npm - @mcp-use/inspector - Versions diffs - 0.16.2 → 0.17.0-canary.0 - Mend

@mcp-use/inspector 0.16.2 → 0.17.0-canary.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (250) hide show

package/dist/cli.js CHANGED Viewed

@@ -421,7 +421,8 @@ function generateWidgetContentHtml(widgetData) {
     resourceData,
     toolId,
     devServerBaseUrl,
-    theme
+    theme,
+    playground
   } = widgetData;
   console.log("[Widget Content] Using pre-fetched resource for:", {
     serverId,
@@ -455,6 +456,24 @@ function generateWidgetContentHtml(widgetData) {
   const safeToolId = JSON.stringify(toolId);
   const safeWidgetStateKey = JSON.stringify(widgetStateKey);
   const safeTheme = JSON.stringify(theme === "dark" ? "dark" : "light");
+  const locale = playground?.locale || "en-US";
+  const deviceType = playground?.deviceType || "desktop";
+  const capabilities = playground?.capabilities || {
+    hover: true,
+    touch: false
+  };
+  const safeAreaInsets = playground?.safeAreaInsets || {
+    top: 0,
+    right: 0,
+    bottom: 0,
+    left: 0
+  };
+  const safeLocale = JSON.stringify(locale);
+  const safeUserAgent = JSON.stringify({
+    device: { type: deviceType },
+    capabilities
+  });
+  const safeSafeArea = JSON.stringify({ insets: safeAreaInsets });
   const apiScript = `
     <script>
       (function() {
@@ -479,9 +498,9 @@ function generateWidgetContentHtml(widgetData) {
           displayMode: 'inline',
           maxHeight: 600,
           theme: ${safeTheme},
-          locale: 'en-US',
-          safeArea: { insets: { top: 0, bottom: 0, left: 0, right: 0 } },
-          userAgent: {},
+          locale: ${safeLocale},
+          safeArea: ${safeSafeArea},
+          userAgent: ${safeUserAgent},
           widgetState: null,
           async setWidgetState(state) {
@@ -884,8 +903,333 @@ function formatErrorResponse(error, context) {
   };
 }
+// src/server/routes/mcp-apps.ts
+var RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
+async function fetchWithRetry(url, maxRetries = 3, delay = 1e3) {
+  for (let i = 0; i < maxRetries; i++) {
+    try {
+      const response = await fetch(url);
+      if (response.ok) return response;
+      if (i < maxRetries - 1) {
+        await new Promise((resolve) => setTimeout(resolve, delay));
+      }
+    } catch (error) {
+      if (i === maxRetries - 1) throw error;
+      await new Promise((resolve) => setTimeout(resolve, delay));
+    }
+  }
+  throw new Error(`Failed to fetch after ${maxRetries} retries`);
+}
+var SANDBOX_PROXY_HTML = `<!doctype html>
+<html>
+  <head>
+    <meta charset="utf-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; img-src * data: blob: 'unsafe-inline'; media-src * blob: data:; font-src * blob: data:; script-src * 'wasm-unsafe-eval' 'unsafe-inline' 'unsafe-eval' blob: data:; style-src * blob: data: 'unsafe-inline'; connect-src * data: blob: about:; frame-src * blob: data: http://localhost:* https://localhost:* http://127.0.0.1:* https://127.0.0.1:*;"
+    />
+    <title>MCP Apps Sandbox Proxy</title>
+    <style>
+      html, body { margin: 0; padding: 0; height: 100%; width: 100%; overflow: hidden; }
+      * { box-sizing: border-box; }
+      iframe { display: block; background-color: transparent; border: 0px none transparent; padding: 0px; width: 100%; height: 100%; }
+    </style>
+  </head>
+  <body>
+    <script>
+      function sanitizeDomain(domain) {
+        if (typeof domain !== "string") return "";
+        return domain.replace(/['"<>;]/g, "").trim();
+      }
+      function buildAllowAttribute(permissions) {
+        if (!permissions) return "";
+        const allowList = [];
+        if (permissions.camera) allowList.push("camera *");
+        if (permissions.microphone) allowList.push("microphone *");
+        if (permissions.geolocation) allowList.push("geolocation *");
+        if (permissions.clipboardWrite) allowList.push("clipboard-write *");
+        return allowList.join("; ");
+      }
+      function buildCSP(csp) {
