@frontmcp/ui 0.5.1 → 0.6.0

package/src/runtime/adapters/types.d.ts

@@ -1,94 +0,0 @@
-/**
- * Renderer Adapter Types
- *
- * Defines the interface for renderer adapters that handle different
- * UI types (HTML, React, MDX) at runtime.
- *
- * @packageDocumentation
- */
-import type { UIType } from '../../types/ui-runtime';
-/**
- * Context passed to renderer adapters.
- */
-export interface RenderContext {
-    /** Tool input arguments */
-    input: Record<string, unknown>;
-    /** Tool output/result */
-    output: unknown;
-    /** Structured content (if schema provided) */
-    structuredContent?: unknown;
-    /** Tool name */
-    toolName: string;
-}
-/**
- * Options for rendering.
- */
-export interface RenderOptions {
-    /** Target element to render into */
-    target?: HTMLElement;
-    /** Whether to hydrate existing SSR content */
-    hydrate?: boolean;
-    /** Manifest data from the page */
-    manifest?: Record<string, unknown>;
-}
-/**
- * Result of a render operation.
- */
-export interface RenderResult {
-    /** Whether rendering was successful */
-    success: boolean;
-    /** Error message if failed */
-    error?: string;
-    /** The rendered HTML (for SSR) */
-    html?: string;
-}
-/**
- * Renderer adapter interface.
- *
- * Each adapter handles a specific UI type and provides methods
- * for rendering templates to the DOM.
- */
-export interface RendererAdapter {
-    /** The UI type this adapter handles */
-    readonly type: UIType;
-    /**
-     * Check if this adapter can handle the given content.
-     */
-    canHandle(content: string | unknown): boolean;
-    /**
-     * Render content to an HTML string.
-     * Used for SSR and initial page generation.
-     */
-    render(content: string, context: RenderContext, options?: RenderOptions): Promise<string>;
-    /**
-     * Render content directly to the DOM.
-     * Used for client-side rendering.
-     */
-    renderToDOM?(content: string, target: HTMLElement, context: RenderContext, options?: RenderOptions): Promise<RenderResult>;
-    /**
-     * Hydrate existing SSR content with interactivity.
-     * Used for React/MDX components that were server-rendered.
-     */
-    hydrate?(target: HTMLElement, context: RenderContext, options?: RenderOptions): Promise<RenderResult>;
-    /**
-     * Update the rendered content with new data.
-     * Used when tool output changes at runtime.
-     */
-    update?(target: HTMLElement, context: RenderContext): Promise<RenderResult>;
-    /**
-     * Clean up any resources (event listeners, etc.).
-     */
-    destroy?(target: HTMLElement): void;
-}
-/**
- * Lazy loader function for adapters.
- */
-export type AdapterLoader = () => Promise<RendererAdapter>;
-/**
- * Adapter registry entry.
- */
-export interface AdapterRegistryEntry {
-    type: UIType;
-    loader: AdapterLoader;
-    instance?: RendererAdapter;
-}

package/src/runtime/adapters/types.js

@@ -1,11 +0,0 @@
-"use strict";
-/**
- * Renderer Adapter Types
- *
- * Defines the interface for renderer adapters that handle different
- * UI types (HTML, React, MDX) at runtime.
- *
- * @packageDocumentation
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-//# sourceMappingURL=types.js.map

package/src/runtime/adapters/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/runtime/adapters/types.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG","sourcesContent":["/**\n * Renderer Adapter Types\n *\n * Defines the interface for renderer adapters that handle different\n * UI types (HTML, React, MDX) at runtime.\n *\n * @packageDocumentation\n */\n\nimport type { UIType } from '../../types/ui-runtime';\n\n/**\n * Context passed to renderer adapters.\n */\nexport interface RenderContext {\n  /** Tool input arguments */\n  input: Record<string, unknown>;\n  /** Tool output/result */\n  output: unknown;\n  /** Structured content (if schema provided) */\n  structuredContent?: unknown;\n  /** Tool name */\n  toolName: string;\n}\n\n/**\n * Options for rendering.\n */\nexport interface RenderOptions {\n  /** Target element to render into */\n  target?: HTMLElement;\n  /** Whether to hydrate existing SSR content */\n  hydrate?: boolean;\n  /** Manifest data from the page */\n  manifest?: Record<string, unknown>;\n}\n\n/**\n * Result of a render operation.\n */\nexport interface RenderResult {\n  /** Whether rendering was successful */\n  success: boolean;\n  /** Error message if failed */\n  error?: string;\n  /** The rendered HTML (for SSR) */\n  html?: string;\n}\n\n/**\n * Renderer adapter interface.\n *\n * Each adapter handles a specific UI type and provides methods\n * for rendering templates to the DOM.\n */\nexport interface RendererAdapter {\n  /** The UI type this adapter handles */\n  readonly type: UIType;\n\n  /**\n   * Check if this adapter can handle the given content.\n   */\n  canHandle(content: string | unknown): boolean;\n\n  /**\n   * Render content to an HTML string.\n   * Used for SSR and initial page generation.\n   */\n  render(content: string, context: RenderContext, options?: RenderOptions): Promise<string>;\n\n  /**\n   * Render content directly to the DOM.\n   * Used for client-side rendering.\n   */\n  renderToDOM?(\n    content: string,\n    target: HTMLElement,\n    context: RenderContext,\n    options?: RenderOptions,\n  ): Promise<RenderResult>;\n\n  /**\n   * Hydrate existing SSR content with interactivity.\n   * Used for React/MDX components that were server-rendered.\n   */\n  hydrate?(target: HTMLElement, context: RenderContext, options?: RenderOptions): Promise<RenderResult>;\n\n  /**\n   * Update the rendered content with new data.\n   * Used when tool output changes at runtime.\n   */\n  update?(target: HTMLElement, context: RenderContext): Promise<RenderResult>;\n\n  /**\n   * Clean up any resources (event listeners, etc.).\n   */\n  destroy?(target: HTMLElement): void;\n}\n\n/**\n * Lazy loader function for adapters.\n */\nexport type AdapterLoader = () => Promise<RendererAdapter>;\n\n/**\n * Adapter registry entry.\n */\nexport interface AdapterRegistryEntry {\n  type: UIType;\n  loader: AdapterLoader;\n  instance?: RendererAdapter;\n}\n"]}

package/src/runtime/csp.d.ts

@@ -1,37 +0,0 @@
-/**
- * Content Security Policy Builder
- *
- * Generates CSP meta tags for sandboxed UI templates based on
- * OpenAI Apps SDK and ext-apps (SEP-1865) specifications.
- */
-import type { UIContentSecurityPolicy } from './types';
-/**
- * Default CSP when no custom policy is provided.
- * Very restrictive - no external resources allowed.
- */
-export declare const DEFAULT_CSP_DIRECTIVES: readonly ["default-src 'none'", "script-src 'self' 'unsafe-inline'", "style-src 'self' 'unsafe-inline'", "img-src 'self' data:", "font-src 'self' data:", "connect-src 'none'"];
-/**
- * Build CSP directives from a UIContentSecurityPolicy configuration
- */
-export declare function buildCSPDirectives(csp?: UIContentSecurityPolicy): string[];
-/**
- * Build a CSP meta tag from directives
- */
-export declare function buildCSPMetaTag(csp?: UIContentSecurityPolicy): string;
-/**
- * Build CSP for OpenAI Apps SDK format
- * Returns the object format expected by _meta['openai/widgetCSP']
- */
-export declare function buildOpenAICSP(csp?: UIContentSecurityPolicy): {
-    connect_domains?: string[];
-    resource_domains?: string[];
-} | undefined;
-/**
- * Validate CSP domain format
- * Domains should be valid URLs or wildcard patterns
- */
-export declare function validateCSPDomain(domain: string): boolean;
-/**
- * Filter and warn about invalid CSP domains
- */
-export declare function sanitizeCSPDomains(domains: string[] | undefined): string[];

