@superblocksteam/gateway 2.0.155-next.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (183) hide show
  1. package/LICENSE.txt +87 -0
  2. package/README.md +170 -0
  3. package/dist/agents/resolve-orchestrator-url.d.ts +22 -0
  4. package/dist/agents/resolve-orchestrator-url.js +38 -0
  5. package/dist/agents/resolve-orchestrator-url.js.map +1 -0
  6. package/dist/capabilities/import-prompt.d.ts +11 -0
  7. package/dist/capabilities/import-prompt.js +96 -0
  8. package/dist/capabilities/import-prompt.js.map +1 -0
  9. package/dist/capabilities/lifecycle.d.ts +73 -0
  10. package/dist/capabilities/lifecycle.js +2531 -0
  11. package/dist/capabilities/lifecycle.js.map +1 -0
  12. package/dist/capabilities/persisted-progress.d.ts +46 -0
  13. package/dist/capabilities/persisted-progress.js +246 -0
  14. package/dist/capabilities/persisted-progress.js.map +1 -0
  15. package/dist/capabilities/types.d.ts +446 -0
  16. package/dist/capabilities/types.js +47 -0
  17. package/dist/capabilities/types.js.map +1 -0
  18. package/dist/capture/browser-contract.d.ts +36 -0
  19. package/dist/capture/browser-contract.js +24 -0
  20. package/dist/capture/browser-contract.js.map +1 -0
  21. package/dist/capture/browser-instructions.d.ts +9 -0
  22. package/dist/capture/browser-instructions.js +17 -0
  23. package/dist/capture/browser-instructions.js.map +1 -0
  24. package/dist/capture/capture-library-probe.d.ts +55 -0
  25. package/dist/capture/capture-library-probe.js +177 -0
  26. package/dist/capture/capture-library-probe.js.map +1 -0
  27. package/dist/capture/capture-library.d.ts +52 -0
  28. package/dist/capture/capture-library.js +249 -0
  29. package/dist/capture/capture-library.js.map +1 -0
  30. package/dist/capture/classify-library-paint.d.ts +21 -0
  31. package/dist/capture/classify-library-paint.js +13 -0
  32. package/dist/capture/classify-library-paint.js.map +1 -0
  33. package/dist/capture/host-mcp-scan.d.ts +16 -0
  34. package/dist/capture/host-mcp-scan.js +64 -0
  35. package/dist/capture/host-mcp-scan.js.map +1 -0
  36. package/dist/capture/library-parent-script.d.ts +34 -0
  37. package/dist/capture/library-parent-script.js +82 -0
  38. package/dist/capture/library-parent-script.js.map +1 -0
  39. package/dist/capture/mode.d.ts +22 -0
  40. package/dist/capture/mode.js +45 -0
  41. package/dist/capture/mode.js.map +1 -0
  42. package/dist/config.d.ts +141 -0
  43. package/dist/config.js +109 -0
  44. package/dist/config.js.map +1 -0
  45. package/dist/debug.d.ts +2 -0
  46. package/dist/debug.js +9 -0
  47. package/dist/debug.js.map +1 -0
  48. package/dist/deps.d.ts +36 -0
  49. package/dist/deps.js +2 -0
  50. package/dist/deps.js.map +1 -0
  51. package/dist/events/cursor.d.ts +43 -0
  52. package/dist/events/cursor.js +78 -0
  53. package/dist/events/cursor.js.map +1 -0
  54. package/dist/events/memory-event-store.d.ts +34 -0
  55. package/dist/events/memory-event-store.js +110 -0
  56. package/dist/events/memory-event-store.js.map +1 -0
  57. package/dist/events/merge.d.ts +23 -0
  58. package/dist/events/merge.js +97 -0
  59. package/dist/events/merge.js.map +1 -0
  60. package/dist/events/normalized-collector.d.ts +62 -0
  61. package/dist/events/normalized-collector.js +156 -0
  62. package/dist/events/normalized-collector.js.map +1 -0
  63. package/dist/events/schema.d.ts +9 -0
  64. package/dist/events/schema.js +93 -0
  65. package/dist/events/schema.js.map +1 -0
  66. package/dist/events/snapshot.d.ts +32 -0
  67. package/dist/events/snapshot.js +57 -0
  68. package/dist/events/snapshot.js.map +1 -0
  69. package/dist/events/stream-key.d.ts +2 -0
  70. package/dist/events/stream-key.js +31 -0
  71. package/dist/events/stream-key.js.map +1 -0
  72. package/dist/events/types.d.ts +179 -0
  73. package/dist/events/types.js +66 -0
  74. package/dist/events/types.js.map +1 -0
  75. package/dist/health/readiness.d.ts +99 -0
  76. package/dist/health/readiness.js +202 -0
  77. package/dist/health/readiness.js.map +1 -0
  78. package/dist/index.d.ts +10 -0
  79. package/dist/index.js +10 -0
  80. package/dist/index.js.map +1 -0
  81. package/dist/integrations/filters.d.ts +8 -0
  82. package/dist/integrations/filters.js +40 -0
  83. package/dist/integrations/filters.js.map +1 -0
  84. package/dist/integrations/map.d.ts +26 -0
  85. package/dist/integrations/map.js +43 -0
  86. package/dist/integrations/map.js.map +1 -0
  87. package/dist/integrations/profile-key.d.ts +19 -0
  88. package/dist/integrations/profile-key.js +35 -0
  89. package/dist/integrations/profile-key.js.map +1 -0
  90. package/dist/main.d.ts +2 -0
  91. package/dist/main.js +5 -0
  92. package/dist/main.js.map +1 -0
  93. package/dist/orchestrator/client.d.ts +62 -0
  94. package/dist/orchestrator/client.js +160 -0
  95. package/dist/orchestrator/client.js.map +1 -0
  96. package/dist/playwright/ensure-chromium.d.ts +26 -0
  97. package/dist/playwright/ensure-chromium.js +60 -0
  98. package/dist/playwright/ensure-chromium.js.map +1 -0
  99. package/dist/preview/capture-screenshot.d.ts +52 -0
  100. package/dist/preview/capture-screenshot.js +158 -0
