@miragon/pulse-widget-shell 0.24.1 → 0.25.0

package/dist/{bpmn-names.js → protocol/bpmn-names.js}

@@ -1,19 +1,13 @@
 /**
- * THE rule every module names a BPMN process and its elements by (#322 U13):
- * one reader for the server (no DOM) and the browser alike, so camunda7,
- * analytics and the kit's heatmap never give the same process or activity two
- * different names. The Camunda Modeler names the POOL of a collaboration and
- * leaves the process unnamed, and it writes a line break, `&`, `"`, `<` or
- * `>` in a name as a character reference (`&#10;`, `&#38;` …): a reader that
- * knew only the process element or only the five named entities would show
- * the key or the raw reference instead.
+ * One BPMN name reader for server and browser, so no two modules name a process differently.
+ * The Camunda Modeler names the POOL, not the process, and writes `&`, line breaks etc. as numeric
+ * character references; a reader that missed either would show the key or the raw reference.
  */
-/** A start tag: prefix, local name, and its attributes (a quoted value may hold `>`). */
+/** A quoted value may hold `>`. */
 const START_TAG = /<(?:[A-Za-z_][\w.-]*:)?([A-Za-z_][\w.-]*)((?:\s+[A-Za-z_][\w:.-]*\s*=\s*(?:"[^"]*"|'[^']*'))*)\s*\/?>/g;
 const ENTITIES = { amp: "&", lt: "<", gt: ">", quot: '"', apos: "'" };
-/** A numeric character reference's character; one past Unicode stays as written. */
+/** One past Unicode stays as written. */
 const character = (code, written) => code <= 0x10ffff ? String.fromCodePoint(code) : written;
-/** An attribute value as text: entities decoded, line breaks and runs of space folded. */
 function attributeText(raw) {
     return raw
         .replace(/&(?:#x([0-9a-f]+)|#(\d+)|(amp|lt|gt|quot|apos));/gi, (match, hex, dec, named) => {
@@ -29,12 +23,7 @@ function attributeText(raw) {
 const isSpace = (c) => c === " " || c === "\t" || c === "\n" || c === "\r";
 const NAME_CHAR = /[\w:.-]/;
 const NAME_START = /^[A-Za-z_]/;
-/**
- * The `name="value"` / `name='value'` pairs of a start tag, read by a linear
- * tokenizer: a global attribute regex rescans from every position of a run
- * without `=` (CodeQL js/polynomial-redos), and the XML comes from an engine.
- * Every step advances, so malformed input ends the loop too.
- */
+/** A linear tokenizer: a global attribute regex is polynomial ReDoS on engine-supplied XML. */
 function attributesOf(raw) {
     const out = {};
     let at = 0;
@@ -71,15 +60,10 @@ const SKIPPED_SECTIONS = [
     { open: "<![CDATA[", close: "]]>" },
 ];
 /**
- * The document without its comments and CDATA sections, cut by a linear
- * scan instead of a lazy regex (CodeQL js/polynomial-redos and
- * js/incomplete-multi-character-sanitization: the XML comes from an engine).
- * An unterminated section swallows the rest of the document, so no opener
- * ever survives.
+ * A linear scan instead of a lazy regex (CodeQL ReDoS, incomplete sanitization). An unterminated
+ * section swallows the rest, so no opener survives.
  */
 function withoutCommentsAndCdata(xml) {
-    // Each opener's next position is searched again only once the scan has
-    // passed it, so the whole cut stays linear in the document's length.
     const nextOpen = SKIPPED_SECTIONS.map((section) => xml.indexOf(section.open));
     let out = "";
     let at = 0;
@@ -101,14 +85,7 @@ function withoutCommentsAndCdata(xml) {
         at = end + close.length;
     }
 }
-/**
- * Every name in one BPMN 2.0 XML document, read without a DOM: each
- * `<process id=… name=…>` (or, when the process has no name, the name of the
- * pool — `<participant processRef=…>` — that holds it) and every other
- * element with an `id` and a non-empty `name`. Comments and CDATA are
- * skipped, any namespace prefix is accepted. A document that is not BPMN
- * yields no names, never an error.
- */
+/** A document that is not BPMN yields no names, never an error. */
 export function readBpmnNames(xml) {
     const text = withoutCommentsAndCdata(xml);
     const own = {};
@@ -133,17 +110,11 @@ export function readBpmnNames(xml) {
     }
     return { processes: { ...pools, ...own }, elements };
 }
-/** The name {@link readBpmnNames} found for process `processDefinitionKey`, or null. */
 export function bpmnProcessNameOf(names, processDefinitionKey) {
     return Object.hasOwn(names.processes, processDefinitionKey)
         ? names.processes[processDefinitionKey]
         : null;
 }
-/**
- * The names of process `processDefinitionKey` in one BPMN 2.0 XML document:
- * its own name (else its pool's) and every named element
- * ({@link readBpmnNames}).
- */
 export function parseBpmnNames(xml, processDefinitionKey) {
     const names = readBpmnNames(xml);
     return { name: bpmnProcessNameOf(names, processDefinitionKey), elements: names.elements };

