@miragon/pulse-widget-shell 0.0.0-stage → 0.22.0

package/dist/widget-meta-defaults.test.js

@@ -0,0 +1,196 @@
+import { describe, expect, it, vi } from "vitest";
+import { appOnly, showToolBinding } from "./widget-tool-bindings.js";
+import { honorWidgetMetaDefaults, mergeDomainLists, withWidgetMetaDefaults, } from "./widget-meta-defaults.js";
+/** A server whose `tool()` records the definitions it receives, plus one other member. */
+function recordingServer() {
+    const definitions = [];
+    const server = {
+        basePath: "/mcp",
+        tool(definition) {
+            definitions.push(definition);
+            return { name: definition.name };
+        },
+        describe() {
+            return `${this.basePath} with ${definitions.length} tools`;
+        },
+    };
+    return { server: server, definitions };
+}
+const FONT_ORIGIN = "https://mcp.example.com";
+const DEFAULTS = {
+    viewCsp: { resourceDomains: [FONT_ORIGIN] },
+    widgetCSP: { resource_domains: [FONT_ORIGIN] },
+};
+const register = (server, definition) => server.tool(definition, (() => ({ content: [] })));
+describe("withWidgetMetaDefaults", () => {
+    it("adds the view CSP to a view binding and the Apps SDK CSP to the widget tool's _meta", () => {
+        const { server, definitions } = recordingServer();
+        register(withWidgetMetaDefaults(server, DEFAULTS), {
+            name: "x_show_thing",
+            ...showToolBinding("x_show_thing", "Thing"),
+        });
+        const [definition] = definitions;
+        expect(definition.view).toEqual({
+            name: "x_show_thing",
+            description: "Thing",
+            prefersBorder: true,
+            csp: { resourceDomains: [FONT_ORIGIN] },
+        });
+        expect(definition._meta?.["openai/widgetCSP"]).toEqual({ resource_domains: [FONT_ORIGIN] });
+        expect(definition._meta?.["openai/outputTemplate"]).toBe("ui://views/x_show_thing.html");
+    });
+    it("keeps what a tool states itself first and appends each default origin once", () => {
+        const { server, definitions } = recordingServer();
+        const own = {
+            name: "x_show_map",
+            view: {
+                name: "x_show_map",
+                csp: {
+                    resourceDomains: ["https://tiles.example", FONT_ORIGIN],
+                    connectDomains: ["https://api.example"],
+                },
+            },
+            _meta: {
+                "openai/outputTemplate": "ui://views/x_show_map.html",
+                "openai/widgetCSP": { resource_domains: ["https://tiles.example"] },
+            },
+        };
+        register(withWidgetMetaDefaults(server, DEFAULTS), own);
+        const [definition] = definitions;
+        expect(definition.view?.csp).toEqual({
+            resourceDomains: ["https://tiles.example", FONT_ORIGIN],
+            connectDomains: ["https://api.example"],
+        });
+        expect(definition._meta?.["openai/widgetCSP"]).toEqual({
+            resource_domains: ["https://tiles.example", FONT_ORIGIN],
+        });
+        // A copy: the caller's definition is untouched.
+        expect(own.view?.csp?.resourceDomains).toEqual(["https://tiles.example", FONT_ORIGIN]);
+        expect(own._meta?.["openai/widgetCSP"]).toEqual({ resource_domains: ["https://tiles.example"] });
+        expect(definition).not.toBe(own);
+    });
+    it("leaves app-only feeds and plain tools as they are — nothing renders them", () => {
+        const { server, definitions } = recordingServer();
+        const bound = withWidgetMetaDefaults(server, DEFAULTS);
+        const feed = { name: "x_thing_data", ...appOnly };
+        const plain = { name: "x_list_things", description: "Lists things." };
+        register(bound, feed);
+        register(bound, plain);
+        expect(definitions).toEqual([feed, plain]);
+        expect(definitions[0]._meta).toEqual({ "openai/widgetAccessible": true });
+    });
+    it("applies each half on its own: a view CSP without an Apps SDK CSP and the other way round", () => {
+        const { server, definitions } = recordingServer();
+        const binding = showToolBinding("x_show_a", "A");
+        register(withWidgetMetaDefaults(server, { viewCsp: DEFAULTS.viewCsp }), {
+            name: "x_show_a",
+            ...binding,
+        });
+        register(withWidgetMetaDefaults(server, { widgetCSP: DEFAULTS.widgetCSP }), {
+            name: "x_show_a",
+            ...binding,
+        });
+        expect(definitions[0].view?.csp).toEqual({ resourceDomains: [FONT_ORIGIN] });
+        expect(definitions[0]._meta?.["openai/widgetCSP"]).toBeUndefined();
+        expect(definitions[1].view?.csp).toBeUndefined();
+        expect(definitions[1]._meta?.["openai/widgetCSP"]).toEqual({ resource_domains: [FONT_ORIGIN] });
+    });
+    it("is the server itself without defaults (or with empty ones)", () => {
+        const { server } = recordingServer();
