    /** Selects preloaded HTML rendering. */
     kind: "preloaded";
+    /** Complete HTML document to render. */
     html: string;
+    /** CSP declared for the preloaded document. */
     csp?: McpUiResourceCsp;
+    /** Browser permissions requested by the preloaded document. */
     permissions?: McpUiResourcePermissions;
+    /** Whether the preloaded app prefers visible host borders. */
     prefersBorder?: boolean;
 };
+/** Normalized HTML, CSP, permissions, and MIME metadata for a rendered view. */
 export type ResolvedViewResource = {
+    /** HTML document rendered in the sandbox. */
     html: string;
+    /** CSP declared by the resource before host policy is applied. */
     declaredCsp: McpUiResourceCsp | undefined;
+    /** CSP enforced by the host, if any. */
     csp: McpUiResourceCsp | undefined;
+    /** Browser permissions requested by the resource. */
     permissions: McpUiResourcePermissions | undefined;
+    /** Whether the app prefers a visible host border. */
     prefersBorder: boolean;
+    /** MIME type reported by the resource. */
     mimeType: string | undefined;
+    /** Whether the MIME type is the MCP App resource media type. */
     mimeTypeValid: boolean;
+    /** MIME validation warning, or `null` for a valid resource. */
     mimeTypeWarning: string | null;
 };
+/** Browser CSP violation observed while an MCP App is running. */
 export type ViewCspViolation = {
+    /** CSP directive reported by the browser. */
     directive: string;
+    /** Effective CSP directive reported by the browser. */
     effectiveDirective?: string;
+    /** URI blocked by the policy. */
     blockedUri: string;
+    /** Source file associated with the violation. */
     sourceFile?: string | null;
+    /** Source line associated with the violation. */
     lineNumber?: number | null;
+    /** Source column associated with the violation. */
     columnNumber?: number | null;
+    /** Original policy text reported by the browser. */
     originalPolicy?: string;
+    /** Unix timestamp in milliseconds when the violation occurred. */
     timestamp: number;
 };
+/** App-visible tools and the function used to call them. */
 export type ViewAppToolConnection = {
+    /** Tools available to the app. */
     tools: Tool[];
+    /** Calls an app-visible tool. */
     callTool: (name: string, args?: Record<string, unknown>) => Promise<unknown>;
 };
+/** Lifecycle stage reported by a rendered MCP App. */
 export type ViewLifecycleStatus = "resolving" | "sandbox-loading" | "connecting" | "initialized" | "ready" | "tearing-down" | "closed" | "error";
+/** Lifecycle update emitted by {@link ViewRenderer}. */
 export type ViewLifecycleEvent = {
+    /** Current lifecycle stage. */
     status: ViewLifecycleStatus;
+    /** Error message when `status` is `"error"`. */
     error?: string;
 };
+/** Props accepted by {@link ViewRenderer}. */
 export interface ViewRendererProps {
+    /** Stable identifier for the view instance. */
     viewId: string;
+    /** Live resource or preloaded HTML to render. */
     source: ViewRendererSource;
+    /** Sandbox page URL or function that derives one from the resolved resource. */
     sandboxUrl?: URL | ((resolved: ResolvedViewResource) => URL);
+    /** Tool associated with the view. */
     toolName?: string;
+    /** Complete tool input forwarded to the app. */
     toolInput?: Record<string, unknown>;
+    /** Tool result forwarded to the app. */
     toolOutput?: unknown;
+    /** Partial streaming tool input forwarded to the app. */
     partialToolInput?: Record<string, unknown>;
+    /** String-valued custom properties forwarded to the app. */
     customProps?: Record<string, string>;
+    /** Whether the associated tool call was cancelled. */
     cancelled?: boolean;
+    /** Host identity advertised to the app. */
     hostInfo?: {
+        /** Stable host name. */
         name: string;
+        /** Host version. */
         version: string;
     };
+    /** Initial host context sent to the app. */
     hostContext?: McpUiHostContext;
+    /** Explicit host capability overrides. */
     hostCapabilities?: Partial<McpUiHostCapabilities>;