+        if (!csp) {
+          return [
+            "default-src 'none'",
+            "script-src 'unsafe-inline'",
+            "style-src 'unsafe-inline'",
+            "img-src data:",
+            "font-src data:",
+            "media-src data:",
+            "connect-src 'none'",
+            "frame-src 'none'",
+            "object-src 'none'",
+            "base-uri 'none'",
+          ].join("; ");
+        }
+        const connectDomains = (csp.connectDomains || []).map(sanitizeDomain).filter(Boolean);
+        const resourceDomains = (csp.resourceDomains || []).map(sanitizeDomain).filter(Boolean);
+        const frameDomains = (csp.frameDomains || []).map(sanitizeDomain).filter(Boolean);
+        const baseUriDomains = (csp.baseUriDomains || []).map(sanitizeDomain).filter(Boolean);
+        const connectSrc = connectDomains.length > 0 ? connectDomains.join(" ") : "'none'";
+        const resourceSrc = resourceDomains.length > 0 ? ["data:", "blob:", ...resourceDomains].join(" ") : "data: blob:";
+        const frameSrc = frameDomains.length > 0 ? frameDomains.join(" ") : "'none'";
+        const baseUri = baseUriDomains.length > 0 ? baseUriDomains.join(" ") : "'none'";
+        return [
+          "default-src 'none'",
+          "script-src 'unsafe-inline' " + resourceSrc,
+          "style-src 'unsafe-inline' " + resourceSrc,
+          "img-src " + resourceSrc,
+          "font-src " + resourceSrc,
+          "media-src " + resourceSrc,
+          "connect-src " + connectSrc,
+          "frame-src " + frameSrc,
+          "object-src 'none'",
+          "base-uri " + baseUri,
+        ].join("; ");
+      }
+      function buildViolationListenerScript() {
+        return \`<script>
+document.addEventListener('securitypolicyviolation', function(e) {
+  var violation = {
+    type: 'mcp-apps:csp-violation',
+    directive: e.violatedDirective,
+    blockedUri: e.blockedURI,
+    sourceFile: e.sourceFile || null,
+    lineNumber: e.lineNumber || null,
+    columnNumber: e.columnNumber || null,
+    effectiveDirective: e.effectiveDirective,
+    originalPolicy: e.originalPolicy,
+    disposition: e.disposition,
+    timestamp: Date.now()
+  };
+  console.warn('[MCP Apps CSP Violation]', violation.directive, ':', violation.blockedUri);
+  window.parent.postMessage(violation, '*');
+});
+</\` + \`script>\`;
+      }
+      function injectCSP(html, cspValue) {
+        const cspMeta = '<meta http-equiv="Content-Security-Policy" content="' + cspValue + '">';
+        const violationListener = buildViolationListenerScript();
+        const injection = cspMeta + violationListener;
+        if (html.includes("<head>")) {
+          return html.replace("<head>", "<head>" + injection);
+        } else if (html.includes("<HEAD>")) {
+          return html.replace("<HEAD>", "<HEAD>" + injection);
+        } else if (html.includes("<html>")) {
+          return html.replace("<html>", "<html><head>" + injection + "</head>");
+        } else if (html.includes("<HTML>")) {
+          return html.replace("<HTML>", "<HTML><head>" + injection + "</head>");
+        } else if (html.includes("<!DOCTYPE") || html.includes("<!doctype")) {
+          return html.replace(/(<!DOCTYPE[^>]*>|<!doctype[^>]*>)/i, "$1<head>" + injection + "</head>");
+        } else {
+          return injection + html;
+        }
+      }
+      const inner = document.createElement("iframe");
+      inner.style = "width:100%; height:100%; border:none;";
+      inner.setAttribute("sandbox", "allow-scripts allow-same-origin allow-forms");
+      document.body.appendChild(inner);
+      window.addEventListener("message", async (event) => {
+        if (event.source === window.parent) {
+          if (event.data && event.data.method === "ui/notifications/sandbox-resource-ready") {
+            const { html, sandbox, csp, permissions, permissive } = event.data.params || {};
+            if (typeof sandbox === "string") {
+              inner.setAttribute("sandbox", sandbox);
+            }
+            const allowAttribute = buildAllowAttribute(permissions);
+            if (allowAttribute) {
+              inner.setAttribute("allow", allowAttribute);
+            }
+            if (typeof html === "string") {
+              if (permissive) {
+                const permissiveCsp = [
+                  "default-src * 'unsafe-inline' 'unsafe-eval' data: blob: filesystem: about:",
+                  "script-src * 'unsafe-inline' 'unsafe-eval' data: blob:",
+                  "style-src * 'unsafe-inline' data: blob:",
+                  "img-src * data: blob: https: http:",
+                  "media-src * data: blob: https: http:",
+                  "font-src * data: blob: https: http:",
+                  "connect-src * data: blob: https: http: ws: wss: about:",
+                  "frame-src * data: blob: https: http: about:",
+                  "object-src * data: blob:",
+                  "base-uri *",
+                  "form-action *",
+                ].join("; ");
+                const processedHtml = injectCSP(html, permissiveCsp);
+                inner.srcdoc = processedHtml;
+              } else {
+                const cspValue = buildCSP(csp);
+                const processedHtml = injectCSP(html, cspValue);
+                inner.srcdoc = processedHtml;
+              }
+            }
+          } else {
+            if (inner && inner.contentWindow) {
+              inner.contentWindow.postMessage(event.data, "*");
+            }
+          }
+        } else if (event.source === inner.contentWindow) {
+          window.parent.postMessage(event.data, "*");
+        }
+      });
+      window.parent.postMessage({
+        jsonrpc: "2.0",
+        method: "ui/notifications/sandbox-proxy-ready",
+        params: {},
+      }, "*");
+    </script>
+  </body>
+</html>`;
+function registerMcpAppsRoutes(app2) {
+  app2.post("/inspector/api/mcp-apps/widget/store", async (c) => {
+    try {
+      const body = await c.req.json();
+      const result = storeWidgetData({
+        ...body,
+        protocol: "mcp-apps"
+        // Tag as MCP Apps protocol
+      });
+      if (!result.success) {
+        return c.json(result, 400);
+      }
+      return c.json(result);
+    } catch (error) {
+      console.error("[MCP Apps] Error storing widget data:", error);
+      return c.json(
+        {
+          success: false,
+          error: error instanceof Error ? error.message : "Unknown error"
+        },
+        500
+      );
+    }
+  });
+  app2.get("/inspector/api/mcp-apps/widget-content/:toolId", async (c) => {
+    try {
+      const toolId = c.req.param("toolId");
+      const cspModeParam = c.req.query("csp_mode");
+      const widgetData = getWidgetData(toolId);
+      if (!widgetData) {
+        return c.json({ error: "Widget data not found or expired" }, 404);
+      }
+      const { resourceData, mcpAppsCsp, mcpAppsPermissions } = widgetData;
+      let htmlContent = "";
+      let mimeType;
+      const contentsArray = Array.isArray(resourceData?.contents) ? resourceData.contents : [];
+      const firstContent = contentsArray[0];
+      if (firstContent) {
+        mimeType = firstContent.mimeType;
+        if (typeof firstContent.text === "string") {
+          htmlContent = firstContent.text;
+        } else if (typeof firstContent.blob === "string") {
+          htmlContent = Buffer.from(firstContent.blob, "base64").toString(
+            "utf-8"
+          );
+        }
+      }
+      if (!htmlContent) {
+        return c.json({ error: "No HTML content in resource" }, 404);
+      }
+      const mimeTypeValid = mimeType === RESOURCE_MIME_TYPE;
+      const mimeTypeWarning = !mimeTypeValid ? mimeType ? `Invalid MIME type "${mimeType}" - SEP-1865 requires "${RESOURCE_MIME_TYPE}"` : `Missing MIME type - SEP-1865 requires "${RESOURCE_MIME_TYPE}"` : null;
+      if (mimeTypeWarning) {
+        console.warn("[MCP Apps] MIME type validation:", mimeTypeWarning, {
+          resourceUri: widgetData.uri