  101. package/dist/preview/capture-screenshot.js.map +1 -0
  102. package/dist/preview/viewer-url.d.ts +82 -0
  103. package/dist/preview/viewer-url.js +128 -0
  104. package/dist/preview/viewer-url.js.map +1 -0
  105. package/dist/process/fault-barrier.d.ts +55 -0
  106. package/dist/process/fault-barrier.js +113 -0
  107. package/dist/process/fault-barrier.js.map +1 -0
  108. package/dist/resume/memory-progress-store.d.ts +39 -0
  109. package/dist/resume/memory-progress-store.js +82 -0
  110. package/dist/resume/memory-progress-store.js.map +1 -0
  111. package/dist/resume/memory-recent-app-store.d.ts +14 -0
  112. package/dist/resume/memory-recent-app-store.js +27 -0
  113. package/dist/resume/memory-recent-app-store.js.map +1 -0
  114. package/dist/resume/memory-turn-store.d.ts +18 -0
  115. package/dist/resume/memory-turn-store.js +73 -0
  116. package/dist/resume/memory-turn-store.js.map +1 -0
  117. package/dist/resume/progress-key.d.ts +21 -0
  118. package/dist/resume/progress-key.js +58 -0
  119. package/dist/resume/progress-key.js.map +1 -0
  120. package/dist/resume/stores.d.ts +14 -0
  121. package/dist/resume/stores.js +18 -0
  122. package/dist/resume/stores.js.map +1 -0
  123. package/dist/resume/types.d.ts +124 -0
  124. package/dist/resume/types.js +13 -0
  125. package/dist/resume/types.js.map +1 -0
  126. package/dist/sabs/agent-facing-text.d.ts +33 -0
  127. package/dist/sabs/agent-facing-text.js +125 -0
  128. package/dist/sabs/agent-facing-text.js.map +1 -0
  129. package/dist/sabs/browser-context.d.ts +53 -0
  130. package/dist/sabs/browser-context.js +91 -0
  131. package/dist/sabs/browser-context.js.map +1 -0
  132. package/dist/sabs/editor-client-methods.d.ts +147 -0
  133. package/dist/sabs/editor-client-methods.js +715 -0
  134. package/dist/sabs/editor-client-methods.js.map +1 -0
  135. package/dist/sabs/recent-tool-runs.d.ts +14 -0
  136. package/dist/sabs/recent-tool-runs.js +61 -0
  137. package/dist/sabs/recent-tool-runs.js.map +1 -0
  138. package/dist/sabs/session-peer.d.ts +351 -0
  139. package/dist/sabs/session-peer.js +2 -0
  140. package/dist/sabs/session-peer.js.map +1 -0
  141. package/dist/sabs/turn-collector.d.ts +152 -0
  142. package/dist/sabs/turn-collector.js +573 -0
  143. package/dist/sabs/turn-collector.js.map +1 -0
  144. package/dist/sabs/websocket-session-peer.d.ts +514 -0
  145. package/dist/sabs/websocket-session-peer.js +2487 -0
  146. package/dist/sabs/websocket-session-peer.js.map +1 -0
  147. package/dist/security/constant-time.d.ts +9 -0
  148. package/dist/security/constant-time.js +13 -0
  149. package/dist/security/constant-time.js.map +1 -0
  150. package/dist/server/client.d.ts +371 -0
  151. package/dist/server/client.js +572 -0
  152. package/dist/server/client.js.map +1 -0
  153. package/dist/server/identity-reads.d.ts +76 -0
  154. package/dist/server/identity-reads.js +209 -0
  155. package/dist/server/identity-reads.js.map +1 -0
  156. package/dist/start.d.ts +14 -0
  157. package/dist/start.js +75 -0
  158. package/dist/start.js.map +1 -0
  159. package/dist/telemetry/metrics.d.ts +32 -0
  160. package/dist/telemetry/metrics.js +57 -0
  161. package/dist/telemetry/metrics.js.map +1 -0
  162. package/dist/transports/mcp/admin-tools.d.ts +47 -0
  163. package/dist/transports/mcp/admin-tools.js +164 -0
  164. package/dist/transports/mcp/admin-tools.js.map +1 -0
  165. package/dist/transports/mcp/app-status-html.d.ts +15 -0
  166. package/dist/transports/mcp/app-status-html.js +563 -0
  167. package/dist/transports/mcp/app-status-html.js.map +1 -0
  168. package/dist/transports/mcp/decision-elicitation.d.ts +74 -0
  169. package/dist/transports/mcp/decision-elicitation.js +233 -0
  170. package/dist/transports/mcp/decision-elicitation.js.map +1 -0
  171. package/dist/transports/mcp/dispatch-probe.d.ts +24 -0
  172. package/dist/transports/mcp/dispatch-probe.js +48 -0
  173. package/dist/transports/mcp/dispatch-probe.js.map +1 -0
  174. package/dist/transports/mcp/format-tool-content.d.ts +25 -0
  175. package/dist/transports/mcp/format-tool-content.js +48 -0
  176. package/dist/transports/mcp/format-tool-content.js.map +1 -0
  177. package/dist/transports/mcp/mount.d.ts +9 -0
  178. package/dist/transports/mcp/mount.js +469 -0
  179. package/dist/transports/mcp/mount.js.map +1 -0
  180. package/dist/transports/mcp/progress-notifier.d.ts +39 -0
  181. package/dist/transports/mcp/progress-notifier.js +52 -0
  182. package/dist/transports/mcp/progress-notifier.js.map +1 -0
  183. package/package.json +72 -0
package/dist/transports/mcp/app-status-html.d.ts ADDED
@@ -0,0 +1,15 @@
1
+ /**
2
+ * Self-contained MCP App HTML for Gateway status / open-link buttons.
3
+ *
4
+ * Nested iframes of Superblocks (preview / editor / live) were removed: Claude's
5
+ * widget origin cannot hold a Superblocks Auth0 session, and Private Network
6
+ * Access blocks localhost from a public parent. Display-mode controls (pip /
7
+ * fullscreen / inline) were also removed — without an iframe they only resized
8
+ * the status card. openLink buttons keep URLs in JS memory only (not printed).
