@frontmcp/uipack 1.8.5 → 1.8.7

package/adapters/index.js

@@ -669,6 +669,23 @@ function __applySizingCss(sizing) {
   }
 }
 
+function __measureHeight() {
+  // <html> at fit-content includes body margins and collapsed child margins;
+  // content overflowing a fixed-height body is added; a px max-height clamps.
+  var de = document.documentElement;
+  var body = document.body;
+  if (!de || !body) return 0;
+  var prev = de.style.height;
+  de.style.height = 'fit-content';
+  var dr = de.getBoundingClientRect();
+  var br = body.getBoundingClientRect();
+  var h = Math.max(dr.height, br.top + body.scrollHeight + Math.max(0, dr.bottom - br.bottom) - dr.top);
+  de.style.height = prev;
+  var maxHeight = getComputedStyle(de).maxHeight;
+  var mx = maxHeight && maxHeight.slice(-2) === 'px' ? parseFloat(maxHeight) : NaN;
+  return Math.ceil(isNaN(mx) ? h : Math.min(h, mx));
+}
+
 function __initAutoResize() {
   if (typeof window === 'undefined') return;
   // Idempotent: a re-injected IIFE must not stack observers.
@@ -691,23 +708,30 @@ function __initAutoResize() {
   if (typeof ResizeObserver === 'undefined') return;
 
   function startObserving() {
-    var target = document.getElementById('root') || document.body;
-    if (!target) return;
+    if (!document.body) return;
+    var targets = [document.documentElement, document.body];
+    var root = document.getElementById('root');
+    if (root) targets.push(root);
 
     var rafId = null;
     var lastReported = -1;
     function report() {
       rafId = null;
       try {
-        var rect = target.getBoundingClientRect();
-        var height = Math.ceil(rect.height);
-        var width = Math.ceil(rect.width);
+        // Before the handshake an ext-apps host can't receive the report; the
+        // bridge:ready listener below sends it once the bridge is up.
+        if (window.FrontMcpBridge && window.FrontMcpBridge.initialized === false) return;
+        var height = __measureHeight();
+        var width = Math.ceil(document.documentElement.getBoundingClientRect().width);
         if (height === lastReported || height <= 0) return;
         lastReported = height;
         var payload = { height: height, width: width };
         if (sizing.aspectRatio != null) payload.aspectRatio = sizing.aspectRatio;
         if (window.FrontMcpBridge && typeof window.FrontMcpBridge.setSize === 'function') {
-          window.FrontMcpBridge.setSize(payload).catch(function() {});
+          window.FrontMcpBridge.setSize(payload).catch(function() {
+            // Forget a rejected report so the same height is sent again.
+            if (lastReported === height) lastReported = -1;
+          });
         }
         window.dispatchEvent(new CustomEvent('widget:resize', { detail: payload }));
       } catch (e) {}
@@ -728,9 +752,17 @@ function __initAutoResize() {
         window.__mcpResizeObserver.disconnect();
       }
       var ro = new ResizeObserver(function() { schedule(); });
-      ro.observe(target);
+      for (var i = 0; i < targets.length; i++) ro.observe(targets[i]);
       window.__mcpResizeObserver = ro;
     } catch (e) {}
+    // Report once the bridge is ready (the report scheduled below is skipped
+    // while the handshake is still pending).
+    var readySent = false;
+    window.addEventListener('bridge:ready', function() {
+      if (readySent) return;
+      readySent = true;
+      schedule();
+    });
     // Report once on init so the host gets an initial measurement.
     schedule();
   }
@@ -778,12 +810,57 @@ function detectViewport() {
   return undefined;
 }
 
