@superblocksteam/gateway 2.0.161 → 2.0.162-next.1

package/dist/transports/mcp/admin-tools.js

@@ -1,6 +1,9 @@
 import { z } from "zod";
 import { buildToolRegistry, executeToolCall, runWithAuthContext, toolDefinitions, } from "@superblocksteam/mcp-server";
 import { gatewayDebug, gatewayDebugStack } from "../../debug.js";
+import { attachAdminAgentInstructions } from "./instructions/index.js";
+import { isRecord } from "./instructions/result.js";
+import { isPublicIntegration } from "./instructions/tools/create-integration.js";
 /**
  * Loose JSON-Schema -> Zod conversion so `registerTool` can list Admin tools
  * with usable shapes. Handlers still validate through `@superblocksteam/mcp-server`.
@@ -29,6 +32,14 @@ export function jsonSchemaToZodShape(inputSchema, options = {}) {
 const GATEWAY_SUPPLIED_ARGUMENTS = {
     base_url: "Omit this. The gateway always sends its own Superblocks Server URL; any value here is replaced.",
 };
+/**
+ * Gateway-only argument on `create_integration`, and the one thing this process
+ * cannot work out for itself: which application the conversation is building.
+ * Stripped before the shared Admin handler, whose schema is strict.
+ */
+const CREATE_INTEGRATION_APPLICATION_ID = "application_id";
+const CREATE_INTEGRATION_APPLICATION_ID_DESCRIPTION = "The application this conversation is building, when there is one. Pass it so credential entry opens on the Integrations tab inside that editor and the user stays where they are. Omit it when this conversation has not started or edited an application: the result then links the org Integrations page. Never pass an application another conversation is working on.";
+const CREATE_INTEGRATION_GUIDANCE = " When this conversation has already started or edited an application, pass its applicationId as application_id so credential entry opens inside that editor.";
 /**
  * Admin tools the gateway keeps to itself.
  *
@@ -118,6 +129,70 @@ export function completeToolAnnotations(annotations) {
         readOnlyHint,
     };
 }
+function parseCreateIntegrationPayload(result) {
+    if (result.isError || result.content[0]?.type !== "text") {
+        return undefined;
+    }
+    let value;
+    try {
+        value = JSON.parse(result.content[0].text);
+    }
+    catch {
+        return undefined;
+    }
+    return isRecord(value) ? value : undefined;
+}
+function withCreateIntegrationPayload(result, value) {
+    return {
+        ...result,
+        content: [{ type: "text", text: JSON.stringify(value) }],
+    };
+}
+async function withEditorIntegrationSetupUrl(result, resolveUrl, applicationId) {
+    const value = parseCreateIntegrationPayload(result);
+    if (!value ||
+        isPublicIntegration(value) ||
+        (isRecord(value.integration) && value.integration.kind === "SECRET") ||
+        typeof value.integration_id !== "string" ||
+        !value.integration_id ||
+        !resolveUrl) {
+        return result;
+    }
+    let editorUrl;
+    try {
+        editorUrl = await resolveUrl(value.integration_id, applicationId);
+    }
+    catch (error) {
+        gatewayDebug("create_integration editor URL enrichment failed", {
+            integrationId: value.integration_id,
+            message: error instanceof Error ? error.message : String(error),
+        });
+        return result;
+    }
+    if (!editorUrl) {
+        return result;
+    }
+    return withCreateIntegrationPayload(result, {
+        ...value,
+        integration_url: editorUrl,
+    });
+}
+function withCreateIntegrationBrowserNavigation(result) {
+    const value = parseCreateIntegrationPayload(result);
+    if (!value || typeof value.integration_url !== "string") {
+        return result;
+    }
+    return {
+        ...result,
+        structuredContent: {
+            ...value,
+            browserNavigation: {
+                action: "open_editor",
+                url: value.integration_url,
+            },
+        },
+    };
+}
 /**
  * Registers customer-profile Admin MCP tools on the same McpServer as Builder
  * tools. Each call runs under `runWithAuthContext` with the Gateway's
@@ -132,10 +207,21 @@ export function registerAdminTools(server, options) {
             continue;
         }
         const definition = toolDefinitions.find((d) => d.name === tool.name);
+        const isCreateIntegration = tool.name === "create_integration";
         server.registerTool(tool.name, {
             annotations: completeToolAnnotations(tool.annotations),
-            description: superblocksProductCopy(tool.description ?? ""),
-            inputSchema: gatewayAdminInputShape(tool.inputSchema),
+            description: superblocksProductCopy(tool.description ?? "") +
+                (isCreateIntegration ? CREATE_INTEGRATION_GUIDANCE : ""),
+            inputSchema: isCreateIntegration
+                ? {
+                    ...gatewayAdminInputShape(tool.inputSchema),
+                    [CREATE_INTEGRATION_APPLICATION_ID]: z
+                        .string()
+                        .uuid()
+                        .optional()
+                        .describe(CREATE_INTEGRATION_APPLICATION_ID_DESCRIPTION),
+                }
+                : gatewayAdminInputShape(tool.inputSchema),
             title: tool.title ?? definition?.title,
         }, async (args, extra) => {
             gatewayDebugStack("admin tool started", {
@@ -145,20 +231,45 @@ export function registerAdminTools(server, options) {
             try {
                 const token = await resolveToken(options, extra.authInfo);
                 const baseUrl = options.serverUrl.replace(/\/$/, "");
+                const rawArgs = args;
+                const setupApplicationId = isCreateIntegration &&
+                    typeof rawArgs[CREATE_INTEGRATION_APPLICATION_ID] === "string"
+                    ? rawArgs[CREATE_INTEGRATION_APPLICATION_ID]
+                    : undefined;
                 const callArgs = {
-                    ...args,
+                    ...rawArgs,
                     // Overwritten, never merged. The credential this call runs with belongs
                     // to the Gateway's own control plane, so a base_url from the model
                     // would send that credential to a host the model chose - reachable
                     // through any prompt injection that gets as far as a tool call.
                     base_url: baseUrl,
                 };
+                if (isCreateIntegration) {
+                    // The shared Admin schema is strict and knows nothing about it.
+                    delete callArgs[CREATE_INTEGRATION_APPLICATION_ID];
+                }
                 const result = await runWithAuthContext({ baseUrl, token }, () => executeToolCall(tool.name, callArgs, registry));
                 gatewayDebug("admin tool finished", {
                     "result.kind": "success",
                     "tool.name": tool.name,
                 });
-                return result;
+                const profile = options.clientProfile?.();
+                if (!isCreateIntegration) {
+                    if (profile &&
+                        (tool.name === "get_application_access" ||
+                            tool.name === "get_application_deployment_history" ||
+                            tool.name === "get_application_summary")) {
+                        return attachAdminAgentInstructions(tool.name, result, profile);
+                    }
+                    return result;
+                }
+                const withEditorUrl = await withEditorIntegrationSetupUrl(result, options.resolveEditorIntegrationSetupUrl, setupApplicationId);
+                const withBrowser = profile?.hasNativeBrowser === true
+                    ? withCreateIntegrationBrowserNavigation(withEditorUrl)
+                    : withEditorUrl;
+                return profile
+                    ? attachAdminAgentInstructions("create_integration", withBrowser, profile)
+                    : withBrowser;
             }
             catch (error) {
                 gatewayDebug("admin tool finished", {