9
+ *
10
+ * Speaks the MCP Apps postMessage dialect without bundling ext-apps into the
11
+ * card (hosts cache UI resources; keep this file small and inline). Bump the
12
+ * resource URI when the HTML changes so Claude Desktop refreshes its cache.
13
+ */
14
+ export declare const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v6.html";
15
+ export declare const APP_STATUS_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n <meta charset=\"utf-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n <title>Superblocks app</title>\n <style>\n :root {\n color-scheme: light dark;\n }\n body {\n margin: 0;\n font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n font-size: var(--font-text-sm-size, 13px);\n line-height: var(--font-text-sm-line-height, 1.45);\n color: var(--color-text-primary, #0f172a);\n background: transparent;\n }\n .card {\n display: flex;\n flex-direction: column;\n gap: 10px;\n padding: 14px;\n border: var(--border-width-regular, 1px) solid\n var(--color-border-primary, #e2e8f0);\n border-radius: var(--border-radius-lg, 12px);\n background: var(--color-background-primary, #ffffff);\n }\n .head {\n display: flex;\n align-items: center;\n gap: 8px;\n }\n h1 {\n flex: 1;\n margin: 0;\n font-size: var(--font-text-md-size, 14px);\n font-weight: var(--font-weight-semibold, 600);\n }\n .status {\n padding: 2px 8px;\n border-radius: var(--border-radius-full, 999px);\n background: var(--color-background-secondary, #f1f5f9);\n color: var(--color-text-secondary, #64748b);\n font-size: var(--font-text-xs-size, 12px);\n text-transform: lowercase;\n }\n .meta {\n color: var(--color-text-tertiary, #94a3b8);\n font-size: var(--font-text-xs-size, 12px);\n }\n .note {\n display: none;\n color: var(--color-text-warning, #b45309);\n font-size: var(--font-text-xs-size, 12px);\n }\n .note.shown {\n display: block;\n }\n .shot {\n display: none;\n width: 100%;\n border: var(--border-width-regular, 1px) solid\n var(--color-border-primary, #e2e8f0);\n border-radius: var(--border-radius-md, 8px);\n }\n .shot.shown {\n display: block;\n }\n .actions {\n display: flex;\n flex-wrap: wrap;\n gap: 8px;\n }\n button {\n appearance: none;\n border: var(--border-width-regular, 1px) solid\n var(--color-border-primary, #e2e8f0);\n border-radius: var(--border-radius-md, 8px);\n padding: 7px 12px;\n background: var(--color-background-secondary, #f8fafc);\n color: var(--color-text-primary, #0f172a);\n font: inherit;\n font-weight: var(--font-weight-medium, 500);\n cursor: pointer;\n }\n button:hover:not(:disabled) {\n background: var(--color-background-tertiary, #f1f5f9);\n }\n button:disabled {\n opacity: 0.45;\n cursor: not-allowed;\n }\n </style>\n</head>\n<body>\n <div class=\"card\">\n <div class=\"head\">\n <h1>Superblocks app</h1>\n <span id=\"status\" class=\"status\">loading</span>\n </div>\n <div id=\"appId\" class=\"meta\"></div>\n <img id=\"shot\" class=\"shot\" alt=\"Preview of the running app\" />\n <div id=\"note\" class=\"note\"></div>\n <div class=\"actions\">\n <button id=\"openEditor\" type=\"button\" disabled>Open editor</button>\n <button id=\"openPreview\" type=\"button\" disabled>Open preview</button>\n <button id=\"publishApp\" type=\"button\" disabled>Publish app</button>\n </div>\n </div>\n <script>\n (() => {\n const PROTOCOL_VERSION = \"2026-01-26\";\n let nextId = 1;\n const pending = new Map();\n let applicationId = \"\";\n let appName = \"\";\n let commitId = \"\";\n let editUrl = \"\";\n let previewUrl = \"\";\n let publishUrl = \"\";\n let canOpenLinks = false;\n let canCallTools = false;\n let publishing = false;\n let lastHeight = 0;\n\n function post(message) {\n window.parent.postMessage(message, \"*\");\n }\n\n function notify(method, params) {\n post({ jsonrpc: \"2.0\", method, params });\n }\n\n function request(method, params) {\n const id = nextId++;\n return new Promise((resolve, reject) => {\n pending.set(id, { resolve, reject });\n post({ jsonrpc: \"2.0\", id, method, params });\n });\n }\n\n function element(id) {\n return document.getElementById(id);\n }\n\n function show(id, on) {\n const node = element(id);\n if (node && node.classList) {\n node.classList.toggle(\"shown\", on);\n }\n }\n\n // Hosts size the card from this notification alone; without it the card\n // is laid out at zero height and never appears.\n function reportSize() {\n const height = Math.ceil(document.documentElement.scrollHeight || 0);\n if (height <= 0 || height === lastHeight) {\n return;\n }\n lastHeight = height;\n notify(\"ui/notifications/size-changed\", {\n height,\n width: Math.ceil(window.innerWidth || 0),\n });\n }\n\n function note(text) {\n element(\"note\").textContent = text;\n show(\"note\", Boolean(text));\n reportSize();\n }\n\n function isPlainHttp(url) {\n return url.slice(0, 5).toLowerCase() === \"http:\";\n }\n\n /** A UUID says nothing; the name the user asked Superblocks for does. */\n function renderIdentity() {\n element(\"appId\").textContent = appName || applicationId;\n }\n\n /**\n * Draws the screenshot the tool captured.\n *\n * Hosts that render an MCP App render it *instead of* the tool's content\n * blocks, so the image block get_app returns never reaches the user on\n * its own \u2014 the card has to take it out of the result and show it.