@superblocksteam/gateway 2.0.157 → 2.0.158

package/dist/telemetry/mcp-client.js

@@ -0,0 +1,129 @@
+import { context, SpanStatusCode, trace, } from "@opentelemetry/api";
+function bounded(value, maxLength) {
+    return value.slice(0, maxLength);
+}
+function stringProperty(value, key) {
+    if (typeof value !== "object" || value === null || !(key in value)) {
+        return undefined;
+    }
+    const property = Reflect.get(value, key);
+    return typeof property === "string" ? property : undefined;
+}
+export class McpClientTelemetry {
+    tracer;
+    ended = false;
+    hadError = false;
+    organizationId;
+    sessionContext;
+    sessionSpan;
+    constructor(tracer) {
+        this.tracer = tracer;
+        this.sessionSpan = tracer.startSpan("gen_ai.request", {
+            attributes: {
+                "gen_ai.operation.name": "invoke_agent",
+            },
+        });
+        this.sessionContext = trace.setSpan(context.active(), this.sessionSpan);
+    }
+    setOrganizationId(organizationId) {
+        this.organizationId = organizationId;
+        this.sessionSpan.setAttribute("organization.id", organizationId);
+    }
+    async runTool(call, operation) {
+        const attributes = {
+            "gen_ai.operation.name": "execute_tool",
+            ...(call.client
+                ? {
+                    "mcp.client.name": bounded(call.client.name, 80),
+                    ...(call.client.version
+                        ? {
+                            "mcp.client.version": bounded(call.client.version, 40),
+                        }
+                        : {}),
+                }
+                : {}),
+            ...(this.organizationId
+                ? { "organization.id": this.organizationId }
+                : {}),
+            "tool.name": bounded(call.toolName, 80),
+        };
+        if (call.client) {
+            this.sessionSpan.setAttributes({
+                "mcp.client.name": bounded(call.client.name, 80),
+                ...(call.client.version
+                    ? { "mcp.client.version": bounded(call.client.version, 40) }
+                    : {}),
+            });
+        }
+        let span;
+        try {
+            span = this.tracer.startSpan("gen_ai.tool_call", { attributes }, this.sessionContext);
+        }
+        catch {
+            return operation();
+        }
+        const startedAt = Date.now();
+        try {
+            const result = await context.with(trace.setSpan(this.sessionContext, span), operation);
+            span.setAttribute("tool.duration_ms", Date.now() - startedAt);
+            if (this.organizationId) {
+                span.setAttribute("organization.id", this.organizationId);
+            }
+            if (result.kind === "error") {
+                this.hadError = true;
+                span.setAttributes({
+                    ...(result.applicationId
+                        ? { "application.id": result.applicationId }
+                        : {}),
+                    "mcp.error.code": bounded(result.code, 80),
+                    "tool.error_category": result.code === "cancelled" ? "timeout" : "execution_error",
+                    "tool.status": "error",
+                });
+                span.setStatus({ code: SpanStatusCode.ERROR });
+            }
+            else if (result.kind === "auth_required") {
+                this.hadError = true;
+                span.setAttributes({
+                    "mcp.result.status": "auth_required",
+                    "tool.error_category": "permission_denied",
+                    "tool.status": "error",
+                });
+            }
+            else {
+                const applicationId = stringProperty(result.value, "applicationId");
+                const resultStatus = stringProperty(result.value, "status");
+                span.setAttributes({
+                    ...(applicationId ? { "application.id": applicationId } : {}),
+                    ...(resultStatus
+                        ? { "mcp.result.status": bounded(resultStatus, 80) }
+                        : {}),
+                    "tool.error_category": "none",
+                    "tool.status": "success",
+                });
+            }
+            return result;
+        }
+        catch (error) {
+            this.hadError = true;
+            span.setAttributes({
+                "tool.duration_ms": Date.now() - startedAt,
+                "tool.error_category": "execution_error",
+                "tool.status": "error",
+            });
+            span.setStatus({ code: SpanStatusCode.ERROR });
+            throw error;
+        }
+        finally {
+            span.end();
+        }
+    }
+    endSession() {
+        if (this.ended) {
+            return;
+        }
+        this.ended = true;
+        this.sessionSpan.setAttribute("gen_ai.request.status", this.hadError ? "error" : "success");
+        this.sessionSpan.end();
+    }
+}
+//# sourceMappingURL=mcp-client.js.map

package/dist/telemetry/mcp-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-client.js","sourceRoot":"","sources":["../../src/telemetry/mcp-client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,OAAO,EAEP,cAAc,EACd,KAAK,GAEN,MAAM,oBAAoB,CAAC;AAc5B,SAAS,OAAO,CAAC,KAAa,EAAE,SAAiB;IAC/C,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,GAAW;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,EAAE,CAAC;QACnE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,OAAO,kBAAkB;IAOA;IANrB,KAAK,GAAG,KAAK,CAAC;IACd,QAAQ,GAAG,KAAK,CAAC;IACjB,cAAc,CAAqB;IAC1B,cAAc,CAAmC;IACjD,WAAW,CAAO;IAEnC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,gBAAgB,EAAE;YACpD,UAAU,EAAE;gBACV,uBAAuB,EAAE,cAAc;aACxC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC1E,CAAC;IAED,iBAAiB,CAAC,cAAsB;QACtC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,OAAO,CACX,IAAiB,EACjB,SAA6C;QAE7C,MAAM,UAAU,GAAG;YACjB,uBAAuB,EAAE,cAAc;YACvC,GAAG,CAAC,IAAI,CAAC,MAAM;gBACb,CAAC,CAAC;oBACE,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;wBACrB,CAAC,CAAC;4BACE,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;yBACvD;wBACH,CAAC,CAAC,EAAE,CAAC;iBACR;gBACH,CAAC,CAAC,EAAE,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,cAAc;gBACrB,CAAC,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE;gBAC5C,CAAC,CAAC,EAAE,CAAC;YACP,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;SACxC,CAAC;QACF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC;gBAC7B,iBAAiB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO;oBACrB,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE;oBAC5D,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAU,CAAC;QACf,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAC1B,kBAAkB,EAClB,EAAE,UAAU,EAAE,EACd,IAAI,CAAC,cAAc,CACpB,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAC/B,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,EACxC,SAAS,CACV,CAAC;YACF,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;YAC9D,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,YAAY,CAAC,iBAAiB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,aAAa,CAAC;oBACjB,GAAG,CAAC,MAAM,CAAC,aAAa;wBACtB,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,aAAa,EAAE;wBAC5C,CAAC,CAAC,EAAE,CAAC;oBACP,gBAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAC1C,qBAAqB,EACnB,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB;oBAC7D,aAAa,EAAE,OAAO;iBACvB,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;gBACrB,IAAI,CAAC,aAAa,CAAC;oBACjB,mBAAmB,EAAE,eAAe;oBACpC,qBAAqB,EAAE,mBAAmB;oBAC1C,aAAa,EAAE,OAAO;iBACvB,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;gBACpE,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;gBAC5D,IAAI,CAAC,aAAa,CAAC;oBACjB,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,YAAY;wBACd,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE;wBACpD,CAAC,CAAC,EAAE,CAAC;oBACP,qBAAqB,EAAE,MAAM;oBAC7B,aAAa,EAAE,SAAS;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,aAAa,CAAC;gBACjB,kBAAkB,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBAC1C,qBAAqB,EAAE,iBAAiB;gBACxC,aAAa,EAAE,OAAO;aACvB,CAAC,CAAC;YACH,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YAC/C,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAED,UAAU;QACR,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,WAAW,CAAC,YAAY,CAC3B,uBAAuB,EACvB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CACpC,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC;CACF"}

package/dist/telemetry/runtime.d.ts

@@ -0,0 +1,9 @@
+import type { GatewayConfig } from "../config.js";
+import { McpClientTelemetry } from "./mcp-client.js";
+export declare function startGatewayTelemetry(input: {
+    apiKey: string;
+    config: GatewayConfig;
+}): {
+    mcpTelemetry: McpClientTelemetry;
+    shutdown: () => Promise<void>;
+};

package/dist/telemetry/runtime.js

@@ -0,0 +1,121 @@
+import { DeploymentType, getDefaultPolicy, parseDeploymentType, } from "@superblocksteam/telemetry";
+import { initNodeTelemetry } from "@superblocksteam/telemetry/node";
+import { McpClientTelemetry } from "./mcp-client.js";
+const TELEMETRY_SHUTDOWN_MS = 2_000;
+/**
+ * stdout is the MCP JSON-RPC wire. Without a logger the shared init falls back
+ * to console.info, which writes there and corrupts the protocol.
