@marimo-team/islands 0.25.3-dev244 → 0.25.3-dev246

package/dist/{ErrorBoundary-DKniGLW9.js → ErrorBoundary-lLc3Ot2z.js}

@@ -135,7 +135,7 @@ function F(e) {
 }
 //#endregion
 //#region src/components/editor/boundary/ErrorBoundary.tsx
-var I = (0, T.lazy)(() => import("./feedback-button-C0iLkz-H.js").then((e) => ({ default: e.FeedbackModal }))), L = (e) => {
+var I = (0, T.lazy)(() => import("./feedback-button-z-kbzGSb.js").then((e) => ({ default: e.FeedbackModal }))), L = (e) => {
 	let t = (0, w.c)(2), n;
 	return t[0] === e.children ? n = t[1] : (n = /* @__PURE__ */ (0, j.jsx)(O, {
 		FallbackComponent: R,

package/dist/{code-visibility-CIUgREo9.js → code-visibility-D2YIi76S.js}

@@ -17,7 +17,7 @@ function b() {
 		return e.warn("Failed to get version from mount config"), null;
 	}
 }
-var x = b() || "0.25.3-dev244", S = s(x), C = s(!0);
+var x = b() || "0.25.3-dev246", S = s(x), C = s(!0);
 s(null);
 //#endregion
 //#region src/core/wasm/state.ts

package/dist/{common-DzCPFBsv.js → common--Xk2FKfC.js}

@@ -12,7 +12,7 @@ import { A as Re, C as ze, M as Be, S as Ve, T as He, _ as Ue, b as We, c as Ge,
 import { $ as ot, $t as st, A as ct, At as lt, B as ut, Bt as dt, C as ft, Ct as pt, D as mt, Dt as ht, E as gt, Et as _t, F as vt, Ft as yt, G as bt, Gt as xt, H as St, Ht as Ct, I as wt, It as Tt, Jt as Et, K as Dt, Kt as Ot, L as kt, Lt as At, M as jt, Mt, N as Nt, Nt as Pt, O as Ft, Ot as It, P as Lt, Pt as Rt, Q as zt, Qt as Bt, R as Vt, Rt as Ht, S as Ut, St as Wt, T as Gt, Tt as Kt, U as qt, Ut as Jt, V as Yt, Vt as Xt, W as Zt, Wt as Qt, X as $t, Xt as en, Yt as tn, Z as nn, Zt as rn, _ as an, _n as on, _t as sn, a as cn, an as ln, at as un, b as dn, bn as fn, bt as pn, cn as mn, ct as hn, d as gn, dn as _n, dt as vn, en as yn, et as bn, f as xn, ft as Sn, gn as Cn, gt as wn, h as Tn, hn as En, ht as Dn, i as On, it as kn, j as An, jt as jn, k as Mn, kt as Nn, l as Pn, lt as Fn, mn as In, mt as Ln, n as Rn, nn as zn, nt as Bn, o as Vn, on as Hn, ot as Un, pn as Wn, q as Gn, qt as Kn, rn as qn, rt as Jn, s as Yn, sn as Xn, st as Zn, t as Qn, tn as $n, tt as er, u as tr, un as nr, ut as rr, vn as ir, vt as ar, wt as or, x as sr, xn as cr, xt as lr, yn as ur, yt as dr, z as fr, zt as pr } from "./dropdown-menu-BRiE7Vnp.js";
