@frontmcp/uipack 0.12.2 → 1.0.0-beta.10

package/esm/shell/index.mjs

@@ -0,0 +1,1406 @@
+// libs/uipack/src/shell/csp.ts
+var DEFAULT_CDN_DOMAINS = [
+  "https://cdn.jsdelivr.net",
+  "https://cdnjs.cloudflare.com",
+  "https://fonts.googleapis.com",
+  "https://fonts.gstatic.com",
+  "https://esm.sh"
+];
+var DEFAULT_CSP_DIRECTIVES = [
+  "default-src 'none'",
+  `script-src 'self' 'unsafe-inline' ${DEFAULT_CDN_DOMAINS.join(" ")}`,
+  `style-src 'self' 'unsafe-inline' ${DEFAULT_CDN_DOMAINS.join(" ")}`,
+  `img-src 'self' data: ${DEFAULT_CDN_DOMAINS.join(" ")}`,
+  `font-src 'self' data: ${DEFAULT_CDN_DOMAINS.join(" ")}`,
+  `connect-src ${DEFAULT_CDN_DOMAINS.join(" ")}`,
+  "object-src 'self' data:"
+];
+var RESTRICTIVE_CSP_DIRECTIVES = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "font-src 'self' data:",
+  "connect-src 'none'",
+  "object-src 'self' data:"
+];
+function buildCSPDirectives(csp) {
+  if (!csp) {
+    return [...DEFAULT_CSP_DIRECTIVES];
+  }
+  const validResourceDomains = sanitizeCSPDomains(csp.resourceDomains);
+  const validConnectDomains = sanitizeCSPDomains(csp.connectDomains);
+  const allResourceDomains = [.../* @__PURE__ */ new Set([...DEFAULT_CDN_DOMAINS, ...validResourceDomains])];
+  const directives = [
+    "default-src 'none'",
+    `script-src 'self' 'unsafe-inline' ${allResourceDomains.join(" ")}`,
+    `style-src 'self' 'unsafe-inline' ${allResourceDomains.join(" ")}`
+  ];
+  const imgSources = ["'self'", "data:", ...allResourceDomains];
+  directives.push(`img-src ${imgSources.join(" ")}`);
+  const fontSources = ["'self'", "data:", ...allResourceDomains];
+  directives.push(`font-src ${fontSources.join(" ")}`);
+  if (validConnectDomains.length) {
+    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
+  } else {
+    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
+  }
+  directives.push("object-src 'self' data:");
+  return directives;
+}
+function buildCSPMetaTag(csp) {
+  const directives = buildCSPDirectives(csp);
+  const content = directives.join("; ");
+  return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
+}
+function validateCSPDomain(domain) {
+  if (domain.startsWith("https://*.")) {
+    const rest = domain.slice(10);
+    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  }
+  try {
+    const url = new URL(domain);
+    return url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function sanitizeCSPDomains(domains) {
+  if (!domains) return [];
+  const valid = [];
+  for (const domain of domains) {
+    if (validateCSPDomain(domain)) {
+      valid.push(domain);
+    } else {
+      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    }
+  }
+  return valid;
+}
+function escapeAttribute(str) {
+  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+// libs/uipack/src/utils/index.ts
+function escapeHtml(str) {
+  if (str === null || str === void 0) {
+    return "";
+  }
+  const s = String(str);
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
+}
+function escapeScriptClose(jsonString) {
+  return jsonString.replace(/<\//g, "<\\/");
+}
+function safeJsonForScript(value) {
+  if (value === void 0) {
+    return "null";
+  }
+  try {
+    const jsonString = JSON.stringify(value, (_key, val) => {
+      if (typeof val === "bigint") {
+        return val.toString();
+      }
+      return val;
+    });
+    if (jsonString === void 0) {
+      return "null";
+    }
+    return escapeScriptClose(jsonString);
+  } catch {
+    return '{"error":"Value could not be serialized"}';
+  }
+}
+
+// libs/uipack/src/shell/data-injector.ts
+function buildDataInjectionScript(options) {
+  const { toolName, input, output, structuredContent } = options;
+  const lines = [
+    `window.__mcpToolName = ${safeJsonForScript(toolName)};`,
+    `window.__mcpToolInput = ${safeJsonForScript(input ?? null)};`,
+    `window.__mcpToolOutput = ${safeJsonForScript(output ?? null)};`,
+    `window.__mcpStructuredContent = ${safeJsonForScript(structuredContent ?? null)};`
+  ];
+  return `<script>
+${lines.join("\n")}
+</script>`;
+}
+var _uniqueIdCounter = 0;
+function createTemplateHelpers() {
+  return {
+    escapeHtml: (str) => escapeHtml(str),
+    formatDate: (date, format) => {
+      const d = date instanceof Date ? date : new Date(date);
+      if (isNaN(d.getTime())) return String(date);
+      if (format === "iso") return d.toISOString();
+      if (format === "date") return d.toLocaleDateString();
+      if (format === "time") return d.toLocaleTimeString();
+      return d.toLocaleString();
+    },
+    formatCurrency: (amount, currency = "USD") => {
+      return new Intl.NumberFormat("en-US", {
+        style: "currency",
+        currency
+      }).format(amount);
+    },
+    uniqueId: (prefix = "mcp") => {
+      return `${prefix}-${++_uniqueIdCounter}`;
+    },
+    jsonEmbed: (data) => {
+      return escapeScriptClose(JSON.stringify(data));
+    }
+  };
+}
+
+// libs/uipack/src/bridge-runtime/iife-generator.ts
+function generateBridgeIIFE(options = {}) {
+  const { debug = false, trustedOrigins = [], minify = false } = options;
+  const adapters = options.adapters || ["openai", "ext-apps", "claude", "gemini", "generic"];
+  const parts = [];
+  parts.push("(function() {");
+  parts.push('"use strict";');
+  parts.push("");
+  if (debug) {
+    parts.push('function log(msg) { console.log("[FrontMcpBridge] " + msg); }');
+  } else {
+    parts.push("function log() {}");
+  }
+  parts.push("");
+  parts.push("var DEFAULT_SAFE_AREA = { top: 0, bottom: 0, left: 0, right: 0 };");
+  parts.push("");
+  parts.push(generateContextDetection());
+  parts.push("");
+  parts.push(generateBaseCapabilities());
+  parts.push("");
+  if (adapters.includes("openai")) {
+    parts.push(generateOpenAIAdapter());
+    parts.push("");
+  }
+  if (adapters.includes("ext-apps")) {
+    parts.push(generateExtAppsAdapter(trustedOrigins));
+    parts.push("");
+  }
+  if (adapters.includes("claude")) {
+    parts.push(generateClaudeAdapter());
+    parts.push("");
+  }
+  if (adapters.includes("gemini")) {
+    parts.push(generateGeminiAdapter());
+    parts.push("");
+  }
+  if (adapters.includes("generic")) {
