@toon-protocol/views 0.2.0

package/dist/spec.js

@@ -0,0 +1,221 @@
+/**
+ * ViewSpec — the declarative composition language the client-side agent authors
+ * to assemble atoms into a user journey. A ViewSpec rides as the *result* of the
+ * `toon_render` tool (MCP Apps delivers dynamic data via tool results, not a
+ * side-channel); the iframe runtime interprets it.
+ *
+ * ViewSpecs are MODEL-AUTHORED → UNTRUSTED. `validateViewSpec` is the security
+ * boundary: it allowlists atom ids, caps depth/breadth, and rejects anything
+ * non-serializable. Invalid specs must degrade to a fallback, never `eval`.
+ */
+import {} from './types.js';
+const DEFAULT_MAX_DEPTH = 32;
+const DEFAULT_MAX_NODES = 500;
+function editDistance(a, b) {
+    const n = b.length;
+    const row = Array.from({ length: n + 1 }, (_, j) => j);
+    for (let i = 1; i <= a.length; i++) {
+        let prev = row[0];
+        row[0] = i;
+        for (let j = 1; j <= n; j++) {
+            const tmp = row[j];
+            row[j] = a[i - 1] === b[j - 1] ? prev : 1 + Math.min(prev, row[j - 1], row[j]);
+            prev = tmp;
+        }
+    }
+    return row[n];
+}
+function nearestAtom(name, allowed) {
+    if (name.length > 64)
+        return undefined; // no real atom name exceeds this; avoid O(m×n) on untrusted input
+    const lower = name.toLowerCase();
+    let best;
+    let bestDist = Infinity;
+    for (const id of allowed) {
+        const d = editDistance(lower, id.toLowerCase());
+        if (d < bestDist) {
+            bestDist = d;
+            best = id;
+        }
+    }
+    return bestDist <= Math.floor(name.length / 2) ? best : undefined;
+}
+const FILTER_ARRAY_KEYS = new Set([
+    'kinds',
+    'authors',
+    'ids',
+    '#d',
+    '#e',
+    '#a',
+    '#p',
+    '#t',
+]);
+const FILTER_NUM_KEYS = new Set(['since', 'until', 'limit']);
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function toSet(v) {
+    return v instanceof Set ? v : new Set(v);
+}
+function validateFilter(filter, path, errors) {
+    if (!isPlainObject(filter)) {
+        errors.push(`${path}: filter must be an object`);
+        return;
+    }
+    for (const [key, value] of Object.entries(filter)) {
+        if (FILTER_ARRAY_KEYS.has(key)) {
+            if (!Array.isArray(value) ||
+                !value.every((x) => typeof x === 'string' || typeof x === 'number')) {
+                errors.push(`${path}.${key}: must be an array of string/number`);
+            }
+        }
+        else if (FILTER_NUM_KEYS.has(key)) {
+            if (typeof value !== 'number' || !Number.isFinite(value)) {
+                errors.push(`${path}.${key}: must be a finite number`);
+            }
+        }
+        else {
+            errors.push(`${path}.${key}: unsupported filter key`);
+        }
+    }
+}
+/** True if a value is safely JSON-serializable (no functions, no cycles, finite). */
+function isJsonSafe(value, depth = 0) {
+    if (depth > 8)
+        return false;
+    if (value === null)
+        return true;
+    switch (typeof value) {
+        case 'string':
+        case 'boolean':
+            return true;
+        case 'number':
+            return Number.isFinite(value);
+        case 'object':
+            if (Array.isArray(value))
+                return value.every((v) => isJsonSafe(v, depth + 1));
+            if (isPlainObject(value))
+                return Object.values(value).every((v) => isJsonSafe(v, depth + 1));
+            return false;
+        default:
+            return false;
+    }
+}
+/**
+ * Validate a model-authored ViewSpec against the atom/tool allowlists and the
+ * depth/breadth caps. Returns the (structurally identical) spec on success or a
+ * list of human-readable errors on failure.
+ */
+export function validateViewSpec(input, opts) {
+    const errors = [];
+    const allowedAtoms = toSet(opts.allowedAtoms);
+    const allowedTools = opts.allowedTools ? toSet(opts.allowedTools) : undefined;
+    const maxDepth = opts.maxDepth ?? DEFAULT_MAX_DEPTH;
+    const maxNodes = opts.maxNodes ?? DEFAULT_MAX_NODES;
+    if (!isPlainObject(input)) {
+        return { ok: false, errors: ['spec must be an object'] };
+    }
+    if (input['title'] !== undefined && typeof input['title'] !== 'string') {
+        errors.push('spec.title: must be a string');
+    }
+    if (!isPlainObject(input['root'])) {
+        return { ok: false, errors: ['spec.root: required object'] };
+    }
+    let nodeCount = 0;
