@frontmcp/uipack 1.8.0 → 1.8.2

package/shell/index.js

@@ -37,11 +37,14 @@ __export(shell_exports, {
   clearShellTemplateCache: () => clearShellTemplateCache,
   createTemplateHelpers: () => createTemplateHelpers,
   hasSizing: () => hasSizing,
+  html: () => html,
   isInlineShellSource: () => isInlineShellSource,
   isNpmShellSource: () => isNpmShellSource,
+  isTrustedHtml: () => isTrustedHtml,
   isUrlShellSource: () => isUrlShellSource,
   resolveShellTemplate: () => resolveShellTemplate,
   sanitizeCSPDomains: () => sanitizeCSPDomains,
+  trustedHtml: () => trustedHtml,
   validateCSPDomain: () => validateCSPDomain,
   validateShellTemplate: () => validateShellTemplate
 });
@@ -1332,14 +1335,16 @@ function isNpmShellSource(source) {
 }
 
 // libs/uipack/src/shell/custom-shell-applier.ts
+var PLACEHOLDER_PATTERN = new RegExp(`\\{\\{(${SHELL_PLACEHOLDER_NAMES.join("|")})\\}\\}`, "g");
+var VALUE_KEYS = {
+  CSP: "csp",
+  DATA: "data",
+  BRIDGE: "bridge",
+  CONTENT: "content",
+  TITLE: "title"
+};
 function applyShellTemplate(template, values) {
-  let result = template;
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CSP, values.csp);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.DATA, values.data);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.BRIDGE, values.bridge);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.CONTENT, values.content);
-  result = result.replaceAll(SHELL_PLACEHOLDERS.TITLE, values.title);
-  return result;
+  return template.replace(PLACEHOLDER_PATTERN, (_token, name) => values[VALUE_KEYS[name]]);
 }
 
 // libs/uipack/src/shell/custom-shell-validator.ts
@@ -1366,8 +1371,9 @@ function escapeHtml(str) {
   const s = String(str);
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;").replace(/\u2028/g, "\\u2028").replace(/\u2029/g, "\\u2029");
 }
-function escapeScriptClose(jsonString) {
-  return jsonString.replace(/<\//g, "<\\/");
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
 }
 function safeJsonForScript(value) {
   if (value === void 0) {
@@ -1383,12 +1389,35 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }
 }
 
+// libs/uipack/src/shell/trusted-html.ts
+var TRUSTED_HTML = /* @__PURE__ */ Symbol.for("@frontmcp/uipack/trusted-html");
+function trustedHtml(markup) {
+  const value = String(markup);
+  return Object.freeze({ [TRUSTED_HTML]: value, toString: () => value });
+}
+function isTrustedHtml(value) {
+  return typeof value === "object" && value !== null && typeof value[TRUSTED_HTML] === "string";
+}
+function interpolate(value) {
+  if (isTrustedHtml(value)) return value[TRUSTED_HTML];
+  if (Array.isArray(value)) return value.map(interpolate).join("");
+  if (value === false) return "";
+  return escapeHtml(value);
+}
+function html(strings, ...values) {
+  let markup = strings[0];
+  for (let index = 0; index < values.length; index++) {
+    markup += interpolate(values[index]) + strings[index + 1];
+  }
+  return trustedHtml(markup);
+}
+
 // libs/uipack/src/shell/data-injector.ts
 function hasSizing(sizing) {
   if (!sizing) return false;
@@ -1442,9 +1471,9 @@ function createTemplateHelpers() {
     uniqueId: (prefix = "mcp") => {
       return `${prefix}-${++_uniqueIdCounter}`;
     },
-    jsonEmbed: (data) => {
-      return escapeScriptClose(JSON.stringify(data));
-    }
+    jsonEmbed: (data) => safeJsonForScript(data),
+    html,
+    trustedHtml
   };
 }
 