 import { a as mr, n as hr, r as gr, t as _r } from "./config-DbjzjwxX.js";
 import { A as vr, E as yr, G as br, H as xr, I as Sr, Lt as Cr, Nt as wr, Q as Tr, Rt as Er, T as Dr, Tt as Or, U as kr, V as Ar, b as jr, et as Mr, h as Nr, j as Pr, l as Fr, q as Ir, st as Lr, t as Rr, tt as zr, u as Br, wt as Vr, y as Hr, zt as Ur } from "./error-entries-CRPfxMqm.js";
-import { n as Wr, t as Gr } from "./ErrorBoundary-DKniGLW9.js";
+import { n as Wr, t as Gr } from "./ErrorBoundary-lLc3Ot2z.js";
 import { i as Kr, r as qr, s as Jr, t as Yr } from "./strings-BGW-fXVJ.js";
 import { t as Xr } from "./clsx-CoeGtWvn.js";
 import { t as Zr } from "./react-dom-DUmH0GXv.js";
@@ -25751,24 +25751,15 @@ async function OR(e) {
 	}
 }
 var kR = /* @__PURE__ */ new Set([
-	"text/plain",
-	"text/csv",
-	"text/tab-separated-values",
-	"application/json",
-	"application/octet-stream",
-	"application/pdf",
-	"application/zip",
-	"application/gzip",
-	"image/png",
-	"image/jpeg",
-	"image/gif",
-	"image/webp",
-	"image/avif",
-	"image/bmp",
-	"image/x-icon"
+	"text/html",
+	"text/xml",
+	"application/xml",
+	"text/jscript",
+	"text/livescript",
+	"text/vbscript"
 ]);
 function AR(e) {
-	if (!e.trim()) return !1;
+	if (typeof e != "string" || !e.trim()) return !1;
 	try {
 		let t = i_(e);
 		switch (t.protocol) {
@@ -25779,7 +25770,7 @@ function AR(e) {
 				let e = t.pathname.indexOf(",");
 				if (e === -1) return !1;
 				let n = t.pathname.slice(0, e).split(";", 1)[0].trim().toLowerCase();
-				return kR.has(n || "text/plain");
+				return !n || /^[\w!#$%&'*+.^`|~-]+\/[\w!#$%&'*+.^`|~-]+$/.test(n) && !kR.has(n) && !/^(?:text|application)\/(?:x-)?(?:java|ecma)script(?:\d+(?:\.\d+)*)?$/.test(n) && !n.endsWith("+xml");
 			}
 			default: return !1;
 		}
@@ -25790,11 +25781,20 @@ function AR(e) {
 function jR(e, t) {
 	if (!AR(e)) throw Error("Unsupported download URL");
 	let n = document.createElement("a");
-	n.href = e, n.download = t ?? "", n.click(), n.remove();
+	n.href = e, n.download = t ?? "";
+	try {
+		n.click();
+	} finally {
+		n.remove();
+	}
 }
 function MR(e, t) {
 	let n = URL.createObjectURL(e);
-	jR(n, t), URL.revokeObjectURL(n);
+	try {
+		jR(n, t);
+	} finally {
+		URL.revokeObjectURL(n);
+	}
 }
 function NR({ contents: e, filename: t, mediaType: n }) {
 	MR(new Blob([e], { type: n }), t);