\n */\n function showScreenshot(dataBase64, mimeType) {\n if (typeof dataBase64 !== \"string\" || !dataBase64) {\n return;\n }\n element(\"shot\").src =\n \"data:\" + (mimeType || \"image/jpeg\") + \";base64,\" + dataBase64;\n show(\"shot\", true);\n reportSize();\n }\n\n /** Applies every part of an MCP content array the card understands. */\n function applyContent(content) {\n for (const part of content || []) {\n if (!part) {\n continue;\n }\n if (part.type === \"text\" && typeof part.text === \"string\") {\n applyPayload(part.text);\n }\n if (part.type === \"image\") {\n showScreenshot(part.data, part.mimeType);\n }\n }\n }\n\n /**\n * Keep URLs in memory for openLink \u2014 never print them (preview JWTs are\n * huge and ugly in the card).\n */\n function renderActions() {\n element(\"openEditor\").disabled = !editUrl || !canOpenLinks;\n element(\"openPreview\").disabled = !previewUrl || !canOpenLinks;\n // Once the app is live, publishing again is not what anyone wants from\n // this button \u2014 going to the live app is.\n element(\"publishApp\").textContent = publishUrl\n ? \"Open published app\"\n : \"Publish app\";\n element(\"publishApp\").disabled = publishUrl\n ? !canOpenLinks\n : !applicationId || !canCallTools || publishing;\n // Only warn about what is actually broken. Hosts that do open links\n // handle local http fine; if one refuses, refused() says so then.\n if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {\n note(\"This host cannot open links for me \u2014 ask the model for an https preview URL.\");\n }\n reportSize();\n }\n\n /** Only ever ask the host to open a real web address. */\n function webUrl(candidate) {\n try {\n const parsed = new URL(candidate);\n return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n ? candidate\n : \"\";\n } catch {\n return \"\";\n }\n }\n\n /**\n * Merges whatever the host sent. Hosts replay tool input as well as tool\n * results, and the input carries no status or URLs \u2014 overwriting from a\n * partial payload is what showed the card as \"unknown\".\n *\n * Hosts also disagree on the shape: some pass the capability JSON, some\n * pass the MCP content/text envelope (Claude Desktop on initialize), and\n * some nest that under structuredContent.\n */\n function applyPayload(raw) {\n let data = raw;\n if (typeof raw === \"string\") {\n try {\n data = JSON.parse(raw);\n } catch {\n return;\n }\n }\n if (!data || typeof data !== \"object\") {\n return;\n }\n // MCP tool-result / initialize toolResult envelope.\n if (Array.isArray(data.content)) {\n applyContent(data.content);\n if (data.structuredContent) {\n applyPayload(data.structuredContent);\n }\n return;\n }\n if (data.result && typeof data.result === \"object\") {\n applyPayload(data.result);\n return;\n }\n const value = data.kind === \"ok\" ? data.value : data;\n if (!value || typeof value !== \"object\") {\n return;\n }\n if (typeof value.status === \"string\") {\n element(\"status\").textContent = value.status;\n }\n if (typeof value.applicationId === \"string\") {\n applicationId = value.applicationId;\n renderIdentity();\n }\n if (typeof value.name === \"string\" && value.name) {\n appName = value.name;\n renderIdentity();\n }\n if (typeof value.commitId === \"string\") {\n commitId = value.commitId;\n }\n if (typeof value.screenshotBase64 === \"string\") {\n showScreenshot(value.screenshotBase64, \"image/jpeg\");\n }\n if (typeof value.editUrl === \"string\") {\n editUrl = webUrl(value.editUrl);\n }\n if (typeof value.previewUrl === \"string\") {\n previewUrl = webUrl(value.previewUrl);\n }\n if (typeof value.publishUrl === \"string\") {\n publishUrl = webUrl(value.publishUrl);\n }\n // Hosts that deliver URLs without a status left the badge on the HTML\n // default (\"loading\") even after the app was built.\n const badge = element(\"status\").textContent;\n if (\n !value.status &&\n editUrl &&\n (badge === \"\" || badge === \"loading\" || badge === \"waiting\")\n ) {\n element(\"status\").textContent = previewUrl ? \"ready\" : \"building\";\n }\n renderActions();\n }\n\n /**\n * When the host opened the card with tool input (applicationId) but never\n * pushed a tool result, refresh ourselves so the badge is not stuck on\n * \"loading\" after the build finished.\n */\n function refreshFromServer() {\n if (!canCallTools || !applicationId || editUrl) {\n return;\n }\n request(\"tools/call\", {\n name: \"get_app\",\n arguments: { applicationId },\n })\n .then((result) => {\n if (!result || result.isError) {\n return;\n }\n applyPayload(result);\n if (result.structuredContent) {\n applyPayload(result.structuredContent);\n }\n })\n .catch(() => {\n // Host declined; stay on whatever we have.\n });\n }\n\n function applyHostContext(context) {\n if (!context || typeof context !== \"object\") {\n return;\n }\n const variables = context.styles && context.styles.variables;\n const style = document.documentElement.style;\n if (variables && style && typeof style.setProperty === \"function\") {\n for (const name of Object.keys(variables)) {\n const value = variables[name];\n if (typeof value === \"string\") {\n style.setProperty(name, value);\n }\n }\n }\n reportSize();\n }\n\n function refused(url) {\n note(\n isPlainHttp(url)\n ? \"This host only opens https links, and this app is served over http \u2014 ask for an https preview URL.\"\n : \"The host could not open the link \u2014 try again or ask the model for another URL.\",\n );\n }\n\n function openLink(url) {\n if (!url || !canOpenLinks) {\n return;\n }\n request(\"ui/open-link\", { url })\n .then((result) => {\n if (result && result.isError) {\n refused(url);\n return;\n }\n note(\"\");\n })\n .catch(() => refused(url));\n }\n\n /**\n * Asks the host to proxy publish_app back to this MCP server. The prompt\n * is the commit message createCommit needs; the card supplies a fixed one\n * so the user does not have to type through the model.\n */\n function publish() {\n if (!applicationId || !canCallTools || publishing) {\n return;\n }\n publishing = true;\n renderActions();\n note(\"Publishing\u2026\");\n const args = {\n applicationId,\n idempotencyKey:\n \"mcp-app-publish:\" + applicationId + \":\" + Date.now(),\n prompt: \"Published from Gateway status card\",\n };\n if (commitId) {\n args.commitId = commitId;\n }\n request(\"tools/call\", { name: \"publish_app\", arguments: args })\n .then((result) => {\n publishing = false;\n if (!result || result.isError) {\n const text =\n result &&\n Array.isArray(result.content) &&\n result.content[0] &&\n result.content[0].text\n ? String(result.content[0].text)\n : \"Publish failed.\";\n note(text.slice(0, 280));\n renderActions();\n return;\n }\n applyContent(result.content || []);\n if (result.structuredContent) {\n applyPayload(result.structuredContent);\n }\n note(\n publishUrl\n ? \"Published \u2014 open the live app with Open published app.\"\n : \"Published \u2014 the app is live.\",\n );\n renderActions();\n })\n .catch((error) => {\n publishing = false;\n note(\n (error && error.message) ||\n \"The host could not call publish_app.\",\n );\n renderActions();\n });\n }\n\n function handleHostMessage(event) {\n // App documents are opaque-origin, so the host window is the only\n // identity available to authenticate a message against.\n if (event.source !== window.parent) {\n return;\n }\n const data = event.data;\n if (!data || typeof data !== \"object\") {\n return;\n }\n if (data.method === \"ping\") {\n post({ jsonrpc: \"2.0\", id: data.id, result: {} });\n return;\n }\n if (data.id != null && pending.has(data.id)) {\n const waiter = pending.get(data.id);\n pending.delete(data.id);\n if (data.error) {\n waiter.reject(data.error);\n } else {\n waiter.resolve(data.result);\n }\n return;\n }\n const method = data.method;\n const params = data.params || {};\n if (\n method === \"ui/notifications/tool-result\" ||\n method === \"ui/tool-result\" ||\n method === \"tools/call\"\n ) {\n applyContent(params.content || params.result?.content || []);\n if (params.structuredContent) {\n applyPayload(params.structuredContent);\n }\n }\n if (method === \"ui/notifications/tool-input\" && params.arguments) {\n applyPayload(params.arguments);\n refreshFromServer();\n }\n if (method === \"ui/notifications/host-context-changed\") {\n applyHostContext(params);\n }\n }\n\n window.addEventListener(\"message\", handleHostMessage);\n\n element(\"openEditor\").addEventListener(\"click\", () => openLink(editUrl));\n element(\"openPreview\").addEventListener(\"click\", () =>\n openLink(previewUrl),\n );\n element(\"publishApp\").addEventListener(\"click\", () => {\n if (publishUrl) {\n openLink(publishUrl);\n return;\n }\n publish();\n });\n\n if (typeof ResizeObserver === \"function\") {\n new ResizeObserver(reportSize).observe(document.documentElement);\n }\n\n void request(\"ui/initialize\", {\n appCapabilities: {\n availableDisplayModes: [\"inline\"],\n },\n appInfo: { name: \"gateway-app-status\", version: \"0.0.6\" },\n protocolVersion: PROTOCOL_VERSION,\n })\n .then((result) => {\n // Hosts hold back tool results until the app confirms it is ready.\n notify(\"ui/notifications/initialized\", {});\n // Buttons that cannot work are worse than no buttons: hosts without\n // openLinks silently drop ui/open-link.\n canOpenLinks = Boolean(\n result && result.hostCapabilities && result.hostCapabilities.openLinks,\n );\n canCallTools = Boolean(\n result &&\n result.hostCapabilities &&\n result.hostCapabilities.serverTools,\n );\n applyHostContext(result && result.hostContext);\n renderActions();\n if (result && result.toolResult) {\n applyPayload(result.toolResult);\n }\n refreshFromServer();\n })\n .catch(() => {\n // Hosts that push tool results via notification still work.\n })\n .finally(reportSize);\n })();\n </script>\n</body>\n</html>\n";
package/dist/transports/mcp/app-status-html.js ADDED
@@ -0,0 +1,563 @@
1
+ /**
2
+ * Self-contained MCP App HTML for Gateway status / open-link buttons.
3
+ *
4
+ * Nested iframes of Superblocks (preview / editor / live) were removed: Claude's
5
+ * widget origin cannot hold a Superblocks Auth0 session, and Private Network
6
+ * Access blocks localhost from a public parent. Display-mode controls (pip /
7
+ * fullscreen / inline) were also removed — without an iframe they only resized
8
+ * the status card. openLink buttons keep URLs in JS memory only (not printed).
9
+ *
10
+ * Speaks the MCP Apps postMessage dialect without bundling ext-apps into the
11
+ * card (hosts cache UI resources; keep this file small and inline). Bump the
12
+ * resource URI when the HTML changes so Claude Desktop refreshes its cache.
