@frontmcp/uipack 0.6.1

package/runtime/mcp-bridge.d.ts

@@ -0,0 +1,101 @@
+/**
+ * MCP Bridge Runtime
+ *
+ * Universal JavaScript runtime injected into UI templates that adapts
+ * to the host environment (OpenAI Apps SDK, ext-apps, Claude, etc.).
+ *
+ * This script is designed to be embedded directly into HTML templates
+ * via the MCP_BRIDGE_RUNTIME constant.
+ *
+ * Architecture:
+ * - On OpenAI: Proxy directly to native window.openai API
+ * - On Claude: Polyfill with limited functionality (network-blocked)
+ * - On ext-apps: JSON-RPC postMessage bridge (SEP-1865 compliant)
+ * - On Gemini: Gemini SDK integration
+ * - On Unknown: LocalStorage-based state, basic functionality
+ *
+ * @see https://developers.openai.com/apps-sdk/build/chatgpt-ui
+ * @see https://github.com/modelcontextprotocol/ext-apps (SEP-1865)
+ */
+/**
+ * The MCP Bridge runtime script.
+ * This is injected into UI templates to provide a unified API across providers.
+ *
+ * Uses the new FrontMcpBridge adapter system which supports:
+ * - OpenAI ChatGPT Apps SDK
+ * - ext-apps (SEP-1865 protocol)
+ * - Claude (Anthropic)
+ * - Gemini (Google)
+ * - Generic fallback
+ *
+ * The bridge exposes:
+ * - window.FrontMcpBridge - New unified bridge API
+ * - window.mcpBridge - Legacy compatibility bridge
+ * - window.openai - OpenAI polyfill for non-OpenAI platforms
+ *
+ * Provides full OpenAI window.openai API compatibility:
+ * - Properties: theme, userAgent, locale, maxHeight, displayMode, safeArea,
+ *               toolInput, toolOutput, toolResponseMetadata, widgetState
+ * - Methods: callTool, requestDisplayMode, requestClose, openExternal,
+ *            sendFollowUpMessage, setWidgetState
+ */
+export declare const MCP_BRIDGE_RUNTIME = "\n<script>\n(function() {\n  'use strict';\n\n  // ==================== Environment Detection ====================\n\n  var isOpenAI = typeof window.openai !== 'undefined';\n  var isExtApps = window.parent !== window && !isOpenAI;\n  var isClaude = typeof window.claude !== 'undefined' ||\n    (window.__mcpPlatform === 'claude');\n  var isGemini = window.__mcpPlatform === 'gemini';\n\n  // ==================== Internal State ====================\n\n  var messageId = 0;\n  var pendingRequests = new Map();\n  var contextChangeListeners = [];\n  var toolResultListeners = [];\n\n  // Default values for polyfilled properties\n  var defaultSafeArea = { top: 0, bottom: 0, left: 0, right: 0 };\n  var defaultUserAgent = { type: 'web', hover: true, touch: false };\n\n  // Host context (for ext-apps and polyfill mode)\n  var hostContext = window.__mcpHostContext || {\n    theme: 'light',\n    displayMode: 'inline'\n  };\n\n  // Trusted origin for postMessage validation (set during ext-apps initialization)\n  var trustedOrigin = null;\n\n  // Detect device capabilities\n  var detectUserAgent = function() {\n    var ua = navigator.userAgent || '';\n    var isMobile = /iPhone|iPad|iPod|Android/i.test(ua);\n    var hasTouch = 'ontouchstart' in window || navigator.maxTouchPoints > 0;\n    var hasHover = window.matchMedia && window.matchMedia('(hover: hover)').matches;\n    return {\n      type: isMobile ? 'mobile' : 'web',\n      hover: hasHover !== false,\n      touch: hasTouch\n    };\n  };\n\n  // Detect theme from system preference\n  var detectTheme = function() {\n    if (window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches) {\n      return 'dark';\n    }\n    return 'light';\n  };\n\n  // ==================== Bridge Implementation ====================\n\n  /**\n   * MCP Bridge provides full OpenAI API compatibility.\n   * On OpenAI, it proxies directly to window.openai.\n   * On other platforms, it provides polyfills.