@frontmcp/uipack 0.6.3 → 0.7.2

package/index.js

@@ -30,79 +30,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
-// libs/uipack/src/utils/safe-stringify.ts
-function safeStringify(value, space) {
-  const seen = /* @__PURE__ */ new WeakSet();
-  try {
-    return JSON.stringify(
-      value,
-      (_key, val) => {
-        if (typeof val === "object" && val !== null) {
-          if (seen.has(val)) return "[Circular]";
-          seen.add(val);
-        }
-        return val;
-      },
-      space
-    );
-  } catch {
-    return JSON.stringify({ error: "Output could not be serialized" });
-  }
-}
-var init_safe_stringify = __esm({
-  "libs/uipack/src/utils/safe-stringify.ts"() {
-    "use strict";
-  }
-});
-
-// libs/uipack/src/utils/escape-html.ts
-function escapeHtml(str) {
-  if (str === null || str === void 0) {
-    return "";
-  }
-  const s = String(str);
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-function escapeHtmlAttr(str) {
-  return str.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-}
-function escapeJsString(str) {
-  return str.replace(/\\/g, "\\\\").replace(/'/g, "\\'").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
-}
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
-}
-function safeJsonForScript(value) {
-  if (value === void 0) {
-    return "null";
-  }
-  try {
-    const jsonString = JSON.stringify(value, (_key, val) => {
-      if (typeof val === "bigint") {
-        return val.toString();
-      }
-      return val;
-    });
-    if (jsonString === void 0) {
-      return "null";
-    }
-    return escapeScriptClose(jsonString);
-  } catch {
-    return '{"error":"Value could not be serialized"}';
-  }
-}
-var init_escape_html = __esm({
-  "libs/uipack/src/utils/escape-html.ts"() {
-    "use strict";
-  }
-});
-
 // libs/uipack/src/utils/index.ts
+var import_utils;
 var init_utils = __esm({
   "libs/uipack/src/utils/index.ts"() {
     "use strict";
-    init_safe_stringify();
-    init_escape_html();
+    import_utils = require("@frontmcp/utils");
   }
 });
 
@@ -820,6 +753,13 @@ var init_theme = __esm({
 
 // libs/uipack/src/theme/css-to-theme.ts
 function cssToTailwindTheme(userCss) {
+  if (userCss.length > MAX_CSS_INPUT_LENGTH) {
+    return {
+      themeBlock: "",
+      remainingCss: userCss,
+      colorVars: /* @__PURE__ */ new Map()
+    };
+  }
   const colorVars = /* @__PURE__ */ new Map();
   const regex = new RegExp(COLOR_VAR_REGEX.source, "g");
   let match;
@@ -852,11 +792,12 @@ function buildTailwindStyleBlock(userCss) {
 ${parts.join("\n\n")}
 </style>`;
 }
-var COLOR_VAR_REGEX;
+var COLOR_VAR_REGEX, MAX_CSS_INPUT_LENGTH;
 var init_css_to_theme = __esm({
   "libs/uipack/src/theme/css-to-theme.ts"() {
     "use strict";
     COLOR_VAR_REGEX = /--(color-[\w-]+):\s*([^;]+);/g;
+    MAX_CSS_INPUT_LENGTH = 1e5;
   }
 });
 
@@ -901,6 +842,9 @@ function isTemplateBuilderFunction(fn) {
   return true;
 }
 function containsJsx(source) {
+  if (source.length > MAX_TEMPLATE_LENGTH) {
+    return false;
+  }
   if (/<[A-Z][a-zA-Z0-9]*(\s|>|\/)/.test(source)) {
     return true;
   }
@@ -925,6 +869,9 @@ function containsJsx(source) {
   return false;
 }
 function containsMdxSyntax(source) {
+  if (source.length > MAX_TEMPLATE_LENGTH) {
+    return false;
+  }
   if (/<[A-Z][a-zA-Z0-9]*/.test(source)) {
     return true;
   }
@@ -998,9 +945,11 @@ function detectTemplateType(template) {
     reason: "Unknown template type, defaulting to HTML"
   };
 }
+var MAX_TEMPLATE_LENGTH;
 var init_detect = __esm({
   "libs/uipack/src/renderers/utils/detect.ts"() {
     "use strict";
+    MAX_TEMPLATE_LENGTH = 5e4;
   }
 });
 
@@ -1221,7 +1170,7 @@ var init_helpers = __esm({
     idCounter = 0;
     builtinHelpers = {
       // Escaping
-      escapeHtml,
+      escapeHtml: import_utils.escapeHtml,
       // Formatting
       formatDate,
       formatCurrency,
@@ -1392,7 +1341,7 @@ __export(handlebars_exports, {
   createHandlebarsRenderer: () => createHandlebarsRenderer,
   defaultValue: () => defaultValue,
   eq: () => eq,
-  escapeHtml: () => escapeHtml,
+  escapeHtml: () => import_utils.escapeHtml,
   extractAll: () => extractAll,
   extractExpressions: () => extractExpressions,
   extractInputPaths: () => extractInputPaths,
@@ -2228,12 +2177,12 @@ var init_mdx_client_renderer = __esm({
           ...outputProps,
           ...props
         };
-        const escapedMdx = escapeScriptClose(JSON.stringify(template));
-        const escapedProps = escapeScriptClose(JSON.stringify(spreadProps));
-        const safeContainerId = escapeJsString(containerId);
