@frontmcp/uipack 1.8.7 → 1.9.1-rc.1

package/adapters/index.js

@@ -1922,11 +1922,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -1935,26 +1932,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;
@@ -2358,8 +2363,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -2625,7 +2630,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -3090,6 +3095,16 @@ function renderUnwrappedResult(rawResult, options) {
   }
   return rawResult;
 }
+var warnedComponentReferences = /* @__PURE__ */ new WeakMap();
+function warnComponentReference(template, toolName, logger) {
+  const warned = warnedComponentReferences.get(template) ?? /* @__PURE__ */ new Set();
+  if (warned.has(toolName)) return;
+  warned.add(toolName);
+  warnedComponentReferences.set(template, warned);
+  logger.warn(
+    `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
+  );
+}
 function isReactElement(value) {
   return typeof value === "object" && value !== null && "$$typeof" in value;
 }
@@ -3124,7 +3139,7 @@ function renderToolTemplate(options) {
     size = result.size;
   } else if (typeof template === "function") {
     const helpers = createTemplateHelpers();
-    const ctx = { input, output, helpers };
+    const ctx = { input: input ?? {}, output: output ?? {}, helpers };
     let rawResult;
     let isHtmlBuilder = uiType !== "react" || !isDefinitelyReactComponent(template);
     if (isHtmlBuilder) {
@@ -3137,9 +3152,7 @@ function renderToolTemplate(options) {
       }
     }
     if (!isHtmlBuilder) {
-      (options.logger ?? console).warn(
-        `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
-      );
+      warnComponentReference(template, toolName, options.logger ?? console);
       const shellResult = buildShell('<div id="root"></div>', shellConfig);
       html2 = shellResult.html;
       hash = shellResult.hash;

package/adapters/template-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA+ED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAsH/F"}
+{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAIxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAQnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;OAGG;IACH,GAAG,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,yEAAyE;IACzE,MAAM,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC9C;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AA8FD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAoH/F"}

package/component/index.js

@@ -564,8 +564,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -817,7 +817,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -2214,11 +2214,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -2227,26 +2224,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;

package/esm/adapters/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -1890,11 +1893,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -1903,26 +1903,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;
@@ -2326,8 +2334,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -2593,7 +2601,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -3058,6 +3066,16 @@ function renderUnwrappedResult(rawResult, options) {
   }
   return rawResult;
 }
+var warnedComponentReferences = /* @__PURE__ */ new WeakMap();
+function warnComponentReference(template, toolName, logger) {
+  const warned = warnedComponentReferences.get(template) ?? /* @__PURE__ */ new Set();
+  if (warned.has(toolName)) return;
+  warned.add(toolName);
+  warnedComponentReferences.set(template, warned);
+  logger.warn(
+    `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
+  );
+}
 function isReactElement(value) {
   return typeof value === "object" && value !== null && "$$typeof" in value;
 }
@@ -3092,7 +3110,7 @@ function renderToolTemplate(options) {
     size = result.size;
   } else if (typeof template === "function") {
     const helpers = createTemplateHelpers();
-    const ctx = { input, output, helpers };
+    const ctx = { input: input ?? {}, output: output ?? {}, helpers };
     let rawResult;
     let isHtmlBuilder = uiType !== "react" || !isDefinitelyReactComponent(template);
     if (isHtmlBuilder) {
@@ -3105,9 +3123,7 @@ function renderToolTemplate(options) {
       }
     }
     if (!isHtmlBuilder) {
-      (options.logger ?? console).warn(
-        `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
-      );
+      warnComponentReference(template, toolName, options.logger ?? console);
       const shellResult = buildShell('<div id="root"></div>', shellConfig);
       html2 = shellResult.html;
       hash = shellResult.hash;

package/esm/bridge-runtime/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/bridge-runtime/iife-generator.ts
 function generateBridgeIIFE(options = {}) {
   const { debug = false, trustedOrigins = [], minify = false } = options;

package/esm/component/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -535,8 +538,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -788,7 +791,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -2185,11 +2188,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -2198,26 +2198,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;

package/esm/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
   get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
 }) : x)(function(x) {
@@ -2973,11 +2976,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -2986,26 +2986,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;
@@ -3542,8 +3550,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -3795,7 +3803,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -4329,6 +4337,16 @@ function renderUnwrappedResult(rawResult, options) {
   }
   return rawResult;
 }
+var warnedComponentReferences = /* @__PURE__ */ new WeakMap();
+function warnComponentReference(template, toolName, logger) {
+  const warned = warnedComponentReferences.get(template) ?? /* @__PURE__ */ new Set();
+  if (warned.has(toolName)) return;
+  warned.add(toolName);
+  warnedComponentReferences.set(template, warned);
+  logger.warn(
+    `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
+  );
+}
 function isReactElement(value) {
   return typeof value === "object" && value !== null && "$$typeof" in value;
 }
@@ -4363,7 +4381,7 @@ function renderToolTemplate(options) {
     size = result.size;
   } else if (typeof template === "function") {
     const helpers = createTemplateHelpers();
-    const ctx = { input, output, helpers };
+    const ctx = { input: input ?? {}, output: output ?? {}, helpers };
     let rawResult;
     let isHtmlBuilder = uiType !== "react" || !isDefinitelyReactComponent(template);
     if (isHtmlBuilder) {
@@ -4376,9 +4394,7 @@ function renderToolTemplate(options) {
       }
     }
     if (!isHtmlBuilder) {
-      (options.logger ?? console).warn(
-        `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
-      );
+      warnComponentReference(template, toolName, options.logger ?? console);
       const shellResult = buildShell('<div id="root"></div>', shellConfig);
       html2 = shellResult.html;
       hash = shellResult.hash;

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.8.7",
+  "version": "1.9.1-rc.1",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.7",
+    "@frontmcp/lazy-zod": "1.9.1-rc.1",
     "esbuild": ">=0.27.0 <1"
   },
   "peerDependenciesMeta": {

package/esm/resolver/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/resolver/cdn-registry.ts
 var DEFAULT_CDN_REGISTRY = {
   react: {

package/esm/shell/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/bridge-runtime/iife-generator.ts
 function generateBridgeIIFE(options = {}) {
   const { debug = false, trustedOrigins = [], minify = false } = options;
@@ -1367,11 +1370,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -1380,26 +1380,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;

package/esm/types/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/types/ui-runtime.ts
 function isUIType(value) {
   return typeof value === "string" && ["html", "react", "mdx", "markdown", "auto"].includes(value);

package/esm/typings/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/typings/types.ts
 var DEFAULT_ALLOWED_PACKAGES = ["react", "react-dom", "react/jsx-runtime", "zod", "@frontmcp/*"];
 var DEFAULT_TYPE_FETCHER_OPTIONS = {

package/esm/utils/index.mjs

@@ -1,3 +1,6 @@
+var __frontmcpModule = typeof process !== "undefined" && typeof process.getBuiltinModule === "function" ? process.getBuiltinModule("module") : undefined;
+const require = __frontmcpModule ? __frontmcpModule.createRequire(import.meta.url || 'file:///') : undefined;
+// __frontmcpCreateRequire
 // libs/uipack/src/utils/index.ts
 function safeStringify(value, space) {
   const seen = /* @__PURE__ */ new WeakSet();

package/index.js

@@ -3093,11 +3093,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -3106,26 +3103,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;
@@ -3662,8 +3667,8 @@ if (__root) {
       configurable: true, enumerable: true
     });
   }
-  // 2. Try injected data globals
-  if (__hasData(window.__mcpToolOutput)) { __render(window.__mcpToolOutput); }
+  // 2. Try injected data globals (null: the page carries no call's data, e.g. compiled at startup)
+  if (__hasData(window.__mcpToolOutput) && window.__mcpToolOutput !== null) { __render(window.__mcpToolOutput); }
   // 3. Listen for bridge tool-result (ext-apps / MCP Inspector)
   var __bridge = window.FrontMcpBridge;
   if (__bridge && typeof __bridge.onToolResult === 'function') {
@@ -3915,7 +3920,7 @@ createRoot(document.getElementById('root'))
   return `${componentImport}
 import React from 'react';
 import { createRoot } from 'react-dom/client';
-const output = window.__mcpToolOutput;
+const output = window.__mcpToolOutput || {};
 const props = ${propsCode};
 createRoot(document.getElementById('root'))
   .render(React.createElement(Component, props));`;
@@ -4449,6 +4454,16 @@ function renderUnwrappedResult(rawResult, options) {
   }
   return rawResult;
 }
+var warnedComponentReferences = /* @__PURE__ */ new WeakMap();
+function warnComponentReference(template, toolName, logger) {
+  const warned = warnedComponentReferences.get(template) ?? /* @__PURE__ */ new Set();
+  if (warned.has(toolName)) return;
+  warned.add(toolName);
+  warnedComponentReferences.set(template, warned);
+  logger.warn(
+    `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
+  );
+}
 function isReactElement(value) {
   return typeof value === "object" && value !== null && "$$typeof" in value;
 }
@@ -4483,7 +4498,7 @@ function renderToolTemplate(options) {
     size = result.size;
   } else if (typeof template === "function") {
     const helpers = createTemplateHelpers();
-    const ctx = { input, output, helpers };
+    const ctx = { input: input ?? {}, output: output ?? {}, helpers };
     let rawResult;
     let isHtmlBuilder = uiType !== "react" || !isDefinitelyReactComponent(template);
     if (isHtmlBuilder) {
@@ -4496,9 +4511,7 @@ function renderToolTemplate(options) {
       }
     }
     if (!isHtmlBuilder) {
-      (options.logger ?? console).warn(
-        `[FrontMCP] Tool "${toolName}": \`ui.template\` is a React component reference, which cannot be bundled (there is no source file to compile), so the widget would render an empty page. Use \`template: { file: './widget.tsx' }\` instead.`
-      );
+      warnComponentReference(template, toolName, options.logger ?? console);
       const shellResult = buildShell('<div id="root"></div>', shellConfig);
       html2 = shellResult.html;
       hash = shellResult.hash;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.8.7",
+  "version": "1.9.1-rc.1",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,7 +61,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.7",
+    "@frontmcp/lazy-zod": "1.9.1-rc.1",
     "esbuild": ">=0.27.0 <1"
   },
   "peerDependenciesMeta": {

