@eshal-bot/chat-widget 0.2.17 → 0.2.19

package/dist/chat-widget-markdown-chunk.js

@@ -88402,6 +88402,21 @@
     return typeof u === 'string' && /^https?:\/\//i.test(u) ? u : undefined;
   }
 
+  /**
+   * The same rule for images a card draws itself (A2UI card, list item,
+   * avatar, gallery), which never pass through markdown. Returns `src`
+   * unchanged while the policy is off (the default) or in report mode, and
+   * undefined when enforce blocks the host, so the caller skips the <img>.
+   */
+  function policedImageSrc(src) {
+    return src;
+  }
+  function rehypeImagePolicy() {
+    return tree => {
+      return;
+    };
+  }
+
   const LINK_RE = /\[([^\]\n]+)\]\((https?:\/\/[^\s)]+)\)|(https?:\/\/[^\s<>()]+[^\s<>().,;:!?'"])/g;
   const LINK_STYLE = {
     color: '#1d4ed8',
@@ -88479,6 +88494,12 @@
    * bug this file fixes (12-06-2026).
    */
 
+
+  // Card images (banner, list item, avatar, gallery) go through the chat image
+  // policy too. Unchanged while it is off, which is the default.
+  const cardImageSrc = u => policedImageSrc(safeUrl(u));
+  // True only when the policy itself drops a URL that would otherwise render.
+  const cardImageBlocked = u => safeUrl(u) !== undefined && cardImageSrc(u) === undefined;
   function A2uiBlock({
     spec,
     isDark = false,
@@ -88913,7 +88934,7 @@
     const summary = String(spec.body || '').trim();
     const full = String(spec.details || '').trim();
     const hasMore = summary.length > 0 && full.length > summary.length + 2;
-    const imageUrl = safeUrl(spec.image);
+    const imageUrl = cardImageSrc(spec.image);
     const pill = status && status.label ? _STATUS_PILL(isDark)[status.variant || 'success'] : null;
     return /*#__PURE__*/jsxRuntimeExports.jsxs("div", {
       style: {
@@ -89727,8 +89748,8 @@
             display: 'flex',
             flexDirection: 'column'
           },
-          children: [safeUrl(item.image) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(item.image),
+          children: [cardImageSrc(item.image) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(item.image),
             alt: item.name || '',
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -89842,8 +89863,8 @@
             fontWeight: 700,
             fontSize: 16
           },
-          children: safeUrl(spec.avatar) ? /*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(spec.avatar),
+          children: cardImageSrc(spec.avatar) ? /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(spec.avatar),
             alt: spec.name || '',
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -90281,8 +90302,8 @@
             border: '1px solid ' + (isDark ? '#374151' : '#e5e7eb'),
             background: isDark ? '#111827' : '#f9fafb'
           },
-          children: [/*#__PURE__*/jsxRuntimeExports.jsx("img", {
-            src: safeUrl(img.url),
+          children: [!cardImageBlocked(img.url) && /*#__PURE__*/jsxRuntimeExports.jsx("img", {
+            src: cardImageSrc(img.url),
             alt: img.caption || `Image ${i + 1}`,
             referrerPolicy: "no-referrer",
             onError: e => {
@@ -91616,12 +91637,6 @@
     };
   }
 
-  function rehypeImagePolicy() {
-    return tree => {
-      return;
-    };
-  }
-
   /**
    * WidgetCitationContext - the message's `sources` array + download handler,
    * supplied by `<MessageBubble>` and consumed by every `<CitationPill>` that