package/dist/{data-grid-overlay-editor-PstJqwhX.js → data-grid-overlay-editor-C9K6pi5e.js}

@@ -2,7 +2,7 @@ import { a as e } from "./rolldown-runtime-Cb76FRpK.js";
 import { t } from "./react-sHtZdjeP.js";
 import { t as n } from "./react-dom-DUmH0GXv.js";
 import { c as r, l as i, u as a } from "./data-grid-types-0PJ-9N5n.js";
-import { a as o, i as s, n as c, r as l } from "./glide-data-editor-8CBjuK8C.js";
+import { a as o, i as s, n as c, r as l } from "./glide-data-editor-CXKLf1C2.js";
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/internal/data-grid-overlay-editor/data-grid-overlay-editor-style.js
 var u = /* @__PURE__ */ e(t(), 1), d = /* @__PURE__ */ e(n(), 1), f = /*#__PURE__*/ o("div")({
 	name: "DataGridOverlayEditorStyle",

package/dist/{feedback-button-C0iLkz-H.js → feedback-button-z-kbzGSb.js}

@@ -4,13 +4,13 @@ import { t as r } from "./react-sHtZdjeP.js";
 import { t as i } from "./compiler-runtime-CldRdSsv.js";
 import { t as a } from "./copy-icon-CG57cxwb.js";
 import { A as o, E as s, I as c, K as l, P as u, T as d, i as f, n as p, zt as m } from "./error-entries-CRPfxMqm.js";
-import { n as h, t as ee } from "./globals-M9WsksQz.js";
+import { n as h, t as ee } from "./globals-D8BQ2O39.js";
 import { t as g } from "./strings-BGW-fXVJ.js";
 import { t as _ } from "./jsx-runtime-3BD1kT0s.js";
 import { l as te, r as v, x as ne } from "./utils-DXkj82sK.js";
 import { a as re, i as ie, n as ae, r as oe } from "./dialog-DsZ49mmU.js";
 import { t as se } from "./useAsyncData-DsZMvNXn.js";
-import { t as ce } from "./code-visibility-CIUgREo9.js";
+import { t as ce } from "./code-visibility-D2YIi76S.js";
 //#region src/components/ui/skeleton.tsx
 var y = /* @__PURE__ */ e(r(), 1), b = i(), x = _(), le = (e) => {
 	let n = (0, b.c)(8), r, i;

package/dist/{glide-data-editor-8CBjuK8C.js → glide-data-editor-CXKLf1C2.js}

@@ -6,7 +6,7 @@ import { i as s, n as c, r as l } from "./copy-icon-CG57cxwb.js";
 import { c as u, d, i as f, n as p, s as m, t as h } from "./select-BSxlITBo.js";
 import { d as g, h as _, i as v, l as y, n as b, o as x, q as S, s as C, t as w, u as T } from "./dropdown-menu-BRiE7Vnp.js";
 import { c as E, d as D, l as O, n as k, o as A, s as ee, t as j, u as te } from "./glide-utils-CQddGpa-.js";
-import { n as ne, t as re } from "./ErrorBoundary-DKniGLW9.js";
+import { n as ne, t as re } from "./ErrorBoundary-lLc3Ot2z.js";
 import { i as ie, n as M } from "./strings-BGW-fXVJ.js";
 import { t as N } from "./react-dom-DUmH0GXv.js";
 import { t as P } from "./jsx-runtime-3BD1kT0s.js";
@@ -7062,7 +7062,7 @@ function rs(e, t, n, r, i) {
 }
 //#endregion
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/data-editor/data-editor.js
-var is = /* @__PURE__ */ e(_r(), 1), as = /* @__PURE__ */ e(xr(), 1), os = K.lazy(async () => await import("./data-grid-overlay-editor-PstJqwhX.js")), ss = 0;
+var is = /* @__PURE__ */ e(_r(), 1), as = /* @__PURE__ */ e(xr(), 1), os = K.lazy(async () => await import("./data-grid-overlay-editor-C9K6pi5e.js")), ss = 0;
 function cs(e) {
 	return (0, is.default)((0, as.default)((0, as.default)(e).filter((e) => e.span !== void 0).map((e) => (0, Za.default)((e.span?.[0] ?? 0) + 1, (e.span?.[1] ?? 0) + 1))));
 }
@@ -9293,7 +9293,7 @@ function Vs(e, t, n, r, i) {
 }
 //#endregion
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/cells/number-cell.js
-var Hs = K.lazy(async () => await import("./number-overlay-editor-uvNY9IUz.js")), Us = {
+var Hs = K.lazy(async () => await import("./number-overlay-editor-B7B9pMI5.js")), Us = {
 	getAccessibilityString: (e) => e.data?.toString() ?? "",
 	kind: W.Number,
 	needsHover: (e) => e.hoverEffect === !0,

package/dist/{globals-M9WsksQz.js → globals-D8BQ2O39.js}

@@ -1,6 +1,6 @@
 import { m as e } from "./tooltip-C3UnvsRe.js";
 import { l as t } from "./utils-DXkj82sK.js";
-import { r as n } from "./code-visibility-CIUgREo9.js";
+import { r as n } from "./code-visibility-D2YIi76S.js";
 var r = e("triangle-alert", [
 	["path", {
 		d: "m21.73 18-8-14a2 2 0 0 0-3.48 0l-8 14A2 2 0 0 0 4 21h16a2 2 0 0 0 1.73-3",