+    parts.push(generateGenericAdapter());
+    parts.push("");
+  }
+  parts.push(generatePlatformDetection(adapters));
+  parts.push("");
+  parts.push(generateBridgeClass());
+  parts.push("");
+  parts.push("var bridge = new FrontMcpBridge();");
+  parts.push("bridge.initialize().then(function() {");
+  parts.push('  log("Bridge initialized with adapter: " + bridge.adapterId);');
+  parts.push('  window.dispatchEvent(new CustomEvent("bridge:ready", { detail: { adapter: bridge.adapterId } }));');
+  parts.push("}).catch(function(err) {");
+  parts.push('  console.error("[FrontMcpBridge] Init failed:", err);');
+  parts.push('  window.dispatchEvent(new CustomEvent("bridge:error", { detail: { error: err } }));');
+  parts.push("});");
+  parts.push("");
+  parts.push("window.FrontMcpBridge = bridge;");
+  parts.push("})();");
+  const code = parts.join("\n");
+  if (minify) {
+    return minifyJS(code);
+  }
+  return code;
+}
+function generateContextDetection() {
+  return `
+function detectTheme() {
+  if (typeof window !== 'undefined' && window.matchMedia) {
+    return window.matchMedia('(prefers-color-scheme: dark)').matches ? 'dark' : 'light';
+  }
+  return 'light';
+}
+
+function detectLocale() {
+  if (typeof navigator !== 'undefined') {
+    return navigator.language || 'en-US';
+  }
+  return 'en-US';
+}
+
+function detectUserAgent() {
+  if (typeof navigator === 'undefined') {
+    return { type: 'web', hover: true, touch: false };
+  }
+  var ua = navigator.userAgent || '';
+  var isMobile = /iPhone|iPad|iPod|Android/i.test(ua);
+  var hasTouch = 'ontouchstart' in window || navigator.maxTouchPoints > 0;
+  var hasHover = window.matchMedia && window.matchMedia('(hover: hover)').matches;
+  return { type: isMobile ? 'mobile' : 'web', hover: hasHover !== false, touch: hasTouch };
+}
+
+function detectViewport() {
+  if (typeof window !== 'undefined') {
+    return { width: window.innerWidth, height: window.innerHeight };
+  }
+  return undefined;
+}
+
+function readInjectedData() {
+  var data = { toolInput: {}, toolOutput: undefined, structuredContent: undefined };
+  if (typeof window !== 'undefined') {
+    if (window.__mcpToolInput) data.toolInput = window.__mcpToolInput;
+    if (window.__mcpToolOutput) data.toolOutput = window.__mcpToolOutput;
+    if (window.__mcpStructuredContent) data.structuredContent = window.__mcpStructuredContent;
+  }
+  return data;
+}
+`.trim();
+}
+function generateBaseCapabilities() {
+  return `
+var DEFAULT_CAPABILITIES = {
+  canCallTools: false,
+  canSendMessages: false,
+  canOpenLinks: false,
+  canPersistState: true,
+  hasNetworkAccess: true,
+  supportsDisplayModes: false,
+  supportsTheme: true
+};
+`.trim();
+}
+function generateOpenAIAdapter() {
+  return `
+var OpenAIAdapter = {
+  id: 'openai',
+  name: 'OpenAI ChatGPT',
+  priority: 100,
+  capabilities: Object.assign({}, DEFAULT_CAPABILITIES, {
+    canCallTools: true,
+    canSendMessages: true,
+    canOpenLinks: true,
+    supportsDisplayModes: true
+  }),
+  canHandle: function() {
+    if (typeof window === 'undefined') return false;
+    // Check for window.openai.callTool (the actual OpenAI SDK API)
+    if (window.openai && typeof window.openai.callTool === 'function') return true;
+    // Also check if we're being injected with tool metadata (OpenAI injects toolOutput)
+    if (window.openai && (window.openai.toolOutput !== undefined || window.openai.toolInput !== undefined)) return true;
+    return false;
+  },
+  initialize: function(context) {
+    var sdk = window.openai;
+    context.sdk = sdk;
+    // OpenAI SDK exposes theme and displayMode directly as properties
+    if (sdk.theme) {
+      context.hostContext.theme = sdk.theme;
+    }
+    if (sdk.displayMode) {
+      context.hostContext.displayMode = sdk.displayMode;
+    }
+    // Note: OpenAI SDK does not have an onContextChange equivalent
+    return Promise.resolve();
+  },
+  callTool: function(context, name, args) {
+    return context.sdk.callTool(name, args);
+  },
+  sendMessage: function(context, content) {
+    if (typeof context.sdk.sendFollowUpMessage === 'function') {
+      return context.sdk.sendFollowUpMessage(content);
+    }
+    return Promise.reject(new Error('Messages not supported'));
+  },
+  openLink: function(context, url) {
+    window.open(url, '_blank', 'noopener,noreferrer');
+    return Promise.resolve();
+  },
+  requestDisplayMode: function(context, mode) {
+    return Promise.resolve();
+  },
+  requestClose: function(context) {
+    return Promise.resolve();
+  }
+};
+`.trim();
+}
+function generateExtAppsAdapter(trustedOrigins) {
+  const originsArray = trustedOrigins.length > 0 ? JSON.stringify(trustedOrigins) : "[]";
+  return `
+var ExtAppsAdapter = {
+  id: 'ext-apps',
+  name: 'ext-apps (SEP-1865)',
+  priority: 80,
+  capabilities: Object.assign({}, DEFAULT_CAPABILITIES, { canPersistState: true, hasNetworkAccess: true }),
+  trustedOrigins: ${originsArray},
+  trustedOrigin: null,
+  originTrustPending: false,
+  pendingRequests: {},
+  requestId: 0,
+  hostCapabilities: {},
+  canHandle: function() {
+    if (typeof window === 'undefined') return false;
+    if (window.parent === window) return false;
+
+    // Check for OpenAI SDK - defer to OpenAIAdapter
+    if (window.openai && window.openai.canvas) return false;
+    if (window.openai && typeof window.openai.callTool === 'function') return false;
+
+    // Explicit ext-apps marker
+    if (window.__mcpPlatform === 'ext-apps') return true;
+    if (window.__extAppsInitialized) return true;
+
+    // Claude MCP Apps mode (2026+) - uses ext-apps protocol
+    if (window.__mcpAppsEnabled) return true;
+
+    // Legacy Claude detection - defer to ClaudeAdapter
+    if (window.claude) return false;
+    if (window.__claudeArtifact) return false;
+    if (window.__mcpPlatform === 'claude') return false;
+    if (typeof location !== 'undefined') {
+      try {
+        var url = new URL(location.href);
+        var hostname = url.hostname.toLowerCase();
+        var isClaudeHost = hostname === 'claude.ai' || (hostname.length > 10 && hostname.slice(-10) === '.claude.ai');
+        var isAnthropicHost = hostname === 'anthropic.com' || (hostname.length > 14 && hostname.slice(-14) === '.anthropic.com');
+        if (isClaudeHost || isAnthropicHost) return false;
+      } catch (e) {
+        // If URL parsing fails, fall through to other checks
+      }
+    }
+
+    // Do NOT default to true for any iframe
+    return false;
+  },
+  initialize: function(context) {
+    var self = this;
+    context.extApps = this;
+
+    window.addEventListener('message', function(event) {
+      self.handleMessage(context, event);
+    });
+
+    return self.performHandshake(context);
+  },
+  handleMessage: function(context, event) {
+    if (!this.isOriginTrusted(event.origin)) return;
+    var data = event.data;
+    if (!data || typeof data !== 'object' || data.jsonrpc !== '2.0') return;
+
+    if ('id' in data && (data.result !== undefined || data.error !== undefined)) {
+      var pending = this.pendingRequests[data.id];
+      if (pending) {
+        clearTimeout(pending.timeout);
+        delete this.pendingRequests[data.id];
+        if (data.error) {
+          pending.reject(new Error(data.error.message + ' (code: ' + data.error.code + ')'));
+        } else {
+          pending.resolve(data.result);
+        }
+      }
+      return;
+    }
+
+    if ('method' in data && !('id' in data)) {
+      this.handleNotification(context, data);
+    }
+  },
+  handleNotification: function(context, notification) {
+    var params = notification.params || {};
+    switch (notification.method) {
+      case 'ui/notifications/tool-input':
+        context.toolInput = params.arguments || {};
+        window.dispatchEvent(new CustomEvent('tool:input', { detail: { arguments: context.toolInput } }));
+        break;
+      case 'ui/notifications/tool-input-partial':
+        // Streaming: merge partial input with existing
+        context.toolInput = Object.assign({}, context.toolInput, params.arguments || {});
+        window.dispatchEvent(new CustomEvent('tool:input-partial', { detail: { arguments: context.toolInput } }));
+        break;
+      case 'ui/notifications/tool-result':
+        context.toolOutput = params.content;
+        context.structuredContent = params.structuredContent;
+        context.notifyToolResult(params.content);
+        window.dispatchEvent(new CustomEvent('tool:result', { detail: params }));
+        break;
+      case 'ui/notifications/host-context-changed':
+        Object.assign(context.hostContext, params);
+        context.notifyContextChange(params);
+        break;
+      case 'ui/notifications/cancelled':
+        window.dispatchEvent(new CustomEvent('tool:cancelled', { detail: { reason: params.reason } }));
+        break;
+    }
+  },
+  isOriginTrusted: function(origin) {
+    if (this.trustedOrigins.length > 0) {
+      return this.trustedOrigins.indexOf(origin) !== -1;
+    }
+    // Trust-on-first-use: trust first message origin.
+    // SECURITY WARNING: For production, always configure trustedOrigins.
+    if (!this.trustedOrigin) {
+      // Guard against race condition where multiple messages arrive simultaneously
+      if (this.originTrustPending) {
+        return false;
+      }
+      if (window.parent !== window && origin) {
+        this.originTrustPending = true;
+        this.trustedOrigin = origin;
+        this.originTrustPending = false; // Reset after successful trust establishment
+        return true;
+      }
+      return false;
+    }
+    return this.trustedOrigin === origin;
+  },
+  sendRequest: function(method, params) {
+    var self = this;
+    return new Promise(function(resolve, reject) {
+      // Security: Require trusted origin before sending requests to prevent message leaks
+      if (!self.trustedOrigin && self.trustedOrigins.length === 0) {
+        reject(new Error('Cannot send request: no trusted origin established'));
+        return;
+      }
+
+      var id = ++self.requestId;
+      var timeout = setTimeout(function() {
+        delete self.pendingRequests[id];
+        reject(new Error('Request ' + method + ' timed out'));
+      }, 10000);
+
+      self.pendingRequests[id] = { resolve: resolve, reject: reject, timeout: timeout };
+
+      var targetOrigin = self.trustedOrigin || self.trustedOrigins[0];
+      window.parent.postMessage({ jsonrpc: '2.0', id: id, method: method, params: params }, targetOrigin);
+    });
+  },
+  performHandshake: function(context) {
+    var self = this;
+    var params = {
+      appInfo: { name: 'FrontMCP Widget', version: '1.0.0' },
+      appCapabilities: { tools: { listChanged: false } },
+      protocolVersion: '2024-11-05'
+    };
+
+    return this.sendRequest('ui/initialize', params).then(function(result) {
+      self.hostCapabilities = result.hostCapabilities || {};
+      self.capabilities = Object.assign({}, self.capabilities, {
+        canCallTools: Boolean(self.hostCapabilities.serverToolProxy),
+        canSendMessages: true,
+        canOpenLinks: Boolean(self.hostCapabilities.openLink),
+        supportsDisplayModes: true
+      });
+      if (result.hostContext) {
+        Object.assign(context.hostContext, result.hostContext);
+      }
+    });
+  },
+  callTool: function(context, name, args) {
+    if (!this.hostCapabilities.serverToolProxy) {
+      return Promise.reject(new Error('Server tool proxy not supported'));
+    }
+    return this.sendRequest('ui/callServerTool', { name: name, arguments: args });
+  },
+  sendMessage: function(context, content) {
+    return this.sendRequest('ui/message', { content: content });
+  },
+  openLink: function(context, url) {
+    if (!this.hostCapabilities.openLink) {
+      window.open(url, '_blank', 'noopener,noreferrer');
+      return Promise.resolve();
+    }
+    return this.sendRequest('ui/openLink', { url: url });
+  },
+  requestDisplayMode: function(context, mode) {
+    return this.sendRequest('ui/setDisplayMode', { mode: mode });
+  },
+  requestClose: function(context) {
+    return this.sendRequest('ui/close', {});
+  },
+  // Extended ext-apps methods (full specification)
+  updateModelContext: function(context, data, merge) {
+    if (!this.hostCapabilities.modelContextUpdate) {
