@frontmcp/uipack 1.8.0 → 1.8.1

package/adapters/content-detector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-detector.d.ts","sourceRoot":"","sources":["../../src/adapters/content-detector.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAyBzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAsCrE"}
+{"version":3,"file":"content-detector.d.ts","sourceRoot":"","sources":["../../src/adapters/content-detector.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AA2BzF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAsCrE"}

package/adapters/index.js

@@ -514,8 +514,9 @@ function escapeHtml(str) {
   const s = String(str);
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -531,7 +532,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -1828,14 +1829,16 @@ var REQUIRED_PLACEHOLDERS = ["CONTENT"];
 var OPTIONAL_PLACEHOLDERS = ["CSP", "DATA", "BRIDGE", "TITLE"];
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -1907,9 +1910,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 
@@ -2585,6 +2586,7 @@ var MERMAID_PREFIXES = [
   "xychart"
 ];
 var PDF_MAGIC = "JVBERi";
+var BASE64_PATTERN = /^[A-Za-z0-9+/=\r\n]+$/;
 function detectContentType(value) {
   if (value === null || value === void 0) {
     return "text";
@@ -2599,7 +2601,7 @@ function detectContentType(value) {
   if (typeof value === "string") {
     const trimmed = value.trimStart();
     if (trimmed.startsWith(PDF_MAGIC)) {
-      return "pdf";
+      return BASE64_PATTERN.test(trimmed.trimEnd()) ? "pdf" : "text";
     }
     for (const prefix of MERMAID_PREFIXES) {
       if (trimmed.startsWith(prefix)) {
@@ -2661,7 +2663,7 @@ function buildPdfHtml(base64) {
 import * as pdfjsLib from 'https://esm.sh/pdfjs-dist@4/build/pdf.min.mjs';
 pdfjsLib.GlobalWorkerOptions.workerSrc = 'https://esm.sh/pdfjs-dist@4/build/pdf.worker.min.mjs';
 
-const base64 = ${JSON.stringify(base64)};
+const base64 = ${safeJsonForScript(base64)};
 const binaryStr = atob(base64);
 const bytes = new Uint8Array(binaryStr.length);
 for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
@@ -2756,6 +2758,12 @@ function buildCspConfig(resolver) {
   }
   return { resourceDomains: cspResourceDomains, connectDomains: cspConnectDomains };
 }
+function renderUnwrappedResult(rawResult) {
+  if (typeof rawResult !== "string") {
+    return `<pre>${escapeHtml(JSON.stringify(rawResult, null, 2))}</pre>`;
+  }
+  return detectContentType(rawResult) === "html" ? rawResult : escapeHtml(rawResult);
+}
 function renderToolTemplate(options) {
   const { toolName, input, output, template, resolver, platformType, sizing } = options;
   const uiType = detectUIType(template);
@@ -2794,8 +2802,7 @@ function renderToolTemplate(options) {
       if (wrapped) {
         html = wrapped;
       } else {
-        const textContent = typeof rawResult === "string" ? rawResult : `<pre>${JSON.stringify(rawResult, null, 2)}</pre>`;
-        const shellResult = buildShell(textContent, shellConfig);
+        const shellResult = buildShell(renderUnwrappedResult(rawResult), shellConfig);
         html = shellResult.html;
         hash = shellResult.hash;
         size = shellResult.size;

package/adapters/template-renderer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAKnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAsBD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAyG/F"}
+{"version":3,"file":"template-renderer.d.ts","sourceRoot":"","sources":["../../src/adapters/template-renderer.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAOnD;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,gBAAgB;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB;IACjB,KAAK,EAAE,OAAO,CAAC;IACf,kBAAkB;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,QAAQ,EAAE,OAAO,CAAC;IAClB,4CAA4C;IAC5C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kDAAkD;IAClD,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAChC;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,iCAAiC;IACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B;AAmCD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,yBAAyB,GAAG,wBAAwB,CAsG/F"}

package/component/index.js

@@ -450,8 +450,9 @@ function createEsmShResolver(options = {}) {
 }
 
 // libs/uipack/src/utils/index.ts
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -467,7 +468,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -2070,14 +2071,16 @@ var REQUIRED_PLACEHOLDERS = ["CONTENT"];
 var OPTIONAL_PLACEHOLDERS = ["CSP", "DATA", "BRIDGE", "TITLE"];
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts

package/esm/adapters/index.mjs

@@ -482,8 +482,9 @@ function escapeHtml(str) {
   const s = String(str);
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -499,7 +500,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -1796,14 +1797,16 @@ var REQUIRED_PLACEHOLDERS = ["CONTENT"];
 var OPTIONAL_PLACEHOLDERS = ["CSP", "DATA", "BRIDGE", "TITLE"];
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -1875,9 +1878,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 
@@ -2553,6 +2554,7 @@ var MERMAID_PREFIXES = [
   "xychart"
 ];
 var PDF_MAGIC = "JVBERi";
+var BASE64_PATTERN = /^[A-Za-z0-9+/=\r\n]+$/;
 function detectContentType(value) {
   if (value === null || value === void 0) {
     return "text";
@@ -2567,7 +2569,7 @@ function detectContentType(value) {
   if (typeof value === "string") {
     const trimmed = value.trimStart();
     if (trimmed.startsWith(PDF_MAGIC)) {
-      return "pdf";
+      return BASE64_PATTERN.test(trimmed.trimEnd()) ? "pdf" : "text";
     }
     for (const prefix of MERMAID_PREFIXES) {
       if (trimmed.startsWith(prefix)) {
@@ -2629,7 +2631,7 @@ function buildPdfHtml(base64) {
 import * as pdfjsLib from 'https://esm.sh/pdfjs-dist@4/build/pdf.min.mjs';
 pdfjsLib.GlobalWorkerOptions.workerSrc = 'https://esm.sh/pdfjs-dist@4/build/pdf.worker.min.mjs';
 
-const base64 = ${JSON.stringify(base64)};
+const base64 = ${safeJsonForScript(base64)};
 const binaryStr = atob(base64);
 const bytes = new Uint8Array(binaryStr.length);
 for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
@@ -2724,6 +2726,12 @@ function buildCspConfig(resolver) {
   }
   return { resourceDomains: cspResourceDomains, connectDomains: cspConnectDomains };
 }
+function renderUnwrappedResult(rawResult) {
+  if (typeof rawResult !== "string") {
+    return `<pre>${escapeHtml(JSON.stringify(rawResult, null, 2))}</pre>`;
+  }
+  return detectContentType(rawResult) === "html" ? rawResult : escapeHtml(rawResult);
+}
 function renderToolTemplate(options) {
   const { toolName, input, output, template, resolver, platformType, sizing } = options;
   const uiType = detectUIType(template);
@@ -2762,8 +2770,7 @@ function renderToolTemplate(options) {
       if (wrapped) {
         html = wrapped;
       } else {
-        const textContent = typeof rawResult === "string" ? rawResult : `<pre>${JSON.stringify(rawResult, null, 2)}</pre>`;
-        const shellResult = buildShell(textContent, shellConfig);
+        const shellResult = buildShell(renderUnwrappedResult(rawResult), shellConfig);
         html = shellResult.html;
         hash = shellResult.hash;
         size = shellResult.size;

package/esm/component/index.mjs

@@ -421,8 +421,9 @@ function createEsmShResolver(options = {}) {
 }
 
 // libs/uipack/src/utils/index.ts
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -438,7 +439,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -2041,14 +2042,16 @@ var REQUIRED_PLACEHOLDERS = ["CONTENT"];
 var OPTIONAL_PLACEHOLDERS = ["CSP", "DATA", "BRIDGE", "TITLE"];
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts

package/esm/index.mjs

@@ -107,6 +107,10 @@ function escapeJsString(str) {
 function escapeScriptClose(jsonString) {
   return jsonString.replace(/<\//g, "<\\/");
 }
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
 function safeJsonForScript(value) {
   if (value === void 0) {
     return "null";
@@ -121,7 +125,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -2885,14 +2889,16 @@ function isNpmShellSource(source) {
 }
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -2964,9 +2970,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 
@@ -3821,6 +3825,7 @@ var MERMAID_PREFIXES = [
   "xychart"
 ];
 var PDF_MAGIC = "JVBERi";
+var BASE64_PATTERN = /^[A-Za-z0-9+/=\r\n]+$/;
 function detectContentType(value) {
   if (value === null || value === void 0) {
     return "text";
@@ -3835,7 +3840,7 @@ function detectContentType(value) {
   if (typeof value === "string") {
     const trimmed = value.trimStart();
     if (trimmed.startsWith(PDF_MAGIC)) {
-      return "pdf";
+      return BASE64_PATTERN.test(trimmed.trimEnd()) ? "pdf" : "text";
     }
     for (const prefix of MERMAID_PREFIXES) {
       if (trimmed.startsWith(prefix)) {
@@ -3897,7 +3902,7 @@ function buildPdfHtml(base64) {
 import * as pdfjsLib from 'https://esm.sh/pdfjs-dist@4/build/pdf.min.mjs';
 pdfjsLib.GlobalWorkerOptions.workerSrc = 'https://esm.sh/pdfjs-dist@4/build/pdf.worker.min.mjs';
 