package/dist/transports/mcp/admin-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"admin-tools.js","sourceRoot":"","sources":["../../../src/transports/mcp/admin-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,GAEhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAyCjE;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAgC,EAChC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GACb,WAAW,EAAE,UAEA,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAA2B;IACzD,QAAQ,EACN,iGAAiG;CACpG,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,WAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC9C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;KACtD,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CACZ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC;qBACL,MAAM,CACL,oBAAoB,CAAC;oBACnB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CACH;qBACA,WAAW,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAkC,EAClC,IAA0B;IAE1B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,6CAA6C,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACvD,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CACrC,WAAwC;IAExC,MAAM,YAAY,GAAG,WAAW,EAAE,YAAY,IAAI,KAAK,CAAC;IACxD,OAAO;QACL,GAAG,WAAW;QACd,eAAe,EACb,WAAW,EAAE,eAAe,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,cAAc,EAAE,WAAW,EAAE,cAAc,IAAI,YAAY;QAC3D,aAAa,EAAE,WAAW,EAAE,aAAa,IAAI,IAAI;QACjD,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,EAAE;QAC9D,mBAAmB,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;KACrD,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC;YACtD,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;YAC3D,WAAW,EAAE,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;YACrD,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,KAAK;SACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,iBAAiB,CAAC,oBAAoB,EAAE;gBACtC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAA4B;oBACxC,GAAI,IAAgC;oBACpC,wEAAwE;oBACxE,mEAAmE;oBACnE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/D,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;gBACF,YAAY,CAAC,qBAAqB,EAAE;oBAClC,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,qBAAqB,EAAE;oBAClC,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;oBAChE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"admin-tools.js","sourceRoot":"","sources":["../../../src/transports/mcp/admin-tools.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,eAAe,GAEhB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAEjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAmDjF;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAgC,EAChC,UAAuC,EAAE;IAEzC,MAAM,UAAU,GACb,WAAW,EAAE,UAEA,IAAI,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAE5C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACrD,IAAI,KAAK,GAAG,uBAAuB,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC3B,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,0BAA0B,GAA2B;IACzD,QAAQ,EACN,iGAAiG;CACpG,CAAC;AAEF;;;;GAIG;AACH,MAAM,iCAAiC,GAAG,gBAAgB,CAAC;AAE3D,MAAM,6CAA6C,GACjD,2WAA2W,CAAC;AAE9W,MAAM,2BAA2B,GAC/B,8JAA8J,CAAC;AAEjK;;;;;;;;;GASG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,sBAAsB;IACtB,iBAAiB;CAClB,CAAC,CAAC;AAEH,SAAS,sBAAsB,CAC7B,WAAgC;IAEhC,MAAM,KAAK,GAAG,oBAAoB,CAAC,WAAW,EAAE;QAC9C,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC;KACtD,CAAC,CAAC;IACH,KAAK,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,IAAwB;IACvD,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,CAAC,IAAI,CAAC,MAA+B,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACpE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACrB,KAAK,OAAO;YACV,OAAO,CAAC,CAAC,KAAK,CACZ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAC/D,CAAC;QACJ,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACpB,OAAO,CAAC;qBACL,MAAM,CACL,oBAAoB,CAAC;oBACnB,IAAI,EAAE,QAAQ;oBACd,UAAU,EAAE,IAAI,CAAC,UAAU;oBAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CACH;qBACA,WAAW,EAAE,CAAC;YACnB,CAAC;YACD,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C;YACE,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CACnB,OAAkC,EAClC,IAA0B;IAE1B,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,6CAA6C,CAAC,CACzD,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,IAAI;SACR,UAAU,CAAC,oBAAoB,EAAE,qBAAqB,CAAC;SACvD,UAAU,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC7C,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,uBAAuB,CACrC,WAAwC;IAExC,MAAM,YAAY,GAAG,WAAW,EAAE,YAAY,IAAI,KAAK,CAAC;IACxD,OAAO;QACL,GAAG,WAAW;QACd,eAAe,EACb,WAAW,EAAE,eAAe,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,cAAc,EAAE,WAAW,EAAE,cAAc,IAAI,YAAY;QAC3D,aAAa,EAAE,WAAW,EAAE,aAAa,IAAI,IAAI;QACjD,YAAY;KACb,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAsB;IAEtB,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACzD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAsB,EACtB,KAA8B;IAE9B,OAAO;QACL,GAAG,MAAM;QACT,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,MAAsB,EACtB,UAKa,EACb,aAAiC;IAEjC,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACpD,IACE,CAAC,KAAK;QACN,mBAAmB,CAAC,KAAK,CAAC;QAC1B,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC;QACpE,OAAO,KAAK,CAAC,cAAc,KAAK,QAAQ;QACxC,CAAC,KAAK,CAAC,cAAc;QACrB,CAAC,UAAU,EACX,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,iDAAiD,EAAE;YAC9D,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAChE,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,4BAA4B,CAAC,MAAM,EAAE;QAC1C,GAAG,KAAK;QACR,eAAe,EAAE,SAAS;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,sCAAsC,CAC7C,MAAsB;IAEtB,MAAM,KAAK,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO;QACL,GAAG,MAAM;QACT,iBAAiB,EAAE;YACjB,GAAG,KAAK;YACR,iBAAiB,EAAE;gBACjB,MAAM,EAAE,aAAa;gBACrB,GAAG,EAAE,KAAK,CAAC,eAAe;aAC3B;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAiB,EACjB,OAAkC;IAElC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,eAAe,EAAE,UAAU,EAAE;QAC9D,mBAAmB,EAAE,OAAO,CAAC,cAAc,KAAK,IAAI;KACrD,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,CAAC;QACxC,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,KAAK,oBAAoB,CAAC;QAC/D,MAAM,CAAC,YAAY,CACjB,IAAI,CAAC,IAAI,EACT;YACE,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,WAAW,CAAC;YACtD,WAAW,EACT,sBAAsB,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;gBAC9C,CAAC,mBAAmB,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,WAAW,EAAE,mBAAmB;gBAC9B,CAAC,CAAC;oBACE,GAAG,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;oBAC3C,CAAC,iCAAiC,CAAC,EAAE,CAAC;yBACnC,MAAM,EAAE;yBACR,IAAI,EAAE;yBACN,QAAQ,EAAE;yBACV,QAAQ,CAAC,6CAA6C,CAAC;iBAC3D;gBACH,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,WAAW,CAAC;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,KAAK;SACvC,EACD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;YACpB,iBAAiB,CAAC,oBAAoB,EAAE;gBACtC,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;gBAC9C,WAAW,EAAE,IAAI,CAAC,IAAI;aACvB,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC1D,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACrD,MAAM,OAAO,GAAG,IAA+B,CAAC;gBAChD,MAAM,kBAAkB,GACtB,mBAAmB;oBACnB,OAAO,OAAO,CAAC,iCAAiC,CAAC,KAAK,QAAQ;oBAC5D,CAAC,CAAE,OAAO,CAAC,iCAAiC,CAAY;oBACxD,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,QAAQ,GAA4B;oBACxC,GAAG,OAAO;oBACV,wEAAwE;oBACxE,mEAAmE;oBACnE,mEAAmE;oBACnE,gEAAgE;oBAChE,QAAQ,EAAE,OAAO;iBAClB,CAAC;gBACF,IAAI,mBAAmB,EAAE,CAAC;oBACxB,gEAAgE;oBAChE,OAAO,QAAQ,CAAC,iCAAiC,CAAC,CAAC;gBACrD,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,CAC/D,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAC/C,CAAC;gBACF,YAAY,CAAC,qBAAqB,EAAE;oBAClC,aAAa,EAAE,SAAS;oBACxB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBACzB,IACE,OAAO;wBACP,CAAC,IAAI,CAAC,IAAI,KAAK,wBAAwB;4BACrC,IAAI,CAAC,IAAI,KAAK,oCAAoC;4BAClD,IAAI,CAAC,IAAI,KAAK,yBAAyB,CAAC,EAC1C,CAAC;wBACD,OAAO,4BAA4B,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;oBAClE,CAAC;oBACD,OAAO,MAAM,CAAC;gBAChB,CAAC;gBACD,MAAM,aAAa,GAAG,MAAM,6BAA6B,CACvD,MAAM,EACN,OAAO,CAAC,gCAAgC,EACxC,kBAAkB,CACnB,CAAC;gBACF,MAAM,WAAW,GACf,OAAO,EAAE,gBAAgB,KAAK,IAAI;oBAChC,CAAC,CAAC,sCAAsC,CAAC,aAAa,CAAC;oBACvD,CAAC,CAAC,aAAa,CAAC;gBACpB,OAAO,OAAO;oBACZ,CAAC,CAAC,4BAA4B,CAC1B,oBAAoB,EACpB,WAAW,EACX,OAAO,CACR;oBACH,CAAC,CAAC,WAAW,CAAC;YAClB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,CAAC,qBAAqB,EAAE;oBAClC,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK;oBAChE,aAAa,EAAE,OAAO;oBACtB,WAAW,EAAE,IAAI,CAAC,IAAI;iBACvB,CAAC,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/transports/mcp/app-status-html.d.ts

@@ -1,15 +1,11 @@
 /**
- * Self-contained MCP App HTML for Gateway status / open-link buttons.
+ * Self-contained MCP App HTML for Gateway status and open-link buttons.
  *
- * Nested iframes of Superblocks (preview / editor / live) were removed: Claude's
- * widget origin cannot hold a Superblocks Auth0 session, and Private Network
- * Access blocks localhost from a public parent. Display-mode controls (pip /
- * fullscreen / inline) were also removed — without an iframe they only resized
- * the status card. openLink buttons keep URLs in JS memory only (not printed).
+ * openLink buttons keep URLs in JS memory only (not printed).
  *
  * Speaks the MCP Apps postMessage dialect without bundling ext-apps into the
  * card (hosts cache UI resources; keep this file small and inline). Bump the
  * resource URI when the HTML changes so Claude Desktop refreshes its cache.
  */
-export declare const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v8.html";
-export declare const APP_STATUS_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>Superblocks app</title>\n  <style>\n    :root {\n      color-scheme: light dark;\n    }\n    body {\n      margin: 0;\n      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n      font-size: var(--font-text-sm-size, 13px);\n      line-height: var(--font-text-sm-line-height, 1.45);\n      color: var(--color-text-primary, #0f172a);\n      background: transparent;\n    }\n    .card {\n      display: flex;\n      flex-direction: column;\n      gap: 10px;\n      padding: 14px;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-lg, 12px);\n      background: var(--color-background-primary, #ffffff);\n    }\n    .head {\n      display: flex;\n      align-items: center;\n      gap: 8px;\n    }\n    h1 {\n      flex: 1;\n      margin: 0;\n      font-size: var(--font-text-md-size, 14px);\n      font-weight: var(--font-weight-semibold, 600);\n    }\n    .status {\n      padding: 2px 8px;\n      border-radius: var(--border-radius-full, 999px);\n      background: var(--color-background-secondary, #f1f5f9);\n      color: var(--color-text-secondary, #64748b);\n      font-size: var(--font-text-xs-size, 12px);\n      text-transform: lowercase;\n    }\n    .meta {\n      color: var(--color-text-tertiary, #94a3b8);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note {\n      display: none;\n      color: var(--color-text-warning, #b45309);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note.shown {\n      display: block;\n    }\n    .shot {\n      display: none;\n      width: 100%;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n    }\n    .shot.shown {\n      display: block;\n    }\n    .actions {\n      display: flex;\n      flex-wrap: wrap;\n      gap: 8px;\n    }\n    button {\n      appearance: none;\n      border: var(--border-width-regular, 1px) solid\n        var(--color-border-primary, #e2e8f0);\n      border-radius: var(--border-radius-md, 8px);\n      padding: 7px 12px;\n      background: var(--color-background-secondary, #f8fafc);\n      color: var(--color-text-primary, #0f172a);\n      font: inherit;\n      font-weight: var(--font-weight-medium, 500);\n      cursor: pointer;\n    }\n    button:hover:not(:disabled) {\n      background: var(--color-background-tertiary, #f1f5f9);\n    }\n    button:disabled {\n      opacity: 0.45;\n      cursor: not-allowed;\n    }\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"head\">\n      <h1>Superblocks app</h1>\n      <span id=\"status\" class=\"status\">loading</span>\n    </div>\n    <div id=\"appId\" class=\"meta\"></div>\n    <img id=\"shot\" class=\"shot\" alt=\"Preview of the running app\" />\n    <div id=\"note\" class=\"note\"></div>\n    <div class=\"actions\">\n      <button id=\"openEditor\" type=\"button\" disabled>Open editor</button>\n      <button id=\"openPreview\" type=\"button\" disabled>Open preview</button>\n      <button id=\"publishApp\" type=\"button\" disabled>Publish app</button>\n    </div>\n  </div>\n  <script>\n    (() => {\n      const PROTOCOL_VERSION = \"2026-01-26\";\n      // Statuses get_app reports when the app is still the empty starter\n      // template. \"building\" is deliberately absent: the card only hears a\n      // build finished if a new result arrives, so a stale badge would strand\n      // the button.\n      const UNBUILT_STATUSES = [\n        \"cancelled\",\n        \"live_edit_terminated\",\n        \"needs_decision\",\n        \"no_changes\",\n        \"timeout\",\n      ];\n      const BLOCKED_ACTIONS = [\n        \"answer_question\",\n        \"approve_plan\",\n        \"retry_build\",\n        \"retry_import\",\n      ];\n      let nextId = 1;\n      const pending = new Map();\n      let applicationId = \"\";\n      let appName = \"\";\n      let commitId = \"\";\n      let pendingAction = \"\";\n      let editUrl = \"\";\n      let previewUrl = \"\";\n      let publishUrl = \"\";\n      let canOpenLinks = false;\n      let canCallTools = false;\n      let publishing = false;\n      let lastHeight = 0;\n      let refreshInFlight = false;\n      let refreshTimer = 0;\n      let refreshGeneration = 0;\n      let refreshAttempts = 0;\n      let pollAfterMs = 2000;\n      const MIN_POLL_MS = 2000;\n      const MAX_REFRESH_ATTEMPTS = 40;\n\n      function post(message) {\n        window.parent.postMessage(message, \"*\");\n      }\n\n      function notify(method, params) {\n        post({ jsonrpc: \"2.0\", method, params });\n      }\n\n      function request(method, params) {\n        const id = nextId++;\n        return new Promise((resolve, reject) => {\n          pending.set(id, { resolve, reject });\n          post({ jsonrpc: \"2.0\", id, method, params });\n        });\n      }\n\n      function element(id) {\n        return document.getElementById(id);\n      }\n\n      function show(id, on) {\n        const node = element(id);\n        if (node && node.classList) {\n          node.classList.toggle(\"shown\", on);\n        }\n      }\n\n      // Hosts size the card from this notification alone; without it the card\n      // is laid out at zero height and never appears.\n      function reportSize() {\n        const height = Math.ceil(document.documentElement.scrollHeight || 0);\n        if (height <= 0 || height === lastHeight) {\n          return;\n        }\n        lastHeight = height;\n        notify(\"ui/notifications/size-changed\", {\n          height,\n          width: Math.ceil(window.innerWidth || 0),\n        });\n      }\n\n      function note(text) {\n        element(\"note\").textContent = text;\n        show(\"note\", Boolean(text));\n        reportSize();\n      }\n\n      function isPlainHttp(url) {\n        return url.slice(0, 5).toLowerCase() === \"http:\";\n      }\n\n      /** A UUID says nothing; the name the user asked Superblocks for does. */\n      function renderIdentity() {\n        element(\"appId\").textContent = appName || applicationId;\n      }\n\n      /**\n       * Draws the screenshot the tool captured.\n       *\n       * Hosts that render an MCP App render it *instead of* the tool's content\n       * blocks, so the image block get_app returns never reaches the user on\n       * its own \u2014 the card has to take it out of the result and show it.\n       */\n      function showScreenshot(dataBase64, mimeType) {\n        if (typeof dataBase64 !== \"string\" || !dataBase64) {\n          return;\n        }\n        element(\"shot\").src =\n          \"data:\" + (mimeType || \"image/jpeg\") + \";base64,\" + dataBase64;\n        show(\"shot\", true);\n        reportSize();\n      }\n\n      /** Applies every part of an MCP content array the card understands. */\n      function applyContent(content) {\n        for (const part of content || []) {\n          if (!part) {\n            continue;\n          }\n          if (part.type === \"text\" && typeof part.text === \"string\") {\n            applyPayload(part.text);\n          }\n          if (part.type === \"image\") {\n            showScreenshot(part.data, part.mimeType);\n          }\n        }\n      }\n\n      /**\n       * True when publishing would deploy the empty starter template.\n       * pendingAction is the server's own \"nothing to preview\" signal;\n       * wait_for_build is the building exception. Status is only a fallback\n       * when the payload omitted pendingAction. loading/waiting with no\n       * preview fail closed so Publish is not clickable before get_app\n       * returns.\n       */\n      function nothingToPublish() {\n        if (previewUrl || publishUrl) {\n          return false;\n        }\n        if (pendingAction === \"wait_for_build\") {\n          return false;\n        }\n        if (BLOCKED_ACTIONS.indexOf(pendingAction) !== -1) {\n          return true;\n        }\n        const badge = element(\"status\").textContent;\n        if (!badge || badge === \"loading\" || badge === \"waiting\") {\n          return true;\n        }\n        return UNBUILT_STATUSES.indexOf(badge) !== -1;\n      }\n\n      /**\n       * Keep URLs in memory for openLink \u2014 never print them (preview JWTs are\n       * huge and ugly in the card).\n       */\n      function renderActions() {\n        element(\"openEditor\").disabled = !editUrl || !canOpenLinks;\n        element(\"openPreview\").disabled = !previewUrl || !canOpenLinks;\n        // Once the app is live, publishing again is not what anyone wants from\n        // this button \u2014 going to the live app is.\n        element(\"publishApp\").textContent = publishUrl\n          ? \"Open published app\"\n          : \"Publish app\";\n        element(\"publishApp\").disabled = publishUrl\n          ? !canOpenLinks\n          : !applicationId ||\n            !canCallTools ||\n            publishing ||\n            nothingToPublish();\n        // Only warn about what is actually broken. Hosts that do open links\n        // handle local http fine; if one refuses, refused() says so then.\n        if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {\n          note(\"This host cannot open links for me \u2014 ask the model for an https preview URL.\");\n        }\n        reportSize();\n      }\n\n      /** Only ever ask the host to open a real web address. */\n      function webUrl(candidate) {\n        try {\n          const parsed = new URL(candidate);\n          return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n            ? candidate\n            : \"\";\n        } catch {\n          return \"\";\n        }\n      }\n\n      /**\n       * Merges whatever the host sent. Hosts replay tool input as well as tool\n       * results, and the input carries no status or URLs \u2014 overwriting from a\n       * partial payload is what showed the card as \"unknown\".\n       *\n       * Hosts also disagree on the shape: some pass the capability JSON, some\n       * pass the MCP content/text envelope (Claude Desktop on initialize), and\n       * some nest that under structuredContent.\n       */\n      function applyPayload(raw) {\n        let data = raw;\n        if (typeof raw === \"string\") {\n          try {\n            data = JSON.parse(raw);\n          } catch {\n            return;\n          }\n        }\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        // MCP tool-result / initialize toolResult envelope.\n        if (Array.isArray(data.content)) {\n          applyContent(data.content);\n          if (data.structuredContent) {\n            applyPayload(data.structuredContent);\n          }\n          return;\n        }\n        if (data.result && typeof data.result === \"object\") {\n          applyPayload(data.result);\n          return;\n        }\n        const value = data.kind === \"ok\" ? data.value : data;\n        if (!value || typeof value !== \"object\") {\n          return;\n        }\n        if (typeof value.status === \"string\") {\n          element(\"status\").textContent = value.status;\n        }\n        if (typeof value.applicationId === \"string\") {\n          applicationId = value.applicationId;\n          renderIdentity();\n        }\n        if (typeof value.name === \"string\" && value.name) {\n          appName = value.name;\n          renderIdentity();\n        }\n        if (typeof value.commitId === \"string\") {\n          commitId = value.commitId;\n        }\n        if (typeof value.pendingAction === \"string\") {\n          pendingAction = value.pendingAction;\n        } else if (typeof value.status === \"string\") {\n          pendingAction = \"\";\n        }\n        if (typeof value.screenshotBase64 === \"string\") {\n          showScreenshot(value.screenshotBase64, \"image/jpeg\");\n        }\n        if (typeof value.editUrl === \"string\") {\n          editUrl = webUrl(value.editUrl);\n        }\n        if (typeof value.previewUrl === \"string\") {\n          previewUrl = webUrl(value.previewUrl);\n        }\n        if (typeof value.publishUrl === \"string\") {\n          publishUrl = webUrl(value.publishUrl);\n        }\n        if (typeof value.nextPollAfterMs === \"number\") {\n          pollAfterMs = value.nextPollAfterMs;\n        }\n        // Hosts that deliver URLs without a status left the badge on the HTML\n        // default (\"loading\") even after the app was built.\n        const badge = element(\"status\").textContent;\n        if (\n          !value.status &&\n          editUrl &&\n          (badge === \"\" || badge === \"loading\" || badge === \"waiting\")\n        ) {\n          element(\"status\").textContent = previewUrl ? \"ready\" : \"building\";\n        }\n        renderActions();\n      }\n\n      /**\n       * Re-ask get_app when the host gave us no result, or while status is\n       * still building. wait:false and ensurePreview:false so polls only\n       * ask for status. Honor nextPollAfterMs; 0 means stop.\n       */\n      function clearRefreshTimer() {\n        if (refreshTimer) {\n          clearTimeout(refreshTimer);\n          refreshTimer = 0;\n        }\n      }\n\n      function retryDelay() {\n        return Math.max(MIN_POLL_MS, pollAfterMs || MIN_POLL_MS);\n      }\n\n      function scheduleRefresh(delayMs) {\n        clearRefreshTimer();\n        if (refreshAttempts >= MAX_REFRESH_ATTEMPTS) {\n          note(\"Stopped checking whether the app is still building.\");\n          return;\n        }\n        refreshTimer = setTimeout(() => {\n          refreshTimer = 0;\n          refreshFromServer();\n        }, delayMs);\n      }\n\n      function refreshFromServer() {\n        clearRefreshTimer();\n        if (!canCallTools || !applicationId || refreshInFlight) {\n          return;\n        }\n        if (typeof document.hidden === \"boolean\" && document.hidden) {\n          scheduleRefresh(retryDelay());\n          return;\n        }\n        const badge = element(\"status\").textContent;\n        if (editUrl && badge !== \"building\") {\n          return;\n        }\n        if (refreshAttempts >= MAX_REFRESH_ATTEMPTS) {\n          note(\"Stopped checking whether the app is still building.\");\n          return;\n        }\n        refreshAttempts += 1;\n        const generation = refreshGeneration;\n        refreshInFlight = true;\n        request(\"tools/call\", {\n          name: \"get_app\",\n          arguments: {\n            applicationId,\n            ensurePreview: false,\n            wait: false,\n          },\n        })\n          .then((result) => {\n            refreshInFlight = false;\n            if (generation !== refreshGeneration) {\n              if (element(\"status\").textContent === \"building\") {\n                scheduleRefresh(retryDelay());\n              }\n              return;\n            }\n            if (!result || result.isError) {\n              scheduleRefresh(retryDelay());\n              return;\n            }\n            applyPayload(result);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            if (element(\"status\").textContent !== \"building\") {\n              return;\n            }\n            if (pollAfterMs === 0) {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          })\n          .catch(() => {\n            refreshInFlight = false;\n            if (generation !== refreshGeneration) {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          });\n      }\n\n      function applyHostContext(context) {\n        if (!context || typeof context !== \"object\") {\n          return;\n        }\n        const variables = context.styles && context.styles.variables;\n        const style = document.documentElement.style;\n        if (variables && style && typeof style.setProperty === \"function\") {\n          for (const name of Object.keys(variables)) {\n            const value = variables[name];\n            if (typeof value === \"string\") {\n              style.setProperty(name, value);\n            }\n          }\n        }\n        reportSize();\n      }\n\n      function refused(url) {\n        note(\n          isPlainHttp(url)\n            ? \"This host only opens https links, and this app is served over http \u2014 ask for an https preview URL.\"\n            : \"The host could not open the link \u2014 try again or ask the model for another URL.\",\n        );\n      }\n\n      function openLink(url) {\n        if (!url || !canOpenLinks) {\n          return;\n        }\n        request(\"ui/open-link\", { url })\n          .then((result) => {\n            if (result && result.isError) {\n              refused(url);\n              return;\n            }\n            note(\"\");\n          })\n          .catch(() => refused(url));\n      }\n\n      /**\n       * Asks the host to proxy publish_app back to this MCP server. The prompt\n       * is the commit message createCommit needs; the card supplies a fixed one\n       * so the user does not have to type through the model.\n       */\n      function publish() {\n        if (!applicationId || !canCallTools || publishing) {\n          return;\n        }\n        if (nothingToPublish()) {\n          note(\"Nothing to publish yet: this turn did not build the app.\");\n          return;\n        }\n        publishing = true;\n        renderActions();\n        note(\"Publishing\u2026\");\n        const args = {\n          applicationId,\n          idempotencyKey:\n            \"mcp-app-publish:\" + applicationId + \":\" + Date.now(),\n          prompt: \"Published from Gateway status card\",\n        };\n        if (commitId) {\n          args.commitId = commitId;\n        }\n        request(\"tools/call\", { name: \"publish_app\", arguments: args })\n          .then((result) => {\n            publishing = false;\n            if (!result || result.isError) {\n              const text =\n                result &&\n                Array.isArray(result.content) &&\n                result.content[0] &&\n                result.content[0].text\n                  ? String(result.content[0].text)\n                  : \"Publish failed.\";\n              note(text.slice(0, 280));\n              renderActions();\n              return;\n            }\n            applyContent(result.content || []);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            note(\n              publishUrl\n                ? \"Published \u2014 open the live app with Open published app.\"\n                : \"Published \u2014 the app is live.\",\n            );\n            renderActions();\n          })\n          .catch((error) => {\n            publishing = false;\n            note(\n              (error && error.message) ||\n                \"The host could not call publish_app.\",\n            );\n            renderActions();\n          });\n      }\n\n      function handleHostMessage(event) {\n        // App documents are opaque-origin, so the host window is the only\n        // identity available to authenticate a message against.\n        if (event.source !== window.parent) {\n          return;\n        }\n        const data = event.data;\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        if (data.method === \"ping\") {\n          post({ jsonrpc: \"2.0\", id: data.id, result: {} });\n          return;\n        }\n        if (data.id != null && pending.has(data.id)) {\n          const waiter = pending.get(data.id);\n          pending.delete(data.id);\n          if (data.error) {\n            waiter.reject(data.error);\n          } else {\n            waiter.resolve(data.result);\n          }\n          return;\n        }\n        const method = data.method;\n        const params = data.params || {};\n        if (\n          method === \"ui/notifications/tool-result\" ||\n          method === \"ui/tool-result\" ||\n          method === \"tools/call\"\n        ) {\n          applyContent(params.content || params.result?.content || []);\n          if (params.structuredContent) {\n            applyPayload(params.structuredContent);\n          }\n          refreshGeneration += 1;\n          if (element(\"status\").textContent === \"building\") {\n            refreshFromServer();\n          }\n        }\n        if (method === \"ui/notifications/tool-input\" && params.arguments) {\n          applyPayload(params.arguments);\n          refreshFromServer();\n        }\n        if (method === \"ui/notifications/host-context-changed\") {\n          applyHostContext(params);\n        }\n      }\n\n      window.addEventListener(\"message\", handleHostMessage);\n\n      element(\"openEditor\").addEventListener(\"click\", () => openLink(editUrl));\n      element(\"openPreview\").addEventListener(\"click\", () =>\n        openLink(previewUrl),\n      );\n      element(\"publishApp\").addEventListener(\"click\", () => {\n        if (publishUrl) {\n          openLink(publishUrl);\n          return;\n        }\n        publish();\n      });\n\n      if (typeof ResizeObserver === \"function\") {\n        new ResizeObserver(reportSize).observe(document.documentElement);\n      }\n\n      void request(\"ui/initialize\", {\n        appCapabilities: {\n          availableDisplayModes: [\"inline\"],\n        },\n        appInfo: { name: \"gateway-app-status\", version: \"0.0.6\" },\n        protocolVersion: PROTOCOL_VERSION,\n      })\n        .then((result) => {\n          // Hosts hold back tool results until the app confirms it is ready.\n          notify(\"ui/notifications/initialized\", {});\n          // Buttons that cannot work are worse than no buttons: hosts without\n          // openLinks silently drop ui/open-link.\n          canOpenLinks = Boolean(\n            result && result.hostCapabilities && result.hostCapabilities.openLinks,\n          );\n          canCallTools = Boolean(\n            result &&\n              result.hostCapabilities &&\n              result.hostCapabilities.serverTools,\n          );\n          applyHostContext(result && result.hostContext);\n          renderActions();\n          if (result && result.toolResult) {\n            applyPayload(result.toolResult);\n          }\n          refreshFromServer();\n        })\n        .catch(() => {\n          // Hosts that push tool results via notification still work.\n        })\n        .finally(reportSize);\n    })();\n  </script>\n</body>\n</html>\n";
+export declare const APP_STATUS_RESOURCE_URI = "ui://gateway/app-status-v37.html";
+export declare const APP_STATUS_HTML = "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n  <meta charset=\"utf-8\" />\n  <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />\n  <title>Superblocks app</title>\n  <style>\n    .head {\n      display: flex;\n      min-width: 0;\n      align-items: center;\n      gap: 8px;\n    }\n    h1 {\n      flex: 1;\n      margin: 0;\n      font-size: var(--font-text-md-size, 14px);\n      font-weight: var(--font-weight-semibold, 600);\n    }\n    .status {\n      padding: 2px 8px;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-full, 999px);\n      background: var(--sb-app-background-subtle);\n      color: var(--sb-app-text-secondary);\n      font-size: var(--font-text-xs-size, 12px);\n      text-transform: lowercase;\n    }\n    .status[data-tone=\"info\"] {\n      border-color: var(--sb-app-info-border);\n      background: var(--sb-app-info-background);\n      color: var(--sb-app-info-text);\n    }\n    .status[data-tone=\"success\"] {\n      border-color: var(--sb-app-success-border);\n      background: var(--sb-app-success-background);\n      color: var(--sb-app-success-text);\n    }\n    .status[data-tone=\"warning\"] {\n      border-color: var(--sb-app-warning-border);\n      background: var(--sb-app-warning-background);\n      color: var(--sb-app-warning-text);\n    }\n    .status[data-tone=\"danger\"] {\n      border-color: var(--sb-app-danger-border);\n      background: var(--sb-app-danger-background);\n      color: var(--sb-app-danger-text);\n    }\n    .meta {\n      color: var(--sb-app-text-tertiary);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .note {\n      color: var(--sb-app-warning-text);\n      font-size: var(--font-text-xs-size, 12px);\n    }\n    .shot {\n      display: none;\n      max-width: 100%;\n      width: 100%;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-md, 8px);\n    }\n    .shot.shown {\n      display: block;\n    }\n    .actions {\n      display: flex;\n      flex-wrap: wrap;\n      gap: 8px;\n    }\n    @media (max-width: 360px) {\n      .head {\n        align-items: flex-start;\n        flex-direction: column;\n      }\n    }\n\n    :root {\n      color-scheme: light dark;\n      --sb-app-background: var(\n        --color-background-primary,\n        light-dark(#ffffff, #1b1c1f)\n      );\n      --sb-app-background-subtle: var(\n        --color-background-secondary,\n        light-dark(#f9fafb, #24272b)\n      );\n      --sb-app-background-hover: var(\n        --color-background-tertiary,\n        light-dark(#f3f4f6, #2f3437)\n      );\n      --sb-app-background-inverse: var(\n        --color-background-inverse,\n        light-dark(#121517, #f9fafb)\n      );\n      --sb-app-text: var(\n        --color-text-primary,\n        light-dark(#121517, #f9fafb)\n      );\n      --sb-app-text-secondary: var(\n        --color-text-secondary,\n        light-dark(#5a6272, #c6cad2)\n      );\n      --sb-app-text-tertiary: var(\n        --color-text-tertiary,\n        light-dark(#6b7280, #a4aab7)\n      );\n      --sb-app-text-inverse: var(\n        --color-text-inverse,\n        light-dark(#ffffff, #121517)\n      );\n      --sb-app-border: var(\n        --color-border-primary,\n        light-dark(#e8eaed, #454d5f)\n      );\n      --sb-app-ring: var(\n        --color-ring-primary,\n        light-dark(#0077b6, #27bbff)\n      );\n      --sb-app-info-background: var(\n        --color-background-info,\n        light-dark(#e6f5ff, #083a50)\n      );\n      --sb-app-info-text: var(\n        --color-text-info,\n        light-dark(#00679e, #7dd3fc)\n      );\n      --sb-app-info-border: var(\n        --color-border-info,\n        light-dark(#c2e7ff, #075985)\n      );\n      --sb-app-success-background: var(\n        --color-background-success,\n        light-dark(#e8f8ef, #0a3926)\n      );\n      --sb-app-success-text: var(\n        --color-text-success,\n        light-dark(#087a43, #6ee7b7)\n      );\n      --sb-app-success-border: var(\n        --color-border-success,\n        light-dark(#b8e8cf, #087a43)\n      );\n      --sb-app-warning-background: var(\n        --color-background-warning,\n        light-dark(#fff7e6, #49350a)\n      );\n      --sb-app-warning-text: var(\n        --color-text-warning,\n        light-dark(#946200, #fcd34d)\n      );\n      --sb-app-warning-border: var(\n        --color-border-warning,\n        light-dark(#f5d996, #946200)\n      );\n      --sb-app-danger-background: var(\n        --color-background-danger,\n        light-dark(#fff1f1, #4a1d1d)\n      );\n      --sb-app-danger-text: var(\n        --color-text-danger,\n        light-dark(#c54141, #fca5a5)\n      );\n      --sb-app-danger-border: var(\n        --color-border-danger,\n        light-dark(#ffcaca, #c54141)\n      );\n    }\n    * {\n      box-sizing: border-box;\n    }\n    body {\n      min-width: 0;\n      margin: 0;\n      overflow-x: hidden;\n      background: transparent;\n      color: var(--sb-app-text);\n      font-family: var(--font-sans, system-ui, -apple-system, sans-serif);\n      font-size: var(--font-text-sm-size, 13px);\n      line-height: var(--font-text-sm-line-height, 1.45);\n    }\n    .card {\n      display: flex;\n      min-width: 0;\n      flex-direction: column;\n      gap: 12px;\n      padding: 16px;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-lg, 12px);\n      background: var(--sb-app-background);\n      box-shadow: var(--shadow-sm, 0 1px 2px rgba(18, 21, 23, 0.08));\n    }\n    h1,\n    .meta,\n    .note {\n      min-width: 0;\n      overflow-wrap: anywhere;\n    }\n    .note:empty {\n      position: absolute;\n    }\n    button,\n    textarea {\n      font: inherit;\n    }\n    button {\n      appearance: none;\n      min-width: 0;\n      padding: 8px 12px;\n      border: var(--border-width-regular, 1px) solid var(--sb-app-border);\n      border-radius: var(--border-radius-md, 8px);\n      background: var(--sb-app-background-subtle);\n      color: var(--sb-app-text);\n      font-weight: var(--font-weight-medium, 500);\n      line-height: var(--font-text-sm-line-height, 1.45);\n      cursor: pointer;\n    }\n    button:hover:not(:disabled) {\n      background: var(--sb-app-background-hover);\n    }\n    .button-primary {\n      border-color: var(--sb-app-background-inverse);\n      background: var(--sb-app-background-inverse);\n      color: var(--sb-app-text-inverse);\n    }\n    .button-primary:hover:not(:disabled) {\n      border-color: var(--sb-app-background-inverse);\n      background: var(--sb-app-background-inverse);\n    }\n    button:focus-visible,\n    textarea:focus-visible,\n    a:focus-visible {\n      outline: 2px solid var(--sb-app-ring);\n      outline-offset: 2px;\n    }\n    button:disabled {\n      opacity: 0.48;\n      cursor: not-allowed;\n    }\n    .actions {\n      min-width: 0;\n    }\n    .actions > button {\n      overflow-wrap: anywhere;\n    }\n    @media (max-width: 360px) {\n      .actions {\n        flex-direction: column;\n        flex-wrap: nowrap;\n      }\n      .actions > button {\n        width: 100%;\n      }\n    }\n\n  </style>\n</head>\n<body>\n  <div class=\"card\">\n    <div class=\"head\">\n      <h1>Superblocks app</h1>\n      <span id=\"status\" class=\"status\" data-tone=\"info\" aria-live=\"polite\">loading</span>\n    </div>\n    <div id=\"appId\" class=\"meta\"></div>\n    <img id=\"shot\" class=\"shot\" alt=\"Preview of the running app\" />\n    <div id=\"note\" class=\"note\" aria-live=\"polite\"></div>\n    <div class=\"actions\">\n      <button id=\"openEditor\" class=\"button-secondary\" type=\"button\" disabled>Open editor</button>\n      <button id=\"openPreview\" class=\"button-secondary\" type=\"button\" disabled>Open preview</button>\n      <button id=\"publishApp\" class=\"button-primary\" type=\"button\" disabled>Publish app</button>\n    </div>\n  </div>\n  <script>\n    (() => {\n      const PROTOCOL_VERSION = \"2026-01-26\";\n      // Statuses with no usable build to publish. \"building\" is deliberately\n      // absent because a stale badge should not strand the button.\n      const UNBUILT_STATUSES = [\n        \"cancelled\",\n        \"checkpoint_failed\",\n        \"detached\",\n        \"failed\",\n        \"live_edit_terminated\",\n        \"needs_decision\",\n        \"no_changes\",\n        \"timeout\",\n      ];\n      const BLOCKED_ACTIONS = [\n        \"answer_question\",\n        \"approve_plan\",\n        \"open_editor\",\n        \"retry_build\",\n      ];\n      const STATUS_TONES = {\n        building: \"info\",\n        cancelled: \"warning\",\n        checkpoint_failed: \"danger\",\n        deployed: \"success\",\n        detached: \"warning\",\n        failed: \"danger\",\n        live_edit_terminated: \"danger\",\n        loading: \"info\",\n        needs_decision: \"warning\",\n        no_changes: \"warning\",\n        publish_failed: \"danger\",\n        publishing: \"info\",\n        ready: \"success\",\n        timeout: \"danger\",\n        waiting: \"info\",\n      };\n      let nextId = 1;\n      const pending = new Map();\n      let applicationId = \"\";\n      let appName = \"\";\n      let branch = \"\";\n      let commitId = \"\";\n      let directoryHash = \"\";\n      let pendingAction = \"\";\n      let editUrl = \"\";\n      let previewUrl = \"\";\n      let publishUrl = \"\";\n      let canOpenLinks = false;\n      let canCallTools = false;\n      let publishing = false;\n      let teardownRequested = false;\n      let lastHeight = 0;\n      let buildWatchStartedAtMs;\n      let refreshInFlightGeneration = -1;\n      let refreshTimer = 0;\n      let refreshGeneration = 0;\n      const BUILD_WATCH_MS = 20 * 60_000;\n      const POLL_INTERVAL_MS = 2000;\n\n      function post(message) {\n        window.parent.postMessage(message, \"*\");\n      }\n\n      function notify(method, params) {\n        post({ jsonrpc: \"2.0\", method, params });\n      }\n\n      function request(method, params) {\n        const id = nextId++;\n        return new Promise((resolve, reject) => {\n          pending.set(id, { resolve, reject });\n          post({ jsonrpc: \"2.0\", id, method, params });\n        });\n      }\n\n      function element(id) {\n        return document.getElementById(id);\n      }\n\n      function show(id, on) {\n        const node = element(id);\n        if (node && node.classList) {\n          node.classList.toggle(\"shown\", on);\n        }\n      }\n\n      function renderStatus(status) {\n        const badge = element(\"status\");\n        badge.textContent = status;\n        badge.setAttribute(\n          \"data-tone\",\n          Object.hasOwn(STATUS_TONES, status) ? STATUS_TONES[status] : \"neutral\",\n        );\n      }\n\n      // Hosts size the card from this notification alone; without it the card\n      // is laid out at zero height and never appears.\n      function reportSize() {\n        if (teardownRequested) {\n          return;\n        }\n        const height = Math.ceil(document.documentElement.scrollHeight || 0);\n        if (height <= 0 || height === lastHeight) {\n          return;\n        }\n        lastHeight = height;\n        notify(\"ui/notifications/size-changed\", {\n          height,\n          width: Math.ceil(window.innerWidth || 0),\n        });\n      }\n\n      function note(text) {\n        element(\"note\").textContent = text;\n        show(\"note\", Boolean(text));\n        reportSize();\n      }\n\n      function isPlainHttp(url) {\n        return url.slice(0, 5).toLowerCase() === \"http:\";\n      }\n\n      /** A UUID says nothing; the name the user asked Superblocks for does. */\n      function renderIdentity() {\n        element(\"appId\").textContent = appName || applicationId;\n      }\n\n      /**\n       * Draws the screenshot the tool captured.\n       *\n       * Hosts that render an MCP App render it *instead of* the tool's content\n       * blocks, so the image block get_app returns never reaches the user on\n       * its own \u2014 the card has to take it out of the result and show it.\n       */\n      function showScreenshot(dataBase64, mimeType) {\n        if (typeof dataBase64 !== \"string\" || !dataBase64) {\n          return;\n        }\n        element(\"shot\").src =\n          \"data:\" + (mimeType || \"image/jpeg\") + \";base64,\" + dataBase64;\n        show(\"shot\", true);\n        reportSize();\n      }\n\n      /** Applies every part of an MCP content array the card understands. */\n      function applyContent(content) {\n        for (const part of content || []) {\n          if (!part) {\n            continue;\n          }\n          if (part.type === \"text\" && typeof part.text === \"string\") {\n            applyPayload(part.text);\n          }\n          if (part.type === \"image\") {\n            showScreenshot(part.data, part.mimeType);\n          }\n        }\n      }\n\n      /**\n       * True when publishing would deploy the empty starter template.\n       * pendingAction is the server's own \"nothing to preview\" signal;\n       * wait_for_build is the building exception. Status is only a fallback\n       * when the payload omitted pendingAction. loading/waiting with no\n       * preview fail closed so Publish is not clickable before get_app\n       * returns.\n       */\n      function nothingToPublish() {\n        const badge = element(\"status\").textContent;\n        if (UNBUILT_STATUSES.indexOf(badge) !== -1) {\n          return true;\n        }\n        if (previewUrl || publishUrl) {\n          return false;\n        }\n        if (pendingAction === \"wait_for_build\") {\n          return false;\n        }\n        if (BLOCKED_ACTIONS.indexOf(pendingAction) !== -1) {\n          return true;\n        }\n        if (!badge || badge === \"loading\" || badge === \"waiting\") {\n          return true;\n        }\n        return false;\n      }\n\n      /**\n       * Keep URLs in memory for openLink \u2014 never print them (preview JWTs are\n       * huge and ugly in the card).\n       */\n      function renderActions() {\n        const status = element(\"status\").textContent;\n        const previewReady = status === \"ready\";\n        const rollingOut = status === \"publishing\";\n        const published = Boolean(publishUrl) && !rollingOut;\n        element(\"openEditor\").disabled = !editUrl || !canOpenLinks;\n        element(\"openPreview\").disabled =\n          !previewReady || !previewUrl || !canOpenLinks;\n        // Once the app is live, publishing again is not what anyone wants from\n        // this button \u2014 going to the live app is.\n        element(\"publishApp\").textContent = rollingOut\n          ? \"Publishing...\"\n          : published\n            ? \"Open published app\"\n            : \"Publish app\";\n        element(\"publishApp\").disabled = rollingOut\n          ? true\n          : published\n            ? !canOpenLinks\n            : !applicationId ||\n              !canCallTools ||\n              publishing ||\n              nothingToPublish();\n        // Only warn about what is actually broken. Hosts that do open links\n        // handle local http fine; if one refuses, refused() says so then.\n        if (!canOpenLinks && (editUrl || previewUrl) && !publishUrl) {\n          note(\"This host cannot open links for me \u2014 ask the model for an https preview URL.\");\n        }\n        reportSize();\n      }\n\n      /** Only ever ask the host to open a real web address. */\n      function webUrl(candidate) {\n        try {\n          const parsed = new URL(candidate);\n          return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n            ? candidate\n            : \"\";\n        } catch {\n          return \"\";\n        }\n      }\n\n      /**\n       * Merges whatever the host sent. Hosts replay tool input as well as tool\n       * results, and the input carries no status or URLs \u2014 overwriting from a\n       * partial payload is what showed the card as \"unknown\".\n       *\n       * Hosts also disagree on the shape: some pass the capability JSON, some\n       * pass the MCP content/text envelope (Claude Desktop on initialize), and\n       * some nest that under structuredContent.\n       */\n      function applyPayload(raw) {\n        let data = raw;\n        if (typeof raw === \"string\") {\n          try {\n            data = JSON.parse(raw);\n          } catch {\n            return;\n          }\n        }\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        // MCP tool-result / initialize toolResult envelope.\n        if (Array.isArray(data.content)) {\n          applyContent(data.content);\n          if (data.structuredContent) {\n            applyPayload(data.structuredContent);\n          }\n          return;\n        }\n        if (data.result && typeof data.result === \"object\") {\n          applyPayload(data.result);\n          return;\n        }\n        const value = data.kind === \"ok\" ? data.value : data;\n        if (!value || typeof value !== \"object\") {\n          return;\n        }\n        if (\n          value.browserNavigation &&\n          typeof value.browserNavigation === \"object\" &&\n          value.browserNavigation.action === \"open_editor\"\n        ) {\n          if (!teardownRequested) {\n            teardownRequested = true;\n            refreshGeneration += 1;\n            clearRefreshTimer();\n            document.body.hidden = true;\n            notify(\"ui/notifications/size-changed\", { height: 0, width: 0 });\n            notify(\"ui/notifications/request-teardown\", {});\n          }\n          return;\n        }\n        if (teardownRequested) {\n          return;\n        }\n        if (typeof value.status === \"string\") {\n          if (value.status !== \"building\") {\n            buildWatchStartedAtMs = undefined;\n          }\n          renderStatus(value.status);\n        }\n        if (typeof value.applicationId === \"string\") {\n          applicationId = value.applicationId;\n          renderIdentity();\n        }\n        if (typeof value.name === \"string\" && value.name) {\n          appName = value.name;\n          renderIdentity();\n        }\n        if (typeof value.branch === \"string\") {\n          branch = value.branch;\n        }\n        if (typeof value.directoryHash === \"string\") {\n          directoryHash = value.directoryHash;\n        }\n        if (\n          typeof value.commitId === \"string\" ||\n          typeof value.previewUrl === \"string\" ||\n          (typeof value.applicationId === \"string\" &&\n            typeof value.status === \"string\")\n        ) {\n          commitId =\n            typeof value.commitId === \"string\" ? value.commitId : \"\";\n        }\n        if (typeof value.pendingAction === \"string\") {\n          pendingAction = value.pendingAction;\n        } else if (typeof value.status === \"string\") {\n          pendingAction = \"\";\n        }\n        if (typeof value.screenshotBase64 === \"string\") {\n          showScreenshot(value.screenshotBase64, \"image/jpeg\");\n        }\n        if (typeof value.editUrl === \"string\") {\n          editUrl = webUrl(value.editUrl);\n        }\n        if (typeof value.previewUrl === \"string\") {\n          previewUrl = webUrl(value.previewUrl);\n        } else if (typeof value.status === \"string\" && !commitId) {\n          previewUrl = \"\";\n        }\n        if (typeof value.publishUrl === \"string\") {\n          publishUrl = webUrl(value.publishUrl);\n        }\n        // Hosts that deliver URLs without a status left the badge on the HTML\n        // default (\"loading\") even after the app was built.\n        const badge = element(\"status\").textContent;\n        if (\n          !value.status &&\n          editUrl &&\n          (badge === \"\" || badge === \"loading\" || badge === \"waiting\")\n        ) {\n          renderStatus(previewUrl ? \"ready\" : \"building\");\n        }\n        renderActions();\n        if (\n          canCallTools &&\n          commitId &&\n          element(\"status\").textContent === \"publishing\"\n        ) {\n          scheduleRefresh(retryDelay());\n        }\n      }\n\n      /**\n       * Ask the app-only status tool when the host gave us no result, or while\n       * status is still building.\n       */\n      function clearRefreshTimer() {\n        if (refreshTimer) {\n          clearTimeout(refreshTimer);\n          refreshTimer = 0;\n        }\n      }\n\n      function retryDelay() {\n        return POLL_INTERVAL_MS;\n      }\n\n      function scheduleRefresh(delayMs) {\n        clearRefreshTimer();\n        if (\n          element(\"status\").textContent !== \"publishing\" &&\n          buildWatchStartedAtMs !== undefined &&\n          Date.now() - buildWatchStartedAtMs >= BUILD_WATCH_MS\n        ) {\n          note(\"Stopped checking whether the app is still building.\");\n          return;\n        }\n        refreshTimer = setTimeout(() => {\n          refreshTimer = 0;\n          refreshFromServer();\n        }, delayMs);\n      }\n\n      function refreshFromServer() {\n        clearRefreshTimer();\n        if (\n          teardownRequested ||\n          !canCallTools ||\n          refreshInFlightGeneration === refreshGeneration ||\n          publishing\n        ) {\n          return;\n        }\n        if (typeof document.hidden === \"boolean\" && document.hidden) {\n          scheduleRefresh(retryDelay());\n          return;\n        }\n        const badge = element(\"status\").textContent;\n        const publishStatus = badge === \"publishing\";\n        if (editUrl && badge !== \"building\" && !publishStatus) {\n          buildWatchStartedAtMs = undefined;\n          return;\n        }\n        if (!publishStatus) {\n          if (badge === \"building\") {\n            if (buildWatchStartedAtMs === undefined) {\n              buildWatchStartedAtMs = Date.now();\n            }\n          } else {\n            buildWatchStartedAtMs = undefined;\n          }\n          if (\n            buildWatchStartedAtMs !== undefined &&\n            Date.now() - buildWatchStartedAtMs >= BUILD_WATCH_MS\n          ) {\n            note(\"Stopped checking whether the app is still building.\");\n            return;\n          }\n        }\n        const generation = refreshGeneration;\n        refreshInFlightGeneration = generation;\n        const previewStatus = !publishStatus && Boolean(commitId && directoryHash);\n        request(\"tools/call\", {\n          name: publishStatus\n            ? \"check_publish_progress\"\n            : previewStatus\n              ? \"get_preview_status\"\n              : \"get_app_status\",\n          arguments: {\n            ...(applicationId ? { applicationId } : {}),\n            ...(!publishStatus && branch ? { branch } : {}),\n            ...(publishStatus && commitId ? { commitId } : {}),\n            ...(previewStatus ? { commitId, directoryHash, wait: false } : {}),\n          },\n        })\n          .then((result) => {\n            if (refreshInFlightGeneration === generation) {\n              refreshInFlightGeneration = -1;\n            }\n            if (generation !== refreshGeneration) {\n              if (\n                !publishing &&\n                element(\"status\").textContent === \"building\" &&\n                refreshInFlightGeneration !== refreshGeneration\n              ) {\n                scheduleRefresh(retryDelay());\n              }\n              return;\n            }\n            const publishError = publishStatus\n              ? terminalPublishErrorOf(result)\n              : \"\";\n            if (publishError) {\n              refreshGeneration += 1;\n              clearRefreshTimer();\n              publishUrl = \"\";\n              renderStatus(\"publish_failed\");\n              note(publishError);\n              renderActions();\n              return;\n            }\n            if (!result || result.isError) {\n              scheduleRefresh(retryDelay());\n              return;\n            }\n            applyPayload(result);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            const status = element(\"status\").textContent;\n            if (status === \"deployed\") {\n              note(\n                publishUrl\n                  ? \"Published - open the live app with Open published app.\"\n                  : \"Published - the app is live.\",\n              );\n              return;\n            }\n            if (status === \"publishing\") {\n              scheduleRefresh(retryDelay());\n              return;\n            }\n            if (status !== \"building\") {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          })\n          .catch(() => {\n            if (refreshInFlightGeneration === generation) {\n              refreshInFlightGeneration = -1;\n            }\n            if (generation !== refreshGeneration) {\n              return;\n            }\n            scheduleRefresh(retryDelay());\n          });\n      }\n\n      function applyHostContext(context) {\n        if (!context || typeof context !