-        const loadingHtml = showLoading ? `<div class="mdx-loading">${escapeHtml(loadingMessage)}</div>` : "";
+        const escapedMdx = (0, import_utils.escapeScriptClose)(JSON.stringify(template));
+        const escapedProps = (0, import_utils.escapeScriptClose)(JSON.stringify(spreadProps));
+        const safeContainerId = (0, import_utils.escapeJsString)(containerId);
+        const loadingHtml = showLoading ? `<div class="mdx-loading">${(0, import_utils.escapeHtml)(loadingMessage)}</div>` : "";
         return `
-<div id="${escapeHtml(containerId)}">${loadingHtml}</div>
+<div id="${(0, import_utils.escapeHtml)(containerId)}">${loadingHtml}</div>
 <script type="module">
 (async function() {
   try {
@@ -2446,7 +2395,7 @@ function sha256Buffer(buffer) {
 }
 async function hashFile(filePath) {
   try {
-    const content = await (0, import_promises.readFile)(filePath);
+    const content = await (0, import_utils8.readFileBuffer)(filePath);
     return sha256Buffer(content);
   } catch {
     return void 0;
@@ -2497,7 +2446,7 @@ async function collectLocalDependencies(filePath, baseDir, collected, maxDepth,
   if (!(0, import_fs.existsSync)(filePath)) return;
   collected.add(filePath);
   try {
-    const content = await (0, import_promises.readFile)(filePath, "utf8");
+    const content = await (0, import_utils8.readFile)(filePath);
     const imports = extractImportPaths(content);
     for (const importPath of imports) {
       if (!importPath.startsWith(".") && !importPath.startsWith("/")) {
@@ -2566,14 +2515,14 @@ function generateBuildId() {
   const random = Math.random().toString(36).substring(2, 10);
   return `${timestamp}-${random}`;
 }
-var import_crypto, import_promises, import_fs, import_path;
+var import_crypto, import_fs, import_path, import_utils8;
 var init_hash_calculator = __esm({
   "libs/uipack/src/bundler/file-cache/hash-calculator.ts"() {
     "use strict";
     import_crypto = require("crypto");
-    import_promises = require("fs/promises");
     import_fs = require("fs");
     import_path = require("path");
+    import_utils8 = require("@frontmcp/utils");
   }
 });
 
@@ -3420,13 +3369,16 @@ function generateUMDShim(dependencies, options = {}) {
     console.warn('UMD shim failed:', e);
   }
 })();` : `window.__esm_shim = ${shimObject};`;
-  return minify ? code.replace(/\s+/g, " ").replace(/\s*([{},:])\s*/g, "$1") : code;
+  if (minify && code.length <= 1e5) {
+    return code.replace(/\s+/g, " ").replace(/\s*([{},:])\s*/g, "$1");
+  }
+  return code;
 }
 function generateCDNScriptTags(dependencies) {
   return dependencies.filter((dep) => !dep.esm).map((dep) => {
-    const attrs = [`src="${escapeHtmlAttr(dep.cdnUrl)}"`];
+    const attrs = [`src="${(0, import_utils.escapeHtmlAttr)(dep.cdnUrl)}"`];
     if (dep.integrity) {
-      attrs.push(`integrity="${escapeHtmlAttr(dep.integrity)}"`);
+      attrs.push(`integrity="${(0, import_utils.escapeHtmlAttr)(dep.integrity)}"`);
     }
     attrs.push('crossorigin="anonymous"');
     return `<script ${attrs.join(" ")}></script>`;
@@ -3434,9 +3386,9 @@ function generateCDNScriptTags(dependencies) {
 }
 function generateESMScriptTags(dependencies) {
   return dependencies.filter((dep) => dep.esm).map((dep) => {
-    const attrs = ['type="module"', `src="${escapeHtmlAttr(dep.cdnUrl)}"`];
+    const attrs = ['type="module"', `src="${(0, import_utils.escapeHtmlAttr)(dep.cdnUrl)}"`];
     if (dep.integrity) {
-      attrs.push(`integrity="${escapeHtmlAttr(dep.integrity)}"`);
+      attrs.push(`integrity="${(0, import_utils.escapeHtmlAttr)(dep.integrity)}"`);
     }
     attrs.push('crossorigin="anonymous"');
     return `<script ${attrs.join(" ")}></script>`;
@@ -3722,14 +3674,14 @@ __export(filesystem_exports, {
 function createFilesystemStorage(options) {
   return new FilesystemStorage(options);
 }
-var import_promises2, import_path3, import_fs3, import_crypto3, CacheInitializationError, CacheOperationError, StorageNotInitializedError, DEFAULT_FS_OPTIONS, FilesystemStorage;
+var import_path3, import_fs3, import_crypto3, import_utils16, CacheInitializationError, CacheOperationError, StorageNotInitializedError, DEFAULT_FS_OPTIONS, FilesystemStorage;
 var init_filesystem = __esm({
   "libs/uipack/src/bundler/file-cache/storage/filesystem.ts"() {
     "use strict";
-    import_promises2 = require("fs/promises");
     import_path3 = require("path");
     import_fs3 = require("fs");
     import_crypto3 = require("crypto");
+    import_utils16 = require("@frontmcp/utils");
     init_interface();
     CacheInitializationError = class extends Error {
       cause;
@@ -3781,7 +3733,7 @@ var init_filesystem = __esm({
       async initialize() {
         if (this.initialized) return;
         try {
-          await (0, import_promises2.mkdir)(this.options.cacheDir, { recursive: true });
+          await (0, import_utils16.mkdir)(this.options.cacheDir, { recursive: true });
           await this.loadStats();
           this.initialized = true;
         } catch (error) {
@@ -3800,7 +3752,7 @@ var init_filesystem = __esm({
             this.updateHitRate();
             return void 0;
           }
-          const content = await (0, import_promises2.readFile)(filePath, "utf8");
+          const content = await (0, import_utils16.readFile)(filePath, "utf8");
           const entry = JSON.parse(content);
           if (Date.now() > entry.metadata.expiresAt) {
             await this.delete(key);
@@ -3856,7 +3808,7 @@ var init_filesystem = __esm({
         const filePath = this.getFilePath(key);
         try {
           if (!(0, import_fs3.existsSync)(filePath)) return false;
-          const content = await (0, import_promises2.readFile)(filePath, "utf8");
+          const content = await (0, import_utils16.readFile)(filePath, "utf8");
           const entry = JSON.parse(content);
           if (Date.now() > entry.metadata.expiresAt) {
             await this.delete(key);
@@ -3875,9 +3827,9 @@ var init_filesystem = __esm({
         const filePath = this.getFilePath(key);
         try {
           if (!(0, import_fs3.existsSync)(filePath)) return false;
-          const content = await (0, import_promises2.readFile)(filePath, "utf8");
+          const content = await (0, import_utils16.readFile)(filePath, "utf8");
           const entry = JSON.parse(content);
-          await (0, import_promises2.unlink)(filePath);
+          await (0, import_utils16.unlink)(filePath);
           this.stats.entries = Math.max(0, this.stats.entries - 1);
           this.stats.totalSize = Math.max(0, this.stats.totalSize - entry.metadata.size);
           return true;
@@ -3891,8 +3843,8 @@ var init_filesystem = __esm({
       async clear() {
         this.ensureInitialized();
         try {
-          await (0, import_promises2.rm)(this.options.cacheDir, { recursive: true, force: true });
-          await (0, import_promises2.mkdir)(this.options.cacheDir, { recursive: true });
+          await (0, import_utils16.rm)(this.options.cacheDir, { recursive: true, force: true });
+          await (0, import_utils16.mkdir)(this.options.cacheDir, { recursive: true });
           this.stats = {
             entries: 0,
             totalSize: 0,
@@ -3917,21 +3869,21 @@ var init_filesystem = __esm({
         this.ensureInitialized();
         let removed = 0;
         try {
-          const files = await (0, import_promises2.readdir)(this.options.cacheDir);
+          const files = await (0, import_utils16.readdir)(this.options.cacheDir);
           for (const file of files) {
             if (!file.endsWith(this.options.extension)) continue;
             const filePath = (0, import_path3.join)(this.options.cacheDir, file);
             try {
-              const content = await (0, import_promises2.readFile)(filePath, "utf8");
+              const content = await (0, import_utils16.readFile)(filePath, "utf8");
               const entry = JSON.parse(content);
               if (Date.now() > entry.metadata.expiresAt) {
-                await (0, import_promises2.unlink)(filePath);
+                await (0, import_utils16.unlink)(filePath);
                 this.stats.entries = Math.max(0, this.stats.entries - 1);
                 this.stats.totalSize = Math.max(0, this.stats.totalSize - entry.metadata.size);
                 removed++;
               }
             } catch {
-              await (0, import_promises2.unlink)(filePath).catch(() => {
+              await (0, import_utils16.unlink)(filePath).catch(() => {
               });
               removed++;
             }
@@ -3957,8 +3909,8 @@ var init_filesystem = __esm({
        * Write a cache entry to disk.
        */
       async writeEntry(filePath, entry) {
-        await (0, import_promises2.mkdir)((0, import_path3.dirname)(filePath), { recursive: true });
-        await (0, import_promises2.writeFile)(filePath, JSON.stringify(entry, null, 2), "utf8");
+        await (0, import_utils16.mkdir)((0, import_path3.dirname)(filePath), { recursive: true });
+        await (0, import_utils16.writeFile)(filePath, JSON.stringify(entry, null, 2));
       }
       /**
        * Ensure the storage is initialized.