\n   */\n  var bridge = {\n    // ==================== Environment Info ====================\n\n    get provider() {\n      if (isOpenAI) return 'openai';\n      if (isClaude) return 'claude';\n      if (isGemini) return 'gemini';\n      if (isExtApps) return 'ext-apps';\n      return 'unknown';\n    },\n\n    // ==================== OpenAI-Compatible Properties ====================\n\n    get theme() {\n      if (isOpenAI && window.openai) {\n        return window.openai.theme || 'light';\n      }\n      return hostContext.theme || detectTheme();\n    },\n\n    get userAgent() {\n      if (isOpenAI && window.openai && window.openai.userAgent) {\n        return window.openai.userAgent;\n      }\n      return hostContext.userAgent || detectUserAgent();\n    },\n\n    get locale() {\n      if (isOpenAI && window.openai && window.openai.locale) {\n        return window.openai.locale;\n      }\n      return navigator.language || 'en-US';\n    },\n\n    get maxHeight() {\n      if (isOpenAI && window.openai) {\n        return window.openai.maxHeight;\n      }\n      return hostContext.viewport ? hostContext.viewport.maxHeight : undefined;\n    },\n\n    get displayMode() {\n      if (isOpenAI && window.openai) {\n        return window.openai.displayMode || 'inline';\n      }\n      return hostContext.displayMode || 'inline';\n    },\n\n    get safeArea() {\n      if (isOpenAI && window.openai && window.openai.safeArea) {\n        return window.openai.safeArea;\n      }\n      return hostContext.safeArea || defaultSafeArea;\n    },\n\n    get toolInput() {\n      if (isOpenAI && window.openai && window.openai.toolInput) {\n        return window.openai.toolInput;\n      }\n      return window.__mcpToolInput || {};\n    },\n\n    get toolOutput() {\n      if (isOpenAI && window.openai) {\n        return window.openai.toolOutput;\n      }\n      return window.__mcpToolOutput;\n    },\n\n    get structuredContent() {\n      // Alias for toolOutput to maintain compatibility\n      if (isOpenAI && window.openai) {\n        return window.openai.toolOutput;\n      }\n      return window.__mcpStructuredContent;\n    },\n\n    get toolResponseMetadata() {\n      if (isOpenAI && window.openai && window.openai.toolResponseMetadata) {\n        return window.openai.toolResponseMetadata;\n      }\n      return window.__mcpToolResponseMetadata || {};\n    },\n\n    get widgetState() {\n      if (isOpenAI && window.openai) {\n        return window.openai.widgetState || {};\n      }\n      // Polyfill: use localStorage\n      try {\n        var stored = localStorage.getItem('__mcpWidgetState');\n        return stored ? JSON.parse(stored) : {};\n      } catch (e) {\n        return {};\n      }\n    },\n\n    // ==================== OpenAI-Compatible Methods ====================\n\n    callTool: function(name, params) {\n      if (isOpenAI && window.openai && window.openai.callTool) {\n        return window.openai.callTool(name, params);\n      }\n      if (isClaude) {\n        return Promise.reject(new Error(\n          'Tool calls are not supported in Claude widgets (network-blocked sandbox)'\n        ));\n      }\n      if (isGemini) {\n        return Promise.reject(new Error(\n          'Tool calls are not supported in Gemini widgets'\n        ));\n      }\n      if (isExtApps) {\n        return this._sendRequest('tools/call', { name: name, arguments: params });\n      }\n      return Promise.reject(new Error('Tool calls not supported in this environment'));\n    },\n\n    requestDisplayMode: function(options) {\n      if (isOpenAI && window.openai && window.openai.requestDisplayMode) {\n        return window.openai.requestDisplayMode(options);\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/request-display-mode', options);\n      }\n      // Polyfill: just update local state\n      if (options && options.mode) {\n        hostContext.displayMode = options.mode;\n        contextChangeListeners.forEach(function(cb) {\n          try { cb({ displayMode: options.mode }); } catch (e) {}\n        });\n      }\n      return Promise.resolve();\n    },\n\n    requestClose: function() {\n      if (isOpenAI && window.openai && window.openai.requestClose) {\n        return window.openai.requestClose();\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/request-close', {});\n      }\n      // Polyfill: dispatch event for parent to handle\n      window.dispatchEvent(new CustomEvent('mcp:request-close'));\n      return Promise.resolve();\n    },\n\n    openExternal: function(options) {\n      var href = typeof options === 'string' ? options : (options && options.href);\n      if (!href) {\n        return Promise.reject(new Error('URL required'));\n      }\n      if (isOpenAI && window.openai && window.openai.openExternal) {\n        return window.openai.openExternal({ href: href });\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/open-link', { url: href });\n      }\n      // Fallback: open in new window\n      window.open(href, '_blank', 'noopener,noreferrer');\n      return Promise.resolve();\n    },\n\n    // Alias for openExternal (backwards compatibility)\n    openLink: function(url) {\n      return this.openExternal({ href: url });\n    },\n\n    sendFollowUpMessage: function(options) {\n      var prompt = typeof options === 'string' ? options : (options && options.prompt);\n      if (!prompt) {\n        return Promise.reject(new Error('Prompt required'));\n      }\n      if (isOpenAI && window.openai && window.openai.sendFollowUpMessage) {\n        return window.openai.sendFollowUpMessage({ prompt: prompt });\n      }\n      if (isClaude) {\n        return Promise.reject(new Error(\n          'Follow-up messages are not supported in Claude widgets (network-blocked sandbox)'\n        ));\n      }\n      if (isGemini) {\n        return Promise.reject(new Error(\n          'Follow-up messages are not supported in Gemini widgets'\n        ));\n      }\n      if (isExtApps) {\n        return this._sendRequest('ui/message', {\n          role: 'user',\n          content: { type: 'text', text: prompt }\n        });\n      }\n      return Promise.reject(new Error('Messages not supported in this environment'));\n    },\n\n    // Alias for sendFollowUpMessage (backwards compatibility)\n    sendMessage: function(content) {\n      return this.sendFollowUpMessage({ prompt: content });\n    },\n\n    setWidgetState: function(state) {\n      if (isOpenAI && window.openai && window.openai.setWidgetState) {\n        window.openai.setWidgetState(state);\n        return;\n      }\n      // Polyfill: persist to localStorage\n      try {\n        localStorage.setItem('__mcpWidgetState', JSON.stringify(state));\n      } catch (e) {\n        console.warn('Failed to persist widget state:', e);\n      }\n    },\n\n    // ==================== Context API (MCP-specific) ====================\n\n    get context() {\n      return {\n        theme: this.theme,\n        displayMode: this.displayMode,\n        viewport: this.maxHeight ? { maxHeight: this.maxHeight } : undefined,\n        userAgent: this.userAgent,\n        locale: this.locale,\n        safeArea: this.safeArea\n      };\n    },\n\n    onContextChange: function(callback) {\n      contextChangeListeners.push(callback);\n      return function() {\n        var index = contextChangeListeners.indexOf(callback);\n        if (index > -1) contextChangeListeners.splice(index, 1);\n      };\n    },\n\n    onToolResult: function(callback) {\n      toolResultListeners.push(callback);\n      return function() {\n        var index = toolResultListeners.indexOf(callback);\n        if (index > -1) toolResultListeners.splice(index, 1);\n      };\n    },\n\n    // ==================== Internal Methods ====================\n\n    _sendRequest: function(method, params) {\n      return new Promise(function(resolve, reject) {\n        var id = ++messageId;\n        pendingRequests.set(id, { resolve: resolve, reject: reject });\n\n        window.parent.postMessage({\n          jsonrpc: '2.0',\n          id: id,\n          method: method,\n          params: params\n        }, '*');\n\n        // Timeout after 30s\n        setTimeout(function() {\n          if (pendingRequests.has(id)) {\n            pendingRequests.delete(id);\n            reject(new Error('Request timeout'));\n          }\n        }, 30000);\n      });\n    },\n\n    _initExtApps: function() {\n      var self = this;\n      return this._sendRequest('ui/initialize', {}).then(function(result) {\n        if (result && result.hostContext) {\n          hostContext = Object.assign(hostContext, result.hostContext);\n        }\n        // Note: trustedOrigin is now set from first message event origin (trust-on-first-use)\n        // Send initialized notification\n        window.parent.postMessage({\n          jsonrpc: '2.0',\n          method: 'ui/notifications/initialized',\n          params: {}\n        }, '*');\n        return result;\n      });\n    }\n  };\n\n  // ==================== Event Handling ====================\n\n  window.addEventListener('message', function(event) {\n    var data = event.data;\n    if (!data || data.jsonrpc !== '2.0') return;\n\n    // Trust-on-first-use: Establish trusted origin from the first valid message\n    if (isExtApps && !trustedOrigin && event.origin) {\n      trustedOrigin = event.origin;\n    }\n\n    // Validate origin for ext-apps environment to prevent spoofed messages\n    if (isExtApps && trustedOrigin && event.origin !== trustedOrigin) {\n      console.warn('MCP Bridge: Ignoring message from untrusted origin:', event.origin);\n      return;\n    }\n\n    // Handle responses\n    if (data.id && pendingRequests.has(data.id)) {\n      var pending = pendingRequests.get(data.id);\n      pendingRequests.delete(data.id);\n\n      if (data.error) {\n        var err = new Error(data.error.message || 'Unknown error');\n        err.code = data.error.code;\n        err.data = data.error.data;\n        pending.reject(err);\n      } else {\n        pending.resolve(data.result);\n      }\n      return;\n    }\n\n    // Handle notifications\n    switch (data.method) {\n      case 'ui/notifications/tool-input':\n        window.__mcpToolInput = data.params && data.params.arguments;\n        window.dispatchEvent(new CustomEvent('mcp:tool-input', { detail: data.params }));\n        break;\n\n      case 'ui/notifications/tool-input-partial':\n        if (data.params && data.params.arguments) {\n          window.__mcpToolInput = Object.assign(window.__mcpToolInput || {}, data.params.arguments);\n        }\n        break;\n\n      case 'ui/notifications/tool-result':\n        window.__mcpToolOutput = data.params && data.params.content;\n        window.__mcpStructuredContent = data.params && data.params.structuredContent;\n        toolResultListeners.forEach(function(cb) {\n          try { cb(data.params); } catch (e) { console.error('Tool result listener error:', e); }\n        });\n        window.dispatchEvent(new CustomEvent('mcp:tool-result', { detail: data.params }));\n        break;\n\n      case 'ui/notifications/tool-cancelled':\n        window.dispatchEvent(new CustomEvent('mcp:tool-cancelled', { detail: data.params }));\n        break;\n\n      case 'ui/host-context-change':\n        hostContext = Object.assign(hostContext, data.params);\n        contextChangeListeners.forEach(function(cb) {\n          try { cb(data.params); } catch (e) { console.error('Context change listener error:', e); }\n        });\n        window.dispatchEvent(new CustomEvent('mcp:context-change', { detail: data.params }));\n        break;\n\n      case 'ui/size-change':\n        if (hostContext.viewport) {\n          hostContext.viewport = Object.assign(hostContext.viewport, data.params);\n        } else {\n          hostContext.viewport = data.params;\n        }\n        break;\n    }\n  });\n\n  // ==================== Initialize ====================\n\n  // Export bridge\n  window.mcpBridge = bridge;\n\n  // Also create window.openai polyfill for non-OpenAI platforms\n  // This allows code written for OpenAI to work on other platforms\n  if (!isOpenAI) {\n    window.openai = {\n      get theme() { return bridge.theme; },\n      get