@frontmcp/ui 1.12.0-rc.1 → 1.12.1

package/bridge/core/bridge-factory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge-factory.d.ts","sourceRoot":"","sources":["../../../src/bridge/core/bridge-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EAGZ,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,UAAU,EACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAU3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,cAAe,YAAW,uBAAuB;IAC5D,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAA4B;IAEhD;;;;OAIG;gBACS,MAAM,GAAE,YAAiB,EAAE,QAAQ,CAAC,EAAE,eAAe;IAyBjE;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,mBAAmB,GAAG,SAAS,CAElD;IAMD;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBjC;;OAEG;YACW,aAAa;IAiC3B;;OAEG;IACH,OAAO,IAAI,IAAI;IAaf;;OAEG;IACH,UAAU,IAAI,eAAe,GAAG,SAAS;IAIzC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,mBAAmB,GAAG,OAAO;IAQtD;;OAEG;IACH,QAAQ,IAAI,OAAO,GAAG,MAAM;IAK5B;;OAEG;IACH,cAAc,IAAI,WAAW;IAK7B;;OAEG;IACH,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAKvC;;OAEG;IACH,aAAa,IAAI,OAAO;IAKxB;;OAEG;IACH,oBAAoB,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,IAAI;IAK7C;;OAEG;IACH,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAKzC;;OAEG;IACH,cAAc,IAAI,WAAW;IAS7B;;;;OAIG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7E;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;OAGG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C;;;OAGG;IACG,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAKnC;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IASpD;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI;IAK9E;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAS7D;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;OAEG;IACH,OAAO,CAAC,YAAY;IAkBpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAWlB;;OAEG;IACH,OAAO,CAAC,IAAI;CAKb;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAI7G;AAQD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAMpF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}
+{"version":3,"file":"bridge-factory.d.ts","sourceRoot":"","sources":["../../../src/bridge/core/bridge-factory.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAEnB,YAAY,EAGZ,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,eAAe,EACf,UAAU,EACX,MAAM,UAAU,CAAC;AAClB,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA2B3E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,qBAAa,cAAe,YAAW,uBAAuB;IAC5D,OAAO,CAAC,OAAO,CAAe;IAC9B,OAAO,CAAC,SAAS,CAAkB;IACnC,OAAO,CAAC,QAAQ,CAA8B;IAC9C,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,YAAY,CAA4B;IAEhD;;;;OAIG;gBACS,MAAM,GAAE,YAAiB,EAAE,QAAQ,CAAC,EAAE,eAAe;IAiCjE;;OAEG;IACH,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED;;OAEG;IACH,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAED;;OAEG;IACH,IAAI,YAAY,IAAI,mBAAmB,GAAG,SAAS,CAElD;IAMD;;;;;;OAMG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAkBjC;;OAEG;YACW,aAAa;IAiC3B;;OAEG;IACH,OAAO,IAAI,IAAI;IAaf;;OAEG;IACH,UAAU,IAAI,eAAe,GAAG,SAAS;IAIzC;;;OAGG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,mBAAmB,GAAG,OAAO;IAQtD;;OAEG;IACH,QAAQ,IAAI,OAAO,GAAG,MAAM;IAK5B;;OAEG;IACH,cAAc,IAAI,WAAW;IAK7B;;OAEG;IACH,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAKvC;;OAEG;IACH,aAAa,IAAI,OAAO;IAKxB;;OAEG;IACH,oBAAoB,CAAC,CAAC,GAAG,OAAO,KAAK,CAAC,GAAG,IAAI;IAK7C;;OAEG;IACH,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAKzC;;OAEG;IACH,cAAc,IAAI,WAAW;IAS7B;;;;OAIG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ7E;;;OAGG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQjD;;;OAGG;IACG,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1C;;;OAGG;IACG,kBAAkB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAK1D;;;OAGG;IACG,OAAO,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9C;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC;IAKnC;;;OAGG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IASpD;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,KAAK,IAAI,GAAG,MAAM,IAAI;IAK9E;;;;OAIG;IACH,YAAY,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,IAAI,GAAG,MAAM,IAAI;IAS7D;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAO1B;;OAEG;IACH,OAAO,CAAC,YAAY;IAkBpB;;OAEG;IACH,OAAO,CAAC,UAAU;IAWlB;;OAEG;IACH,OAAO,CAAC,IAAI;CAKb;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAI7G;AAQD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAMpF;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAKxC"}

package/bridge/index.js

@@ -284,6 +284,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -309,6 +319,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties
@@ -1308,6 +1325,7 @@ var ExtAppsAdapter = class extends BaseAdapter {
    * Handle incoming postMessage events.
    */
   _handleMessage(event) {
+    if (event.source !== window.parent) return;
     if (!this._isOriginTrusted(event.origin)) {
       return;
     }

package/esm/bridge/index.mjs

@@ -232,6 +232,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -257,6 +267,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties
@@ -1256,6 +1273,7 @@ var ExtAppsAdapter = class extends BaseAdapter {
    * Handle incoming postMessage events.
    */
   _handleMessage(event) {
+    if (event.source !== window.parent) return;
     if (!this._isOriginTrusted(event.origin)) {
       return;
     }

package/esm/index.mjs

@@ -226,6 +226,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -251,6 +261,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/ui",
-  "version": "1.12.0-rc.1",
+  "version": "1.12.1",
   "description": "React components, bridge hooks and content renderers (built on MUI) for FrontMCP tool widgets in ChatGPT, Claude and other MCP Apps hosts",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://frontmcp.dev/reference/ui",
@@ -436,7 +436,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/uipack": "1.12.0-rc.1"
+    "@frontmcp/uipack": "1.12.1"
   },
   "devDependencies": {
     "@types/dompurify": "^3.0.0",

package/esm/react/index.mjs

@@ -226,6 +226,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -251,6 +261,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties

package/esm/renderer/index.mjs

@@ -1037,6 +1037,7 @@ import Paper from "@mui/material/Paper";
 import { styled as styled6 } from "@mui/material/styles";
 import Typography4 from "@mui/material/Typography";
 import React7, { useEffect as useEffect5 } from "react";
+import { sanitizeHtml } from "@frontmcp/uipack/shell";
 var LEAFLET_CSS_URL = "https://esm.sh/leaflet@1.9.4/dist/leaflet.css";
 var LEAFLET_CSS_ID = "fmcp-leaflet-css";
 var DEFAULT_TILE_URL = "https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png";
@@ -1087,7 +1088,12 @@ function parseMapConfig(content) {
       geojson: parsed
     };
   }
-  return parsed;
+  const config = parsed;
+  const tileLayer = config.tileLayer;
+  if (tileLayer?.attribution !== void 0) {
+    return { ...config, tileLayer: { ...tileLayer, attribution: sanitizeHtml(String(tileLayer.attribution)) } };
+  }
+  return config;
 }
 function MapView({ config, className }) {
   useEffect5(() => {
@@ -1158,16 +1164,76 @@ import Alert5 from "@mui/material/Alert";
 import Box7 from "@mui/material/Box";
 import { styled as styled7 } from "@mui/material/styles";
 import React8, { useEffect as useEffect6, useMemo as useMemo6 } from "react";
+
+// libs/ui/src/renderer/math/math-spans.ts
+function lastEscapeOf(source, closer) {
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    if (source[index + 1] === closer) last = index;
+    index++;
+  }
+  return last;
+}
+function lastEnvironmentEnd(source) {
+  const lastBrace = source.lastIndexOf("}");
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    const nameStart = index + 5;
+    if (source.startsWith("end{", index + 1) && nameStart < lastBrace && source[nameStart] !== "}") last = index;
+    index++;
+  }
+  return last;
+}
+function hasEscapedPair(source, opener, closer) {
+  const start = source.indexOf(`\\${opener}`);
+  return start !== -1 && lastEscapeOf(source, closer) >= start + 2;
+}
+function createMathSpanFinder(source) {
+  const bracketClose = lastEscapeOf(source, "]");
+  const parenClose = lastEscapeOf(source, ")");
+  const environmentEnd = lastEnvironmentEnd(source);
+  let nextDoubleDollar = -2;
+  return (index) => {
+    if (source.startsWith("$$", index)) {
+      if (nextDoubleDollar !== -1 && nextDoubleDollar < index + 2) nextDoubleDollar = source.indexOf("$$", index + 2);
+      if (nextDoubleDollar > index + 2) return nextDoubleDollar + 2;
+    }
+    if (source[index] === "$") {
+      let close = index + 1;
+      while (close < source.length && source[close] !== "$" && source[close] !== "\n") close++;
+      if (source[close] === "$" && close > index + 1) return close + 1;
+    }
+    if (source.startsWith("\\[", index) && bracketClose >= index + 2) return bracketClose + 2;
+    if (source.startsWith("\\(", index) && parenClose >= index + 2) return parenClose + 2;
+    if (source.startsWith("\\begin{", index) && environmentEnd >= index + 7) {
+      return source.indexOf("}", environmentEnd + 6) + 1;
+    }
+    return -1;
+  };
+}
+function findMathSpans(source) {
+  const findSpanEnd = createMathSpanFinder(source);
+  const spans = [];
+  for (let index = 0; index < source.length; index++) {
+    const end = findSpanEnd(index);
+    if (end === -1) continue;
+    spans.push({ start: index, end });
+    index = end - 1;
+  }
+  return spans;
+}
+
+// libs/ui/src/renderer/math/index.ts
 var KATEX_CSS_URL = "https://esm.sh/katex@0.16.11/dist/katex.min.css";
 var KATEX_CSS_ID = "fmcp-katex-css";
 var MATH_DISPLAY = /\$\$(?:[^$]|\$(?!\$))+\$\$/s;
 var MATH_INLINE = /\$[^$\n]+?\$/;
-var MATH_BRACKET_DISPLAY = /\\\[(?:[^\\]|\\.)*\\\]/s;
-var MATH_PAREN_INLINE = /\\\((?:[^\\]|\\.)*\\\)/s;
 var MATH_BEGIN = /\\begin\{(?:equation|align|gather|matrix|pmatrix|bmatrix|cases)\}/;
 function isMath(content) {
   const trimmed = content.trim();
-  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || MATH_BRACKET_DISPLAY.test(trimmed) || MATH_PAREN_INLINE.test(trimmed) || MATH_BEGIN.test(trimmed);
+  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || hasEscapedPair(trimmed, "[", "]") || hasEscapedPair(trimmed, "(", ")") || MATH_BEGIN.test(trimmed);
 }
 var lazyKatex = createLazyImport("katex", async () => {
   const mod = await runtimeImportWithFallback("katex", esmShUrl("katex@0.16"));
@@ -1201,14 +1267,12 @@ var MathInline = styled7("span", {
 });
 function parseMathContent(source) {
   const segments = [];
-  const mathRegex = /(\$\$(?:[^$]|\$(?!\$))+\$\$|\$[^$\n]+?\$|\\\[(?:[^\\]|\\.)*\\\]|\\\((?:[^\\]|\\.)*\\\)|\\begin\{(?:[^\\]|\\.)*\\end\{[^}]+\})/gs;
   let lastIndex = 0;
-  let match;
-  while ((match = mathRegex.exec(source)) !== null) {
-    if (match.index > lastIndex) {
-      segments.push({ type: "text", content: source.slice(lastIndex, match.index) });
+  for (const span of findMathSpans(source)) {
+    if (span.start > lastIndex) {
+      segments.push({ type: "text", content: source.slice(lastIndex, span.start) });
     }
-    const raw = match[0];
+    const raw = source.slice(span.start, span.end);
     if (raw.startsWith("$$")) {
       segments.push({ type: "display", content: raw.slice(2, -2).trim() });
     } else if (raw.startsWith("\\[")) {
@@ -1220,7 +1284,7 @@ function parseMathContent(source) {
     } else if (raw.startsWith("$")) {
       segments.push({ type: "inline", content: raw.slice(1, -1).trim() });
     }
-    lastIndex = match.index + raw.length;
+    lastIndex = span.end;
   }
   if (lastIndex < source.length) {
     segments.push({ type: "text", content: source.slice(lastIndex) });
@@ -1299,6 +1363,7 @@ import TableHead2 from "@mui/material/TableHead";
 import TableRow2 from "@mui/material/TableRow";
 import Typography5 from "@mui/material/Typography";
 import React9, { useMemo as useMemo7 } from "react";
+import { sanitizeHtml as sanitizeHtml2 } from "@frontmcp/uipack/shell";
 var lazyReactMarkdown = createLazyImport(
   "react-markdown",
   async () => {
@@ -1321,6 +1386,16 @@ var lazyRehypeRaw = createLazyImport("rehype-raw", async () => {
   const mod = await runtimeImportWithFallback("rehype-raw", esmShUrl("rehype-raw@7"));
   return mod;
 });
+var RAW_HTML_POLICY = { maxMarkupLength: Number.MAX_SAFE_INTEGER };
+function rehypeSanitizeRawHtml() {
+  return (tree) => {
+    const pending = [tree];
+    for (let node = pending.pop(); node; node = pending.pop()) {
+      if (node.type === "raw") node.value = sanitizeHtml2(node.value ?? "", RAW_HTML_POLICY);
+      for (const child of node.children ?? []) pending.push(child);
+    }
+  };
+}
 var MarkdownRoot = styled8(Box8, {
   name: "FrontMcpMarkdown",
   slot: "Root"
@@ -1375,7 +1450,7 @@ var Blockquote = styled8("blockquote", {
   "& > p": { margin: 0 }
 }));
 function createMuiComponents() {
-  return {
+  const components = {
     h1: (props) => React9.createElement(Typography5, { ...props, variant: "h4", gutterBottom: true }),
     h2: (props) => React9.createElement(Typography5, { ...props, variant: "h5", gutterBottom: true }),
     h3: (props) => React9.createElement(Typography5, { ...props, variant: "h6", gutterBottom: true }),
@@ -1397,6 +1472,12 @@ function createMuiComponents() {
     th: (props) => React9.createElement(TableCell2, { ...props, sx: { fontWeight: 600 } }),
     td: (props) => React9.createElement(TableCell2, props)
   };
+  return Object.fromEntries(
+    Object.entries(components).map(([tag, render]) => [
+      tag,
+      ({ component: _component, as: _as, ...props }) => render(props)
+    ])
+  );
 }
 function MarkdownView({ content, className }) {
   const components = useMemo7(() => createMuiComponents(), []);
@@ -1410,7 +1491,7 @@ function MarkdownView({ content, className }) {
     const rehypePlugins = [];
     if (remarkGfmMod) remarkPlugins.push(remarkGfmMod.default);
     if (rehypeHighlightMod) rehypePlugins.push(rehypeHighlightMod.default);
-    if (rehypeRawMod) rehypePlugins.push(rehypeRawMod.default);
+    if (rehypeRawMod) rehypePlugins.push(rehypeSanitizeRawHtml, rehypeRawMod.default);
     return React9.createElement(
       MarkdownRoot,
       { className },
@@ -1755,8 +1836,9 @@ var lazyReactPdf = createLazyImport("react-pdf", async () => {
   }
   return mod;
 });
+var PDF_DATA_URI = /^data:application\/pdf[;,]/i;
 function toDataUri(content) {
-  if (content.startsWith("data:")) return content;
+  if (content.startsWith("data:")) return PDF_DATA_URI.test(content) ? content : void 0;
   if (content.startsWith("%PDF-")) {
     const base64 = typeof btoa === "function" ? btoa(content) : Buffer.from(content).toString("base64");
     return `data:application/pdf;base64,${base64}`;
@@ -1805,6 +1887,13 @@ function PdfView({ content, className, title }) {
   const goToNext = useCallback3(() => setPageNumber((p) => Math.min(numPages, p + 1)), []);
   const zoomIn = useCallback3(() => setScale((s) => Math.min(3, s + 0.25)), []);
   const zoomOut = useCallback3(() => setScale((s) => Math.max(0.25, s - 0.25)), []);
+  if (!dataUri) {
+    return React12.createElement(
+      Typography6,
+      { className, variant: "body2", color: "error" },
+      "This content is not a PDF document."
+    );
+  }
   if (!reactPdf) {
     return React12.createElement("iframe", {
       className: className ?? "fmcp-pdf-content",