-const base64 = ${JSON.stringify(base64)};
+const base64 = ${safeJsonForScript(base64)};
 const binaryStr = atob(base64);
 const bytes = new Uint8Array(binaryStr.length);
 for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
@@ -3992,6 +3997,12 @@ function buildCspConfig(resolver) {
   }
   return { resourceDomains: cspResourceDomains, connectDomains: cspConnectDomains };
 }
+function renderUnwrappedResult(rawResult) {
+  if (typeof rawResult !== "string") {
+    return `<pre>${escapeHtml(JSON.stringify(rawResult, null, 2))}</pre>`;
+  }
+  return detectContentType(rawResult) === "html" ? rawResult : escapeHtml(rawResult);
+}
 function renderToolTemplate(options) {
   const { toolName, input, output, template, resolver, platformType, sizing } = options;
   const uiType = detectUIType(template);
@@ -4030,8 +4041,7 @@ function renderToolTemplate(options) {
       if (wrapped) {
         html = wrapped;
       } else {
-        const textContent = typeof rawResult === "string" ? rawResult : `<pre>${JSON.stringify(rawResult, null, 2)}</pre>`;
-        const shellResult = buildShell(textContent, shellConfig);
+        const shellResult = buildShell(renderUnwrappedResult(rawResult), shellConfig);
         html = shellResult.html;
         hash = shellResult.hash;
         size = shellResult.size;

package/esm/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.0"
+    "@frontmcp/lazy-zod": "1.8.1"
   }
 }

package/esm/shell/index.mjs

@@ -1283,14 +1283,16 @@ function isNpmShellSource(source) {
 }
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -1317,8 +1319,9 @@ function escapeHtml(str) {
   const s = String(str);
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -1334,7 +1337,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -1393,9 +1396,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 

package/esm/utils/index.mjs

@@ -33,6 +33,10 @@ function escapeJsString(str) {
 function escapeScriptClose(jsonString) {
   return jsonString.replace(/<\//g, "<\\/");
 }
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
 function safeJsonForScript(value) {
   if (value === void 0) {
     return "null";
@@ -47,7 +51,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }

package/index.js

@@ -224,6 +224,10 @@ function escapeJsString(str) {
 function escapeScriptClose(jsonString) {
   return jsonString.replace(/<\//g, "<\\/");
 }
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
 function safeJsonForScript(value) {
   if (value === void 0) {
     return "null";
@@ -238,7 +242,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -3002,14 +3006,16 @@ function isNpmShellSource(source) {
 }
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -3081,9 +3087,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 
@@ -3938,6 +3942,7 @@ var MERMAID_PREFIXES = [
   "xychart"
 ];
 var PDF_MAGIC = "JVBERi";
+var BASE64_PATTERN = /^[A-Za-z0-9+/=\r\n]+$/;
 function detectContentType(value) {
   if (value === null || value === void 0) {
     return "text";
@@ -3952,7 +3957,7 @@ function detectContentType(value) {
   if (typeof value === "string") {
     const trimmed = value.trimStart();
     if (trimmed.startsWith(PDF_MAGIC)) {
-      return "pdf";
+      return BASE64_PATTERN.test(trimmed.trimEnd()) ? "pdf" : "text";
     }
     for (const prefix of MERMAID_PREFIXES) {
       if (trimmed.startsWith(prefix)) {
@@ -4014,7 +4019,7 @@ function buildPdfHtml(base64) {
 import * as pdfjsLib from 'https://esm.sh/pdfjs-dist@4/build/pdf.min.mjs';
 pdfjsLib.GlobalWorkerOptions.workerSrc = 'https://esm.sh/pdfjs-dist@4/build/pdf.worker.min.mjs';
 
-const base64 = ${JSON.stringify(base64)};
+const base64 = ${safeJsonForScript(base64)};
 const binaryStr = atob(base64);
 const bytes = new Uint8Array(binaryStr.length);
 for (let i = 0; i < binaryStr.length; i++) bytes[i] = binaryStr.charCodeAt(i);
@@ -4109,6 +4114,12 @@ function buildCspConfig(resolver) {
   }
   return { resourceDomains: cspResourceDomains, connectDomains: cspConnectDomains };
 }
+function renderUnwrappedResult(rawResult) {
+  if (typeof rawResult !== "string") {
+    return `<pre>${escapeHtml(JSON.stringify(rawResult, null, 2))}</pre>`;
+  }
+  return detectContentType(rawResult) === "html" ? rawResult : escapeHtml(rawResult);
+}
 function renderToolTemplate(options) {
   const { toolName, input, output, template, resolver, platformType, sizing } = options;
   const uiType = detectUIType(template);
@@ -4147,8 +4158,7 @@ function renderToolTemplate(options) {
       if (wrapped) {
         html = wrapped;
       } else {
-        const textContent = typeof rawResult === "string" ? rawResult : `<pre>${JSON.stringify(rawResult, null, 2)}</pre>`;
-        const shellResult = buildShell(textContent, shellConfig);
+        const shellResult = buildShell(renderUnwrappedResult(rawResult), shellConfig);
         html = shellResult.html;
         hash = shellResult.hash;
         size = shellResult.size;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@frontmcp/uipack",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "FrontMCP UIpack - HTML shell builder, pluggable import resolver, and NPM component loader for MCP UI (React-free core)",
   "author": "AgentFront <info@agentfront.dev>",
   "homepage": "https://docs.agentfront.dev",
@@ -61,6 +61,6 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@frontmcp/lazy-zod": "1.8.0"
+    "@frontmcp/lazy-zod": "1.8.1"
   }
 }

