mountly-mcp 3.1.0 → 4.0.1

package/templates/vue/package.json.tmpl

@@ -0,0 +1,26 @@
+{
+  "name": "{{name}}",
+  "version": "0.0.1",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "build": "vite build",
+    "dev": "mountly-mcp dev --server ./server.mjs",
+    "verify": "mountly-mcp verify",
+    "verify:strict": "mountly-mcp verify --strict",
+    "typecheck": "vue-tsc --noEmit"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
+    "mountly-mcp": "^{{mcpVersion}}",
+    "mountly-vue": "^2.0.3",
+    "vue": "^3.5.41",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@vitejs/plugin-vue": "^6.0.8",
+    "typescript": "^5.9.0",
+    "vite": "^8.2.1",
+    "vue-tsc": "^2.2.0"
+  }
+}

package/templates/vue/server.mjs.tmpl

@@ -0,0 +1,70 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { readMcpAppManifest } from "mountly-mcp/artifact";
+import { registerMcpApps } from "mountly-mcp/server";
+import { z } from "zod";
+
+const URI = "{{uri}}";
+
+function sampleCards() {
+  return [
+    { label: "Requests", value: Math.floor(1200 + Math.random() * 200) },
+    { label: "Latency", value: `${Math.floor(30 + Math.random() * 20)} ms` },
+    { label: "Uptime", value: "99.9%" },
+  ];
+}
+
+/** Default export for `mountly-mcp dev --server ./server.mjs`. */
+export default async function createServer() {
+  const server = new McpServer(
+    { name: "{{slug}}", version: "0.0.1" },
+    { capabilities: { tools: {}, resources: {} } },
+  );
+
+  const { artifacts } = await readMcpAppManifest("dist/mountly-mcp.manifest.json");
+
+  await registerMcpApps(server, {
+    views: artifacts.map((artifact) => ({ artifact })),
+    tools: [
+      {
+        name: "showDashboard",
+        resourceUri: URI,
+        config: {
+          description: "Show an interactive metrics dashboard",
+          inputSchema: {
+            topic: z.string().describe("Dashboard topic"),
+          },
+        },
+        handler: async ({ topic }) => ({
+          structuredContent: {
+            topic,
+            cards: [
+              { label: "Requests", value: 1284 },
+              { label: "Latency", value: "42 ms" },
+              { label: "Uptime", value: "99.9%" },
+            ],
+          },
+        }),
+      },
+      {
+        name: "refreshDashboard",
+        resourceUri: URI,
+        visibility: ["app"],
+        config: {
+          description: "Refresh dashboard metrics (app-only)",
+          inputSchema: {
+            reason: z.string().optional(),
+          },
+        },
+        handler: async ({ reason }) => ({
+          structuredContent: {
+            refreshedAt: new Date().toISOString(),
+            cards: sampleCards(),
+            reason: reason ?? null,
+          },
+        }),
+      },
+    ],
+  });
+
+  return server;
+}

package/templates/vue/src/Dashboard.vue.tmpl

@@ -0,0 +1,159 @@
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useMcpApp, useToolResult } from "mountly-mcp/vue";
+
+interface DashboardCard {
+  label: string;
+  value: string | number;
+}
+
+interface DashboardData {
+  topic?: string;
+  refreshedAt?: string;
+  cards?: DashboardCard[];
+}
+
+interface DashboardResult {
+  structuredContent?: DashboardData;
+}
+
+const mcp = useMcpApp();
+const result = useToolResult<DashboardResult>();
+const data = ref<DashboardData | undefined>();
+const busy = ref(false);
+const status = ref("Connected.");
+
+watch(
+  result,
+  (value) => {
+    if (value?.structuredContent) data.value = value.structuredContent;
+  },
+  { immediate: true },
+);
+
+const cards = computed(() => data.value?.cards ?? []);
+const title = computed(() =>
+  data.value?.topic ? `${data.value.topic} Dashboard` : "Dashboard",
+);
+
+async function refresh() {
+  busy.value = true;
+  status.value = "Refreshing…";
+  try {
+    const next = (await mcp.callServerTool({
+      name: "refreshDashboard",
+      arguments: { reason: "User clicked refresh" },
+    })) as DashboardResult;
+    const content = next.structuredContent;
+    if (content) {
+      data.value = {
+        ...data.value,
+        ...content,
+        topic: content.topic ?? data.value?.topic,
+      };
+    }
+    status.value = content?.refreshedAt
+      ? `Refreshed ${new Date(content.refreshedAt).toLocaleTimeString()}`
+      : "Refreshed.";
+  } catch (error) {
+    status.value = error instanceof Error ? error.message : "Refresh failed.";
+  } finally {
+    busy.value = false;
+  }
+}
+</script>
+
+<template>
+  <div class="card">
+    <p class="eyebrow">MCP App · Mountly</p>
+    <h1>{{ title }}</h1>
+    <p class="subtitle">
+      Built with <code>mountly-mcp</code> — try Refresh to call an app-only tool.
+    </p>
+    <div class="grid">
+      <div v-if="cards.length === 0" v-for="i in 3" :key="i" class="metric">
+        <div class="label">—</div>
+        <div class="value">—</div>
+      </div>
+      <div v-for="c in cards" :key="c.label" class="metric">
+        <div class="label">{{ c.label }}</div>
+        <div class="value">{{ c.value }}</div>
+      </div>
+    </div>
+    <div class="row">
+      <button type="button" :disabled="busy" @click="refresh">Refresh data</button>
+      <span class="status">{{ status }}</span>
+    </div>
+  </div>
+</template>
+
+<style scoped>
+.card {
+  border: 1px solid var(--color-border-primary, #e5e5e5);
+  border-radius: 12px;
+  padding: 20px;
+  background: var(--color-background-secondary, #fafafa);
+}
+.eyebrow {
+  margin: 0 0 8px;
+  color: var(--color-text-secondary, #737373);
+  font-size: 11px;
+  text-transform: uppercase;
+  letter-spacing: 0.1em;
+}
+h1 {
+  margin: 0 0 4px;
+  font-size: 20px;
+  font-weight: 600;
+}
+.subtitle {
+  color: var(--color-text-secondary, #737373);
+  font-size: 14px;
+  margin: 0 0 16px;
+}
+.grid {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 10px;
+  margin-bottom: 16px;
+}
+.metric {
+  border: 1px solid var(--color-border-primary, #e5e5e5);
+  border-radius: 8px;
+  padding: 12px;
+  background: var(--color-background-primary, #ffffff);
+}
+.label {
+  color: var(--color-text-secondary, #737373);
+  font-size: 11px;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+}
+.value {
+  margin-top: 4px;
+  font-size: 22px;
+  font-weight: 600;
+}
+.row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+}
+button {
+  border: 1px solid var(--color-border-primary, #e5e5e5);
+  border-radius: 8px;
+  padding: 8px 14px;
+  background: var(--color-background-primary, #ffffff);
+  color: inherit;
+  cursor: pointer;
+  font-size: 13px;
+}
+button:disabled {
+  opacity: 0.6;
+  cursor: wait;
+}
+.status {
+  font-size: 12px;
+  color: var(--color-text-secondary, #737373);
+}
+</style>

package/templates/vue/src/view.ts.tmpl

@@ -0,0 +1,14 @@
+import { createMcpView } from "mountly-mcp/vue";
+import Dashboard from "./Dashboard.vue";
+
+const styles = `
+:root {
+  color-scheme: light dark;
+  font-family: system-ui, -apple-system, sans-serif;
+  background: var(--color-background-primary, #ffffff);
+  color: var(--color-text-primary, #171717);
+}
+body { margin: 0; padding: 20px; }
+`;
+
+createMcpView(Dashboard, { shadow: true, styles });

package/templates/vue/tsconfig.json.tmpl

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": ["ES2022", "DOM", "DOM.Iterable"],
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "skipLibCheck": true,
+    "noEmit": true,
+    "isolatedModules": true,
+    "resolveJsonModule": true,
+    "jsx": "preserve"
+  },
+  "include": ["src/**/*.ts", "src/**/*.vue"]
+}

package/templates/vue/vite.config.ts.tmpl

@@ -0,0 +1,22 @@
+import { defineConfig } from "vite";
+import vue from "@vitejs/plugin-vue";
+import { mountlyMcpViews } from "mountly-mcp/vite";
+
+export default defineConfig({
+  plugins: [
+    vue(),
+    mountlyMcpViews({
+      apps: [
+        {
+          entry: "src/view.ts",
+          uri: "{{uri}}",
+          name: "dashboard",
+          description: "Interactive metrics dashboard",
+          displayModes: ["inline", "fullscreen"],
+          prefersBorder: true,
+          awaitToolResult: true,
+        },
+      ],
+    }),
+  ],
+});

package/dist/chunk-4WAKOYMK.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/build/index.ts","../src/build/emit-html.ts","../src/build/emit-meta.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { fileURLToPath } from \"node:url\";\nimport { resolve } from \"node:path\";\nimport type {\n  McpUiDisplayMode,\n  McpUiResourceCsp,\n  McpUiResourcePermissions,\n} from \"@modelcontextprotocol/ext-apps\";\nimport type { McpResourceDeclaration } from \"../types.js\";\nimport type { McpAppArtifact } from \"../artifact/index.js\";\nimport { emitHtml } from \"./emit-html.js\";\nimport { emitMeta } from \"./emit-meta.js\";\n\n/**\n * Absolute path to the iframe bridge runtime shipped with this package.\n *\n * `buildMcpResource` inlines this file's contents into the emitted HTML so\n * the widget can speak the MCP Apps postMessage protocol. Use this when you\n * need to point another build tool at the runtime, or when you want a\n * stable, version-pinned alternative to passing `bridgeRuntimePath` yourself.\n *\n * Resolves relative to the installed package, so it works identically in\n * monorepos and in projects that installed mountly-mcp from npm.\n */\nexport function getBridgeRuntimePath(): string {\n  // Ask the module resolver rather than walking up from __dirname: the subpath\n  // is a declared export, so this holds wherever a bundler puts this file.\n  return fileURLToPath(import.meta.resolve(\"mountly-mcp/bridge/iframe-entry.js\"));\n}\n\nfunction defaultBridgeRuntimePath(): string {\n  return getBridgeRuntimePath();\n}\n\nexport interface BuildSelfContainedOptions {\n  entry: string;\n  uri: string;\n  name: string;\n  output: string;\n  description?: string;\n  awaitToolResult?: boolean;\n  displayModes?: ReadonlyArray<McpUiDisplayMode>;\n  /**\n   * Render progressive states from `ui/notifications/tool-input-partial`.\n   * Off by default — see `RunBridgeOptions.streamToolInput`.\n   */\n  streamToolInput?: boolean;\n  csp?: McpUiResourceCsp;\n  /** Sandbox permissions requested by the view (camera/microphone/geolocation/clipboardWrite). */\n  permissions?: McpUiResourcePermissions;\n  /** Dedicated sandbox origin (host-dependent format). */\n  domain?: string;\n  /** Whether the view requests the host to show a visible border + background. */\n  prefersBorder?: boolean;\n  cssEntry?: string;\n  bridgeRuntimePath?: string;\n}\n\nexport interface BuildCdnOptions extends BuildSelfContainedOptions {\n  cdn: { jsUrl: string; cssUrl: string };\n}\n\nexport type BuildOptions = BuildSelfContainedOptions | BuildCdnOptions;\n\nexport interface BuildResult {\n  htmlPath: string;\n  metaPath: string;\n  declaration: McpResourceDeclaration;\n  artifact: McpAppArtifact;\n}\n\nexport interface BuildFromSourceOptions extends Omit<\n  BuildSelfContainedOptions,\n  \"entry\" | \"cssEntry\"\n> {\n  /** The bundled widget JS. */\n  js: string;\n  /** The widget's CSS, if it has any. */\n  css?: string;\n}\n\n/**\n * Same as {@link buildMcpResource}, but taking the bundle in memory instead of\n * from disk — for bundler plugins that already hold the emitted sources and\n * shouldn't have to guess when they land on the filesystem.\n */\nexport async function buildMcpResourceFromSource(\n  options: BuildFromSourceOptions,\n): Promise<BuildResult> {\n  const { js, css, ...rest } = options;\n  return writeResource({ ...rest, mode: \"self-contained\", js, css: css ?? \"\" });\n}\n\nexport async function buildMcpResource(options: BuildOptions): Promise<BuildResult> {\n  if (!(\"cdn\" in options)) {\n    const js = await readFile(options.entry, \"utf8\");\n    const css = options.cssEntry ? await readFile(options.cssEntry, \"utf8\") : \"\";\n    return writeResource({ ...options, mode: \"self-contained\", js, css });\n  }\n  return writeResource({ ...options, mode: \"cdn\" });\n}\n\ntype ResourceMeta = Omit<BuildSelfContainedOptions, \"entry\" | \"cssEntry\">;\n\ntype WriteResourceOptions =\n  | (ResourceMeta & { mode: \"self-contained\"; js: string; css: string })\n  | (ResourceMeta & { mode: \"cdn\"; cdn: BuildCdnOptions[\"cdn\"] });\n\nasync function writeResource(options: WriteResourceOptions): Promise<BuildResult> {\n  const bridgeRuntimeJs = await readFile(\n    options.bridgeRuntimePath ?? defaultBridgeRuntimePath(),\n    \"utf8\",\n  );\n\n  const declaration = emitMeta({\n    uri: options.uri,\n    name: options.name,\n    description: options.description,\n    awaitToolResult: options.awaitToolResult,\n    displayModes: options.displayModes,\n    csp: options.mode === \"cdn\" ? mergeCdnIntoCsp(options.csp, options.cdn) : options.csp,\n    permissions: options.permissions,\n    domain: options.domain,\n    prefersBorder: options.prefersBorder,\n  });\n\n  // Same values the sidecar declares, so the view's `ui/initialize` matches it.