+    /** Content modalities accepted by the host's message handler. */
     messageCapabilities?: McpUiSupportedContentBlockModalities;
+    /** Content modalities accepted by the model-context handler. */
     modelContextCapabilities?: McpUiSupportedContentBlockModalities;
+    /** CSP enforcement mode. Defaults to `"permissive"`. */
     cspMode?: ViewCspMode;
+    /** Initial display mode. Defaults to `"inline"`. */
     displayMode?: ViewDisplayMode;
+    /** Called when the app requests a supported display mode. */
     onDisplayModeChange?: (mode: ViewDisplayMode) => void;
+    /** Maximum inline view width in pixels. */
     inlineMaxWidth?: number;
+    /** Whether to hide the built-in view chrome. */
     chromeless?: boolean;
+    /** Handles content the app sends to the conversation. */
     onMessage?: (content: unknown[]) => void | Promise<void>;
+    /** Handles sampling requests from the app. */
     onSamplingRequest?: (params: CreateMessageRequest["params"]) => Promise<CreateMessageResult | CreateMessageResultWithTools>;
+    /** Handles file-download requests from the app. */
     onDownloadFile?: (params: McpUiDownloadFileRequest["params"]) => Promise<McpUiDownloadFileResult>;
+    /** Receives the current app-visible tool connection. */
     onAppToolsChanged?: (connection: ViewAppToolConnection | null) => void;
+    /** Handles model-context updates from the app. */
     onModelContextUpdate?: (ctx: {
         content?: unknown;
         structuredContent?: unknown;
     }) => void | Promise<void>;
+    /** Handles structured log entries from the app. */
     onLog?: (entry: {
         level: string;
         data: unknown;
     }) => void;
+    /** Called when the app signals that it is ready. */
     onReady?: () => void;
+    /** Called for each view lifecycle transition. */
     onLifecycleChange?: (event: ViewLifecycleEvent) => void;
+    /** Called when view initialization or runtime handling fails. */
     onError?: (message: string) => void;
+    /** Called when the browser reports a CSP violation. */
     onCspViolation?: (violation: ViewCspViolation) => void;
+    /** Called after a live or preloaded resource is normalized. */
     onResourceResolved?: (resolved: ResolvedViewResource) => void;
+    /** Wraps the host transport before it is connected to the app bridge. */
     wrapTransport?: (transport: Transport, viewId: string) => Transport;
+    /** Timeout in milliseconds for app-initiated tool calls. Defaults to `600000`. */
     toolCallTimeout?: number;
     /** Dev mock of ChatGPT file APIs for local hosts (inspector). Default false. */
     mockOpenAiFileApis?: boolean;
@@ -114,7 +197,9 @@ export interface ViewRendererProps {
     onInlineHeightChange?: (height: number) => void;
     /** Inspector-only chrome shown above the iframe in fullscreen display mode. */
     fullscreenHeader?: {
+        /** Header title. */
         title: string;
+        /** Optional header icon URL. */
         iconUrl?: string | null;
     };
     /** Optional host close control for fullscreen (e.g. shared Button + icon). */
@@ -123,9 +208,13 @@ export interface ViewRendererProps {
         "data-testid": string;
         "aria-label": string;
     }) => ReactNode;
+    /** Additional class name applied to the view container. */
     className?: string;
+    /** Test identifier applied to the view container. */
     testId?: string;
+    /** Status text shown while the associated tool is running. */
     invoking?: string;
+    /** Status text shown after the associated tool completes. */
     invoked?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/react/view/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/react/view/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oCAAoC,EACrC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,4BAA4B,EAC5B,IAAI,EACL,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oCAAoC,GACrC,CAAC;AACF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,YAAY,CAAC;AAE9D,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,KAC7D,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,SAAS;QACf,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE;YACN,EAAE,CAAC,EAAE;gBACH,UAAU,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;aAC3C,CAAC;SACH,CAAC;KACH,EAAE,CAAC;IACJ,SAAS,CAAC,EAAE,SAAS;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE;YAAE,EAAE,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;CAClE;AAED,MAAM,MAAM,kBAAkB,GAC1B;IACE,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,cAAc,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEN,MAAM,MAAM,oBAAoB,GAAG;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC1C,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAClC,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAClD,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,iBAAiB,GACjB,YAAY,GACZ,aAAa,GACb,OAAO,GACP,cAAc,GACd,QAAQ,GACR,OAAO,CAAC;AAEZ,MAAM,MAAM,kBAAkB,GAAG;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,kBAAkB,CAAC;IAC3B,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,KAAK,GAAG,CAAC,CAAC;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClD,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,wBAAwB,CAAC,EAAE,oCAAoC,CAAC;IAChE,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,iBAAiB,CAAC,EAAE,CAClB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KACnC,OAAO,CAAC,mBAAmB,GAAG,4BAA4B,CAAC,CAAC;IACjE,cAAc,CAAC,EAAE,CACf,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,KACvC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,KAAK,IAAI,CAAC;IACvE,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC7B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IAC1D,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACvD,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC9D,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC;IACpE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;KACtB,KAAK,SAAS,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/react/view/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oCAAoC,EACrC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,4BAA4B,EAC5B,IAAI,EACL,MAAM,8BAA8B,CAAC;AAEtC,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,EACrB,gBAAgB,EAChB,gBAAgB,EAChB,wBAAwB,EACxB,oCAAoC,GACrC,CAAC;AACF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAEvC,4CAA4C;AAC5C,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,KAAK,GAAG,YAAY,CAAC;AAE9D,4EAA4E;AAC5E,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAE3D,uEAAuE;AACvE,MAAM,WAAW,cAAc;IAC7B,gCAAgC;IAChC,QAAQ,EAAE,CACR,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,sBAAsB,CAAC,EAAE,OAAO,CAAA;KAAE,KAC7D,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,oCAAoC;IACpC,YAAY,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,sEAAsE;IACtE,KAAK,CAAC,EAAE,SAAS;QACf,iBAAiB;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,8BAA8B;QAC9B,KAAK,CAAC,EAAE;YACN,sCAAsC;YACtC,EAAE,CAAC,EAAE;gBACH,sDAAsD;gBACtD,UAAU,CAAC,EAAE,SAAS,CAAC,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC;aAC3C,CAAC;SACH,CAAC;KACH,EAAE,CAAC;IACJ,uCAAuC;IACvC,SAAS,CAAC,EAAE,SAAS;QACnB,oBAAoB;QACpB,GAAG,EAAE,MAAM,CAAC;QACZ,kCAAkC;QAClC,KAAK,CAAC,EAAE;YACN,0CAA0C;YAC1C,EAAE,CAAC,EAAE,OAAO,CAAC;SACd,CAAC;KACH,EAAE,CAAC;CACL;AAED,2EAA2E;AAC3E,MAAM,MAAM,kBAAkB,GAC1B;IACE,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,UAAU,EAAE,cAAc,CAAC;IAC3B,2CAA2C;IAC3C,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IACE,wCAAwC;IACxC,IAAI,EAAE,WAAW,CAAC;IAClB,wCAAwC;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACvB,+DAA+D;IAC/D,WAAW,CAAC,EAAE,wBAAwB,CAAC;IACvC,8DAA8D;IAC9D,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB,CAAC;AAEN,gFAAgF;AAChF,MAAM,MAAM,oBAAoB,GAAG;IACjC,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,WAAW,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC1C,wCAAwC;IACxC,GAAG,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAClC,qDAAqD;IACrD,WAAW,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAClD,qDAAqD;IACrD,aAAa,EAAE,OAAO,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gEAAgE;IAChE,aAAa,EAAE,OAAO,CAAC;IACvB,+DAA+D;IAC/D,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,kEAAkE;AAClE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6CAA6C;IAC7C,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