package/esm/renderer/maps/index.mjs

@@ -5,6 +5,7 @@ import Paper from "@mui/material/Paper";
 import { styled } from "@mui/material/styles";
 import Typography from "@mui/material/Typography";
 import React, { useEffect as useEffect2 } from "react";
+import { sanitizeHtml } from "@frontmcp/uipack/shell";
 
 // libs/ui/src/renderer/common/inject-stylesheet.ts
 function injectStylesheet(href, id) {
@@ -145,7 +146,12 @@ function parseMapConfig(content) {
       geojson: parsed
     };
   }
-  return parsed;
+  const config = parsed;
+  const tileLayer = config.tileLayer;
+  if (tileLayer?.attribution !== void 0) {
+    return { ...config, tileLayer: { ...tileLayer, attribution: sanitizeHtml(String(tileLayer.attribution)) } };
+  }
+  return config;
 }
 function MapView({ config, className }) {
   useEffect2(() => {

package/esm/renderer/math/index.mjs

@@ -92,17 +92,75 @@ function useLazyModule(lazy) {
   return lazy.get();
 }
 
+// libs/ui/src/renderer/math/math-spans.ts
+function lastEscapeOf(source, closer) {
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    if (source[index + 1] === closer) last = index;
+    index++;
+  }
+  return last;
+}
+function lastEnvironmentEnd(source) {
+  const lastBrace = source.lastIndexOf("}");
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    const nameStart = index + 5;
+    if (source.startsWith("end{", index + 1) && nameStart < lastBrace && source[nameStart] !== "}") last = index;
+    index++;
+  }
+  return last;
+}
+function hasEscapedPair(source, opener, closer) {
+  const start = source.indexOf(`\\${opener}`);
+  return start !== -1 && lastEscapeOf(source, closer) >= start + 2;
+}
+function createMathSpanFinder(source) {
+  const bracketClose = lastEscapeOf(source, "]");
+  const parenClose = lastEscapeOf(source, ")");
+  const environmentEnd = lastEnvironmentEnd(source);
+  let nextDoubleDollar = -2;
+  return (index) => {
+    if (source.startsWith("$$", index)) {
+      if (nextDoubleDollar !== -1 && nextDoubleDollar < index + 2) nextDoubleDollar = source.indexOf("$$", index + 2);
+      if (nextDoubleDollar > index + 2) return nextDoubleDollar + 2;
+    }
+    if (source[index] === "$") {
+      let close = index + 1;
+      while (close < source.length && source[close] !== "$" && source[close] !== "\n") close++;
+      if (source[close] === "$" && close > index + 1) return close + 1;
+    }
+    if (source.startsWith("\\[", index) && bracketClose >= index + 2) return bracketClose + 2;
+    if (source.startsWith("\\(", index) && parenClose >= index + 2) return parenClose + 2;
+    if (source.startsWith("\\begin{", index) && environmentEnd >= index + 7) {
+      return source.indexOf("}", environmentEnd + 6) + 1;
+    }
+    return -1;
+  };
+}
+function findMathSpans(source) {
+  const findSpanEnd = createMathSpanFinder(source);
+  const spans = [];
+  for (let index = 0; index < source.length; index++) {
+    const end = findSpanEnd(index);
+    if (end === -1) continue;
+    spans.push({ start: index, end });
+    index = end - 1;
+  }
+  return spans;
+}
+
 // libs/ui/src/renderer/math/index.ts
 var KATEX_CSS_URL = "https://esm.sh/katex@0.16.11/dist/katex.min.css";
 var KATEX_CSS_ID = "fmcp-katex-css";
 var MATH_DISPLAY = /\$\$(?:[^$]|\$(?!\$))+\$\$/s;
 var MATH_INLINE = /\$[^$\n]+?\$/;
-var MATH_BRACKET_DISPLAY = /\\\[(?:[^\\]|\\.)*\\\]/s;
-var MATH_PAREN_INLINE = /\\\((?:[^\\]|\\.)*\\\)/s;
 var MATH_BEGIN = /\\begin\{(?:equation|align|gather|matrix|pmatrix|bmatrix|cases)\}/;
 function isMath(content) {
   const trimmed = content.trim();
-  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || MATH_BRACKET_DISPLAY.test(trimmed) || MATH_PAREN_INLINE.test(trimmed) || MATH_BEGIN.test(trimmed);
+  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || hasEscapedPair(trimmed, "[", "]") || hasEscapedPair(trimmed, "(", ")") || MATH_BEGIN.test(trimmed);
 }
 var lazyKatex = createLazyImport("katex", async () => {
   const mod = await runtimeImportWithFallback("katex", esmShUrl("katex@0.16"));
@@ -136,14 +194,12 @@ var MathInline = styled("span", {
 });
 function parseMathContent(source) {
   const segments = [];
-  const mathRegex = /(\$\$(?:[^$]|\$(?!\$))+\$\$|\$[^$\n]+?\$|\\\[(?:[^\\]|\\.)*\\\]|\\\((?:[^\\]|\\.)*\\\)|\\begin\{(?:[^\\]|\\.)*\\end\{[^}]+\})/gs;
   let lastIndex = 0;
-  let match;
-  while ((match = mathRegex.exec(source)) !== null) {
-    if (match.index > lastIndex) {
-      segments.push({ type: "text", content: source.slice(lastIndex, match.index) });
+  for (const span of findMathSpans(source)) {
+    if (span.start > lastIndex) {
+      segments.push({ type: "text", content: source.slice(lastIndex, span.start) });
     }
-    const raw = match[0];
+    const raw = source.slice(span.start, span.end);
     if (raw.startsWith("$$")) {
       segments.push({ type: "display", content: raw.slice(2, -2).trim() });
     } else if (raw.startsWith("\\[")) {
@@ -155,7 +211,7 @@ function parseMathContent(source) {
     } else if (raw.startsWith("$")) {
       segments.push({ type: "inline", content: raw.slice(1, -1).trim() });
     }
-    lastIndex = match.index + raw.length;
+    lastIndex = span.end;
   }
   if (lastIndex < source.length) {
     segments.push({ type: "text", content: source.slice(lastIndex) });

package/esm/renderer/mdx/index.mjs

@@ -9,6 +9,7 @@ import TableHead from "@mui/material/TableHead";
 import TableRow from "@mui/material/TableRow";
 import Typography from "@mui/material/Typography";
 import React, { useMemo } from "react";
+import { sanitizeHtml } from "@frontmcp/uipack/shell";
 
 // libs/ui/src/renderer/common/lazy-import.ts
 var ESM_SH_BASE = "https://esm.sh/";
@@ -109,6 +110,16 @@ var lazyRehypeRaw = createLazyImport("rehype-raw", async () => {
   const mod = await runtimeImportWithFallback("rehype-raw", esmShUrl("rehype-raw@7"));
   return mod;
 });
+var RAW_HTML_POLICY = { maxMarkupLength: Number.MAX_SAFE_INTEGER };
+function rehypeSanitizeRawHtml() {
+  return (tree) => {
+    const pending = [tree];
+    for (let node = pending.pop(); node; node = pending.pop()) {
+      if (node.type === "raw") node.value = sanitizeHtml(node.value ?? "", RAW_HTML_POLICY);
+      for (const child of node.children ?? []) pending.push(child);
+    }
+  };
+}
 var MarkdownRoot = styled(Box, {
   name: "FrontMcpMarkdown",
   slot: "Root"
@@ -163,7 +174,7 @@ var Blockquote = styled("blockquote", {
   "& > p": { margin: 0 }
 }));
 function createMuiComponents() {
-  return {
+  const components = {
     h1: (props) => React.createElement(Typography, { ...props, variant: "h4", gutterBottom: true }),
     h2: (props) => React.createElement(Typography, { ...props, variant: "h5", gutterBottom: true }),
     h3: (props) => React.createElement(Typography, { ...props, variant: "h6", gutterBottom: true }),
@@ -185,6 +196,12 @@ function createMuiComponents() {
     th: (props) => React.createElement(TableCell, { ...props, sx: { fontWeight: 600 } }),
     td: (props) => React.createElement(TableCell, props)
   };
+  return Object.fromEntries(
+    Object.entries(components).map(([tag, render]) => [
+      tag,
+      ({ component: _component, as: _as, ...props }) => render(props)
+    ])
+  );
 }
 function MarkdownView({ content, className }) {
   const components = useMemo(() => createMuiComponents(), []);
@@ -198,7 +215,7 @@ function MarkdownView({ content, className }) {
     const rehypePlugins = [];
     if (remarkGfmMod) remarkPlugins.push(remarkGfmMod.default);
     if (rehypeHighlightMod) rehypePlugins.push(rehypeHighlightMod.default);
-    if (rehypeRawMod) rehypePlugins.push(rehypeRawMod.default);
+    if (rehypeRawMod) rehypePlugins.push(rehypeSanitizeRawHtml, rehypeRawMod.default);
     return React.createElement(
       MarkdownRoot,
       { className },

package/esm/renderer/pdf/index.mjs

@@ -94,8 +94,9 @@ var lazyReactPdf = createLazyImport("react-pdf", async () => {
   }
   return mod;
 });
+var PDF_DATA_URI = /^data:application\/pdf[;,]/i;
 function toDataUri(content) {
-  if (content.startsWith("data:")) return content;
+  if (content.startsWith("data:")) return PDF_DATA_URI.test(content) ? content : void 0;
   if (content.startsWith("%PDF-")) {
     const base64 = typeof btoa === "function" ? btoa(content) : Buffer.from(content).toString("base64");
     return `data:application/pdf;base64,${base64}`;
@@ -144,6 +145,13 @@ function PdfView({ content, className, title }) {
   const goToNext = useCallback(() => setPageNumber((p) => Math.min(numPages, p + 1)), []);
   const zoomIn = useCallback(() => setScale((s) => Math.min(3, s + 0.25)), []);
   const zoomOut = useCallback(() => setScale((s) => Math.max(0.25, s - 0.25)), []);
+  if (!dataUri) {
+    return React.createElement(
+      Typography,
+      { className, variant: "body2", color: "error" },
+      "This content is not a PDF document."
+    );
+  }
   if (!reactPdf) {
     return React.createElement("iframe", {
       className: className ?? "fmcp-pdf-content",

package/index.js

@@ -274,6 +274,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -299,6 +309,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/ui",
-  "version": "1.12.0-rc.1",
+  "version": "1.12.1",
   "description": "React components, bridge hooks and content renderers (built on MUI) for FrontMCP tool widgets in ChatGPT, Claude and other MCP Apps hosts",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://frontmcp.dev/reference/ui",
@@ -436,7 +436,7 @@
     }
   },
   "dependencies": {
-    "@frontmcp/uipack": "1.12.0-rc.1"
+    "@frontmcp/uipack": "1.12.1"
   },
   "devDependencies": {
     "@types/dompurify": "^3.0.0",

package/react/index.js

@@ -265,6 +265,16 @@ var DEFAULT_CONFIG = {
   debug: false,
   initTimeout: 5e3
 };
+function limitToTrustedOrigins(adapterConfig, trustedOrigins) {
+  const ownOrigins = adapterConfig?.options?.["trustedOrigins"];
+  const origins = Array.isArray(ownOrigins) && ownOrigins.length > 0 ? ownOrigins.filter((origin) => trustedOrigins.includes(origin)) : trustedOrigins;
+  if (origins.length === 0) {
+    throw new Error(
+      'The bridge trustedOrigins and adapterConfigs["ext-apps"].options.trustedOrigins have no origin in common. List the host origin in both, or set only one of them.'
+    );
+  }
+  return { ...adapterConfig, options: { ...adapterConfig?.options, trustedOrigins: origins } };
+}
 var FrontMcpBridge = class {
   _config;
   _registry;
@@ -290,6 +300,13 @@ var FrontMcpBridge = class {
         this._registry.configure(id, adapterConfig);
       }
     }
+    if (this._config.trustedOrigins?.length) {
+      const extAppsConfig = limitToTrustedOrigins(
+        this._config.adapterConfigs?.["ext-apps"],
+        this._config.trustedOrigins
+      );
+      this._registry.configure("ext-apps", extAppsConfig);
+    }
   }
   // ============================================
   // Public Properties

package/renderer/index.js

@@ -1124,6 +1124,7 @@ var import_Paper = __toESM(require("@mui/material/Paper"));
 var import_styles7 = require("@mui/material/styles");
 var import_Typography4 = __toESM(require("@mui/material/Typography"));
 var import_react9 = __toESM(require("react"));
+var import_shell = require("@frontmcp/uipack/shell");
 var LEAFLET_CSS_URL = "https://esm.sh/leaflet@1.9.4/dist/leaflet.css";
 var LEAFLET_CSS_ID = "fmcp-leaflet-css";
 var DEFAULT_TILE_URL = "https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png";
@@ -1174,7 +1175,12 @@ function parseMapConfig(content) {
       geojson: parsed
     };
   }
-  return parsed;
+  const config = parsed;
+  const tileLayer = config.tileLayer;
+  if (tileLayer?.attribution !== void 0) {
+    return { ...config, tileLayer: { ...tileLayer, attribution: (0, import_shell.sanitizeHtml)(String(tileLayer.attribution)) } };
+  }
+  return config;
 }
 function MapView({ config, className }) {
   (0, import_react9.useEffect)(() => {
@@ -1245,16 +1251,76 @@ var import_Alert5 = __toESM(require("@mui/material/Alert"));
 var import_Box7 = __toESM(require("@mui/material/Box"));
 var import_styles8 = require("@mui/material/styles");
 var import_react10 = __toESM(require("react"));
+
+// libs/ui/src/renderer/math/math-spans.ts
+function lastEscapeOf(source, closer) {
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    if (source[index + 1] === closer) last = index;
+    index++;
+  }
+  return last;
+}
+function lastEnvironmentEnd(source) {
+  const lastBrace = source.lastIndexOf("}");
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    const nameStart = index + 5;
+    if (source.startsWith("end{", index + 1) && nameStart < lastBrace && source[nameStart] !== "}") last = index;
+    index++;
+  }
+  return last;
+}
+function hasEscapedPair(source, opener, closer) {
+  const start = source.indexOf(`\\${opener}`);
+  return start !== -1 && lastEscapeOf(source, closer) >= start + 2;
+}
+function createMathSpanFinder(source) {
+  const bracketClose = lastEscapeOf(source, "]");
+  const parenClose = lastEscapeOf(source, ")");
+  const environmentEnd = lastEnvironmentEnd(source);
+  let nextDoubleDollar = -2;
+  return (index) => {
+    if (source.startsWith("$$", index)) {
+      if (nextDoubleDollar !== -1 && nextDoubleDollar < index + 2) nextDoubleDollar = source.indexOf("$$", index + 2);
+      if (nextDoubleDollar > index + 2) return nextDoubleDollar + 2;
+    }
+    if (source[index] === "$") {
+      let close = index + 1;
+      while (close < source.length && source[close] !== "$" && source[close] !== "\n") close++;
+      if (source[close] === "$" && close > index + 1) return close + 1;
+    }
+    if (source.startsWith("\\[", index) && bracketClose >= index + 2) return bracketClose + 2;
+    if (source.startsWith("\\(", index) && parenClose >= index + 2) return parenClose + 2;
+    if (source.startsWith("\\begin{", index) && environmentEnd >= index + 7) {
+      return source.indexOf("}", environmentEnd + 6) + 1;
+    }
+    return -1;
+  };
+}
+function findMathSpans(source) {
+  const findSpanEnd = createMathSpanFinder(source);
+  const spans = [];
+  for (let index = 0; index < source.length; index++) {
+    const end = findSpanEnd(index);
+    if (end === -1) continue;
+    spans.push({ start: index, end });
+    index = end - 1;
+  }
+  return spans;
+}
+
+// libs/ui/src/renderer/math/index.ts
 var KATEX_CSS_URL = "https://esm.sh/katex@0.16.11/dist/katex.min.css";
 var KATEX_CSS_ID = "fmcp-katex-css";
 var MATH_DISPLAY = /\$\$(?:[^$]|\$(?!\$))+\$\$/s;
 var MATH_INLINE = /\$[^$\n]+?\$/;
-var MATH_BRACKET_DISPLAY = /\\\[(?:[^\\]|\\.)*\\\]/s;
-var MATH_PAREN_INLINE = /\\\((?:[^\\]|\\.)*\\\)/s;
 var MATH_BEGIN = /\\begin\{(?:equation|align|gather|matrix|pmatrix|bmatrix|cases)\}/;
 function isMath(content) {
   const trimmed = content.trim();
-  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || MATH_BRACKET_DISPLAY.test(trimmed) || MATH_PAREN_INLINE.test(trimmed) || MATH_BEGIN.test(trimmed);
+  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || hasEscapedPair(trimmed, "[", "]") || hasEscapedPair(trimmed, "(", ")") || MATH_BEGIN.test(trimmed);
 }
 var lazyKatex = createLazyImport("katex", async () => {
   const mod = await runtimeImportWithFallback("katex", esmShUrl("katex@0.16"));
@@ -1288,14 +1354,12 @@ var MathInline = (0, import_styles8.styled)("span", {
 });
 function parseMathContent(source) {
   const segments = [];
-  const mathRegex = /(\$\$(?:[^$]|\$(?!\$))+\$\$|\$[^$\n]+?\$|\\\[(?:[^\\]|\\.)*\\\]|\\\((?:[^\\]|\\.)*\\\)|\\begin\{(?:[^\\]|\\.)*\\end\{[^}]+\})/gs;
   let lastIndex = 0;
-  let match;
-  while ((match = mathRegex.exec(source)) !== null) {
-    if (match.index > lastIndex) {
-      segments.push({ type: "text", content: source.slice(lastIndex, match.index) });
+  for (const span of findMathSpans(source)) {
+    if (span.start > lastIndex) {
+      segments.push({ type: "text", content: source.slice(lastIndex, span.start) });
     }
-    const raw = match[0];
+    const raw = source.slice(span.start, span.end);
     if (raw.startsWith("$$")) {
       segments.push({ type: "display", content: raw.slice(2, -2).trim() });
     } else if (raw.startsWith("\\[")) {
@@ -1307,7 +1371,7 @@ function parseMathContent(source) {
     } else if (raw.startsWith("$")) {
       segments.push({ type: "inline", content: raw.slice(1, -1).trim() });
     }
-    lastIndex = match.index + raw.length;
+    lastIndex = span.end;
   }
   if (lastIndex < source.length) {
     segments.push({ type: "text", content: source.slice(lastIndex) });
@@ -1386,6 +1450,7 @@ var import_TableHead2 = __toESM(require("@mui/material/TableHead"));
 var import_TableRow2 = __toESM(require("@mui/material/TableRow"));
 var import_Typography5 = __toESM(require("@mui/material/Typography"));
 var import_react11 = __toESM(require("react"));
+var import_shell2 = require("@frontmcp/uipack/shell");
 var lazyReactMarkdown = createLazyImport(
   "react-markdown",
   async () => {
@@ -1408,6 +1473,16 @@ var lazyRehypeRaw = createLazyImport("rehype-raw", async () => {
   const mod = await runtimeImportWithFallback("rehype-raw", esmShUrl("rehype-raw@7"));
   return mod;
 });
+var RAW_HTML_POLICY = { maxMarkupLength: Number.MAX_SAFE_INTEGER };
+function rehypeSanitizeRawHtml() {
+  return (tree) => {
+    const pending = [tree];
+    for (let node = pending.pop(); node; node = pending.pop()) {
+      if (node.type === "raw") node.value = (0, import_shell2.sanitizeHtml)(node.value ?? "", RAW_HTML_POLICY);
+      for (const child of node.children ?? []) pending.push(child);
+    }
+  };
+}
 var MarkdownRoot = (0, import_styles9.styled)(import_Box8.default, {
   name: "FrontMcpMarkdown",
   slot: "Root"
@@ -1462,7 +1537,7 @@ var Blockquote = (0, import_styles9.styled)("blockquote", {
   "& > p": { margin: 0 }
 }));
 function createMuiComponents() {
-  return {
+  const components = {
     h1: (props) => import_react11.default.createElement(import_Typography5.default, { ...props, variant: "h4", gutterBottom: true }),
     h2: (props) => import_react11.default.createElement(import_Typography5.default, { ...props, variant: "h5", gutterBottom: true }),
     h3: (props) => import_react11.default.createElement(import_Typography5.default, { ...props, variant: "h6", gutterBottom: true }),
@@ -1484,6 +1559,12 @@ function createMuiComponents() {
     th: (props) => import_react11.default.createElement(import_TableCell2.default, { ...props, sx: { fontWeight: 600 } }),
     td: (props) => import_react11.default.createElement(import_TableCell2.default, props)
   };
+  return Object.fromEntries(
+    Object.entries(components).map(([tag, render]) => [
+      tag,
+      ({ component: _component, as: _as, ...props }) => render(props)
+    ])
+  );
 }
 function MarkdownView({ content, className }) {
   const components = (0, import_react11.useMemo)(() => createMuiComponents(), []);
@@ -1497,7 +1578,7 @@ function MarkdownView({ content, className }) {
     const rehypePlugins = [];
     if (remarkGfmMod) remarkPlugins.push(remarkGfmMod.default);
     if (rehypeHighlightMod) rehypePlugins.push(rehypeHighlightMod.default);
-    if (rehypeRawMod) rehypePlugins.push(rehypeRawMod.default);
+    if (rehypeRawMod) rehypePlugins.push(rehypeSanitizeRawHtml, rehypeRawMod.default);
     return import_react11.default.createElement(
       MarkdownRoot,
       { className },
@@ -1842,8 +1923,9 @@ var lazyReactPdf = createLazyImport("react-pdf", async () => {
   }
   return mod;
 });
+var PDF_DATA_URI = /^data:application\/pdf[;,]/i;
 function toDataUri(content) {
-  if (content.startsWith("data:")) return content;
+  if (content.startsWith("data:")) return PDF_DATA_URI.test(content) ? content : void 0;
   if (content.startsWith("%PDF-")) {
     const base64 = typeof btoa === "function" ? btoa(content) : Buffer.from(content).toString("base64");
     return `data:application/pdf;base64,${base64}`;
@@ -1892,6 +1974,13 @@ function PdfView({ content, className, title }) {
   const goToNext = (0, import_react14.useCallback)(() => setPageNumber((p) => Math.min(numPages, p + 1)), []);
   const zoomIn = (0, import_react14.useCallback)(() => setScale((s) => Math.min(3, s + 0.25)), []);
   const zoomOut = (0, import_react14.useCallback)(() => setScale((s) => Math.max(0.25, s - 0.25)), []);
+  if (!dataUri) {
+    return import_react14.default.createElement(
+      import_Typography6.default,
+      { className, variant: "body2", color: "error" },
+      "This content is not a PDF document."
+    );
+  }
   if (!reactPdf) {
     return import_react14.default.createElement("iframe", {
       className: className ?? "fmcp-pdf-content",

package/renderer/maps/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/maps/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAoB,MAAM,OAAO,CAAC;AAKzC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAe/D,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAe9C;AAyID,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAInC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAWrE;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/maps/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAoB,MAAM,OAAO,CAAC;AAOzC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAe/D,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD,wBAAgB,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAe9C;AA+ID,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAInC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAWrE;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/renderer/maps/index.js

@@ -41,6 +41,7 @@ var import_Paper = __toESM(require("@mui/material/Paper"));
 var import_styles = require("@mui/material/styles");
 var import_Typography = __toESM(require("@mui/material/Typography"));
 var import_react2 = __toESM(require("react"));
+var import_shell = require("@frontmcp/uipack/shell");
 