\n  const config = {\n    awaitToolResult: declaration.awaitToolResult,\n    displayModes: declaration.displayModes,\n    streamToolInput: options.streamToolInput ?? false,\n  };\n\n  const html =\n    options.mode === \"cdn\"\n      ? emitHtml({\n          mode: \"cdn\",\n          uri: options.uri,\n          jsUrl: options.cdn.jsUrl,\n          cssUrl: options.cdn.cssUrl,\n          bridgeRuntimeJs,\n          config,\n        })\n      : emitHtml({\n          mode: \"self-contained\",\n          uri: options.uri,\n          js: options.js,\n          css: options.css,\n          bridgeRuntimeJs,\n          config,\n        });\n\n  const metaPath = `${options.output}.meta.json`;\n  await writeFile(options.output, html, \"utf8\");\n  await writeFile(metaPath, JSON.stringify(declaration, null, 2), \"utf8\");\n\n  const htmlPath = resolve(options.output);\n  return {\n    htmlPath,\n    metaPath: resolve(metaPath),\n    declaration,\n    artifact: {\n      name: declaration.name,\n      uri: declaration.uri,\n      htmlPath,\n      metaPath: resolve(metaPath),\n      declaration,\n    },\n  };\n}\n\nfunction mergeCdnIntoCsp(\n  csp: McpUiResourceCsp | undefined,\n  cdn: { jsUrl: string; cssUrl: string },\n): McpUiResourceCsp {\n  const jsOrigin = new URL(cdn.jsUrl).origin;\n  const cssOrigin = new URL(cdn.cssUrl).origin;\n  const merged: McpUiResourceCsp = { ...(csp ?? {}) };\n  const existing = new Set(merged.resourceDomains ?? []);\n  existing.add(jsOrigin);\n  existing.add(cssOrigin);\n  merged.resourceDomains = Array.from(existing);\n  return merged;\n}\n\nexport { emitHtml } from \"./emit-html.js\";\nexport { emitMeta } from \"./emit-meta.js\";\n","import { MCP_APPS_PROTOCOL_VERSION } from \"../schema.js\";\nimport type { McpUiDisplayMode } from \"@modelcontextprotocol/ext-apps\";\nimport { escapeInlineScript, serializeInlineScriptValue } from \"../html.js\";\n\n/**\n * Runtime config the emitted HTML hands to the inlined bridge\n * (`bridge/iframe-entry.ts` reads these off `globalThis`). Without it the view\n * falls back to `awaitToolResult: true` / `availableDisplayModes: [\"inline\"]`,\n * regardless of what the build declared in the sidecar.\n */\nexport interface EmitHtmlConfig {\n  awaitToolResult?: boolean;\n  displayModes?: ReadonlyArray<McpUiDisplayMode>;\n  streamToolInput?: boolean;\n}\n\nexport interface EmitHtmlSelfContainedInput {\n  mode: \"self-contained\";\n  uri: string;\n  js: string;\n  css: string;\n  bridgeRuntimeJs: string;\n  config?: EmitHtmlConfig;\n}\n\nexport interface EmitHtmlCdnInput {\n  mode: \"cdn\";\n  uri: string;\n  jsUrl: string;\n  cssUrl: string;\n  bridgeRuntimeJs: string;\n  config?: EmitHtmlConfig;\n}\n\nexport type EmitHtmlInput = EmitHtmlSelfContainedInput | EmitHtmlCdnInput;\n\nfunction escapeAttr(value: string): string {\n  return value\n    .replace(/&/g, \"&amp;\")\n    .replace(/\"/g, \"&quot;\")\n    .replace(/</g, \"&lt;\")\n    .replace(/>/g, \"&gt;\");\n}\n\nfunction escapeStyle(value: string): string {\n  return value.replace(/<\\/style/gi, \"<\\\\/style\");\n}\n\n/**\n * Classic (non-module) script so it runs at parse time — before the deferred\n * module scripts that boot the bridge.\n */\nfunction configScript(config: EmitHtmlConfig | undefined): string[] {\n  if (!config) return [];\n  const assignments: string[] = [];\n  if (config.awaitToolResult !== undefined) {\n    assignments.push(\n      `globalThis.__mountlyMcpAwaitToolResult__=${serializeInlineScriptValue(config.awaitToolResult)};`,\n    );\n  }\n  if (config.displayModes !== undefined) {\n    assignments.push(\n      `globalThis.__mountlyMcpAvailableDisplayModes__=${serializeInlineScriptValue(config.displayModes)};`,\n    );\n  }\n  if (config.streamToolInput !== undefined) {\n    assignments.push(\n      `globalThis.__mountlyMcpStreamToolInput__=${serializeInlineScriptValue(config.streamToolInput)};`,\n    );\n  }\n  if (assignments.length === 0) return [];\n  return [`<script>${assignments.join(\"\")}</script>`];\n}\n\nexport function emitHtml(input: EmitHtmlInput): string {\n  const head = [\n    `<meta charset=\"utf-8\">`,\n    `<meta name=\"mountly-mcp-protocol\" content=\"${MCP_APPS_PROTOCOL_VERSION}\">`,\n    `<meta name=\"mountly-mcp-uri\" content=\"${escapeAttr(input.uri)}\">`,\n  ];\n\n  if (input.mode === \"self-contained\") {\n    head.push(`<style>${escapeStyle(input.css)}</style>`);\n    const body = [\n      `<div id=\"mountly-mcp-root\"></div>`,\n      ...configScript(input.config),\n      `<script type=\"module\">${escapeInlineScript(input.js)}\\n${escapeInlineScript(input.bridgeRuntimeJs)}</script>`,\n    ];\n    return template(head, body);\n  }\n\n  head.push(`<link rel=\"stylesheet\" href=\"${escapeAttr(input.cssUrl)}\">`);\n  // The widget bundle MUST load before the bridge: module scripts execute in\n  // document order, and the bridge reads `__mountlyMcpWidget__` synchronously.\n  const body = [\n    `<div id=\"mountly-mcp-root\"></div>`,\n    ...configScript(input.config),\n    `<script type=\"module\" src=\"${escapeAttr(input.jsUrl)}\"></script>`,\n    `<script type=\"module\">${escapeInlineScript(input.bridgeRuntimeJs)}</script>`,\n  ];\n  return template(head, body);\n}\n\nfunction template(head: string[], body: string[]): string {\n  return `<!doctype html>\n<html data-mountly-mcp>\n<head>\n${head.join(\"\\n\")}\n</head>\n<body>\n${body.join(\"\\n\")}\n</body>\n</html>`;\n}\n","import { MCP_APPS_MIME, MCP_APPS_PROTOCOL_VERSION } from \"../schema.js\";\nimport type {\n  McpUiDisplayMode,\n  McpUiResourceCsp,\n  McpUiResourcePermissions,\n} from \"@modelcontextprotocol/ext-apps\";\nimport type { McpResourceDeclaration } from \"../types.js\";\n\nexport interface EmitMetaInput {\n  uri: string;\n  name: string;\n  description?: string;\n  awaitToolResult?: boolean;\n  displayModes?: ReadonlyArray<McpUiDisplayMode>;\n  csp?: McpUiResourceCsp;\n  /** Sandbox permissions