@miragon/mcp-toolkit-core 0.10.1 → 1.1.0

package/dist/tools/tool-results.js

@@ -0,0 +1,39 @@
+/**
+ * Toolkit-owned `CallToolResult` builders, byte-for-byte equivalent to the
+ * mcp-use v1 response helpers (`text` / `object` / `error`) the registrars
+ * used to import. The v2 migration guide deprecates those helpers in favour
+ * of raw result structures; owning the three shapes the toolkit actually
+ * emits keeps the wire output identical across the swap and survives their
+ * eventual upstream removal.
+ */
+/** A plain-text tool result (`text/plain` mime hint), as mcp-use's `text()` emitted. */
+export function textResult(content) {
+    return {
+        content: [{ type: "text", text: content }],
+        _meta: { mimeType: "text/plain" },
+    };
+}
+/**
+ * An object tool result: pretty-printed JSON text plus `structuredContent`,
+ * as mcp-use's `object()` emitted for non-array payloads (the registrars wrap
+ * arrays into `{ data }` before calling this — see `toStructuredContent`).
+ */
+export function objectResult(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+        structuredContent: data,
+        _meta: { mimeType: "application/json" },
+    };
+}
+/**
+ * An error tool result. The literal `isError: true` matters: tools with an
+ * `outputSchema` (every view-bound tool) have a callback type demanding
+ * either matching `structuredContent` or an explicit `isError: true` result.
+ */
+export function errorResult(message) {
+    return {
+        isError: true,
+        content: [{ type: "text", text: message }],
+    };
+}
+//# sourceMappingURL=tool-results.js.map

package/dist/tools/tool-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-results.js","sourceRoot":"","sources":["../../src/tools/tool-results.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wFAAwF;AACxF,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACnD,KAAK,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;KAClC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAoC,IAAO;IACrE,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;QACzE,iBAAiB,EAAE,IAAI;QACvB,KAAK,EAAE,EAAE,QAAQ,EAAE,kBAAkB,EAAE;KACxC,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO;QACL,OAAO,EAAE,IAAa;QACtB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;KACpD,CAAA;AACH,CAAC"}

package/dist/tools/with-tool-errors.d.ts

@@ -1,16 +1,22 @@
-import { error } from "mcp-use/server";
+import { errorResult } from "./tool-results.js";
 /**
  * Wraps a raw `server.tool()` handler so thrown exceptions surface as the same
- * `error("[code] message")` tool result the toolkit's registrars produce. This
- * is the single source of truth for the registrar error format — both
+ * `[code] message` error result the toolkit's registrars produce. This is the
+ * single source of truth for the registrar error format — both
  * `createToolRegistrar` and `createWidgetToolRegistrar` route their `catch`
  * paths through here, and tools that bypass the registrars (widget tools,
- * `*_data` feeds) can wrap their handlers to follow the house "use `error()`,
- * don't throw" convention.
+ * `*_data` feeds) can wrap their handlers to follow the house "return an
+ * error result, don't throw" convention.
  *
  * Code precedence matches the registrars: an HTTP-ish `status` (e.g. `404`)
  * wins over a domain error `code` (e.g. `ENGINE_NOT_SELECTED`); both may be a
  * `string` or `number`. When neither is present the message is returned as-is.
+ *
+ * The error branch (`errorResult`) carries a literal `isError: true`: tools
+ * with an `outputSchema` — every view-bound tool since the native-views move —
+ * have a callback type demanding either matching `structuredContent` or an
+ * explicit `isError: true` result, and the literal is what lets wrapped
+ * handlers register without casts.
  */
-export declare function withToolErrors<TArgs extends unknown[], TResult>(handler: (...args: TArgs) => Promise<TResult>): (...args: TArgs) => Promise<TResult | ReturnType<typeof error>>;
+export declare function withToolErrors<TArgs extends unknown[], TResult>(handler: (...args: TArgs) => Promise<TResult>): (...args: TArgs) => Promise<TResult | ReturnType<typeof errorResult>>;
 //# sourceMappingURL=with-tool-errors.d.ts.map

package/dist/tools/with-tool-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"with-tool-errors.d.ts","sourceRoot":"","sources":["../../src/tools/with-tool-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEtC;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC7D,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,GAC5C,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAWjE"}
+{"version":3,"file":"with-tool-errors.d.ts","sourceRoot":"","sources":["../../src/tools/with-tool-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAAC,KAAK,SAAS,OAAO,EAAE,EAAE,OAAO,EAC7D,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,CAAC,GAC5C,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,CAAC,CAWvE"}