package/src/runtime/csp.js

@@ -1,140 +0,0 @@
-"use strict";
-/**
- * Content Security Policy Builder
- *
- * Generates CSP meta tags for sandboxed UI templates based on
- * OpenAI Apps SDK and ext-apps (SEP-1865) specifications.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_CSP_DIRECTIVES = void 0;
-exports.buildCSPDirectives = buildCSPDirectives;
-exports.buildCSPMetaTag = buildCSPMetaTag;
-exports.buildOpenAICSP = buildOpenAICSP;
-exports.validateCSPDomain = validateCSPDomain;
-exports.sanitizeCSPDomains = sanitizeCSPDomains;
-/**
- * Default CSP when no custom policy is provided.
- * Very restrictive - no external resources allowed.
- */
-exports.DEFAULT_CSP_DIRECTIVES = [
-    "default-src 'none'",
-    "script-src 'self' 'unsafe-inline'",
-    "style-src 'self' 'unsafe-inline'",
-    "img-src 'self' data:",
-    "font-src 'self' data:",
-    "connect-src 'none'",
-];
-/**
- * Build CSP directives from a UIContentSecurityPolicy configuration
- */
-function buildCSPDirectives(csp) {
-    if (!csp) {
-        return [...exports.DEFAULT_CSP_DIRECTIVES];
-    }
-    // Validate and sanitize domains before use
-    const validResourceDomains = sanitizeCSPDomains(csp.resourceDomains);
-    const validConnectDomains = sanitizeCSPDomains(csp.connectDomains);
-    const directives = [
-        "default-src 'none'",
-        "script-src 'self' 'unsafe-inline'",
-        "style-src 'self' 'unsafe-inline'",
-    ];
-    // Image sources
-    const imgSources = ["'self'", 'data:'];
-    if (validResourceDomains.length) {
-        imgSources.push(...validResourceDomains);
-    }
-    directives.push(`img-src ${imgSources.join(' ')}`);
-    // Font sources
-    const fontSources = ["'self'", 'data:'];
-    if (validResourceDomains.length) {
-        fontSources.push(...validResourceDomains);
-    }
-    directives.push(`font-src ${fontSources.join(' ')}`);
-    // Connect sources (for fetch/XHR/WebSocket)
-    if (validConnectDomains.length) {
-        directives.push(`connect-src ${validConnectDomains.join(' ')}`);
-    }
-    else {
-        directives.push("connect-src 'none'");
-    }
-    // Script sources (add resource domains if specified)
-    if (validResourceDomains.length) {
-        directives[1] = `script-src 'self' 'unsafe-inline' ${validResourceDomains.join(' ')}`;
-        directives[2] = `style-src 'self' 'unsafe-inline' ${validResourceDomains.join(' ')}`;
-    }
-    return directives;
-}
-/**
- * Build a CSP meta tag from directives
- */
-function buildCSPMetaTag(csp) {
-    const directives = buildCSPDirectives(csp);
-    const content = directives.join('; ');
-    return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
-}
-/**
- * Build CSP for OpenAI Apps SDK format
- * Returns the object format expected by _meta['openai/widgetCSP']
- */
-function buildOpenAICSP(csp) {
-    if (!csp)
-        return undefined;
-    const result = {};
-    if (csp.connectDomains?.length) {
-        result.connect_domains = csp.connectDomains;
-    }
-    if (csp.resourceDomains?.length) {
-        result.resource_domains = csp.resourceDomains;
-    }
-    return Object.keys(result).length > 0 ? result : undefined;
-}
-/**
- * Escape a string for use in an HTML attribute
- */
-function escapeAttribute(str) {
-    return str
-        .replace(/&/g, '&amp;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&#39;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;');
-}
-/**
- * Validate CSP domain format
- * Domains should be valid URLs or wildcard patterns
- */
-function validateCSPDomain(domain) {
-    // Allow wildcard subdomains (e.g., https://*.example.com, https://*.x.io)
-    if (domain.startsWith('https://*.')) {
-        const rest = domain.slice(10);
-        // Allow single-char segments and multi-level domains
-        return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
-    }
-    // Standard HTTPS URL
-    try {
-        const url = new URL(domain);
-        return url.protocol === 'https:';
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Filter and warn about invalid CSP domains
- */
-function sanitizeCSPDomains(domains) {
-    if (!domains)
-        return [];
-    const valid = [];
-    for (const domain of domains) {
-        if (validateCSPDomain(domain)) {
-            valid.push(domain);
-        }
-        else {
-            console.warn(`Invalid CSP domain ignored: ${domain}`);
-        }
-    }
-    return valid;
-}
-//# sourceMappingURL=csp.js.map

package/src/runtime/csp.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../../src/runtime/csp.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAoBH,gDA2CC;AAKD,0CAIC;AAMD,wCAsBC;AAkBD,8CAeC;AAKD,gDAaC;AAnJD;;;GAGG;AACU,QAAA,sBAAsB,GAAG;IACpC,oBAAoB;IACpB,mCAAmC;IACnC,kCAAkC;IAClC,sBAAsB;IACtB,uBAAuB;IACvB,oBAAoB;CACZ,CAAC;AAEX;;GAEG;AACH,SAAgB,kBAAkB,CAAC,GAA6B;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,8BAAsB,CAAC,CAAC;IACrC,CAAC;IAED,2CAA2C;IAC3C,MAAM,oBAAoB,GAAG,kBAAkB,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IACrE,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAEnE,MAAM,UAAU,GAAa;QAC3B,oBAAoB;QACpB,mCAAmC;QACnC,kCAAkC;KACnC,CAAC;IAEF,gBAAgB;IAChB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvC,IAAI,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAChC,UAAU,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC3C,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,WAAW,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEnD,eAAe;IACf,MAAM,WAAW,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAChC,WAAW,CAAC,IAAI,CAAC,GAAG,oBAAoB,CAAC,CAAC;IAC5C,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,YAAY,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAErD,4CAA4C;IAC5C,IAAI,mBAAmB,CAAC,MAAM,EAAE,CAAC;QAC/B,UAAU,CAAC,IAAI,CAAC,eAAe,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;SAAM,CAAC;QACN,UAAU,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,qDAAqD;IACrD,IAAI,oBAAoB,CAAC,MAAM,EAAE,CAAC;QAChC,UAAU,CAAC,CAAC,CAAC,GAAG,qCAAqC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtF,UAAU,CAAC,CAAC,CAAC,GAAG,oCAAoC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvF,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,SAAgB,eAAe,CAAC,GAA6B;IAC3D,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,uDAAuD,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC;AAC7F,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,GAA6B;IAM1D,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,MAAM,GAGR,EAAE,CAAC;IAEP,IAAI,GAAG,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,eAAe,GAAG,GAAG,CAAC,cAAc,CAAC;IAC9C,CAAC;IAED,IAAI,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC;QAChC,MAAM,CAAC,gBAAgB,GAAG,GAAG,CAAC,eAAe,CAAC;IAChD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,GAAW;IAClC,OAAO,GAAG;SACP,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,MAAc;IAC9C,0EAA0E;IAC1E,IAAI,MAAM,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,qDAAqD;QACrD,OAAO,wDAAwD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,CAAC;IAED,qBAAqB;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,OAA6B;IAC9D,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC","sourcesContent":["/**\n * Content Security Policy Builder\n *\n * Generates CSP meta tags for sandboxed UI templates based on\n * OpenAI Apps SDK and ext-apps (SEP-1865) specifications.\n */\n\nimport type { UIContentSecurityPolicy } from './types';\n\n/**\n * Default CSP when no custom policy is provided.\n * Very restrictive - no external resources allowed.\n */\nexport const DEFAULT_CSP_DIRECTIVES = [\n  \"default-src 'none'\",\n  \"script-src 'self' 'unsafe-inline'\",\n  \"style-src 'self' 'unsafe-inline'\",\n  \"img-src 'self' data:\",\n  \"font-src 'self' data:\",\n  \"connect-src 'none'\",\n] as const;\n\n/**\n * Build CSP directives from a UIContentSecurityPolicy configuration\n */\nexport function buildCSPDirectives(csp?: UIContentSecurityPolicy): string[] {\n  if (!csp) {\n    return [...DEFAULT_CSP_DIRECTIVES];\n  }\n\n  // Validate and sanitize domains before use\n  const validResourceDomains = sanitizeCSPDomains(csp.resourceDomains);\n  const validConnectDomains = sanitizeCSPDomains(csp.connectDomains);\n\n  const directives: string[] = [\n    \"default-src 'none'\",\n    \"script-src 'self' 'unsafe-inline'\",\n    \"style-src 'self' 'unsafe-inline'\",\n  ];\n\n  // Image sources\n  const imgSources = [\"'self'\", 'data:'];\n  if (validResourceDomains.length) {\n    imgSources.push(...validResourceDomains);\n  }\n  directives.push(`img-src ${imgSources.join(' ')}`);\n\n  // Font sources\n  const fontSources = [\"'self'\", 'data:'];\n  if (validResourceDomains.length) {\n    fontSources.push(...validResourceDomains);\n  }\n  directives.push(`font-src ${fontSources.join(' ')}`);\n\n  // Connect sources (for fetch/XHR/WebSocket)\n  if (validConnectDomains.length) {\n    directives.push(`connect-src ${validConnectDomains.join(' ')}`);\n  } else {\n    directives.push(\"connect-src 'none'\");\n  }\n\n  // Script sources (add resource domains if specified)\n  if (validResourceDomains.length) {\n    directives[1] = `script-src 'self' 'unsafe-inline' ${validResourceDomains.join(' ')}`;\n    directives[2] = `style-src 'self' 'unsafe-inline' ${validResourceDomains.join(' ')}`;\n  }\n\n  return directives;\n}\n\n/**\n * Build a CSP meta tag from directives\n */\nexport function buildCSPMetaTag(csp?: UIContentSecurityPolicy): string {\n  const directives = buildCSPDirectives(csp);\n  const content = directives.join('; ');\n  return `<meta http-equiv=\"Content-Security-Policy\" content=\"${escapeAttribute(content)}\">`;\n}\n\n/**\n * Build CSP for OpenAI Apps SDK format\n * Returns the object format expected by _meta['openai/widgetCSP']\n */\nexport function buildOpenAICSP(csp?: UIContentSecurityPolicy):\n  | {\n      connect_domains?: string[];\n      resource_domains?: string[];\n    }\n  | undefined {\n  if (!csp) return undefined;\n\n  const result: {\n    connect_domains?: string[];\n    resource_domains?: string[];\n  } = {};\n\n  if (csp.connectDomains?.length) {\n    result.connect_domains = csp.connectDomains;\n  }\n\n  if (csp.resourceDomains?.length) {\n    result.resource_domains = csp.resourceDomains;\n  }\n\n  return Object.keys(result).length > 0 ? result : undefined;\n}\n\n/**\n * Escape a string for use in an HTML attribute\n */\nfunction escapeAttribute(str: string): string {\n  return str\n    .replace(/&/g, '&amp;')\n    .replace(/\"/g, '&quot;')\n    .replace(/'/g, '&#39;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;');\n}\n\n/**\n * Validate CSP domain format\n * Domains should be valid URLs or wildcard patterns\n */\nexport function validateCSPDomain(domain: string): boolean {\n  // Allow wildcard subdomains (e.g., https://*.example.com, https://*.x.io)\n  if (domain.startsWith('https://*.')) {\n    const rest = domain.slice(10);\n    // Allow single-char segments and multi-level domains\n    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\\.[a-zA-Z]{2,}$/.test(rest);\n  }\n\n  // Standard HTTPS URL\n  try {\n    const url = new URL(domain);\n    return url.protocol === 'https:';\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Filter and warn about invalid CSP domains\n */\nexport function sanitizeCSPDomains(domains: string[] | undefined): string[] {\n  if (!domains) return [];\n\n  const valid: string[] = [];\n  for (const domain of domains) {\n    if (validateCSPDomain(domain)) {\n      valid.push(domain);\n    } else {\n      console.warn(`Invalid CSP domain ignored: ${domain}`);\n    }\n  }\n\n  return valid;\n}\n"]}

package/src/runtime/index.d.ts

@@ -1,16 +0,0 @@
-/**
- * MCP Bridge Runtime Module
- *
- * Provides the infrastructure for rendering tool UI templates
- * that work across multiple host environments (OpenAI, Claude, ext-apps).
- *
- * @module @frontmcp/ui/runtime
- */
-export type { ProviderType, DisplayMode, ThemeMode, HostContext, MCPBridge, MCPBridgeExtended, WrapToolUIOptions, OpenAIRuntime, OpenAIUserAgent, SafeAreaInsets, UIContentSecurityPolicy, TemplateContext, TemplateHelpers, TemplateBuilderFn, ToolUITemplate, ToolUIConfig, WidgetServingMode, } from './types';
-export { MCP_BRIDGE_RUNTIME, getMCPBridgeScript, isMCPBridgeSupported } from './mcp-bridge';
-export { FRONTMCP_BRIDGE_RUNTIME, PLATFORM_BRIDGE_SCRIPTS, generateCustomBridge, type IIFEGeneratorOptions, } from './mcp-bridge';
-export { DEFAULT_CSP_DIRECTIVES, buildCSPDirectives, buildCSPMetaTag, buildOpenAICSP, validateCSPDomain, sanitizeCSPDomains, } from './csp';
-export { type WrapToolUIFullOptions, type WrapToolUIUniversalOptions, type WrapStaticWidgetOptions, type WrapLeanWidgetShellOptions, type WrapHybridWidgetShellOptions, wrapToolUI, wrapToolUIMinimal, wrapToolUIUniversal, wrapStaticWidgetUniversal, wrapLeanWidgetShell, wrapHybridWidgetShell, createTemplateHelpers, buildOpenAIMeta, getToolUIMimeType, } from './wrapper';
-export { type SanitizerFn, type SanitizeOptions, REDACTION_TOKENS, PII_PATTERNS, sanitizeInput, createSanitizer, detectPII, isEmail, isPhone, isCreditCard, isSSN, isIPv4, detectPIIType, redactPIIFromText, } from './sanitizer';
-export { RendererRuntime, createRendererRuntime, bootstrapRendererRuntime, generateBootstrapScript, type RendererRuntimeConfig, } from './renderer-runtime';
-export { type RendererAdapter, type RenderContext, type RenderOptions, type RenderResult, type AdapterLoader, HtmlRendererAdapter, ReactRendererAdapter, MdxRendererAdapter, createHtmlAdapter, createReactAdapter, createMdxAdapter, loadAdapter, getAdapterLoader, adapterLoaders, } from './adapters';