package/dist/main.js

@@ -6,7 +6,7 @@ import { i as x, n as S, r as C, t as w } from "./copy-icon-CG57cxwb.js";
 import { $ as T, A as E, At as D, B as O, Bt as k, Ct as A, F as j, H as M, Ht as N, I as P, It as F, Kt as I, M as L, Nt as R, Ot as z, Pt as B, Q as ee, R as te, Rt as ne, St as re, Tt as ie, U as ae, Ut as oe, V as se, Vt as ce, W as le, Wt as ue, Z as de, _ as fe, _t as pe, a as me, at as he, b as ge, bt as _e, c as ve, et as ye, ft as be, i as xe, it as Se, jt as Ce, kt as we, mt as Te, n as Ee, nt as De, o as Oe, pt as ke, qt as Ae, tt as je, v as Me, w as Ne, x as Pe, xt as Fe, y as Ie, z as Le, zt as Re } from "./html-to-image-Gx4q3ZoD.js";
 import { a as ze, d as Be, i as Ve, m as He, n as Ue, o as We, p as Ge, r as Ke, t as qe } from "./tooltip-C3UnvsRe.js";
 import { D as Je, E as Ye, O as Xe, S as Ze, T as Qe, _ as $e, a as et, c as tt, d as nt, f as rt, g as it, h as at, i as ot, l as st, m as ct, n as lt, o as ut, p as dt, r as ft, s as pt, t as mt, u as ht, v as gt, w as _t, x as vt, y as yt } from "./spec-Dq8RNplp.js";
-import { $t as bt, A as xt, At as St, B as Ct, Bt as wt, C as Tt, Ct as Et, D as Dt, Dt as Ot, E as kt, Et as At, F as jt, Ft as Mt, G as Nt, Gt as Pt, H as Ft, Ht as It, I as Lt, It as Rt, J as zt, Jt as Bt, K as Vt, Kt as Ht, L as Ut, Lt as Wt, M as Gt, Mt as Kt, N as qt, Nt as Jt, O as Yt, Ot as Xt, P as Zt, Pt as Qt, Qt as $t, R as en, Rt as tn, S as nn, T as rn, Tt as an, U as on, Ut as sn, V as cn, Vt as ln, W as un, Wt as dn, X as fn, Xt as pn, Y as mn, Yt as hn, Z as gn, Zt as _n, _ as vn, _t as yn, an as bn, at as xn, b as Sn, bt as Cn, c as wn, cn as Tn, ct as En, d as Dn, dn as On, dt as kn, en as An, f as jn, fn as Mn, ft as Nn, g as Pn, gn as Fn, gt as In, h as Ln, hn as Rn, ht as zn, in as Bn, it as Vn, j as Hn, jt as Un, k as Wn, kt as Gn, ln as Kn, lt as qn, m as Jn, mn as Yn, mt as Xn, nn as Zn, nt as Qn, on as $n, ot as er, p as tr, pn as nr, pt as rr, q as ir, qt as ar, r as or, rn as sr, rt as cr, st as lr, t as ur, tn as dr, tt as fr, u as pr, un as mr, ut as hr, v as gr, vt as _r, w as vr, wt as yr, x as br, y as xr, yt as Sr, z as Cr, zt as wr } from "./common-DzCPFBsv.js";
+import { $t as bt, A as xt, At as St, B as Ct, Bt as wt, C as Tt, Ct as Et, D as Dt, Dt as Ot, E as kt, Et as At, F as jt, Ft as Mt, G as Nt, Gt as Pt, H as Ft, Ht as It, I as Lt, It as Rt, J as zt, Jt as Bt, K as Vt, Kt as Ht, L as Ut, Lt as Wt, M as Gt, Mt as Kt, N as qt, Nt as Jt, O as Yt, Ot as Xt, P as Zt, Pt as Qt, Qt as $t, R as en, Rt as tn, S as nn, T as rn, Tt as an, U as on, Ut as sn, V as cn, Vt as ln, W as un, Wt as dn, X as fn, Xt as pn, Y as mn, Yt as hn, Z as gn, Zt as _n, _ as vn, _t as yn, an as bn, at as xn, b as Sn, bt as Cn, c as wn, cn as Tn, ct as En, d as Dn, dn as On, dt as kn, en as An, f as jn, fn as Mn, ft as Nn, g as Pn, gn as Fn, gt as In, h as Ln, hn as Rn, ht as zn, in as Bn, it as Vn, j as Hn, jt as Un, k as Wn, kt as Gn, ln as Kn, lt as qn, m as Jn, mn as Yn, mt as Xn, nn as Zn, nt as Qn, on as $n, ot as er, p as tr, pn as nr, pt as rr, q as ir, qt as ar, r as or, rn as sr, rt as cr, st as lr, t as ur, tn as dr, tt as fr, u as pr, un as mr, ut as hr, v as gr, vt as _r, w as vr, wt as yr, x as br, y as xr, yt as Sr, z as Cr, zt as wr } from "./common--Xk2FKfC.js";