== \"object\") {\n          return;\n        }\n        const root = document.documentElement;\n        if (context.theme === \"light\" || context.theme === \"dark\") {\n          root.setAttribute(\"data-theme\", context.theme);\n          root.style.colorScheme = context.theme;\n        }\n        const variables = context.styles && context.styles.variables;\n        const style = root.style;\n        if (variables && style && typeof style.setProperty === \"function\") {\n          for (const name of Object.keys(variables)) {\n            const value = variables[name];\n            if (typeof value === \"string\") {\n              style.setProperty(name, value);\n            }\n          }\n        }\n        const fonts = context.styles && context.styles.css?.fonts;\n        if (typeof fonts === \"string\") {\n          let fontStyle = document.getElementById(\"__mcp-host-fonts\");\n          if (!fontStyle) {\n            fontStyle = document.createElement(\"style\");\n            fontStyle.id = \"__mcp-host-fonts\";\n            document.head.appendChild(fontStyle);\n          }\n          fontStyle.textContent = fonts;\n        }\n        reportSize();\n      }\n\n      function capabilityFailureOf(result) {\n        if (!result || !Array.isArray(result.content)) {\n          return null;\n        }\n        for (const block of result.content) {\n          if (!block || block.type !== \"text\" || !block.text) {\n            continue;\n          }\n          try {\n            const parsed = JSON.parse(block.text);\n            if (parsed && parsed.kind === \"error\") {\n              return {\n                code: parsed.code || \"\",\n                message: parsed.message || parsed.code || \"Tool call failed.\",\n              };\n            }\n          } catch {\n            continue;\n          }\n        }\n        return null;\n      }\n\n      function capabilityErrorOf(result) {\n        return capabilityFailureOf(result)?.message || \"\";\n      }\n\n      function terminalPublishErrorOf(result) {\n        const failure = capabilityFailureOf(result);\n        if (\n          !failure ||\n          ![\n            \"publish_failed\",\n            \"publish_needs_acknowledgement\",\n            \"publish_timeout\",\n          ].includes(failure.code)\n        ) {\n          return \"\";\n        }\n        return failure.message;\n      }\n\n      /** First text block of a failed tool result, for the note line. */\n      function errorTextOf(result, fallback) {\n        const capabilityError = capabilityErrorOf(result);\n        if (capabilityError) {\n          return capabilityError;\n        }\n        const first =\n          result && Array.isArray(result.content) ? result.content[0] : null;\n        return first && first.text ? String(first.text).slice(0, 280) : fallback;\n      }\n\n      function refused(url) {\n        note(\n          isPlainHttp(url)\n            ? \"This host only opens https links, and this app is served over http \u2014 ask for an https preview URL.\"\n            : \"The host could not open the link \u2014 try again or ask the model for another URL.\",\n        );\n      }\n\n      function openLink(url) {\n        if (!url || !canOpenLinks) {\n          return;\n        }\n        request(\"ui/open-link\", { url })\n          .then((result) => {\n            if (result && result.isError) {\n              refused(url);\n              return;\n            }\n            note(\"\");\n          })\n          .catch(() => refused(url));\n      }\n\n      /**\n       * Asks the host to proxy publish_app back to this MCP server. The prompt\n       * is the commit message createCommit needs; the card supplies a fixed one\n       * so the user does not have to type through the model.\n       */\n      function publish() {\n        if (!applicationId || !canCallTools || publishing) {\n          return;\n        }\n        if (nothingToPublish()) {\n          note(\"Nothing to publish yet: this turn did not build the app.\");\n          return;\n        }\n        publishing = true;\n        refreshGeneration += 1;\n        clearRefreshTimer();\n        renderActions();\n        note(\"Publishing\u2026\");\n        const args = {\n          applicationId,\n          idempotencyKey:\n            \"mcp-app-publish:\" + applicationId + \":\" + Date.now(),\n          prompt: \"Published from Gateway status card\",\n        };\n        if (commitId) {\n          args.commitId = commitId;\n        }\n        if (branch) {\n          args.branch = branch;\n        }\n        request(\"tools/call\", { name: \"publish_app\", arguments: args })\n          .then((result) => {\n            publishing = false;\n            const publishError = capabilityErrorOf(result);\n            if (!result || result.isError || publishError) {\n              note(errorTextOf(result, \"Publish failed.\"));\n              renderActions();\n              refreshFromServer();\n              return;\n            }\n            applyContent(result.content || []);\n            if (result.structuredContent) {\n              applyPayload(result.structuredContent);\n            }\n            const status = element(\"status\").textContent;\n            note(\n              status === \"publishing\"\n                ? \"Publish accepted; the deploy is still rolling out.\"\n                : publishUrl\n                  ? \"Published - open the live app with Open published app.\"\n                  : \"Published - the app is live.\",\n            );\n            renderActions();\n          })\n          .catch((error) => {\n            publishing = false;\n            note(\n              (error && error.message) ||\n                \"The host could not call publish_app.\",\n            );\n            renderActions();\n            refreshFromServer();\n          });\n      }\n\n      function handleHostMessage(event) {\n        // App documents are opaque-origin, so the host window is the only\n        // identity available to authenticate a message against.\n        if (event.source !== window.parent) {\n          return;\n        }\n        const data = event.data;\n        if (!data || typeof data !== \"object\") {\n          return;\n        }\n        if (data.method === \"ping\") {\n          post({ jsonrpc: \"2.0\", id: data.id, result: {} });\n          return;\n        }\n        if (data.id != null && pending.has(data.id)) {\n          const waiter = pending.get(data.id);\n          pending.delete(data.id);\n          if (data.error) {\n            waiter.reject(data.error);\n          } else {\n            waiter.resolve(data.result);\n          }\n          return;\n        }\n        const method = data.method;\n        const params = data.params || {};\n        if (\n          method === \"ui/notifications/tool-result\" ||\n          method === \"ui/tool-result\" ||\n          method === \"tools/call\"\n        ) {\n          applyContent(params.content || params.result?.content || []);\n          if (params.structuredContent) {\n            applyPayload(params.structuredContent);\n          }\n          refreshGeneration += 1;\n          if (element(\"status\").textContent === \"building\") {\n            refreshFromServer();\n          }\n        }\n        if (method === \"ui/notifications/tool-input\" && params.arguments) {\n          applyPayload(params.arguments);\n          refreshFromServer();\n        }\n        if (method === \"ui/notifications/host-context-changed\") {\n          applyHostContext(params);\n        }\n      }\n\n      window.addEventListener(\"message\", handleHostMessage);\n\n      element(\"openEditor\").addEventListener(\"click\", () => openLink(editUrl));\n      element(\"openPreview\").addEventListener(\"click\", () =>\n        openLink(previewUrl),\n      );\n      element(\"publishApp\").addEventListener(\"click\", () => {\n        if (element(\"status\").textContent === \"publishing\") {\n          return;\n        }\n        if (publishUrl) {\n          openLink(publishUrl);\n          return;\n        }\n        publish();\n      });\n\n      if (typeof ResizeObserver === \"function\") {\n        new ResizeObserver(reportSize).observe(document.documentElement);\n      }\n\n      void request(\"ui/initialize\", {\n        appCapabilities: {\n          availableDisplayModes: [\"inline\"],\n        },\n        appInfo: { name: \"gateway-app-status\", version: \"0.0.8\" },\n        protocolVersion: PROTOCOL_VERSION,\n      })\n        .then((result) => {\n          // Hosts hold back tool results until the app confirms it is ready.\n          notify(\"ui/notifications/initialized\", {});\n          // Buttons that cannot work are worse than no buttons: hosts without\n          // openLinks silently drop ui/open-link.\n          canOpenLinks = Boolean(\n            result && result.hostCapabilities && result.hostCapabilities.openLinks,\n          );\n          canCallTools = Boolean(\n            result &&\n              result.hostCapabilities &&\n              result.hostCapabilities.serverTools,\n          );\n          if (result && result.toolResult) {\n            applyPayload(result.toolResult);\n          }\n          if (teardownRequested) {\n            return;\n          }\n          applyHostContext(result && result.hostContext);\n          renderActions();\n          const badge = element(\"status\").textContent;\n          if (badge === \"publishing\") {\n            return;\n          }\n          if (!applicationId && (!badge || badge === \"loading\")) {\n            scheduleRefresh(500);\n          } else {\n            refreshFromServer();\n          }\n        })\n        .catch(() => {\n          // Hosts that push tool results via notification still work.\n        })\n        .finally(reportSize);\n    })();\n  </script>\n</body>\n</html>\n";