package/src/runtime/index.js

@@ -1,72 +0,0 @@
-"use strict";
-/**
- * MCP Bridge Runtime Module
- *
- * Provides the infrastructure for rendering tool UI templates
- * that work across multiple host environments (OpenAI, Claude, ext-apps).
- *
- * @module @frontmcp/ui/runtime
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.adapterLoaders = exports.getAdapterLoader = exports.loadAdapter = exports.createMdxAdapter = exports.createReactAdapter = exports.createHtmlAdapter = exports.MdxRendererAdapter = exports.ReactRendererAdapter = exports.HtmlRendererAdapter = exports.generateBootstrapScript = exports.bootstrapRendererRuntime = exports.createRendererRuntime = exports.RendererRuntime = exports.redactPIIFromText = exports.detectPIIType = exports.isIPv4 = exports.isSSN = exports.isCreditCard = exports.isPhone = exports.isEmail = exports.detectPII = exports.createSanitizer = exports.sanitizeInput = exports.PII_PATTERNS = exports.REDACTION_TOKENS = exports.getToolUIMimeType = exports.buildOpenAIMeta = exports.createTemplateHelpers = exports.wrapHybridWidgetShell = exports.wrapLeanWidgetShell = exports.wrapStaticWidgetUniversal = exports.wrapToolUIUniversal = exports.wrapToolUIMinimal = exports.wrapToolUI = exports.sanitizeCSPDomains = exports.validateCSPDomain = exports.buildOpenAICSP = exports.buildCSPMetaTag = exports.buildCSPDirectives = exports.DEFAULT_CSP_DIRECTIVES = exports.generateCustomBridge = exports.PLATFORM_BRIDGE_SCRIPTS = exports.FRONTMCP_BRIDGE_RUNTIME = exports.isMCPBridgeSupported = exports.getMCPBridgeScript = exports.MCP_BRIDGE_RUNTIME = void 0;
-// MCP Bridge Runtime (legacy)
-var mcp_bridge_1 = require("./mcp-bridge");
-Object.defineProperty(exports, "MCP_BRIDGE_RUNTIME", { enumerable: true, get: function () { return mcp_bridge_1.MCP_BRIDGE_RUNTIME; } });
-Object.defineProperty(exports, "getMCPBridgeScript", { enumerable: true, get: function () { return mcp_bridge_1.getMCPBridgeScript; } });
-Object.defineProperty(exports, "isMCPBridgeSupported", { enumerable: true, get: function () { return mcp_bridge_1.isMCPBridgeSupported; } });
-// New FrontMcpBridge Runtime
-var mcp_bridge_2 = require("./mcp-bridge");
-Object.defineProperty(exports, "FRONTMCP_BRIDGE_RUNTIME", { enumerable: true, get: function () { return mcp_bridge_2.FRONTMCP_BRIDGE_RUNTIME; } });
-Object.defineProperty(exports, "PLATFORM_BRIDGE_SCRIPTS", { enumerable: true, get: function () { return mcp_bridge_2.PLATFORM_BRIDGE_SCRIPTS; } });
-Object.defineProperty(exports, "generateCustomBridge", { enumerable: true, get: function () { return mcp_bridge_2.generateCustomBridge; } });
-// CSP utilities
-var csp_1 = require("./csp");
-Object.defineProperty(exports, "DEFAULT_CSP_DIRECTIVES", { enumerable: true, get: function () { return csp_1.DEFAULT_CSP_DIRECTIVES; } });
-Object.defineProperty(exports, "buildCSPDirectives", { enumerable: true, get: function () { return csp_1.buildCSPDirectives; } });
-Object.defineProperty(exports, "buildCSPMetaTag", { enumerable: true, get: function () { return csp_1.buildCSPMetaTag; } });
-Object.defineProperty(exports, "buildOpenAICSP", { enumerable: true, get: function () { return csp_1.buildOpenAICSP; } });
-Object.defineProperty(exports, "validateCSPDomain", { enumerable: true, get: function () { return csp_1.validateCSPDomain; } });
-Object.defineProperty(exports, "sanitizeCSPDomains", { enumerable: true, get: function () { return csp_1.sanitizeCSPDomains; } });
-// Wrapper utilities
-var wrapper_1 = require("./wrapper");
-Object.defineProperty(exports, "wrapToolUI", { enumerable: true, get: function () { return wrapper_1.wrapToolUI; } });
-Object.defineProperty(exports, "wrapToolUIMinimal", { enumerable: true, get: function () { return wrapper_1.wrapToolUIMinimal; } });
-Object.defineProperty(exports, "wrapToolUIUniversal", { enumerable: true, get: function () { return wrapper_1.wrapToolUIUniversal; } });
-Object.defineProperty(exports, "wrapStaticWidgetUniversal", { enumerable: true, get: function () { return wrapper_1.wrapStaticWidgetUniversal; } });
-Object.defineProperty(exports, "wrapLeanWidgetShell", { enumerable: true, get: function () { return wrapper_1.wrapLeanWidgetShell; } });
-Object.defineProperty(exports, "wrapHybridWidgetShell", { enumerable: true, get: function () { return wrapper_1.wrapHybridWidgetShell; } });
-Object.defineProperty(exports, "createTemplateHelpers", { enumerable: true, get: function () { return wrapper_1.createTemplateHelpers; } });
-Object.defineProperty(exports, "buildOpenAIMeta", { enumerable: true, get: function () { return wrapper_1.buildOpenAIMeta; } });
-Object.defineProperty(exports, "getToolUIMimeType", { enumerable: true, get: function () { return wrapper_1.getToolUIMimeType; } });
-// Input sanitization
-var sanitizer_1 = require("./sanitizer");
-Object.defineProperty(exports, "REDACTION_TOKENS", { enumerable: true, get: function () { return sanitizer_1.REDACTION_TOKENS; } });
-Object.defineProperty(exports, "PII_PATTERNS", { enumerable: true, get: function () { return sanitizer_1.PII_PATTERNS; } });
-Object.defineProperty(exports, "sanitizeInput", { enumerable: true, get: function () { return sanitizer_1.sanitizeInput; } });
-Object.defineProperty(exports, "createSanitizer", { enumerable: true, get: function () { return sanitizer_1.createSanitizer; } });
-Object.defineProperty(exports, "detectPII", { enumerable: true, get: function () { return sanitizer_1.detectPII; } });
-Object.defineProperty(exports, "isEmail", { enumerable: true, get: function () { return sanitizer_1.isEmail; } });
-Object.defineProperty(exports, "isPhone", { enumerable: true, get: function () { return sanitizer_1.isPhone; } });
-Object.defineProperty(exports, "isCreditCard", { enumerable: true, get: function () { return sanitizer_1.isCreditCard; } });
-Object.defineProperty(exports, "isSSN", { enumerable: true, get: function () { return sanitizer_1.isSSN; } });
-Object.defineProperty(exports, "isIPv4", { enumerable: true, get: function () { return sanitizer_1.isIPv4; } });
-Object.defineProperty(exports, "detectPIIType", { enumerable: true, get: function () { return sanitizer_1.detectPIIType; } });
-Object.defineProperty(exports, "redactPIIFromText", { enumerable: true, get: function () { return sanitizer_1.redactPIIFromText; } });
-// Renderer Runtime
-var renderer_runtime_1 = require("./renderer-runtime");
-Object.defineProperty(exports, "RendererRuntime", { enumerable: true, get: function () { return renderer_runtime_1.RendererRuntime; } });
-Object.defineProperty(exports, "createRendererRuntime", { enumerable: true, get: function () { return renderer_runtime_1.createRendererRuntime; } });
-Object.defineProperty(exports, "bootstrapRendererRuntime", { enumerable: true, get: function () { return renderer_runtime_1.bootstrapRendererRuntime; } });
-Object.defineProperty(exports, "generateBootstrapScript", { enumerable: true, get: function () { return renderer_runtime_1.generateBootstrapScript; } });
-// Renderer Adapters
-var adapters_1 = require("./adapters");
-Object.defineProperty(exports, "HtmlRendererAdapter", { enumerable: true, get: function () { return adapters_1.HtmlRendererAdapter; } });
-Object.defineProperty(exports, "ReactRendererAdapter", { enumerable: true, get: function () { return adapters_1.ReactRendererAdapter; } });
-Object.defineProperty(exports, "MdxRendererAdapter", { enumerable: true, get: function () { return adapters_1.MdxRendererAdapter; } });
-Object.defineProperty(exports, "createHtmlAdapter", { enumerable: true, get: function () { return adapters_1.createHtmlAdapter; } });
-Object.defineProperty(exports, "createReactAdapter", { enumerable: true, get: function () { return adapters_1.createReactAdapter; } });
-Object.defineProperty(exports, "createMdxAdapter", { enumerable: true, get: function () { return adapters_1.createMdxAdapter; } });
-Object.defineProperty(exports, "loadAdapter", { enumerable: true, get: function () { return adapters_1.loadAdapter; } });
-Object.defineProperty(exports, "getAdapterLoader", { enumerable: true, get: function () { return adapters_1.getAdapterLoader; } });
-Object.defineProperty(exports, "adapterLoaders", { enumerable: true, get: function () { return adapters_1.adapterLoaders; } });
-//# sourceMappingURL=index.js.map