package/dist/protocol/bpmn-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bpmn-names.js","sourceRoot":"","sources":["../../src/protocol/bpmn-names.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,mCAAmC;AACnC,MAAM,SAAS,GACb,wGAAwG,CAAA;AAE1G,MAAM,QAAQ,GAA2B,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,CAAA;AAE7F,yCAAyC;AACzC,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,EAAE,CAClD,IAAI,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;AAEzD,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG;SACP,OAAO,CACN,oDAAoD,EACpD,CAAC,KAAa,EAAE,GAAY,EAAE,GAAY,EAAE,KAAc,EAAE,EAAE;QAC5D,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1D,IAAI,GAAG;YAAE,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;QAC1D,OAAO,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAA;IACvD,CAAC,CACF;SACA,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE,CAAA;AACX,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,CAAA;AAC9F,MAAM,SAAS,GAAG,SAAS,CAAA;AAC3B,MAAM,UAAU,GAAG,YAAY,CAAA;AAE/B,+FAA+F;AAC/F,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,EAAE,CAAA;QAChB,OAAO,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,EAAE,CAAA;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACjC,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,EAAE,CAAA;QAC7B,IAAI,GAAG,CAAC,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;YACpB,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;YAC5B,SAAQ;QACV,CAAC;QACD,EAAE,EAAE,CAAA;QACJ,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAAE,EAAE,EAAE,CAAA;QAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,CAAA;QACrB,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;YAAE,SAAQ;QAC5C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QACtC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,MAAK;QACrB,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;QAC7D,EAAE,GAAG,GAAG,GAAG,CAAC,CAAA;IACd,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE;IAC9B,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE;CAC3B,CAAA;AAEV;;;GAGG;AACH,SAAS,uBAAuB,CAAC,GAAW;IAC1C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;IAC7E,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,IAAI,EAAE,GAAG,CAAC,CAAA;IACV,SAAS,CAAC;QACR,IAAI,IAAI,GAAG,CAAC,CAAC,CAAA;QACb,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE;YACtC,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE;gBAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YACvF,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAAE,IAAI,GAAG,CAAC,CAAA;QACnF,CAAC,CAAC,CAAA;QACF,IAAI,IAAI,KAAK,CAAC,CAAC;YAAE,OAAO,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QAC3C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QAC9C,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;QACpC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5D,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,GAAG,CAAA;QAC1B,EAAE,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;IACzB,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,IAAI,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAA;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAA;IACtC,MAAM,KAAK,GAA2B,EAAE,CAAA;IACxC,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QAClB,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACtE,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI;gBAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAA;YAC5D,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI;YAAE,SAAQ;QAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;YACpB,SAAQ;QACV,CAAC;QACD,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,CAAA;IAC3B,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,KAAK,EAAE,GAAG,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAA;AACtD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAqB,EACrB,oBAA4B;IAE5B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,EAAE,oBAAoB,CAAC;QACzD,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC;QACvC,CAAC,CAAC,IAAI,CAAA;AACV,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,oBAA4B;IACtE,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,CAAA;IAChC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAA;AAC3F,CAAC"}

package/dist/protocol/served-fonts.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Dependency-free, so both `/server` and `/widgets` export it. Self-hosted on purpose
+ * (design system §4: no CDN, offline-capable, GDPR-safe).
+ */
+/** Names the fontsource release so the route can be cached `immutable`; `served-fonts.test.ts` pins it. */
+export declare const SERVED_FONT_PATH = "/fonts/geist-5.3.0";
+/** The latin variable woff2 files under {@link SERVED_FONT_PATH} (pulse-ui's `GEIST_FONT_FILES`). */
+export declare const SERVED_FONT_FILES: {
+    readonly sans: "geist-latin-wght-normal.woff2";
+    readonly mono: "geist-mono-latin-wght-normal.woff2";
+};
+/**
+ * The same origin the view's CSP admits in `resourceDomains`. `undefined` for no or a
+ * non-http(s) base: the view then declares no face and the host's font renders.
+ */
+export declare function servedFontBaseUrl(publicBase: string | undefined): string | undefined;
+//# sourceMappingURL=served-fonts.d.ts.map

package/dist/protocol/served-fonts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"served-fonts.d.ts","sourceRoot":"","sources":["../../src/protocol/served-fonts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,2GAA2G;AAC3G,eAAO,MAAM,gBAAgB,uBAAuB,CAAA;AAEpD,qGAAqG;AACrG,eAAO,MAAM,iBAAiB;;;CAGpB,CAAA;AAEV;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAUpF"}