+      return Promise.reject(new Error('Model context update not supported'));
+    }
+    return this.sendRequest('ui/updateModelContext', { context: data, merge: merge !== false });
+  },
+  log: function(context, level, message, data) {
+    if (!this.hostCapabilities.logging) {
+      // Fallback to console logging if host doesn't support it
+      var logFn = console[level] || console.log;
+      logFn('[Widget] ' + message, data);
+      return Promise.resolve();
+    }
+    return this.sendRequest('ui/log', { level: level, message: message, data: data });
+  },
+  registerTool: function(context, name, description, inputSchema) {
+    if (!this.hostCapabilities.widgetTools) {
+      return Promise.reject(new Error('Widget tool registration not supported'));
+    }
+    return this.sendRequest('ui/registerTool', { name: name, description: description, inputSchema: inputSchema });
+  },
+  unregisterTool: function(context, name) {
+    if (!this.hostCapabilities.widgetTools) {
+      return Promise.reject(new Error('Widget tool unregistration not supported'));
+    }
+    return this.sendRequest('ui/unregisterTool', { name: name });
+  }
+};
+`.trim();
+}
+function generateClaudeAdapter() {
+  return `
+var ClaudeAdapter = {
+  id: 'claude',
+  name: 'Claude (Anthropic)',
+  priority: 60,
+  capabilities: Object.assign({}, DEFAULT_CAPABILITIES, {
+    canCallTools: false,
+    canSendMessages: false,
+    canOpenLinks: true,
+    hasNetworkAccess: false,
+    supportsDisplayModes: false
+  }),
+  canHandle: function() {
+    if (typeof window === 'undefined') return false;
+
+    // If MCP Apps is enabled, let ext-apps adapter handle it
+    if (window.__mcpAppsEnabled) return false;
+    if (window.__mcpPlatform === 'ext-apps') return false;
+    if (window.__extAppsInitialized) return false;
+
+    // Legacy Claude detection
+    if (window.__mcpPlatform === 'claude') return true;
+    if (window.claude) return true;
+    if (window.__claudeArtifact) return true;
+    if (typeof location !== 'undefined') {
+      try {
+        var url = new URL(location.href);
+        var hostname = url.hostname.toLowerCase();
+        var isClaudeHost = hostname === 'claude.ai' || (hostname.length > 10 && hostname.slice(-10) === '.claude.ai');
+        var isAnthropicHost = hostname === 'anthropic.com' || (hostname.length > 14 && hostname.slice(-14) === '.anthropic.com');
+        if (isClaudeHost || isAnthropicHost) return true;
+      } catch (e) {
+        // If URL parsing fails, fall through
+      }
+    }
+    return false;
+  },
+  initialize: function(context) {
+    return Promise.resolve();
+  },
+  callTool: function() {
+    return Promise.reject(new Error('Tool calls not supported in Claude'));
+  },
+  sendMessage: function() {
+    return Promise.reject(new Error('Messages not supported in Claude'));
+  },
+  openLink: function(context, url) {
+    window.open(url, '_blank', 'noopener,noreferrer');
+    return Promise.resolve();
+  },
+  requestDisplayMode: function() {
+    return Promise.resolve();
+  },
+  requestClose: function() {
+    return Promise.resolve();
+  }
+};
+`.trim();
+}
+function generateGeminiAdapter() {
+  return `
+var GeminiAdapter = {
+  id: 'gemini',
+  name: 'Google Gemini',
+  priority: 40,
+  capabilities: Object.assign({}, DEFAULT_CAPABILITIES, {
+    canOpenLinks: true,
+    hasNetworkAccess: true
+  }),
+  canHandle: function() {
+    if (typeof window === 'undefined') return false;
+    if (window.__mcpPlatform === 'gemini') return true;
+    if (window.gemini) return true;
+    if (typeof location !== 'undefined') {
+      var href = location.href;
+      if (href.indexOf('gemini.google.com') !== -1 || href.indexOf('bard.google.com') !== -1) return true;
+    }
+    return false;
+  },
+  initialize: function(context) {
+    if (window.gemini && window.gemini.ui && window.gemini.ui.getTheme) {
+      context.hostContext.theme = window.gemini.ui.getTheme() === 'dark' ? 'dark' : 'light';
+    }
+    return Promise.resolve();
+  },
+  callTool: function() {
+    return Promise.reject(new Error('Tool calls not supported in Gemini'));
+  },
+  sendMessage: function(context, content) {
+    if (window.gemini && window.gemini.ui && window.gemini.ui.sendMessage) {
+      return window.gemini.ui.sendMessage(content);
+    }
+    return Promise.reject(new Error('Messages not supported in Gemini'));
+  },
+  openLink: function(context, url) {
+    if (window.gemini && window.gemini.ui && window.gemini.ui.openLink) {
+      return window.gemini.ui.openLink(url);
+    }
+    window.open(url, '_blank', 'noopener,noreferrer');
+    return Promise.resolve();
+  },
+  requestDisplayMode: function() {
+    return Promise.resolve();
+  },
+  requestClose: function() {
+    return Promise.resolve();
+  }
+};
+`.trim();
+}
+function generateGenericAdapter() {
+  return `
+var GenericAdapter = {
+  id: 'generic',
+  name: 'Generic Web',
+  priority: 0,
+  capabilities: Object.assign({}, DEFAULT_CAPABILITIES, {
+    canOpenLinks: true,
+    hasNetworkAccess: true
+  }),
+  canHandle: function() {
+    return typeof window !== 'undefined';
+  },
+  initialize: function(context) {
+    return Promise.resolve();
+  },
+  callTool: function() {
+    return Promise.reject(new Error('Tool calls not supported'));
+  },
+  sendMessage: function() {
+    return Promise.reject(new Error('Messages not supported'));
+  },
+  openLink: function(context, url) {
+    window.open(url, '_blank', 'noopener,noreferrer');
+    return Promise.resolve();
+  },
+  requestDisplayMode: function() {
+    return Promise.resolve();
+  },
+  requestClose: function() {
+    return Promise.resolve();
+  }
+};
+`.trim();
+}
+function generatePlatformDetection(adapters) {
+  const adapterVars = adapters.map((a) => {
+    switch (a) {
+      case "openai":
+        return "OpenAIAdapter";
+      case "ext-apps":
+        return "ExtAppsAdapter";
+      case "claude":
+        return "ClaudeAdapter";
+      case "gemini":
+        return "GeminiAdapter";
+      case "generic":
+        return "GenericAdapter";
+      default:
+        return "";
+    }
+  }).filter(Boolean);