 import { a as Tr, n as Er, s as Dr, t as Or } from "./useLifecycle-BquH9ET-.js";
 import { t as kr } from "./check-Z_vtI3OL.js";
 import { A as Ar, C as jr, D as Mr, M as Nr, O as Pr, a as Fr, c as Ir, d as Lr, i as Rr, k as zr, l as Br, n as Vr, o as Hr, r as Ur, s as Wr, t as Gr, w as Kr, x as qr } from "./select-BSxlITBo.js";
@@ -15,8 +15,8 @@ import { c as Di, i as Oi, l as ki, o as Ai, s as ji, t as Mi } from "./config-D
 import { A as Ni, At as Pi, B as Fi, G as Ii, It as Li, J as Ri, K as zi, N as Bi, Nt as Vi, Ot as Hi, Pt as Ui, R as Wi, St as Gi, T as Ki, Tt as qi, V as Ji, X as Yi, Y as Xi, Z as Zi, _ as Qi, at as $i, c as ea, ct as ta, d as na, g as ra, h as ia, jt as aa, k as oa, kt as sa, lt as ca, m as la, ot as ua, p as da, q as fa, s as pa, ut as ma, xt as ha, z as ga } from "./error-entries-CRPfxMqm.js";
 import { a as _a, c as va, d as ya, f as ba, i as xa, l as Sa, n as Ca, o as wa, r as Ta, s as Ea, t as Da } from "./process-output-D2ISIyIs.js";
 import { a as Oa, c as ka, d as Aa, i as ja, l as Ma, r as Na, u as Pa } from "./glide-utils-CQddGpa-.js";
-import { n as Fa, t as Ia } from "./ErrorBoundary-DKniGLW9.js";
-import { n as La, t as Ra } from "./globals-M9WsksQz.js";
+import { n as Fa, t as Ia } from "./ErrorBoundary-lLc3Ot2z.js";
+import { n as La, t as Ra } from "./globals-D8BQ2O39.js";
 import { a as za, i as Ba, n as Va, r as Ha, s as Ua, t as Wa } from "./strings-BGW-fXVJ.js";
 import { t as Ga } from "./react-dom-DUmH0GXv.js";
 import { t as Ka } from "./jsx-runtime-3BD1kT0s.js";
@@ -44,7 +44,7 @@ import { t as Hs } from "./useAsyncData-DsZMvNXn.js";
 import { t as Us } from "./semaphore-89jsoHtS.js";
 import { D as Ws, O as Gs } from "./vega-loader.browser-B9Pz0EGP.js";
 import { a as Ks, n as qs } from "./loader-BisjOLiW.js";
-import { c as Js, d as Ys, i as Xs, l as Zs, o as Qs, s as $s, t as ec, u as tc } from "./code-visibility-CIUgREo9.js";
+import { c as Js, d as Ys, i as Xs, l as Zs, o as Qs, s as $s, t as ec, u as tc } from "./code-visibility-D2YIi76S.js";
 import { t as nc } from "./useDeepCompareMemoize-KMBBux8C.js";
 import { t as rc } from "./esm-BgKjMvWw.js";
 //#region ../node_modules/.pnpm/iconify-icon@2.3.0/node_modules/iconify-icon/dist/iconify-icon.mjs
@@ -12406,7 +12406,7 @@ function _D(e, t) {
 }
 //#endregion
 //#region src/plugins/impl/DataEditorPlugin.tsx
-var vD = J.lazy(() => import("./glide-data-editor-8CBjuK8C.js").then((e) => e.t)), yD = eE("marimo-data-editor", { cssStyles: [CE] }).withData(G({
+var vD = J.lazy(() => import("./glide-data-editor-CXKLf1C2.js").then((e) => e.t)), yD = eE("marimo-data-editor", { cssStyles: [CE] }).withData(G({
 	initialValue: G({ edits: K(G({
 		rowIdx: W(),
 		columnId: U(),
@@ -32194,7 +32194,7 @@ function vH(e) {
 }
 //#endregion
 //#region src/components/editor/renderers/slides-layout/slides-layout.tsx
-var yH = J.lazy(() => import("./reveal-component-GMnfGiUU.js")), bH = (e) => {
+var yH = J.lazy(() => import("./reveal-component-DbHmKv3w.js")), bH = (e) => {
 	let t = (0, X.c)(33), { layout: n, setLayout: r, cells: i, mode: a } = e, o = jo(Wo), s = a === "read" || o, c = jo(ha) > 1, [l, u] = (0, J.useState)(null), d;
 	t[0] !== i || t[1] !== n ? (d = gR(i, n), t[0] = i, t[1] = n, t[2] = d) : d = t[2];
 	let { slideCells: f, skippedIds: p, noOutputIds: m, slideTypes: h, startCellIndex: g } = d, _;