+ */
+function logToStderr(first, message) {
+    if (message === undefined) {
+        console.error(first);
+        return;
+    }
+    console.error(first, message);
+}
+const stderrLogger = {
+    error: logToStderr,
+    info: logToStderr,
+    warn: logToStderr,
+};
+function telemetryBaseUrl(serverUrl) {
+    try {
+        const url = new URL(serverUrl);
+        url.hash = "";
+        url.pathname = `${url.pathname.replace(/\/$/u, "")}/api`;
+        url.search = "";
+        return url.toString().replace(/\/$/u, "");
+    }
+    catch {
+        console.error("gateway telemetry skipped: server URL is not parseable");
+        return undefined;
+    }
+}
+function environmentName(config) {
+    if (config.deploymentEnvironmentName !== "unknown") {
+        return config.deploymentEnvironmentName;
+    }
+    try {
+        return environmentFromHostname(new URL(config.serverUrl).hostname);
+    }
+    catch {
+        return "unknown";
+    }
+}
+function environmentFromHostname(hostname) {
+    if (hostname.match(/^app\.superblocks(?:hq)?\.com$/u)) {
+        return "prod";
+    }
+    if (hostname.match(/^eu\.superblocks(?:hq)?\.com$/u)) {
+        return "prod-eu";
+    }
+    if (hostname.match(/^staging\.superblocks(?:hq)?\.com$/u)) {
+        return "staging";
+    }
+    if (hostname.match(/^dev\.superblocks(?:hq)?\.com$/u)) {
+        return "dev";
+    }
+    if (hostname.match(/^pr-[0-9]+\.superblocks(?:hq)?\.dev$/u)) {
+        return "ephemeral";
+    }
+    if (hostname === "localhost" || hostname === "127.0.0.1") {
+        return "local";
+    }
+    return "other";
+}
+function deploymentTypeFor(config) {
+    if (config.localAgentMode) {
+        return DeploymentType.CLOUD_PREM;
+    }
+    try {
+        return parseDeploymentType(process.env.SUPERBLOCKS_DEPLOYMENT_TYPE);
+    }
+    catch {
+        return DeploymentType.CLOUD;
+    }
+}
+async function settleWithin(work, timeoutMs) {
+    let timer;
+    try {
+        await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timer = setTimeout(resolve, timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer !== undefined) {
+            clearTimeout(timer);
+        }
+    }
+}
+export function startGatewayTelemetry(input) {
+    const otlpUrl = telemetryBaseUrl(input.config.serverUrl);
+    const telemetry = initNodeTelemetry({
+        environment: environmentName(input.config),
+        logger: stderrLogger,
+        logsEnabled: false,
+        // Counters in metrics.ts are created at import time, before this SDK
+        // starts, so they stay no-ops. Do not turn metrics on until those
+        // instruments are created after init.
+        metricsEnabled: false,
+        otlpHeaders: { Authorization: `Bearer ${input.apiKey}` },
+        ...(otlpUrl ? { otlpUrl } : {}),
+        serviceName: "gateway",
+        serviceVersion: "0.0.1",
+    }, getDefaultPolicy(deploymentTypeFor(input.config)));
+    const mcpTelemetry = new McpClientTelemetry(telemetry.getTracer("gateway.mcp"));
+    return {
+        mcpTelemetry,
+        shutdown: async () => {
+            try {
+                mcpTelemetry.endSession();
+            }
+            finally {
+                await settleWithin(telemetry.shutdown(), TELEMETRY_SHUTDOWN_MS);
+            }
+        },
+    };
+}
+//# sourceMappingURL=runtime.js.map

package/dist/telemetry/runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.js","sourceRoot":"","sources":["../../src/telemetry/runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAGpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC;;;GAGG;AACH,SAAS,WAAW,CAAC,KAAsB,EAAE,OAAgB;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,KAAK,EAAE,WAAW;IAClB,IAAI,EAAE,WAAW;IACjB,IAAI,EAAE,WAAW;CAClB,CAAC;AAEF,SAAS,gBAAgB,CAAC,SAAiB;IACzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QAC/B,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC;QACd,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC;QACzD,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;QAChB,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;QACxE,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB;IAC5C,IAAI,MAAM,CAAC,yBAAyB,KAAK,SAAS,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,yBAAyB,CAAC;IAC1C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,uBAAuB,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACtD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,gCAAgC,CAAC,EAAE,CAAC;QACrD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,EAAE,CAAC;QAC1D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,iCAAiC,CAAC,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC,uCAAuC,CAAC,EAAE,CAAC;QAC5D,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACzD,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAqB;IAC9C,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO,cAAc,CAAC,UAAU,CAAC;IACnC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,CAAC,KAAK,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAmB,EACnB,SAAiB;IAEjB,IAAI,KAAgD,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAAC;YACjB,IAAI;YACJ,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5B,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACzC,CAAC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAGrC;IAIC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,iBAAiB,CACjC;QACE,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC;QAC1C,MAAM,EAAE,YAAY;QACpB,WAAW,EAAE,KAAK;QAClB,qEAAqE;QACrE,kEAAkE;QAClE,sCAAsC;QACtC,cAAc,EAAE,KAAK;QACrB,WAAW,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,MAAM,EAAE,EAAE;QACxD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,WAAW,EAAE,SAAS;QACtB,cAAc,EAAE,OAAO;KACxB,EACD,gBAAgB,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAClD,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,kBAAkB,CACzC,SAAS,CAAC,SAAS,CAAC,aAAa,CAAC,CACnC,CAAC;IAEF,OAAO;QACL,YAAY;QACZ,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,IAAI,CAAC;gBACH,YAAY,CAAC,UAAU,EAAE,CAAC;YAC5B,CAAC;oBAAS,CAAC;gBACT,MAAM,YAAY,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,qBAAqB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/transports/mcp/admin-tools.d.ts

@@ -1,6 +1,6 @@
 import type { AuthInfo } from "@modelcontextprotocol/sdk/server/auth/types.js";
 import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import type { Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { Tool, ToolAnnotations } from "@modelcontextprotocol/sdk/types.js";
 import { z } from "zod";
 import { type ToolRegistry } from "@superblocksteam/mcp-server";
 export type RegisterAdminToolsOptions = {
@@ -39,6 +39,8 @@ export declare function jsonSchemaToZodShape(inputSchema: Tool["inputSchema"], o
  * so clients do not reintroduce that name.
  */
 export declare function superblocksProductCopy(text: string): string;
+/** Completes MCP hints without overriding shared Admin definitions. */
+export declare function completeToolAnnotations(annotations: ToolAnnotations | undefined): ToolAnnotations;
 /**
  * Registers customer-profile Admin MCP tools on the same McpServer as Builder
  * tools. Each call runs under `runWithAuthContext` with the Gateway's

package/dist/transports/mcp/admin-tools.js

@@ -107,6 +107,17 @@ export function superblocksProductCopy(text) {
         .replaceAll(/\bClark AI Apps\b/g, "Superblocks AI Apps")
         .replaceAll(/\bClark\b/g, "Superblocks");
 }
+/** Completes MCP hints without overriding shared Admin definitions. */
+export function completeToolAnnotations(annotations) {
+    const readOnlyHint = annotations?.readOnlyHint ?? false;
+    return {
+        ...annotations,
+        destructiveHint: annotations?.destructiveHint ?? (readOnlyHint ? false : true),
+        idempotentHint: annotations?.idempotentHint ?? readOnlyHint,
+        openWorldHint: annotations?.openWorldHint ?? true,
+        readOnlyHint,
+    };
+}
 /**
  * Registers customer-profile Admin MCP tools on the same McpServer as Builder
  * tools. Each call runs under `runWithAuthContext` with the Gateway's
@@ -122,7 +133,7 @@ export function registerAdminTools(server, options) {
         }
         const definition = toolDefinitions.find((d) => d.name === tool.name);
         server.registerTool(tool.name, {
-            annotations: tool.annotations,
+            annotations: completeToolAnnotations(tool.annotations),
             description: superblocksProductCopy(tool.description ?? ""),
             inputSchema: gatewayAdminInputShape(tool.inputSchema),
             title: tool.title ?? definition?.title,

package/dist/transports/mcp/admin-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-tools.js","sourceRoot":"","sources":["../../../src/transports/mcp/admin-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,GAEhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyCjE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAgC,EAChC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GACb,WAAW,EAAE,UAEA,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAA2B;IACzD,QAAQ,EACN,iGAAiG;CACpG,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,WAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC9C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;KACtD,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CACZ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC;qBACL,MAAM,CACL,oBAAoB,CAAC;oBACnB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CACH;qBACA,WAAW,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAkC,EAClC,IAA0B;IAE1B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,6CAA6C,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACvD,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,EAAE;QAC9D,mBAAmB,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;KACrD,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3D,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,KAAK;SACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,iBAAiB,CAAC,oBAAoB,EAAE;gBACtC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAA4B;oBACxC,GAAI,IAAgC;oBACpC,wEAAwE;oBACxE,mEAAmE;oBACnE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/D,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;gBACF,YAAY,CAAC,qBAAqB,EAAE;oBAClC,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,qBAAqB,EAAE;oBAClC,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;oBAChE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"admin-tools.js","sourceRoot":"","sources":["../../../src/transports/mcp/admin-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,GAEhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyCjE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAgC,EAChC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GACb,WAAW,EAAE,UAEA,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAA2B;IACzD,QAAQ,EACN,iGAAiG;CACpG,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,WAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC9C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;KACtD,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CACZ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC;qBACL,MAAM,CACL,oBAAoB,CAAC;oBACnB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CACH;qBACA,WAAW,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAkC,EAClC,IAA0B;IAE1B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,6CAA6C,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACvD,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CACrC,WAAwC;IAExC,MAAM,YAAY,GAAG,WAAW,EAAE,YAAY,IAAI,KAAK,CAAC;IACxD,OAAO;QACL,GAAG,WAAW;QACd,eAAe,EACb,WAAW,EAAE,eAAe,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,cAAc,EAAE,WAAW,EAAE,cAAc,IAAI,YAAY;QAC3D,aAAa,EAAE,WAAW,EAAE,aAAa,IAAI,IAAI;QACjD,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,EAAE;QAC9D,mBAAmB,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;KACrD,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC;YACtD,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3D,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,KAAK;SACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,iBAAiB,CAAC,oBAAoB,EAAE;gBACtC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAA4B;oBACxC,GAAI,IAAgC;oBACpC,wEAAwE;oBACxE,mEAAmE;oBACnE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/D,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;gBACF,YAAY,CAAC,qBAAqB,EAAE;oBAClC,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,qBAAqB,EAAE;oBAClC,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;oBAChE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/transports/mcp/app-status-html.d.ts

@@ -11,5 +11,5 @@
  * card (hosts cache UI resources; keep this file small and inline). Bump the
  * resource URI when the HTML changes so Claude Desktop refreshes its cache.