requested by the view (camera/microphone/geolocation/clipboardWrite). */\n  permissions?: McpUiResourcePermissions;\n  /** Dedicated sandbox origin requested by the view (host-dependent format). */\n  domain?: string;\n  /** Whether the view requests the host to show a visible border + background. */\n  prefersBorder?: boolean;\n}\n\nfunction assertUiUri(uri: string): void {\n  if (!uri.startsWith(\"ui://\")) {\n    throw new Error(`mountly-mcp: UI resource uri must use the 'ui://' scheme (received '${uri}')`);\n  }\n}\n\nexport function emitMeta(input: EmitMetaInput): McpResourceDeclaration {\n  assertUiUri(input.uri);\n\n  const ui: McpResourceDeclaration[\"_meta\"][\"ui\"] = {};\n  if (input.csp) ui.csp = input.csp;\n  if (input.permissions) ui.permissions = input.permissions;\n  if (input.domain !== undefined) ui.domain = input.domain;\n  if (input.prefersBorder !== undefined) ui.prefersBorder = input.prefersBorder;\n\n  const decl: McpResourceDeclaration = {\n    protocolVersion: MCP_APPS_PROTOCOL_VERSION,\n    uri: input.uri,\n    name: input.name,\n    mimeType: MCP_APPS_MIME,\n    awaitToolResult: input.awaitToolResult ?? true,\n    displayModes: input.displayModes ?? [\"inline\"],\n    _meta: { ui },\n  };\n  if (input.description !== undefined) decl.description = input.description;\n  return decl;\n}\n"],"mappings":";;;;;;;;;;AAAA,SAAS,UAAU,iBAAiB;AACpC,SAAS,qBAAqB;AAC9B,SAAS,eAAe;;;ACkCxB,SAAS,WAAW,OAAuB;AACzC,SAAO,MACJ,QAAQ,MAAM,OAAO,EACrB,QAAQ,MAAM,QAAQ,EACtB,QAAQ,MAAM,MAAM,EACpB,QAAQ,MAAM,MAAM;AACzB;AAEA,SAAS,YAAY,OAAuB;AAC1C,SAAO,MAAM,QAAQ,cAAc,WAAW;AAChD;AAMA,SAAS,aAAa,QAA8C;AAClE,MAAI,CAAC,OAAQ,QAAO,CAAC;AACrB,QAAM,cAAwB,CAAC;AAC/B,MAAI,OAAO,oBAAoB,QAAW;AACxC,gBAAY;AAAA,MACV,4CAA4C,2BAA2B,OAAO,eAAe,CAAC;AAAA,IAChG;AAAA,EACF;AACA,MAAI,OAAO,iBAAiB,QAAW;AACrC,gBAAY;AAAA,MACV,kDAAkD,2BAA2B,OAAO,YAAY,CAAC;AAAA,IACnG;AAAA,EACF;AACA,MAAI,OAAO,oBAAoB,QAAW;AACxC,gBAAY;AAAA,MACV,4CAA4C,2BAA2B,OAAO,eAAe,CAAC;AAAA,IAChG;AAAA,EACF;AACA,MAAI,YAAY,WAAW,EAAG,QAAO,CAAC;AACtC,SAAO,CAAC,WAAW,YAAY,KAAK,EAAE,CAAC,WAAW;AACpD;AAEO,SAAS,SAAS,OAA8B;AACrD,QAAM,OAAO;AAAA,IACX;AAAA,IACA,8CAA8C,uBAAyB;AAAA,IACvE,yCAAyC,WAAW,MAAM,GAAG,CAAC;AAAA,EAChE;AAEA,MAAI,MAAM,SAAS,kBAAkB;AACnC,SAAK,KAAK,UAAU,YAAY,MAAM,GAAG,CAAC,UAAU;AACpD,UAAMA,QAAO;AAAA,MACX;AAAA,MACA,GAAG,aAAa,MAAM,MAAM;AAAA,MAC5B,yBAAyB,mBAAmB,MAAM,EAAE,CAAC;AAAA,EAAK,mBAAmB,MAAM,eAAe,CAAC;AAAA,IACrG;AACA,WAAO,SAAS,MAAMA,KAAI;AAAA,EAC5B;AAEA,OAAK,KAAK,gCAAgC,WAAW,MAAM,MAAM,CAAC,IAAI;AAGtE,QAAM,OAAO;AAAA,IACX;AAAA,IACA,GAAG,aAAa,MAAM,MAAM;AAAA,IAC5B,8BAA8B,WAAW,MAAM,KAAK,CAAC;AAAA,IACrD,yBAAyB,mBAAmB,MAAM,eAAe,CAAC;AAAA,EACpE;AACA,SAAO,SAAS,MAAM,IAAI;AAC5B;AAEA,SAAS,SAAS,MAAgB,MAAwB;AACxD,SAAO;AAAA;AAAA;AAAA,EAGP,KAAK,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAGf,KAAK,KAAK,IAAI,CAAC;AAAA;AAAA;AAGjB;;;AC1FA,SAAS,YAAY,KAAmB;AACtC,MAAI,CAAC,IAAI,WAAW,OAAO,GAAG;AAC5B,UAAM,IAAI,MAAM,uEAAuE,GAAG,IAAI;AAAA,EAChG;AACF;AAEO,SAAS,SAAS,OAA8C;AACrE,cAAY,MAAM,GAAG;AAErB,QAAM,KAA4C,CAAC;AACnD,MAAI,MAAM,IAAK,IAAG,MAAM,MAAM;AAC9B,MAAI,MAAM,YAAa,IAAG,cAAc,MAAM;AAC9C,MAAI,MAAM,WAAW,OAAW,IAAG,SAAS,MAAM;AAClD,MAAI,MAAM,kBAAkB,OAAW,IAAG,gBAAgB,MAAM;AAEhE,QAAM,OAA+B;AAAA,IACnC,iBAAiB;AAAA,IACjB,KAAK,MAAM;AAAA,IACX,MAAM,MAAM;AAAA,IACZ,UAAU;AAAA,IACV,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,cAAc,MAAM,gBAAgB,CAAC,QAAQ;AAAA,IAC7C,OAAO,EAAE,GAAG;AAAA,EACd;AACA,MAAI,MAAM,gBAAgB,OAAW,MAAK,cAAc,MAAM;AAC9D,SAAO;AACT;;;AFzBO,SAAS,uBAA+B;AAG7C,SAAO,cAAc,YAAY,QAAQ,oCAAoC,CAAC;AAChF;AAEA,SAAS,2BAAmC;AAC1C,SAAO,qBAAqB;AAC9B;AAsDA,eAAsB,2BACpB,SACsB;AACtB,QAAM,EAAE,IAAI,KAAK,GAAG,KAAK,IAAI;AAC7B,SAAO,cAAc,EAAE,GAAG,MAAM,MAAM,kBAAkB,IAAI,KAAK,OAAO,GAAG,CAAC;AAC9E;AAEA,eAAsB,iBAAiB,SAA6C;AAClF,MAAI,EAAE,SAAS,UAAU;AACvB,UAAM,KAAK,MAAM,SAAS,QAAQ,OAAO,MAAM;AAC/C,UAAM,MAAM,QAAQ,WAAW,MAAM,SAAS,QAAQ,UAAU,MAAM,IAAI;AAC1E,WAAO,cAAc,EAAE,GAAG,SAAS,MAAM,kBAAkB,IAAI,IAAI,CAAC;AAAA,EACtE;AACA,SAAO,cAAc,EAAE,GAAG,SAAS,MAAM,MAAM,CAAC;AAClD;AAQA,eAAe,cAAc,SAAqD;AAChF,QAAM,kBAAkB,MAAM;AAAA,IAC5B,QAAQ,qBAAqB,yBAAyB;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,SAAS;AAAA,IAC3B,KAAK,QAAQ;AAAA,IACb,MAAM,QAAQ;AAAA,IACd,aAAa,QAAQ;AAAA,IACrB,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,IACtB,KAAK,QAAQ,SAAS,QAAQ,gBAAgB,QAAQ,KAAK,QAAQ,GAAG,IAAI,QAAQ;AAAA,IAClF,aAAa,QAAQ;AAAA,IACrB,QAAQ,QAAQ;AAAA,IAChB,eAAe,QAAQ;AAAA,EACzB,CAAC;AAGD,QAAM,SAAS;AAAA,IACb,iBAAiB,YAAY;AAAA,IAC7B,cAAc,YAAY;AAAA,IAC1B,iBAAiB,QAAQ,mBAAmB;AAAA,EAC9C;AAEA,QAAM,OACJ,QAAQ,SAAS,QACb,SAAS;AAAA,IACP,MAAM;AAAA,IACN,KAAK,QAAQ;AAAA,IACb,OAAO,QAAQ,IAAI;AAAA,IACnB,QAAQ,QAAQ,IAAI;AAAA,IACpB;AAAA,IACA;AAAA,EACF,CAAC,IACD,SAAS;AAAA,IACP,MAAM;AAAA,IACN,KAAK,QAAQ;AAAA,IACb,IAAI,QAAQ;AAAA,IACZ,KAAK,QAAQ;AAAA,IACb;AAAA,IACA;AAAA,EACF,CAAC;AAEP,QAAM,WAAW,GAAG,QAAQ,MAAM;AAClC,QAAM,UAAU,QAAQ,QAAQ,MAAM,MAAM;AAC5C,QAAM,UAAU,UAAU,KAAK,UAAU,aAAa,MAAM,CAAC,GAAG,MAAM;AAEtE,QAAM,WAAW,QAAQ,QAAQ,MAAM;AACvC,SAAO;AAAA,IACL;AAAA,IACA,UAAU,QAAQ,QAAQ;AAAA,IAC1B;AAAA,IACA,UAAU;AAAA,MACR,MAAM,YAAY;AAAA,MAClB,KAAK,YAAY;AAAA,MACjB;AAAA,MACA,UAAU,QAAQ,QAAQ;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,gBACP,KACA,KACkB;AAClB,QAAM,WAAW,IAAI,IAAI,IAAI,KAAK,EAAE;AACpC,QAAM,YAAY,IAAI,IAAI,IAAI,MAAM,EAAE;AACtC,QAAM,SAA2B,EAAE,GAAI,OAAO,CAAC,EAAG;AAClD,QAAM,WAAW,IAAI,IAAI,OAAO,mBAAmB,CAAC,CAAC;AACrD,WAAS,IAAI,QAAQ;AACrB,WAAS,IAAI,SAAS;AACtB,SAAO,kBAAkB,MAAM,KAAK,QAAQ;AAC5C,SAAO;AACT;","names":["body"]}