userAgent() { return bridge.userAgent; },\n      get locale() { return bridge.locale; },\n      get maxHeight() { return bridge.maxHeight; },\n      get displayMode() { return bridge.displayMode; },\n      get safeArea() { return bridge.safeArea; },\n      get toolInput() { return bridge.toolInput; },\n      get toolOutput() { return bridge.toolOutput; },\n      get toolResponseMetadata() { return bridge.toolResponseMetadata; },\n      get widgetState() { return bridge.widgetState; },\n      callTool: function(n, a) { return bridge.callTool(n, a); },\n      requestDisplayMode: function(o) { return bridge.requestDisplayMode(o); },\n      requestClose: function() { return bridge.requestClose(); },\n      openExternal: function(o) { return bridge.openExternal(o); },\n      sendFollowUpMessage: function(o) { return bridge.sendFollowUpMessage(o); },\n      setWidgetState: function(s) { return bridge.setWidgetState(s); }\n    };\n  }\n\n  // Auto-initialize for ext-apps\n  if (isExtApps) {\n    bridge._initExtApps().catch(function(err) {\n      console.warn('Failed to initialize MCP bridge:', err);\n    });\n  }\n\n  // Dispatch ready event\n  window.dispatchEvent(new CustomEvent('mcp:bridge-ready'));\n})();\n</script>\n";
+/**
+ * Get the MCP Bridge runtime script as a string (without script tags)
+ * Useful for inline embedding in specific scenarios.
+ */
+export declare function getMCPBridgeScript(): string;
+/**
+ * Check if the current environment supports the MCP bridge
+ */
+export declare function isMCPBridgeSupported(): boolean;
+/**
+ * The new FrontMcpBridge runtime script (universal - includes all adapters).
+ * This is the recommended bridge for new integrations.
+ *
+ * @example
+ * ```typescript
+ * import { FRONTMCP_BRIDGE_RUNTIME } from '@frontmcp/uipack/runtime';
+ * const html = `<!DOCTYPE html><html><head>${FRONTMCP_BRIDGE_RUNTIME}</head>...</html>`;
+ * ```
+ */
+export declare const FRONTMCP_BRIDGE_RUNTIME: string;
+/**
+ * Platform-specific bridge scripts.
+ *
+ * Use these for smaller bundle sizes when targeting a specific platform.
+ *
+ * @example
+ * ```typescript
+ * import { PLATFORM_BRIDGE_SCRIPTS } from '@frontmcp/uipack/runtime';
+ *
+ * // For ChatGPT only
+ * const chatgptHtml = `<html><head>${PLATFORM_BRIDGE_SCRIPTS.chatgpt}</head>...</html>`;
+ *
+ * // For Claude only
+ * const claudeHtml = `<html><head>${PLATFORM_BRIDGE_SCRIPTS.claude}</head>...</html>`;
+ * ```
+ */
+export declare const PLATFORM_BRIDGE_SCRIPTS: {
+    universal: string;
+    chatgpt: string;
+    claude: string;
+    gemini: string;
+};
+/**
+ * Generate a custom bridge script with specific options.
+ *
+ * @example
+ * ```typescript
+ * import { generateCustomBridge } from '@frontmcp/uipack/runtime';
+ *
+ * const script = generateCustomBridge({
+ *   adapters: ['openai', 'ext-apps'],
+ *   debug: true,
+ *   trustedOrigins: ['https://my-host.com']
+ * });
+ * ```
+ */
+export { generateBridgeIIFE as generateCustomBridge } from '../bridge-runtime';
+export type { IIFEGeneratorOptions } from '../bridge-runtime';
+//# sourceMappingURL=mcp-bridge.d.ts.map

package/runtime/mcp-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp-bridge.d.ts","sourceRoot":"","sources":["../../src/runtime/mcp-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,eAAO,MAAM,kBAAkB,koeA8c9B,CAAC;AAEF;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAI3C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAW9C;AAMD;;;;;;;;;GASG;AACH,eAAO,MAAM,uBAAuB,QAA+B,CAAC;AAEpE;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,uBAAuB;;;;;CAAqB,CAAC;AAE1D;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,kBAAkB,IAAI,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAG/E,YAAY,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/runtime/renderer-runtime.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Renderer Runtime
+ *
+ * Client-side runtime that manages renderer adapters and handles
+ * communication with the FrontMCP Bridge.