+    const walk = (node, path, depth) => {
+        if (depth > maxDepth) {
+            errors.push(`${path}: exceeds max depth ${maxDepth}`);
+            return;
+        }
+        if (++nodeCount > maxNodes) {
+            errors.push(`spec: exceeds max node count ${maxNodes}`);
+            return;
+        }
+        if (!isPlainObject(node)) {
+            errors.push(`${path}: node must be an object`);
+            return;
+        }
+        if (typeof node['atom'] !== 'string') {
+            errors.push(`${path}.atom: must be a string`);
+        }
+        else if (!allowedAtoms.has(node['atom'])) {
+            const atomName = node['atom'];
+            const suggestion = nearestAtom(atomName, allowedAtoms);
+            const hint = suggestion ? ` Did you mean "${suggestion}"?` : '';
+            const validList = [...allowedAtoms].join(', ');
+            errors.push(`${path}.atom: unknown atom "${atomName}".${hint}\n` +
+                `  Valid atoms: ${validList}.\n` +
+                `  See toon_atoms for full vocabulary.`);
+        }
+        if (node['props'] !== undefined) {
+            if (!isPlainObject(node['props']) || !isJsonSafe(node['props'])) {
+                errors.push(`${path}.props: must be a JSON-serializable object`);
+            }
+        }
+        if (node['bind'] !== undefined) {
+            const bind = node['bind'];
+            if (!isPlainObject(bind)) {
+                errors.push(`${path}.bind: must be an object`);
+            }
+            else {
+                const KNOWN_BIND_KEYS = new Set(['query', 'eventId', 'kindAuto']);
+                for (const key of Object.keys(bind)) {
+                    if (!KNOWN_BIND_KEYS.has(key)) {
+                        errors.push(`${path}.bind.${key}: unknown bind key (use "query" for a NIP-01 filter)`);
+                    }
+                }
+                if (bind['query'] !== undefined)
+                    validateFilter(bind['query'], `${path}.bind.query`, errors);
+                if (bind['eventId'] !== undefined && typeof bind['eventId'] !== 'string') {
+                    errors.push(`${path}.bind.eventId: must be a string`);
+                }
+                if (bind['kindAuto'] !== undefined && typeof bind['kindAuto'] !== 'boolean') {
+                    errors.push(`${path}.bind.kindAuto: must be a boolean`);
+                }
+            }
+        }
+        if (node['actions'] !== undefined) {
+            const actions = node['actions'];
+            if (!isPlainObject(actions)) {
+                errors.push(`${path}.actions: must be an object`);
+            }
+            else {
+                for (const [name, ref] of Object.entries(actions)) {
+                    const p = `${path}.actions.${name}`;
+                    if (!isPlainObject(ref)) {
+                        errors.push(`${p}: must be an object`);
+                        continue;
+                    }
+                    if (typeof ref['tool'] !== 'string') {
+                        errors.push(`${p}.tool: must be a string`);
+                    }
+                    else if (allowedTools && !allowedTools.has(ref['tool'])) {
+                        errors.push(`${p}.tool: tool "${ref['tool']}" not allowed`);
+                    }
+                    if (ref['args'] !== undefined && (!isPlainObject(ref['args']) || !isJsonSafe(ref['args']))) {
+                        errors.push(`${p}.args: must be a JSON-serializable object`);
+                    }
+                    if (ref['spendy'] !== undefined && typeof ref['spendy'] !== 'boolean') {
+                        errors.push(`${p}.spendy: must be a boolean`);
+                    }
+                    if (ref['confirmLabel'] !== undefined && typeof ref['confirmLabel'] !== 'string') {
+                        errors.push(`${p}.confirmLabel: must be a string`);
+                    }
+                }
+            }
+        }
+        if (node['children'] !== undefined) {
+            if (!Array.isArray(node['children'])) {
+                errors.push(`${path}.children: must be an array`);
+            }
+            else {
+                node['children'].forEach((child, i) => walk(child, `${path}.children[${i}]`, depth + 1));
+            }
+        }
+    };
+    walk(input['root'], 'spec.root', 0);
+    if (errors.length > 0)
+        return { ok: false, errors };
+    return { ok: true, spec: input };
+}
+//# sourceMappingURL=spec.js.map