package/src/runtime/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/runtime/index.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;AAwBH,8BAA8B;AAC9B,2CAA4F;AAAnF,gHAAA,kBAAkB,OAAA;AAAE,gHAAA,kBAAkB,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAErE,6BAA6B;AAC7B,2CAKsB;AAJpB,qHAAA,uBAAuB,OAAA;AACvB,qHAAA,uBAAuB,OAAA;AACvB,kHAAA,oBAAoB,OAAA;AAItB,gBAAgB;AAChB,6BAOe;AANb,6GAAA,sBAAsB,OAAA;AACtB,yGAAA,kBAAkB,OAAA;AAClB,sGAAA,eAAe,OAAA;AACf,qGAAA,cAAc,OAAA;AACd,wGAAA,iBAAiB,OAAA;AACjB,yGAAA,kBAAkB,OAAA;AAGpB,oBAAoB;AACpB,qCAemB;AATjB,qGAAA,UAAU,OAAA;AACV,4GAAA,iBAAiB,OAAA;AACjB,8GAAA,mBAAmB,OAAA;AACnB,oHAAA,yBAAyB,OAAA;AACzB,8GAAA,mBAAmB,OAAA;AACnB,gHAAA,qBAAqB,OAAA;AACrB,gHAAA,qBAAqB,OAAA;AACrB,0GAAA,eAAe,OAAA;AACf,4GAAA,iBAAiB,OAAA;AAGnB,qBAAqB;AACrB,yCAeqB;AAZnB,6GAAA,gBAAgB,OAAA;AAChB,yGAAA,YAAY,OAAA;AACZ,0GAAA,aAAa,OAAA;AACb,4GAAA,eAAe,OAAA;AACf,sGAAA,SAAS,OAAA;AACT,oGAAA,OAAO,OAAA;AACP,oGAAA,OAAO,OAAA;AACP,yGAAA,YAAY,OAAA;AACZ,kGAAA,KAAK,OAAA;AACL,mGAAA,MAAM,OAAA;AACN,0GAAA,aAAa,OAAA;AACb,8GAAA,iBAAiB,OAAA;AAGnB,mBAAmB;AACnB,uDAM4B;AAL1B,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AACrB,4HAAA,wBAAwB,OAAA;AACxB,2HAAA,uBAAuB,OAAA;AAIzB,oBAAoB;AACpB,uCAeoB;AATlB,+GAAA,mBAAmB,OAAA;AACnB,gHAAA,oBAAoB,OAAA;AACpB,8GAAA,kBAAkB,OAAA;AAClB,6GAAA,iBAAiB,OAAA;AACjB,8GAAA,kBAAkB,OAAA;AAClB,4GAAA,gBAAgB,OAAA;AAChB,uGAAA,WAAW,OAAA;AACX,4GAAA,gBAAgB,OAAA;AAChB,0GAAA,cAAc,OAAA","sourcesContent":["/**\n * MCP Bridge Runtime Module\n *\n * Provides the infrastructure for rendering tool UI templates\n * that work across multiple host environments (OpenAI, Claude, ext-apps).\n *\n * @module @frontmcp/ui/runtime\n */\n\n// Types (including UI types that were previously re-exported from SDK)\nexport type {\n  ProviderType,\n  DisplayMode,\n  ThemeMode,\n  HostContext,\n  MCPBridge,\n  MCPBridgeExtended,\n  WrapToolUIOptions,\n  OpenAIRuntime,\n  OpenAIUserAgent,\n  SafeAreaInsets,\n  // UI template types (defined locally to avoid circular dependency with SDK)\n  UIContentSecurityPolicy,\n  TemplateContext,\n  TemplateHelpers,\n  TemplateBuilderFn,\n  ToolUITemplate,\n  ToolUIConfig,\n  WidgetServingMode,\n} from './types';\n\n// MCP Bridge Runtime (legacy)\nexport { MCP_BRIDGE_RUNTIME, getMCPBridgeScript, isMCPBridgeSupported } from './mcp-bridge';\n\n// New FrontMcpBridge Runtime\nexport {\n  FRONTMCP_BRIDGE_RUNTIME,\n  PLATFORM_BRIDGE_SCRIPTS,\n  generateCustomBridge,\n  type IIFEGeneratorOptions,\n} from './mcp-bridge';\n\n// CSP utilities\nexport {\n  DEFAULT_CSP_DIRECTIVES,\n  buildCSPDirectives,\n  buildCSPMetaTag,\n  buildOpenAICSP,\n  validateCSPDomain,\n  sanitizeCSPDomains,\n} from './csp';\n\n// Wrapper utilities\nexport {\n  type WrapToolUIFullOptions,\n  type WrapToolUIUniversalOptions,\n  type WrapStaticWidgetOptions,\n  type WrapLeanWidgetShellOptions,\n  type WrapHybridWidgetShellOptions,\n  wrapToolUI,\n  wrapToolUIMinimal,\n  wrapToolUIUniversal,\n  wrapStaticWidgetUniversal,\n  wrapLeanWidgetShell,\n  wrapHybridWidgetShell,\n  createTemplateHelpers,\n  buildOpenAIMeta,\n  getToolUIMimeType,\n} from './wrapper';\n\n// Input sanitization\nexport {\n  type SanitizerFn,\n  type SanitizeOptions,\n  REDACTION_TOKENS,\n  PII_PATTERNS,\n  sanitizeInput,\n  createSanitizer,\n  detectPII,\n  isEmail,\n  isPhone,\n  isCreditCard,\n  isSSN,\n  isIPv4,\n  detectPIIType,\n  redactPIIFromText,\n} from './sanitizer';\n\n// Renderer Runtime\nexport {\n  RendererRuntime,\n  createRendererRuntime,\n  bootstrapRendererRuntime,\n  generateBootstrapScript,\n  type RendererRuntimeConfig,\n} from './renderer-runtime';\n\n// Renderer Adapters\nexport {\n  type RendererAdapter,\n  type RenderContext,\n  type RenderOptions,\n  type RenderResult,\n  type AdapterLoader,\n  HtmlRendererAdapter,\n  ReactRendererAdapter,\n  MdxRendererAdapter,\n  createHtmlAdapter,\n  createReactAdapter,\n  createMdxAdapter,\n  loadAdapter,\n  getAdapterLoader,\n  adapterLoaders,\n} from './adapters';\n"]}