+        expect(withWidgetMetaDefaults(server, undefined)).toBe(server);
+        expect(withWidgetMetaDefaults(server, {})).toBe(server);
+        expect(withWidgetMetaDefaults(server, { viewCsp: { resourceDomains: [] }, widgetCSP: {} })).toBe(server);
+        expect(withWidgetMetaDefaults(server, {
+            viewCsp: { resourceDomains: undefined },
+            widgetCSP: { resource_domains: undefined },
+        })).toBe(server);
+    });
+    it("forwards every other member to the real server, bound to it", () => {
+        const { server } = recordingServer();
+        const bound = withWidgetMetaDefaults(server, DEFAULTS);
+        register(bound, { name: "x_list" });
+        expect(bound.basePath).toBe("/mcp");
+        const { describe: describeServer } = bound;
+        expect(describeServer()).toBe("/mcp with 1 tools");
+    });
+});
+describe("honorWidgetMetaDefaults", () => {
+    it("hands the plugin's registerWidgetTools a server that applies the toolkit's defaults", () => {
+        const { server, definitions } = recordingServer();
+        const seen = [];
+        const plugin = {
+            definition: { name: "x", steps: [], widgets: [] },
+            registerWidgetTools: (target, defaults) => {
+                seen.push(defaults);
+                register(target, { name: "x_show_thing", ...showToolBinding("x_show_thing", "Thing") });
+            },
+        };
+        honorWidgetMetaDefaults(plugin).registerWidgetTools(server, DEFAULTS);
+        expect(seen).toEqual([DEFAULTS]);
+        expect(definitions[0].view?.csp).toEqual({ resourceDomains: [FONT_ORIGIN] });
+    });
+    it("keeps a class-based plugin whole: prototype hooks, one shared `this`, private fields", () => {
+        const { server, definitions } = recordingServer();
+        class BillingPlugin {
+            definition = { name: "billing", steps: [], widgets: [] };
+            appConfig = { region: "eu" };
+            #client = "billing-client";
+            registeredWith;
+            registerTools(target) {
+                this.registeredWith = this.#client;
+                register(target, { name: "billing_list_invoices" });
+            }
+            registerWidgetTools(target) {
+                register(target, {
+                    name: "billing_show_invoice",
+                    description: `${this.#client} after ${this.registeredWith}`,
+                    ...showToolBinding("billing_show_invoice", "Invoice"),
+                });
+            }
+        }
+        const plugin = new BillingPlugin();
+        const wrapped = honorWidgetMetaDefaults(plugin);
+        // The toolkit reads both hooks off the plugin and calls them as methods.
+        wrapped.registerTools?.(server);
+        wrapped.registerWidgetTools?.(server, DEFAULTS);
+        expect(definitions.map((definition) => definition.name)).toEqual([
+            "billing_list_invoices",
+            "billing_show_invoice",
+        ]);
+        // registerTools wrote to the plugin itself; registerWidgetTools read it back there.
+        expect(plugin.registeredWith).toBe("billing-client");
+        expect(definitions[1].description).toBe("billing-client after billing-client");
+        expect(definitions[1].view?.csp).toEqual({ resourceDomains: [FONT_ORIGIN] });
+        expect(wrapped.definition).toBe(plugin.definition);
+        expect(wrapped.appConfig).toBe(plugin.appConfig);
+        expect(wrapped).toBeInstanceOf(BillingPlugin);
+    });
+    it("calls a method-shorthand hook on the plugin itself, even on a frozen plugin", () => {
+        const { server, definitions } = recordingServer();
+        const plugin = Object.freeze({
+            definition: { name: "z", steps: [], widgets: [] },
+            toolName: "z_show_thing",
+            registerWidgetTools(target) {
+                register(target, { name: this.toolName, ...showToolBinding(this.toolName, "Thing") });
+            },
+        });
+        honorWidgetMetaDefaults(plugin).registerWidgetTools?.(server, DEFAULTS);
+        expect(definitions[0].name).toBe("z_show_thing");
+        expect(definitions[0].view?.csp).toEqual({ resourceDomains: [FONT_ORIGIN] });
+    });
+    it("passes a plugin without widget tools through unchanged", () => {
+        const registerTools = vi.fn();
+        const plugin = {
+            definition: { name: "y", steps: [], widgets: [] },
+            registerTools,
+        };
+        expect(honorWidgetMetaDefaults(plugin)).toBe(plugin);
+    });
+});
+describe("mergeDomainLists", () => {
+    it("appends each default list to the tool's own, each entry once, and skips empty ones", () => {
+        expect(mergeDomainLists({ a: ["1"], b: ["2"] }, { a: ["1", "3"], c: ["4"], d: [], e: undefined })).toEqual({ a: ["1", "3"], b: ["2"], c: ["4"] });
+        expect(mergeDomainLists(undefined, { a: ["1"] })).toEqual({ a: ["1"] });
+    });
+});
+//# sourceMappingURL=widget-meta-defaults.test.js.map