package/shell/custom-shell-applier.d.ts

@@ -4,18 +4,19 @@
  * Replaces placeholder tokens in a custom shell template with
  * the generated fragment values (CSP, data script, bridge, content, title).
  *
- * Uses sequential `replaceAll` — injected content is NOT re-scanned,
- * so `{{CSP}}` inside user content is safe.
+ * All placeholders are replaced in a single pass over the template, so an
+ * inserted value is never re-scanned for placeholders.
  *
  * @packageDocumentation
  */
-import type { ShellPlaceholderValues } from './custom-shell-types';
+import { type ShellPlaceholderValues } from './custom-shell-types';
 /**
  * Apply placeholder values to a custom shell template.
  *
- * Each `{{PLACEHOLDER}}` token is replaced with the corresponding value.
- * Replacement is single-pass per token — values injected for one placeholder
- * are not re-scanned for other placeholders.
+ * Each `{{PLACEHOLDER}}` token is replaced with the corresponding value, verbatim.
+ * Values carry tool input and output (GHSA-rhr9-vhpf-jqp7), so they are inserted by a
+ * function replacer: a value is never re-scanned for other placeholders, and `$&`, `$'`
+ * or `` $` `` inside it are not expanded.
  *
  * @param template - The shell template with `{{PLACEHOLDER}}` tokens
  * @param values - The values to inject for each placeholder

package/shell/custom-shell-applier.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-shell-applier.d.ts","sourceRoot":"","sources":["../../src/shell/custom-shell-applier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAEnE;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAU3F"}
+{"version":3,"file":"custom-shell-applier.d.ts","sourceRoot":"","sources":["../../src/shell/custom-shell-applier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAsD,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAYvH;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,sBAAsB,GAAG,MAAM,CAE3F"}

package/shell/data-injector.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-injector.d.ts","sourceRoot":"","sources":["../../src/shell/data-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,IAAI,YAAY,CASvE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,GAAG,MAAM,CAgBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAeT;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACrC,gCAAgC;IAChC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7D,kCAAkC;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9D,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,qCAAqC;IACrC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;CACtC;AAID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CA6BvD"}
+{"version":3,"file":"data-injector.d.ts","sourceRoot":"","sources":["../../src/shell/data-injector.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,YAAY,GAAG,MAAM,IAAI,YAAY,CASvE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB,GAAG,MAAM,CAgBT;AAED;;;;;;;;;GASG;AACH,wBAAgB,8BAA8B,CAAC,UAAU,EAAE;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAeT;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IACrC,gCAAgC;IAChC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7D,kCAAkC;IAClC,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9D,4CAA4C;IAC5C,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtC,qCAAqC;IACrC,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;CACtC;AAID;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CA2BvD"}

package/shell/index.js

@@ -1332,14 +1332,16 @@ function isNpmShellSource(source) {
 }
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -1366,8 +1368,9 @@ function escapeHtml(str) {
   const s = String(str);
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -1383,7 +1386,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
@@ -1442,9 +1445,7 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data)
   };
 }
 

package/utils/index.d.ts

@@ -11,5 +11,12 @@ export declare function escapeHtml(str: unknown): string;
 export declare function escapeHtmlAttr(str: string): string;
 export declare function escapeJsString(str: string): string;
 export declare function escapeScriptClose(jsonString: string): string;
+/**
+ * Serialize a value as JSON that can be embedded in an inline `<script>`.
+ *
+ * `<`, `>`, `&`, U+2028 and U+2029 are written as `\uXXXX`, so the output can neither close
+ * the element, open a comment or nested script, nor end a line; `JSON.parse` and the JS engine
+ * read the escapes back as the original characters.
+ */
 export declare function safeJsonForScript(value: unknown): string;
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBpE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAc/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBxD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBpE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAc/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBxD"}

package/utils/index.js

@@ -62,6 +62,10 @@ function escapeJsString(str) {
 function escapeScriptClose(jsonString) {
   return jsonString.replace(/<\//g, "<\\/");
 }
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
 function safeJsonForScript(value) {
   if (value === void 0) {
     return "null";
@@ -76,7 +80,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }