@plitzi/sdk-server 0.32.24 → 0.32.25

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @plitzi/sdk-server
 
+## 0.32.25
+
+### Patch Changes
+
+- v0.32.25
+- Updated dependencies
+  - @plitzi/plitzi-sdk@0.32.25
+  - @plitzi/sdk-schema@0.32.25
+  - @plitzi/sdk-shared@0.32.25
+
 ## 0.32.24
 
 ### Patch Changes

package/dist/modules/mcp/proxy/config.js

@@ -22,25 +22,42 @@ var proxySettings = (config) => {
 };
 /** The endpoint as a widget must address it: absolute, because the page runs on the host's origin and a relative
 *  URL there points at the host. Falls back to the origin this request came in on, which is the right one whenever
-*  the MCP server owns its sub-domain; a deployment reached under a different public name sets `proxy.baseUrl`.
-*  The grants it mints carry the fingerprint of THIS request's credential, so they belong to this connection. */
+*  the MCP server owns its sub-domain; a deployment reached under a different public name sets `proxy.baseUrl`. */
+var endpointOf = (settings, req) => {
+	const base = (settings.baseUrl ?? requestOrigin(req)).replace(/\/$/, "");
+	return base ? `${base}${settings.path}` : void 0;
+};
+/** The proxy a tool rewrites through. The grants it mints carry the fingerprint of THIS request's credential, so
+*  they belong to this connection. */
 var requestProxy = (config, req) => {
 	const settings = proxySettings(config);
-	if (!settings) return;
-	const base = (settings.baseUrl ?? requestOrigin(req)).replace(/\/$/, "");
-	if (!base) return;
+	const endpoint = settings && endpointOf(settings, req);
+	if (!settings || !endpoint) return;
 	return {
-		endpoint: `${base}${settings.path}`,
+		endpoint,
 		secret: settings.secret,
 		identity: connectionId(req.headers.authorization, settings.secret),
 		ttl: settings.ttl,
 		tools: settings.tools
 	};
 };
+/** The proxy the ENDPOINT itself mints with, while serving an API answer that carries URLs of its own. The request
+*  it is serving comes from a sandboxed iframe and presents no credential, so the connection is the one signed into
+*  the grant being served — the widget's own — rather than one read off a header. */
+var grantingProxy = (settings, req, identity) => {
+	const endpoint = endpointOf(settings, req);
+	return endpoint ? {
+		endpoint,
+		secret: settings.secret,
+		identity,
+		ttl: settings.ttl,
+		tools: settings.tools
+	} : void 0;
+};
 /** The proxy THIS tool may use, or undefined — the single place that decides it, so a tool cannot reach the
 *  endpoint by being wired to it later. A render authors a throwaway widget, so rewriting its URLs is invisible
 *  and lasts as long as the widget does; a tool that WRITES a space (plitzi_apply) would persist those URLs into
 *  content the user owns, which is why it is not on the list unless a deployment puts it there deliberately. */
 var proxyForTool = (proxy, tool) => proxy?.tools.includes(tool) ? proxy : void 0;
 //#endregion
-export { PROXY_PATH, proxyForTool, proxySettings, requestProxy };
+export { PROXY_PATH, grantingProxy, proxyForTool, proxySettings, requestProxy };

package/dist/modules/mcp/proxy/grant.js

@@ -49,12 +49,14 @@ var readGrant = (param, secret) => {
 	const payload = payloadOf(kind, expiresAt, identity, target);
 	if (verify(payload, signature, secret)) return {
 		kind,
-		target
+		target,
+		identity
 	};
 	const origin = originOf(target);
 	return origin && verify(payloadOf(kind, expiresAt, identity, origin), signature, secret) ? {
 		kind,
-		target
+		target,
+		identity
 	} : void 0;
 };
 /** Is this URL one the widget can already reach? Absolute http(s) URLs are the ones a sandbox CSP blocks;

package/dist/modules/mcp/proxy/handler.js

@@ -1,10 +1,31 @@
+import { grantingProxy } from "./config.js";
 import { readGrant } from "./grant.js";
 import { fetchResource } from "./fetch.js";
+import { rewritablePayload, rewritePayload } from "./payload.js";
 //#region src/modules/mcp/proxy/handler.ts
 var CACHE_CONTROL = {
 	asset: "public, max-age=86400, immutable",
 	data: "no-store"
 };
+/** Read a response whole, or undefined once it is past the limit. Only a rewritable answer is read this way: it has
+*  to be complete before a URL inside it can be swapped, and an API answer is small — which is exactly why the
+*  streaming path below stays the rule for everything else. */
+var readAll = async (body, maxBytes) => {
+	const reader = body.getReader();
+	const chunks = [];
+	let written = 0;
+	for (;;) {
+		const { done, value } = await reader.read();
+		if (done) break;
+		written += value.byteLength;
+		if (written > maxBytes) {
+			await reader.cancel();
+			return;
+		}
+		chunks.push(Buffer.from(value));
+	}
+	return Buffer.concat(chunks);
+};
 var fail = (res, status, reason) => {
 	res.setStatus(status);
 	res.setHeader("Content-Type", "text/plain; charset=utf-8");
@@ -47,6 +68,16 @@ var handleProxyRequest = async (req, res, settings) => {
 		res.end();
 		return;
 	}
+	const payloadProxy = grant.kind === "data" && rewritablePayload(result.contentType) ? grantingProxy(settings, req, grant.identity) : void 0;
+	if (payloadProxy) {
+		const body = await readAll(result.body, settings.maxBytes);
+		if (!body) {
+			fail(res, 413, "That response is too large to load in a widget.");
+			return;
+		}
+		res.send(rewritePayload(body.toString("utf8"), payloadProxy));
+		return;
+	}
 	const reader = result.body.getReader();
 	let written = 0;
 	try {

package/dist/modules/mcp/proxy/payload.js

@@ -0,0 +1,29 @@
+import { grantUrl, isGranted, isRemote } from "./grant.js";
+import { looksLikeAsset } from "./rewrite.js";
+//#region src/modules/mcp/proxy/payload.ts
+var JSON_TYPES = ["application/json", "application/ld+json"];
+var ASSET_FIELD = /(image|img|thumb|photo|picture|avatar|icon|logo|cover|banner|poster|artwork|media|src)/i;
+/** Is this what the endpoint fetched a body it can rewrite? Only JSON: it is what an apiContainer binds against,
+*  and re-serializing anything else would risk changing a document to fix a URL that may not even be loaded. */
+var rewritablePayload = (contentType) => JSON_TYPES.some((type) => contentType.startsWith(type));
+var rewriteNode = (node, field, proxy) => {
+	if (typeof node === "string") return isRemote(node) && !isGranted(node, proxy) && (looksLikeAsset(node) || ASSET_FIELD.test(field)) ? grantUrl(node, proxy) : node;
+	if (Array.isArray(node)) return node.map((item) => rewriteNode(item, field, proxy));
+	if (node !== null && typeof node === "object") {
+		const entries = Object.entries(node);
+		return Object.fromEntries(entries.map(([key, value]) => [key, rewriteNode(value, key, proxy)]));
+	}
+	return node;
+};
+/** Rewrite the asset URLs an API answer carries so the widget loads them through this endpoint too. Returns the
+*  body untouched when it is not the JSON it claimed to be — the widget asked for that response, and serving it
+*  as it came is better than failing the fetch over a rewrite. */
+var rewritePayload = (body, proxy) => {
+	try {
+		return JSON.stringify(rewriteNode(JSON.parse(body), "", proxy));
+	} catch {
+		return body;
+	}
+};
+//#endregion
+export { rewritablePayload, rewritePayload };