+  return `
+var ADAPTERS = [${adapterVars.join(", ")}].sort(function(a, b) { return b.priority - a.priority; });
+
+function detectPlatform() {
+  for (var i = 0; i < ADAPTERS.length; i++) {
+    if (ADAPTERS[i].canHandle()) {
+      log('Detected platform: ' + ADAPTERS[i].id);
+      return ADAPTERS[i];
+    }
+  }
+  log('No platform detected, using generic');
+  return GenericAdapter;
+}
+`.trim();
+}
+function generateBridgeClass() {
+  return `
+function FrontMcpBridge() {
+  this._adapter = null;
+  this._initialized = false;
+  this._context = {
+    hostContext: {
+      theme: detectTheme(),
+      displayMode: 'inline',
+      locale: detectLocale(),
+      userAgent: detectUserAgent(),
+      safeArea: DEFAULT_SAFE_AREA,
+      viewport: detectViewport()
+    },
+    toolInput: {},
+    toolOutput: undefined,
+    structuredContent: undefined,
+    widgetState: {},
+    contextListeners: [],
+    toolResultListeners: [],
+    notifyContextChange: function(changes) {
+      Object.assign(this.hostContext, changes);
+      for (var i = 0; i < this.contextListeners.length; i++) {
+        try { this.contextListeners[i](changes); } catch(e) {}
+      }
+    },
+    notifyToolResult: function(result) {
+      this.toolOutput = result;
+      for (var i = 0; i < this.toolResultListeners.length; i++) {
+        try { this.toolResultListeners[i](result); } catch(e) {}
+      }
+    }
+  };
+
+  var injected = readInjectedData();
+  this._context.toolInput = injected.toolInput;
+  this._context.toolOutput = injected.toolOutput;
+  this._context.structuredContent = injected.structuredContent;
+
+  this._loadWidgetState();
+}
+
+FrontMcpBridge.prototype._loadWidgetState = function() {
+  try {
+    var key = 'frontmcp:widget:' + (window.__mcpToolName || 'unknown');
+    var stored = localStorage.getItem(key);
+    if (stored) this._context.widgetState = JSON.parse(stored);
+  } catch(e) {}
+};
+
+FrontMcpBridge.prototype._saveWidgetState = function() {
+  try {
+    var key = 'frontmcp:widget:' + (window.__mcpToolName || 'unknown');
+    localStorage.setItem(key, JSON.stringify(this._context.widgetState));
+  } catch(e) {}
+};
+
+FrontMcpBridge.prototype.initialize = function() {
+  if (this._initialized) return Promise.resolve();
+  var self = this;
+  this._adapter = detectPlatform();
+  return this._adapter.initialize(this._context).then(function() {
+    self._initialized = true;
+    // Set up the data-tool-call click handler after initialization
+    self._setupDataToolCallHandler();
+  });
+};
+
+Object.defineProperty(FrontMcpBridge.prototype, 'initialized', { get: function() { return this._initialized; } });
+Object.defineProperty(FrontMcpBridge.prototype, 'adapterId', { get: function() { return this._adapter ? this._adapter.id : undefined; } });
+Object.defineProperty(FrontMcpBridge.prototype, 'capabilities', { get: function() { return this._adapter ? this._adapter.capabilities : DEFAULT_CAPABILITIES; } });
+
+FrontMcpBridge.prototype.getTheme = function() { return this._context.hostContext.theme; };
+FrontMcpBridge.prototype.getDisplayMode = function() { return this._context.hostContext.displayMode; };
+FrontMcpBridge.prototype.getToolInput = function() { return this._context.toolInput; };
+FrontMcpBridge.prototype.getToolOutput = function() { return this._context.toolOutput; };
+FrontMcpBridge.prototype.getStructuredContent = function() { return this._context.structuredContent; };
+FrontMcpBridge.prototype.getWidgetState = function() { return this._context.widgetState; };
+FrontMcpBridge.prototype.getHostContext = function() { return Object.assign({}, this._context.hostContext); };
+FrontMcpBridge.prototype.hasCapability = function(cap) { return this._adapter && this._adapter.capabilities[cap] === true; };
+
+// Get tool response metadata (platform-agnostic)
+// Used by inline mode widgets to detect when ui/html arrives
+FrontMcpBridge.prototype.getToolResponseMetadata = function() {
+  // OpenAI injects toolResponseMetadata for widget-producing tools
+  if (typeof window !== 'undefined' && window.openai && window.openai.toolResponseMetadata) {
+    return window.openai.toolResponseMetadata;
+  }
+  // Claude (future support)
+  if (typeof window !== 'undefined' && window.claude && window.claude.toolResponseMetadata) {
+    return window.claude.toolResponseMetadata;
+  }
+  // FrontMCP direct injection (for testing/ext-apps)
+  if (typeof window !== 'undefined' && window.__mcpToolResponseMetadata) {
+    return window.__mcpToolResponseMetadata;
+  }
+  return null;
+};
+
+// Subscribe to tool response metadata changes (for inline mode injection)
+FrontMcpBridge.prototype.onToolResponseMetadata = function(callback) {
+  var self = this;
+  var called = false;
+
+  // Check if already available
+  var existing = self.getToolResponseMetadata();
+  if (existing) {
+    called = true;
+    callback(existing);
+  }
+
+  // Set up property interceptors for OpenAI
+  if (typeof window !== 'undefined') {
+    // OpenAI: Intercept toolResponseMetadata assignment
+    if (!window.__frontmcpMetadataIntercepted) {
+      window.__frontmcpMetadataIntercepted = true;
+      window.__frontmcpMetadataCallbacks = [];
+
+      // Create openai object if it doesn't exist
+      if (!window.openai) window.openai = {};
+
+      var originalMetadata = window.openai.toolResponseMetadata;
+      Object.defineProperty(window.openai, 'toolResponseMetadata', {
+        get: function() { return originalMetadata; },
+        set: function(val) {
+          originalMetadata = val;
+          log('toolResponseMetadata set, notifying ' + window.__frontmcpMetadataCallbacks.length + ' listeners');
+          for (var i = 0; i < window.__frontmcpMetadataCallbacks.length; i++) {
+            try { window.__frontmcpMetadataCallbacks[i](val); } catch(e) {}
+          }
+        },
+        configurable: true
+      });
+    }
+
+    // Register callback wrapper (store reference for unsubscribe)
+    var wrapper = function(metadata) {
+      if (!called) {
+        called = true;
+        callback(metadata);
+      }
+    };
+    window.__frontmcpMetadataCallbacks.push(wrapper);
+