@@ -1522,12 +1551,12 @@ function buildShell(content, config) {
     sizing
   });
   if (!withShell) {
-    const html2 = `${dataScript}
+    const html3 = `${dataScript}
 ${content}`;
     return {
-      html: html2,
-      hash: simpleHash(html2),
-      size: Buffer.byteLength(html2, "utf-8")
+      html: html3,
+      hash: simpleHash(html3),
+      size: Buffer.byteLength(html3, "utf-8")
     };
   }
   if (customShell) {
@@ -1560,7 +1589,7 @@ ${content}`;
     const bridgeScript = generateBridgeIIFE({ minify: true });
     headParts.push(`<script>${bridgeScript}</script>`);
   }
-  const html = `<!DOCTYPE html>
+  const html2 = `<!DOCTYPE html>
 <html lang="en">
 <head>
 ${headParts.map((p) => `  ${p}`).join("\n")}
@@ -1570,9 +1599,9 @@ ${content}
 </body>
 </html>`;
   return {
-    html,
-    hash: simpleHash(html),
-    size: Buffer.byteLength(html, "utf-8")
+    html: html2,
+    hash: simpleHash(html2),
+    size: Buffer.byteLength(html2, "utf-8")
   };
 }
 function buildCustomShell(content, customShell, ctx) {
@@ -1605,7 +1634,7 @@ ${sizingStyle}` : dataScript;
     const bridgeScript = generateBridgeIIFE({ minify: true });
     bridgeHtml = `<script>${bridgeScript}</script>`;
   }
-  const html = applyShellTemplate(template, {
+  const html2 = applyShellTemplate(template, {
     csp: cspTag,
     data: dataWithSizing,
     bridge: bridgeHtml,
@@ -1613,9 +1642,9 @@ ${sizingStyle}` : dataScript;
     title: ctx.title ? escapeHtmlForTag(ctx.title) : ""
   });
   return {
-    html,
-    hash: simpleHash(html),
-    size: Buffer.byteLength(html, "utf-8")
+    html: html2,
+    hash: simpleHash(html2),
+    size: Buffer.byteLength(html2, "utf-8")
   };
 }
 function simpleHash(str) {
@@ -1757,11 +1786,14 @@ function escapeRegExp(str) {
   clearShellTemplateCache,
   createTemplateHelpers,
   hasSizing,
+  html,
   isInlineShellSource,
   isNpmShellSource,
+  isTrustedHtml,
   isUrlShellSource,
   resolveShellTemplate,
   sanitizeCSPDomains,
+  trustedHtml,
   validateCSPDomain,
   validateShellTemplate
 });

package/shell/trusted-html.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Trusted Markup
+ *
+ * Explicit markup values for UI template functions. A template result built with {@link html}
+ * or wrapped with {@link trustedHtml} is rendered as HTML; with `escapeStringResults` on, a plain
+ * string result is escaped instead.
+ *
+ * @packageDocumentation
+ */
+declare const TRUSTED_HTML: unique symbol;
+/**
+ * Markup a template author vouches for. It renders as HTML and is never escaped again.
+ * Create it with {@link html} or {@link trustedHtml}; `String(value)` returns the markup.
+ */
+export interface TrustedHtml {
+    readonly [TRUSTED_HTML]: string;
+    toString(): string;
+}
+/**
+ * Mark already-safe markup as trusted. Only pass markup you produced or sanitized yourself —
+ * never raw tool output or user input.
+ */
+export declare function trustedHtml(markup: string): TrustedHtml;
+/** Whether a value was created by {@link html} or {@link trustedHtml}. */
+export declare function isTrustedHtml(value: unknown): value is TrustedHtml;
+/**
+ * Tagged template that builds {@link TrustedHtml}.
+ *
+ * The literal parts are kept as markup. Each interpolated value is HTML-escaped unless it is
+ * itself `TrustedHtml`; arrays are joined without a separator and `null`, `undefined` and `false`
+ * render nothing. Always quote attribute values.
+ *
+ * @example
+ * ```typescript
+ * html`<ul>${items.map((item) => html`<li>${item.name}</li>`)}</ul>`
+ * ```
+ */
+export declare function html(strings: TemplateStringsArray, ...values: unknown[]): TrustedHtml;
+export {};
+//# sourceMappingURL=trusted-html.d.ts.map

package/shell/trusted-html.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trusted-html.d.ts","sourceRoot":"","sources":["../../src/shell/trusted-html.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,QAAA,MAAM,YAAY,EAAE,OAAO,MAAoD,CAAC;AAEhF;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,IAAI,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW,CAGvD;AAED,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,WAAW,CAMlE;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAMrF"}

package/types/ui-config.d.ts

@@ -10,6 +10,7 @@
 import type { FileSource } from '../component/types';
 import type { CDNDependency } from '../resolver/types';
 import type { CustomShellSource } from '../shell/custom-shell-types';
+import type { TrustedHtml } from '../shell/trusted-html';
 /**
  * Configuration options for bundling file-based components.
  */
@@ -172,6 +173,19 @@ export interface TemplateHelpers {
      * Safely embed JSON data in HTML (escapes script-breaking characters).
      */
     jsonEmbed: (data: unknown) => string;
+    /**
+     * Tagged template that builds trusted markup. The literal parts stay HTML; each interpolated
+     * value is HTML-escaped unless it is itself `TrustedHtml`. Arrays are joined without a
+     * separator and `null` / `undefined` / `false` render nothing. Don't pre-escape values.
+     *
+     * @example ctx.helpers.html`<h2>${ctx.output.title}</h2>`
+     */
+    html: (strings: TemplateStringsArray, ...values: unknown[]) => TrustedHtml;
+    /**
+     * Mark markup you produced or sanitized yourself as trusted, so it renders as HTML even when
+     * `escapeStringResults` is on. Never pass raw tool output or user input.
+     */
+    trustedHtml: (markup: string) => TrustedHtml;
 }
 /**
  * Context passed to template builder functions.
@@ -198,9 +212,10 @@ export interface TemplateContext<In = unknown, Out = unknown> {
 }
 /**
  * Template builder function type.
- * Receives context with input/output and returns HTML string.
+ * Receives context with input/output and returns markup: `TrustedHtml` from
+ * `ctx.helpers.html` / `ctx.helpers.trustedHtml`, or a string (see `escapeStringResults`).
  */
-export type TemplateBuilderFn<In = unknown, Out = unknown> = (ctx: TemplateContext<In, Out>) => string;
+export type TemplateBuilderFn<In = unknown, Out = unknown> = (ctx: TemplateContext<In, Out>) => string | TrustedHtml;
 /**
  * Widget serving mode determines how the widget HTML is delivered to the client.
  *
@@ -331,6 +346,19 @@ export interface UITemplateConfig<In = unknown, Out = unknown> {
      * ```
      */
     contentSecurity?: UIContentSecurity;
+    /**
+     * HTML-escape a plain string returned by a template function.
+     *
+     * - `true`: plain strings are escaped and shown as text; markup built with
+     *   `ctx.helpers.html` or wrapped with `ctx.helpers.trustedHtml` still renders as HTML.
+     * - unset (1.8 default): strings that look like HTML render as markup, and a one-time
+     *   notice per tool recommends `html` because 1.9 will escape string results by default.
+     * - `false`: keep rendering strings as markup without the notice.
+     *
+     * Overrides the server-wide `@FrontMcp({ ui: { escapeStringResults } })` default.
+     * Static string templates (`template: '<div>…</div>'`) are author markup and never escaped.
+     */
+    escapeStringResults?: boolean;
     /**
      * Whether the widget can invoke tools via the MCP bridge.
      * When true, the widget gains access to `window.mcpBridge.callTool()`.

package/types/ui-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ui-config.d.ts","sourceRoot":"","sources":["../../src/types/ui-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gCAAgC;IAChC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzE,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAErC;;;;OAIG;IACH,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE7D;;;;OAIG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE9D;;;OAGG;IACH,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAEtC;;OAEG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;CACtC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAC1D;;OAEG;IACH,KAAK,EAAE,EAAE,CAAC;IAEV;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC;IAEZ;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,MAAM,iBAAiB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC;AAMvG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,YAAY,CAAC;AAMjB;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,YAAY,GAAG,KAAK,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAK9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAC3D;;;;;;;;OAQG;IAEH,QAAQ,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC;IAEnF;;;OAGG;IACH,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,eAAe,CAAC,EAAE,iBAAiB,CAAC;IAEpC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE;QACjB,gDAAgD;QAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uDAAuD;QACvD,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;;OAcG;IAEH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAMpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE;QACnB,oEAAoE;QACpE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,qDAAqD;QACrD,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAMlB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAExD;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,uCAAuC;QACvC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iCAAiC;QACjC,QAAQ,CAAC,EAAE;YACT,sCAAsC;YACtC,GAAG,CAAC,EAAE,OAAO,CAAC;YACd,gCAAgC;YAChC,cAAc,CAAC,EAAE,MAAM,CAAC;SACzB,CAAC;KACH,CAAC;IAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAM5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAEtC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC"}
+{"version":3,"file":"ui-config.d.ts","sourceRoot":"","sources":["../../src/types/ui-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEzD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,gCAAgC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,yCAAyC;IACzC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gCAAgC;IAChC,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;IACzE,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,2BAA2B;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8CAA8C;IAC9C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAMD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAE1B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;;;;;;;OAcG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;;;;;;OAiBG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAMD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B;;;;OAIG;IACH,UAAU,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC;IAErC;;;;OAIG;IACH,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE7D;;;;OAIG;IACH,cAAc,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAE9D;;;OAGG;IACH,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IAEtC;;OAEG;IACH,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM,CAAC;IAErC;;;;;;OAMG;IACH,IAAI,EAAE,CAAC,OAAO,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,KAAK,WAAW,CAAC;IAE3E;;;OAGG;IACH,WAAW,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,WAAW,CAAC;CAC9C;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAC1D;;OAEG;IACH,KAAK,EAAE,EAAE,CAAC;IAEV;;OAEG;IACH,MAAM,EAAE,GAAG,CAAC;IAEZ;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAE5B;;OAEG;IACH,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,MAAM,GAAG,WAAW,CAAC;AAMrH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,MAAM,iBAAiB,GACzB,MAAM,GACN,QAAQ,GACR,QAAQ,GACR,QAAQ,GACR,YAAY,GACZ,YAAY,CAAC;AAMjB;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,YAAY,GAAG,KAAK,CAAC;AAEhE;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,CAAC;AAK9C;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO;IAC3D;;;;;;;;OAQG;IAEH,QAAQ,EAAE,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,CAAC,GAAG,UAAU,CAAC;IAEnF;;;OAGG;IACH,GAAG,CAAC,EAAE,uBAAuB,CAAC;IAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,eAAe,CAAC,EAAE,iBAAiB,CAAC;IAEpC;;;;;;;;;;;OAWG;IACH,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAE9B;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;OAQG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAElC;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;OAGG;IACH,SAAS,CAAC,EAAE,eAAe,CAAC;IAE5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAE9B;;;;;;;;;;;;;;;;OAgBG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,EAAE;QACjB,gDAAgD;QAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,uDAAuD;QACvD,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IAEF;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAEhC;;;;;;;;;OASG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IAEzB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB;;;;;;;;;;;;;;OAcG;IAEH,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAMpC;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE;QACnB,oEAAoE;QACpE,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,qDAAqD;QACrD,oBAAoB,CAAC,EAAE,OAAO,CAAC;KAChC,CAAC;IAEF;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8CG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAMlB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,UAAU,GAAG,MAAM,CAAC;IAExD;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAEpC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC;IAEhC;;OAEG;IACH,cAAc,CAAC,EAAE;QACf,uCAAuC;QACvC,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,iCAAiC;QACjC,QAAQ,CAAC,EAAE;YACT,sCAAsC;YACtC,GAAG,CAAC,EAAE,OAAO,CAAC;YACd,gCAAgC;YAChC,cAAc,CAAC,EAAE,MAAM,CAAC;SACzB,CAAC;KACH,CAAC;IAMF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAM5B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4CG;IACH,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IAErB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IAE7C;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IAEtC;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;CACjC;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,GAAG,OAAO,IAAI,gBAAgB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC"}

package/utils/index.d.ts

@@ -11,5 +11,12 @@ export declare function escapeHtml(str: unknown): string;
 export declare function escapeHtmlAttr(str: string): string;
 export declare function escapeJsString(str: string): string;
 export declare function escapeScriptClose(jsonString: string): string;
+/**
+ * Serialize a value as JSON that can be embedded in an inline `<script>`.
+ *
+ * `<`, `>`, `&`, U+2028 and U+2029 are written as `\uXXXX`, so the output can neither close
+ * the element, open a comment or nested script, nor end a line; `JSON.parse` and the JS engine
+ * read the escapes back as the original characters.
+ */
 export declare function safeJsonForScript(value: unknown): string;
 //# sourceMappingURL=index.d.ts.map

package/utils/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBpE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAc/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBxD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/utils/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAiBpE;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAc/C;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAqBxD"}

package/utils/index.js

@@ -62,6 +62,10 @@ function escapeJsString(str) {
 function escapeScriptClose(jsonString) {
   return jsonString.replace(/<\//g, "<\\/");
 }
+var SCRIPT_UNSAFE_CHARACTERS = /[<>&\u2028\u2029]/g;
+function toUnicodeEscape(character) {
+  return `\\u${character.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
 function safeJsonForScript(value) {
   if (value === void 0) {
     return "null";
@@ -76,7 +80,7 @@ function safeJsonForScript(value) {
     if (jsonString === void 0) {
       return "null";
     }
-    return escapeScriptClose(jsonString);
+    return jsonString.replace(SCRIPT_UNSAFE_CHARACTERS, toUnicodeEscape);
   } catch {
     return '{"error":"Value could not be serialized"}';
   }