,iDAAiD;IACjD,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,4DAA4D;AAC5D,MAAM,MAAM,qBAAqB,GAAG;IAClC,kCAAkC;IAClC,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,iCAAiC;IACjC,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9E,CAAC;AAEF,sDAAsD;AACtD,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,iBAAiB,GACjB,YAAY,GACZ,aAAa,GACb,OAAO,GACP,cAAc,GACd,QAAQ,GACR,OAAO,CAAC;AAEZ,wDAAwD;AACxD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,+BAA+B;IAC/B,MAAM,EAAE,mBAAmB,CAAC;IAC5B,gDAAgD;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,8CAA8C;AAC9C,MAAM,WAAW,iBAAiB;IAChC,+CAA+C;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,MAAM,EAAE,kBAAkB,CAAC;IAC3B,gFAAgF;IAChF,UAAU,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,oBAAoB,KAAK,GAAG,CAAC,CAAC;IAC7D,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,wCAAwC;IACxC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,sDAAsD;IACtD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2CAA2C;IAC3C,QAAQ,CAAC,EAAE;QACT,wBAAwB;QACxB,IAAI,EAAE,MAAM,CAAC;QACb,oBAAoB;QACpB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,4CAA4C;IAC5C,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,0CAA0C;IAC1C,gBAAgB,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClD,iEAAiE;IACjE,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,gEAAgE;IAChE,wBAAwB,CAAC,EAAE,oCAAoC,CAAC;IAChE,wDAAwD;IACxD,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,oDAAoD;IACpD,WAAW,CAAC,EAAE,eAAe,CAAC;IAC9B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAC;IACtD,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gDAAgD;IAChD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,yDAAyD;IACzD,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzD,8CAA8C;IAC9C,iBAAiB,CAAC,EAAE,CAClB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,KACnC,OAAO,CAAC,mBAAmB,GAAG,4BAA4B,CAAC,CAAC;IACjE,mDAAmD;IACnD,cAAc,CAAC,EAAE,CACf,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,KACvC,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtC,wDAAwD;IACxD,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,qBAAqB,GAAG,IAAI,KAAK,IAAI,CAAC;IACvE,kDAAkD;IAClD,oBAAoB,CAAC,EAAE,CAAC,GAAG,EAAE;QAC3B,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iBAAiB,CAAC,EAAE,OAAO,CAAC;KAC7B,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,mDAAmD;IACnD,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,KAAK,IAAI,CAAC;IAC1D,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;IACrB,iDAAiD;IACjD,iBAAiB,CAAC,EAAE,CAAC,KAAK,EAAE,kBAAkB,KAAK,IAAI,CAAC;IACxD,iEAAiE;IACjE,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,uDAAuD;IACvD,cAAc,CAAC,EAAE,CAAC,SAAS,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACvD,+DAA+D;IAC/D,kBAAkB,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC9D,yEAAyE;IACzE,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,CAAC;IACpE,kFAAkF;IAClF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,oFAAoF;IACpF,oBAAoB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE;QACjB,oBAAoB;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,gCAAgC;QAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACzB,CAAC;IACF,8EAA8E;IAC9E,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC9B,OAAO,EAAE,MAAM,IAAI,CAAC;QACpB,aAAa,EAAE,MAAM,CAAC;QACtB,YAAY,EAAE,MAAM,CAAC;KACtB,KAAK,SAAS,CAAC;IAChB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB"}

package/dist/react/view/view-detection.d.ts

@@ -1,4 +1,22 @@
+/**
+ * Reads the MCP App resource URI from tool metadata.
+ *
+ * @param toolMeta - Tool `_meta` object.
+ * @returns The declared view resource URI, or `null` when none is declared.
+ */
 export declare function getViewResourceUri(toolMeta?: Record<string, unknown>): string | null;
+/**
+ * Tests whether tool metadata declares an MCP App resource.
+ *
+ * @param toolMeta - Tool `_meta` object.
+ * @returns `true` when the tool declares a view resource URI.
+ */
 export declare function isViewTool(toolMeta?: Record<string, unknown>): boolean;
+/**
+ * Tests whether a resource uses the MCP App HTML media type.
+ *
+ * @param mimeType - Resource MIME type.
+ * @returns `true` for the MCP App resource media type.
+ */
 export declare function isViewResource(mimeType?: string): boolean;
 //# sourceMappingURL=view-detection.d.ts.map

package/dist/react/view/view-detection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-detection.d.ts","sourceRoot":"","sources":["../../../src/react/view/view-detection.ts"],"names":[],"mappings":"AAEA,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,MAAM,GAAG,IAAI,CAWf;AAED,wBAAgB,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEtE;AAED,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAEzD"}
+{"version":3,"file":"view-detection.d.ts","sourceRoot":"","sources":["../../../src/react/view/view-detection.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,MAAM,GAAG,IAAI,CAWf;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAEtE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/dist/react/view/view-host-policy.d.ts

@@ -1,5 +1,6 @@
 import type { McpUiHostCapabilities, McpUiSupportedContentBlockModalities } from "./ext-apps-bridge.js";
 import type { ViewConnection, ViewDisplayMode } from "./types.js";
+/** Inputs used to derive the capabilities advertised by an MCP App host. */
 type CapabilityInputs = {
     hasConnection: boolean;
     hasMessageHandler: boolean;
@@ -10,17 +11,51 @@ type CapabilityInputs = {
     messageCapabilities?: McpUiSupportedContentBlockModalities;
     modelContextCapabilities?: McpUiSupportedContentBlockModalities;
 };
+/**
+ * Builds host capabilities from the callbacks and connections the host exposes.
+ *
+ * @param inputs - Available host features and supported content modalities.
+ * @returns Capabilities suitable for MCP App bridge initialization.
+ */
 export declare function buildDefaultHostCapabilities({ hasConnection, hasMessageHandler, hasModelContextHandler, hasLogHandler, hasSamplingHandler, hasDownloadHandler, messageCapabilities, modelContextCapabilities, }: CapabilityInputs): McpUiHostCapabilities;
+/**
+ * Tests whether a tool is visible to the model.
+ *
+ * Tools without explicit visibility metadata remain model-visible.
+ *
+ * @param tool - Tool metadata to inspect.
+ * @returns `true` when the tool may be presented to the model.
+ */
 export declare function isToolVisibleToModel(tool: {
     _meta?: unknown;
 }): boolean;
+/**
+ * Validates and dispatches an MCP App `ui/message` payload.
+ *
+ * @param handler - Host callback that accepts message content.
+ * @param content - Content blocks supplied by the app.
+ * @throws When the host has no message handler or `content` is empty.
+ */
 export declare function dispatchUiMessage(handler: ((content: unknown[]) => void | Promise<void>) | undefined, content: unknown[]): Promise<void>;
+/**
+ * Resolves a display-mode request against host and app availability.
+ *
+ * @param options - Requested and current modes plus each side's supported modes.
+ * @returns The requested mode when both sides support it; otherwise `current`.
+ */
 export declare function resolveRequestedDisplayMode({ requested, current, hostAvailable, appAvailable, }: {
     requested: ViewDisplayMode;
     current: ViewDisplayMode;
     hostAvailable?: readonly ViewDisplayMode[];
     appAvailable?: readonly ViewDisplayMode[];
 }): ViewDisplayMode;
+/**
+ * Asserts that an MCP App may call a named server tool.
+ *
+ * @param tools - Tools available through the live view connection.
+ * @param name - Tool name requested by the app.
+ * @throws When the tool is unavailable or not visible to apps.
+ */
 export declare function assertAppCanCallTool(tools: ViewConnection["tools"], name: string): void;
 export {};
 //# sourceMappingURL=view-host-policy.d.ts.map

package/dist/react/view/view-host-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"view-host-policy.d.ts","sourceRoot":"","sources":["../../../src/react/view/view-host-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,oCAAoC,EACrC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,KAAK,gBAAgB,GAAG;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sBAAsB,EAAE,OAAO,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,wBAAwB,CAAC,EAAE,oCAAoC,CAAC;CACjE,CAAC;AAEF,wBAAgB,4BAA4B,CAAC,EAC3C,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GACzB,EAAE,gBAAgB,GAAG,qBAAqB,CAmB1C;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAQvE;AAED,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,OAAO,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED,wBAAgB,2BAA2B,CAAC,EAC1C,SAAS,EACT,OAAO,EACP,aAAa,EACb,YAAY,GACb,EAAE;IACD,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC3C,GAAG,eAAe,CAMlB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,GACX,IAAI,CAUN"}
+{"version":3,"file":"view-host-policy.d.ts","sourceRoot":"","sources":["../../../src/react/view/view-host-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,qBAAqB,EACrB,oCAAoC,EACrC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElE,4EAA4E;AAC5E,KAAK,gBAAgB,GAAG;IACtB,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,sBAAsB,EAAE,OAAO,CAAC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mBAAmB,CAAC,EAAE,oCAAoC,CAAC;IAC3D,wBAAwB,CAAC,EAAE,oCAAoC,CAAC;CACjE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,EAC3C,aAAa,EACb,iBAAiB,EACjB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GACzB,EAAE,gBAAgB,GAAG,qBAAqB,CAmB1C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAQvE;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,EACnE,OAAO,EAAE,OAAO,EAAE,GACjB,OAAO,CAAC,IAAI,CAAC,CAQf;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,EAC1C,SAAS,EACT,OAAO,EACP,aAAa,EACb,YAAY,GACb,EAAE;IACD,SAAS,EAAE,eAAe,CAAC;IAC3B,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,YAAY,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;CAC3C,GAAG,eAAe,CAMlB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAC9B,IAAI,EAAE,MAAM,GACX,IAAI,CAUN"}

package/dist/sandbox.d.ts

@@ -0,0 +1,2 @@
+export { buildSandboxProxyBlobHtml } from "./react/view/sandbox-blob-url.js";
+//# sourceMappingURL=sandbox.d.ts.map

package/dist/sandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../src/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC"}

package/dist/sandbox.js

@@ -0,0 +1,283 @@
+// src/react/view/sandbox-blob-url.ts
+var SANDBOX_PROXY_HTML = `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; img-src * data: blob: 'unsafe-inline'; media-src * blob: data:; font-src * blob: data:; script-src * 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data:; style-src * blob: data: 'unsafe-inline'; connect-src * data: blob: about:; frame-src * blob: data: http://localhost:* https://localhost:* http://127.0.0.1:* https://127.0.0.1:*;"
+    />
+    <title>MCP Apps Sandbox Proxy</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; width: 100%; overflow: hidden; }
+      * { box-sizing: border-box; }
+      iframe { display: block; background-color: transparent; border: 0px none transparent; padding: 0px; width: 100%; height: 100%; }
+    </style>
+  </head>
+  <body>
+    <script>
+      function sanitizeDomain(domain) {
+        if (typeof domain !== "string") return "";
+        return domain.replace(/['"<>;]/g, "").trim();
+      }
+
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+        const allowList = [];
+        if (permissions.camera) allowList.push("camera *");
+        if (permissions.microphone) allowList.push("microphone *");
+        if (permissions.geolocation) allowList.push("geolocation *");
+        if (permissions.clipboardWrite) allowList.push("clipboard-write *");
+        return allowList.join("; ");
+      }
+
+      function buildCSP(csp) {
+        if (!csp) {
+          return [
+            "default-src 'none'",
+            "script-src 'unsafe-inline'",
+            "style-src 'unsafe-inline'",
+            "img-src data:",
+            "font-src data:",
+            "media-src data:",
+            "connect-src 'none'",
+            "frame-src 'none'",
+            "object-src 'none'",
+            "base-uri 'none'",
+          ].join("; ");
+        }
+
+        const connectDomains = (csp.connectDomains || []).map(sanitizeDomain).filter(Boolean);
+        const resourceDomains = (csp.resourceDomains || []).map(sanitizeDomain).filter(Boolean);
+        const frameDomains = (csp.frameDomains || []).map(sanitizeDomain).filter(Boolean);
+        const baseUriDomains = (csp.baseUriDomains || []).map(sanitizeDomain).filter(Boolean);
+        const scriptDirectives = (csp.scriptDirectives || []).filter(function(d) { return typeof d === "string" && d.length > 0; });
+
+        const connectSrc = connectDomains.length > 0 ? connectDomains.join(" ") : "'none'";
+        const resourceSrc = resourceDomains.length > 0 ? ["data:", "blob:", ...resourceDomains].join(" ") : "data: blob:";
+        const frameSrc = frameDomains.length > 0 ? frameDomains.join(" ") : "'none'";
+        const baseUri = baseUriDomains.length > 0 ? baseUriDomains.join(" ") : "'none'";
+        const scriptSrcParts = ["'unsafe-inline'", resourceSrc];
+        if (scriptDirectives.length > 0) scriptSrcParts.push(scriptDirectives.join(" "));
+
+        return [
+          "default-src 'none'",
+          "script-src " + scriptSrcParts.join(" "),
+          "style-src 'unsafe-inline' " + resourceSrc,
+          "img-src " + resourceSrc,
+          "font-src " + resourceSrc,
+          "media-src " + resourceSrc,
+          "connect-src " + connectSrc,
+          "frame-src " + frameSrc,
+          "object-src 'none'",
+          "base-uri " + baseUri,
+        ].join("; ");
+      }
+
+      function buildViolationListenerScript() {
+        return \`<script>
+document.addEventListener('securitypolicyviolation', function(e) {
+  var violation = {
+    type: 'mcp-apps:csp-violation',
+    directive: e.violatedDirective,
+    blockedUri: e.blockedURI,
+    sourceFile: e.sourceFile || null,
+    lineNumber: e.lineNumber || null,
+    columnNumber: e.columnNumber || null,
+    effectiveDirective: e.effectiveDirective,
+    originalPolicy: e.originalPolicy,
+    disposition: e.disposition,
+    timestamp: Date.now()
+  };
+  console.warn('[MCP Apps CSP Violation]', violation.directive, ':', violation.blockedUri);
+  window.parent.postMessage(violation, '*');
+});
+
+function serializeConsoleArgs(args) {
+  try {
+    return Array.from(args || []).map(function(arg) {
+      if (arg instanceof Error) {
+        return {
+          type: 'Error',
+          message: arg.message,
+          stack: arg.stack,
+          name: arg.name,
+        };
+      }
+      if (typeof arg === 'object' && arg !== null) {
+        try {
+          return JSON.parse(JSON.stringify(arg));
+        } catch (e) {
+          return String(arg);
+        }
+      }
+      return arg;
+    });
+  } catch (e) {
+    return [String(args)];
+  }
+}
+
+function sendConsoleToParent(level, args) {
+  try {
+    window.parent.postMessage({
+      type: 'iframe-console-log',
+      level: level,
+      args: serializeConsoleArgs(args),
+      timestamp: new Date().toISOString(),
+      url: window.location.href,
+    }, '*');
+  } catch (e) {}
+}
+
+var originalConsoleError = console.error.bind(console);
+console.error = function() {
+  var args = Array.from(arguments);
+  originalConsoleError.apply(console, args);
+  sendConsoleToParent('error', args);
+};
+
+window.addEventListener('error', function(event) {
+  sendConsoleToParent('error', [{
+    message: event.message,
+    filename: event.filename,
+    lineno: event.lineno,
+    colno: event.colno,
+    error: event.error ? {
+      message: event.error.message,
+      stack: event.error.stack,
+      name: event.error.name,
+    } : null,
+  }]);
+});
+
+window.addEventListener('unhandledrejection', function(event) {
+  sendConsoleToParent('error', [{
+    message: 'Unhandled Promise Rejection',
+    reason: event.reason ? String(event.reason) : 'Unknown',
+    error: event.reason instanceof Error ? {
+      message: event.reason.message,
+      stack: event.reason.stack,
+      name: event.reason.name,
+    } : null,
+  }]);
+});
+</\` + \`script>\`;
+      }
+
+      function injectCSP(html, cspValue) {
+        const cspMeta = '<meta http-equiv="Content-Security-Policy" content="' + cspValue + '">';
+        const violationListener = buildViolationListenerScript();
+        const injection = cspMeta + violationListener;
+
+        if (html.includes("<head>")) {
+          return html.replace("<head>", "<head>" + injection);
+        } else if (html.includes("<HEAD>")) {
+          return html.replace("<HEAD>", "<HEAD>" + injection);
+        } else if (html.includes("<html>")) {
+          return html.replace("<html>", "<html><head>" + injection + "</head>");
+        } else if (html.includes("<HTML>")) {
+          return html.replace("<HTML>", "<HTML><head>" + injection + "</head>");
+        } else if (html.includes("<!DOCTYPE") || html.includes("<!doctype")) {
+          return html.replace(/(<!DOCTYPE[^>]*>|<!doctype[^>]*>)/i, "$1<head>" + injection + "</head>");
+        } else {
+          return injection + html;
+        }
+      }
+
+      // Query params from host (csp_mode, permissions, widget_csp). AppFrame only
+      // sends { html, csp } in sandbox-resource-ready; we carry the rest on the URL.