package/dist/chunk-KRAS266U.js

@@ -1,260 +0,0 @@
-import {
-  escapeInlineScript,
-  serializeInlineScriptValue
-} from "./chunk-YJA4H6IB.js";
-
-// src/dev/index.ts
-import { existsSync } from "fs";
-import { readFile } from "fs/promises";
-import { createServer } from "http";
-import { fileURLToPath } from "url";
-function escapeHtml(value) {
-  return value.replace(
-    /[&<>"']/g,
-    (character) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[character]
-  );
-}
-var runtimeCache = /* @__PURE__ */ new Map();
-function loadRuntime(name) {
-  const cached = runtimeCache.get(name);
-  if (cached) return cached;
-  const loading = (async () => {
-    try {
-      return await readFile(
-        fileURLToPath(import.meta.resolve(`mountly-mcp/dev/${name}.js`)),
-        "utf8"
-      );
-    } catch {
-    }
-    const entry = fileURLToPath(new URL(`./${name}.ts`, import.meta.url));
-    if (!existsSync(entry)) {
-      throw new Error(
-        `mountly-mcp dev: ${name} runtime missing. Expected the packaged 'mountly-mcp/dev/${name}.js' export, or ${entry} when running from source.`
-      );
-    }
-    const { build } = await import("vite");
-    const result = await build({
-      configFile: false,
-      logLevel: "silent",
-      build: {
-        write: false,
-        target: "es2022",
-        minify: false,
-        lib: { entry, formats: ["iife"], name: "__mountlyMcpDevRuntime" }
-      }
-    });
-    const outputs = Array.isArray(result) ? result : [result];
-    const chunk = outputs.flatMap((output) => "output" in output ? output.output : []).find((item) => item.type === "chunk");
-    if (!chunk || chunk.type !== "chunk")
-      throw new Error(`mountly-mcp dev: failed to bundle ${name}`);
-    return chunk.code;
-  })();
-  runtimeCache.set(name, loading);
-  return loading;
-}
-function listenOnFreePort(server, port) {
-  return new Promise((resolvePort, reject) => {
-    const attempt = (candidate) => {
-      const onError = (error) => {
-        server.removeListener("listening", onListening);
-        if (error.code === "EADDRINUSE" && candidate < port + 50) attempt(candidate + 1);
-        else reject(error);
-      };
-      const onListening = () => {
-        server.removeListener("error", onError);
-        const address = server.address();
-        resolvePort(typeof address === "object" && address !== null ? address.port : candidate);
-      };
-      server.once("error", onError);
-      server.once("listening", onListening);
-      server.listen(candidate);
-    };
-    attempt(port);
-  });
-}
-async function startDevHost(options) {
-  const { htmlPath, fixtures = {}, toolInput = {}, callTool } = options;
-  const metaPath = `${htmlPath}.meta.json`;
-  const initialMeta = JSON.parse(await readFile(metaPath, "utf8"));
-  const toolName = options.toolName ?? initialMeta.name;
-  const [hostRuntime, sandboxRuntime] = await Promise.all([
-    loadRuntime("host-entry"),
-    loadRuntime("sandbox-entry")
-  ]);
-  let version = 1;
-  let hostOrigin = "";
-  const sandboxServer = createServer((_req, res) => {
-    res.writeHead(200, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store" });
-    res.end(sandboxProxyShell(hostOrigin, sandboxRuntime));
-  });
-  const sandboxPort = await listenOnFreePort(
-    sandboxServer,
-    options.sandboxPort ?? (options.hostPort ?? 5179) + 1
-  );
-  const sandboxOrigin = `http://localhost:${sandboxPort}`;
-  const hostServer = createServer(async (req, res) => {
-    const path = new URL(req.url ?? "/", "http://localhost").pathname;
-    const send = (status, type, body) => {
-      res.writeHead(status, { "Content-Type": type, "Cache-Control": "no-store" });
-      res.end(body);
-    };
-    try {
-      if (path === "/call" && req.method === "POST") {
-        if (!callTool) return send(400, "text/plain", "no server connected");
-        const body = await new Promise((done, fail) => {
-          let raw = "";
-          req.on("data", (chunk) => raw += chunk);
-          req.on("end", () => done(raw));
-          req.on("error", fail);
-        });
-        const { name, arguments: args } = JSON.parse(body);
-        const result = await callTool(name, args).catch((error) => ({
-          isError: true,
-          content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }]
-        }));
-        return send(200, "application/json", JSON.stringify(result));
-      }
-      if (path === "/") return send(200, "text/html; charset=utf-8", hostPage());
-      if (path === "/host.js") return send(200, "text/javascript; charset=utf-8", hostRuntime);
-      if (path === "/version") return send(200, "application/json", String(version));
-      if (path === "/widget.html")
-        return send(200, "text/plain; charset=utf-8", await readFile(htmlPath, "utf8"));
-      if (path === "/widget.meta.json")
-        return send(200, "application/json", await readFile(metaPath, "utf8"));
-      send(404, "text/plain", "not found");
-    } catch (error) {
-      send(500, "text/plain", error instanceof Error ? error.message : String(error));
-    }
-  });
-  let hostPort;
-  try {
-    hostPort = await listenOnFreePort(hostServer, options.hostPort ?? 5179);
-  } catch (caught) {
-    await new Promise((done) => sandboxServer.close(() => done()));
-    throw caught;
-  }
-  hostOrigin = `http://localhost:${hostPort}`;
-  function hostPage() {
-    return devHostHtml({
-      toolName,
-      sandboxOrigin,
-      fixtures,
-      toolInput,
-      uri: initialMeta.uri,
-      hasServer: callTool !== void 0
-    });
-  }
-  return {
-    hostUrl: hostOrigin,
-    sandboxUrl: sandboxOrigin,
-    reload() {
-      version += 1;
-    },
-    async close() {
-      await Promise.all([
-        new Promise((done) => hostServer.close(() => done())),
-        new Promise((done) => sandboxServer.close(() => done()))
-      ]);
-    }
-  };
-}
-function devHostHtml(options) {
-  const { toolName, sandboxOrigin, fixtures, toolInput, uri, hasServer } = options;
-  const buttons = Object.keys(fixtures).map(
-    (name, index) => `<button class="btn" data-fixture="${escapeHtml(name)}"${index === 0 ? ' data-active="true"' : ""}>${escapeHtml(name)}</button>`
-  ).join("\n");
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<meta name="viewport" content="width=device-width,initial-scale=1">
-<title>mountly-mcp dev \xB7 ${escapeHtml(toolName)}</title>
-<style>
-  :root { color-scheme:light; --bg:#f6f7f9; --fg:#0b0c0f; --muted:#5c6675; --accent:#1d4ed8; --border:#dcdfe5; }
-  :root[data-theme="dark"] { color-scheme:dark; --bg:#0b0c0f; --fg:#e6e9ef; --muted:#9aa3b2; --accent:#7aa2ff; --border:#252a33; }
-  * { box-sizing:border-box; }
-  body { margin:0; min-height:100vh; background:var(--bg); color:var(--fg); font:14px/1.5 -apple-system,BlinkMacSystemFont,"Segoe UI",system-ui,sans-serif; }
-  header { padding:18px 24px; border-bottom:1px solid var(--border); display:flex; align-items:center; gap:12px; flex-wrap:wrap; }
-  header h1 { margin:0; font-size:16px; font-weight:600; }
-  header code { color:var(--muted); font-size:12px; }
-  #fixtures { display:flex; gap:8px; flex-wrap:wrap; }
-  .spacer { flex:1; }
-  .btn { appearance:none; border:1px solid var(--border); background:transparent; color:var(--fg); padding:6px 12px; border-radius:6px; font:inherit; cursor:pointer; }
-  .btn:hover { border-color:var(--accent); color:var(--accent); }
-  .btn[data-active="true"] { background:var(--accent); color:white; border-color:var(--accent); }
-  main { display:grid; grid-template-columns:minmax(420px,1fr) 360px; gap:20px; padding:24px; align-items:start; }
-  iframe { width:100%; height:460px; border:1px solid var(--border); border-radius:12px; background:white; }
-  .panel { border:1px solid var(--border); border-radius:12px; padding:16px; }
-  .panel + .panel { margin-top:12px; }
-  .panel h2 { margin:0 0 8px; font-size:13px; text-transform:uppercase; letter-spacing:.08em; color:var(--muted); }
-  pre { margin:0; padding:10px; border-radius:8px; font:12px/1.45 ui-monospace,Menlo,Consolas,monospace; overflow:auto; max-height:200px; }
-  .log { font:11px/1.5 ui-monospace,Menlo,Consolas,monospace; color:var(--muted); white-space:pre-wrap; max-height:280px; overflow:auto; }
-  @media (max-width:880px) { main { grid-template-columns:1fr; padding:16px; } }
-</style>
-</head>
-<body>
-<header>
-  <h1>${escapeHtml(toolName)}</h1>
-  <code>${escapeHtml(uri)}</code>
-  <span class="spacer"></span>
-  <div id="fixtures">${buttons}</div>
-  <button class="btn" id="theme" type="button">Theme</button>
-  <button class="btn" id="teardown" type="button">Teardown</button>
-</header>
-<main>
-  <iframe id="sandbox" sandbox="allow-scripts allow-same-origin" title="mountly-mcp sandbox proxy"></iframe>
-  <div>
-    <section class="panel">
-      <h2>Last structuredContent</h2>
-      <pre id="payload">(none yet)</pre>
-    </section>
-    <section class="panel">
-      <h2>Channel log</h2>
-      <div class="log" id="log"></div>
-    </section>
-  </div>
-</main>
-<script>
-globalThis.__mountlyMcpDevHost__ = ${serializeInlineScriptValue({
-    toolName,
-    sandboxOrigin,
-    fixtures,
-    toolInput,
-    uri,
-    hasServer,
-    sandboxPath: "/sandbox-proxy.html"
-  })};
-const HAS_SERVER = ${hasServer ? "true" : "false"};
-</script>
-<script src="/host.js"></script>
-</body>
-</html>
-`;
-}
-function sandboxProxyShell(hostOrigin, runtime) {
-  return `<!doctype html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>mountly-mcp sandbox proxy</title>
-<style>
-  html, body { margin: 0; padding: 0; width: 100%; height: 100%; background: transparent; }
-  #inner { width: 100%; height: 100%; border: 0; background: white; }
-</style>
-</head>
-<body>
-<script>globalThis.__mountlyMcpSandbox__ = ${serializeInlineScriptValue({ hostOrigin })};</script>
-<script>${escapeInlineScript(runtime)}</script>
-</body>
-</html>
-`;
-}
-async function sandboxProxyHtml(hostOrigin) {
-  return sandboxProxyShell(hostOrigin, await loadRuntime("sandbox-entry"));
-}
-
-export {
-  startDevHost,
-  sandboxProxyHtml
-};
-//# sourceMappingURL=chunk-KRAS266U.js.map