+function __applyHostTheme(theme) {
+  // Follow a host-supplied theme: <meta name="color-scheme"> sets the frame's
+  // canvas and form controls (a widget's own :root color-scheme still wins),
+  // <html data-theme> is a styling hook. The OS fallback is never written.
+  if (theme !== 'light' && theme !== 'dark') return;
+  if (typeof document === 'undefined' || !document.documentElement) return;
+  try {
+    var meta = document.querySelector('meta[name="color-scheme"]');
+    var head = document.head || document.getElementsByTagName('head')[0];
+    if (!meta && head) {
+      meta = document.createElement('meta');
+      meta.setAttribute('name', 'color-scheme');
+      head.appendChild(meta);
+    }
+    if (meta) meta.setAttribute('content', theme);
+    document.documentElement.setAttribute('data-theme', theme);
+  } catch (e) {}
+}
+
+function extractToolOutput(params) {
+  // A host sends a CallToolResult: prefer structuredContent, then parsed text, then the raw content.
+  if (!params) return undefined;
+  if (params.structuredContent !== undefined && params.structuredContent !== null) return params.structuredContent;
+  var content = params.content;
+  if (Array.isArray(content)) {
+    for (var i = 0; i < content.length; i++) {
+      var item = content[i];
+      if (item && item.type === 'text' && typeof item.text === 'string') {
+        try { return JSON.parse(item.text); } catch (e) { return item.text; }
+      }
+    }
+  }
+  return content;
+}
+
 function readInjectedData() {
   var data = { toolInput: {}, toolOutput: undefined, structuredContent: undefined };
   if (typeof window !== 'undefined') {
     if (window.__mcpToolInput) data.toolInput = window.__mcpToolInput;
     if (window.__mcpToolOutput) data.toolOutput = window.__mcpToolOutput;
     if (window.__mcpStructuredContent) data.structuredContent = window.__mcpStructuredContent;
+    // The OpenAI Apps SDK hands the widget its data as window.openai.toolInput / toolOutput
+    // (toolOutput is the tool's structuredContent).
+    var oa = window.openai;
+    if (oa && typeof oa === 'object') {
+      if (oa.toolInput && !window.__mcpToolInput) data.toolInput = oa.toolInput;
+      if (oa.toolOutput !== undefined && oa.toolOutput !== null) {
+        if (data.toolOutput === undefined) data.toolOutput = oa.toolOutput;
+        if (data.structuredContent === undefined) data.structuredContent = oa.toolOutput;
+      }
+    }
   }
   return data;
 }
@@ -832,7 +909,24 @@ var OpenAIAdapter = {
     if (sdk.displayMode) {
       context.hostContext.displayMode = sdk.displayMode;
     }
-    // Note: OpenAI SDK does not have an onContextChange equivalent
+    // The Apps SDK re-dispatches the changed globals in an 'openai:set_globals' event.
+    window.addEventListener('openai:set_globals', function(event) {
+      var globals = (event && event.detail && event.detail.globals) || window.openai || {};
+      if (globals.toolInput !== undefined && globals.toolInput !== null) {
+        context.toolInput = globals.toolInput;
+        window.dispatchEvent(new CustomEvent('tool:input', { detail: { arguments: context.toolInput } }));
+      }
+      if (globals.toolOutput !== undefined && globals.toolOutput !== null) {
+        context.structuredContent = globals.toolOutput;
+        context.notifyToolResult(globals.toolOutput);
+      }
+      if (globals.theme && globals.theme !== context.hostContext.theme) {
+        context.notifyContextChange({ theme: globals.theme });
+      }
+      if (globals.displayMode && globals.displayMode !== context.hostContext.displayMode) {
+        context.notifyContextChange({ displayMode: globals.displayMode });
+      }
+    });
     return Promise.resolve();
   },
   callTool: function(context, name, args) {
@@ -884,6 +978,8 @@ var ExtAppsAdapter = {
   pendingRequests: {},
   requestId: 0,
   hostCapabilities: {},
+  handshakeSettled: false,
+  pendingSize: null,
   canHandle: function() {
     if (typeof window === 'undefined') return false;
     if (window.parent === window) return false;
@@ -977,9 +1073,10 @@ var ExtAppsAdapter = {
         window.dispatchEvent(new CustomEvent('tool:input-partial', { detail: { arguments: context.toolInput } }));
         break;
       case 'ui/notifications/tool-result':
-        context.toolOutput = params.content;
+        var resultOutput = extractToolOutput(params);
+        context.toolOutput = resultOutput;
         context.structuredContent = params.structuredContent;
-        context.notifyToolResult(params.content);
+        context.notifyToolResult(resultOutput);
         window.dispatchEvent(new CustomEvent('tool:result', { detail: params }));
         break;
       case 'ui/notifications/host-context-changed':
@@ -1033,6 +1130,15 @@ var ExtAppsAdapter = {
       window.parent.postMessage({ jsonrpc: '2.0', id: id, method: method, params: params }, targetOrigin);
     });
   },
+  sendNotification: function(method, params) {
+    // JSON-RPC notification: no id, no response. Same origin rule as sendRequest.
+    if (!this.trustedOrigin && this.trustedOrigins.length === 0) {
+      return Promise.reject(new Error('Cannot send notification: no trusted origin established'));
+    }
+    var targetOrigin = this.trustedOrigin || this.trustedOrigins[0];
+    window.parent.postMessage({ jsonrpc: '2.0', method: method, params: params }, targetOrigin);
+    return Promise.resolve();
+  },
   sendHandshake: function(context) {
     // Send ui/initialize using '*' as target origin since TOFU hasn't
     // been established yet. The response from the host will establish
@@ -1049,6 +1155,7 @@ var ExtAppsAdapter = {
       var timeout = setTimeout(function() {
         delete self.pendingRequests[id];
         // Handshake timeout is non-fatal \u2014 notifications may still arrive
+        self.settleHandshake();
         resolve();
       }, 10000);
 