package/dist/widget-meta-defaults.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-meta-defaults.test.js","sourceRoot":"","sources":["../src/widget-meta-defaults.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAGjD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACpE,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,GAEvB,MAAM,2BAA2B,CAAA;AAQlC,0FAA0F;AAC1F,SAAS,eAAe;IACtB,MAAM,WAAW,GAAiB,EAAE,CAAA;IACpC,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,MAAM;QAChB,IAAI,CAAC,UAAsB;YACzB,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAC5B,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAA;QAClC,CAAC;QACD,QAAQ;YACN,OAAO,GAAG,IAAI,CAAC,QAAQ,SAAS,WAAW,CAAC,MAAM,QAAQ,CAAA;QAC5D,CAAC;KACF,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,MAA8B,EAAE,WAAW,EAAE,CAAA;AAChE,CAAC;AAED,MAAM,WAAW,GAAG,yBAAyB,CAAA;AAC7C,MAAM,QAAQ,GAAuB;IACnC,OAAO,EAAE,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE;IAC3C,SAAS,EAAE,EAAE,gBAAgB,EAAE,CAAC,WAAW,CAAC,EAAE;CAC/C,CAAA;AAED,MAAM,QAAQ,GAAG,CAAC,MAAiB,EAAE,UAAsB,EAAE,EAAE,CAC7D,MAAM,CAAC,IAAI,CAAC,UAAmB,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAU,CAAC,CAAA;AAEtE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,QAAQ,CAAC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE;YACjD,IAAI,EAAE,cAAc;YACpB,GAAG,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC;SAC5C,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC9B,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE;SACxC,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC3F,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,uBAAuB,CAAC,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,GAAG,GAAe;YACtB,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE;gBACJ,IAAI,EAAE,YAAY;gBAClB,GAAG,EAAE;oBACH,eAAe,EAAE,CAAC,uBAAuB,EAAE,WAAW,CAAC;oBACvD,cAAc,EAAE,CAAC,qBAAqB,CAAC;iBACxC;aACF;YACD,KAAK,EAAE;gBACL,uBAAuB,EAAE,4BAA4B;gBACrD,kBAAkB,EAAE,EAAE,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE;aACpE;SACF,CAAA;QACD,QAAQ,CAAC,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAA;QACvD,MAAM,CAAC,UAAU,CAAC,GAAG,WAAW,CAAA;QAChC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;YACnC,eAAe,EAAE,CAAC,uBAAuB,EAAE,WAAW,CAAC;YACvD,cAAc,EAAE,CAAC,qBAAqB,CAAC;SACxC,CAAC,CAAA;QACF,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC;YACrD,gBAAgB,EAAE,CAAC,uBAAuB,EAAE,WAAW,CAAC;SACzD,CAAC,CAAA;QACF,gDAAgD;QAChD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,CAAA;QACtF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAA;QAChG,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtD,MAAM,IAAI,GAAe,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,OAAO,EAAE,CAAA;QAC7D,MAAM,KAAK,GAAe,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,CAAA;QACjF,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QACrB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACtB,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAC1C,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0FAA0F,EAAE,GAAG,EAAE;QAClG,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;QAChD,QAAQ,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE;YACtE,IAAI,EAAE,UAAU;YAChB,GAAG,OAAO;SACX,CAAC,CAAA;QACF,QAAQ,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE;YAC1E,IAAI,EAAE,UAAU;YAChB,GAAG,OAAO;SACX,CAAC,CAAA;QACF,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,aAAa,EAAE,CAAA;QAClE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,aAAa,EAAE,CAAA;QAChD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,gBAAgB,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IACjG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAA;QACpC,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9D,MAAM,CAAC,sBAAsB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACvD,MAAM,CACJ,sBAAsB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACpF,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACd,MAAM,CACJ,sBAAsB,CAAC,MAAM,EAAE;YAC7B,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE;YACvC,SAAS,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE;SAC3C,CAAC,CACH,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAChB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,EAAE,CAAA;QACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,MAAM,EAAE,QAAQ,CAGpD,CAAA;QACD,QAAQ,CAAC,KAA6B,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAA;QAC3D,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACnC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,KAAK,CAAA;QAC1C,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;QAC7F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,IAAI,GAAc,EAAE,CAAA;QAC1B,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,mBAAmB,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;gBACxC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACnB,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,eAAe,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YACzF,CAAC;SACF,CAAA;QACD,uBAAuB,CAAC,MAAM,CAAC,CAAC,mBAAoB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACtE,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QAChC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,aAAa;YACjB,UAAU,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;YACxD,SAAS,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;YACnB,OAAO,GAAG,gBAAgB,CAAA;YACnC,cAAc,CAAoB;YAClC,aAAa,CAAC,MAAiB;gBAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,OAAO,CAAA;gBAClC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAA;YACrD,CAAC;YACD,mBAAmB,CAAC,MAAiB;gBACnC,QAAQ,CAAC,MAAM,EAAE;oBACf,IAAI,EAAE,sBAAsB;oBAC5B,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,IAAI,CAAC,cAAc,EAAE;oBAC3D,GAAG,eAAe,CAAC,sBAAsB,EAAE,SAAS,CAAC;iBACtD,CAAC,CAAA;YACJ,CAAC;SACF;QACD,MAAM,MAAM,GAAG,IAAI,aAAa,EAAE,CAAA;QAClC,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAA;QAC/C,yEAAyE;QACzE,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAA;QAC/B,OAAO,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC/C,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/D,uBAAuB;YACvB,sBAAsB;SACvB,CAAC,CAAA;QACF,oFAAoF;QACpF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QACpD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAA;QAC9E,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAChD,MAAM,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,aAAa,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAAA;QACjD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,QAAQ,EAAE,cAAc;YACxB,mBAAmB,CAAC,MAAiB;gBACnC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAA;YACvF,CAAC;SACF,CAAC,CAAA;QACF,uBAAuB,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QACvE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAChD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAA;QAC7B,MAAM,MAAM,GAAyB;YACnC,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;YACjD,aAAa;SACd,CAAA;QACD,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,CACJ,gBAAgB,CACd,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EACtB,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CACjD,CACF,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAChD,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACzE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/widget-tool-bindings.d.ts