package/dist/spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spec.js","sourceRoot":"","sources":["../src/spec.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAoB,MAAM,YAAY,CAAC;AAqD9C,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,SAAS,YAAY,CAAC,CAAS,EAAE,CAAS;IACxC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACnB,MAAM,GAAG,GAAa,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACjE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QACnB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;YACpB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YACjF,IAAI,GAAG,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,OAA4B;IAC7D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,SAAS,CAAC,CAAC,kEAAkE;IAC1G,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,IAAwB,CAAC;IAC7B,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACxB,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC,GAAG,QAAQ,EAAE,CAAC;YAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,IAAI,GAAG,EAAE,CAAC;QAAC,CAAC;IAChD,CAAC;IACD,OAAO,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACpE,CAAC;AAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,OAAO;IACP,SAAS;IACT,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;CACL,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAE7D,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,KAAK,CAAC,CAA0C;IACvD,OAAO,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAsB,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,CAAC,MAAe,EAAE,IAAY,EAAE,MAAgB;IACrE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACrB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,EACnE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,qCAAqC,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzD,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,2BAA2B,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,GAAG,0BAA0B,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,UAAU,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,QAAQ,OAAO,KAAK,EAAE,CAAC;QACrB,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,IAAI,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,KAAK,QAAQ;YACX,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC9E,IAAI,aAAa,CAAC,KAAK,CAAC;gBACtB,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YACrE,OAAO,KAAK,CAAC;QACf;YACE,OAAO,KAAK,CAAC;IACjB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAc,EACd,IAAqB;IAErB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC;IAEpD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,wBAAwB,CAAC,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,4BAA4B,CAAC,EAAE,CAAC;IAC/D,CAAC;IAED,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,IAAY,EAAE,KAAa,EAAQ,EAAE;QAChE,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,uBAAuB,QAAQ,EAAE,CAAC,CAAC;YACtD,OAAO;QACT,CAAC;QACD,IAAI,EAAE,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,gCAAgC,QAAQ,EAAE,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;YAC/C,OAAO;QACT,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,yBAAyB,CAAC,CAAC;QAChD,CAAC;aAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAW,CAAC;YACxC,MAAM,UAAU,GAAG,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,kBAAkB,UAAU,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,SAAS,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,wBAAwB,QAAQ,KAAK,IAAI,IAAI;gBAClD,kBAAkB,SAAS,KAAK;gBAChC,uCAAuC,CAC1C,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBAChE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,4CAA4C,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;YAC1B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,0BAA0B,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;gBAClE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACpC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,SAAS,GAAG,sDAAsD,CAAC,CAAC;oBACzF,CAAC;gBACH,CAAC;gBACD,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS;oBAAE,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,aAAa,EAAE,MAAM,CAAC,CAAC;gBAC7F,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACzE,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,iCAAiC,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC5E,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,mCAAmC,CAAC,CAAC;gBAC1D,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC5B,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,GAAG,GAAG,IAAI,YAAY,IAAI,EAAE,CAAC;oBACpC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;wBACvC,SAAS;oBACX,CAAC;oBACD,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACpC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;oBAC7C,CAAC;yBAAM,IAAI,YAAY,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;wBAC1D,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;oBAC9D,CAAC;oBACD,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3F,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;oBAC/D,CAAC;oBACD,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,SAAS,EAAE,CAAC;wBACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;oBAChD,CAAC;oBACD,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,CAAC;wBACjF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;oBACrD,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,SAAS,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBACrC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;YAC3F,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACpD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAA4B,EAAE,CAAC;AAC1D,CAAC"}

package/dist/tool-names.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared MCP tool / resource names for the TOON apps surface.
+ *
+ * Node-safe (no React) so both the iframe runtime and the server can import them
+ * and stay in lockstep.
+ */
+/** Resolves a NIP-01 filter to events (free read). */
+export declare const QUERY_TOOL = "toon_query";
+/** Returns the atom catalog so the agent can compose valid ViewSpecs. */
+export declare const ATOMS_TOOL = "toon_atoms";
+/** Accepts an agent-authored ViewSpec; carries `_meta.ui.resourceUri`. */
+export declare const RENDER_TOOL = "toon_render";
+/** Pay-to-write: daemon signs + publishes the supplied event shell. */
+export declare const PUBLISH_TOOL = "toon_publish_unsigned";
+/** Spendy: upload media to Arweave then publish a referencing event. */
+export declare const UPLOAD_TOOL = "toon_upload_media";
+/** Pre-open a payment channel (daemon signs/settles; UI never holds keys). */
+export declare const OPEN_CHANNEL_TOOL = "toon_open_channel";
+/** Spendy: run a cross-asset swap; daemon signs the source claim, returns a target claim. */
+export declare const SWAP_TOOL = "toon_swap";
+/** Read-only: report the current pay-to-write fee + settlement chain (no payment). */
+export declare const STATUS_TOOL = "toon_status";
+/** The single MCP-app UI resource the host renders. */
+export declare const APP_RESOURCE_URI = "ui://toon/app";
+/** Write tools the runtime/validator permit an action to target. */
+export declare const WRITE_TOOLS: ReadonlySet<string>;
+//# sourceMappingURL=tool-names.d.ts.map

package/dist/tool-names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.d.ts","sourceRoot":"","sources":["../src/tool-names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,yEAAyE;AACzE,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,0EAA0E;AAC1E,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,YAAY,0BAA0B,CAAC;AACpD,wEAAwE;AACxE,eAAO,MAAM,WAAW,sBAAsB,CAAC;AAC/C,8EAA8E;AAC9E,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,6FAA6F;AAC7F,eAAO,MAAM,SAAS,cAAc,CAAC;AACrC,sFAAsF;AACtF,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,kBAAkB,CAAC;AAEhD,oEAAoE;AACpE,eAAO,MAAM,WAAW,EAAE,WAAW,CAAC,MAAM,CAK1C,CAAC"}

package/dist/tool-names.js

@@ -0,0 +1,32 @@
+/**
+ * Shared MCP tool / resource names for the TOON apps surface.
+ *
+ * Node-safe (no React) so both the iframe runtime and the server can import them
+ * and stay in lockstep.
+ */
+/** Resolves a NIP-01 filter to events (free read). */
+export const QUERY_TOOL = 'toon_query';
+/** Returns the atom catalog so the agent can compose valid ViewSpecs. */
+export const ATOMS_TOOL = 'toon_atoms';
+/** Accepts an agent-authored ViewSpec; carries `_meta.ui.resourceUri`. */
+export const RENDER_TOOL = 'toon_render';
+/** Pay-to-write: daemon signs + publishes the supplied event shell. */
+export const PUBLISH_TOOL = 'toon_publish_unsigned';
+/** Spendy: upload media to Arweave then publish a referencing event. */
+export const UPLOAD_TOOL = 'toon_upload_media';
+/** Pre-open a payment channel (daemon signs/settles; UI never holds keys). */
+export const OPEN_CHANNEL_TOOL = 'toon_open_channel';
+/** Spendy: run a cross-asset swap; daemon signs the source claim, returns a target claim. */
+export const SWAP_TOOL = 'toon_swap';
+/** Read-only: report the current pay-to-write fee + settlement chain (no payment). */
+export const STATUS_TOOL = 'toon_status';
+/** The single MCP-app UI resource the host renders. */
+export const APP_RESOURCE_URI = 'ui://toon/app';
+/** Write tools the runtime/validator permit an action to target. */
+export const WRITE_TOOLS = new Set([
+    PUBLISH_TOOL,
+    UPLOAD_TOOL,
+    OPEN_CHANNEL_TOOL,
+    SWAP_TOOL,
+]);
+//# sourceMappingURL=tool-names.js.map