@@ -3974,14 +3926,14 @@ var init_filesystem = __esm({
        */
       async loadStats() {
         try {
-          const files = await (0, import_promises2.readdir)(this.options.cacheDir);
+          const files = await (0, import_utils16.readdir)(this.options.cacheDir);
           let entries = 0;
           let totalSize = 0;
           for (const file of files) {
             if (!file.endsWith(this.options.extension)) continue;
             const filePath = (0, import_path3.join)(this.options.cacheDir, file);
             try {
-              const content = await (0, import_promises2.readFile)(filePath, "utf8");
+              const content = await (0, import_utils16.readFile)(filePath, "utf8");
               const entry = JSON.parse(content);
               entries++;
               totalSize += entry.metadata.size;
@@ -4010,7 +3962,7 @@ var init_filesystem = __esm({
        */
       async evictLRU() {
         try {
-          const files = await (0, import_promises2.readdir)(this.options.cacheDir);
+          const files = await (0, import_utils16.readdir)(this.options.cacheDir);
           let oldestKey = null;
           let oldestTime = Infinity;
           let corruptedFile = null;
@@ -4018,7 +3970,7 @@ var init_filesystem = __esm({
             if (!file.endsWith(this.options.extension)) continue;
             const filePath = (0, import_path3.join)(this.options.cacheDir, file);
             try {
-              const content = await (0, import_promises2.readFile)(filePath, "utf8");
+              const content = await (0, import_utils16.readFile)(filePath, "utf8");
               const entry = JSON.parse(content);
               if (entry.metadata.lastAccessedAt < oldestTime) {
                 oldestTime = entry.metadata.lastAccessedAt;
@@ -4030,7 +3982,7 @@ var init_filesystem = __esm({
           }
           if (corruptedFile) {
             try {
-              await (0, import_promises2.unlink)(corruptedFile);
+              await (0, import_utils16.unlink)(corruptedFile);
               this.stats.entries = Math.max(0, this.stats.entries - 1);
               return true;
             } catch {
@@ -4330,14 +4282,14 @@ async function createRedisBuilder(redisClient, keyPrefix = "frontmcp:ui:build:")
   await storage.initialize();
   return new ComponentBuilder(storage);
 }
-var import_promises3, import_fs4, import_path4, import_crypto4, ComponentBuilder;
+var import_fs4, import_path4, import_crypto4, import_utils17, ComponentBuilder;
 var init_component_builder = __esm({
   "libs/uipack/src/bundler/file-cache/component-builder.ts"() {
     "use strict";
-    import_promises3 = require("fs/promises");
     import_fs4 = require("fs");
     import_path4 = require("path");
     import_crypto4 = require("crypto");
+    import_utils17 = require("@frontmcp/utils");
     init_hash_calculator();
     init_resolver();
     init_import_map();
@@ -4384,7 +4336,7 @@ var init_component_builder = __esm({
             };
           }
         }
-        const source = await (0, import_promises3.readFile)(absoluteEntryPath, "utf8");
+        const source = await (0, import_utils17.readFile)(absoluteEntryPath, "utf8");
         const resolver = new DependencyResolver({ platform });
         const resolvedDeps = [];
         for (const pkg of externals) {
@@ -4707,10 +4659,10 @@ __export(index_exports, {
   detectTemplateMode: () => detectTemplateMode,
   detectTemplateType: () => detectTemplateType,
   errorDisplay: () => errorDisplay,
-  escapeHtml: () => escapeHtml,
-  escapeHtmlAttr: () => escapeHtmlAttr,
-  escapeJsString: () => escapeJsString,
-  escapeScriptClose: () => escapeScriptClose,
+  escapeHtml: () => import_utils.escapeHtml,
+  escapeHtmlAttr: () => import_utils.escapeHtmlAttr,
+  escapeJsString: () => import_utils.escapeJsString,
+  escapeScriptClose: () => import_utils.escapeScriptClose,
   executeTemplate: () => executeTemplate,
   executeTranspiledCode: () => executeTranspiledCode,
   extractExternalPackages: () => extractExternalPackages,
@@ -4814,8 +4766,8 @@ __export(index_exports, {
   rendererRegistry: () => rendererRegistry,
   resolveDependencies: () => resolveDependencies,
   resolveServingMode: () => resolveServingMode,
-  safeJsonForScript: () => safeJsonForScript,
-  safeStringify: () => safeStringify,
+  safeJsonForScript: () => import_utils.safeJsonForScript,
+  safeStringify: () => import_utils.safeStringify,
   sanitizeCSPDomains: () => sanitizeCSPDomains,
   sanitizeInput: () => sanitizeInput,
   sha256: () => sha256,
@@ -4930,16 +4882,13 @@ function buildUIMeta(options) {
     case "generic-mcp":
     case "gemini":
     default:
-      meta["frontmcp/html"] = html;
-      meta["frontmcp/mimeType"] = "text/html+mcp";
-      if (rendererType) meta["frontmcp/type"] = rendererType;
-      if (contentHash) meta["frontmcp/contentHash"] = contentHash;
-      if (manifestUri) meta["frontmcp/manifestUri"] = manifestUri;
-      if (token) meta["frontmcp/widgetToken"] = token;
-      if (directUrl) meta["frontmcp/directUrl"] = directUrl;
       meta["ui/html"] = html;
       meta["ui/mimeType"] = "text/html+mcp";
       if (rendererType) meta["ui/type"] = rendererType;
+      if (contentHash) meta["ui/contentHash"] = contentHash;
+      if (manifestUri) meta["ui/manifestUri"] = manifestUri;
+      if (token) meta["ui/widgetToken"] = token;
+      if (directUrl) meta["ui/directUrl"] = directUrl;
       if (platformType === "claude") {
         return buildClaudeMeta(meta, uiConfig);
       } else if (platformType === "gemini") {
@@ -4998,34 +4947,37 @@ function buildIDEMeta(meta, uiConfig) {
   }
   return meta;
 }
-function buildFrontMCPCSP(csp) {
-  const result = {};
-  if (csp.connectDomains?.length) {
-    result.connectDomains = csp.connectDomains;
-  }
-  if (csp.resourceDomains?.length) {