+        });
+      }
+      const cspMode = cspModeParam || "permissive";
+      const isPermissive = cspMode === "permissive";
+      c.header("Cache-Control", "no-cache, no-store, must-revalidate");
+      return c.json({
+        html: htmlContent,
+        csp: isPermissive ? void 0 : mcpAppsCsp,
+        permissions: mcpAppsPermissions,
+        permissive: isPermissive,
+        cspMode,
+        mimeType,
+        mimeTypeValid,
+        mimeTypeWarning
+      });
+    } catch (error) {
+      console.error("[MCP Apps] Error fetching widget content:", error);
+      return c.json(
+        { error: error instanceof Error ? error.message : "Unknown error" },
+        500
+      );
+    }
+  });
+  app2.get("/inspector/api/mcp-apps/dev-widget-content/:toolId", async (c) => {
+    try {
+      const toolId = c.req.param("toolId");
+      const cspModeParam = c.req.query("csp_mode");
+      const widgetData = getWidgetData(toolId);
+      if (!widgetData?.devWidgetUrl || !widgetData?.devServerBaseUrl) {
+        return c.json({ error: "Dev widget data not found or expired" }, 404);
+      }
+      console.log(
+        `[MCP Apps] Fetching live HTML from Vite dev server: ${widgetData.devWidgetUrl}`
+      );
+      const response = await fetchWithRetry(widgetData.devWidgetUrl);
+      if (!response.ok) {
+        return c.json(
+          { error: `Failed to fetch from dev server (${response.status})` },
+          response.status
+        );
+      }
+      const htmlContent = await response.text();
+      const cspMode = cspModeParam || "permissive";
+      const isPermissive = cspMode === "permissive";
+      c.header("Cache-Control", "no-cache, no-store, must-revalidate");
+      return c.json({
+        html: htmlContent,
+        csp: isPermissive ? void 0 : widgetData.mcpAppsCsp,
+        permissions: widgetData.mcpAppsPermissions,
+        mimeTypeValid: true
+        // Dev mode widgets always valid
+      });
+    } catch (error) {
+      console.error("[MCP Apps] Error fetching dev widget:", error);
+      return c.json(
+        { error: error instanceof Error ? error.message : "Unknown error" },
+        500
+      );
+    }
+  });
+  app2.get("/inspector/api/mcp-apps/sandbox-proxy", (c) => {
+    c.header("Content-Type", "text/html; charset=utf-8");
+    c.header("Cache-Control", "no-cache, no-store, must-revalidate");
+    const additionalFrameAncestors = process.env.FRAME_ANCESTORS || "";
+    const frameAncestors = [
+      "'self'",
+      // Local development
+      "http://localhost:*",
+      "http://127.0.0.1:*",
+      "https://localhost:*",
+      "https://127.0.0.1:*",
+      // Production - allow mcp-use.com subdomain pattern (sandbox-* convention)
+      "https://*.mcp-use.com",
+      "http://*.mcp-use.com",
+      // Custom domains from environment variable
+      additionalFrameAncestors
+    ].filter(Boolean).join(" ");
+    c.header("Content-Security-Policy", `frame-ancestors ${frameAncestors}`);
+    c.res.headers.delete("X-Frame-Options");
+    return c.body(SANDBOX_PROXY_HTML);
+  });
+}
 // src/server/shared-routes.ts
-async function fetchWithRetry(url, options, maxRetries = 3, initialDelay = 500) {
+async function fetchWithRetry2(url, options, maxRetries = 3, initialDelay = 500) {
   let lastError;
   for (let attempt = 0; attempt <= maxRetries; attempt++) {
     try {
@@ -932,6 +1276,7 @@ function registerInspectorRoutes(app2, config) {
     basePath: "/inspector/api/oauth",
     enableLogging: true
   });
+  registerMcpAppsRoutes(app2);
   app2.post("/inspector/api/chat/stream", async (c) => {
     try {
       const requestBody = await c.req.json();
@@ -1045,7 +1390,7 @@ function registerInspectorRoutes(app2, config) {
           404
         );
       }
-      const response = await fetchWithRetry(widgetData.devWidgetUrl);
+      const response = await fetchWithRetry2(widgetData.devWidgetUrl);
       if (!response.ok) {
         const status = response.status;
         return c.html(