package/src/runtime/mcp-bridge.d.ts

@@ -1,100 +0,0 @@
-/**
- * MCP Bridge Runtime
- *
- * Universal JavaScript runtime injected into UI templates that adapts
- * to the host environment (OpenAI Apps SDK, ext-apps, Claude, etc.).
- *
- * This script is designed to be embedded directly into HTML templates
- * via the MCP_BRIDGE_RUNTIME constant.
- *
- * Architecture:
- * - On OpenAI: Proxy directly to native window.openai API
- * - On Claude: Polyfill with limited functionality (network-blocked)
- * - On ext-apps: JSON-RPC postMessage bridge (SEP-1865 compliant)
- * - On Gemini: Gemini SDK integration
- * - On Unknown: LocalStorage-based state, basic functionality
- *
- * @see https://developers.openai.com/apps-sdk/build/chatgpt-ui
- * @see https://github.com/modelcontextprotocol/ext-apps (SEP-1865)
- */
-/**
- * The MCP Bridge runtime script.
- * This is injected into UI templates to provide a unified API across providers.
- *
- * Uses the new FrontMcpBridge adapter system which supports:
- * - OpenAI ChatGPT Apps SDK
- * - ext-apps (SEP-1865 protocol)
- * - Claude (Anthropic)
- * - Gemini (Google)
- * - Generic fallback
- *
- * The bridge exposes:
- * - window.FrontMcpBridge - New unified bridge API
- * - window.mcpBridge - Legacy compatibility bridge
- * - window.openai - OpenAI polyfill for non-OpenAI platforms
- *
- * Provides full OpenAI window.openai API compatibility:
- * - Properties: theme, userAgent, locale, maxHeight, displayMode, safeArea,
- *               toolInput, toolOutput, toolResponseMetadata, widgetState
- * - Methods: callTool, requestDisplayMode, requestClose, openExternal,
- *            sendFollowUpMessage, setWidgetState
- */
-export declare const MCP_BRIDGE_RUNTIME = "\n<script>\n(function() {\n  'use strict';\n\n  // ==================== Environment Detection ====================\n\n  var isOpenAI = typeof window.openai !== 'undefined';\n  var isExtApps = window.parent !== window && !isOpenAI;\n  var isClaude = typeof window.claude !== 'undefined' ||\n    (window.__mcpPlatform === 'claude');\n  var isGemini = window.__mcpPlatform === 'gemini';\n\n  // ==================== Internal State ====================\n\n  var messageId = 0;\n  var pendingRequests = new Map();\n  var contextChangeListeners = [];\n  var toolResultListeners = [];\n\n  // Default values for polyfilled properties\n  var defaultSafeArea = { top: 0, bottom: 0, left: 0, right: 0 };\n  var defaultUserAgent = { type: 'web', hover: true, touch: false };\n\n  // Host context (for ext-apps and polyfill mode)\n  var hostContext = window.__mcpHostContext || {\n    theme: 'light',\n    displayMode: 'inline'\n  };\n\n  // Trusted origin for postMessage validation (set during ext-apps initialization)\n  var trustedOrigin = null;\n\n  // Detect device capabilities\n  var detectUserAgent = function() {\n    var ua = navigator.userAgent || '';\n    var isMobile = /iPhone|iPad|iPod|Android/i.test(ua);\n    var hasTouch = 'ontouchstart' in window || navigator.maxTouchPoints > 0;\n    var hasHover = window.matchMedia && window.matchMedia('(hover: hover)').matches;\n    return {\n      type: isMobile ? 'mobile' : 'web',\n      hover: hasHover !== false,\n      touch: hasTouch\n    };\n  };\n\n  // Detect theme from system preference\n  var detectTheme = function() {\n    if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {\n      return 'dark';\n    }\n    return 'light';\n  };\n\n  // ==================== Bridge Implementation ====================\n\n  /**\n   * MCP Bridge provides full OpenAI API compatibility.\n   * On OpenAI, it proxies directly to window.openai.\n   * On other platforms, it provides polyfills.\n   */\n  var bridge = {\n    // ==================== Environment Info ====================\n\n    get provider() {\n      if (isOpenAI) return 'openai';\n      if (isClaude) return 'claude';\n      if (isGemini) return 'gemini';\n      if (isExtApps) return 'ext-apps';\n      return 'unknown';\n    },\n\n    // ==================== OpenAI-Compatible Properties ====================\n\n    get theme() {\n      if (isOpenAI && window.openai) {\n        return window.openai.theme || 'light';\n      }\n      return hostContext.theme || detectTheme();\n    },\n\n    get userAgent() {\n      if (isOpenAI && window.openai && window.openai.userAgent) {\n        return window.openai.userAgent;\n      }\n      return hostContext.userAgent || detectUserAgent();\n    },\n\n    get locale() {\n      if (isOpenAI && window.openai && window.openai.locale) {\n        return window.openai.locale;\n      }\n      return navigator.language || 'en-US';\n    },\n\n    get maxHeight() {\n      if (isOpenAI && window.openai) {\n        return window.openai.maxHeight;\n      }\n      return hostContext.viewport ? hostContext.viewport.maxHeight : undefined;\n    },\n\n    get displayMode() {\n      if (isOpenAI && window.openai) {\n        return window.openai.displayMode || 'inline';\n      }\n      return hostContext.displayMode || 'inline';\n    },\n\n    get safeArea() {\n      if (isOpenAI && window.openai && window.openai.safeArea) {\n        return window.openai.safeArea;\n      }\n      return hostContext.safeArea || defaultSafeArea;\n    },\n\n    get toolInput() {\n      if (isOpenAI && window.openai && window.openai.toolInput) {\n        return window.openai.toolInput;\n      }\n      return window.__mcpToolInput || {};\n    },\n\n    get toolOutput() {\n      if (isOpenAI && window.openai) {\n        return window.openai.toolOutput;\n      }\n      return window.__mcpToolOutput;\n    },\n\n    get structuredContent() {\n      // Alias for toolOutput to maintain compatibility\n      if (isOpenAI && window.openai) {\n        return window.openai.toolOutput;\n      }\n      return window.__mcpStructuredContent;\n    },\n\n    get toolResponseMetadata() {\n      if (isOpenAI && window.openai && window.openai.toolResponseMetadata) {\n        return window.openai.toolResponseMetadata;\n      }\n      return window.