package/dist/tools/with-tool-errors.js

@@ -1,16 +1,22 @@
-import { error } from "mcp-use/server";
+import { errorResult } from "./tool-results.js";
 /**
  * Wraps a raw `server.tool()` handler so thrown exceptions surface as the same
- * `error("[code] message")` tool result the toolkit's registrars produce. This
- * is the single source of truth for the registrar error format — both
+ * `[code] message` error result the toolkit's registrars produce. This is the
+ * single source of truth for the registrar error format — both
  * `createToolRegistrar` and `createWidgetToolRegistrar` route their `catch`
  * paths through here, and tools that bypass the registrars (widget tools,
- * `*_data` feeds) can wrap their handlers to follow the house "use `error()`,
- * don't throw" convention.
+ * `*_data` feeds) can wrap their handlers to follow the house "return an
+ * error result, don't throw" convention.
  *
  * Code precedence matches the registrars: an HTTP-ish `status` (e.g. `404`)
  * wins over a domain error `code` (e.g. `ENGINE_NOT_SELECTED`); both may be a
  * `string` or `number`. When neither is present the message is returned as-is.
+ *
+ * The error branch (`errorResult`) carries a literal `isError: true`: tools
+ * with an `outputSchema` — every view-bound tool since the native-views move —
+ * have a callback type demanding either matching `structuredContent` or an
+ * explicit `isError: true` result, and the literal is what lets wrapped
+ * handlers register without casts.
  */
 export function withToolErrors(handler) {
     return async (...args) => {
@@ -21,7 +27,7 @@ export function withToolErrors(handler) {
             const message = e instanceof Error ? e.message : String(e);
             const { status, code } = (e ?? {});
             const errorCode = status ?? code;
-            return error(errorCode ? `[${errorCode}] ${message}` : message);
+            return errorResult(errorCode ? `[${errorCode}] ${message}` : message);
         }
     };
 }

package/dist/tools/with-tool-errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"with-tool-errors.js","sourceRoot":"","sources":["../../src/tools/with-tool-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAEtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA6C;IAE7C,OAAO,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC1D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAyD,CAAA;YAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAA;YAChC,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"with-tool-errors.js","sourceRoot":"","sources":["../../src/tools/with-tool-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,cAAc,CAC5B,OAA6C;IAE7C,OAAO,KAAK,EAAE,GAAG,IAAI,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAC1D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAyD,CAAA;YAC1F,MAAM,SAAS,GAAG,MAAM,IAAI,IAAI,CAAA;YAChC,OAAO,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACvE,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/types/app.d.ts

@@ -32,13 +32,16 @@ export interface AppPlugin<TServer = unknown> {
     appConfig?: Record<string, unknown>;
     registerTools?: (server: TServer) => void;
     /**
-     * Registers the plugin's widget tools against the shared app resource.
-     * The optional `metaDefaults` carry app-level widget `_meta` defaults
-     * (currently the Apps SDK CSP) — forward them into
-     * `createWidgetToolRegistrar` / `uiMeta` so every widget tool advertises
-     * the same contract as the framework's own `render-view`. Implementations
-     * may ignore the parameter; their tools then simply omit those keys.
+     * Registers the plugin's widget tools. Model-visible widget tools bind a
+     * view named after the tool (see `createWidgetToolRegistrar`);
+     * `createFrameworkApp` collects those bindings and primes the view registry
+     * with the shared app bundle. The optional `metaDefaults` carry app-level
+     * widget defaults (the Apps SDK CSP and its camelCase view-CSP sibling) —
+     * forward them into `createWidgetToolRegistrar` so every widget tool
+     * advertises the same contract as the framework's own `render-view`.
+     * Implementations may ignore the parameter; their tools then simply omit
+     * those keys.
      */
-    registerWidgetTools?: (server: TServer, resourceUri: string, metaDefaults?: WidgetToolMetaDefaults) => void;
+    registerWidgetTools?: (server: TServer, metaDefaults?: WidgetToolMetaDefaults) => void;
 }
 //# sourceMappingURL=app.d.ts.map

package/dist/types/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/types/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IAMZ,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAA;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS,CAAC,OAAO,GAAG,OAAO;IAC1C,UAAU,EAAE,aAAa,CAAA;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;IACzC;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,CACpB,MAAM,EAAE,OAAO,EACf,WAAW,EAAE,MAAM,EACnB,YAAY,CAAC,EAAE,sBAAsB,KAClC,IAAI,CAAA;CACV"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/types/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEnD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IAMZ,KAAK,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAA;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS,CAAC,OAAO,GAAG,OAAO;IAC1C,UAAU,EAAE,aAAa,CAAA;IACzB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACnC,aAAa,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,CAAA;IACzC;;;;;;;;;;OAUG;IACH,mBAAmB,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,EAAE,sBAAsB,KAAK,IAAI,CAAA;CACvF"}

package/dist/types/index.d.ts

@@ -5,6 +5,6 @@ export type { AppDefinition, AppPlugin } from "./app.js";
 export type { PipelineConfig, PipelineStepRef } from "./pipeline.js";
 export type { AppConfig, AppConfigEntry, ValidationResult } from "./config.js";
 export type { ViewStructuredContent, StepDataEntry, RefreshParams } from "./view-data.js";
-export { APP_ONLY_META, uiMeta } from "./meta.js";
-export type { UiMetaOptions, UiToolMeta, WidgetCspMeta, WidgetToolMetaDefaults } from "./meta.js";
+export { appsSdkMeta, viewResourceUri, VIEW_RESOURCE_URI_PREFIX } from "./meta.js";
+export type { AppsSdkMetaOptions, AppResourceCsp, WidgetCspMeta, WidgetToolMetaDefaults, } from "./meta.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3E,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC5E,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9E,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AACjD,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAA;AAC3E,YAAY,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAA;AAC/E,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC5E,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AACxD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AACpE,YAAY,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAC9E,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AACzF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA;AAClF,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,sBAAsB,GACvB,MAAM,WAAW,CAAA"}

package/dist/types/index.js

@@ -1,2 +1,2 @@
-export { APP_ONLY_META, uiMeta } from "./meta.js";
+export { appsSdkMeta, viewResourceUri, VIEW_RESOURCE_URI_PREFIX } from "./meta.js";
 //# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAA"}

package/dist/types/meta.d.ts

@@ -1,36 +1,55 @@
 /**
- * Shared `_meta` shapes for widget tools: the SEP-1865 tool-visibility
- * convention plus the dual-protocol widget contract (MCP Apps + OpenAI
- * Apps SDK) that ext-apps hosts key on.
+ * Shared `_meta` shapes for widget tools.
  *
- * Browser-bundle-safe: this module is a pure object/function with no
- * `mcp-use/server` or `node:*` imports, so it can be re-exported from the core
- * Root barrel and consumed by UI bundles as well as server registrars. The
- * dual-protocol key literals are therefore written out here instead of being
- * imported from `mcp-use/server`; `meta.test.ts` pins them against the
- * adapters mcp-use itself emits (`McpAppsAdapter`/`AppsSdkAdapter`), so a
- * contract drift in a future mcp-use bump fails CI instead of silently
- * breaking widget rendering on Claude Desktop / claude.ai again.
+ * Since the native-views move the MCP Apps half of the widget contract
+ * (`_meta.ui.resourceUri`, flat `ui/resourceUri`, `_meta.ui.visibility`, the
+ * resource CSP) is emitted by mcp-use itself from the first-class
+ * `ToolDefinition.view` / `.visibility` fields — the toolkit no longer stamps
+ * any `ui` keys. What remains toolkit-owned is the OpenAI Apps SDK half
+ * (`openai/*` keys), which mcp-use does not derive: {@link appsSdkMeta} builds
+ * it, and mcp-use passes non-`ui` `_meta` entries through to `tools/list`
+ * untouched.
  *
- * SEP-1865 (`_meta.ui.visibility`): conforming MCP hosts hide tools marked
- * `visibility: ["app"]` from the LLM's `tools/list` while keeping them callable
- * from inside a widget iframe via `callTool`. Non-conforming hosts ignore the
- * marker and fall back to the tool description.
+ * Browser-bundle-safe: this module is pure objects/functions with no mcp-use
+ * or `node:*` imports, so it can be re-exported from the core root barrel and
+ * consumed by UI bundles as well as server registrars.
  */
 /**
- * App-only marker — hides a tool from the LLM tool surface while leaving it
- * callable from widgets. Deliberately carries no `resourceUri`: app-only tools
- * (`*_data` feeds, catalogue/refresh hooks) return JSON, they do not render UI.
+ * URI scheme prefix mcp-use uses for view resources. Mirrors
+ * `UI_RESOURCE_URI_PREFIX`, which mcp-use 2.x keeps in an internal `views/`
+ * module without a package export; the wire contract is pinned by
+ * `view-binding.test.ts` against a real server, so a drift in an upstream
+ * bump fails CI instead of silently breaking Apps SDK hosts.
  */
-export declare const APP_ONLY_META: {
-    readonly ui: {
-        readonly visibility: readonly ["app"];
-    };
-};
+export declare const VIEW_RESOURCE_URI_PREFIX = "ui://views/";
 /**
- * The Apps SDK `openai/widgetCSP` shape (snake_cased, as emitted on the wire
- * by mcp-use's `AppsSdkAdapter`). All domains are full origins
- * (e.g. `https://server.example`).
+ * The stable `ui://` resource URI mcp-use assigns to a registered view name —
+ * `ui://views/<name>.html`. Widget registrars use it to point the Apps SDK
+ * `openai/outputTemplate` key at the same resource the MCP Apps `view`
+ * binding renders.
+ */
+export declare function viewResourceUri(viewName: string): string;
+/**
+ * CSP advertised on a view resource, in the SEP-1865 camelCase shape mcp-use
+ * expects on `ToolDefinition.view.csp` (`_meta.ui.csp` on the wire). All
+ * entries are full origins (e.g. `https://server.example`). mcp-use appends
+ * the request-resolved server origin to connect/resource domains itself, so
+ * this only needs origins *other* than the server (e.g. a CDN or an API the
+ * widget fetches directly).
+ */
+export interface AppResourceCsp {
+    /** Origins allowed for fetch/XHR/WebSocket from inside the widget iframe. */
+    connectDomains?: string[];
+    /** Origins allowed for images, scripts, stylesheets, fonts. */
+    resourceDomains?: string[];
+    /** Allowed iframe origins. */
+    frameDomains?: string[];
+    /** Allowed `base-uri` origins. */
+    baseUriDomains?: string[];
+}
+/**
+ * The Apps SDK `openai/widgetCSP` shape (snake_cased, as Apps SDK hosts read
+ * it). All domains are full origins (e.g. `https://server.example`).
  */
 export interface WidgetCspMeta {
     /** Origins allowed for fetch/XHR/WebSocket from inside the widget iframe. */