package/dist/protocol/served-fonts.js

@@ -0,0 +1,30 @@
+/**
+ * Dependency-free, so both `/server` and `/widgets` export it. Self-hosted on purpose
+ * (design system §4: no CDN, offline-capable, GDPR-safe).
+ */
+/** Names the fontsource release so the route can be cached `immutable`; `served-fonts.test.ts` pins it. */
+export const SERVED_FONT_PATH = "/fonts/geist-5.3.0";
+/** The latin variable woff2 files under {@link SERVED_FONT_PATH} (pulse-ui's `GEIST_FONT_FILES`). */
+export const SERVED_FONT_FILES = {
+    sans: "geist-latin-wght-normal.woff2",
+    mono: "geist-mono-latin-wght-normal.woff2",
+};
+/**
+ * The same origin the view's CSP admits in `resourceDomains`. `undefined` for no or a
+ * non-http(s) base: the view then declares no face and the host's font renders.
+ */
+export function servedFontBaseUrl(publicBase) {
+    if (!publicBase)
+        return undefined;
+    let base;
+    try {
+        base = new URL(publicBase);
+    }
+    catch {
+        return undefined;
+    }
+    if (base.protocol !== "http:" && base.protocol !== "https:")
+        return undefined;
+    return `${base.origin}${SERVED_FONT_PATH}`;
+}
+//# sourceMappingURL=served-fonts.js.map

package/dist/protocol/served-fonts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"served-fonts.js","sourceRoot":"","sources":["../../src/protocol/served-fonts.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,2GAA2G;AAC3G,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAA;AAEpD,qGAAqG;AACrG,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,IAAI,EAAE,+BAA+B;IACrC,IAAI,EAAE,oCAAoC;CAClC,CAAA;AAEV;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,UAA8B;IAC9D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAA;IACjC,IAAI,IAAS,CAAA;IACb,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAA;IAC7E,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAA;AAC5C,CAAC"}

package/dist/protocol/tool-result.d.ts

@@ -0,0 +1,24 @@
+/** No React, no mcp-use: the server tests and the view runtime decode tool results the same way. */
+export interface ToolResult {
+    content?: ReadonlyArray<{
+        type: string;
+        text?: string;
+    }>;
+    structuredContent?: unknown;
+    isError?: boolean;
+}
+/**
+ * A tool's own `isError` answer (a validation error, an engine 404), not a transport failure.
+ * The message is the tool's text, so `describeError` reads it like any other failure.
+ */
+export declare class ToolResultError extends Error {
+    readonly result: ToolResult;
+    constructor(result: ToolResult);
+}
+/**
+ * `isError` throws {@link ToolResultError}; then `structuredContent` (when not null); then the
+ * first text block, JSON-decoded or as the text itself; else the result as it is. A `*_data`
+ * feed answers in its text block only, a show tool in `structuredContent`.
+ */
+export declare function decodeToolResult<T>(result: ToolResult): T;
+//# sourceMappingURL=tool-result.d.ts.map

package/dist/protocol/tool-result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-result.d.ts","sourceRoot":"","sources":["../../src/protocol/tool-result.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAEpG,MAAM,WAAW,UAAU;IACzB,OAAO,CAAC,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACxD,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAMD;;;GAGG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAA;gBAEf,MAAM,EAAE,UAAU;CAK/B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,GAAG,CAAC,CAUzD"}

package/dist/protocol/tool-result.js

@@ -0,0 +1,37 @@
+/** No React, no mcp-use: the server tests and the view runtime decode tool results the same way. */
+function firstText(result) {
+    return result?.content?.find((block) => typeof block.text === "string")?.text;
+}
+/**
+ * A tool's own `isError` answer (a validation error, an engine 404), not a transport failure.
+ * The message is the tool's text, so `describeError` reads it like any other failure.
+ */
+export class ToolResultError extends Error {
+    result;
+    constructor(result) {
+        super(firstText(result) ?? "Tool call failed");
+        this.name = "ToolResultError";
+        this.result = result;
+    }
+}
+/**
+ * `isError` throws {@link ToolResultError}; then `structuredContent` (when not null); then the
+ * first text block, JSON-decoded or as the text itself; else the result as it is. A `*_data`
+ * feed answers in its text block only, a show tool in `structuredContent`.
+ */
+export function decodeToolResult(result) {
+    if (result?.isError)
+        throw new ToolResultError(result);
+    if (result?.structuredContent != null)
+        return result.structuredContent;
+    const text = firstText(result);
+    if (text === undefined)
+        return result;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+//# sourceMappingURL=tool-result.js.map

package/dist/protocol/tool-result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-result.js","sourceRoot":"","sources":["../../src/protocol/tool-result.ts"],"names":[],"mappings":"AAAA,oGAAoG;AAQpG,SAAS,SAAS,CAAC,MAAqC;IACtD,OAAO,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IAAI,CAAA;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,eAAgB,SAAQ,KAAK;IAC/B,MAAM,CAAY;IAE3B,YAAY,MAAkB;QAC5B,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAA;QAC9C,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAA;QAC7B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAI,MAAkB;IACpD,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,MAAM,EAAE,iBAAiB,IAAI,IAAI;QAAE,OAAO,MAAM,CAAC,iBAAsB,CAAA;IAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,MAAW,CAAA;IAC1C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAS,CAAA;IAClB,CAAC;AACH,CAAC"}

package/dist/protocol/translator.d.ts

@@ -0,0 +1,14 @@
+/** Browser-safe, no imports: `/server` (tool summaries) and `/widgets` (widget strings) export it alike. */
+/** A string with `{name}` placeholders, or a function of the params (plurals, conditionals). */
+export type Message = string | ((params: Record<string, unknown>) => string);
+/** One locale's messages, keyed by a dotted message key. */
+export type MessageCatalog = Record<string, Message>;
+/** Per-locale catalogs, keyed by a locale tag (`en`, `de`). */
+export type Catalogs = Record<string, MessageCatalog>;
+export type Translator = (locale: string, key: string, params?: Record<string, unknown>) => string;
+/**
+ * Requested locale, then `en`, then the key itself, so a missing message stays visible. A string
+ * message interpolates `{name}` placeholders from the params and leaves unknown ones untouched.
+ */
+export declare function createTranslator(catalogs: Catalogs): Translator;
+//# sourceMappingURL=translator.d.ts.map

package/dist/protocol/translator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"translator.d.ts","sourceRoot":"","sources":["../../src/protocol/translator.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAE5G,gGAAgG;AAChG,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,CAAA;AAE5E,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAEpD,+DAA+D;AAC/D,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAA;AAErD,MAAM,MAAM,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAA;AAElG;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,QAAQ,GAAG,UAAU,CAU/D"}

package/dist/protocol/translator.js

@@ -0,0 +1,18 @@
+/** Browser-safe, no imports: `/server` (tool summaries) and `/widgets` (widget strings) export it alike. */
+/**
+ * Requested locale, then `en`, then the key itself, so a missing message stays visible. A string
+ * message interpolates `{name}` placeholders from the params and leaves unknown ones untouched.
+ */
+export function createTranslator(catalogs) {
+    return (locale, key, params) => {
+        const message = catalogs[locale]?.[key] ?? catalogs.en?.[key];
+        if (message === undefined)
+            return key;
+        if (typeof message === "function")
+            return message(params ?? {});
+        if (!params)
+            return message;
+        return message.replace(/\{(\w+)\}/g, (whole, name) => name in params ? String(params[name]) : whole);
+    };
+}
+//# sourceMappingURL=translator.js.map

package/dist/protocol/translator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"translator.js","sourceRoot":"","sources":["../../src/protocol/translator.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAa5G;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAkB;IACjD,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE;QAC7B,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAA;QAC7D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,GAAG,CAAA;QACrC,IAAI,OAAO,OAAO,KAAK,UAAU;YAAE,OAAO,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAA;QAC3B,OAAO,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE,CAC3D,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAC9C,CAAA;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/protocol/view-name.d.ts

@@ -0,0 +1,11 @@
+/**
+ * One prebuilt bundle serves every view, so each view document names its view in a prelude the
+ * server prepends to the bundle (`primeViews`). The view name IS its show tool's name.
+ */
+/** The global a view document's prelude sets before the bundle runs. */
+export declare const VIEW_NAME_GLOBAL = "__pulseView";
+/** `globalThis.__pulseView="<name>";` and a newline: a plain statement ahead of the bundle. */
+export declare function viewPrelude(name: string): string;
+/** The prelude's value, or undefined when it is missing or not a non-empty string. */
+export declare function readViewName(): string | undefined;
+//# sourceMappingURL=view-name.d.ts.map

package/dist/protocol/view-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-name.d.ts","sourceRoot":"","sources":["../../src/protocol/view-name.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wEAAwE;AACxE,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAU7C,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,sFAAsF;AACtF,wBAAgB,YAAY,IAAI,MAAM,GAAG,SAAS,CAGjD"}

package/dist/protocol/view-name.js

@@ -0,0 +1,23 @@
+/**
+ * One prebuilt bundle serves every view, so each view document names its view in a prelude the
+ * server prepends to the bundle (`primeViews`). The view name IS its show tool's name.
+ */
+/** The global a view document's prelude sets before the bundle runs. */
+export const VIEW_NAME_GLOBAL = "__pulseView";
+/** `<` and the JS line separators escaped, so a name can never close the inline script. */
+function scriptSafe(json) {
+    return json
+        .replace(/</g, "\\u003c")
+        .replace(/\u2028/g, "\\u2028")
+        .replace(/\u2029/g, "\\u2029");
+}
+/** `globalThis.__pulseView="<name>";` and a newline: a plain statement ahead of the bundle. */
+export function viewPrelude(name) {
+    return `globalThis.${VIEW_NAME_GLOBAL}=${scriptSafe(JSON.stringify(name))};\n`;
+}
+/** The prelude's value, or undefined when it is missing or not a non-empty string. */
+export function readViewName() {
+    const value = globalThis[VIEW_NAME_GLOBAL];
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+//# sourceMappingURL=view-name.js.map

package/dist/protocol/view-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"view-name.js","sourceRoot":"","sources":["../../src/protocol/view-name.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAA;AAE7C,2FAA2F;AAC3F,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI;SACR,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC;SACxB,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC;SAC7B,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAA;AAClC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,cAAc,gBAAgB,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;AAChF,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAa,UAAsC,CAAC,gBAAgB,CAAC,CAAA;IAChF,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACtE,CAAC"}

package/dist/request-context.d.ts

@@ -1,47 +1,18 @@
-/** The per-request slice the ctx-less consumers actually need. */
 export interface McpRequestInfo {
-    /** The OAuth caller's id, read off the request's auth like `resolveCaller` does. */
     authUserId?: string;
-    /**
-     * Declares the request's caller as THE single local user of a transport
-     * without auth (stdio, tests) — it resolves to `ANONYMOUS_PROFILE_KEY`.
-     * Never derived from a request: the HTTP middleware does not set it, so
-     * only code that runs work under [[runWithMcpRequestInfo]] can declare it.
-     */
-    anonymousCaller?: boolean;
-    /** Raw `Authorization` header value, scheme included (e.g. `Bearer …`). */
     authorization?: string;
 }
-/** The current request's info, or `undefined` outside one (boot, tests, no middleware). */
 export declare function getMcpRequestInfo(): McpRequestInfo | undefined;
 /**
- * An opaque, stable key for the current request's caller AND the credential
- * it presents: the OAuth caller's id and the raw `Authorization` header,
- * hashed, so no credential is kept by whoever stores the key. For a cache
- * whose answers depend on whose permissions a read ran under: with
- * passthrough auth the engine answers each caller with that caller's own
- * permissions, so one caller's answer must never serve another. Two requests
- * share a key only with the same caller and the same credential; outside a
- * request (or without either) the key is the empty string.
+ * Hashed so no credential is kept. With passthrough auth the engine answers with each
+ * caller's own permissions, so a cached answer must never serve another caller.
  */
 export declare function callerCacheKey(): string;
-/**
- * Run `fn` under a fixed request info — the test seam, and the only way to
- * declare an `anonymousCaller` (a transport without auth that serves exactly
- * one local user).
- */
+/** The test seam. */
 export declare function runWithMcpRequestInfo<T>(info: McpRequestInfo, fn: () => T): T;
-/**
- * The narrow structural server surface needed here (`server.use("mcp:*", …)`),
- * so callers can pass an `MCPServer` without this module importing mcp-use.
- */
+/** Structural so this module need not import mcp-use. */
 export interface McpMiddlewareHost {
     use(pattern: "mcp:*", fn: (ctx: unknown, next: () => Promise<void>) => Promise<void>): unknown;
 }
-/**
- * Install the ambient-request middleware on a server (idempotent). Wraps every
- * MCP method (`mcp:*`) so tool handlers, app-only feeds, and pipeline steps
- * all observe the same {@link McpRequestInfo} for the duration of the call.
- */
 export declare function installMcpRequestContext(server: McpMiddlewareHost): void;
 //# sourceMappingURL=request-context.d.ts.map

package/dist/request-context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AA4BA,kEAAkE;AAClE,MAAM,WAAW,cAAc;IAC7B,oFAAoF;IACpF,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID,2FAA2F;AAC3F,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE7E;AA2BD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;CAC/F;AAID;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIxE"}
+{"version":3,"file":"request-context.d.ts","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,SAAS,CAE9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAMvC;AAED,qBAAqB;AACrB,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAE7E;AAsBD,yDAAyD;AACzD,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAA;CAC/F;AAID,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIxE"}

package/dist/request-context.js

@@ -1,44 +1,21 @@
 /**
- * Repo-owned ambient MCP request info — for the few consumers that run
- * WITHOUT a tool-handler `ctx` in hand.
- *
- * Since toolkit 2.6 every handler gets mcp-use's `ctx` (registrar handlers as
- * their third argument, raw `server.tool` callbacks as their second), and
- * caller identity resolves from it ([[resolveProfileKey]] reads `ctx.auth`
- * first). What remains ctx-less: pipeline steps (`render-view` /
- * `refresh-view` hand a step no `ctx`, so a step's saved-default-engine
- * lookup reads the caller here) and the camunda7 REST client's
- * passthrough-auth interceptor, which runs deep inside a hey-api call chain
- * (`resolveMcpBearerToken`). This store carries exactly what those need: the
- * OAuth caller's id and the raw `Authorization` header — nothing a client can
- * pick for itself becomes an identity here.
- *
- * Fail-closed by construction: outside a request — or when no middleware was
- * installed — there is no store, and no store means NO identity (saves
- * refuse, reads fall back to defaults), never a shared record.
- *
- * Installed once per server via [[installMcpRequestContext]] (idempotent) —
- * `createComposedServer` does it right after `createFrameworkApp`. Lives on
- * the `/server` path only: `node:async_hooks` must never reach the widget
- * bundle.
+ * Ambient request info for consumers WITHOUT a handler `ctx`: the per-caller caches
+ * (`callerCacheKey`) and the engine passthrough-auth interceptor deep in a hey-api
+ * chain. Without the middleware nothing is forwarded (passthrough fails with the engine's
+ * 401) and every caller shares the "" cache partition, which is safe only because no
+ * per-caller token reaches the engine. `/server` only: `node:async_hooks` must
+ * never reach the widget bundle.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";
-import { resolveCallerId } from "@miragon/mcp-toolkit-core";
+import { callerUserId } from "./caller.js";
 const storage = new AsyncLocalStorage();
-/** The current request's info, or `undefined` outside one (boot, tests, no middleware). */
 export function getMcpRequestInfo() {
     return storage.getStore();
 }
 /**
- * An opaque, stable key for the current request's caller AND the credential
- * it presents: the OAuth caller's id and the raw `Authorization` header,
- * hashed, so no credential is kept by whoever stores the key. For a cache
- * whose answers depend on whose permissions a read ran under: with
- * passthrough auth the engine answers each caller with that caller's own
- * permissions, so one caller's answer must never serve another. Two requests
- * share a key only with the same caller and the same credential; outside a
- * request (or without either) the key is the empty string.
+ * Hashed so no credential is kept. With passthrough auth the engine answers with each
+ * caller's own permissions, so a cached answer must never serve another caller.
  */
 export function callerCacheKey() {
     const info = storage.getStore();
@@ -48,11 +25,7 @@ export function callerCacheKey() {
         .update(JSON.stringify([info.authUserId ?? null, info.authorization ?? null]))
         .digest("base64url");
 }
-/**
- * Run `fn` under a fixed request info — the test seam, and the only way to
- * declare an `anonymousCaller` (a transport without auth that serves exactly
- * one local user).
- */
+/** The test seam. */
 export function runWithMcpRequestInfo(info, fn) {
     return storage.run(info, fn);
 }
@@ -66,16 +39,11 @@ function deriveInfo(ctx) {
         }
     };
     return {
-        authUserId: resolveCallerId(ctx),
+        authUserId: callerUserId(ctx),
         authorization: header("Authorization") ?? header("authorization"),
     };
 }
 const installed = new WeakSet();
-/**
- * Install the ambient-request middleware on a server (idempotent). Wraps every
- * MCP method (`mcp:*`) so tool handlers, app-only feeds, and pipeline steps
- * all observe the same {@link McpRequestInfo} for the duration of the call.
- */
 export function installMcpRequestContext(server) {
     if (installed.has(server))
         return;

package/dist/request-context.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAiB3D,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAkB,CAAA;AAEvD,2FAA2F;AAC3F,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAA;AAC3B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAA;IAC/B,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,EAAE,CAAA;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC;SAC7E,MAAM,CAAC,WAAW,CAAC,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAI,IAAoB,EAAE,EAAW;IACxE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAC9B,CAAC;AAaD,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAsB,EAAE;QAClD,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,OAAO;QACL,UAAU,EAAE,eAAe,CAAC,GAAG,CAAC;QAChC,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC;KAClE,CAAA;AACH,CAAC;AAUD,MAAM,SAAS,GAAG,IAAI,OAAO,EAAqB,CAAA;AAElD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAyB;IAChE,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAM;IACjC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAwB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC7F,CAAC"}
+{"version":3,"file":"request-context.js","sourceRoot":"","sources":["../src/request-context.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAO1C,MAAM,OAAO,GAAG,IAAI,iBAAiB,EAAkB,CAAA;AAEvD,MAAM,UAAU,iBAAiB;IAC/B,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAA;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAA;IAC/B,IAAI,CAAC,IAAI,EAAE,UAAU,IAAI,CAAC,IAAI,EAAE,aAAa;QAAE,OAAO,EAAE,CAAA;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,CAAC,CAAC;SAC7E,MAAM,CAAC,WAAW,CAAC,CAAA;AACxB,CAAC;AAED,qBAAqB;AACrB,MAAM,UAAU,qBAAqB,CAAI,IAAoB,EAAE,EAAW;IACxE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAC9B,CAAC;AAQD,SAAS,UAAU,CAAC,GAAsB;IACxC,MAAM,MAAM,GAAG,CAAC,IAAY,EAAsB,EAAE;QAClD,IAAI,CAAC;YACH,OAAO,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IACD,OAAO;QACL,UAAU,EAAE,YAAY,CAAC,GAAG,CAAC;QAC7B,aAAa,EAAE,MAAM,CAAC,eAAe,CAAC,IAAI,MAAM,CAAC,eAAe,CAAC;KAClE,CAAA;AACH,CAAC;AAOD,MAAM,SAAS,GAAG,IAAI,OAAO,EAAqB,CAAA;AAElD,MAAM,UAAU,wBAAwB,CAAC,MAAyB;IAChE,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAM;IACjC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACrB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,GAAwB,CAAC,EAAE,IAAI,CAAC,CAAC,CAAA;AAC7F,CAAC"}

package/dist/server.d.ts

@@ -1,43 +1,23 @@
 /**
- * Server-side surface of the widget shell (`@miragon/pulse-widget-shell/server`):
- * the one import path for module tools and composition roots — the eager view
- * builders for `*_show_*` tools (the toolkit core's, re-typed below), the
- * shared error wrapper for raw `server.tool()` registrations, module
- * composition and the composed-server boot, caller identity, the profile
- * and dashboard persistence, and the one rule a BPMN model's names are read by.
+ * The `/server` import path: the module port, tool authoring and the boot. The boot's own parts
+ * (edge guard, body limit, metrics, health, request context) stay inside `createComposedServer`,
+ * so no root can wire a second boot that skips one of them.
  */
-export type { ComposedViewEntry, ComposedViewInput, SingleWidgetViewInput, } from "@miragon/mcp-toolkit-core";
-export { withToolErrors } from "@miragon/mcp-toolkit-core/tools";
-export { createShellPlugin, shellDefinition, type ShellPluginOptions } from "./shell-catalogue.js";
-export { SHELL_SAVE_SETTINGS, SHELL_SETTINGS_DATA, SHELL_SETTINGS_PAGE_WIDGET, SHELL_SETTINGS_WIDGET, SHELL_SHOW_SETTINGS, type ShellSettingsReadOnlyReason, type ShellSettingsView, } from "./shell-settings-contract.js";
-export { createBuilderTexts, type BuilderTexts } from "./builder-texts.js";
-export { ANONYMOUS_PROFILE_KEY, resolveAuthUserId, resolveProfileKey, withoutDefaults, type ProfileSlice, type ProfileSource, } from "./profile.js";
-export { callerCacheKey, getMcpRequestInfo, installMcpRequestContext, runWithMcpRequestInfo, type McpMiddlewareHost, type McpRequestInfo, } from "./request-context.js";
-export { OAUTH_ENV_VARS, oauthFromEnv, type OAuthFromEnvOptions } from "./oauth-env.js";
-export { requestLogLevelWarning, resolvePort, swallowDevCliViewsPrime, type ResolvePortOptions, type ToolCallMiddlewareHost, } from "./host-boot.js";
-export { installHealthEndpoints, type HealthOptions, type HealthReport, type HealthStatus, type HttpRouteHost, type ReadinessCheck, } from "./health.js";
-export { installMetrics, type HttpMiddlewareContext, type HttpMiddlewareHost, type MetricsHost, type MetricsOptions, } from "./metrics.js";
-export { DEFAULT_MAX_BODY_BYTES, HTTP_EDGE_ENV_VARS, installHttpEdgeGuard, resolveHttpEdgePolicy, type AllowList, type EdgeGuardContext, type EdgeGuardHost, type EdgeGuardOptions, type HttpEdgePolicy, } from "./http-edge.js";
-export { fontAssetsCsp, installFontAssets, type FontAsset, type FontAssetsOptions, } from "./font-assets.js";
-export { SERVED_FONT_FILES, SERVED_FONT_PATH, servedFontBaseUrl } from "./served-fonts.js";
-export { honorWidgetMetaDefaults, withWidgetMetaDefaults, type WidgetMetaDefaults, } from "./widget-meta-defaults.js";
-export { createBodyLimitedListener, type BodyLimitedListener, type BodyLimitedListenerOptions, type FetchTarget, } from "./node-listener.js";
-export { createComposedServer, DEFAULT_DRAIN_TIMEOUT_MS, DEFAULT_REQUEST_TIMEOUT_MS, type BootComposition, type ComposedServer, type ComposedServerInfo, type ComposedServerOptions, type ComposedServerRuntime, type ListenOptions, type RunningServer, } from "./composed-server.js";
-export { explicitLocale, LANGUAGES, LOCALES, PROFILE_SCHEMA_VERSION, type LanguagePref, type Locale, } from "./profile-constants.js";
-export { defaultProfileRecord, profileRecordSchema, type ProfileRecord, type ProfileRecordSaveInput, } from "./profile-record.js";
-export { parseStoredProfile } from "./profile-migrations.js";
-export { createFileSystemProfileStore, createInMemoryProfileStore, mergeStoredProfile, type MergedProfile, type ProfileSaveOptions, type ProfileStore, } from "./profile-store.js";
-export { readProfileAdvisory } from "./profile-advisory.js";
-export { createPostgresProfileStore, PROFILE_STORE_MIGRATIONS } from "./profile-store-postgres.js";
-export { createPostgresDashboardStore, DASHBOARD_STORE_MIGRATIONS, } from "./dashboard-store-postgres.js";
-export { createSql, postgresReadinessCheck, runMigrations, type Migration } from "./postgres.js";
+export { type ComposableModule, type ModuleEntry, type ModulePlugin } from "./composition.js";
+export { createToolsetVocabulary, type ToolsetVocabulary } from "./toolsets.js";
+export { withToolErrors } from "./tool-errors.js";
+export { createToolRegistrar, type ToolConfig, type ToolRegistrar } from "./tool-registrar.js";
 export { appOnly, showToolBinding, strictToolInput } from "./widget-tool-bindings.js";
-export { composeModules, frameworkWritesAllowed, type ActiveModuleRef, type ComposableModule, type EffectiveToolset, type ModuleComposition, type ResolveBootOptions, type ResolvedBoot, } from "./composition.js";
-export { announcePersistence, persistenceFromEnv, profileStoreFromEnv, type PersistenceBackend, type PersistenceSelection, } from "./profile-store-env.js";