@@ -1062,7 +1169,9 @@ var ExtAppsAdapter = {
             supportsDisplayModes: true
           });
           if (result.hostContext) {
-            Object.assign(context.hostContext, result.hostContext);
+            // Notify (not a silent merge) so onContextChange listeners and the
+            // host theme see the handshake's context.
+            context.notifyContextChange(result.hostContext);
           }
           // Send ui/notifications/initialized to tell the host the view is ready.
           // Per MCP Apps spec, the host waits for this before sending tool-result.
@@ -1072,9 +1181,10 @@ var ExtAppsAdapter = {
             method: 'ui/notifications/initialized',
             params: {}
           }, targetOrigin);
+          self.settleHandshake();
           resolve();
         },
-        reject: function(err) { resolve(); }, // Non-fatal
+        reject: function(err) { self.settleHandshake(); resolve(); }, // Non-fatal
         timeout: timeout
       };
 
@@ -1088,6 +1198,18 @@ var ExtAppsAdapter = {
   performHandshake: function(context) {
     return this.sendHandshake(context);
   },
+  settleHandshake: function() {
+    // Deliver the latest size requested while no host origin was trusted.
+    this.handshakeSettled = true;
+    var pending = this.pendingSize;
+    if (!pending) return;
+    this.pendingSize = null;
+    this.sendNotification('ui/notifications/size-changed', pending.params).then(function(result) {
+      for (var i = 0; i < pending.waiters.length; i++) pending.waiters[i].resolve(result);
+    }, function(err) {
+      for (var i = 0; i < pending.waiters.length; i++) pending.waiters[i].reject(err);
+    });
+  },
   callTool: function(context, name, args) {
     if (!this.hostCapabilities.serverTools && !this.hostCapabilities.serverToolProxy) {
       return Promise.reject(new Error('Server tool proxy not supported'));
@@ -1109,13 +1231,22 @@ var ExtAppsAdapter = {
     return this.sendRequest('ui/setDisplayMode', { mode: mode });
   },
   setSize: function(context, size) {
-    // FrontMCP sizing channel \u2014 parallels ui/setDisplayMode. Reports the
-    // measured/desired widget dimensions to the host.
-    return this.sendRequest('ui/setSize', {
-      height: size && size.height,
-      width: size && size.width,
-      aspectRatio: size && size.aspectRatio
-    });
+    // Standard ext-apps sizing: the view tells the host its dimensions with the
+    // ui/notifications/size-changed notification ({ width?, height? } in px).
+    var params = {};
+    if (size && typeof size.width === 'number') params.width = size.width;
+    if (size && typeof size.height === 'number') params.height = size.height;
+    if (!this.handshakeSettled && !this.trustedOrigin && this.trustedOrigins.length === 0) {
+      // No host origin yet: keep only the latest size and send it when the
+      // handshake settles; every caller's promise follows that one request.
+      var self = this;
+      if (!this.pendingSize) this.pendingSize = { params: params, waiters: [] };
+      this.pendingSize.params = params;
+      return new Promise(function(resolve, reject) {
+        self.pendingSize.waiters.push({ resolve: resolve, reject: reject });
+      });
+    }
+    return this.sendNotification('ui/notifications/size-changed', params);
   },
   requestClose: function(context) {
     return this.sendRequest('ui/close', {});
@@ -1361,6 +1492,7 @@ function FrontMcpBridge() {
     toolResultListeners: [],
     notifyContextChange: function(changes) {
       Object.assign(this.hostContext, changes);
+      if (changes && changes.theme) __applyHostTheme(changes.theme);
       for (var i = 0; i < this.contextListeners.length; i++) {
         try { this.contextListeners[i](changes); } catch(e) {}
       }
@@ -1537,7 +1669,7 @@ FrontMcpBridge.prototype.requestDisplayMode = function(mode) {
 