  */
-export declare const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v6.html";
-export declare const APP_STATUS_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>Superblocks app</title>\n  <style>\n    :root {\n      color-scheme: light dark;\n    }\n    body {\n      margin: 0;\n      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n      font-size: var(--font-text-sm-size, 13px);\n      line-height: var(--font-text-sm-line-height, 1.45);\n      color: var(--color-text-primary, #0f172a);\n      background: transparent;\n    }\n    .card {\n      display: flex;\n      flex-direction: column;\n      gap: 10px;\n      padding: 14px;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-lg, 12px);\n      background: var(--color-background-primary, #ffffff);\n    }\n    .head {\n      display: flex;\n      align-items: center;\n      gap: 8px;\n    }\n    h1 {\n      flex: 1;\n      margin: 0;\n      font-size: var(--font-text-md-size, 14px);\n      font-weight: var(--font-weight-semibold, 600);\n    }\n    .status {\n      padding: 2px 8px;\n      border-radius: var(--border-radius-full, 999px);\n      background: var(--color-background-secondary, #f1f5f9);\n      color: var(--color-text-secondary, #64748b);\n      font-size: var(--font-text-xs-size, 12px);\n      text-transform: lowercase;\n    }\n    .meta {\n      color: var(--color-text-tertiary, #94a3b8);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note {\n      display: none;\n      color: var(--color-text-warning, #b45309);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note.shown {\n      display: block;\n    }\n    .shot {\n      display: none;\n      width: 100%;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n    }\n    .shot.shown {\n      display: block;\n    }\n    .actions {\n      display: flex;\n      flex-wrap: wrap;\n      gap: 8px;\n    }\n    button {\n      appearance: none;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n      padding: 7px 12px;\n      background: var(--color-background-secondary, #f8fafc);\n      color: var(--color-text-primary, #0f172a);\n      font: inherit;\n      font-weight: var(--font-weight-medium, 500);\n      cursor: pointer;\n    }\n    button:hover:not(:disabled) {\n      background: var(--color-background-tertiary, #f1f5f9);\n    }\n    button:disabled {\n      opacity: 0.45;\n      cursor: not-allowed;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"head\">\n      <h1>Superblocks app</h1>\n      <span id=\"status\" class=\"status\">loading</span>\n    </div>\n    <div id=\"appId\" class=\"meta\"></div>\n    <img id=\"shot\" class=\"shot\" alt=\"Preview of the running app\" />\n    <div id=\"note\" class=\"note\"></div>\n    <div class=\"actions\">\n      <button id=\"openEditor\" type=\"button\" disabled>Open editor</button>\n      <button id=\"openPreview\" type=\"button\" disabled>Open preview</button>\n      <button id=\"publishApp\" type=\"button\" disabled>Publish app</button>\n    </div>\n  </div>\n  <script>\n    (() => {\n      const PROTOCOL_VERSION = \"2026-01-26\";\n      let nextId = 1;\n      const pending = new Map();\n      let applicationId = \"\";\n      let appName = \"\";\n      let commitId = \"\";\n      let editUrl = \"\";\n      let previewUrl = \"\";\n      let publishUrl = \"\";\n      let canOpenLinks = false;\n      let canCallTools = false;\n      let publishing = false;\n      let lastHeight = 0;\n\n      function post(message) {\n        window.parent.postMessage(message, \"*\");\n      }\n\n      function notify(method, params) {\n        post({ jsonrpc: \"2.0\", method, params });\n      }\n\n      function request(method, params) {\n        const id = nextId++;\n        return new Promise((resolve, reject) => {\n          pending.set(id, { resolve, reject });\n          post({ jsonrpc: \"2.0\", id, method, params });\n        });\n      }\n\n      function element(id) {\n        return document.getElementById(id);\n      }\n\n      function show(id, on) {\n        const node = element(id);\n        if (node && node.classList) {\n          node.classList.toggle(\"shown\", on);\n        }\n      }\n\n      // Hosts size the card from this notification alone; without it the card\n      // is laid out at zero height and never appears.\n      function reportSize() {\n        const height = Math.ceil(document.documentElement.scrollHeight || 0);\n        if (height <= 0 || height === lastHeight) {\n          return;\n        }\n        lastHeight = height;\n        notify(\"ui/notifications/size-changed\", {\n          height,\n          width: Math.ceil(window.innerWidth || 0),\n        });\n      }\n\n      function note(text) {\n        element(\"note\").textContent = text;\n        show(\"note\", Boolean(text));\n        reportSize();\n      }\n\n      function isPlainHttp(url) {\n        return url.slice(0, 5).toLowerCase() === \"http:\";\n      }\n\n      /** A UUID says nothing; the name the user asked Superblocks for does. */\n      function renderIdentity() {\n        element(\"appId\").textContent = appName || applicationId;\n      }\n\n      /**\n       * Draws the screenshot the tool captured.\n       *\n       * Hosts that render an MCP App render it *instead of* the tool's content\n       * blocks, so the image block get_app returns never reaches the user on\n       * its own \u2014 the card has to take it out of the result and show it.\n       */\n      function showScreenshot(dataBase64, mimeType) {\n        if (typeof dataBase64 !== \"string\" || !dataBase64) {\n          return;\n        }\n        element(\"shot\").src =\n          \"data:\" + (mimeType || \"image/jpeg\") + \";base64,\" + dataBase64;\n        show(\"shot\", true);\n        reportSize();\n      }\n\n      /** Applies every part of an MCP content array the card understands. */\n      function applyContent(content) {\n        for (const part of content || []) {\n          if (!part) {\n            continue;\n          }\n          if (part.type === \"text\" && typeof part.text === \"string\") {\n            applyPayload(part.text);\n          }\n          if (part.type === \"image\") {\n            showScreenshot(part.data, part.mimeType);\n          }\n        }\n      }\n\n      /**\n       * Keep URLs in memory for openLink \u2014 never print them (preview JWTs are\n       * huge and ugly in the card).\n       */\n      function renderActions() {\n        element(\"openEditor\").disabled = !editUrl || !canOpenLinks;\n        element(\"openPreview\").disabled = !previewUrl || !canOpenLinks;\n        // Once the app is live, publishing again is not what anyone wants from\n        // this button \u2014 going to the live app is.\n        element(\"publishApp\").textContent = publishUrl\n          ? \"Open published app\"\n          : \"Publish app\";\n        element(\"publishApp\").disabled = publishUrl\n          ? !canOpenLinks\n          : !applicationId || !canCallTools || publishing;\n        // Only warn about what is actually broken. Hosts that do open links\n        // handle local http fine; if one refuses, refused() says so then.\n        if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {\n          note(\"This host cannot open links for me \u2014 ask the model for an https preview URL.\");\n        }\n        reportSize();\n      }\n\n      /** Only ever ask the host to open a real web address. */\n      function webUrl(candidate) {\n        try {\n          const parsed = new URL(candidate);\n          return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n            ? candidate\n            : \"\";\n        } catch {\n          return \"\";\n        }\n      }\n\n      /**\n       * Merges whatever the host sent. Hosts replay tool input as well as tool\n       * results, and the input carries no status or URLs \u2014 overwriting from a\n       * partial payload is what showed the card as \"unknown\".