13
+ */
14
+ export const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v6.html";
15
+ export const APP_STATUS_HTML = `<!DOCTYPE html>
16
+ <html lang="en">
17
+ <head>
18
+ <meta charset="utf-8" />
19
+ <meta name="viewport" content="width=device-width, initial-scale=1" />
20
+ <title>Superblocks app</title>
21
+ <style>
22
+ :root {
23
+ color-scheme: light dark;
24
+ }
25
+ body {
26
+ margin: 0;
27
+ font-family: var(--font-sans, system-ui, -apple-system, sans-serif);
28
+ font-size: var(--font-text-sm-size, 13px);
29
+ line-height: var(--font-text-sm-line-height, 1.45);
30
+ color: var(--color-text-primary, #0f172a);
31
+ background: transparent;
32
+ }
33
+ .card {
34
+ display: flex;
35
+ flex-direction: column;
36
+ gap: 10px;
37
+ padding: 14px;
38
+ border: var(--border-width-regular, 1px) solid
39
+ var(--color-border-primary, #e2e8f0);
40
+ border-radius: var(--border-radius-lg, 12px);
41
+ background: var(--color-background-primary, #ffffff);
42
+ }
43
+ .head {
44
+ display: flex;
45
+ align-items: center;
46
+ gap: 8px;
47
+ }
48
+ h1 {
49
+ flex: 1;
50
+ margin: 0;
51
+ font-size: var(--font-text-md-size, 14px);
52
+ font-weight: var(--font-weight-semibold, 600);
53
+ }
54
+ .status {
55
+ padding: 2px 8px;
56
+ border-radius: var(--border-radius-full, 999px);
57
+ background: var(--color-background-secondary, #f1f5f9);
58
+ color: var(--color-text-secondary, #64748b);
59
+ font-size: var(--font-text-xs-size, 12px);
60
+ text-transform: lowercase;
61
+ }
62
+ .meta {
63
+ color: var(--color-text-tertiary, #94a3b8);
64
+ font-size: var(--font-text-xs-size, 12px);
65
+ }
66
+ .note {
67
+ display: none;
68
+ color: var(--color-text-warning, #b45309);
69
+ font-size: var(--font-text-xs-size, 12px);
70
+ }
71
+ .note.shown {
72
+ display: block;
73
+ }
74
+ .shot {
75
+ display: none;
76
+ width: 100%;
77
+ border: var(--border-width-regular, 1px) solid
78
+ var(--color-border-primary, #e2e8f0);
79
+ border-radius: var(--border-radius-md, 8px);
80
+ }
81
+ .shot.shown {
82
+ display: block;
83
+ }
84
+ .actions {
85
+ display: flex;
86
+ flex-wrap: wrap;
87
+ gap: 8px;
88
+ }
89
+ button {
90
+ appearance: none;
91
+ border: var(--border-width-regular, 1px) solid
92
+ var(--color-border-primary, #e2e8f0);
93
+ border-radius: var(--border-radius-md, 8px);
94
+ padding: 7px 12px;
95
+ background: var(--color-background-secondary, #f8fafc);
96
+ color: var(--color-text-primary, #0f172a);
97
+ font: inherit;
98
+ font-weight: var(--font-weight-medium, 500);
99
+ cursor: pointer;
100
+ }
101
+ button:hover:not(:disabled) {
102
+ background: var(--color-background-tertiary, #f1f5f9);
103
+ }
104
+ button:disabled {
105
+ opacity: 0.45;
106
+ cursor: not-allowed;
107
+ }
108
+ </style>
109
+ </head>
110
+ <body>
111
+ <div class="card">
112
+ <div class="head">
113
+ <h1>Superblocks app</h1>
114
+ <span id="status" class="status">loading</span>
115
+ </div>
116
+ <div id="appId" class="meta"></div>
117
+ <img id="shot" class="shot" alt="Preview of the running app" />
118
+ <div id="note" class="note"></div>
119
+ <div class="actions">
120
+ <button id="openEditor" type="button" disabled>Open editor</button>
121
+ <button id="openPreview" type="button" disabled>Open preview</button>
122
+ <button id="publishApp" type="button" disabled>Publish app</button>
123
+ </div>
124
+ </div>
125
+ <script>
126
+ (() => {
127
+ const PROTOCOL_VERSION = "2026-01-26";
128
+ let nextId = 1;
129
+ const pending = new Map();
130
+ let applicationId = "";
131
+ let appName = "";
132
+ let commitId = "";
133
+ let editUrl = "";
134
+ let previewUrl = "";
135
+ let publishUrl = "";
136
+ let canOpenLinks = false;
137
+ let canCallTools = false;
138
+ let publishing = false;
139
+ let lastHeight = 0;
140
+
141
+ function post(message) {
142
+ window.parent.postMessage(message, "*");
143
+ }
144
+
145
+ function notify(method, params) {
146
+ post({ jsonrpc: "2.0", method, params });
147
+ }
148
+
149
+ function request(method, params) {
150
+ const id = nextId++;
151
+ return new Promise((resolve, reject) => {
152
+ pending.set(id, { resolve, reject });
153
+ post({ jsonrpc: "2.0", id, method, params });
154
+ });
155
+ }
156
+
157
+ function element(id) {
158
+ return document.getElementById(id);
159
+ }
160
+
161
+ function show(id, on) {
162
+ const node = element(id);
163
+ if (node && node.classList) {
164
+ node.classList.toggle("shown", on);
165
+ }
166
+ }
167
+
168
+ // Hosts size the card from this notification alone; without it the card
169
+ // is laid out at zero height and never appears.
170
+ function reportSize() {
171
+ const height = Math.ceil(document.documentElement.scrollHeight || 0);
172
+ if (height <= 0 || height === lastHeight) {
173
+ return;
174
+ }
175
+ lastHeight = height;
176
+ notify("ui/notifications/size-changed", {
177
+ height,
178
+ width: Math.ceil(window.innerWidth || 0),
179
+ });
180
+ }
181
+
182
+ function note(text) {
183
+ element("note").textContent = text;
184
+ show("note", Boolean(text));
185
+ reportSize();
186
+ }
187
+
188
+ function isPlainHttp(url) {
189
+ return url.slice(0, 5).toLowerCase() === "http:";
190
+ }
191
+
192
+ /** A UUID says nothing; the name the user asked Superblocks for does. */
193
+ function renderIdentity() {
194
+ element("appId").textContent = appName || applicationId;
195
+ }
196
+
197
+ /**
198
+ * Draws the screenshot the tool captured.
199
+ *
200
+ * Hosts that render an MCP App render it *instead of* the tool's content
201
+ * blocks, so the image block get_app returns never reaches the user on
202
+ * its own — the card has to take it out of the result and show it.
203
+ */
204
+ function showScreenshot(dataBase64, mimeType) {
205
+ if (typeof dataBase64 !== "string" || !dataBase64) {
206
+ return;
207
+ }
208
+ element("shot").src =
209
+ "data:" + (mimeType || "image/jpeg") + ";base64," + dataBase64;
210
+ show("shot", true);
211
+ reportSize();
212
+ }
213
+
214
+ /** Applies every part of an MCP content array the card understands. */
215
+ function applyContent(content) {
216
+ for (const part of content || []) {
217
+ if (!part) {
218
+ continue;
219
+ }
220
+ if (part.type === "text" && typeof part.text === "string") {
221
+ applyPayload(part.text);
222
+ }
223
+ if (part.type === "image") {
224
+ showScreenshot(part.data, part.mimeType);
225
+ }
226
+ }
227
+ }
228
+
229
+ /**
230
+ * Keep URLs in memory for openLink — never print them (preview JWTs are
231
+ * huge and ugly in the card).
232
+ */
233
+ function renderActions() {
234
+ element("openEditor").disabled = !editUrl || !canOpenLinks;
235
+ element("openPreview").disabled = !previewUrl || !canOpenLinks;
236
+ // Once the app is live, publishing again is not what anyone wants from
237
+ // this button — going to the live app is.
238
+ element("publishApp").textContent = publishUrl
239
+ ? "Open published app"
240
+ : "Publish app";
241
+ element("publishApp").disabled = publishUrl
242
+ ? !canOpenLinks
243
+ : !applicationId || !canCallTools || publishing;
244
+ // Only warn about what is actually broken. Hosts that do open links
245
+ // handle local http fine; if one refuses, refused() says so then.
246
+ if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {
247
+ note("This host cannot open links for me — ask the model for an https preview URL.");
248
+ }
249
+ reportSize();
250
+ }
251
+
252
+ /** Only ever ask the host to open a real web address. */
253
+ function webUrl(candidate) {
254
+ try {
255
+ const parsed = new URL(candidate);
256
+ return parsed.protocol === "http:" || parsed.protocol === "https:"
257
+ ? candidate
258
+ : "";
259
+ } catch {
260
+ return "";
261
+ }
262
+ }
263
+
264
+ /**
265
+ * Merges whatever the host sent. Hosts replay tool input as well as tool
266
+ * results, and the input carries no status or URLs — overwriting from a
267
+ * partial payload is what showed the card as "unknown".
268
+ *
269
+ * Hosts also disagree on the shape: some pass the capability JSON, some
270
+ * pass the MCP content/text envelope (Claude Desktop on initialize), and
271
+ * some nest that under structuredContent.
272
+ */
273
+ function applyPayload(raw) {
274
+ let data = raw;
275
+ if (typeof raw === "string") {
276
+ try {
277
+ data = JSON.parse(raw);
278
+ } catch {
279
+ return;
280
+ }
281
+ }
282
+ if (!data || typeof data !== "object") {
283
+ return;
284
+ }
285
+ // MCP tool-result / initialize toolResult envelope.
286
+ if (Array.isArray(data.content)) {
287
+ applyContent(data.content);
288
+ if (data.structuredContent) {
289
+ applyPayload(data.structuredContent);
290
+ }
291
+ return;
292
+ }
293
+ if (data.result && typeof data.result === "object") {
294
+ applyPayload(data.result);
295
+ return;
296
+ }
297
+ const value = data.kind === "ok" ? data.value : data;
298
+ if (!value || typeof value !== "object") {
299
+ return;
300
+ }
301
+ if (typeof value.status === "string") {
302
+ element("status").textContent = value.status;
303
+ }
304
+ if (typeof value.applicationId === "string") {
305
+ applicationId = value.applicationId;
306
+ renderIdentity();
307
+ }
308
+ if (typeof value.name === "string" && value.name) {
309
+ appName = value.name;
310
+ renderIdentity();
311
+ }
312
+ if (typeof value.commitId === "string") {
313
+ commitId = value.commitId;
314
+ }
315
+ if (typeof value.screenshotBase64 === "string") {
316
+ showScreenshot(value.screenshotBase64, "image/jpeg");
317
+ }
318
+ if (typeof value.editUrl === "string") {
319
+ editUrl = webUrl(value.editUrl);
320
+ }
321
+ if (typeof value.previewUrl === "string") {
322
+ previewUrl = webUrl(value.previewUrl);
323
+ }
324
+ if (typeof value.publishUrl === "string") {
325
+ publishUrl = webUrl(value.publishUrl);
326
+ }
327
+ // Hosts that deliver URLs without a status left the badge on the HTML
328
+ // default ("loading") even after the app was built.
329
+ const badge = element("status").textContent;
330
+ if (
331
+ !value.status &&
332
+ editUrl &&
333
+ (badge === "" || badge === "loading" || badge === "waiting")
334
+ ) {
335
+ element("status").textContent = previewUrl ? "ready" : "building";
336
+ }
337
+ renderActions();
338
+ }
339
+
340
+ /**
341
+ * When the host opened the card with tool input (applicationId) but never
342
+ * pushed a tool result, refresh ourselves so the badge is not stuck on
343
+ * "loading" after the build finished.
344
+ */
345
+ function refreshFromServer() {
346
+ if (!canCallTools || !applicationId || editUrl) {
347
+ return;
348
+ }
349
+ request("tools/call", {
350
+ name: "get_app",
351
+ arguments: { applicationId },
352
+ })
353
+ .then((result) => {
354
+ if (!result || result.isError) {
355
+ return;
356
+ }
357
+ applyPayload(result);
358
+ if (result.structuredContent) {
359
+ applyPayload(result.structuredContent);
360
+ }
361
+ })
362
+ .catch(() => {
363
+ // Host declined; stay on whatever we have.
364
+ });
365
+ }
366
+
367
+ function applyHostContext(context) {
368
+ if (!context || typeof context !== "object") {
369
+ return;
370
+ }
371
+ const variables = context.styles && context.styles.variables;
372
+ const style = document.documentElement.style;
373
+ if (variables && style && typeof style.setProperty === "function") {
374
+ for (const name of Object.keys(variables)) {
375
+ const value = variables[name];
376
+ if (typeof value === "string") {
377
+ style.setProperty(name, value);
378
+ }
379
+ }
380
+ }
381
+ reportSize();
382
+ }
383
+
384
+ function refused(url) {
385
+ note(
386
+ isPlainHttp(url)
387
+ ? "This host only opens https links, and this app is served over http — ask for an https preview URL."