 // libs/ui/src/renderer/common/inject-stylesheet.ts
 function injectStylesheet(href, id) {
@@ -181,7 +182,12 @@ function parseMapConfig(content) {
       geojson: parsed
     };
   }
-  return parsed;
+  const config = parsed;
+  const tileLayer = config.tileLayer;
+  if (tileLayer?.attribution !== void 0) {
+    return { ...config, tileLayer: { ...tileLayer, attribution: (0, import_shell.sanitizeHtml)(String(tileLayer.attribution)) } };
+  }
+  return config;
 }
 function MapView({ config, className }) {
   (0, import_react2.useEffect)(() => {

package/renderer/math/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/math/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAA6B,MAAM,OAAO,CAAC;AAKlD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAmB/D,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS/C;AAqKD,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAInC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAMrE;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/math/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAA6B,MAAM,OAAO,CAAC;AAKlD,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkB/D,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS/C;AAgKD,qBAAa,YAAa,YAAW,eAAe;IAClD,QAAQ,CAAC,IAAI,UAAU;IACvB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAInC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAMrE;AAED,eAAO,MAAM,YAAY,cAAqB,CAAC"}

package/renderer/math/index.js

@@ -128,17 +128,75 @@ function useLazyModule(lazy) {
   return lazy.get();
 }
 
+// libs/ui/src/renderer/math/math-spans.ts
+function lastEscapeOf(source, closer) {
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    if (source[index + 1] === closer) last = index;
+    index++;
+  }
+  return last;
+}
+function lastEnvironmentEnd(source) {
+  const lastBrace = source.lastIndexOf("}");
+  let last = -1;
+  for (let index = 0; index < source.length; index++) {
+    if (source[index] !== "\\") continue;
+    const nameStart = index + 5;
+    if (source.startsWith("end{", index + 1) && nameStart < lastBrace && source[nameStart] !== "}") last = index;
+    index++;
+  }
+  return last;
+}
+function hasEscapedPair(source, opener, closer) {
+  const start = source.indexOf(`\\${opener}`);
+  return start !== -1 && lastEscapeOf(source, closer) >= start + 2;
+}
+function createMathSpanFinder(source) {
+  const bracketClose = lastEscapeOf(source, "]");
+  const parenClose = lastEscapeOf(source, ")");
+  const environmentEnd = lastEnvironmentEnd(source);
+  let nextDoubleDollar = -2;
+  return (index) => {
+    if (source.startsWith("$$", index)) {
+      if (nextDoubleDollar !== -1 && nextDoubleDollar < index + 2) nextDoubleDollar = source.indexOf("$$", index + 2);
+      if (nextDoubleDollar > index + 2) return nextDoubleDollar + 2;
+    }
+    if (source[index] === "$") {
+      let close = index + 1;
+      while (close < source.length && source[close] !== "$" && source[close] !== "\n") close++;
+      if (source[close] === "$" && close > index + 1) return close + 1;
+    }
+    if (source.startsWith("\\[", index) && bracketClose >= index + 2) return bracketClose + 2;
+    if (source.startsWith("\\(", index) && parenClose >= index + 2) return parenClose + 2;
+    if (source.startsWith("\\begin{", index) && environmentEnd >= index + 7) {
+      return source.indexOf("}", environmentEnd + 6) + 1;
+    }
+    return -1;
+  };
+}
+function findMathSpans(source) {
+  const findSpanEnd = createMathSpanFinder(source);
+  const spans = [];
+  for (let index = 0; index < source.length; index++) {
+    const end = findSpanEnd(index);
+    if (end === -1) continue;
+    spans.push({ start: index, end });
+    index = end - 1;
+  }
+  return spans;
+}
+
 // libs/ui/src/renderer/math/index.ts
 var KATEX_CSS_URL = "https://esm.sh/katex@0.16.11/dist/katex.min.css";
 var KATEX_CSS_ID = "fmcp-katex-css";
 var MATH_DISPLAY = /\$\$(?:[^$]|\$(?!\$))+\$\$/s;
 var MATH_INLINE = /\$[^$\n]+?\$/;
-var MATH_BRACKET_DISPLAY = /\\\[(?:[^\\]|\\.)*\\\]/s;
-var MATH_PAREN_INLINE = /\\\((?:[^\\]|\\.)*\\\)/s;
 var MATH_BEGIN = /\\begin\{(?:equation|align|gather|matrix|pmatrix|bmatrix|cases)\}/;
 function isMath(content) {
   const trimmed = content.trim();
-  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || MATH_BRACKET_DISPLAY.test(trimmed) || MATH_PAREN_INLINE.test(trimmed) || MATH_BEGIN.test(trimmed);
+  return MATH_DISPLAY.test(trimmed) || MATH_INLINE.test(trimmed) || hasEscapedPair(trimmed, "[", "]") || hasEscapedPair(trimmed, "(", ")") || MATH_BEGIN.test(trimmed);
 }
 var lazyKatex = createLazyImport("katex", async () => {
   const mod = await runtimeImportWithFallback("katex", esmShUrl("katex@0.16"));
@@ -172,14 +230,12 @@ var MathInline = (0, import_styles.styled)("span", {
 });
 function parseMathContent(source) {
   const segments = [];
-  const mathRegex = /(\$\$(?:[^$]|\$(?!\$))+\$\$|\$[^$\n]+?\$|\\\[(?:[^\\]|\\.)*\\\]|\\\((?:[^\\]|\\.)*\\\)|\\begin\{(?:[^\\]|\\.)*\\end\{[^}]+\})/gs;
   let lastIndex = 0;
-  let match;
-  while ((match = mathRegex.exec(source)) !== null) {
-    if (match.index > lastIndex) {
-      segments.push({ type: "text", content: source.slice(lastIndex, match.index) });
+  for (const span of findMathSpans(source)) {
+    if (span.start > lastIndex) {
+      segments.push({ type: "text", content: source.slice(lastIndex, span.start) });
     }
-    const raw = match[0];
+    const raw = source.slice(span.start, span.end);
     if (raw.startsWith("$$")) {
       segments.push({ type: "display", content: raw.slice(2, -2).trim() });
     } else if (raw.startsWith("\\[")) {
@@ -191,7 +247,7 @@ function parseMathContent(source) {
     } else if (raw.startsWith("$")) {
       segments.push({ type: "inline", content: raw.slice(1, -1).trim() });
     }
-    lastIndex = match.index + raw.length;
+    lastIndex = span.end;
   }
   if (lastIndex < source.length) {
     segments.push({ type: "text", content: source.slice(lastIndex) });