-    result.resourceDomains = csp.resourceDomains;
-  }
-  return result;
-}
 function buildGenericMeta(meta, uiConfig) {
-  if (uiConfig.widgetAccessible) {
-    meta["frontmcp/widgetAccessible"] = true;
-  }
   if (uiConfig.csp) {
-    meta["frontmcp/widgetCSP"] = buildFrontMCPCSP(uiConfig.csp);
+    const csp = {};
+    if (uiConfig.csp.connectDomains?.length) {
+      csp.connectDomains = uiConfig.csp.connectDomains;
+    }
+    if (uiConfig.csp.resourceDomains?.length) {
+      csp.resourceDomains = uiConfig.csp.resourceDomains;
+    }
+    if (Object.keys(csp).length > 0) {
+      meta["ui/csp"] = csp;
+    }
   }
   if (uiConfig.displayMode) {
-    meta["frontmcp/displayMode"] = uiConfig.displayMode;
-  }
-  if (uiConfig.widgetDescription) {
-    meta["frontmcp/widgetDescription"] = uiConfig.widgetDescription;
+    const displayModeMap = {
+      inline: "inline",
+      fullscreen: "fullscreen",
+      pip: "pip",
+      widget: "inline",
+      panel: "fullscreen"
+    };
+    const mappedMode = displayModeMap[uiConfig.displayMode];
+    if (mappedMode) {
+      meta["ui/displayMode"] = mappedMode;
+    }
   }
   if (uiConfig.prefersBorder !== void 0) {
-    meta["frontmcp/prefersBorder"] = uiConfig.prefersBorder;
+    meta["ui/prefersBorder"] = uiConfig.prefersBorder;
   }
   if (uiConfig.sandboxDomain) {
-    meta["frontmcp/domain"] = uiConfig.sandboxDomain;
+    meta["ui/domain"] = uiConfig.sandboxDomain;
   }
   return meta;
 }
@@ -5261,7 +5213,7 @@ function buildToolResponseContent(options) {
   const { rawOutput, htmlContent, servingMode, useStructuredContent, platformType } = options;
   if (servingMode === "static") {
     return {
-      content: [{ type: "text", text: safeStringify(rawOutput) }],
+      content: [{ type: "text", text: (0, import_utils.safeStringify)(rawOutput) }],
       structuredContent: useStructuredContent ? rawOutput : void 0,
       contentCleared: false,
       format: "json-only"
@@ -5269,7 +5221,7 @@ function buildToolResponseContent(options) {
   }
   if (servingMode === "hybrid") {
     return {
-      content: [{ type: "text", text: safeStringify(rawOutput) }],
+      content: [{ type: "text", text: (0, import_utils.safeStringify)(rawOutput) }],
       structuredContent: useStructuredContent ? rawOutput : void 0,
       contentCleared: false,
       format: "json-only"
@@ -5277,15 +5229,25 @@ function buildToolResponseContent(options) {
   }
   if (useStructuredContent) {
     if (htmlContent) {
-      return {
-        content: [{ type: "text", text: htmlContent }],
-        structuredContent: rawOutput,
-        contentCleared: false,
-        format: "structured-content"
-      };
+      const htmlInContent = platformType === "openai" || platformType === "ext-apps";
+      if (htmlInContent) {
+        return {
+          content: [{ type: "text", text: htmlContent }],
+          structuredContent: rawOutput,
+          contentCleared: false,
+          format: "structured-content"
+        };
+      } else {
+        return {
+          content: [{ type: "text", text: (0, import_utils.safeStringify)(rawOutput) }],
+          structuredContent: rawOutput,
+          contentCleared: false,
+          format: "structured-content"
+        };
+      }
     }
     return {
-      content: [{ type: "text", text: safeStringify(rawOutput) }],
+      content: [{ type: "text", text: (0, import_utils.safeStringify)(rawOutput) }],
       structuredContent: rawOutput,
       contentCleared: false,
       format: "json-only"
@@ -5306,7 +5268,7 @@ function buildToolResponseContent(options) {
           type: "text",
           text: `## Data
 \`\`\`json
-${safeStringify(
+${(0, import_utils.safeStringify)(
             rawOutput,
             2
           )}
@@ -5323,7 +5285,7 @@ ${htmlContent}
     };
   }
   return {
-    content: [{ type: "text", text: safeStringify(rawOutput, 2) }],
+    content: [{ type: "text", text: (0, import_utils.safeStringify)(rawOutput, 2) }],
     contentCleared: false,
     format: "json-only"
   };
@@ -6154,7 +6116,11 @@ FrontMcpBridge.prototype._setupDataToolCallHandler = function() {
 };
 `.trim();
 }
+var MAX_MINIFY_CODE_LENGTH = 5e5;
 function minifyJS(code) {
+  if (code.length > MAX_MINIFY_CODE_LENGTH) {
+    return code;
+  }
   return code.replace(/\/\*[\s\S]*?\*\//g, "").replace(/\/\/.*$/gm, "").replace(/\s+/g, " ").replace(/\s*([{};,:()[\]])\s*/g, "$1").replace(/;\}/g, "}").trim();
 }
 function generatePlatformBundle(platform, options = {}) {
@@ -6794,7 +6760,11 @@ function detectPIIType(value) {
   if (isIPv4(value)) return "IP";
   return null;
 }
+var MAX_PII_TEXT_LENGTH = 1e5;
 function redactPIIFromText(text) {
+  if (text.length > MAX_PII_TEXT_LENGTH) {
+    return text;
+  }
   let result = text;
   result = result.replace(PII_PATTERNS.creditCardInText, REDACTION_TOKENS.CARD);
   result = result.replace(PII_PATTERNS.ssnInText, REDACTION_TOKENS.ID);
@@ -6913,7 +6883,7 @@ function createTemplateHelpers() {
     /**
      * Escape HTML special characters to prevent XSS
      */
-    escapeHtml,
+    escapeHtml: import_utils.escapeHtml,
     /**
      * Format a date for display
      */
@@ -7017,7 +6987,7 @@ function wrapToolUI(options) {
     widgetAccessible,
     hostContext
   });
-  const pageTitle = title || `${escapeHtml(toolName)} - Tool Result`;
+  const pageTitle = title || `${(0, import_utils.escapeHtml)(toolName)} - Tool Result`;
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -7170,7 +7140,7 @@ function wrapToolUIUniversal(options) {
     resourceMode
   });
   const bridgeScript = includeBridge ? BRIDGE_SCRIPT_TAGS.universal : "";
-  const pageTitle = title || `${escapeHtml(toolName)} - Tool Result`;
+  const pageTitle = title || `${(0, import_utils.escapeHtml)(toolName)} - Tool Result`;