-export { createToolsetVocabulary, type EffectiveSelection, type ToolsetSource, type ToolsetVocabulary, } from "./toolsets.js";
-export { createLocalizeFor, createLocalizeViewFor, createViewLocaleOf, resolveProfileLocale, type ServerT, type Translator, type ViewLocale, } from "./server-locale.js";
-export { parseModuleSlice, requireProfileKey, saveModuleSlice } from "./profile-slice.js";
-export { catalogueSyncIssues } from "./catalogue-sync.js";
-export { bpmnProcessNameOf, parseBpmnNames, readBpmnNames, type BpmnModelNames, type BpmnNames, } from "./bpmn-names.js";
-export { buildComposedView, buildDataFeedResult, buildSingleWidgetView } from "./view-results.js";
+export { buildDataFeedResult, buildViewResult, type ViewResult } from "./view-results.js";
+export { decodeToolResult, type ToolResult } from "./protocol/tool-result.js";
+export { createTranslator, type Catalogs, type Message, type MessageCatalog, type Translator, } from "./protocol/translator.js";
+export { bpmnProcessNameOf, parseBpmnNames, readBpmnNames, type BpmnModelNames, type BpmnNames, } from "./protocol/bpmn-names.js";
+export { callerCacheKey, getMcpRequestInfo, runWithMcpRequestInfo, type McpRequestInfo, } from "./request-context.js";
+export { composedEnvVars, createComposedServer, retiredEnvVars, type ComposedServer, type ComposedServerInfo, type ComposedServerOptions, type ListenOptions, type RunningServer, } from "./composed-server.js";
+export { VIEW_RESOURCE_URI_PREFIX, viewResourceUri } from "./widget-tool-bindings.js";
+export { viewPrelude } from "./protocol/view-name.js";
+export { VIEW_BUNDLE_DEDUPE } from "./view-bundle.js";
+export type { HttpRouteHost } from "./health.js";
+export { fontAssetsCsp, installFontAssets, type FontAsset, type FontAssetsOptions, } from "./font-assets.js";
+export { SERVED_FONT_FILES, SERVED_FONT_PATH, servedFontBaseUrl } from "./protocol/served-fonts.js";
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,YAAY,EACV,iBAAiB,EACjB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAA;AAChE,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAA;AAClG,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,GACvB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAC1E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,iBAAiB,EACtB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACvF,OAAO,EACL,sBAAsB,EACtB,WAAW,EACX,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,sBAAsB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,cAAc,EACd,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,cAAc,GACpB,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,GACpB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAC1F,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,kBAAkB,GACxB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,yBAAyB,EACzB,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,KAAK,WAAW,GACjB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,0BAA0B,EAC1B,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,cAAc,EACd,SAAS,EACT,OAAO,EACP,sBAAsB,EACtB,KAAK,YAAY,EACjB,KAAK,MAAM,GACZ,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,sBAAsB,GAC5B,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,EAC1B,kBAAkB,EAClB,KAAK,aAAa,EAClB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAC3D,OAAO,EAAE,0BAA0B,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAA;AAClG,OAAO,EACL,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,SAAS,EAAE,sBAAsB,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAA;AAChG,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,GAC1B,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,uBAAuB,EACvB,KAAK,kBAAkB,EACvB,KAAK,aAAa,EAClB,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,OAAO,EACZ,KAAK,UAAU,EACf,KAAK,UAAU,GAChB,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzD,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,iBAAiB,CAAA;AAExB,OAAO,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,kBAAkB,CAAA;AAC7F,OAAO,EAAE,uBAAuB,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAI/E,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,EAAE,mBAAmB,EAAE,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAMzF,OAAO,EAAE,gBAAgB,EAAE,KAAK,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC7E,OAAO,EACL,gBAAgB,EAChB,KAAK,QAAQ,EACb,KAAK,OAAO,EACZ,KAAK,cAAc,EACnB,KAAK,UAAU,GAChB,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,SAAS,GACf,MAAM,0BAA0B,CAAA;AACjC,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,KAAK,cAAc,GACpB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EAClB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AACrF,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAGrD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAChD,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA"}