package/dist/client/components/AddToClientDropdown.d.ts CHANGED Viewed

@@ -14,6 +14,7 @@ interface AddToClientDropdownProps {
     showClients?: {
         cursor?: boolean;
         vsCode?: boolean;
+        vsCodeInsiders?: boolean;
         claudeDesktop?: boolean;
         claudeCode?: boolean;
         geminiCli?: boolean;

package/dist/client/components/AddToClientDropdown.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AddToClientDropdown.d.ts","sourceRoot":"","sources":["../../../src/client/components/AddToClientDropdown.tsx"],"names":[],"mappings":"~~AA4BA~~,UAAU,wBAAwB;IAChC,YAAY,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QACvB,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACrC,CAAC,CAAC;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EACJ,KAAK,CAAC,SAAS,GACf,CAAC,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;CAC5E;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,eAAoB,EACpB,~~WAOC~~,EACD,SAAc,EACd,SAAS,EACT,OAAO,EACP,OAAO,GACR,EAAE,wBAAwB,~~2CAyb1B~~"}
1	+ {"version":3,"file":"AddToClientDropdown.d.ts","sourceRoot":"","sources":["../../../src/client/components/AddToClientDropdown.tsx"],"names":[],"mappings":"AA6BA,UAAU,wBAAwB;IAChC,YAAY,EAAE;QACZ,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,eAAe,CAAC,EAAE,KAAK,CAAC;QACtB,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;QACvB,OAAO,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;KACrC,CAAC,CAAC;IACH,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC;IACF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACjC,OAAO,CAAC,EACJ,KAAK,CAAC,SAAS,GACf,CAAC,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,IAAI,CAAA;KAAE,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;CAC5E;AAID;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,EAClC,YAAY,EACZ,eAAoB,EACpB,WAQC,EACD,SAAc,EACd,SAAS,EACT,OAAO,EACP,OAAO,GACR,EAAE,wBAAwB,2CAgd1B"}

