// ✅ Correct: Pure client-side processing
export const hashFn: ToolFunction = async (params) => {
  const data = new TextEncoder().encode(params.input as string);
  const hash = await crypto.subtle.digest('SHA-256', data);
  return { success: true, data: { hash: arrayToHex(hash) } };
};

// ❌ Wrong: Sending data to external server
export const hashFn: ToolFunction = async (params) => {
  // VIOLATION: Transmitting user input
  const response = await fetch('https://api.example.com/hash', {
    method: 'POST',
    body: JSON.stringify({ input: params.input }),
  });
  return { success: true, data: await response.json() };
};

export const myFn: ToolFunction = (params) => {
  const input = params.input;

  // 1. Required check
  if (!input) {
    return {
      success: false,
      error: 'Input is required',
      errorCode: 'MISSING_REQUIRED',
    };
  }

  // 2. Type check
  if (typeof input !== 'string') {
    return {
      success: false,
      error: 'Input must be a string',
      errorCode: 'TYPE_ERROR',
    };
  }

  // 3. Constraint check
  if (input.length > 100000) {
    return {
      success: false,
      error: 'Input exceeds maximum length of 100,000 characters',
      errorCode: 'CONSTRAINT_VIOLATION',
    };
  }

  // 4. Process safely
  return { success: true, data: process(input) };
};

{
  name: 'input',
  type: 'textarea',
  validation: {
    minLength: 1,
    maxLength: 100000,
    pattern: '^[\\s\\S]*$',  // Safe pattern
  },
}

// ✅ Correct: Generic error message
return {
  success: false,
  error: 'Invalid input format',
  errorCode: 'INVALID_INPUT',
};

// ❌ Wrong: Exposing internal details
return {
  success: false,
  error: `Database error: ${dbError.message} at ${dbError.stack}`,
  errorCode: 'INTERNAL_ERROR',
};

// Escape HTML entities
function escapeHtml(text: string): string {
  return text
    .replace(/&/g, '&')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;')
    .replace(/'/g, '&#039;');
}

Content-Security-Policy:
  default-src 'self';
  script-src 'self' https://cdn.conveniencepro.cc;
  style-src 'self' 'unsafe-inline';
  connect-src 'self';
  frame-ancestors 'self' https://*.yourdomain.com;

<iframe
  src="https://conveniencepro.cc/embed/tool"
  sandbox="allow-scripts allow-forms"
  referrerpolicy="no-referrer"
></iframe>

// Validate message origin
window.addEventListener('message', (event) => {
  // Always check origin
  if (!trustedOrigins.includes(event.origin)) {
    return;
  }

  // Validate message structure
  if (!isValidCTPMessage(event.data)) {
    return;
  }

  handleMessage(event.data);
});

export const myDefinition: ToolDefinition = {
  // ...
  rateLimit: {
    requests: 100,   // Max requests
    window: 60,      // Per 60 seconds
  },
};

import { RateLimiter } from '@conveniencepro/ctp-runtime';

const limiter = new RateLimiter({
  requests: 100,
  window: 60,
});

const result = await limiter.check('user-id');
if (!result.allowed) {
  return {
    success: false,
    error: `Rate limit exceeded. Try again in ${result.retryAfter} seconds.`,
    errorCode: 'RATE_LIMITED',
  };
}

export const myDefinition: ToolDefinition = {
  // ...
  requiresAuth: true,
};

export const myFn: ToolFunction = async (params, context) => {
  // Check authentication
  if (!context?.userId) {
    return {
      success: false,
      error: 'Authentication required',
      errorCode: 'UNAUTHORIZED',
    };
  }

  // Proceed with authenticated user
  return executeForUser(context.userId, params);
};