+      // Blob URLs cannot reliably carry search params, so the CDN shell injects
+      // window.__SANDBOX_SEARCH__ via buildSandboxProxyBlobHtml.
+      const query = new URLSearchParams(
+        typeof window.__SANDBOX_SEARCH__ === "string"
+          ? window.__SANDBOX_SEARCH__
+          : location.search
+      );
+      const queryCspMode = query.get("csp_mode") || "permissive";
+      let queryPermissions = null;
+      let queryWidgetCsp = null;
+      try {
+        const rawPerm = query.get("permissions");
+        if (rawPerm) queryPermissions = JSON.parse(rawPerm);
+      } catch (e) {}
+      try {
+        const rawCsp = query.get("widget_csp");
+        if (rawCsp) queryWidgetCsp = JSON.parse(rawCsp);
+      } catch (e) {}
+
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+      document.body.appendChild(inner);
+
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          if (event.data && event.data.method === "ui/notifications/sandbox-resource-ready") {
+            const params = event.data.params || {};
+            const html = params.html;
+            const sandbox = params.sandbox;
+            // Prefer message csp when present; fall back to URL widget_csp
+            const csp = params.csp != null ? params.csp : queryWidgetCsp;
+            const permissions = params.permissions != null ? params.permissions : queryPermissions;
+            const permissive =
+              typeof params.permissive === "boolean"
+                ? params.permissive
+                : queryCspMode === "permissive";
+            if (typeof sandbox === "string") {
+              inner.setAttribute("sandbox", sandbox);
+            }
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              if (permissive) {
+                const permissiveCsp = [
+                  "default-src * 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about:",
+                  "script-src * 'unsafe-inline' 'unsafe-eval' data: blob:",
+                  "style-src * 'unsafe-inline' data: blob:",
+                  "img-src * data: blob: https: http:",
+                  "media-src * data: blob: https: http:",
+                  "font-src * data: blob: https: http:",
+                  "connect-src * data: blob: https: http: ws: wss: about:",
+                  "frame-src * data: blob: https: http: about:",
+                  "object-src * data: blob:",
+                  "base-uri *",
+                  "form-action *",
+                ].join("; ");
+                const processedHtml = injectCSP(html, permissiveCsp);
+                inner.srcdoc = processedHtml;
+              } else {
+                const cspValue = buildCSP(csp);
+                const processedHtml = injectCSP(html, cspValue);
+                inner.srcdoc = processedHtml;
+              }
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          window.parent.postMessage(event.data, "*");
+        }
+      });
+
+      window.parent.postMessage({
+        jsonrpc: "2.0",
+        method: "ui/notifications/sandbox-proxy-ready",
+        params: {},
+      }, "*");
+    </script>
+  </body>
+</html>`;
+function buildSandboxProxyBlobHtml(search) {
+  const escaped = JSON.stringify(search).replace(/</g, "\\u003c");
+  const inject = "<script>window.__SANDBOX_SEARCH__ = " + escaped + ";</script>";
+  return SANDBOX_PROXY_HTML.replace("<body>", "<body>" + inject);
+}
+export {
+  buildSandboxProxyBlobHtml
+};
+//# sourceMappingURL=sandbox.js.map