388
+ : "The host could not open the link — try again or ask the model for another URL.",
389
+ );
390
+ }
391
+
392
+ function openLink(url) {
393
+ if (!url || !canOpenLinks) {
394
+ return;
395
+ }
396
+ request("ui/open-link", { url })
397
+ .then((result) => {
398
+ if (result && result.isError) {
399
+ refused(url);
400
+ return;
401
+ }
402
+ note("");
403
+ })
404
+ .catch(() => refused(url));
405
+ }
406
+
407
+ /**
408
+ * Asks the host to proxy publish_app back to this MCP server. The prompt
409
+ * is the commit message createCommit needs; the card supplies a fixed one
410
+ * so the user does not have to type through the model.
411
+ */
412
+ function publish() {
413
+ if (!applicationId || !canCallTools || publishing) {
414
+ return;
415
+ }
416
+ publishing = true;
417
+ renderActions();
418
+ note("Publishing…");
419
+ const args = {
420
+ applicationId,
421
+ idempotencyKey:
422
+ "mcp-app-publish:" + applicationId + ":" + Date.now(),
423
+ prompt: "Published from Gateway status card",
424
+ };
425
+ if (commitId) {
426
+ args.commitId = commitId;
427
+ }
428
+ request("tools/call", { name: "publish_app", arguments: args })
429
+ .then((result) => {
430
+ publishing = false;
431
+ if (!result || result.isError) {
432
+ const text =
433
+ result &&
434
+ Array.isArray(result.content) &&
435
+ result.content[0] &&
436
+ result.content[0].text
437
+ ? String(result.content[0].text)
438
+ : "Publish failed.";
439
+ note(text.slice(0, 280));
440
+ renderActions();
441
+ return;
442
+ }
443
+ applyContent(result.content || []);
444
+ if (result.structuredContent) {
445
+ applyPayload(result.structuredContent);
446
+ }
447
+ note(
448
+ publishUrl
449
+ ? "Published — open the live app with Open published app."
450
+ : "Published — the app is live.",
451
+ );
452
+ renderActions();
453
+ })
454
+ .catch((error) => {
455
+ publishing = false;
456
+ note(
457
+ (error && error.message) ||
458
+ "The host could not call publish_app.",
459
+ );
460
+ renderActions();
461
+ });
462
+ }
463
+
464
+ function handleHostMessage(event) {
465
+ // App documents are opaque-origin, so the host window is the only
466
+ // identity available to authenticate a message against.
467
+ if (event.source !== window.parent) {
468
+ return;
469
+ }
470
+ const data = event.data;
471
+ if (!data || typeof data !== "object") {
472
+ return;
473
+ }
474
+ if (data.method === "ping") {
475
+ post({ jsonrpc: "2.0", id: data.id, result: {} });
476
+ return;
477
+ }
478
+ if (data.id != null && pending.has(data.id)) {
479
+ const waiter = pending.get(data.id);
480
+ pending.delete(data.id);
481
+ if (data.error) {
482
+ waiter.reject(data.error);
483
+ } else {
484
+ waiter.resolve(data.result);
485
+ }
486
+ return;
487
+ }
488
+ const method = data.method;
489
+ const params = data.params || {};
490
+ if (
491
+ method === "ui/notifications/tool-result" ||
492
+ method === "ui/tool-result" ||
493
+ method === "tools/call"
494
+ ) {
495
+ applyContent(params.content || params.result?.content || []);
496
+ if (params.structuredContent) {
497
+ applyPayload(params.structuredContent);
498
+ }
499
+ }
500
+ if (method === "ui/notifications/tool-input" && params.arguments) {
501
+ applyPayload(params.arguments);
502
+ refreshFromServer();
503
+ }
504
+ if (method === "ui/notifications/host-context-changed") {
505
+ applyHostContext(params);
506
+ }
507
+ }
508
+
509
+ window.addEventListener("message", handleHostMessage);
510
+
511
+ element("openEditor").addEventListener("click", () => openLink(editUrl));
512
+ element("openPreview").addEventListener("click", () =>
513
+ openLink(previewUrl),
514
+ );
515
+ element("publishApp").addEventListener("click", () => {
516
+ if (publishUrl) {
517
+ openLink(publishUrl);
518
+ return;
519
+ }
520
+ publish();
521
+ });
522
+
523
+ if (typeof ResizeObserver === "function") {
524
+ new ResizeObserver(reportSize).observe(document.documentElement);
525
+ }
526
+
527
+ void request("ui/initialize", {
528
+ appCapabilities: {
529
+ availableDisplayModes: ["inline"],
530
+ },
531
+ appInfo: { name: "gateway-app-status", version: "0.0.6" },
532
+ protocolVersion: PROTOCOL_VERSION,
533
+ })
534
+ .then((result) => {
535
+ // Hosts hold back tool results until the app confirms it is ready.
536
+ notify("ui/notifications/initialized", {});
537
+ // Buttons that cannot work are worse than no buttons: hosts without
538
+ // openLinks silently drop ui/open-link.
539
+ canOpenLinks = Boolean(
540
+ result && result.hostCapabilities && result.hostCapabilities.openLinks,
541
+ );
542
+ canCallTools = Boolean(
543
+ result &&
544
+ result.hostCapabilities &&
545
+ result.hostCapabilities.serverTools,
546
+ );
547
+ applyHostContext(result && result.hostContext);
548
+ renderActions();
549
+ if (result && result.toolResult) {
550
+ applyPayload(result.toolResult);
551
+ }
552
+ refreshFromServer();
553
+ })
554
+ .catch(() => {
555
+ // Hosts that push tool results via notification still work.
556
+ })
557
+ .finally(reportSize);
558
+ })();
559
+ </script>
560
+ </body>
561
+ </html>
562
+ `;
563
+ //# sourceMappingURL=app-status-html.js.map
package/dist/transports/mcp/app-status-html.js.map ADDED
@@ -0,0 +1 @@
1
+ {"version":3,"file":"app-status-html.js","sourceRoot":"","sources":["../../../src/transports/mcp/app-status-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,iCAAiC,CAAC;AAEzE,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmiB9B,CAAC"}