@@ -0,0 +1,71 @@
+import { z } from "zod";
+/**
+ * The two spreads every module's raw `server.tool()` widget registrations
+ * compose — the wire-contract halves of architecture invariant 5. One
+ * implementation for all modules (they were byte-identical copies before):
+ * a module that hand-rolls these drifts out of the widget-contract e2e test's
+ * expectations on the first mcp-use change.
+ */
+/**
+ * View binding + Apps-SDK `_meta` half for a widget-RENDERING (model-visible)
+ * tool — spread into the `server.tool` definition of every `show_*` tool. The
+ * view name IS the tool name: mcp-use derives the entire MCP Apps half of the
+ * wire contract (`_meta.ui.resourceUri`, flat `ui/resourceUri`, resource CSP)
+ * from the first-class `view` binding — never stamp `ui` keys by hand, mcp-use
+ * overwrites that namespace on `tools/list`. What mcp-use does NOT derive is
+ * the OpenAI Apps SDK half (`openai/*`): `appsSdkMeta` builds it, pointing
+ * `openai/outputTemplate` at the same `ui://views/<name>.html` resource. The
+ * `outputSchema` is required by mcp-use for any view-bound tool; `passthrough`
+ * matches the free-form `structuredContent` the view builders return without
+ * stripping keys on SDK-side validation.
+ *
+ * The view resource carries its title as `description` (hosts that list
+ * resources show it) and asks the host for a border (`prefersBorder`, owner
+ * decision 2026-10-12, #344 N159): the cards draw none of their own, so a
+ * frame sets them off from the chat around them.
+ */
+export declare function showToolBinding(name: string, title: string): {
+    view: {
+        name: string;
+        description: string;
+        prefersBorder: boolean;
+    };
+    outputSchema: z.ZodObject<{}, z.core.$loose>;
+    _meta: Record<string, unknown>;
+};
+/**
+ * The strict input schema every raw `server.tool()` registration declares —
+ * the twin of the toolkit registrar's `strictInput` option for the widget
+ * path, which registers outside the registrar. A non-strict `z.object` lets
+ * mcp-use STRIP an unknown key before the handler runs: a misnamed optional
+ * filter then silently widens the result (#329). Strict, the schema is
+ * advertised with `additionalProperties: false`, and an unknown key fails
+ * validation with the toolkit's own message — every unknown key plus every
+ * valid one — as an `isError` result the model can correct in one retry.
+ *
+ * The message mirrors the toolkit's `unknownKeysMessage` (not exported);
+ * `widget-tool-bindings.test.ts` pins the two to the same text.
+ */
+export declare function strictToolInput<TShape extends z.ZodRawShape>(shape: TShape): z.ZodObject<{ -readonly [P in keyof TShape]: TShape[P]; }, z.core.$strict>;
+/**
+ * App-only marker for the internal `*_data` feeds — spread into each feed's
+ * `server.tool` definition. `visibility: "app"` is mcp-use 2's first-class
+ * field (emitted as SEP-1865 `_meta.ui.visibility: ["app"]`): conforming hosts
+ * hide these tools from the LLM tool surface while keeping them callable from
+ * widgets via `callTool`; the "Internal JSON feed" descriptions stay as
+ * fallback for non-conforming hosts. Deliberately no `view` binding — the
+ * feeds must return JSON, not render UI.
+ *
+ * `openai/widgetAccessible` covers the Apps-SDK half of the dual contract:
+ * those hosts only allow in-widget callTool on tools carrying the key — a
+ * feed without it renders fine but every pagination/search/refresh is denied.
+ * The key does NOT render anything (no outputTemplate), so the feeds stay
+ * JSON-only. mcp-use passes non-`ui` `_meta` entries through untouched.
+ */
+export declare const appOnly: {
+    visibility: "app";
+    _meta: {
+        "openai/widgetAccessible": boolean;
+    };
+};
+//# sourceMappingURL=widget-tool-bindings.d.ts.map

package/dist/widget-tool-bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-tool-bindings.d.ts","sourceRoot":"","sources":["../src/widget-tool-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM;;;;;;;;EAM1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,8EAM1E;AAUD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;;;;;CAGnB,CAAA"}

package/dist/widget-tool-bindings.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { appsSdkMeta, viewResourceUri } from "@miragon/mcp-toolkit-core";
+/**
+ * The two spreads every module's raw `server.tool()` widget registrations
+ * compose — the wire-contract halves of architecture invariant 5. One
+ * implementation for all modules (they were byte-identical copies before):
+ * a module that hand-rolls these drifts out of the widget-contract e2e test's
+ * expectations on the first mcp-use change.
+ */
+/**
+ * View binding + Apps-SDK `_meta` half for a widget-RENDERING (model-visible)
+ * tool — spread into the `server.tool` definition of every `show_*` tool. The
+ * view name IS the tool name: mcp-use derives the entire MCP Apps half of the
+ * wire contract (`_meta.ui.resourceUri`, flat `ui/resourceUri`, resource CSP)
+ * from the first-class `view` binding — never stamp `ui` keys by hand, mcp-use
+ * overwrites that namespace on `tools/list`. What mcp-use does NOT derive is
+ * the OpenAI Apps SDK half (`openai/*`): `appsSdkMeta` builds it, pointing
+ * `openai/outputTemplate` at the same `ui://views/<name>.html` resource. The
+ * `outputSchema` is required by mcp-use for any view-bound tool; `passthrough`
+ * matches the free-form `structuredContent` the view builders return without
+ * stripping keys on SDK-side validation.
+ *
+ * The view resource carries its title as `description` (hosts that list
+ * resources show it) and asks the host for a border (`prefersBorder`, owner
+ * decision 2026-10-12, #344 N159): the cards draw none of their own, so a
+ * frame sets them off from the chat around them.
+ */
+export function showToolBinding(name, title) {
+    return {
+        view: { name, description: title, prefersBorder: true },
+        outputSchema: z.object({}).passthrough(),
+        _meta: appsSdkMeta({ resourceUri: viewResourceUri(name), title }),
+    };
+}
+/**
+ * The strict input schema every raw `server.tool()` registration declares —
+ * the twin of the toolkit registrar's `strictInput` option for the widget
+ * path, which registers outside the registrar. A non-strict `z.object` lets
+ * mcp-use STRIP an unknown key before the handler runs: a misnamed optional
+ * filter then silently widens the result (#329). Strict, the schema is
+ * advertised with `additionalProperties: false`, and an unknown key fails
+ * validation with the toolkit's own message — every unknown key plus every
+ * valid one — as an `isError` result the model can correct in one retry.
+ *
+ * The message mirrors the toolkit's `unknownKeysMessage` (not exported);
+ * `widget-tool-bindings.test.ts` pins the two to the same text.
+ */
+export function strictToolInput(shape) {
+    const valid = Object.keys(shape);
+    return z.strictObject(shape, {
+        error: (issue) => issue.code === "unrecognized_keys" ? unknownKeysMessage(issue.keys, valid) : undefined,
+    });
+}
+function unknownKeysMessage(unknown, valid) {
+    const quote = (keys) => keys.map((key) => JSON.stringify(key)).join(", ");
+    const head = `Unknown key${unknown.length === 1 ? "" : "s"} ${quote(unknown)}.`;
+    return valid.length === 0
+        ? `${head} This tool takes no arguments.`
+        : `${head} Valid keys: ${quote(valid)}.`;
+}
+/**
+ * App-only marker for the internal `*_data` feeds — spread into each feed's
+ * `server.tool` definition. `visibility: "app"` is mcp-use 2's first-class
+ * field (emitted as SEP-1865 `_meta.ui.visibility: ["app"]`): conforming hosts
+ * hide these tools from the LLM tool surface while keeping them callable from
+ * widgets via `callTool`; the "Internal JSON feed" descriptions stay as
+ * fallback for non-conforming hosts. Deliberately no `view` binding — the
+ * feeds must return JSON, not render UI.
+ *
+ * `openai/widgetAccessible` covers the Apps-SDK half of the dual contract:
+ * those hosts only allow in-widget callTool on tools carrying the key — a
+ * feed without it renders fine but every pagination/search/refresh is denied.
+ * The key does NOT render anything (no outputTemplate), so the feeds stay
+ * JSON-only. mcp-use passes non-`ui` `_meta` entries through untouched.
+ */
+export const appOnly = {
+    visibility: "app",
+    _meta: { "openai/widgetAccessible": true },
+};
+//# sourceMappingURL=widget-tool-bindings.js.map

package/dist/widget-tool-bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-tool-bindings.js","sourceRoot":"","sources":["../src/widget-tool-bindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AACvB,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAExE;;;;;;GAMG;AAEH;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,OAAO;QACL,IAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE;QACvD,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE;QACxC,KAAK,EAAE,WAAW,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC;KAClE,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAA+B,KAAa;IACzE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChC,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE;QAC3B,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CACf,KAAK,CAAC,IAAI,KAAK,mBAAmB,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;KACzF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B,EAAE,KAAwB;IAC9E,MAAM,KAAK,GAAG,CAAC,IAAuB,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC5F,MAAM,IAAI,GAAG,cAAc,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAA;IAC/E,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC;QACvB,CAAC,CAAC,GAAG,IAAI,gCAAgC;QACzC,CAAC,CAAC,GAAG,IAAI,gBAAgB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,UAAU,EAAE,KAAc;IAC1B,KAAK,EAAE,EAAE,yBAAyB,EAAE,IAAI,EAAE;CAC3C,CAAA"}

package/dist/widget-tool-bindings.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=widget-tool-bindings.test.d.ts.map

package/dist/widget-tool-bindings.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-tool-bindings.test.d.ts","sourceRoot":"","sources":["../src/widget-tool-bindings.test.ts"],"names":[],"mappings":""}

package/dist/widget-tool-bindings.test.js

@@ -0,0 +1,83 @@
+import { describe, expect, it } from "vitest";
+import { z } from "zod";
+import { createToolRegistrar } from "@miragon/mcp-toolkit-core/tools";
+import { appOnly, showToolBinding, strictToolInput } from "./widget-tool-bindings.js";
+describe("showToolBinding", () => {
+    it("binds the view to the tool name and stamps the Apps-SDK _meta half", () => {
+        const binding = showToolBinding("camunda7_show_thing", "Thing");
+        expect(binding.view).toEqual({
+            name: "camunda7_show_thing",
+            description: "Thing",
+            prefersBorder: true,
+        });
+        expect(binding._meta).toMatchObject({
+            "openai/outputTemplate": "ui://views/camunda7_show_thing.html",
+            "openai/widgetAccessible": true,
+        });
+    });
+    it("carries a passthrough outputSchema (mcp-use requires one for view-bound tools)", () => {
+        const binding = showToolBinding("t", "T");
+        // Free-form structuredContent must survive SDK-side validation unstripped.
+        expect(binding.outputSchema.parse({ anything: 1, nested: { x: true } })).toEqual({
+            anything: 1,
+            nested: { x: true },
+        });
+    });
+});
+describe("appOnly", () => {
+    it("marks the tool app-only + widget-accessible, without any rendering keys", () => {
+        expect(appOnly.visibility).toBe("app");
+        expect(appOnly._meta).toEqual({ "openai/widgetAccessible": true });
+        // No view binding and no outputTemplate — a feed result must never be
+        // rendered by the host (invariant 5).
+        expect(appOnly).not.toHaveProperty("view");
+    });
+});
+describe("strictToolInput", () => {
+    const shape = { processDefinitionKey: z.string().optional(), engine: z.string().optional() };
+    /** The input schema the toolkit registrar advertises for `input` with `strictInput`. */
+    function registrarSchema(input) {
+        let schema;
+        const server = {
+            tool: (definition) => {
+                schema = definition.inputSchema;
+            },
+        };
+        createToolRegistrar(server, null, { strictInput: true })({
+            name: "probe",
+            description: "probe",
+            inputSchema: input,
+            handler: () => Promise.resolve(null),
+        });
+        if (!schema)
+            throw new Error("the registrar registered nothing");
+        return schema;
+    }
+    const failure = (schema, args) => {
+        const result = schema.safeParse(args);
+        if (result.success)
+            throw new Error("expected a validation failure");
+        return result.error.issues.map((issue) => issue.message);
+    };
+    it("rejects an unknown key, naming it and every valid key", () => {
+        expect(failure(strictToolInput(shape), { processDefinitionKeyIn: "a" })).toEqual([
+            'Unknown key "processDefinitionKeyIn". Valid keys: "processDefinitionKey", "engine".',
+        ]);
+    });
+    it("reports exactly the registrar's message (the widget path matches the registrar path)", () => {
+        for (const args of [{ bogus: 1 }, { a: 1, b: 2, engine: "x" }]) {
+            expect(failure(strictToolInput(shape), args)).toEqual(failure(registrarSchema(shape), args));
+        }
+        expect(failure(strictToolInput({}), { x: 1 })).toEqual(failure(registrarSchema({}), { x: 1 }));
+    });
+    it("keeps valid input and other validation messages untouched", () => {
+        expect(strictToolInput(shape).parse({ engine: "a" })).toEqual({ engine: "a" });
+        expect(failure(strictToolInput(shape), { engine: 1 })[0]).not.toMatch(/Unknown key/);
+    });
+    it("advertises additionalProperties: false", () => {
+        expect(z.toJSONSchema(strictToolInput(shape), { io: "input" })).toMatchObject({
+            additionalProperties: false,
+        });
+    });
+});
+//# sourceMappingURL=widget-tool-bindings.test.js.map

package/dist/widget-tool-bindings.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"widget-tool-bindings.test.js","sourceRoot":"","sources":["../src/widget-tool-bindings.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAA;AACrE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAErF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,OAAO,GAAG,eAAe,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAA;QAC/D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC3B,IAAI,EAAE,qBAAqB;YAC3B,WAAW,EAAE,OAAO;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;QACF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,aAAa,CAAC;YAClC,uBAAuB,EAAE,qCAAqC;YAC9D,yBAAyB,EAAE,IAAI;SAChC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QACzC,2EAA2E;QAC3E,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/E,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE;SACpB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE;IACvB,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAA;QAClE,sEAAsE;QACtE,sCAAsC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,KAAK,GAAG,EAAE,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAA;IAE5F,wFAAwF;IACxF,SAAS,eAAe,CAAC,KAAgC;QACvD,IAAI,MAA6B,CAAA;QACjC,MAAM,MAAM,GAAG;YACb,IAAI,EAAE,CAAC,UAAsC,EAAE,EAAE;gBAC/C,MAAM,GAAG,UAAU,CAAC,WAAW,CAAA;YACjC,CAAC;SACsB,CAAA;QACzB,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,WAAW,EAAE,KAAK;YAClB,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;SACrC,CAAC,CAAA;QACF,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QAChE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAE,IAAa,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QACpE,OAAO,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC1D,CAAC,CAAA;IAED,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/E,qFAAqF;SACtF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,KAAK,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;QAC9F,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAChG,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9E,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACtF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC;YAC5E,oBAAoB,EAAE,KAAK;SAC5B,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/with-tool-errors.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=with-tool-errors.test.d.ts.map

package/dist/with-tool-errors.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-tool-errors.test.d.ts","sourceRoot":"","sources":["../src/with-tool-errors.test.ts"],"names":[],"mappings":""}

package/dist/with-tool-errors.test.js

@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { withToolErrors } from "./server.js";
+class CodedError extends Error {
+    code = "ENGINE_NOT_SELECTED";
+}
+describe("withToolErrors", () => {
+    it("passes successful results through untouched", async () => {
+        const result = { content: [{ type: "text", text: "ok" }] };
+        const wrapped = withToolErrors(() => Promise.resolve(result));
+        await expect(wrapped()).resolves.toBe(result);
+    });
+    it("forwards the handler arguments", async () => {
+        const wrapped = withToolErrors((args) => Promise.resolve(args.a * 2));
+        await expect(wrapped({ a: 21 })).resolves.toBe(42);
+    });
+    it("converts a coded exception to the registrar's `[code] message` error result", async () => {
+        const wrapped = withToolErrors(() => Promise.reject(new CodedError("No engine selected for this session.")));
+        const result = (await wrapped());
+        expect(result.isError).toBe(true);
+        expect(result.content[0].text).toBe("[ENGINE_NOT_SELECTED] No engine selected for this session.");
+    });
+    it("prefers an HTTP-ish `status` over `code`, matching the toolkit registrar", async () => {
+        const e = Object.assign(new Error("boom"), { status: 404, code: "IGNORED" });
+        const wrapped = withToolErrors(() => Promise.reject(e));
+        const result = (await wrapped());
+        expect(result.content[0].text).toBe("[404] boom");
+    });
+    it("handles plain errors and non-Error throwables without a code prefix", async () => {
+        const plain = withToolErrors(() => Promise.reject(new Error("plain failure")));
+        // Non-Error rejection on purpose: the wrapper must stringify whatever a
+        // misbehaving handler throws instead of crashing on it.
+        // eslint-disable-next-line @typescript-eslint/prefer-promise-reject-errors
+        const thrownString = withToolErrors(() => Promise.reject("string failure"));
+        expect((await plain()).content[0].text).toBe("plain failure");
+        expect((await thrownString()).content[0].text).toBe("string failure");
+    });
+});
+//# sourceMappingURL=with-tool-errors.test.js.map