 // Report a desired widget size to the host. \`size\` is { height?, width?, aspectRatio? }.
 // Per-adapter behaviour: Claude/generic no-op (host measures the DOM),
-// ext-apps sends ui/setSize, OpenAI forwards to its SDK when available.
+// ext-apps sends ui/notifications/size-changed, OpenAI forwards to its SDK when available.
 FrontMcpBridge.prototype.setSize = function(size) {
   if (!this._adapter) return Promise.reject(new Error('Not initialized'));
   if (!this._adapter.setSize) return Promise.resolve();
@@ -1639,7 +1771,7 @@ FrontMcpBridge.prototype._setupDataToolCallHandler = function() {
         target.classList.add('opacity-50', 'cursor-not-allowed');
 
         // Add spinner for buttons
-        var spinner = '<svg class="animate-spin -ml-1 mr-2 h-4 w-4 inline" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path></svg>';
+        var spinner = '<svg class="animate-spin -ml-1 mr-2 h-4 w-4 inline" style="width:1em;height:1em;vertical-align:-0.125em" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path></svg>';
         if (target.tagName === 'BUTTON') {
           target.innerHTML = spinner + 'Loading...';
         }
@@ -1720,7 +1852,22 @@ function minifyJS(code) {
   if (code.length > MAX_MINIFY_CODE_LENGTH) {
     return code;
   }
-  return code.replace(/\/\*[\s\S]*?\*\//g, "").replace(/(^|[^:])\/\/.*$/gm, "$1").replace(/\s+/g, " ").replace(/\s*([{};,:()[\]])\s*/g, "$1").replace(/;\}/g, "}").trim();
+  const out = [];
+  let inBlockComment = false;
+  for (const raw of code.split("\n")) {
+    const line = raw.trim();
+    if (inBlockComment) {
+      if (line.includes("*/")) inBlockComment = false;
+      continue;
+    }
+    if (line === "" || line.startsWith("//")) continue;
+    if (line.startsWith("/*")) {
+      if (!line.includes("*/")) inBlockComment = true;
+      continue;
+    }
+    out.push(line);
+  }
+  return out.join("\n");
 }
 function generatePlatformBundle(platform, options = {}) {
   const platformAdapters = {
@@ -2145,8 +2292,24 @@ function isFrontmcpUiResolvable(...candidatePaths) {
 }
 