package/dist/tool-names.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-names.js","sourceRoot":"","sources":["../src/tool-names.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,sDAAsD;AACtD,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC,yEAAyE;AACzE,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC;AACvC,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AACpD,wEAAwE;AACxE,MAAM,CAAC,MAAM,WAAW,GAAG,mBAAmB,CAAC;AAC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AACrD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AACrC,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AAEzC,uDAAuD;AACvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAEhD,oEAAoE;AACpE,MAAM,CAAC,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC;IACtD,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Shared Nostr primitives for the views layer.
+ *
+ * These are intentionally self-contained (no `nostr-tools` / `@toon-protocol/core`
+ * import) so the package builds in a browser bundle and stays decoupled from the
+ * payment-side packages.
+ */
+/** A signed Nostr event as seen on a relay (read side). */
+export interface NostrEvent {
+    id: string;
+    pubkey: string;
+    created_at: number;
+    kind: number;
+    tags: string[][];
+    content: string;
+    sig: string;
+}
+/**
+ * A Nostr subscription filter (NIP-01). Tag filters use the `#<letter>` form.
+ * Kept permissive: any `#x` single-letter tag filter is allowed.
+ */
+export interface NostrFilter {
+    kinds?: number[];
+    authors?: string[];
+    ids?: string[];
+    since?: number;
+    until?: number;
+    limit?: number;
+    '#d'?: string[];
+    '#e'?: string[];
+    '#a'?: string[];
+    '#p'?: string[];
+    '#t'?: string[];
+}
+/** Get the first value for a tag name. */
+export declare function getTagValue(tags: string[][], name: string): string | undefined;
+/** Get all values for a tag name. */
+export declare function getTagValues(tags: string[][], name: string): string[];
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB;AAED,0CAA0C;AAC1C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED,qCAAqC;AACrC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAKrE"}

package/dist/types.js

@@ -0,0 +1,20 @@
+/**
+ * Shared Nostr primitives for the views layer.
+ *
+ * These are intentionally self-contained (no `nostr-tools` / `@toon-protocol/core`
+ * import) so the package builds in a browser bundle and stays decoupled from the
+ * payment-side packages.
+ */
+/** Get the first value for a tag name. */
+export function getTagValue(tags, name) {
+    const tag = tags.find((t) => t[0] === name);
+    return tag?.[1];
+}
+/** Get all values for a tag name. */
+export function getTagValues(tags, name) {
+    return tags
+        .filter((t) => t[0] === name)
+        .map((t) => t[1])
+        .filter((v) => v !== undefined);
+}
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+BH,0CAA0C;AAC1C,MAAM,UAAU,WAAW,CAAC,IAAgB,EAAE,IAAY;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC5C,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,qCAAqC;AACrC,MAAM,UAAU,YAAY,CAAC,IAAgB,EAAE,IAAY;IACzD,OAAO,IAAI;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAChB,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;AACjD,CAAC"}

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@toon-protocol/views",
+  "version": "0.2.0",
+  "description": "Shared TOON kind→atom registry, NIP parsers, ViewSpec composition runtime, and MCP-app iframe bundle. Consumed by rig and the toon-mcp apps surface.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist"
+  ],
+  "bin": {
+    "toon-apps": "./dist/server/daemon-main.js",
+    "toon-apps-fake": "./dist/server/fake-main.js"
+  },
+  "dependencies": {
+    "@fontsource-variable/geist": "^5.2.9",
+    "@mcp-ui/client": "^7.1.1",
+    "@modelcontextprotocol/ext-apps": "^1.7.4",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "class-variance-authority": "^0.7.1",
+    "clsx": "^2.1.1",
+    "lucide-react": "^1.7.0",
+    "radix-ui": "^1.4.3",
+    "shadcn": "^4.11.0",
+    "tailwind-merge": "^2.6.1",
+    "tw-animate-css": "^1.4.0",
+    "zod": "^3.25.0",
+    "@toon-protocol/client": "0.14.0"
+  },
+  "peerDependencies": {
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0"
+  },
+  "devDependencies": {
+    "@tailwindcss/vite": "^4.0.0",
+    "@testing-library/react": "^16.0.0",
+    "@types/react": "^19.0.0",
+    "@types/react-dom": "^19.0.0",
+    "@vitejs/plugin-react": "^4.0.0",
+    "jsdom": "^24.0.0",
+    "react": "^19.0.0",
+    "react-dom": "^19.0.0",
+    "tailwindcss": "^4.0.0",
+    "typescript": "^5.3.0",
+    "vite": "^5.0.0",
+    "vite-plugin-singlefile": "^2.3.3",
+    "vitest": "^1.0.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json && vite build",
+    "build:lib": "tsc -p tsconfig.build.json",
+    "build:app": "vite build",
+    "demo:apps": "node dist/server/fake-main.js",
+    "demo:apps:daemon": "node dist/server/daemon-main.js",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}