@@ -43,27 +62,32 @@ export interface WidgetCspMeta {
     base_uri_domains?: string[];
 }
 /**
- * Per-app widget-tool `_meta` defaults the framework threads into each
- * plugin's `registerWidgetTools` hook (third parameter) so every widget tool
- * can advertise them without knowing app-level configuration.
+ * Per-app widget-tool defaults the framework threads into each plugin's
+ * `registerWidgetTools` hook (second parameter) so every widget tool can
+ * advertise them without knowing app-level configuration.
  */
 export interface WidgetToolMetaDefaults {
     /** Content-security policy advertised to Apps SDK hosts (`openai/widgetCSP`). */
     widgetCSP?: WidgetCspMeta;
+    /**
+     * CSP for the tool's `view` binding (`_meta.ui.csp` on the view resource) —
+     * the camelCase sibling of {@link WidgetToolMetaDefaults.widgetCSP}, both
+     * derived from `createFrameworkApp`'s `app.csp`.
+     */
+    viewCsp?: AppResourceCsp;
 }
-/** Options for {@link uiMeta}. */
-export interface UiMetaOptions {
+/** Options for {@link appsSdkMeta}. */
+export interface AppsSdkMetaOptions {
     /**
-     * The MCP UI resource URI hosting the widget bundle. When set, the host
-     * renders the tool result into that resource instead of returning it.
+     * The `ui://` resource URI of the view rendering this tool's result —
+     * `viewResourceUri(<view name>)` for a view-bound tool. Emitted as
+     * `openai/outputTemplate` so Apps SDK hosts render the widget instead of
+     * the raw result.
      */
-    resourceUri?: string;
-    /** When `true`, marks the tool app-only via SEP-1865 `visibility: ["app"]`. */
-    appOnly?: boolean;
+    resourceUri: string;
     /**
      * Display name used to derive the default `invoking`/`invoked` status
-     * strings (mirroring mcp-use's `Loading <name>...` / `<name> ready`
-     * defaults). Typically the tool title.
+     * strings (`Loading <name>...` / `<name> ready`). Typically the tool title.
      */
     title?: string;
     /** Host status line while the tool call runs (`openai/toolInvocation/invoking`). */
@@ -75,25 +99,18 @@ export interface UiMetaOptions {
     /** Content-security policy advertised to Apps SDK hosts (`openai/widgetCSP`). */
     widgetCSP?: WidgetCspMeta;
 }
-/** Return shape of {@link uiMeta}: the nested `ui` block plus flat wire keys. */
-export interface UiToolMeta extends Record<string, unknown> {
-    ui: Record<string, unknown>;
-}
 /**
- * Builds the `_meta` object for a tool from a {@link UiMetaOptions}, keeping
- * the SEP-1865 visibility / resourceUri literals in one place. Omitted fields
- * are left off entirely so the emitted `_meta` matches the hand-written
- * literals it replaces.
+ * Builds the OpenAI Apps SDK half of the widget-tool `_meta` — the `openai/*`
+ * keys Apps SDK hosts key on to recognise a tool as widget-producing and to
+ * deliver `structuredContent` to the iframe. The MCP Apps half (`_meta.ui`)
+ * is emitted natively by mcp-use from the tool's `view` / `visibility`
+ * fields; never stamp `ui` keys by hand — mcp-use overwrites that namespace
+ * on `tools/list`.
  *
- * Widget-RENDERING tools (a `resourceUri` and not app-only) additionally get
- * the dual-protocol widget contract that mcp-use emits natively for `mcpApps`
- * widgets — the flat SEP-1865 key plus the `openai/*` Apps SDK keys. Ext-apps
- * hosts (Claude Desktop / claude.ai) key on these to recognise the tool as
- * widget-producing and to deliver `structuredContent` to the iframe; without
- * them every widget hangs on its loading skeleton. App-only tools stay free
- * of the widget keys on purpose: their results are consumed by an already
- * rendered widget via `callTool`, and advertising an output template would
- * invite hosts to render them.
+ * Only for widget-RENDERING (model-visible, view-bound) tools. App-only tools
+ * stay free of these keys on purpose: their results are consumed by an
+ * already rendered widget via `callTool`, and advertising an output template
+ * would invite hosts to render them.
  */
-export declare function uiMeta(opts: UiMetaOptions): UiToolMeta;
+export declare function appsSdkMeta(opts: AppsSdkMetaOptions): Record<string, unknown>;
 //# sourceMappingURL=meta.d.ts.map