package/dist/client/components/ui/SandboxedIframe.d.ts ADDED Viewed

@@ -0,0 +1,60 @@
+/**
+ * SandboxedIframe - Double-Iframe Sandbox Component for MCP Apps
+ *
+ * Provides secure double-iframe architecture for rendering untrusted HTML:
+ * Host Page → Sandbox Proxy (different origin) → Guest UI
+ *
+ * The sandbox proxy:
+ * 1. Runs on a different origin for security isolation (localhost ↔ 127.0.0.1)
+ * 2. Loads guest HTML via srcdoc when ready
+ * 3. Forwards messages between host and guest (except sandbox-internal)
+ *
+ * Per SEP-1865, this component provides cross-origin isolation for MCP Apps.
+ */
+export interface SandboxedIframeHandle {
+    postMessage: (data: unknown) => void;
+    getIframeElement: () => HTMLIFrameElement | null;
+}
+interface SandboxedIframeProps {
+    /** HTML content to render in the sandbox */
+    html: string | null;
+    /** Sandbox attribute for the inner iframe */
+    sandbox?: string;
+    /** CSP metadata from resource _meta.ui.csp (SEP-1865) */
+    csp?: {
+        connectDomains?: string[];
+        resourceDomains?: string[];
+        frameDomains?: string[];
+        baseUriDomains?: string[];
+    };
+    /** Permissions metadata from resource _meta.ui.permissions (SEP-1865) */
+    permissions?: {
+        camera?: object;
+        microphone?: object;
+        geolocation?: object;
+        clipboardWrite?: object;
+    };
+    /** Skip CSP injection entirely (for permissive/testing mode) */
+    permissive?: boolean;
+    /** Callback when sandbox proxy is ready */
+    onProxyReady?: () => void;
+    /** Callback for messages from guest UI (excluding sandbox-internal messages) */
+    onMessage: (event: MessageEvent) => void;
+    /** CSS class for the outer iframe */
+    className?: string;
+    /** Inline styles for the outer iframe */
+    style?: React.CSSProperties;
+    /** Title for accessibility */
+    title?: string;
+}
+/**
+ * SandboxedIframe provides a secure double-iframe architecture per SEP-1865.
+ *
+ * Message flow:
+ * 1. Proxy sends ui/notifications/sandbox-proxy-ready when loaded
+ * 2. Host sends ui/notifications/sandbox-resource-ready with HTML
+ * 3. Guest UI initializes and communicates via JSON-RPC 2.0
+ */
+export declare const SandboxedIframe: import("react").ForwardRefExoticComponent<SandboxedIframeProps & import("react").RefAttributes<SandboxedIframeHandle>>;
+export {};
+//# sourceMappingURL=SandboxedIframe.d.ts.map

package/dist/client/components/ui/SandboxedIframe.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"SandboxedIframe.d.ts","sourceRoot":"","sources":["../../../../src/client/components/ui/SandboxedIframe.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACrC,gBAAgB,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAC;CAClD;AAED,UAAU,oBAAoB;IAC5B,4CAA4C;IAC5C,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,GAAG,CAAC,EAAE;QACJ,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAC1B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;QAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;KAC3B,CAAC;IACF,yEAAyE;IACzE,WAAW,CAAC,EAAE;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,gEAAgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,IAAI,CAAC;IAC1B,gFAAgF;IAChF,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACzC,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yCAAyC;IACzC,KAAK,CAAC,EAAE,KAAK,CAAC,aAAa,CAAC;IAC5B,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,wHA8I1B,CAAC"}

package/dist/client/components/ui/WidgetWrapper.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+interface WidgetWrapperProps {
+    children: React.ReactNode;
+    className?: string;
+    noWrapper?: boolean;
+}
+/**
+ * Widget wrapper with dotted radial gradient background
+ * Shared by OpenAI Apps SDK and MCP Apps renderers
+ */
+export declare function WidgetWrapper({ children, className, noWrapper, }: WidgetWrapperProps): string | number | bigint | boolean | import("react/jsx-runtime").JSX.Element | Iterable<import("react").ReactNode> | Promise<string | number | bigint | boolean | import("react").ReactPortal | import("react").ReactElement<unknown, string | import("react").JSXElementConstructor<any>> | Iterable<import("react").ReactNode> | null | undefined> | null | undefined;
+export {};
+//# sourceMappingURL=WidgetWrapper.d.ts.map

package/dist/client/components/ui/WidgetWrapper.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"WidgetWrapper.d.ts","sourceRoot":"","sources":["../../../../src/client/components/ui/WidgetWrapper.tsx"],"names":[],"mappings":"AAEA,UAAU,kBAAkB;IAC1B,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,EAC5B,QAAQ,EACR,SAAS,EACT,SAAS,GACV,EAAE,kBAAkB,2WAcpB"}