+    // Return unsubscribe function that removes the wrapper (not the original callback)
+    return function() {
+      if (window.__frontmcpMetadataCallbacks) {
+        var idx = window.__frontmcpMetadataCallbacks.indexOf(wrapper);
+        if (idx !== -1) window.__frontmcpMetadataCallbacks.splice(idx, 1);
+      }
+    };
+  }
+
+  // Return no-op unsubscribe for non-window environments
+  return function() {};
+};
+
+FrontMcpBridge.prototype.callTool = function(name, args) {
+  // Priority 1: Direct OpenAI SDK call (most reliable in OpenAI iframe)
+  // This bypasses adapter abstraction for maximum compatibility
+  if (typeof window !== 'undefined' && window.openai && typeof window.openai.callTool === 'function') {
+    log('callTool: Using OpenAI SDK directly');
+    return window.openai.callTool(name, args);
+  }
+
+  // Priority 2: Use adapter (if initialized and supports tool calls)
+  if (this._adapter && this._adapter.capabilities && this._adapter.capabilities.canCallTools) {
+    log('callTool: Using adapter ' + this._adapter.id);
+    return this._adapter.callTool(this._context, name, args);
+  }
+
+  // Not initialized or no tool support
+  if (!this._adapter) {
+    return Promise.reject(new Error('Bridge not initialized. Wait for bridge:ready event.'));
+  }
+  return Promise.reject(new Error('Tool calls not supported on this platform (' + this._adapter.id + ')'));
+};
+
+FrontMcpBridge.prototype.sendMessage = function(content) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  return this._adapter.sendMessage(this._context, content);
+};
+
+FrontMcpBridge.prototype.openLink = function(url) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  return this._adapter.openLink(this._context, url);
+};
+
+FrontMcpBridge.prototype.requestDisplayMode = function(mode) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  var self = this;
+  return this._adapter.requestDisplayMode(this._context, mode).then(function() {
+    self._context.hostContext.displayMode = mode;
+  });
+};
+
+FrontMcpBridge.prototype.requestClose = function() {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  return this._adapter.requestClose(this._context);
+};
+
+// Extended ext-apps methods (full specification)
+FrontMcpBridge.prototype.updateModelContext = function(context, merge) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  if (!this._adapter.updateModelContext) {
+    return Promise.reject(new Error('updateModelContext not supported on this platform'));
+  }
+  return this._adapter.updateModelContext(this._context, context, merge);
+};
+
+FrontMcpBridge.prototype.log = function(level, message, data) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  if (!this._adapter.log) {
+    // Fallback to console
+    var logFn = console[level] || console.log;
+    logFn('[Widget] ' + message, data);
+    return Promise.resolve();
+  }
+  return this._adapter.log(this._context, level, message, data);
+};
+
+FrontMcpBridge.prototype.registerTool = function(name, description, inputSchema) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  if (!this._adapter.registerTool) {
+    return Promise.reject(new Error('registerTool not supported on this platform'));
+  }
+  return this._adapter.registerTool(this._context, name, description, inputSchema);
+};
+
+FrontMcpBridge.prototype.unregisterTool = function(name) {
+  if (!this._adapter) return Promise.reject(new Error('Not initialized'));
+  if (!this._adapter.unregisterTool) {
+    return Promise.reject(new Error('unregisterTool not supported on this platform'));
+  }
+  return this._adapter.unregisterTool(this._context, name);
+};
+
+FrontMcpBridge.prototype.setWidgetState = function(state) {
+  Object.assign(this._context.widgetState, state);
+  this._saveWidgetState();
+};
+
+FrontMcpBridge.prototype.onContextChange = function(callback) {
+  var listeners = this._context.contextListeners;
+  listeners.push(callback);
+  return function() {
+    var idx = listeners.indexOf(callback);
+    if (idx !== -1) listeners.splice(idx, 1);
+  };
+};
+
+FrontMcpBridge.prototype.onToolResult = function(callback) {
+  var listeners = this._context.toolResultListeners;
+  listeners.push(callback);
+  return function() {
+    var idx = listeners.indexOf(callback);
+    if (idx !== -1) listeners.splice(idx, 1);
+  };
+};
+
+// ==================== data-tool-call Click Handler ====================
+
+FrontMcpBridge.prototype._setupDataToolCallHandler = function() {
+  var self = this;
+
+  document.addEventListener('click', function(e) {
+    // Find the closest element with data-tool-call attribute
+    var target = e.target;
+    while (target && target !== document) {
+      if (target.hasAttribute && target.hasAttribute('data-tool-call')) {
+        var toolName = target.getAttribute('data-tool-call');
+        var argsAttr = target.getAttribute('data-tool-args');
+        var args = {};
+
+        try {
+          if (argsAttr) {
+            args = JSON.parse(argsAttr);
+          }
+        } catch (parseErr) {
+          console.error('[frontmcp] Failed to parse data-tool-args:', parseErr);
+        }
+
+        log('data-tool-call clicked: ' + toolName);
+
+        // Show loading state - save original content first
+        var originalContent = target.innerHTML;
+        var originalDisabled = target.disabled;
+        target.disabled = true;
+        target.classList.add('opacity-50', 'cursor-not-allowed');
+
+        // Add spinner for buttons
+        var spinner = '<svg class="animate-spin -ml-1 mr-2 h-4 w-4 inline" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path></svg>';
+        if (target.tagName === 'BUTTON') {
+          target.innerHTML = spinner + 'Loading...';
+        }
+
+        // Helper to reset button state
+        function resetButton() {
+          target.innerHTML = originalContent;
+          target.disabled = originalDisabled;
+          target.classList.remove('opacity-50', 'cursor-not-allowed');
+        }
+
+        // Determine how to call the tool
+        var toolCallPromise;
+
+        // Priority 1: Direct OpenAI SDK call (bypasses adapter abstraction)