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -7284,7 +7254,7 @@ function wrapToolUIMinimal(options) {
   window.__mcpWidgetAccessible = ${helpers.jsonEmbed(widgetAccessible)};
   window.__mcpHostContext = ${helpers.jsonEmbed(contextData)};
 </script>`;
-  const pageTitle = title || `${escapeHtml(toolName)} - Tool Result`;
+  const pageTitle = title || `${(0, import_utils.escapeHtml)(toolName)} - Tool Result`;
   return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -7434,7 +7404,7 @@ function wrapLeanWidgetShell(options) {
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${escapeHtml(title || toolName)}</title>
+  <title>${(0, import_utils.escapeHtml)(title || toolName)}</title>
   ${fontPreconnect}
   ${fontStylesheets}
   ${tailwindScript}
@@ -7835,7 +7805,7 @@ function wrapHybridWidgetShell(options) {
 <head>
   <meta charset="UTF-8">
   <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>${escapeHtml(title || toolName)}</title>
+  <title>${(0, import_utils.escapeHtml)(title || toolName)}</title>
   ${fontPreconnect}
   ${fontStylesheets}
   ${tailwindScript}
@@ -8377,7 +8347,7 @@ function wrapStaticWidgetUniversal(options) {
     }, 100);
   }
   </script>` : "";
-  const pageTitle = title || `${escapeHtml(toolName)} - Tool Widget`;
+  const pageTitle = title || `${(0, import_utils.escapeHtml)(toolName)} - Tool Widget`;
   const loaderHtml = isReactBased && componentCode && !hasEmbeddedData ? `
   <!-- Loading State -->
   <div id="frontmcp-loader" style="display: flex; align-items: center; justify-content: center; padding: 2rem; gap: 0.5rem;">
@@ -8559,13 +8529,13 @@ function validationErrorBox(options) {
   class="validation-error flex items-start gap-3 p-4 bg-red-50 border border-red-200 text-red-800 rounded-lg"
   role="alert"
   data-testid="validation-error"
-  data-component="${escapeHtml(componentName)}"
-  data-param="${escapeHtml(invalidParam)}"
+  data-component="${(0, import_utils.escapeHtml)(componentName)}"
+  data-param="${(0, import_utils.escapeHtml)(invalidParam)}"
 >
   ${errorIcon}
   <div class="min-w-0">
-    <p class="font-semibold text-sm">${escapeHtml(componentName)}: Invalid Configuration</p>
-    <p class="text-sm opacity-90 mt-0.5">The "${escapeHtml(invalidParam)}" parameter is invalid.</p>
+    <p class="font-semibold text-sm">${(0, import_utils.escapeHtml)(componentName)}: Invalid Configuration</p>
+    <p class="text-sm opacity-90 mt-0.5">The "${(0, import_utils.escapeHtml)(invalidParam)}" parameter is invalid.</p>
   </div>
 </div>`;
 }
@@ -8779,7 +8749,7 @@ function describeZodType(schema) {
 }
 
 // libs/uipack/src/validation/template-validator.ts
-init_expression_extractor();
+init_handlebars();
 function validateTemplate(template, outputSchema, options = {}) {
   const { inputSchema, warnOnOptional = true, suggestSimilar = true, maxSuggestionDistance = 3 } = options;
   const errors = [];
@@ -9145,7 +9115,7 @@ function safeInputToRecord(input) {
   return {};
 }
 var defaultHelpers = {
-  escapeHtml,
+  escapeHtml: import_utils.escapeHtml,
   formatDate: (date, format) => {
     const d = date instanceof Date ? date : new Date(date);
     if (format === "iso") return d.toISOString();
@@ -10002,7 +9972,7 @@ var BaseBuilder = class {
       "<head>",
       '<meta charset="UTF-8">',
       '<meta name="viewport" content="width=device-width, initial-scale=1.0">',
-      `<title>${escapeHtml(title)}</title>`
+      `<title>${(0, import_utils.escapeHtml)(title)}</title>`
     ];
     parts.push(buildFontPreconnect());
     parts.push(buildFontStylesheets({ inter: true }));
@@ -10119,7 +10089,7 @@ ${body}
       input,
       output,
       helpers: {
-        escapeHtml,
+        escapeHtml: import_utils.escapeHtml,
         formatDate: (date, format) => {
           const d = typeof date === "string" ? new Date(date) : date;
           if (isNaN(d.getTime())) return String(date);
@@ -11213,11 +11183,11 @@ var OpenAIPreview = class {
     const theme = mockData?.theme || "light";
     const displayMode = mockData?.displayMode || "inline";
     const toolResponses = mockData?.toolResponses || {};
-    const safeTheme = safeJsonForScript(theme);
-    const safeDisplayMode = safeJsonForScript(displayMode);
-    const safeToolResponses = safeJsonForScript(toolResponses);
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
+    const safeTheme = (0, import_utils.safeJsonForScript)(theme);
+    const safeDisplayMode = (0, import_utils.safeJsonForScript)(displayMode);
+    const safeToolResponses = (0, import_utils.safeJsonForScript)(toolResponses);
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
     const mockScript = `
       <script>
         // Mock window.openai for builder mode
@@ -11258,8 +11228,8 @@ var OpenAIPreview = class {
    */
   combineHybridForBuilder(result, input, output, mockData) {
     let html = result.vendorShell;
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
     html = html.replace(DATA_PLACEHOLDERS.input, `window.__mcpToolInput = ${safeInput};`).replace(DATA_PLACEHOLDERS.output, `window.__mcpToolOutput = ${safeOutput};`).replace(DATA_PLACEHOLDERS.structuredContent, `window.__mcpStructuredContent = ${safeOutput};`);
     const componentScript = `
       <script type="module">
@@ -11334,8 +11304,8 @@ var ClaudePreview = class {
   }
   forExecutionHybrid(result, input, output) {
     let html = result.vendorShell;
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
     html = html.replace(DATA_PLACEHOLDERS2.input, `window.__mcpToolInput = ${safeInput};`).replace(DATA_PLACEHOLDERS2.output, `window.__mcpToolOutput = ${safeOutput};`).replace(DATA_PLACEHOLDERS2.structuredContent, `window.__mcpStructuredContent = ${safeOutput};`);
     const componentScript = `
       <script type="module">
@@ -11396,9 +11366,9 @@ var ClaudePreview = class {
    * to prevent XSS attacks from malicious data.