 // libs/uipack/src/component/transpiler.ts
+function loadEsbuild(filename) {
+  try {
+    return require("esbuild");
+  } catch (err) {
+    if (!isMissingEsbuild(err)) throw err;
+    const subject = filename ? `FileSource widget "${filename}"` : "A FileSource widget";
+    throw new Error(
+      `${subject} needs esbuild, which is not installed. @frontmcp/uipack loads esbuild on demand to bundle FileSource widgets (.tsx/.jsx) when the tool is called, so it must be installed where the server runs: \`npm install esbuild\` (in "dependencies", not "devDependencies"). Projects created with \`frontmcp create\` already get it through the \`frontmcp\` package.`,
+      { cause: err }
+    );
+  }
+}
+function isMissingEsbuild(err) {
+  if (!(err instanceof Error)) return false;
+  return err.code === "MODULE_NOT_FOUND" && /Cannot find module ['"]esbuild['"]/.test(err.message);
+}
 function transpileReactSource(source, filename) {
-  const esbuild = require("esbuild");
+  const esbuild = loadEsbuild(filename);
   const loader = filename?.endsWith(".tsx") ? "tsx" : "jsx";
   const result = esbuild.transformSync(source, {
     loader,
@@ -2165,7 +2328,7 @@ function bundleFileSource(source, filename, resolveDir, componentName, options =
       `FileSource widget "${filename}" requires the @frontmcp/ui package, which provides the React bridge mount that's injected at bundle time. Install it (e.g. \`npm install @frontmcp/ui\` or \`yarn add @frontmcp/ui\`) and try again.`
     );
   }
-  const esbuild = require("esbuild");
+  const esbuild = loadEsbuild(filename);
   const mountCode = `
 // --- Auto-generated mount ---
 import { createElement as __h } from 'react';
@@ -2262,7 +2425,8 @@ if (__root) {
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
     throw new Error(
-      `Failed to bundle FileSource "${filename}": ${message}. If the error mentions @frontmcp/ui or @frontmcp/uipack, ensure both packages are installed in the consuming project.`
+      `Failed to bundle FileSource "${filename}": ${message}. If the error mentions @frontmcp/ui or @frontmcp/uipack, ensure both packages are installed in the consuming project.`,
+      { cause: err }
     );
   }
 }
@@ -2338,6 +2502,37 @@ function resolveImportSource(source) {
     peerDependencies: []
   };
 }
+var BUILD_DIR_SEGMENTS = /* @__PURE__ */ new Set(["dist", "build", "out"]);
+function missingWidgetError(filePath, cause) {
+  const sourceWidget = findSourceWidget(filePath);
+  const error = new Error(
+    `FileSource widget not found (ENOENT): no file at "${filePath}". The widget source is read from this path when the tool is called, so it has to exist where the compiled tool runs \u2014 a path built from \`__dirname\` or \`import.meta.url\` points into the build output once the tool is compiled. tsc does not copy \`*.widget.tsx\` / \`*.widget.jsx\` files into its output; \`frontmcp build\` does, and any other build needs a step that copies them next to the compiled tool.` + (sourceWidget ? ` The source widget exists at "${sourceWidget}" \u2014 copy it to "${filePath}", or build with \`frontmcp build\`.` : ""),
+    { cause }
+  );
+  error.code = "ENOENT";
+  error.path = filePath;
+  return error;
+}
+function findSourceWidget(filePath) {
+  const path = require("path");
+  const fs = require("fs");
+  const parts = filePath.split(path.sep);
+  for (let i = parts.length - 2; i >= 0; i--) {
+    if (!BUILD_DIR_SEGMENTS.has(parts[i])) continue;
+    const candidates = [[...parts.slice(0, i), "src", ...parts.slice(i + 1)]];
+    if (parts.length - i > 2) candidates.push([...parts.slice(0, i), "src", ...parts.slice(i + 2)]);
+    candidates.push([...parts.slice(0, i), ...parts.slice(i + 1)]);
+    for (const candidate of candidates) {
+      const candidatePath = candidate.join(path.sep);
+      try {
+        if (fs.existsSync(candidatePath)) return candidatePath;
+      } catch {
+      }
+    }
+    return void 0;
+  }
+  return void 0;
+}
 function resolveFileSource(source, options = {}) {
   const path = require("path");
   const ext = path.extname(source.file).toLowerCase();
@@ -2352,9 +2547,11 @@ function resolveFileSource(source, options = {}) {
       const isNotFound = err?.code === "ENOENT";
       if (isNotFound && wasRelative) {
         throw new Error(
-          `FileSource widget "${source.file}" not found at "${filePath}". Relative paths are resolved against process.cwd() ("${process.cwd()}"), not the tool file's directory. To anchor the path to the tool file, pass an absolute path \u2014 e.g. \`{ file: fileURLToPath(new URL('./widget.tsx', import.meta.url)) }\` from \`node:url\` (see issue #444).`
+          `FileSource widget "${source.file}" not found at "${filePath}". Relative paths are resolved against process.cwd() ("${process.cwd()}"), not the tool file's directory. To anchor the path to the tool file, pass an absolute path \u2014 e.g. \`{ file: fileURLToPath(new URL('./widget.tsx', import.meta.url)) }\` from \`node:url\` (see issue #444).`,
+          { cause: err }
         );
       }
+      if (isNotFound) throw missingWidgetError(filePath, err);
       throw err;
     }
     const componentName = source.exportName || extractDefaultExportName(rawSource) || "Component";
@@ -2732,6 +2929,86 @@ function wrapDetectedContent(value) {
   }
 }
 
+// libs/uipack/src/adapters/markdown.ts
+var SAFE_HREF = /^(https?:|mailto:|\/|#)/i;
+function emphasis(text) {
+  return text.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>").replace(/\*([^*]+)\*/g, "<em>$1</em>");
+}
+function inline(text) {
+  const stash = [];
+  const hold = (html2) => `\uE000${stash.push(html2) - 1}\uE000`;
+  let out = escapeHtml(text.replace(/\uE000/g, "")).replace(
+    /`([^`]+)`/g,
+    (_m, code) => hold(`<code>${code}</code>`)
+  );
+  out = out.replace(
+    /\[([^\]]+)\]\(([^)\s]+)\)/g,
+    (_m, label, href) => SAFE_HREF.test(href) ? hold(`<a href="${href}" rel="noopener noreferrer">${emphasis(label)}</a>`) : label
+  );
+  out = emphasis(out);
+  for (let i = 0; i < 2; i++) out = out.replace(/\uE000(\d+)\uE000/g, (_m, n) => stash[Number(n)]);
+  return out;
+}
+function markdownToHtml(source) {
+  const lines = source.replace(/\r\n?/g, "\n").split("\n");
+  const blocks = [];
+  let paragraph = [];
+  let list;
+  const flushParagraph = () => {
+    if (paragraph.length > 0) blocks.push(`<p>${inline(paragraph.join(" "))}</p>`);
+    paragraph = [];
+  };
+  const flushList = () => {
+    if (list)
+      blocks.push(`<${list.tag}>${list.items.map((item) => `<li>${inline(item)}</li>`).join("")}</${list.tag}>`);
+    list = void 0;
+  };
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const fence = /^\s*(`{3,})/.exec(line);
+    if (fence) {
+      flushParagraph();
+      flushList();
+      const fenceLength = fence[1].length;
+      const isClosing = (l) => {
+        const m = /^\s*(`{3,})\s*$/.exec(l);
+        return m !== null && m[1].length >= fenceLength;
+      };
+      const code = [];
+      for (i++; i < lines.length && !isClosing(lines[i]); i++) code.push(lines[i]);
+      blocks.push(`<pre><code>${escapeHtml(code.join("\n"))}
+</code></pre>`);
+      continue;
+    }
+    const heading = /^(#{1,6})\s+(.*)$/.exec(line);
+    if (heading) {
+      flushParagraph();
+      flushList();
+      blocks.push(`<h${heading[1].length}>${inline(heading[2].trim())}</h${heading[1].length}>`);
+      continue;
+    }
+    const item = /^\s*([-*+]|\d+\.)\s+(.*)$/.exec(line);
+    if (item) {
+      flushParagraph();
+      const tag = /\d/.test(item[1]) ? "ol" : "ul";
+      if (list && list.tag !== tag) flushList();
+      list ??= { tag, items: [] };
+      list.items.push(item[2]);
+      continue;
+    }
+    if (line.trim() === "") {
+      flushParagraph();
+      flushList();
+      continue;
+    }
+    flushList();
+    paragraph.push(line.trim());
+  }
+  flushParagraph();
+  flushList();
+  return blocks.join("\n");
+}
+
 // libs/uipack/src/adapters/type-detector.ts
 function detectUIType(template) {
   if (template === null || template === void 0) {
@@ -2765,9 +3042,15 @@ function detectUIType(template) {
 }
 
 // libs/uipack/src/adapters/template-renderer.ts
-function buildCspConfig(resolver) {
+function buildCspConfig(resolver, extra) {
   const cspResourceDomains = ["https://esm.sh"];
   const cspConnectDomains = ["https://esm.sh"];
+  for (const domain of extra?.resourceDomains ?? []) {
+    if (!cspResourceDomains.includes(domain)) cspResourceDomains.push(domain);
+  }
+  for (const domain of extra?.connectDomains ?? []) {
+    if (!cspConnectDomains.includes(domain)) cspConnectDomains.push(domain);
+  }
   if (resolver && "overrides" in resolver) {
     const overrides = resolver.overrides;
     if (overrides) {
@@ -2807,6 +3090,14 @@ function renderUnwrappedResult(rawResult, options) {
   }
   return rawResult;
 }
+function isReactElement(value) {
+  return typeof value === "object" && value !== null && "$$typeof" in value;
+}
+function isDefinitelyReactComponent(template) {
+  if (typeof template !== "function") return false;
+  const proto = template.prototype;
+  return typeof proto?.render === "function" || template["$$typeof"] !== void 0;
+}
 function renderToolTemplate(options) {
   const { toolName, input, output, template, resolver, platformType, sizing } = options;
   const uiType = detectUIType(template);
@@ -2817,30 +3108,43 @@ function renderToolTemplate(options) {
     output,
     includeBridge: true,
     resolver,
-    sizing
+    sizing,
+    csp: options.csp ? buildCspConfig(resolver, options.csp) : void 0
   };
   let html2;
   let hash = "";
   let size = 0;
   if (typeof template === "object" && template !== null && "file" in template) {
-    const cspConfig = buildCspConfig(resolver);
     const result = renderComponent(
       { source: template, inlineReact: resourceMode === "inline" },
-      { ...shellConfig, csp: cspConfig }
+      { ...shellConfig, csp: buildCspConfig(resolver, options.csp) }
     );
     html2 = result.html;
     hash = result.hash;
     size = result.size;
   } else if (typeof template === "function") {
-    if (uiType === "react") {
+    const helpers = createTemplateHelpers();
+    const ctx = { input, output, helpers };
+    let rawResult;
+    let isHtmlBuilder = uiType !== "react" || !isDefinitelyReactComponent(template);
+    if (isHtmlBuilder) {
+      try {
+        rawResult = template(ctx);
+        isHtmlBuilder = !isReactElement(rawResult);
+      } catch (error) {
+        if (uiType !== "react") throw error;
+        isHtmlBuilder = false;
+      }
+    }
+    if (!isHtmlBuilder) {
+      (options.logger ?? console).warn(
+        `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
+      );
       const shellResult = buildShell('<div id="root"></div>', shellConfig);
       html2 = shellResult.html;
       hash = shellResult.hash;
       size = shellResult.size;
     } else {
-      const helpers = createTemplateHelpers();
-      const ctx = { input, output, helpers };
-      const rawResult = template(ctx);
       const wrapped = isTrustedHtml(rawResult) ? void 0 : wrapDetectedContent(rawResult);
       if (wrapped) {
         html2 = wrapped;
@@ -2852,7 +3156,7 @@ function renderToolTemplate(options) {
       }
     }
   } else if (typeof template === "string") {
-    const shellResult = buildShell(template, shellConfig);
+    const shellResult = buildShell(uiType === "markdown" ? markdownToHtml(template) : template, shellConfig);
     html2 = shellResult.html;
     hash = shellResult.hash;
     size = shellResult.size;

package/adapters/markdown.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Minimal, safe Markdown to HTML conversion for `ui.template` strings.
+ *
+ * Supports headings, paragraphs, fenced code, ordered/unordered lists and inline
+ * bold, italic, code and http(s)/mailto links. Everything else is escaped text; raw HTML in the
+ * source is never passed through.
+ */
+export declare function markdownToHtml(source: string): string;
+//# sourceMappingURL=markdown.d.ts.map

package/adapters/markdown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"markdown.d.ts","sourceRoot":"","sources":["../../src/adapters/markdown.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA2BH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAgErD"}

package/adapters/template-renderer.d.ts

@@ -36,6 +36,14 @@ export interface RenderToolTemplateOptions {
      * shell, and is mirrored onto the returned `meta` as `ui/preferredHeight` etc.
      */
     sizing?: WidgetSizing;
+    /**
+     * Extra origins the widget may load from (`resourceDomains`) or call (`connectDomains`), from the
+     * tool's `ui.csp`. Merged into the page's own Content-Security-Policy on every template path.
+     */
+    csp?: {
+        connectDomains?: string[];
+        resourceDomains?: string[];
+    };
     /**
      * HTML-escape a plain string returned by a template function; results built with
      * `html` / `trustedHtml` stay markup. When unset, strings that look like HTML render as

package/adapters/template-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAOnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA6DD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAsG/F"}
+{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA+ED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAsH/F"}

package/bridge-runtime/iife-generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"iife-generator.d.ts","sourceRoot":"","sources":["../../src/bridge-runtime/iife-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC;IACvE,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CA8G7E;AAooCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,EACvD,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAM,GACnD,MAAM,CAYR;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAuB,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;CAK9B,CAAC"}
+{"version":3,"file":"iife-generator.d.ts","sourceRoot":"","sources":["../../src/bridge-runtime/iife-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,EAAE,CAAC,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC;IACvE,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,oBAAyB,GAAG,MAAM,CA8G7E;AA8xCD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,EACvD,OAAO,GAAE,IAAI,CAAC,oBAAoB,EAAE,UAAU,CAAM,GACnD,MAAM,CAYR;AAED;;;GAGG;AACH,eAAO,MAAM,uBAAuB,QAAuB,CAAC;AAE5D;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;CAK9B,CAAC"}