package/dist/types/meta.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../src/types/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,eAAO,MAAM,aAAa;;;;CAA2C,CAAA;AAErE;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAA;CAC1B;AAED,kCAAkC;AAClC,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,+EAA+E;IAC/E,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAA;CAC1B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAW,SAAQ,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACzD,EAAE,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,CAqBtD"}
+{"version":3,"file":"meta.d.ts","sourceRoot":"","sources":["../../src/types/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,gBAAgB,CAAA;AAErD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,+DAA+D;IAC/D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAA;IACvB,kCAAkC;IAClC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;IAC3B,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;IACxB,6CAA6C;IAC7C,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAA;IACzB;;;;OAIG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;CACzB;AAED,uCAAuC;AACvC,MAAM,WAAW,kBAAkB;IACjC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kFAAkF;IAClF,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iFAAiF;IACjF,SAAS,CAAC,EAAE,aAAa,CAAA;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAe7E"}

package/dist/types/meta.js

@@ -1,66 +1,62 @@
 /**
- * Shared `_meta` shapes for widget tools: the SEP-1865 tool-visibility
- * convention plus the dual-protocol widget contract (MCP Apps + OpenAI
- * Apps SDK) that ext-apps hosts key on.
+ * Shared `_meta` shapes for widget tools.
  *
- * Browser-bundle-safe: this module is a pure object/function with no
- * `mcp-use/server` or `node:*` imports, so it can be re-exported from the core
- * Root barrel and consumed by UI bundles as well as server registrars. The
- * dual-protocol key literals are therefore written out here instead of being
- * imported from `mcp-use/server`; `meta.test.ts` pins them against the
- * adapters mcp-use itself emits (`McpAppsAdapter`/`AppsSdkAdapter`), so a
- * contract drift in a future mcp-use bump fails CI instead of silently
- * breaking widget rendering on Claude Desktop / claude.ai again.
+ * Since the native-views move the MCP Apps half of the widget contract
+ * (`_meta.ui.resourceUri`, flat `ui/resourceUri`, `_meta.ui.visibility`, the
+ * resource CSP) is emitted by mcp-use itself from the first-class
+ * `ToolDefinition.view` / `.visibility` fields — the toolkit no longer stamps
+ * any `ui` keys. What remains toolkit-owned is the OpenAI Apps SDK half
+ * (`openai/*` keys), which mcp-use does not derive: {@link appsSdkMeta} builds
+ * it, and mcp-use passes non-`ui` `_meta` entries through to `tools/list`
+ * untouched.
  *
- * SEP-1865 (`_meta.ui.visibility`): conforming MCP hosts hide tools marked
- * `visibility: ["app"]` from the LLM's `tools/list` while keeping them callable
- * from inside a widget iframe via `callTool`. Non-conforming hosts ignore the
- * marker and fall back to the tool description.
+ * Browser-bundle-safe: this module is pure objects/functions with no mcp-use
+ * or `node:*` imports, so it can be re-exported from the core root barrel and
+ * consumed by UI bundles as well as server registrars.
  */
 /**
- * App-only marker — hides a tool from the LLM tool surface while leaving it
- * callable from widgets. Deliberately carries no `resourceUri`: app-only tools
- * (`*_data` feeds, catalogue/refresh hooks) return JSON, they do not render UI.
+ * URI scheme prefix mcp-use uses for view resources. Mirrors
+ * `UI_RESOURCE_URI_PREFIX`, which mcp-use 2.x keeps in an internal `views/`
+ * module without a package export; the wire contract is pinned by
+ * `view-binding.test.ts` against a real server, so a drift in an upstream
+ * bump fails CI instead of silently breaking Apps SDK hosts.
  */
-export const APP_ONLY_META = { ui: { visibility: ["app"] } };
+export const VIEW_RESOURCE_URI_PREFIX = "ui://views/";
 /**
- * Builds the `_meta` object for a tool from a {@link UiMetaOptions}, keeping
- * the SEP-1865 visibility / resourceUri literals in one place. Omitted fields
- * are left off entirely so the emitted `_meta` matches the hand-written
- * literals it replaces.
+ * The stable `ui://` resource URI mcp-use assigns to a registered view name —
+ * `ui://views/<name>.html`. Widget registrars use it to point the Apps SDK
+ * `openai/outputTemplate` key at the same resource the MCP Apps `view`
+ * binding renders.
+ */
+export function viewResourceUri(viewName) {
+    return `${VIEW_RESOURCE_URI_PREFIX}${viewName}.html`;
+}
+/**
+ * Builds the OpenAI Apps SDK half of the widget-tool `_meta` — the `openai/*`
+ * keys Apps SDK hosts key on to recognise a tool as widget-producing and to
+ * deliver `structuredContent` to the iframe. The MCP Apps half (`_meta.ui`)
+ * is emitted natively by mcp-use from the tool's `view` / `visibility`
+ * fields; never stamp `ui` keys by hand — mcp-use overwrites that namespace
+ * on `tools/list`.
  *
- * Widget-RENDERING tools (a `resourceUri` and not app-only) additionally get
- * the dual-protocol widget contract that mcp-use emits natively for `mcpApps`
- * widgets — the flat SEP-1865 key plus the `openai/*` Apps SDK keys. Ext-apps
- * hosts (Claude Desktop / claude.ai) key on these to recognise the tool as
- * widget-producing and to deliver `structuredContent` to the iframe; without
- * them every widget hangs on its loading skeleton. App-only tools stay free
- * of the widget keys on purpose: their results are consumed by an already
- * rendered widget via `callTool`, and advertising an output template would
- * invite hosts to render them.
+ * Only for widget-RENDERING (model-visible, view-bound) tools. App-only tools
+ * stay free of these keys on purpose: their results are consumed by an
+ * already rendered widget via `callTool`, and advertising an output template
+ * would invite hosts to render them.
  */
-export function uiMeta(opts) {
-    const ui = {};
-    if (opts.resourceUri !== undefined)
-        ui.resourceUri = opts.resourceUri;
-    if (opts.appOnly)
-        ui.visibility = ["app"];
-    const meta = { ui };
-    if (opts.resourceUri !== undefined && !opts.appOnly) {
-        meta["ui/resourceUri"] = opts.resourceUri;
-        meta["openai/outputTemplate"] = opts.resourceUri;
-        meta["openai/toolInvocation/invoking"] =
-            opts.invoking ?? (opts.title ? `Loading ${opts.title}...` : "Loading view...");
-        meta["openai/toolInvocation/invoked"] =
-            opts.invoked ?? (opts.title ? `${opts.title} ready` : "View ready");
-        meta["openai/widgetAccessible"] = true;
-        meta["openai/resultCanProduceWidget"] = true;
-        if (opts.widgetDescription !== undefined) {
-            meta["openai/widgetDescription"] = opts.widgetDescription;
-        }
-        if (opts.widgetCSP !== undefined)
-            meta["openai/widgetCSP"] = opts.widgetCSP;
+export function appsSdkMeta(opts) {
+    const meta = {
+        "openai/outputTemplate": opts.resourceUri,
+        "openai/toolInvocation/invoking": opts.invoking ?? (opts.title ? `Loading ${opts.title}...` : "Loading view..."),
+        "openai/toolInvocation/invoked": opts.invoked ?? (opts.title ? `${opts.title} ready` : "View ready"),
+        "openai/widgetAccessible": true,
+        "openai/resultCanProduceWidget": true,
+    };
+    if (opts.widgetDescription !== undefined) {
+        meta["openai/widgetDescription"] = opts.widgetDescription;
     }
+    if (opts.widgetCSP !== undefined)
+        meta["openai/widgetCSP"] = opts.widgetCSP;
     return meta;
 }
 //# sourceMappingURL=meta.js.map

package/dist/types/meta.js.map

@@ -1 +1 @@
-{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../src/types/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,EAAW,CAAA;AA0DrE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,MAAM,EAAE,GAA4B,EAAE,CAAA;IACtC,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,EAAE,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAA;IACrE,IAAI,IAAI,CAAC,OAAO;QAAE,EAAE,CAAC,UAAU,GAAG,CAAC,KAAK,CAAC,CAAA;IAEzC,MAAM,IAAI,GAAe,EAAE,EAAE,EAAE,CAAA;IAC/B,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,WAAW,CAAA;QACzC,IAAI,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,WAAW,CAAA;QAChD,IAAI,CAAC,gCAAgC,CAAC;YACpC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAA;QAChF,IAAI,CAAC,+BAA+B,CAAC;YACnC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QACrE,IAAI,CAAC,yBAAyB,CAAC,GAAG,IAAI,CAAA;QACtC,IAAI,CAAC,+BAA+B,CAAC,GAAG,IAAI,CAAA;QAC5C,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,IAAI,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAA;QAC3D,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAA;IAC7E,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"meta.js","sourceRoot":"","sources":["../../src/types/meta.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,aAAa,CAAA;AAErD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,GAAG,wBAAwB,GAAG,QAAQ,OAAO,CAAA;AACtD,CAAC;AA4ED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAwB;IAClD,MAAM,IAAI,GAA4B;QACpC,uBAAuB,EAAE,IAAI,CAAC,WAAW;QACzC,gCAAgC,EAC9B,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC;QAChF,+BAA+B,EAC7B,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC;QACrE,yBAAyB,EAAE,IAAI;QAC/B,+BAA+B,EAAE,IAAI;KACtC,CAAA;IACD,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QACzC,IAAI,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAC3D,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,SAAS,CAAA;IAC3E,OAAO,IAAI,CAAA;AACb,CAAC"}

package/package.json

@@ -1,7 +1,12 @@
 {
   "name": "@miragon/mcp-toolkit-core",
-  "version": "0.10.1",
+  "version": "1.1.0",
   "description": "Framework runtime for MCP servers: plugin contract, step/widget registries, pipeline executor, render-view helpers.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Miragon/mcp-toolkit.git",
+    "directory": "packages/core"
+  },
   "type": "module",
   "sideEffects": false,
   "main": "dist/index.js",
@@ -28,18 +33,20 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "mcp-use": "1.34.5",
+    "mcp-use": "2.1.0",
     "zod": "4.4.3"
   },
   "devDependencies": {
-    "@modelcontextprotocol/sdk": "1.29.0",
-    "@types/node": "26.1.1",
-    "mcp-use": "1.34.5",
+    "@modelcontextprotocol/server": "2.0.0",
+    "@types/node": "26.1.2",
+    "mcp-use": "2.1.0",
     "typescript": "6.0.3",
     "vitest": "4.1.10",
     "zod": "4.4.3"
   },
+  "engines": {
+    "node": ">=22.22.2"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",

package/dist/tools/app-resource-uri.d.ts

@@ -1,28 +0,0 @@
-export interface DeriveAppResourceUriInput {
-    /** Server / app name used as the resource URI authority (`ui://<appName>/...`). */
-    appName: string;
-    /** Absolute path to the bundled `mcp-app.html` served under the URI. */
-    htmlPath: string;
-    /**
-     * Resource URI used when the bundle file is missing (e.g. `dist` not built
-     * yet in a dev loop). Defaults to `ui://<appName>/mcp-app.dev.html` so a
-     * stable, obviously-non-production URI is still served. Pass a custom value
-     * only when a different placeholder is needed.
-     */
-    devFallback?: string;
-}
-/**
- * Derives a content-hashed MCP UI resource URI for the widget bundle.
- *
- * MCP hosts cache the widget bundle by its resource URI; with a fixed URI a
- * host keeps serving a stale bundle even across server restarts. Hashing the
- * file content into the URI (`ui://<appName>/mcp-app.<hash>.html`) forces a
- * fresh fetch whenever the bundle actually changes — and only then.
- *
- * When the bundle file cannot be read (commonly `dist` not built yet), it
- * falls back to {@link DeriveAppResourceUriInput.devFallback} — a stable
- * `ui://<appName>/mcp-app.dev.html` by default — and emits a boot warning so
- * the missing file is visible in logs rather than silently degrading.
- */
-export declare function deriveAppResourceUri(input: DeriveAppResourceUriInput): string;
-//# sourceMappingURL=app-resource-uri.d.ts.map

package/dist/tools/app-resource-uri.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-resource-uri.d.ts","sourceRoot":"","sources":["../../src/tools/app-resource-uri.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,yBAAyB;IACxC,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAA;IACf,wEAAwE;IACxE,QAAQ,EAAE,MAAM,CAAA;IAChB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,MAAM,CAc7E"}

package/dist/tools/app-resource-uri.js

@@ -1,30 +0,0 @@
-import { createHash } from "node:crypto";
-import { readFileSync } from "node:fs";
-/**
- * Derives a content-hashed MCP UI resource URI for the widget bundle.
- *
- * MCP hosts cache the widget bundle by its resource URI; with a fixed URI a
- * host keeps serving a stale bundle even across server restarts. Hashing the
- * file content into the URI (`ui://<appName>/mcp-app.<hash>.html`) forces a
- * fresh fetch whenever the bundle actually changes — and only then.
- *
- * When the bundle file cannot be read (commonly `dist` not built yet), it
- * falls back to {@link DeriveAppResourceUriInput.devFallback} — a stable
- * `ui://<appName>/mcp-app.dev.html` by default — and emits a boot warning so
- * the missing file is visible in logs rather than silently degrading.
- */
-export function deriveAppResourceUri(input) {
-    const { appName, htmlPath } = input;
-    const devFallback = input.devFallback ?? `ui://${appName}/mcp-app.dev.html`;
-    try {
-        const hash = createHash("sha256").update(readFileSync(htmlPath)).digest("hex").slice(0, 10);
-        return `ui://${appName}/mcp-app.${hash}.html`;
-    }
-    catch {
-        console.warn(`[mcp-toolkit] could not read widget bundle at "${htmlPath}" — ` +
-            `serving the dev fallback resource URI "${devFallback}". ` +
-            `Build the bundle (dist/mcp-app.html) before shipping to production.`);
-        return devFallback;
-    }
-}
-//# sourceMappingURL=app-resource-uri.js.map

package/dist/tools/app-resource-uri.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"app-resource-uri.js","sourceRoot":"","sources":["../../src/tools/app-resource-uri.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAgBtC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAgC;IACnE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAA;IACnC,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,QAAQ,OAAO,mBAAmB,CAAA;IAC3E,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAC3F,OAAO,QAAQ,OAAO,YAAY,IAAI,OAAO,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,IAAI,CACV,kDAAkD,QAAQ,MAAM;YAC9D,0CAA0C,WAAW,KAAK;YAC1D,qEAAqE,CACxE,CAAA;QACD,OAAO,WAAW,CAAA;IACpB,CAAC;AACH,CAAC"}