    */
   buildClaudeInlineHtml(input, output) {
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
-    const escapedOutputDisplay = escapeHtml(JSON.stringify(output, null, 2));
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
+    const escapedOutputDisplay = (0, import_utils.escapeHtml)(JSON.stringify(output, null, 2));
     return `<!DOCTYPE html>
 <html lang="en">
 <head>
@@ -11475,13 +11445,12 @@ var GenericPreview = class {
   forDiscoveryStatic(result, toolName, _description) {
     const resourceUri = `resource://widget/${toolName}`;
     const _meta = {
-      // Primary namespace
-      "frontmcp/outputTemplate": resourceUri,
-      "frontmcp/widgetCSP": {
-        connect_domains: ["esm.sh", "cdn.tailwindcss.com"],
-        resource_domains: ["esm.sh", "cdn.tailwindcss.com", "fonts.googleapis.com", "fonts.gstatic.com"]
+      // Use ui/* namespace for generic MCP clients
+      "ui/resourceUri": resourceUri,
+      "ui/widgetCSP": {
+        connectDomains: ["esm.sh", "cdn.tailwindcss.com"],
+        resourceDomains: ["esm.sh", "cdn.tailwindcss.com", "fonts.googleapis.com", "fonts.gstatic.com"]
       },
-      // Fallback for compatibility
       "ui/mimeType": "text/html+mcp"
     };
     return {
@@ -11492,10 +11461,11 @@ var GenericPreview = class {
   }
   forDiscoveryHybrid(result, _toolName, _description) {
     const _meta = {
-      "frontmcp/outputTemplate": result.shellResourceUri,
-      "frontmcp/widgetCSP": {
-        connect_domains: ["esm.sh", "cdn.tailwindcss.com"],
-        resource_domains: ["esm.sh", "cdn.tailwindcss.com", "fonts.googleapis.com", "fonts.gstatic.com"]
+      // Use ui/* namespace for generic MCP clients
+      "ui/resourceUri": result.shellResourceUri,
+      "ui/widgetCSP": {
+        connectDomains: ["esm.sh", "cdn.tailwindcss.com"],
+        resourceDomains: ["esm.sh", "cdn.tailwindcss.com", "fonts.googleapis.com", "fonts.gstatic.com"]
       },
       "ui/mimeType": "text/html+mcp"
     };
@@ -11507,7 +11477,7 @@ var GenericPreview = class {
   }
   forDiscoveryInline(result, _toolName, _description) {
     const _meta = {
-      "frontmcp/html": result.loaderShell,
+      // Use ui/* namespace for generic MCP clients
       "ui/html": result.loaderShell,
       "ui/mimeType": "text/html+mcp"
     };
@@ -11523,7 +11493,6 @@ var GenericPreview = class {
       const html = this.injectBuilderMode(result.html, input, output, mockData);
       return {
         _meta: {
-          "frontmcp/html": html,
           "ui/html": html
         },
         html,
@@ -11539,13 +11508,12 @@ var GenericPreview = class {
   }
   forExecutionHybrid(result, input, output, builderMode, mockData) {
     const _meta = {
-      "frontmcp/component": result.componentChunk
+      "ui/component": result.componentChunk
     };
     if (builderMode) {
       const html = this.combineHybridForBuilder(result, input, output, mockData);
       return {
         _meta: {
-          "frontmcp/html": html,
           "ui/html": html
         },
         html,
@@ -11561,7 +11529,6 @@ var GenericPreview = class {
   }
   forExecutionInline(result, input, output, _builderMode, _mockData) {
     const _meta = {
-      "frontmcp/html": "<!-- Full widget will be generated -->",
       "ui/html": "<!-- Full widget will be generated -->"
     };
     return {
@@ -11583,11 +11550,11 @@ var GenericPreview = class {
     const theme = mockData?.theme || "light";
     const displayMode = mockData?.displayMode || "inline";
     const toolResponses = mockData?.toolResponses || {};
-    const safeTheme = safeJsonForScript(theme);
-    const safeDisplayMode = safeJsonForScript(displayMode);
-    const safeToolResponses = safeJsonForScript(toolResponses);
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
+    const safeTheme = (0, import_utils.safeJsonForScript)(theme);
+    const safeDisplayMode = (0, import_utils.safeJsonForScript)(displayMode);
+    const safeToolResponses = (0, import_utils.safeJsonForScript)(toolResponses);
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
     const mockScript = `
       <script>
         // Mock FrontMCP bridge for builder mode
@@ -11620,8 +11587,8 @@ var GenericPreview = class {
    */
   combineHybridForBuilder(result, input, output, mockData) {
     let html = result.vendorShell;
-    const safeInput = safeJsonForScript(input);
-    const safeOutput = safeJsonForScript(output);