+ *
+ * @packageDocumentation
+ */
+import type { UIType, WidgetManifest } from '../types/ui-runtime';
+import type { RenderContext, RenderResult } from './adapters/types';
+/**
+ * Runtime configuration.
+ */
+export interface RendererRuntimeConfig {
+    /** The manifest embedded in the page */
+    manifest?: Partial<WidgetManifest>;
+    /** Initial tool input */
+    input?: Record<string, unknown>;
+    /** Initial tool output */
+    output?: unknown;
+    /** Initial structured content */
+    structuredContent?: unknown;
+    /** Tool name */
+    toolName?: string;
+    /** Enable debug logging */
+    debug?: boolean;
+}
+/**
+ * Renderer Runtime.
+ *
+ * Client-side runtime that:
+ * - Reads manifest from the page
+ * - Lazy-loads the appropriate renderer adapter
+ * - Handles tool output updates from the Bridge
+ * - Re-renders when data changes
+ *
+ * @example
+ * ```typescript
+ * // Bootstrap from manifest in page
+ * const runtime = new RendererRuntime();
+ * await runtime.init();
+ *
+ * // Listen for updates
+ * runtime.onUpdate((context) => {
+ *   console.log('Tool output updated:', context.output);
+ * });
+ * ```
+ */
+export declare class RendererRuntime {
+    private config;
+    private adapters;
+    private state;
+    private updateCallbacks;
+    private bridgeUnsubscribe;
+    constructor(config?: RendererRuntimeConfig);
+    /**
+     * Initialize the runtime.
+     * Reads manifest, sets up Bridge listeners, and prepares adapters.
+     */
+    init(): Promise<void>;
+    /**
+     * Get the current render context.
+     */
+    get context(): RenderContext;
+    /**
+     * Get the manifest.
+     */
+    get manifest(): Partial<WidgetManifest> | undefined;
+    /**
+     * Get the resolved UI type.
+     */
+    get uiType(): UIType;
+    /**
+     * Render content to a target element.
+     *
+     * @param target - Element to render into
+     * @param content - Content to render (optional, uses existing innerHTML)
+     * @param options - Render options
+     */
+    render(target: HTMLElement, content?: string, options?: {
+        hydrate?: boolean;
+    }): Promise<RenderResult>;
+    /**
+     * Update the render context and re-render if needed.
+     */
+    updateContext(updates: Partial<RenderContext>): Promise<void>;
+    /**
+     * Subscribe to context updates.
+     */
+    onUpdate(callback: (context: RenderContext) => void): () => void;
+    /**
+     * Clean up resources.
+     */
+    destroy(): void;
+    /**
+     * Read manifest from page.
+     */
+    private readManifest;
+    /**
+     * Read initial data from page globals.
+     */
+    private readPageGlobals;
+    /**
+     * Set up Bridge event listeners.
+     */
+    private setupBridgeListeners;
+    /**
+     * Get or load an adapter for a UI type.
+     */
+    private getAdapter;
+    /**
+     * Auto-detect UI type from content.
+     */
+    private detectType;
+    /**
+     * Log message if debug enabled.
+     */
+    private log;
+}
+/**
+ * Create and initialize a renderer runtime.
+ */
+export declare function createRendererRuntime(config?: RendererRuntimeConfig): Promise<RendererRuntime>;
+/**
+ * Bootstrap the renderer runtime from page manifest.
+ * This is the main entry point for the IIFE bootstrap script.
+ */
+export declare function bootstrapRendererRuntime(): Promise<RendererRuntime | null>;
+/**
+ * Generate the bootstrap IIFE script for embedding in HTML.