\n       *\n       * Hosts also disagree on the shape: some pass the capability JSON, some\n       * pass the MCP content/text envelope (Claude Desktop on initialize), and\n       * some nest that under structuredContent.\n       */\n      function applyPayload(raw) {\n        let data = raw;\n        if (typeof raw === \"string\") {\n          try {\n            data = JSON.parse(raw);\n          } catch {\n            return;\n          }\n        }\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        // MCP tool-result / initialize toolResult envelope.\n        if (Array.isArray(data.content)) {\n          applyContent(data.content);\n          if (data.structuredContent) {\n            applyPayload(data.structuredContent);\n          }\n          return;\n        }\n        if (data.result && typeof data.result === \"object\") {\n          applyPayload(data.result);\n          return;\n        }\n        const value = data.kind === \"ok\" ? data.value : data;\n        if (!value || typeof value !== \"object\") {\n          return;\n        }\n        if (typeof value.status === \"string\") {\n          element(\"status\").textContent = value.status;\n        }\n        if (typeof value.applicationId === \"string\") {\n          applicationId = value.applicationId;\n          renderIdentity();\n        }\n        if (typeof value.name === \"string\" && value.name) {\n          appName = value.name;\n          renderIdentity();\n        }\n        if (typeof value.commitId === \"string\") {\n          commitId = value.commitId;\n        }\n        if (typeof value.screenshotBase64 === \"string\") {\n          showScreenshot(value.screenshotBase64, \"image/jpeg\");\n        }\n        if (typeof value.editUrl === \"string\") {\n          editUrl = webUrl(value.editUrl);\n        }\n        if (typeof value.previewUrl === \"string\") {\n          previewUrl = webUrl(value.previewUrl);\n        }\n        if (typeof value.publishUrl === \"string\") {\n          publishUrl = webUrl(value.publishUrl);\n        }\n        // Hosts that deliver URLs without a status left the badge on the HTML\n        // default (\"loading\") even after the app was built.\n        const badge = element(\"status\").textContent;\n        if (\n          !value.status &&\n          editUrl &&\n          (badge === \"\" || badge === \"loading\" || badge === \"waiting\")\n        ) {\n          element(\"status\").textContent = previewUrl ? \"ready\" : \"building\";\n        }\n        renderActions();\n      }\n\n      /**\n       * When the host opened the card with tool input (applicationId) but never\n       * pushed a tool result, refresh ourselves so the badge is not stuck on\n       * \"loading\" after the build finished.\n       */\n      function refreshFromServer() {\n        if (!canCallTools || !applicationId || editUrl) {\n          return;\n        }\n        request(\"tools/call\", {\n          name: \"get_app\",\n          arguments: { applicationId },\n        })\n          .then((result) => {\n            if (!result || result.isError) {\n              return;\n            }\n            applyPayload(result);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n          })\n          .catch(() => {\n            // Host declined; stay on whatever we have.\n          });\n      }\n\n      function applyHostContext(context) {\n        if (!context || typeof context !== \"object\") {\n          return;\n        }\n        const variables = context.styles && context.styles.variables;\n        const style = document.documentElement.style;\n        if (variables && style && typeof style.setProperty === \"function\") {\n          for (const name of Object.keys(variables)) {\n            const value = variables[name];\n            if (typeof value === \"string\") {\n              style.setProperty(name, value);\n            }\n          }\n        }\n        reportSize();\n      }\n\n      function refused(url) {\n        note(\n          isPlainHttp(url)\n            ? \"This host only opens https links, and this app is served over http \u2014 ask for an https preview URL.\"\n            : \"The host could not open the link \u2014 try again or ask the model for another URL.\",\n        );\n      }\n\n      function openLink(url) {\n        if (!url || !canOpenLinks) {\n          return;\n        }\n        request(\"ui/open-link\", { url })\n          .then((result) => {\n            if (result && result.isError) {\n              refused(url);\n              return;\n            }\n            note(\"\");\n          })\n          .catch(() => refused(url));\n      }\n\n      /**\n       * Asks the host to proxy publish_app back to this MCP server. The prompt\n       * is the commit message createCommit needs; the card supplies a fixed one\n       * so the user does not have to type through the model.\n       */\n      function publish() {\n        if (!applicationId || !canCallTools || publishing) {\n          return;\n        }\n        publishing = true;\n        renderActions();\n        note(\"Publishing\u2026\");\n        const args = {\n          applicationId,\n          idempotencyKey:\n            \"mcp-app-publish:\" + applicationId + \":\" + Date.now(),\n          prompt: \"Published from Gateway status card\",\n        };\n        if (commitId) {\n          args.commitId = commitId;\n        }\n        request(\"tools/call\", { name: \"publish_app\", arguments: args })\n          .then((result) => {\n            publishing = false;\n            if (!result || result.isError) {\n              const text =\n                result &&\n                Array.isArray(result.content) &&\n                result.content[0] &&\n                result.content[0].text\n                  ? String(result.content[0].text)\n                  : \"Publish failed.\";\n              note(text.slice(0, 280));\n              renderActions();\n              return;\n            }\n            applyContent(result.content || []);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            note(\n              publishUrl\n                ? \"Published \u2014 open the live app with Open published app.\"\n                : \"Published \u2014 the app is live.\",\n            );\n            renderActions();\n          })\n          .catch((error) => {\n            publishing = false;\n            note(\n              (error && error.message) ||\n                \"The host could not call publish_app.\",\n            );\n            renderActions();\n          });\n      }\n\n      function handleHostMessage(event) {\n        // App documents are opaque-origin, so the host window is the only\n        // identity available to authenticate a message against.\n        if (event.source !== window.parent) {\n          return;\n        }\n        const data = event.data;\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        if (data.method === \"ping\") {\n          post({ jsonrpc: \"2.0\", id: data.id, result: {} });\n          return;\n        }\n        if (data.id != null && pending.has(data.id)) {\n          const waiter = pending.get(data.id);\n          pending.delete(data.id);\n          if (data.error) {\n            waiter.reject(data.error);\n          } else {\n            waiter.resolve(data.result);\n          }\n          return;\n        }\n        const method = data.method;\n        const params = data.params || {};\n        if (\n          method === \"ui/notifications/tool-result\" ||\n          method === \"ui/tool-result\" ||\n          method === \"tools/call\"\n        ) {\n          applyContent(params.content || params.result?.content || []);\n          if (params.structuredContent) {\n            applyPayload(params.structuredContent);\n          }\n        }\n        if (method === \"ui/notifications/tool-input\" && params.arguments) {\n          applyPayload(params.arguments);\n          refreshFromServer();\n        }\n        if (method === \"ui/notifications/host-context-changed\") {\n          applyHostContext(params);\n        }\n      }\n\n      window.addEventListener(\"message\", handleHostMessage);\n\n      element(\"openEditor\").addEventListener(\"click\", () => openLink(editUrl));\n      element(\"openPreview\").addEventListener(\"click\", () =>\n        openLink(previewUrl),\n      );\n      element(\"publishApp\").addEventListener(\"click\", () => {\n        if (publishUrl) {\n          openLink(publishUrl);\n          return;\n        }\n        publish();\n      });\n\n      if (typeof ResizeObserver === \"function\") {\n        new ResizeObserver(reportSize).observe(document.documentElement);\n      }\n\n      void request(\"ui/initialize\", {\n        appCapabilities: {\n          availableDisplayModes: [\"inline\"],\n        },\n        appInfo: { name: \"gateway-app-status\", version: \"0.0.6\" },\n        protocolVersion: PROTOCOL_VERSION,\n      })\n        .then((result) => {\n          // Hosts hold back tool results until the app confirms it is ready.\n          notify(\"ui/notifications/initialized\", {});\n          // Buttons that cannot work are worse than no buttons: hosts without\n          // openLinks silently drop ui/open-link.\n          canOpenLinks = Boolean(\n            result && result.hostCapabilities && result.hostCapabilities.openLinks,\n          );\n          canCallTools = Boolean(\n            result &&\n              result.hostCapabilities &&\n              result.hostCapabilities.serverTools,\n          );\n          applyHostContext(result && result.hostContext);\n          renderActions();\n          if (result && result.toolResult) {\n            applyPayload(result.toolResult);\n          }\n          refreshFromServer();\n        })\n        .catch(() => {\n          // Hosts that push tool results via notification still work.\n        })\n        .finally(reportSize);\n    })();\n  </script>\n</body>\n</html>\n";
+export declare const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v8.html";
+export declare const APP_STATUS_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>Superblocks app</title>\n  <style>\n    :root {\n      color-scheme: light dark;\n    }\n    body {\n      margin: 0;\n      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n      font-size: var(--font-text-sm-size, 13px);\n      line-height: var(--font-text-sm-line-height, 1.45);\n      color: var(--color-text-primary, #0f172a);\n      background: transparent;\n    }\n    .card {\n      display: flex;\n      flex-direction: column;\n      gap: 10px;\n      padding: 14px;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-lg, 12px);\n      background: var(--color-background-primary, #ffffff);\n    }\n    .head {\n      display: flex;\n      align-items: center;\n      gap: 8px;\n    }\n    h1 {\n      flex: 1;\n      margin: 0;\n      font-size: var(--font-text-md-size, 14px);\n      font-weight: var(--font-weight-semibold, 600);\n    }\n    .status {\n      padding: 2px 8px;\n      border-radius: var(--border-radius-full, 999px);\n      background: var(--color-background-secondary, #f1f5f9);\n      color: var(--color-text-secondary, #64748b);\n      font-size: var(--font-text-xs-size, 12px);\n      text-transform: lowercase;\n    }\n    .meta {\n      color: var(--color-text-tertiary, #94a3b8);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note {\n      display: none;\n      color: var(--color-text-warning, #b45309);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note.shown {\n      display: block;\n    }\n    .shot {\n      display: none;\n      width: 100%;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n    }\n    .shot.shown {\n      display: block;\n    }\n    .actions {\n      display: flex;\n      flex-wrap: wrap;\n      gap: 8px;\n    }\n    button {\n      appearance: none;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n      padding: 7px 12px;\n      background: var(--color-background-secondary, #f8fafc);\n      color: var(--color-text-primary, #0f172a);\n      font: inherit;\n      font-weight: var(--font-weight-medium, 500);\n      cursor: pointer;\n    }\n    button:hover:not(:disabled) {\n      background: var(--color-background-tertiary, #f1f5f9);\n    }\n    button:disabled {\n      opacity: 0.45;\n      cursor: not-allowed;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"head\">\n      <h1>Superblocks app</h1>\n      <span id=\"status\" class=\"status\">loading</span>\n    </div>\n    <div id=\"appId\" class=\"meta\"></div>\n    <img id=\"shot\" class=\"shot\" alt=\"Preview of the running app\" />\n    <div id=\"note\" class=\"note\"></div>\n    <div class=\"actions\">\n      <button id=\"openEditor\" type=\"button\" disabled>Open editor</button>\n      <button id=\"openPreview\" type=\"button\" disabled>Open preview</button>\n      <button id=\"publishApp\" type=\"button\" disabled>Publish app</button>\n    </div>\n  </div>\n  <script>\n    (() => {\n      const PROTOCOL_VERSION = \"2026-01-26\";\n      // Statuses get_app reports when the app is still the empty starter\n      // template. \"building\" is deliberately absent: the card only hears a\n      // build finished if a new result arrives, so a stale badge would strand\n      // the button.\n      const UNBUILT_STATUSES = [\n        \"cancelled\",\n        \"live_edit_terminated\",\n        \"needs_decision\",\n        \"no_changes\",\n        \"timeout\",\n      ];\n      const BLOCKED_ACTIONS = [\n        \"answer_question\",\n        \"approve_plan\",\n        \"retry_build\",\n        \"retry_import\",\n      ];\n      let nextId = 1;\n      const pending = new Map();\n      let applicationId = \"\";\n      let appName = \"\";\n      let commitId = \"\";\n      let pendingAction = \"\";\n      let editUrl = \"\";\n      let previewUrl = \"\";\n      let publishUrl = \"\";\n      let canOpenLinks = false;\n      let canCallTools = false;\n      let publishing = false;\n      let lastHeight = 0;\n      let refreshInFlight = false;\n      let refreshTimer = 0;\n      let refreshGeneration = 0;\n      let refreshAttempts = 0;\n      let pollAfterMs = 2000;\n      const MIN_POLL_MS = 2000;\n      const MAX_REFRESH_ATTEMPTS = 40;\n\n      function post(message) {\n        window.parent.postMessage(message, \"*\");\n      }\n\n      function notify(method, params) {\n        post({ jsonrpc: \"2.0\", method, params });\n      }\n\n      function request(method, params) {\n        const id = nextId++;\n        return new Promise((resolve, reject) => {\n          pending.set(id, { resolve, reject });\n          post({ jsonrpc: \"2.0\", id, method, params });\n        });\n      }\n\n      function element(id) {\n        return document.getElementById(id);\n      }\n\n      function show(id, on) {\n        const node = element(id);\n        if (node && node.classList) {\n          node.classList.toggle(\"shown\", on);\n        }\n      }\n\n      // Hosts size the card from this notification alone; without it the card\n      // is laid out at zero height and never appears.\n      function reportSize() {\n        const height = Math.ceil(document.documentElement.scrollHeight || 0);\n        if (height <= 0 || height === lastHeight) {\n          return;\n        }\n        lastHeight = height;\n        notify(\"ui/notifications/size-changed\", {\n          height,\n          width: Math.ceil(window.innerWidth || 0),\n        });\n      }\n\n      function note(text) {\n        element(\"note\").textContent = text;\n        show(\"note\", Boolean(text));\n        reportSize();\n      }\n\n      function isPlainHttp(url) {\n        return url.slice(0, 5).toLowerCase() === \"http:\";\n      }\n\n      /** A UUID says nothing; the name the user asked Superblocks for does. */\n      function renderIdentity() {\n        element(\"appId\").textContent = appName || applicationId;\n      }\n\n      /**\n       * Draws the screenshot the tool captured.\n       *\n       * Hosts that render an MCP App render it *instead of* the tool's content\n       * blocks, so the image block get_app returns never reaches the user on\n       * its own \u2014 the card has to take it out of the result and show it.\n       */\n      function showScreenshot(dataBase64, mimeType) {\n        if (typeof dataBase64 !== \"string\" || !dataBase64) {\n          return;\n        }\n        element(\"shot\").src =\n          \"data:\" + (mimeType || \"image/jpeg\") + \";base64,\" + dataBase64;\n        show(\"shot\", true);\n        reportSize();\n      }\n\n      /** Applies every part of an MCP content array the card understands. */\n      function applyContent(content) {\n        for (const part of content || []) {\n          if (!part) {\n            continue;\n          }\n          if (part.type === \"text\" && typeof part.text === \"string\") {\n            applyPayload(part.text);\n          }\n          if (part.type === \"image\") {\n            showScreenshot(part.data, part.mimeType);\n          }\n        }\n      }\n\n      /**\n       * True when publishing would deploy the empty starter template.\n       * pendingAction is the server's own \"nothing to preview\" signal;\n       * wait_for_build is the building exception. Status is only a fallback\n       * when the payload omitted pendingAction. loading/waiting with no\n       * preview fail closed so Publish is not clickable before get_app\n       * returns.\n       */\n      function nothingToPublish() {\n        if (previewUrl || publishUrl) {\n          return false;\n        }\n        if (pendingAction === \"wait_for_build\") {\n          return false;\n        }\n        if (BLOCKED_ACTIONS.indexOf(pendingAction) !== -1) {\n          return true;\n        }\n        const badge = element(\"status\").textContent;\n        if (!badge || badge === \"loading\" || badge === \"waiting\") {\n          return true;\n        }\n        return UNBUILT_STATUSES.indexOf(badge) !== -1;\n      }\n\n      /**\n       * Keep URLs in memory for openLink \u2014 never print them (preview JWTs are\n       * huge and ugly in the card).\n       */\n      function renderActions() {\n        element(\"openEditor\").disabled = !editUrl || !canOpenLinks;\n        element(\"openPreview\").disabled = !previewUrl || !canOpenLinks;\n        // Once the app is live, publishing again is not what anyone wants from\n        // this button \u2014 going to the live app is.\n        element(\"publishApp\").textContent = publishUrl\n          ? \"Open published app\"\n          : \"Publish app\";\n        element(\"publishApp\").disabled = publishUrl\n          ? !canOpenLinks\n          : !applicationId ||\n            !canCallTools ||\n            publishing ||\n            nothingToPublish();\n        // Only warn about what is actually broken. Hosts that do open links\n        // handle local http fine; if one refuses, refused() says so then.\n        if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {\n          note(\"This host cannot open links for me \u2014 ask the model for an https preview URL.\");\n        }\n        reportSize();\n      }\n\n      /** Only ever ask the host to open a real web address. */\n      function webUrl(candidate) {\n        try {\n          const parsed = new URL(candidate);\n          return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n            ? candidate\n            : \"\";\n        } catch {\n          return \"\";\n        }\n      }\n\n      /**\n       * Merges whatever the host sent. Hosts replay tool input as well as tool\n       * results, and the input carries no status or URLs \u2014 overwriting from a\n       * partial payload is what showed the card as \"unknown\".\n       *\n       * Hosts also disagree on the shape: some pass the capability JSON, some\n       * pass the MCP content/text envelope (Claude Desktop on initialize), and\n       * some nest that under structuredContent.\n       */\n      function applyPayload(raw) {\n        let data = raw;\n        if (typeof raw === \"string\") {\n          try {\n            data = JSON.parse(raw);\n          } catch {\n            return;\n          }\n        }\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        // MCP tool-result / initialize toolResult envelope.\n        if (Array.isArray(data.content)) {\n          applyContent(data.content);\n          if (data.structuredContent) {\n            applyPayload(data.structuredContent);\n          }\n          return;\n        }\n        if (data.result && typeof data.result === \"object\") {\n          applyPayload(data.result);\n          return;\n        }\n        const value = data.kind === \"ok\" ? data.value : data;\n        if (!value || typeof value !== \"object\") {\n          return;\n        }\n        if (typeof value.status === \"string\") {\n          element(\"status\").textContent = value.status;\n        }\n        if (typeof value.applicationId === \"string\") {\n          applicationId = value.applicationId;\n          renderIdentity();\n        }\n        if (typeof value.name === \"string\" && value.name) {\n          appName = value.name;\n          renderIdentity();\n        }\n        if (typeof value.commitId === \"string\") {\n          commitId = value.commitId;\n        }\n        if (typeof value.pendingAction === \"string\") {\n          pendingAction = value.pendingAction;\n        } else if (typeof value.status === \"string\") {\n          pendingAction = \"\";\n        }\n        if (typeof value.screenshotBase64 === \"string\") {\n          showScreenshot(value.screenshotBase64, \"image/jpeg\");\n        }\n        if (typeof value.editUrl === \"string\") {\n          editUrl = webUrl(value.editUrl);\n        }\n        if (typeof value.previewUrl === \"string\") {\n          previewUrl = webUrl(value.previewUrl);\n        }\n        if (typeof value.publishUrl === \"string\") {\n          publishUrl = webUrl(value.publishUrl);\n        }\n        if (typeof value.nextPollAfterMs === \"number\") {\n          pollAfterMs = value.nextPollAfterMs;\n        }\n        // Hosts that deliver URLs without a status left the badge on the HTML\n        // default (\"loading\") even after the app was built.\n        const badge = element(\"status\").textContent;\n        if (\n          !value.status &&\n          editUrl &&\n          (badge === \"\" || badge === \"loading\" || badge === \"waiting\")\n        ) {\n          element(\"status\").textContent = previewUrl ? \"ready\" : \"building\";\n        }\n        renderActions();\n      }\n\n      /**\n       * Re-ask get_app when the host gave us no result, or while status is\n       * still building. wait:false and ensurePreview:false so polls only\n       * ask for status. Honor nextPollAfterMs; 0 means stop.\n       */\n      function clearRefreshTimer() {\n        if (refreshTimer) {\n          clearTimeout(refreshTimer);\n          refreshTimer = 0;\n        }\n      }\n\n      function retryDelay() {\n        return Math.max(MIN_POLL_MS, pollAfterMs || MIN_POLL_MS);\n      }\n\n      function scheduleRefresh(delayMs) {\n        clearRefreshTimer();\n        if (refreshAttempts >= MAX_REFRESH_ATTEMPTS) {\n          note(\"Stopped checking whether the app is still building.\");\n          return;\n        }\n        refreshTimer = setTimeout(() => {\n          refreshTimer = 0;\n          refreshFromServer();\n        }, delayMs);\n      }\n\n      function refreshFromServer() {\n        clearRefreshTimer();\n        if (!canCallTools || !applicationId || refreshInFlight) {\n          return;\n        }\n        if (typeof document.hidden === \"boolean\" && document.hidden) {\n          scheduleRefresh(retryDelay());\n          return;\n        }\n        const badge = element(\"status\").textContent;\n        if (editUrl && badge !== \"building\") {\n          return;\n        }\n        if (refreshAttempts >= MAX_REFRESH_ATTEMPTS) {\n          note(\"Stopped checking whether the app is still building.\");\n          return;\n        }\n        refreshAttempts += 1;\n        const generation = refreshGeneration;\n        refreshInFlight = true;\n        request(\"tools/call\", {\n          name: \"get_app\",\n          arguments: {\n            applicationId,\n            ensurePreview: false,\n            wait: false,\n          },\n        })\n          .then((result) => {\n            refreshInFlight = false;\n            if (generation !== refreshGeneration) {\n              if (element(\"status\").textContent === \"building\") {\n                scheduleRefresh(retryDelay());\n              }\n              return;\n            }\n            if (!result || result.isError) {\n              scheduleRefresh(retryDelay());\n              return;\n            }\n            applyPayload(result);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            if (element(\"status\").textContent !== \"building\") {\n              return;\n            }\n            if (pollAfterMs === 0) {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          })\n          .catch(() => {\n            refreshInFlight = false;\n            if (generation !== refreshGeneration) {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          });\n      }\n\n      function applyHostContext(context) {\n        if (!context || typeof context !== \"object\") {\n          return;\n        }\n        const variables = context.styles && context.styles.variables;\n        const style = document.documentElement.style;\n        if (variables && style && typeof style.setProperty === \"function\") {\n          for (const name of Object.keys(variables)) {\n            const value = variables[name];\n            if (typeof value === \"string\") {\n              style.setProperty(name, value);\n            }\n          }\n        }\n        reportSize();\n      }\n\n      function refused(url) {\n        note(\n          isPlainHttp(url)\n            ? \"This host only opens https links, and this app is served over http \u2014 ask for an https preview URL.\"\n            : \"The host could not open the link \u2014 try again or ask the model for another URL.\",\n        );\n      }\n\n      function openLink(url) {\n        if (!url || !canOpenLinks) {\n          return;\n        }\n        request(\"ui/open-link\", { url })\n          .then((result) => {\n            if (result && result.isError) {\n              refused(url);\n              return;\n            }\n            note(\"\");\n          })\n          .catch(() => refused(url));\n      }\n\n      /**\n       * Asks the host to proxy publish_app back to this MCP server. The prompt\n       * is the commit message createCommit needs; the card supplies a fixed one\n       * so the user does not have to type through the model.\n       */\n      function publish() {\n        if (!applicationId || !canCallTools || publishing) {\n          return;\n        }\n        if (nothingToPublish()) {\n          note(\"Nothing to publish yet: this turn did not build the app.\");\n          return;\n        }\n        publishing = true;\n        renderActions();\n        note(\"Publishing\u2026\");\n        const args = {\n          applicationId,\n          idempotencyKey:\n            \"mcp-app-publish:\" + applicationId + \":\" + Date.now(),\n          prompt: \"Published from Gateway status card\",\n        };\n        if (commitId) {\n          args.commitId = commitId;\n        }\n        request(\"tools/call\", { name: \"publish_app\", arguments: args })\n          .then((result) => {\n            publishing = false;\n            if (!result || result.isError) {\n              const text =\n                result &&\n                Array.isArray(result.content) &&\n                result.content[0] &&\n                result.content[0].text\n                  ? String(result.content[0].text)\n                  : \"Publish failed.\";\n              note(text.slice(0, 280));\n              renderActions();\n              return;\n            }\n            applyContent(result.content || []);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            note(\n              publishUrl\n                ? \"Published \u2014 open the live app with Open published app.\"\n                : \"Published \u2014 the app is live.\",\n            );\n            renderActions();\n          })\n          .catch((error) => {\n            publishing = false;\n            note(\n              (error && error.message) ||\n                \"The host could not call publish_app.\",\n            );\n            renderActions();\n          });\n      }\n\n      function handleHostMessage(event) {\n        // App documents are opaque-origin, so the host window is the only\n        // identity available to authenticate a message against.\n        if (event.source !== window.parent) {\n          return;\n        }\n        const data = event.data;\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        if (data.method === \"ping\") {\n          post({ jsonrpc: \"2.0\", id: data.id, result: {} });\n          return;\n        }\n        if (data.id != null && pending.has(data.id)) {\n          const waiter = pending.get(data.id);\n          pending.delete(data.id);\n          if (data.error) {\n            waiter.reject(data.error);\n          } else {\n            waiter.resolve(data.result);\n          }\n          return;\n        }\n        const method = data.method;\n        const params = data.params || {};\n        if (\n          method === \"ui/notifications/tool-result\" ||\n          method === \"ui/tool-result\" ||\n          method === \"tools/call\"\n        ) {\n          applyContent(params.content || params.result?.content || []);\n          if (params.structuredContent) {\n            applyPayload(params.structuredContent);\n          }\n          refreshGeneration += 1;\n          if (element(\"status\").textContent === \"building\") {\n            refreshFromServer();\n          }\n        }\n        if (method === \"ui/notifications/tool-input\" && params.arguments) {\n          applyPayload(params.arguments);\n          refreshFromServer();\n        }\n        if (method === \"ui/notifications/host-context-changed\") {\n          applyHostContext(params);\n        }\n      }\n\n      window.addEventListener(\"message\", handleHostMessage);\n\n      element(\"openEditor\").addEventListener(\"click\", () => openLink(editUrl));\n      element(\"openPreview\").addEventListener(\"click\", () =>\n        openLink(previewUrl),\n      );\n      element(\"publishApp\").addEventListener(\"click\", () => {\n        if (publishUrl) {\n          openLink(publishUrl);\n          return;\n        }\n        publish();\n      });\n\n      if (typeof ResizeObserver === \"function\") {\n        new ResizeObserver(reportSize).observe(document.documentElement);\n      }\n\n      void request(\"ui/initialize\", {\n        appCapabilities: {\n          availableDisplayModes: [\"inline\"],\n        },\n        appInfo: { name: \"gateway-app-status\", version: \"0.0.6\" },\n        protocolVersion: PROTOCOL_VERSION,\n      })\n        .then((result) => {\n          // Hosts hold back tool results until the app confirms it is ready.\n          notify(\"ui/notifications/initialized\", {});\n          // Buttons that cannot work are worse than no buttons: hosts without\n          // openLinks silently drop ui/open-link.\n          canOpenLinks = Boolean(\n            result && result.hostCapabilities && result.hostCapabilities.openLinks,\n          );\n          canCallTools = Boolean(\n            result &&\n              result.hostCapabilities &&\n              result.hostCapabilities.serverTools,\n          );\n          applyHostContext(result && result.hostContext);\n          renderActions();\n          if (result && result.toolResult) {\n            applyPayload(result.toolResult);\n          }\n          refreshFromServer();\n        })\n        .catch(() => {\n          // Hosts that push tool results via notification still work.\n        })\n        .finally(reportSize);\n    })();\n  </script>\n</body>\n</html>\n";