package/dist/chunk-KRAS266U.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/dev/index.ts"],"sourcesContent":["/**\n * A local MCP Apps host, so a widget can be developed without installing a\n * real host and restarting it on every change.\n *\n * It is a genuine host, not a preview shim: two origins as the spec requires\n * (§8.4), a sandbox proxy that injects the sidecar's CSP and permissions, the\n * full `ui/initialize` handshake, and tool-input/tool-result delivery. A widget\n * that works here works in Claude, and one that reaches for `eval` fails here\n * for the same reason it would fail there.\n *\n * ```ts\n * const host = await startDevHost({ htmlPath: \"dist/widget.html\", fixtures });\n * console.log(host.hostUrl);\n * ```\n */\nimport { existsSync } from \"node:fs\";\nimport { readFile } from \"node:fs/promises\";\nimport { createServer, type Server } from \"node:http\";\nimport { fileURLToPath } from \"node:url\";\nimport type { McpResourceDeclaration } from \"../types.js\";\nimport { escapeInlineScript, serializeInlineScriptValue } from \"../html.js\";\n\nexport interface DevHostOptions {\n  /** Built widget HTML. Its `.meta.json` sidecar is read alongside. */\n  htmlPath: string;\n  /**\n   * Named samples, each becoming a button in the host chrome.\n   *\n   * Without `callTool` the value is delivered straight through as\n   * `structuredContent`. With `callTool` it is the tool's *arguments*, and\n   * what the view receives is whatever the real tool returns.\n   */\n  fixtures?: Record<string, unknown>;\n  /**\n   * Run a real tool. Supplied when the developer points `dev` at their server,\n   * and used both for the fixture buttons and for `tools/call` requests the\n   * view makes itself — so app-only tools behave as they will in production.\n   */\n  callTool?: (name: string, args: unknown) => Promise<unknown>;\n  /** Arguments delivered as `ui/notifications/tool-input`. */\n  toolInput?: Record<string, unknown>;\n  /** Shown in the host chrome. Defaults to the sidecar's resource name. */\n  toolName?: string;\n  /** Defaults to 5179, incrementing until a free port is found. */\n  hostPort?: number;\n  /** Defaults to `hostPort + 1`, incrementing until a free port is found. */\n  sandboxPort?: number;\n}\n\nexport interface DevHost {\n  hostUrl: string;\n  sandboxUrl: string;\n  /** Tell connected browsers to reload — call after a rebuild. */\n  reload(): void;\n  close(): Promise<void>;\n}\n\nfunction escapeHtml(value: string): string {\n  return value.replace(\n    /[&<>\"']/g,\n    (character) =>\n      ({ \"&\": \"&amp;\", \"<\": \"&lt;\", \">\": \"&gt;\", '\"': \"&quot;\", \"'\": \"&#39;\" })[character]!,\n  );\n}\n\nconst runtimeCache = new Map<string, Promise<string>>();\n\n/**\n * Load one of the browser-side runtimes (`host-entry`, `sandbox-entry`) as a\n * string to inline into a page.\n *\n * Installed, the built IIFE is a declared package export, so ask the module\n * resolver for it. Walking from `import.meta.url` breaks the moment a bundler\n * hoists this module into a shared chunk at a different depth — which is what\n * tsup does, leaving it looking in dist/ while the file sits in dist/dev/.\n */\nfunction loadRuntime(name: \"host-entry\" | \"sandbox-entry\"): Promise<string> {\n  const cached = runtimeCache.get(name);\n  if (cached) return cached;\n  const loading = (async () => {\n    try {\n      return await readFile(\n        fileURLToPath(import.meta.resolve(`mountly-mcp/dev/${name}.js`)),\n        \"utf8\",\n      );\n    } catch {\n      // Running from source in this repo, where nothing is built yet.\n    }\n    const entry = fileURLToPath(new URL(`./${name}.ts`, import.meta.url));\n    if (!existsSync(entry)) {\n      throw new Error(\n        `mountly-mcp dev: ${name} runtime missing. Expected the packaged 'mountly-mcp/dev/${name}.js' export, or ${entry} when running from source.`,\n      );\n    }\n    const { build } = await import(\"vite\");\n    const result = await build({\n      configFile: false,\n      logLevel: \"silent\",\n      build: {\n        write: false,\n        target: \"es2022\",\n        minify: false,\n        lib: { entry, formats: [\"iife\"], name: \"__mountlyMcpDevRuntime\" },\n      },\n    });\n    const outputs = Array.isArray(result) ? result : [result];\n    const chunk = outputs\n      .flatMap((output) => (\"output\" in output ? output.output : []))\n      .find((item) => item.type === \"chunk\");\n    if (!chunk || chunk.type !== \"chunk\")\n      throw new Error(`mountly-mcp dev: failed to bundle ${name}`);\n    return chunk.code;\n  })();\n  runtimeCache.set(name, loading);\n  return loading;\n}\n\nfunction listenOnFreePort(server: Server, port: number): Promise<number> {\n  return new Promise((resolvePort, reject) => {\n    const attempt = (candidate: number): void => {\n      // Listeners are paired and torn down together: `listen()`'s callback form\n      // leaves a stale one attached across retries, which then resolves with\n      // the port that was already taken.\n      const onError = (error: NodeJS.ErrnoException): void => {\n        server.removeListener(\"listening\", onListening);\n        // ponytail: linear probe, fine for a dev tool on a developer's laptop.\n        if (error.code === \"EADDRINUSE\" && candidate < port + 50) attempt(candidate + 1);\n        else reject(error);\n      };\n      const onListening = (): void => {\n        server.removeListener(\"error\", onError);\n        const address = server.address();\n        resolvePort(typeof address === \"object\" && address !== null ? address.port : candidate);\n      };\n      server.once(\"error\", onError);\n      server.once(\"listening\", onListening);\n      server.listen(candidate);\n    };\n    attempt(port);\n  });\n}\n\nexport async function startDevHost(options: DevHostOptions): Promise<DevHost> {\n  const { htmlPath, fixtures = {}, toolInput = {}, callTool } = options;\n\n  const metaPath = `${htmlPath}.meta.json`;\n  const initialMeta = JSON.parse(await readFile(metaPath, \"utf8\")) as McpResourceDeclaration;\n  const toolName = options.toolName ?? initialMeta.name;\n  const [hostRuntime, sandboxRuntime] = await Promise.all([\n    loadRuntime(\"host-entry\"),\n    loadRuntime(\"sandbox-entry\"),\n  ]);\n\n  // Bumped on reload(); the browser polls it and reloads when it changes. The\n  // widget HTML is read per request rather than baked into the page, so a\n  // rebuild is picked up with no server restart.\n  let version = 1;\n\n  // The two servers reference each other's origin, and each only needs the\n  // other's once a request arrives — so the sandbox reads this after the host\n  // has bound its port.\n  let hostOrigin = \"\";\n\n  const sandboxServer = createServer((_req, res) => {\n    res.writeHead(200, { \"Content-Type\": \"text/html; charset=utf-8\", \"Cache-Control\": \"no-store\" });\n    res.end(sandboxProxyShell(hostOrigin, sandboxRuntime));\n  });\n  const sandboxPort = await listenOnFreePort(\n    sandboxServer,\n    options.sandboxPort ?? (options.hostPort ?? 5179) + 1,\n  );\n  const sandboxOrigin = `http://localhost:${sandboxPort}`;\n\n  const hostServer = createServer(async (req, res) => {\n    const path = new URL(req.url ?? \"/\", \"http://localhost\").pathname;\n    const send = (status: number, type: string, body: string | Buffer): void => {\n      res.writeHead(status, { \"Content-Type\": type, \"Cache-Control\": \"no-store\" });\n      res.end(body);\n    };\n    try {\n      if (path === \"/call\" && req.method === \"POST\") {\n        if (!callTool) return send(400, \"text/plain\", \"no server connected\");\n        const body = await new Promise<string>((done, fail) => {\n          let raw = \"\";\n          req.on(\"data\", (chunk) => (raw += chunk));\n          req.on(\"end\", () => done(raw));\n          req.on(\"error\", fail);\n        });\n        const { name, arguments: args } = JSON.parse(body) as { name: string; arguments?: unknown };\n        // Tool failures are the view's problem to render, not the dev server's\n        // to crash on, so they come back as a normal result.\n        const result = await callTool(name, args).catch((error: unknown) => ({\n          isError: true,\n          content: [{ type: \"text\", text: error instanceof Error ? error.message : String(error) }],\n        }));\n        return send(200, \"application/json\", JSON.stringify(result));\n      }\n      if (path === \"/\") return send(200, \"text/html; charset=utf-8\", hostPage());\n      if (path === \"/host.js\") return send(200, \"text/javascript; charset=utf-8\", hostRuntime);\n      if (path === \"/version\") return send(200, \"application/json\", String(version));\n      if (path === \"/widget.html\")\n        return send(200, \"text/plain; charset=utf-8\", await readFile(htmlPath, \"utf8\"));\n      if (path === \"/widget.meta.json\")\n        return send(200, \"application/json\", await readFile(metaPath, \"utf8\"));\n      send(404, \"text/plain\", \"not found\");\n    } catch (error) {\n      // A rebuild in flight can briefly leave the file missing; say so rather\n      // than crashing the dev server.\n      send(500, \"text/plain\", error instanceof Error ? error.message : String(error));\n    }\n  });\n  let hostPort: number;\n  try {\n    hostPort = await listenOnFreePort(hostServer, options.hostPort ?? 5179);\n  } catch (caught) {\n    await new Promise<void>((done) => sandboxServer.close(() => done()));\n    throw caught;\n  }\n  hostOrigin = `http://localhost:${hostPort}`;\n\n  function hostPage(): string {\n    return devHostHtml({\n      toolName,\n      sandboxOrigin,\n      fixtures,\n      toolInput,\n      uri: initialMeta.uri,\n      hasServer: callTool !== undefined,\n    });\n  }\n\n  return {\n    hostUrl: hostOrigin,\n    sandboxUrl: sandboxOrigin,\n    reload() {\n      version += 1;\n    },\n    async close() {\n      await Promise.all([\n        new Promise<void>((done) => hostServer.close(() => done())),\n        new Promise<void>((done) => sandboxServer.close(() => done())),\n      ]);\n    },\n  };\n}\n\ninterface HostPageOptions {\n  toolName: string;\n  sandboxOrigin: string;\n  fixtures: Record<string, unknown>;\n  toolInput: Record<string, unknown>;\n  uri: string;\n  hasServer: boolean;\n}\n\nfunction devHostHtml(options: HostPageOptions): string {\n  const { toolName, sandboxOrigin, fixtures, toolInput, uri, hasServer } = options;\n  const buttons = Object.keys(fixtures)\n    .map(\n      (name, index) =>\n        `<button class=\"btn\" data-fixture=\"${escapeHtml(name)}\"${index === 0 ? ' data-active=\"true\"' : \"\"}>${escapeHtml(name)}</button>`,\n    )\n    .join(\"\\n\");\n\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n<title>mountly-mcp dev · ${escapeHtml(toolName)}</title>\n<style>\n  :root { color-scheme:light; --bg:#f6f7f9; --fg:#0b0c0f; --muted:#5c6675; --accent:#1d4ed8; --border:#dcdfe5; }\n  :root[data-theme=\"dark\"] { color-scheme:dark; --bg:#0b0c0f; --fg:#e6e9ef; --muted:#9aa3b2; --accent:#7aa2ff; --border:#252a33; }\n  * { box-sizing:border-box; }\n  body { margin:0; min-height:100vh; background:var(--bg); color:var(--fg); font:14px/1.5 -apple-system,BlinkMacSystemFont,\"Segoe UI\",system-ui,sans-serif; }\n  header { padding:18px 24px; border-bottom:1px solid var(--border); display:flex; align-items:center; gap:12px; flex-wrap:wrap; }\n  header h1 { margin:0; font-size:16px; font-weight:600; }\n  header code { color:var(--muted); font-size:12px; }\n  #fixtures { display:flex; gap:8px; flex-wrap:wrap; }\n  .spacer { flex:1; }\n  .btn { appearance:none; border:1px solid var(--border); background:transparent; color:var(--fg); padding:6px 12px; border-radius:6px; font:inherit; cursor:pointer; }\n  .btn:hover { border-color:var(--accent); color:var(--accent); }\n  .btn[data-active=\"true\"] { background:var(--accent); color:white; border-color:var(--accent); }\n  main { display:grid; grid-template-columns:minmax(420px,1fr) 360px; gap:20px; padding:24px; align-items:start; }\n  iframe { width:100%; height:460px; border:1px solid var(--border); border-radius:12px; background:white; }\n  .panel { border:1px solid var(--border); border-radius:12px; padding:16px; }\n  .panel + .panel { margin-top:12px; }\n  .panel h2 { margin:0 0 8px; font-size:13px; text-transform:uppercase; letter-spacing:.08em; color:var(--muted); }\n  pre { margin:0; padding:10px; border-radius:8px; font:12px/1.45 ui-monospace,Menlo,Consolas,monospace; overflow:auto; max-height:200px; }\n  .log { font:11px/1.5 ui-monospace,Menlo,Consolas,monospace; color:var(--muted); white-space:pre-wrap; max-height:280px; overflow:auto; }\n  @media (max-width:880px) { main { grid-template-columns:1fr; padding:16px; } }\n</style>\n</head>\n<body>\n<header>\n  <h1>${escapeHtml(toolName)}</h1>\n  <code>${escapeHtml(uri)}</code>\n  <span class=\"spacer\"></span>\n  <div id=\"fixtures\">${buttons}</div>\n  <button class=\"btn\" id=\"theme\" type=\"button\">Theme</button>\n  <button class=\"btn\" id=\"teardown\" type=\"button\">Teardown</button>\n</header>\n<main>\n  <iframe id=\"sandbox\" sandbox=\"allow-scripts allow-same-origin\" title=\"mountly-mcp sandbox proxy\"></iframe>\n  <div>\n    <section class=\"panel\">\n      <h2>Last structuredContent</h2>\n      <pre id=\"payload\">(none yet)</pre>\n    </section>\n    <section class=\"panel\">\n      <h2>Channel log</h2>\n      <div class=\"log\" id=\"log\"></div>\n    </section>\n  </div>\n</main>\n<script>\nglobalThis.