package/shell/csp.d.ts

@@ -28,10 +28,15 @@ export declare function buildCSPDirectives(csp?: CSPConfig): string[];
 export declare function buildCSPMetaTag(csp?: CSPConfig): string;
 /**
  * Validate CSP domain format.
+ *
+ * Accepts `https://` and `wss://` origins (a WebSocket API needs `wss://` in `connect-src`),
+ * their `https://*.` / `wss://*.` wildcard forms, and `http://` / `ws://` origins on a loopback
+ * host (`localhost`, `127.0.0.1`, `[::1]`) for local development. A value with a query or a
+ * fragment is rejected.
  */
 export declare function validateCSPDomain(domain: string): boolean;
 /**
- * Filter and warn about invalid CSP domains.
+ * Filter out invalid CSP domains, warning once per domain.
  */
 export declare function sanitizeCSPDomains(domains: string[] | undefined): string[];
 //# sourceMappingURL=csp.d.ts.map

package/shell/csp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/shell/csp.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,eAAO,MAAM,mBAAmB,sJAMtB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,sBAAsB,uPAQzB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,0BAA0B,4MAQ7B,CAAC;AAEX;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,MAAM,EAAE,CA+B5D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,MAAM,CAIvD;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAYzD;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAa1E"}
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/shell/csp.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,eAAO,MAAM,mBAAmB,sJAMtB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,sBAAsB,uPAQzB,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,0BAA0B,4MAQ7B,CAAC;AAEX;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,MAAM,EAAE,CA8B5D;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,CAAC,EAAE,SAAS,GAAG,MAAM,CAIvD;AAKD;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAkBzD;AAKD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAgB1E"}

package/shell/index.js

@@ -1419,11 +1419,8 @@ function buildCSPDirectives(csp) {
   directives.push(`img-src ${imgSources.join(" ")}`);
   const fontSources = ["'self'", "data:", ...allResourceDomains];
   directives.push(`font-src ${fontSources.join(" ")}`);
-  if (validConnectDomains.length) {
-    directives.push(`connect-src ${validConnectDomains.join(" ")}`);
-  } else {
-    directives.push(`connect-src ${allResourceDomains.join(" ")}`);
-  }
+  const connectSources = [.../* @__PURE__ */ new Set([...allResourceDomains, ...validConnectDomains])];
+  directives.push(`connect-src ${connectSources.join(" ")}`);
   directives.push("object-src 'self' data:");
   return directives;
 }
@@ -1432,26 +1429,34 @@ function buildCSPMetaTag(csp) {
   const content = directives.join("; ");
   return `<meta http-equiv="Content-Security-Policy" content="${escapeAttribute(content)}">`;
 }
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
 function validateCSPDomain(domain) {
-  if (domain.startsWith("https://*.")) {
-    const rest = domain.slice(10);
-    return /^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.[a-zA-Z]{2,}$/.test(rest);
+  if (typeof domain !== "string" || /[\s;,'"]/.test(domain)) return false;
+  if (/[?#]/.test(domain)) return false;
+  if (domain.includes("*")) {
+    const wildcard = /^(?:https|wss):\/\/\*\.(.*)$/.exec(domain);
+    return wildcard !== null && /^([a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$/.test(wildcard[1]);
   }
   try {
     const url = new URL(domain);
-    return url.protocol === "https:";
+    if (url.protocol === "https:" || url.protocol === "wss:") return true;
+    return (url.protocol === "http:" || url.protocol === "ws:") && LOOPBACK_HOSTS.has(url.hostname);
   } catch {
     return false;
   }
 }
+var reportedInvalidDomains = /* @__PURE__ */ new Set();
 function sanitizeCSPDomains(domains) {
   if (!domains) return [];
   const valid = [];
   for (const domain of domains) {
     if (validateCSPDomain(domain)) {
       valid.push(domain);
-    } else {
-      console.warn(`Invalid CSP domain ignored: ${domain}`);
+    } else if (!reportedInvalidDomains.has(domain)) {
+      reportedInvalidDomains.add(domain);
+      console.warn(
+        `Invalid CSP domain ignored: ${domain} (expected an https:// or wss:// origin, or http:// / ws:// on localhost)`
+      );
     }
   }
   return valid;