+ */
+export declare function generateBootstrapScript(): string;
+//# sourceMappingURL=renderer-runtime.d.ts.map

package/runtime/renderer-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderer-runtime.d.ts","sourceRoot":"","sources":["../../src/runtime/renderer-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,KAAK,EAAmB,aAAa,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAGrF;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,wCAAwC;IACxC,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,yBAAyB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,0BAA0B;IAC1B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,gBAAgB;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAYD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAwB;IACtC,OAAO,CAAC,QAAQ,CAAsC;IACtD,OAAO,CAAC,KAAK,CAAe;IAC5B,OAAO,CAAC,eAAe,CAA+C;IACtE,OAAO,CAAC,iBAAiB,CAA6B;gBAE1C,MAAM,GAAE,qBAA0B;IAe9C;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAoB3B;;OAEG;IACH,IAAI,OAAO,IAAI,aAAa,CAE3B;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,GAAG,SAAS,CAElD;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,CAEnB;IAED;;;;;;OAMG;IACG,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC;IAkC3G;;OAEG;IACG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBnE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,IAAI,GAAG,MAAM,IAAI;IAUhE;;OAEG;IACH,OAAO,IAAI,IAAI;IAmBf;;OAEG;IACH,OAAO,CAAC,YAAY;IAiCpB;;OAEG;IACH,OAAO,CAAC,eAAe;IAuCvB;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAoB5B;;OAEG;YACW,UAAU;IA8BxB;;OAEG;IACH,OAAO,CAAC,UAAU;IAwBlB;;OAEG;IACH,OAAO,CAAC,GAAG;CAKZ;AAED;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAIpG;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAiChF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAwBhD"}

package/runtime/sanitizer.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Input Sanitizer
+ *
+ * Provides PII detection and redaction for tool inputs before they are
+ * exposed to widget code. This protects sensitive data from being
+ * accidentally exposed in client-side widgets.
+ *
+ * Built-in patterns:
+ * - Email addresses → [EMAIL]
+ * - Phone numbers → [PHONE]
+ * - Credit card numbers → [CARD]
+ * - SSN / National IDs → [ID]
+ * - IP addresses → [IP]
+ *
+ * @example
+ * ```typescript
+ * import { sanitizeInput, createSanitizer } from './sanitizer';
+ *
+ * // Auto-detect and redact PII
+ * const sanitized = sanitizeInput({
+ *   user: 'john@example.com',
+ *   phone: '555-123-4567',
+ *   message: 'Hello world',
+ * });
+ * // Result: { user: '[EMAIL]', phone: '[PHONE]', message: 'Hello world' }
+ *
+ * // Redact specific fields
+ * const sanitized2 = sanitizeInput(data, ['email', 'ssn']);
+ *
+ * // Custom sanitizer
+ * const sanitized3 = sanitizeInput(data, (key, value) => {
+ *   if (key === 'secret') return '[REDACTED]';
+ *   return value;
+ * });
+ * ```
+ */
+/**
+ * Redaction placeholder tokens
+ */
+export declare const REDACTION_TOKENS: {
+    readonly EMAIL: "[EMAIL]";
+    readonly PHONE: "[PHONE]";
+    readonly CARD: "[CARD]";
+    readonly ID: "[ID]";
+    readonly IP: "[IP]";
+    readonly REDACTED: "[REDACTED]";
+};
+/**
+ * PII detection patterns
+ */
+export declare const PII_PATTERNS: {
+    email: RegExp;
+    emailInText: RegExp;
+    phone: RegExp;
+    phoneInText: RegExp;
+    creditCard: RegExp;
+    creditCardInText: RegExp;
+    ssn: RegExp;
+    ssnInText: RegExp;
+    ipv4: RegExp;
+    ipv4InText: RegExp;
+};
+/**
+ * Custom sanitizer function type
+ */
+export type SanitizerFn = (key: string, value: unknown, path: string[]) => unknown;
+/**
+ * Sanitizer options
+ */
+export interface SanitizeOptions {
+    /**
+     * How to handle PII detection:
+     * - true: Auto-detect and redact common PII patterns
+     * - string[]: Only redact values in fields with these names
+     * - SanitizerFn: Custom sanitizer function
+     */
+    mode: true | string[] | SanitizerFn;
+    /**
+     * Maximum depth for recursive sanitization