__mcpToolResponseMetadata || {};\n    },\n\n    get widgetState() {\n      if (isOpenAI && window.openai) {\n        return window.openai.widgetState || {};\n      }\n      // Polyfill: use localStorage\n      try {\n        var stored = localStorage.getItem('__mcpWidgetState');\n        return stored ? JSON.parse(stored) : {};\n      } catch (e) {\n        return {};\n      }\n    },\n\n    // ==================== OpenAI-Compatible Methods ====================\n\n    callTool: function(name, params) {\n      if (isOpenAI && window.openai && window.openai.callTool) {\n        return window.openai.callTool(name, params);\n      }\n      if (isClaude) {\n        return Promise.reject(new Error(\n          'Tool calls are not supported in Claude widgets (network-blocked sandbox)'\n        ));\n      }\n      if (isGemini) {\n        return Promise.reject(new Error(\n          'Tool calls are not supported in Gemini widgets'\n        ));\n      }\n      if (isExtApps) {\n        return this._sendRequest('tools/call', { name: name, arguments: params });\n      }\n      return Promise.reject(new Error('Tool calls not supported in this environment'));\n    },\n\n    requestDisplayMode: function(options) {\n      if (isOpenAI && window.openai && window.openai.requestDisplayMode) {\n        return window.openai.requestDisplayMode(options);\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/request-display-mode', options);\n      }\n      // Polyfill: just update local state\n      if (options && options.mode) {\n        hostContext.displayMode = options.mode;\n        contextChangeListeners.forEach(function(cb) {\n          try { cb({ displayMode: options.mode }); } catch (e) {}\n        });\n      }\n      return Promise.resolve();\n    },\n\n    requestClose: function() {\n      if (isOpenAI && window.openai && window.openai.requestClose) {\n        return window.openai.requestClose();\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/request-close', {});\n      }\n      // Polyfill: dispatch event for parent to handle\n      window.dispatchEvent(new CustomEvent('mcp:request-close'));\n      return Promise.resolve();\n    },\n\n    openExternal: function(options) {\n      var href = typeof options === 'string' ? options : (options && options.href);\n      if (!href) {\n        return Promise.reject(new Error('URL required'));\n      }\n      if (isOpenAI && window.openai && window.openai.openExternal) {\n        return window.openai.openExternal({ href: href });\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/open-link', { url: href });\n      }\n      // Fallback: open in new window\n      window.open(href, '_blank', 'noopener,noreferrer');\n      return Promise.resolve();\n    },\n\n    // Alias for openExternal (backwards compatibility)\n    openLink: function(url) {\n      return this.openExternal({ href: url });\n    },\n\n    sendFollowUpMessage: function(options) {\n      var prompt = typeof options === 'string' ? options : (options && options.prompt);\n      if (!prompt) {\n        return Promise.reject(new Error('Prompt required'));\n      }\n      if (isOpenAI && window.openai && window.openai.sendFollowUpMessage) {\n        return window.openai.sendFollowUpMessage({ prompt: prompt });\n      }\n      if (isClaude) {\n        return Promise.reject(new Error(\n          'Follow-up messages are not supported in Claude widgets (network-blocked sandbox)'\n        ));\n      }\n      if (isGemini) {\n        return Promise.reject(new Error(\n          'Follow-up messages are not supported in Gemini widgets'\n        ));\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/message', {\n          role: 'user',\n          content: { type: 'text', text: prompt }\n        });\n      }\n      return Promise.reject(new Error('Messages not supported in this environment'));\n    },\n\n    // Alias for sendFollowUpMessage (backwards compatibility)\n    sendMessage: function(content) {\n      return this.sendFollowUpMessage({ prompt: content });\n    },\n\n    setWidgetState: function(state) {\n      if (isOpenAI && window.openai && window.openai.setWidgetState) {\n        window.openai.setWidgetState(state);\n        return;\n      }\n      // Polyfill: persist to localStorage\n      try {\n        localStorage.setItem('__mcpWidgetState', JSON.stringify(state));\n      } catch (e) {\n        console.warn('Failed to persist widget state:', e);\n      }\n    },\n\n    // ==================== Context API (MCP-specific) ====================\n\n    get context() {\n      return {\n        theme: this.theme,\n        displayMode: this.displayMode,\n        viewport: this.maxHeight ? { maxHeight: this.maxHeight } : undefined,\n        userAgent: this.userAgent,\n        locale: this.locale,\n        safeArea: this.safeArea\n      };\n    },\n\n    onContextChange: function(callback) {\n      contextChangeListeners.push(callback);\n      return function() {\n        var index = contextChangeListeners.indexOf(callback);\n        if (index > -1) contextChangeListeners.splice(index, 1);\n      };\n    },\n\n    onToolResult: function(callback) {\n      toolResultListeners.push(callback);\n      return function() {\n        var index = toolResultListeners.indexOf(callback);\n        if (index > -1) toolResultListeners.splice(index, 1);\n      };\n    },\n\n    // ==================== Internal Methods ====================\n\n    _sendRequest: function(method, params) {\n      return new Promise(function(resolve, reject) {\n        var id = ++messageId;\n        pendingRequests.set(id, { resolve: resolve, reject: reject });\n\n        window.parent.postMessage({\n          jsonrpc: '2.0',\n          id: id,\n          method: method,\n          params: params\n        }, '*');\n\n        // Timeout after 30s\n        setTimeout(function() {\n          if (pendingRequests.has(id)) {\n            pendingRequests.delete(id);\n            reject(new Error('Request timeout'));\n          }\n        }, 30000);\n      });\n    },\n\n    _initExtApps: function() {\n      var self = this;\n      return this._sendRequest('ui/initialize', {}).then(function(result) {\n        if (result && result.hostContext) {\n          hostContext = Object.assign(hostContext, result.hostContext);\n        }\n        // Note: trustedOrigin is now set from first message event origin (trust-on-first-use)\n        // Send initialized notification\n        window.parent.postMessage({\n          jsonrpc: '2.0',\n          method: 'ui/notifications/initialized',\n          params: {}\n        }, '*');\n        return result;\n      });\n    }\n  };\n\n  // ==================== Event Handling ====================\n\n  window.addEventListener('message', function(event) {\n    var data = event.data;\n    if (!data || data.jsonrpc !