package/dist/modules/mcp/proxy/rewrite.js

@@ -3,11 +3,25 @@ import { grantUrl, isGranted, isRemote } from "./grant.js";
 var URL_ATTRIBUTES = ["src", "poster"];
 var MARKUP_ATTRIBUTES = ["content", "html"];
 var FETCHING_TYPE = "apiContainer";
+var SET_STATE_ACTION = "setState";
+var NAVIGATION_ACTION = "navigate";
+var FETCHING_UTILITY = "webHook";
+var ASSET_EXTENSION = /\.(?:apng|avif|bmp|gif|ico|jpe?g|png|svg|webp|aac|flac|m4a|mp3|oga|ogg|opus|wav|mp4|m4v|mov|ogv|webm|otf|ttf|woff2?)$/i;
 var CSS_URL = /url\(\s*(["']?)(https?:\/\/[^"')\s]+)\1\s*\)/gi;
 var HTML_SRC = /(<[^>]+?\ssrc\s*=\s*)(["'])(https?:\/\/[^"']+)\2/gi;
 var MARKDOWN_IMAGE = /(!\[[^\]]*\]\(\s*)(https?:\/\/[^\s)]+)/gi;
 var unescapeHtml = (url) => url.replace(/&amp;/g, "&");
 var toProxy = (url, proxy) => isGranted(url, proxy) ? url : grantUrl(unescapeHtml(url), proxy);
+/** Does this URL name a file the widget loads, judged by its path alone? Used where nothing else says what a URL is
+*  for — an interaction param, a field of an API answer — so the extension is the evidence and its absence is a
+*  reason to leave the URL alone. */
+var looksLikeAsset = (url) => {
+	try {
+		return ASSET_EXTENSION.test(new URL(url).pathname);
+	} catch {
+		return false;
+	}
+};
 /** Rewrite every remote URL embedded in a string: `url(…)` in CSS, `src="…"` in markup, `![](…)` in markdown. */
 var rewriteText = (text, proxy) => text.replace(CSS_URL, (_match, quote, url) => `url(${quote}${toProxy(url, proxy)}${quote})`).replace(HTML_SRC, (_match, prefix, quote, url) => `${prefix}${quote}${toProxy(url, proxy)}${quote}`).replace(MARKDOWN_IMAGE, (_match, prefix, url) => `${prefix}${toProxy(url, proxy)}`);
 var rewriteStyleObject = (styleObject, proxy) => {
@@ -17,17 +31,68 @@ var rewriteStyleBlock = (block, proxy) => {
 	if (block.default) rewriteStyleObject(block.default, proxy);
 	for (const state of Object.values(block.states ?? {})) rewriteStyleObject(state, proxy);
 };
-/** Why a fetching element's URL was left as authored, or undefined when it can be granted. Each case is one this
-*  hop cannot reproduce faithfully, and getting it wrong silently would be worse than the request being blocked:
-*  a write sent through a GET, or an API answering 401 because its credential was dropped on the way. */
-var unproxyableFetch = (element) => {
-	const { method, headers, accessToken } = element.attributes;
+/** Why a request was left as authored, or undefined when it can be granted. Each case is one this hop cannot
+*  reproduce faithfully, and getting it wrong silently would be worse than the request being blocked: a write sent
+*  through a GET, or an API answering 401 because its credential was dropped on the way. Reads both vocabularies —
+*  an apiContainer's attributes and a webHook's params name the same things differently. */
+var unproxyableFetch = (source) => {
+	const { method, headers, accessToken, authorizationToken } = source;
 	if (typeof method === "string" && method.toLowerCase() !== "get") return `it is a ${method.toUpperCase()} request`;
 	if (typeof accessToken === "string" && accessToken !== "") return "it sends its own credentials";
+	if (typeof authorizationToken === "string" && authorizationToken !== "") return "it sends its own credentials";
 	return headers && Object.keys(headers).length > 0 ? "it sends its own headers" : void 0;
 };
+var rewriteSetState = (params, proxy) => {
+	const { key, value } = params;
+	if (typeof key !== "string" || typeof value !== "string") return false;
+	if (URL_ATTRIBUTES.includes(key) && isRemote(value)) {
+		params.value = toProxy(value, proxy);
+		return true;
+	}
+	if (MARKUP_ATTRIBUTES.includes(key) && value.includes("http")) {
+		params.value = rewriteText(value, proxy);
+		return true;
+	}
+	return false;
+};
+var rewriteParams = (params, proxy) => {
+	for (const [name, value] of Object.entries(params)) {
+		if (typeof value !== "string") continue;
+		if (URL_ATTRIBUTES.includes(name) && isRemote(value)) params[name] = toProxy(value, proxy);
+		else if (MARKUP_ATTRIBUTES.includes(name) && value.includes("http")) params[name] = rewriteText(value, proxy);
+		else if (isRemote(value) && looksLikeAsset(value)) params[name] = toProxy(value, proxy);
+	}
+};
+var rewriteWebHook = (node, proxy, warnings) => {
+	const params = node.params;
+	const url = params.url;
+	if (typeof url !== "string" || !isRemote(url) || isGranted(url, proxy)) return;
+	const blocked = unproxyableFetch(params);
+	if (blocked) {
+		warnings.push(`The ${FETCHING_UTILITY} step "${node.title}" calls its endpoint directly because ${blocked}, so that request is subject to the network policy of the surface it renders in, and to the CORS headers of the API, and may not run. A plain GET with no credentials is fetched by the widget server instead, which always works.`);
+		return;
+	}
+	params.url = grantUrl(url, proxy, "data");
+};
+var rewriteInteractions = (interactions, proxy, warnings) => {
+	for (const node of Object.values(interactions ?? {})) {
+		if (node.type === "globalCallback" && node.action === NAVIGATION_ACTION) continue;
+		if (node.type === "utility" && node.action === FETCHING_UTILITY) {
+			rewriteWebHook(node, proxy, warnings);
+			continue;
+		}
+		const params = node.params;
+		if (node.action === SET_STATE_ACTION && rewriteSetState(params, proxy)) continue;
+		rewriteParams(params, proxy);
+	}
+};
+var rewriteBindings = (bindings, proxy) => {
+	for (const category of Object.values(bindings ?? {})) for (const binding of category) for (const transformer of binding.transformers ?? []) rewriteParams(transformer.params, proxy);
+};
 var rewriteSchema = (schema, proxy, warnings) => {
 	for (const element of Object.values(schema.flat)) {
+		rewriteInteractions(element.definition.interactions, proxy, warnings);
+		rewriteBindings(element.definition.bindings, proxy);
 		const attributes = element.attributes;
 		for (const name of URL_ATTRIBUTES) {
 			const value = attributes[name];
@@ -39,7 +104,7 @@ var rewriteSchema = (schema, proxy, warnings) => {
 		}
 		const query = attributes.query;
 		if (element.definition.type !== FETCHING_TYPE || typeof query !== "string" || !isRemote(query)) continue;
-		const blocked = unproxyableFetch(element);
+		const blocked = unproxyableFetch(attributes);
 		if (blocked) {
 			warnings.push(`The ${FETCHING_TYPE} "${element.idRef ?? element.id}" calls its endpoint directly because ${blocked}, so that request is subject to the network policy of the surface it renders in, and to the CORS headers of the API, and may not run. A plain GET with no headers is fetched by the widget server instead, which always works.`);
 			continue;
@@ -57,8 +122,9 @@ var rewriteStyle = (style, proxy) => {
 	}
 	if (style.cache.includes("url(")) style.cache = rewriteText(style.cache, proxy);
 };
-/** Point everything an authored widget loads from outside — images, media, fonts, and the data an apiContainer
-*  fetches — at this server's endpoint, in place. The AGENT never sees this: it authors the real URL and this runs
+/** Point everything an authored widget loads from outside — images, media, fonts, the data an apiContainer fetches
+*  and the URLs its interactions swap in later — at this server's endpoint, in place. The AGENT never sees this: it
+*  authors the real URL and this runs
 *  afterwards, on the throwaway space a render builds (so nothing shared is mutated) and before the global style
 *  cache is compiled (so the concatenated CSS comes out already rewritten). Returns what could not be rewritten,
 *  which is the only part the model hears about. */
@@ -69,4 +135,4 @@ var proxifyResources = (space, proxy) => {
 	return warnings;
 };
 //#endregion
-export { proxifyResources, rewriteText };
+export { looksLikeAsset, proxifyResources, rewriteText };

package/dist/modules/mcp/server.js

@@ -45,7 +45,7 @@ var createMcpServer = async ({ adapters, getSpaceId, preview, screenshot, logger
 	const getSpace = () => spacePromise ??= loadSpace();
 	const server = new McpServer({
 		name: "plitzi-mcp",
-		version: "0.32.24"
+		version: "0.32.25"
 	}, { instructions: hasSpace ? serverInstructions : widgetsOnlyInstructions });
 	registerResources(server, getSpace, MCP_ENV, log, hasSpace);
 	registerApps(server, {

package/dist/src/modules/mcp/proxy/config.d.ts

@@ -5,11 +5,13 @@ export declare const PROXY_PATH = "/__proxy";
  *  on: without one the endpoint could not tell its own widgets' URLs from anyone else's, and an unsigned fetcher
  *  on a public origin is an open proxy. */
 export declare const proxySettings: (config: SSRServerConfig) => ResourceProxySettings | undefined;
-/** The endpoint as a widget must address it: absolute, because the page runs on the host's origin and a relative
- *  URL there points at the host. Falls back to the origin this request came in on, which is the right one whenever
- *  the MCP server owns its sub-domain; a deployment reached under a different public name sets `proxy.baseUrl`.
- *  The grants it mints carry the fingerprint of THIS request's credential, so they belong to this connection. */
+/** The proxy a tool rewrites through. The grants it mints carry the fingerprint of THIS request's credential, so
+ *  they belong to this connection. */
 export declare const requestProxy: (config: SSRServerConfig, req: SSRRequest) => ResourceProxy | undefined;
+/** The proxy the ENDPOINT itself mints with, while serving an API answer that carries URLs of its own. The request
+ *  it is serving comes from a sandboxed iframe and presents no credential, so the connection is the one signed into
+ *  the grant being served — the widget's own — rather than one read off a header. */
+export declare const grantingProxy: (settings: ResourceProxySettings, req: SSRRequest, identity: string) => ResourceProxy | undefined;
 /** The proxy THIS tool may use, or undefined — the single place that decides it, so a tool cannot reach the
  *  endpoint by being wired to it later. A render authors a throwaway widget, so rewriting its URLs is invisible
  *  and lasts as long as the widget does; a tool that WRITES a space (plitzi_apply) would persist those URLs into

package/dist/src/modules/mcp/proxy/grant.d.ts

@@ -1,9 +1,11 @@
 import { ProxyKind, ResourceProxy } from './types';
 /** What a widget was granted. The kind is signed in too, so a URL minted for an image cannot be replayed as an
- *  API call (they answer with different content types, cache rules and request headers). */
+ *  API call (they answer with different content types, cache rules and request headers). The connection comes back
+ *  out because a data answer may carry URLs of its own, and the grants minted for those belong to the same one. */
 export type Grant = {
     kind: ProxyKind;
     target: string;
+    identity: string;
 };
 /** Mint the URL a widget will load this target from: this server's endpoint, carrying the target, the kind it was
  *  granted for, when the grant stops working and which connection minted it — all covered by one signature. */

package/dist/src/modules/mcp/proxy/index.d.ts

@@ -1,7 +1,8 @@
-export { PROXY_PATH, proxyForTool, proxySettings, requestProxy } from './config';
+export { grantingProxy, PROXY_PATH, proxyForTool, proxySettings, requestProxy } from './config';
 export { grantUrl, isGranted, isRemote, PROXY_PARAM, readGrant } from './grant';
 export { handleProxyRequest } from './handler';
-export { proxifyResources, rewriteText } from './rewrite';
+export { rewritablePayload, rewritePayload } from './payload';
+export { looksLikeAsset, proxifyResources, rewriteText } from './rewrite';
 export { connectionId, sign, verify } from './sign';
 export { DEFAULT_PROXY_TOOLS } from './types';
 export type { ProxyKind, ResourceProxy, ResourceProxySettings } from './types';

package/dist/src/modules/mcp/proxy/payload.d.ts

@@ -0,0 +1,8 @@
+import { ResourceProxy } from './types';
+/** Is this what the endpoint fetched a body it can rewrite? Only JSON: it is what an apiContainer binds against,
+ *  and re-serializing anything else would risk changing a document to fix a URL that may not even be loaded. */
+export declare const rewritablePayload: (contentType: string) => boolean;
+/** Rewrite the asset URLs an API answer carries so the widget loads them through this endpoint too. Returns the
+ *  body untouched when it is not the JSON it claimed to be — the widget asked for that response, and serving it
+ *  as it came is better than failing the fetch over a rewrite. */
+export declare const rewritePayload: (body: string, proxy: ResourceProxy) => string;

package/dist/src/modules/mcp/proxy/rewrite.d.ts

@@ -1,9 +1,14 @@
 import { ResourceProxy } from './types';
 import { Schema, Style } from '@plitzi/sdk-shared';
+/** Does this URL name a file the widget loads, judged by its path alone? Used where nothing else says what a URL is
+ *  for — an interaction param, a field of an API answer — so the extension is the evidence and its absence is a
+ *  reason to leave the URL alone. */
+export declare const looksLikeAsset: (url: string) => boolean;
 /** Rewrite every remote URL embedded in a string: `url(…)` in CSS, `src="…"` in markup, `![](…)` in markdown. */
 export declare const rewriteText: (text: string, proxy: ResourceProxy) => string;
-/** Point everything an authored widget loads from outside — images, media, fonts, and the data an apiContainer
- *  fetches — at this server's endpoint, in place. The AGENT never sees this: it authors the real URL and this runs
+/** Point everything an authored widget loads from outside — images, media, fonts, the data an apiContainer fetches
+ *  and the URLs its interactions swap in later — at this server's endpoint, in place. The AGENT never sees this: it
+ *  authors the real URL and this runs
  *  afterwards, on the throwaway space a render builds (so nothing shared is mutated) and before the global style
  *  cache is compiled (so the concatenated CSS comes out already rewritten). Returns what could not be rewritten,
  *  which is the only part the model hears about. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plitzi/sdk-server",
-  "version": "0.32.24",
+  "version": "0.32.25",
   "license": "AGPL-3.0",
   "files": [
     "dist",
@@ -30,9 +30,9 @@
   "dependencies": {
     "@modelcontextprotocol/ext-apps": "^1.7.5",
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "@plitzi/plitzi-sdk": "0.32.24",
-    "@plitzi/sdk-schema": "0.32.24",
-    "@plitzi/sdk-shared": "0.32.24",
+    "@plitzi/plitzi-sdk": "0.32.25",
+    "@plitzi/sdk-schema": "0.32.25",
+    "@plitzi/sdk-shared": "0.32.25",
     "ejs": "^6.0.1",
     "esbuild": "^0.28.1",
     "zod": "^4.4.3"