+        if (typeof window !== 'undefined' && window.openai && typeof window.openai.callTool === 'function') {
+          log('Using OpenAI SDK directly for tool call');
+          toolCallPromise = window.openai.callTool(toolName, args);
+        }
+        // Priority 2: Use adapter (if it supports tool calls)
+        else if (self.hasCapability('canCallTools')) {
+          log('Using adapter for tool call');
+          toolCallPromise = self.callTool(toolName, args);
+        }
+        // No tool call capability
+        else {
+          console.error('[frontmcp] Tool calls not supported on this platform (' + self.adapterId + ')');
+          resetButton();
+          target.dispatchEvent(new CustomEvent('tool:error', {
+            detail: { name: toolName, args: args, error: 'Tool calls not supported on this platform' },
+            bubbles: true
+          }));
+          e.preventDefault();
+          return;
+        }
+
+        // Handle the tool call result
+        toolCallPromise.then(function(result) {
+          log('Tool call succeeded: ' + toolName);
+          resetButton();
+
+          // Update bridge state to trigger widget re-render
+          // React isn't hydrated in OpenAI iframe, so useState doesn't work
+          // Instead, we use the bridge's reactive state system
+          if (result && window.__frontmcp && window.__frontmcp.bridge && typeof window.__frontmcp.bridge.setWidgetState === 'function') {
+            var newData = result.structuredContent || result;
+            log('Updating bridge state with new data');
+            window.__frontmcp.bridge.setWidgetState(newData);
+          }
+
+          // Dispatch success event
+          target.dispatchEvent(new CustomEvent('tool:success', {
+            detail: { name: toolName, args: args, result: result },
+            bubbles: true
+          }));
+        }).catch(function(err) {
+          console.error('[frontmcp] Tool call failed: ' + toolName, err);
+          resetButton();
+          // Dispatch error event
+          target.dispatchEvent(new CustomEvent('tool:error', {
+            detail: { name: toolName, args: args, error: err.message || err },
+            bubbles: true
+          }));
+        });
+
+        // Prevent default behavior (e.g., form submission)
+        e.preventDefault();
+        return;
+      }
+      target = target.parentElement;
+    }
+  }, true); // Use capture phase to handle before React handlers
+};
+`.trim();
+}
+var MAX_MINIFY_CODE_LENGTH = 5e5;
+function minifyJS(code) {
+  if (code.length > MAX_MINIFY_CODE_LENGTH) {
+    return code;
+  }
+  return code.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/\s+/g, " ").replace(/\s*([{};,:()[\]])\s*/g, "$1").replace(/;\}/g, "}").trim();
+}
+function generatePlatformBundle(platform, options = {}) {
+  const platformAdapters = {
+    chatgpt: ["openai", "generic"],
+    claude: ["claude", "generic"],
+    gemini: ["gemini", "generic"],
+    universal: ["openai", "ext-apps", "claude", "gemini", "generic"]
+  };
+  return generateBridgeIIFE({
+    ...options,
+    adapters: platformAdapters[platform]
+  });
+}
+var UNIVERSAL_BRIDGE_SCRIPT = generateBridgeIIFE();
+var BRIDGE_SCRIPT_TAGS = {
+  universal: `<script>${UNIVERSAL_BRIDGE_SCRIPT}</script>`,
+  chatgpt: `<script>${generatePlatformBundle("chatgpt")}</script>`,
+  claude: `<script>${generatePlatformBundle("claude")}</script>`,
+  gemini: `<script>${generatePlatformBundle("gemini")}</script>`
+};
+
+// libs/uipack/src/shell/custom-shell-types.ts
+var SHELL_PLACEHOLDER_NAMES = ["CSP", "DATA", "BRIDGE", "CONTENT", "TITLE"];
+var SHELL_PLACEHOLDERS = {
+  CSP: "{{CSP}}",
+  DATA: "{{DATA}}",
+  BRIDGE: "{{BRIDGE}}",
+  CONTENT: "{{CONTENT}}",
+  TITLE: "{{TITLE}}"
+};
+var REQUIRED_PLACEHOLDERS = ["CONTENT"];
+var OPTIONAL_PLACEHOLDERS = ["CSP", "DATA", "BRIDGE", "TITLE"];
+function isInlineShellSource(source) {
+  return typeof source === "object" && source !== null && "inline" in source;
+}
+function isUrlShellSource(source) {
+  return typeof source === "object" && source !== null && "url" in source;
+}
+function isNpmShellSource(source) {
+  return typeof source === "object" && source !== null && "npm" in source;
+}
+
+// libs/uipack/src/shell/custom-shell-validator.ts
+function validateShellTemplate(template) {
+  const found = {};
+  for (const name of SHELL_PLACEHOLDER_NAMES) {
+    found[name] = template.includes(SHELL_PLACEHOLDERS[name]);
+  }
+  const missingRequired = REQUIRED_PLACEHOLDERS.filter((name) => !found[name]);
+  const missingOptional = OPTIONAL_PLACEHOLDERS.filter((name) => !found[name]);
+  return {
+    valid: missingRequired.length === 0,
+    found,
+    missingRequired,
+    missingOptional
+  };
+}
+
+// libs/uipack/src/shell/custom-shell-applier.ts
+function applyShellTemplate(template, values) {
+  let result = template;
+  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
+  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
+  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
+  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
+  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
+  return result;
+}
+
+// libs/uipack/src/shell/builder.ts
+function buildShell(content, config) {
+  const { toolName, csp, withShell = true, input, output, structuredContent, includeBridge = true, title } = config;
+  const { customShell } = config;
+  const dataScript = buildDataInjectionScript({ toolName, input, output, structuredContent });
+  if (!withShell) {
+    const html2 = `${dataScript}
+${content}`;
+    return {
+      html: html2,
+      hash: simpleHash(html2),
+      size: Buffer.byteLength(html2, "utf-8")
+    };
+  }
+  if (customShell) {
+    return buildCustomShell(content, customShell, {
+      csp,
+      toolName,
+      input,
+      output,
+      structuredContent,
+      includeBridge,
+      title
+    });
+  }
+  const headParts = [
+    '<meta charset="UTF-8">',
+    '<meta name="viewport" content="width=device-width, initial-scale=1.0">'
+  ];
+  if (title) {
+    headParts.push(`<title>${escapeHtmlForTag(title)}</title>`);
+  }
+  headParts.push(buildCSPMetaTag(csp));
+  headParts.push(dataScript);
+  if (includeBridge) {
+    const bridgeScript = generateBridgeIIFE({ minify: true });
+    headParts.push(`<script>${bridgeScript}</script>`);
+  }
+  const html = `<!DOCTYPE html>
+<html lang="en">
+<head>
+${headParts.map((p) => `  ${p}`).join("\n")}
+</head>
+<body>
+${content}
+</body>
+</html>`;
+  return {
+    html,
+    hash: simpleHash(html),
+    size: Buffer.byteLength(html, "utf-8")
+  };
+}
+function buildCustomShell(content, customShell, ctx) {
+  let template;
+  if (typeof customShell === "string") {
+    const validation = validateShellTemplate(customShell);
+    if (!validation.valid) {
+      throw new Error(
+        `Custom shell template is missing required placeholder(s): ${validation.missingRequired.map((n) => `{{${n}}}`).join(", ")}`
+      );
+    }
+    template = customShell;
+  } else {
+    template = customShell.template;
+  }
+  const cspTag = buildCSPMetaTag(ctx.csp);
+  const dataScript = buildDataInjectionScript({
+    toolName: ctx.toolName,
+    input: ctx.input,
+    output: ctx.output,
+    structuredContent: ctx.structuredContent
+  });
+  let bridgeHtml = "";
+  if (ctx.includeBridge) {
+    const bridgeScript = generateBridgeIIFE({ minify: true });
+    bridgeHtml = `<script>${bridgeScript}</script>`;
+  }
+  const html = applyShellTemplate(template, {
+    csp: cspTag,
+    data: dataScript,
+    bridge: bridgeHtml,
+    content,
+    title: ctx.title ? escapeHtmlForTag(ctx.title) : ""
+  });
+  return {
+    html,
+    hash: simpleHash(html),
+    size: Buffer.byteLength(html, "utf-8")
+  };
+}
+function simpleHash(str) {
+  let hash = 0;
+  for (let i = 0; i < str.length; i++) {
+    const char = str.charCodeAt(i);
+    hash = (hash << 5) - hash + char | 0;
+  }
+  return Math.abs(hash).toString(16).padStart(8, "0");
+}
+function escapeHtmlForTag(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+
+// libs/uipack/src/shell/custom-shell-resolver.ts
+var DEFAULT_TIMEOUT_MS = 1e4;
+var templateCache = /* @__PURE__ */ new Map();
+async function resolveShellTemplate(source, options) {
+  if (isInlineShellSource(source)) {
+    return resolveInline(source.inline);
+  }
+  if (isUrlShellSource(source)) {
+    const cacheKey = `url:${source.url}`;
+    if (!options?.noCache) {
+      const cached = templateCache.get(cacheKey);
+      if (cached) return cached;
+    }
+    const template = await fetchWithTimeout(source.url, source.timeout ?? DEFAULT_TIMEOUT_MS);
+    const resolved = buildResolved(template, "url");
+    if (!options?.noCache) {
+      templateCache.set(cacheKey, resolved);
+    }
+    return resolved;
+  }
+  if (isNpmShellSource(source)) {
+    const specifier = source.version ? `${source.npm}@${source.version}` : source.npm;
+    const cacheKey = `npm:${specifier}`;
+    if (!options?.noCache) {
+      const cached = templateCache.get(cacheKey);
+      if (cached) return cached;
+    }
+    const template = await resolveNpmTemplate(source, specifier, options?.resolver);
+    const resolved = buildResolved(template, "npm");
+    if (!options?.noCache) {
+      templateCache.set(cacheKey, resolved);
+    }
+    return resolved;
+  }
+  throw new Error('Invalid custom shell source: must have "inline", "url", or "npm" property');
+}
+function clearShellTemplateCache() {
+  templateCache.clear();
+}
+function resolveInline(template) {
+  return buildResolved(template, "inline");
+}
+function buildResolved(template, sourceType) {
+  const validation = validateShellTemplate(template);
+  if (!validation.valid) {
+    throw new Error(
+      `Custom shell template is missing required placeholder(s): ${validation.missingRequired.map((n) => `{{${n}}}`).join(", ")}`
+    );
+  }
+  return { template, sourceType, validation };
+}
+async function fetchWithTimeout(url, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(url, { signal: controller.signal });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch shell template from ${url}: HTTP ${response.status}`);
+    }
+    return await response.text();
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`Shell template fetch timed out after ${timeoutMs}ms: ${url}`);
+    }
+    throw err;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveNpmTemplate(source, specifier, resolver) {
+  const cdnUrl = resolveNpmToCdnUrl(specifier, resolver);
+  const moduleText = await fetchWithTimeout(cdnUrl, DEFAULT_TIMEOUT_MS);
+  return extractTemplateFromModule(moduleText, source.exportName);
+}
+function resolveNpmToCdnUrl(specifier, resolver) {
+  if (resolver) {
+    const resolved = resolver.resolve(specifier);
+    if (resolved) {
+      return resolved.value;
+    }
+  }
+  return `https://esm.sh/${specifier}`;
+}
+function extractTemplateFromModule(moduleText, exportName) {
+  if (exportName && exportName !== "default") {
+    const namedPattern = new RegExp(
+      `export\\s+(?:const|let|var)\\s+${escapeRegExp(exportName)}\\s*=\\s*\`([\\s\\S]*?)\``
+    );
+    const namedMatch = moduleText.match(namedPattern);
+    if (namedMatch) {
+      return namedMatch[1];
+    }
+    throw new Error(
+      `Could not extract named export "${exportName}" from npm shell package. The package must export a template literal string.`
+    );
+  }
+  const defaultPattern = /export\s+default\s+`([\s\S]*?)`/;
+  const defaultMatch = moduleText.match(defaultPattern);
+  if (defaultMatch) {
+    return defaultMatch[1];
+  }
+  throw new Error(
+    "Could not extract default export from npm shell package. The package must export a template literal string (e.g., export default `<html>...</html>`)."
+  );
+}
+function escapeRegExp(str) {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+export {
+  DEFAULT_CDN_DOMAINS,
+  DEFAULT_CSP_DIRECTIVES,
+  OPTIONAL_PLACEHOLDERS,
+  REQUIRED_PLACEHOLDERS,
+  RESTRICTIVE_CSP_DIRECTIVES,
+  SHELL_PLACEHOLDERS,
+  SHELL_PLACEHOLDER_NAMES,
+  applyShellTemplate,
+  buildCSPDirectives,
+  buildCSPMetaTag,
+  buildDataInjectionScript,
+  buildShell,
+  clearShellTemplateCache,
+  createTemplateHelpers,
+  isInlineShellSource,
+  isNpmShellSource,
+  isUrlShellSource,
+  resolveShellTemplate,
+  sanitizeCSPDomains,
+  validateCSPDomain,
+  validateShellTemplate
+};