== '2.0') return;\n\n    // Trust-on-first-use: Establish trusted origin from the first valid message\n    if (isExtApps && !trustedOrigin && event.origin) {\n      trustedOrigin = event.origin;\n    }\n\n    // Validate origin for ext-apps environment to prevent spoofed messages\n    if (isExtApps && trustedOrigin && event.origin !== trustedOrigin) {\n      console.warn('MCP Bridge: Ignoring message from untrusted origin:', event.origin);\n      return;\n    }\n\n    // Handle responses\n    if (data.id && pendingRequests.has(data.id)) {\n      var pending = pendingRequests.get(data.id);\n      pendingRequests.delete(data.id);\n\n      if (data.error) {\n        var err = new Error(data.error.message || 'Unknown error');\n        err.code = data.error.code;\n        err.data = data.error.data;\n        pending.reject(err);\n      } else {\n        pending.resolve(data.result);\n      }\n      return;\n    }\n\n    // Handle notifications\n    switch (data.method) {\n      case 'ui/notifications/tool-input':\n        window.__mcpToolInput = data.params && data.params.arguments;\n        window.dispatchEvent(new CustomEvent('mcp:tool-input', { detail: data.params }));\n        break;\n\n      case 'ui/notifications/tool-input-partial':\n        if (data.params && data.params.arguments) {\n          window.__mcpToolInput = Object.assign(window.__mcpToolInput || {}, data.params.arguments);\n        }\n        break;\n\n      case 'ui/notifications/tool-result':\n        window.__mcpToolOutput = data.params && data.params.content;\n        window.__mcpStructuredContent = data.params && data.params.structuredContent;\n        toolResultListeners.forEach(function(cb) {\n          try { cb(data.params); } catch (e) { console.error('Tool result listener error:', e); }\n        });\n        window.dispatchEvent(new CustomEvent('mcp:tool-result', { detail: data.params }));\n        break;\n\n      case 'ui/notifications/tool-cancelled':\n        window.dispatchEvent(new CustomEvent('mcp:tool-cancelled', { detail: data.params }));\n        break;\n\n      case 'ui/host-context-change':\n        hostContext = Object.assign(hostContext, data.params);\n        contextChangeListeners.forEach(function(cb) {\n          try { cb(data.params); } catch (e) { console.error('Context change listener error:', e); }\n        });\n        window.dispatchEvent(new CustomEvent('mcp:context-change', { detail: data.params }));\n        break;\n\n      case 'ui/size-change':\n        if (hostContext.viewport) {\n          hostContext.viewport = Object.assign(hostContext.viewport, data.params);\n        } else {\n          hostContext.viewport = data.params;\n        }\n        break;\n    }\n  });\n\n  // ==================== Initialize ====================\n\n  // Export bridge\n  window.mcpBridge = bridge;\n\n  // Also create window.openai polyfill for non-OpenAI platforms\n  // This allows code written for OpenAI to work on other platforms\n  if (!isOpenAI) {\n    window.openai = {\n      get theme() { return bridge.theme; },\n      get userAgent() { return bridge.userAgent; },\n      get locale() { return bridge.locale; },\n      get maxHeight() { return bridge.maxHeight; },\n      get displayMode() { return bridge.displayMode; },\n      get safeArea() { return bridge.safeArea; },\n      get toolInput() { return bridge.toolInput; },\n      get toolOutput() { return bridge.toolOutput; },\n      get toolResponseMetadata() { return bridge.toolResponseMetadata; },\n      get widgetState() { return bridge.widgetState; },\n      callTool: function(n, a) { return bridge.callTool(n, a); },\n      requestDisplayMode: function(o) { return bridge.requestDisplayMode(o); },\n      requestClose: function() { return bridge.requestClose(); },\n      openExternal: function(o) { return bridge.openExternal(o); },\n      sendFollowUpMessage: function(o) { return bridge.sendFollowUpMessage(o); },\n      setWidgetState: function(s) { return bridge.setWidgetState(s); }\n    };\n  }\n\n  // Auto-initialize for ext-apps\n  if (isExtApps) {\n    bridge._initExtApps().catch(function(err) {\n      console.warn('Failed to initialize MCP bridge:', err);\n    });\n  }\n\n  // Dispatch ready event\n  window.dispatchEvent(new CustomEvent('mcp:bridge-ready'));\n})();\n</script>\n";
-/**
- * Get the MCP Bridge runtime script as a string (without script tags)
- * Useful for inline embedding in specific scenarios.
- */
-export declare function getMCPBridgeScript(): string;
-/**
- * Check if the current environment supports the MCP bridge
- */
-export declare function isMCPBridgeSupported(): boolean;
-/**
- * The new FrontMcpBridge runtime script (universal - includes all adapters).
- * This is the recommended bridge for new integrations.
- *
- * @example
- * ```typescript
- * import { FRONTMCP_BRIDGE_RUNTIME } from '@frontmcp/ui/runtime';
- * const html = `<!DOCTYPE html><html><head>${FRONTMCP_BRIDGE_RUNTIME}</head>...</html>`;
- * ```
- */
-export declare const FRONTMCP_BRIDGE_RUNTIME: string;
-/**
- * Platform-specific bridge scripts.
- *
- * Use these for smaller bundle sizes when targeting a specific platform.
- *
- * @example
- * ```typescript
- * import { PLATFORM_BRIDGE_SCRIPTS } from '@frontmcp/ui/runtime';
- *
- * // For ChatGPT only
- * const chatgptHtml = `<html><head>${PLATFORM_BRIDGE_SCRIPTS.chatgpt}</head>...</html>`;
- *
- * // For Claude only
- * const claudeHtml = `<html><head>${PLATFORM_BRIDGE_SCRIPTS.claude}</head>...</html>`;
- * ```
- */
-export declare const PLATFORM_BRIDGE_SCRIPTS: {
-    universal: string;
-    chatgpt: string;
-    claude: string;
-    gemini: string;
-};
-/**
- * Generate a custom bridge script with specific options.
- *
- * @example
- * ```typescript
- * import { generateCustomBridge } from '@frontmcp/ui/runtime';
- *
- * const script = generateCustomBridge({
- *   adapters: ['openai', 'ext-apps'],
- *   debug: true,
- *   trustedOrigins: ['https://my-host.com']
- * });
- * ```
- */
-export { generateBridgeIIFE as generateCustomBridge } from '../bridge/runtime/iife-generator';
-export type { IIFEGeneratorOptions } from '../bridge/runtime/iife-generator';