+     * @default 10
+     */
+    maxDepth?: number;
+    /**
+     * Whether to sanitize PII patterns within string values
+     * @default true
+     */
+    sanitizeInText?: boolean;
+}
+/**
+ * Check if a string matches an email pattern
+ */
+export declare function isEmail(value: string): boolean;
+/**
+ * Check if a string matches a phone pattern
+ */
+export declare function isPhone(value: string): boolean;
+/**
+ * Check if a string matches a credit card pattern
+ */
+export declare function isCreditCard(value: string): boolean;
+/**
+ * Check if a string matches an SSN pattern
+ */
+export declare function isSSN(value: string): boolean;
+/**
+ * Check if a string matches an IPv4 pattern
+ */
+export declare function isIPv4(value: string): boolean;
+/**
+ * Detect PII type in a string value
+ */
+export declare function detectPIIType(value: string): keyof typeof REDACTION_TOKENS | null;
+/**
+ * Redact PII patterns from text
+ */
+export declare function redactPIIFromText(text: string): string;
+/**
+ * Sanitize input data by redacting PII.
+ *
+ * @param input - The input data to sanitize
+ * @param mode - Sanitization mode:
+ *   - `true`: Auto-detect and redact common PII patterns
+ *   - `string[]`: Redact values in fields with these names
+ *   - `SanitizerFn`: Custom sanitizer function
+ * @returns Sanitized copy of the input
+ *
+ * @example
+ * ```typescript
+ * // Auto-detect PII
+ * sanitizeInput({ email: 'test@example.com' });
+ * // { email: '[EMAIL]' }
+ *
+ * // Redact specific fields
+ * sanitizeInput({ password: 'secret', name: 'John' }, ['password']);
+ * // { password: '[REDACTED]', name: 'John' }
+ *
+ * // Custom sanitizer
+ * sanitizeInput(data, (key, value) => key === 'token' ? '[TOKEN]' : value);
+ * ```
+ */
+export declare function sanitizeInput(input: Record<string, unknown>, mode?: true | string[] | SanitizerFn): Record<string, unknown>;
+/**
+ * Create a reusable sanitizer function with preset options.
+ *
+ * @param mode - Sanitization mode
+ * @returns Sanitizer function
+ *
+ * @example
+ * ```typescript
+ * const sanitizer = createSanitizer(['email', 'phone', 'ssn']);
+ *
+ * const clean1 = sanitizer(userData1);
+ * const clean2 = sanitizer(userData2);
+ * ```
+ */
+export declare function createSanitizer(mode?: true | string[] | SanitizerFn): (input: Record<string, unknown>) => Record<string, unknown>;
+/**
+ * Check if an object contains any detected PII.
+ * Does not modify the input.
+ *
+ * @param input - The input to check
+ * @param options - Optional configuration
+ * @param options.maxDepth - Maximum recursion depth (default: 10)
+ * @returns Object with boolean `hasPII` and `fields` array of field paths
+ */
+export declare function detectPII(input: Record<string, unknown>, options?: {
+    maxDepth?: number;
+}): {
+    hasPII: boolean;
+    fields: string[];
+};
+//# sourceMappingURL=sanitizer.d.ts.map

package/runtime/sanitizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../../src/runtime/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;;;;;;;CAOnB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;CA8BxB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,WAAW,CAAC;IAEpC;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE9C;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAInD;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE7C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,OAAO,gBAAgB,GAAG,IAAI,CAOjF;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAWtD;AA0FD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,IAAI,GAAE,IAAI,GAAG,MAAM,EAAE,GAAG,WAAkB,GACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAczB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,eAAe,CAC7B,IAAI,GAAE,IAAI,GAAG,MAAM,EAAE,GAAG,WAAkB,GACzC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE7D;AAED;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GAC9B;IACD,MAAM,EAAE,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CA0CA"}