package/renderer/math/math-spans.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Math delimiters found in one pass over the source. The spans are the matches of
+ * /\$\$(?:[^$]|\$(?!\$))+\$\$|\$[^$\n]+?\$|\\\[(?:[^\\]|\\.)*\\\]|\\\((?:[^\\]|\\.)*\\\)|\\begin\{(?:[^\\]|\\.)*\\end\{[^}]+\}/gs
+ * without its backtracking, which reads the rest of the source again for every delimiter that has no closer.
+ */
+/** Start and end positions of a math span in the source, delimiters included. */
+export interface MathSpan {
+    start: number;
+    end: number;
+}
+/** Whether the source has a backslash-escaped `opener` with a backslash-escaped `closer` after it. */
+export declare function hasEscapedPair(source: string, opener: string, closer: string): boolean;
+/** Find the math spans of the source, left to right and without overlap. */
+export declare function findMathSpans(source: string): MathSpan[];
+//# sourceMappingURL=math-spans.d.ts.map

package/renderer/math/math-spans.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"math-spans.d.ts","sourceRoot":"","sources":["../../../src/renderer/math/math-spans.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iFAAiF;AACjF,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACb;AA0BD,sGAAsG;AACtG,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAGtF;AA4BD,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAUxD"}

package/renderer/mdx/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/mdx/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAkB,MAAM,OAAO,CAAC;AAIvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AA6N/D,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,KAAK;IAEtB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAUnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAMrE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/mdx/index.ts"],"names":[],"mappings":"AASA,OAAO,KAAkB,MAAM,OAAO,CAAC;AAMvC,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAwP/D,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,KAAK;IAEtB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAUnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAMrE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/renderer/mdx/index.js

@@ -44,6 +44,7 @@ var import_TableHead = __toESM(require("@mui/material/TableHead"));
 var import_TableRow = __toESM(require("@mui/material/TableRow"));
 var import_Typography = __toESM(require("@mui/material/Typography"));
 var import_react2 = __toESM(require("react"));
+var import_shell = require("@frontmcp/uipack/shell");
 
 // libs/ui/src/renderer/common/lazy-import.ts
 var ESM_SH_BASE = "https://esm.sh/";
@@ -144,6 +145,16 @@ var lazyRehypeRaw = createLazyImport("rehype-raw", async () => {
   const mod = await runtimeImportWithFallback("rehype-raw", esmShUrl("rehype-raw@7"));
   return mod;
 });
+var RAW_HTML_POLICY = { maxMarkupLength: Number.MAX_SAFE_INTEGER };
+function rehypeSanitizeRawHtml() {
+  return (tree) => {
+    const pending = [tree];
+    for (let node = pending.pop(); node; node = pending.pop()) {
+      if (node.type === "raw") node.value = (0, import_shell.sanitizeHtml)(node.value ?? "", RAW_HTML_POLICY);
+      for (const child of node.children ?? []) pending.push(child);
+    }
+  };
+}
 var MarkdownRoot = (0, import_styles.styled)(import_Box.default, {
   name: "FrontMcpMarkdown",
   slot: "Root"
@@ -198,7 +209,7 @@ var Blockquote = (0, import_styles.styled)("blockquote", {
   "& > p": { margin: 0 }
 }));
 function createMuiComponents() {
-  return {
+  const components = {
     h1: (props) => import_react2.default.createElement(import_Typography.default, { ...props, variant: "h4", gutterBottom: true }),
     h2: (props) => import_react2.default.createElement(import_Typography.default, { ...props, variant: "h5", gutterBottom: true }),
     h3: (props) => import_react2.default.createElement(import_Typography.default, { ...props, variant: "h6", gutterBottom: true }),
@@ -220,6 +231,12 @@ function createMuiComponents() {
     th: (props) => import_react2.default.createElement(import_TableCell.default, { ...props, sx: { fontWeight: 600 } }),
     td: (props) => import_react2.default.createElement(import_TableCell.default, props)
   };
+  return Object.fromEntries(
+    Object.entries(components).map(([tag, render]) => [
+      tag,
+      ({ component: _component, as: _as, ...props }) => render(props)
+    ])
+  );
 }
 function MarkdownView({ content, className }) {
   const components = (0, import_react2.useMemo)(() => createMuiComponents(), []);
@@ -233,7 +250,7 @@ function MarkdownView({ content, className }) {
     const rehypePlugins = [];
     if (remarkGfmMod) remarkPlugins.push(remarkGfmMod.default);
     if (rehypeHighlightMod) rehypePlugins.push(rehypeHighlightMod.default);
-    if (rehypeRawMod) rehypePlugins.push(rehypeRawMod.default);
+    if (rehypeRawMod) rehypePlugins.push(rehypeSanitizeRawHtml, rehypeRawMod.default);
     return import_react2.default.createElement(
       MarkdownRoot,
       { className },

package/renderer/pdf/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/pdf/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAyC,MAAM,OAAO,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAqL/D,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAQnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAOrE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/renderer/pdf/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAyC,MAAM,OAAO,CAAC;AAI9D,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAkM/D,qBAAa,WAAY,YAAW,eAAe;IACjD,QAAQ,CAAC,IAAI,SAAS;IACtB,QAAQ,CAAC,QAAQ,MAAM;IAEvB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAQnC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,KAAK,CAAC,YAAY;CAOrE;AAED,eAAO,MAAM,WAAW,aAAoB,CAAC"}

package/renderer/pdf/index.js

@@ -129,8 +129,9 @@ var lazyReactPdf = createLazyImport("react-pdf", async () => {
   }
   return mod;
 });
+var PDF_DATA_URI = /^data:application\/pdf[;,]/i;
 function toDataUri(content) {
-  if (content.startsWith("data:")) return content;
+  if (content.startsWith("data:")) return PDF_DATA_URI.test(content) ? content : void 0;
   if (content.startsWith("%PDF-")) {
     const base64 = typeof btoa === "function" ? btoa(content) : Buffer.from(content).toString("base64");
     return `data:application/pdf;base64,${base64}`;
@@ -179,6 +180,13 @@ function PdfView({ content, className, title }) {
   const goToNext = (0, import_react2.useCallback)(() => setPageNumber((p) => Math.min(numPages, p + 1)), []);
   const zoomIn = (0, import_react2.useCallback)(() => setScale((s) => Math.min(3, s + 0.25)), []);
   const zoomOut = (0, import_react2.useCallback)(() => setScale((s) => Math.max(0.25, s - 0.25)), []);
+  if (!dataUri) {
+    return import_react2.default.createElement(
+      import_Typography.default,
+      { className, variant: "body2", color: "error" },
+      "This content is not a PDF document."
+    );
+  }
   if (!reactPdf) {
     return import_react2.default.createElement("iframe", {
       className: className ?? "fmcp-pdf-content",