package/dist/client/constants/debug-options.d.ts ADDED Viewed

@@ -0,0 +1,28 @@
+/**
+ * Debug and playground options constants
+ */
+export declare const LOCALE_OPTIONS: {
+    value: string;
+    label: string;
+}[];
+/**
+ * Available timezone options for widget testing
+ * Generated dynamically from Intl.supportedValuesOf("timeZone")
+ */
+export declare const TIMEZONE_OPTIONS: {
+    value: string;
+    label: string;
+}[];
+/**
+ * CSP mode options with descriptions
+ */
+export declare const CSP_MODE_OPTIONS: readonly [{
+    readonly value: "strict";
+    readonly label: "Strict";
+    readonly description: "Enforce CSP as specified by widget";
+}, {
+    readonly value: "permissive";
+    readonly label: "Permissive";
+    readonly description: "Relaxed CSP for development";
+}];
+//# sourceMappingURL=debug-options.d.ts.map

package/dist/client/constants/debug-options.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"debug-options.d.ts","sourceRoot":"","sources":["../../../src/client/constants/debug-options.ts"],"names":[],"mappings":"AAAA;;GAEG;AA4EH,eAAO,MAAM,cAAc;;;GAAiB,CAAC;AAc7C;;;GAGG;AACH,eAAO,MAAM,gBAAgB;;;GAAuB,CAAC;AAErD;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;EAWnB,CAAC"}

package/dist/client/constants/iframe.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+/**
+ * Iframe configuration constants
+ */
+/**
+ * Standard sandbox permissions for widget iframes
+ * Used across all widget renderers for consistent security policy
+ */
+export declare const IFRAME_SANDBOX_PERMISSIONS: "allow-scripts allow-same-origin allow-forms allow-popups allow-popups-to-escape-sandbox";
+//# sourceMappingURL=iframe.d.ts.map

package/dist/client/constants/iframe.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"iframe.d.ts","sourceRoot":"","sources":["../../../src/client/constants/iframe.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;GAGG;AACH,eAAO,MAAM,0BAA0B,EACrC,yFAAkG,CAAC"}

package/dist/client/constants/index.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+/**
+ * Centralized constants for inspector client
+ */
+export * from "./iframe";
+export * from "./mcp-apps";
+export * from "./debug-options";
+//# sourceMappingURL=index.d.ts.map

package/dist/client/constants/index.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/client/constants/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/dist/client/constants/mcp-apps.d.ts ADDED Viewed

@@ -0,0 +1,38 @@
+/**
+ * MCP Apps configuration constants
+ */
+export declare const MCP_APPS_CONFIG: {
+    /**
+     * API endpoints for widget operations
+     */
+    readonly API_ENDPOINTS: {
+        readonly WIDGET_STORE: "/inspector/api/mcp-apps/widget/store";
+        readonly DEV_WIDGET_CONTENT: (toolCallId: string) => string;
+        readonly WIDGET_CONTENT: (toolCallId: string) => string;
+    };
+    /**
+     * Protocol version for MCP Apps bridge
+     */
+    readonly VERSION: "0.16.2";
+    /**
+     * Timeout values (in milliseconds)
+     */
+    readonly TIMEOUTS: {
+        /** Tool call timeout - 10 minutes */
+        readonly TOOL_CALL: 600000;
+        /** Animation duration for size changes */
+        readonly ANIMATION: 300;
+    };
+    /**
+     * Default dimensions for widget display
+     */
+    readonly DIMENSIONS: {
+        /** Picture-in-picture width */
+        readonly PIP_WIDTH: 768;
+        /** Picture-in-picture height */
+        readonly PIP_HEIGHT: 384;
+        /** Default iframe height for inline mode */
+        readonly DEFAULT_HEIGHT: 400;
+    };
+};
+//# sourceMappingURL=mcp-apps.d.ts.map

package/dist/client/constants/mcp-apps.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"mcp-apps.d.ts","sourceRoot":"","sources":["../../../src/client/constants/mcp-apps.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,eAAO,MAAM,eAAe;IAC1B;;OAEG;;;kDAGgC,MAAM;8CAEV,MAAM;;IAIrC;;OAEG;;IAGH;;OAEG;;QAED,qCAAqC;;QAErC,0CAA0C;;;IAI5C;;OAEG;;QAED,+BAA+B;;QAE/B,gCAAgC;;QAEhC,4CAA4C;;;CAGtC,CAAC"}