package/dist/with-tool-errors.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"with-tool-errors.test.js","sourceRoot":"","sources":["../src/with-tool-errors.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAE5C,MAAM,UAAW,SAAQ,KAAK;IACnB,IAAI,GAAG,qBAAqB,CAAA;CACtC;AAED,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAe,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;QACnE,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;QAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,IAAmB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QACpF,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAClC,OAAO,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC,CACvE,CAAA;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,EAAE,CAAuD,CAAA;QACtF,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACjC,4DAA4D,CAC7D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;QAC5E,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAA;QACvD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,EAAE,CAAoC,CAAA;QACnE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;QAC9E,wEAAwE;QACxE,wDAAwD;QACxD,2EAA2E;QAC3E,MAAM,YAAY,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAE,CAAC,MAAM,KAAK,EAAE,CAAqC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAC/E,eAAe,CAChB,CAAA;QACD,MAAM,CAAE,CAAC,MAAM,YAAY,EAAE,CAAqC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CACtF,gBAAgB,CACjB,CAAA;IACH,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,116 @@
 {
   "name": "@miragon/pulse-widget-shell",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.22.0",
+  "description": "Shared widget kit for Pulse MCP Apps: UI primitives, view + data-feed builders, and the shell:* widget catalogue.",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "mcp-apps",
+    "widgets",
+    "react",
+    "ui",
+    "camunda"
+  ],
+  "homepage": "https://github.com/Miragon/pulse/tree/main/packages/core/widget-shell#readme",
+  "bugs": "https://github.com/Miragon/pulse/issues",
+  "engines": {
+    "node": ">=22.22.2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Miragon/pulse.git",
+    "directory": "packages/core/widget-shell"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./ui": {
+      "types": "./dist/adapt-data-widget.d.ts",
+      "import": "./dist/adapt-data-widget.js"
+    },
+    "./widgets": {
+      "types": "./dist/ui/index.d.ts",
+      "import": "./dist/ui/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@miragon/mcp-toolkit-core": "~2.8.1",
+    "@miragon/mcp-toolkit-ui": "~2.8.1",
+    "@tanstack/react-query": "5.102.8",
+    "bpmn-js": "18.31.0",
+    "lucide-react": "^0.562.0 || ^1.0.0",
+    "mcp-use": "2.7.3",
+    "postgres": "3.4.9",
+    "react": "^19.2.0",
+    "react-dom": "^19.2.0",
+    "typescript": ">=5.0.0",
+    "zod": "^4.4.0"
+  },
+  "peerDependenciesMeta": {
+    "@miragon/mcp-toolkit-ui": {
+      "optional": true
+    },
+    "@tanstack/react-query": {
+      "optional": true
+    },
+    "lucide-react": {
+      "optional": true
+    },
+    "postgres": {
+      "optional": true
+    },
+    "react": {
+      "optional": true
+    },
+    "react-dom": {
+      "optional": true
+    },
+    "typescript": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@miragon/mcp-toolkit-core": "2.8.1",
+    "@miragon/mcp-toolkit-ui": "2.8.1",
+    "@stryker-mutator/core": "10.0.0",
+    "@stryker-mutator/vitest-runner": "10.0.0",
+    "@testing-library/react": "16.3.3",
+    "@types/react": "19.3.0",
+    "bpmn-js": "18.31.0",
+    "happy-dom": "21.0.4",
+    "lucide-react": "1.61.0",
+    "mcp-use": "2.7.3",
+    "postgres": "3.4.9",
+    "react": "19.3.1",
+    "react-dom": "19.3.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11",
+    "zod": "4.6.7"
+  },
+  "dependencies": {
+    "@fontsource-variable/geist": "5.3.0",
+    "@fontsource-variable/geist-mono": "5.3.0",
+    "prom-client": "15.1.3"
+  },
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src",
+    "lint:fix": "eslint src --fix",
+    "test:mutation": "stryker run"
+  }
 }