+    const safeInput = (0, import_utils.safeJsonForScript)(input);
+    const safeOutput = (0, import_utils.safeJsonForScript)(output);
     html = html.replace(DATA_PLACEHOLDERS3.input, `window.__mcpToolInput = ${safeInput};`).replace(DATA_PLACEHOLDERS3.output, `window.__mcpToolOutput = ${safeOutput};`).replace(DATA_PLACEHOLDERS3.structuredContent, `window.__mcpStructuredContent = ${safeOutput};`);
     const componentScript = `
       <script type="module">
@@ -11727,16 +11694,16 @@ function heading(text, level = 2) {
     3: "text-lg font-medium text-text-primary mb-2",
     4: "text-base font-medium text-text-secondary mb-2"
   }[level] || "";
-  return `<${tag} class="${classes}">${escapeHtml(text)}</${tag}>`;
+  return `<${tag} class="${classes}">${(0, import_utils.escapeHtml)(text)}</${tag}>`;
 }
 function paragraph(text, className = "") {
-  return `<p class="text-text-secondary ${className}">${escapeHtml(text)}</p>`;
+  return `<p class="text-text-secondary ${className}">${(0, import_utils.escapeHtml)(text)}</p>`;
 }
 function keyValue(key, value, className = "") {
   const displayValue = typeof value === "boolean" ? value ? "Yes" : "No" : String(value);
   return `<div class="flex justify-between items-center py-2 border-b border-border ${className}">
-    <span class="text-text-secondary">${escapeHtml(key)}</span>
-    <span class="text-text-primary font-medium">${escapeHtml(displayValue)}</span>
+    <span class="text-text-secondary">${(0, import_utils.escapeHtml)(key)}</span>
+    <span class="text-text-primary font-medium">${(0, import_utils.escapeHtml)(displayValue)}</span>
   </div>`;
 }
 function dataList(items) {
@@ -11749,9 +11716,9 @@ function errorDisplay(message, details) {
       <svg class="w-5 h-5" fill="currentColor" viewBox="0 0 20 20">
         <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zM8.707 7.293a1 1 0 00-1.414 1.414L8.586 10l-1.293 1.293a1 1 0 101.414 1.414L10 11.414l1.293 1.293a1 1 0 001.414-1.414L11.414 10l1.293-1.293a1 1 0 00-1.414-1.414L10 8.586 8.707 7.293z" clip-rule="evenodd"/>
       </svg>
-      <span class="font-medium">${escapeHtml(message)}</span>
+      <span class="font-medium">${(0, import_utils.escapeHtml)(message)}</span>
     </div>
-    ${details ? `<p class="mt-2 text-sm text-text-secondary">${escapeHtml(details)}</p>` : ""}
+    ${details ? `<p class="mt-2 text-sm text-text-secondary">${(0, import_utils.escapeHtml)(details)}</p>` : ""}
   </div>`;
 }
 function successDisplay(message, details) {
@@ -11760,9 +11727,9 @@ function successDisplay(message, details) {
       <svg class="w-5 h-5" fill="currentColor" viewBox="0 0 20 20">
         <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.293a1 1 0 00-1.414-1.414L9 10.586 7.707 9.293a1 1 0 00-1.414 1.414l2 2a1 1 0 001.414 0l4-4z" clip-rule="evenodd"/>
       </svg>
-      <span class="font-medium">${escapeHtml(message)}</span>
+      <span class="font-medium">${(0, import_utils.escapeHtml)(message)}</span>
     </div>
-    ${details ? `<p class="mt-2 text-sm text-text-secondary">${escapeHtml(details)}</p>` : ""}
+    ${details ? `<p class="mt-2 text-sm text-text-secondary">${(0, import_utils.escapeHtml)(details)}</p>` : ""}
   </div>`;
 }
 function loadingDisplay(message = "Loading...") {
@@ -11772,7 +11739,7 @@ function loadingDisplay(message = "Loading...") {
         <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle>
         <path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path>
       </svg>
-      <span>${escapeHtml(message)}</span>
+      <span>${(0, import_utils.escapeHtml)(message)}</span>
     </div>
   </div>`;
 }
@@ -12746,7 +12713,11 @@ init_renderers();
 var import_crypto2 = require("crypto");
 
 // libs/uipack/src/registry/render-template.ts
+var MAX_MDX_SOURCE_LENGTH = 1e5;
 function containsMdxSyntax2(source) {
+  if (source.length > MAX_MDX_SOURCE_LENGTH) {
+    return false;
+  }
   if (/<[A-Z][a-zA-Z0-9]*/.test(source)) {
     return true;
   }
@@ -13589,7 +13560,11 @@ function getSubpathFromSpecifier(specifier) {
   }
   return void 0;
 }
+var MAX_IMPORT_STATEMENT_LENGTH = 2e3;
 function parseImportStatement(statement) {
+  if (statement.length > MAX_IMPORT_STATEMENT_LENGTH) {
+    return null;
+  }
   const namedMatch = /import\s+(?:\{[^}]*\}|\*\s+as\s+\w+|\w+)\s+from\s+['"]([^'"]+)['"]/.exec(statement);
   if (namedMatch) {
     return namedMatch[1];