__mountlyMcpDevHost__ = ${serializeInlineScriptValue({\n    toolName,\n    sandboxOrigin,\n    fixtures,\n    toolInput,\n    uri,\n    hasServer,\n    sandboxPath: \"/sandbox-proxy.html\",\n  })};\nconst HAS_SERVER = ${hasServer ? \"true\" : \"false\"};\n</script>\n<script src=\"/host.js\"></script>\n</body>\n</html>\n`;\n}\n/**\n * The proxy document: a shell around the compiled sandbox runtime.\n *\n * Kept separate from {@link sandboxProxyHtml} so the dev server can load the\n * runtime once at startup and still stamp in the host origin per request,\n * which it only learns after binding a port.\n */\nfunction sandboxProxyShell(hostOrigin: string, runtime: string): string {\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<title>mountly-mcp sandbox proxy</title>\n<style>\n  html, body { margin: 0; padding: 0; width: 100%; height: 100%; background: transparent; }\n  #inner { width: 100%; height: 100%; border: 0; background: white; }\n</style>\n</head>\n<body>\n<script>globalThis.__mountlyMcpSandbox__ = ${serializeInlineScriptValue({ hostOrigin })};</script>\n<script>${escapeInlineScript(runtime)}</script>\n</body>\n</html>\n`;\n}\n\n/**\n * The MCP Apps sandbox proxy document (spec §8.4), ready to serve from an\n * origin distinct from the host page.\n *\n * Exported because this is the security boundary — it builds the CSP from the\n * sidecar and decides what the view may execute and reach. Anything standing\n * up a host, including the example harnesses in this repo, should serve this\n * rather than keep a copy that drifts from it.\n */\nexport async function sandboxProxyHtml(hostOrigin: string): Promise<string> {\n  return sandboxProxyShell(hostOrigin, await loadRuntime(\"sandbox-entry\"));\n}\n\nexport { connectMcpServer, type ConnectedMcpServer } from \"./connect-server.js\";\n"],"mappings":";;;;;;AAeA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AACzB,SAAS,oBAAiC;AAC1C,SAAS,qBAAqB;AAuC9B,SAAS,WAAW,OAAuB;AACzC,SAAO,MAAM;AAAA,IACX;AAAA,IACA,CAAC,eACE,EAAE,KAAK,SAAS,KAAK,QAAQ,KAAK,QAAQ,KAAK,UAAU,KAAK,QAAQ,GAAG,SAAS;AAAA,EACvF;AACF;AAEA,IAAM,eAAe,oBAAI,IAA6B;AAWtD,SAAS,YAAY,MAAuD;AAC1E,QAAM,SAAS,aAAa,IAAI,IAAI;AACpC,MAAI,OAAQ,QAAO;AACnB,QAAM,WAAW,YAAY;AAC3B,QAAI;AACF,aAAO,MAAM;AAAA,QACX,cAAc,YAAY,QAAQ,mBAAmB,IAAI,KAAK,CAAC;AAAA,QAC/D;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AACA,UAAM,QAAQ,cAAc,IAAI,IAAI,KAAK,IAAI,OAAO,YAAY,GAAG,CAAC;AACpE,QAAI,CAAC,WAAW,KAAK,GAAG;AACtB,YAAM,IAAI;AAAA,QACR,oBAAoB,IAAI,4DAA4D,IAAI,mBAAmB,KAAK;AAAA,MAClH;AAAA,IACF;AACA,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,MAAM;AACrC,UAAM,SAAS,MAAM,MAAM;AAAA,MACzB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,OAAO;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,KAAK,EAAE,OAAO,SAAS,CAAC,MAAM,GAAG,MAAM,yBAAyB;AAAA,MAClE;AAAA,IACF,CAAC;AACD,UAAM,UAAU,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;AACxD,UAAM,QAAQ,QACX,QAAQ,CAAC,WAAY,YAAY,SAAS,OAAO,SAAS,CAAC,CAAE,EAC7D,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO;AACvC,QAAI,CAAC,SAAS,MAAM,SAAS;AAC3B,YAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAC7D,WAAO,MAAM;AAAA,EACf,GAAG;AACH,eAAa,IAAI,MAAM,OAAO;AAC9B,SAAO;AACT;AAEA,SAAS,iBAAiB,QAAgB,MAA+B;AACvE,SAAO,IAAI,QAAQ,CAAC,aAAa,WAAW;AAC1C,UAAM,UAAU,CAAC,cAA4B;AAI3C,YAAM,UAAU,CAAC,UAAuC;AACtD,eAAO,eAAe,aAAa,WAAW;AAE9C,YAAI,MAAM,SAAS,gBAAgB,YAAY,OAAO,GAAI,SAAQ,YAAY,CAAC;AAAA,YAC1E,QAAO,KAAK;AAAA,MACnB;AACA,YAAM,cAAc,MAAY;AAC9B,eAAO,eAAe,SAAS,OAAO;AACtC,cAAM,UAAU,OAAO,QAAQ;AAC/B,oBAAY,OAAO,YAAY,YAAY,YAAY,OAAO,QAAQ,OAAO,SAAS;AAAA,MACxF;AACA,aAAO,KAAK,SAAS,OAAO;AAC5B,aAAO,KAAK,aAAa,WAAW;AACpC,aAAO,OAAO,SAAS;AAAA,IACzB;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AACH;AAEA,eAAsB,aAAa,SAA2C;AAC5E,QAAM,EAAE,UAAU,WAAW,CAAC,GAAG,YAAY,CAAC,GAAG,SAAS,IAAI;AAE9D,QAAM,WAAW,GAAG,QAAQ;AAC5B,QAAM,cAAc,KAAK,MAAM,MAAM,SAAS,UAAU,MAAM,CAAC;AAC/D,QAAM,WAAW,QAAQ,YAAY,YAAY;AACjD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,QAAQ,IAAI;AAAA,IACtD,YAAY,YAAY;AAAA,IACxB,YAAY,eAAe;AAAA,EAC7B,CAAC;AAKD,MAAI,UAAU;AAKd,MAAI,aAAa;AAEjB,QAAM,gBAAgB,aAAa,CAAC,MAAM,QAAQ;AAChD,QAAI,UAAU,KAAK,EAAE,gBAAgB,4BAA4B,iBAAiB,WAAW,CAAC;AAC9F,QAAI,IAAI,kBAAkB,YAAY,cAAc,CAAC;AAAA,EACvD,CAAC;AACD,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,QAAQ,gBAAgB,QAAQ,YAAY,QAAQ;AAAA,EACtD;AACA,QAAM,gBAAgB,oBAAoB,WAAW;AAErD,QAAM,aAAa,aAAa,OAAO,KAAK,QAAQ;AAClD,UAAM,OAAO,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB,EAAE;AACzD,UAAM,OAAO,CAAC,QAAgB,MAAc,SAAgC;AAC1E,UAAI,UAAU,QAAQ,EAAE,gBAAgB,MAAM,iBAAiB,WAAW,CAAC;AAC3E,UAAI,IAAI,IAAI;AAAA,IACd;AACA,QAAI;AACF,UAAI,SAAS,WAAW,IAAI,WAAW,QAAQ;AAC7C,YAAI,CAAC,SAAU,QAAO,KAAK,KAAK,cAAc,qBAAqB;AACnE,cAAM,OAAO,MAAM,IAAI,QAAgB,CAAC,MAAM,SAAS;AACrD,cAAI,MAAM;AACV,cAAI,GAAG,QAAQ,CAAC,UAAW,OAAO,KAAM;AACxC,cAAI,GAAG,OAAO,MAAM,KAAK,GAAG,CAAC;AAC7B,cAAI,GAAG,SAAS,IAAI;AAAA,QACtB,CAAC;AACD,cAAM,EAAE,MAAM,WAAW,KAAK,IAAI,KAAK,MAAM,IAAI;AAGjD,cAAM,SAAS,MAAM,SAAS,MAAM,IAAI,EAAE,MAAM,CAAC,WAAoB;AAAA,UACnE,SAAS;AAAA,UACT,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAAC;AAAA,QAC1F,EAAE;AACF,eAAO,KAAK,KAAK,oBAAoB,KAAK,UAAU,MAAM,CAAC;AAAA,MAC7D;AACA,UAAI,SAAS,IAAK,QAAO,KAAK,KAAK,4BAA4B,SAAS,CAAC;AACzE,UAAI,SAAS,WAAY,QAAO,KAAK,KAAK,kCAAkC,WAAW;AACvF,UAAI,SAAS,WAAY,QAAO,KAAK,KAAK,oBAAoB,OAAO,OAAO,CAAC;AAC7E,UAAI,SAAS;AACX,eAAO,KAAK,KAAK,6BAA6B,MAAM,SAAS,UAAU,MAAM,CAAC;AAChF,UAAI,SAAS;AACX,eAAO,KAAK,KAAK,oBAAoB,MAAM,SAAS,UAAU,MAAM,CAAC;AACvE,WAAK,KAAK,cAAc,WAAW;AAAA,IACrC,SAAS,OAAO;AAGd,WAAK,KAAK,cAAc,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAChF;AAAA,EACF,CAAC;AACD,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,iBAAiB,YAAY,QAAQ,YAAY,IAAI;AAAA,EACxE,SAAS,QAAQ;AACf,UAAM,IAAI,QAAc,CAAC,SAAS,cAAc,MAAM,MAAM,KAAK,CAAC,CAAC;AACnE,UAAM;AAAA,EACR;AACA,eAAa,oBAAoB,QAAQ;AAEzC,WAAS,WAAmB;AAC1B,WAAO,YAAY;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK,YAAY;AAAA,MACjB,WAAW,aAAa;AAAA,IAC1B,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,SAAS;AACP,iBAAW;AAAA,IACb;AAAA,IACA,MAAM,QAAQ;AACZ,YAAM,QAAQ,IAAI;AAAA,QAChB,IAAI,QAAc,CAAC,SAAS,WAAW,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,QAC1D,IAAI,QAAc,CAAC,SAAS,cAAc,MAAM,MAAM,KAAK,CAAC,CAAC;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAWA,SAAS,YAAY,SAAkC;AACrD,QAAM,EAAE,UAAU,eAAe,UAAU,WAAW,KAAK,UAAU,IAAI;AACzE,QAAM,UAAU,OAAO,KAAK,QAAQ,EACjC;AAAA,IACC,CAAC,MAAM,UACL,qCAAqC,WAAW,IAAI,CAAC,IAAI,UAAU,IAAI,wBAAwB,EAAE,IAAI,WAAW,IAAI,CAAC;AAAA,EACzH,EACC,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,8BAKkB,WAAW,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QA0BvC,WAAW,QAAQ,CAAC;AAAA,UAClB,WAAW,GAAG,CAAC;AAAA;AAAA,uBAEF,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qCAkBO,2BAA2B;AAAA,IAC5D;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,EACf,CAAC,CAAC;AAAA,qBACiB,YAAY,SAAS,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAMjD;AAQA,SAAS,kBAAkB,YAAoB,SAAyB;AACtE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,6CAWoC,2BAA2B,EAAE,WAAW,CAAC,CAAC;AAAA,UAC7E,mBAAmB,OAAO,CAAC;AAAA;AAAA;AAAA;AAIrC;AAWA,eAAsB,iBAAiB,YAAqC;AAC1E,SAAO,kBAAkB,YAAY,MAAM,YAAY,eAAe,CAAC;AACzE;","names":[]}