package/dist/{number-overlay-editor-uvNY9IUz.js → number-overlay-editor-B7B9pMI5.js}

@@ -1,6 +1,6 @@
 import { a as e } from "./rolldown-runtime-Cb76FRpK.js";
 import { t } from "./react-sHtZdjeP.js";
-import { a as n } from "./glide-data-editor-8CBjuK8C.js";
+import { a as n } from "./glide-data-editor-CXKLf1C2.js";
 //#region ../node_modules/.pnpm/@glideapps+glide-data-grid@6.0.4-alpha24_lodash@4.17.21_marked@15.0.12_react-dom@19.3.0_27cffe7f1bc30287d59ac27db3240c5b/node_modules/@glideapps/glide-data-grid/dist/esm/internal/data-grid-overlay-editor/private/number-overlay-editor-style.js
 var r = /* @__PURE__ */ e(t()), i = /*#__PURE__*/ n("div")({
 	name: "NumberOverlayEditorStyle",

package/dist/{reveal-component-GMnfGiUU.js → reveal-component-DbHmKv3w.js}

@@ -3,7 +3,7 @@ import { c as t, g as n, h as r, m as i, t as a } from "./button-B6RjDKJx.js";
 import { t as o } from "./react-sHtZdjeP.js";
 import { t as s } from "./compiler-runtime-CldRdSsv.js";
 import { m as c, t as l } from "./tooltip-C3UnvsRe.js";
-import { $ as u, Q as d, et as f, i as p, l as m, n as h, on as g, r as _, sn as v, t as y, u as b, un as x } from "./common-DzCPFBsv.js";
+import { $ as u, Q as d, et as f, i as p, l as m, n as h, on as g, r as _, sn as v, t as y, u as b, un as x } from "./common--Xk2FKfC.js";
 import { M as S } from "./select-BSxlITBo.js";
 import { Y as ee } from "./dropdown-menu-BRiE7Vnp.js";
 import { Pt as C } from "./error-entries-CRPfxMqm.js";
@@ -11,7 +11,7 @@ import { t as w } from "./jsx-runtime-3BD1kT0s.js";
 import { r as T } from "./use-restore-focus-BWO0z1lo.js";
 import { D as E, t as D, x as O } from "./utils-DXkj82sK.js";
 import { o as k } from "./static-state-BldGd99T.js";
-import { a as A, n as te, t as ne } from "./code-visibility-CIUgREo9.js";
+import { a as A, n as te, t as ne } from "./code-visibility-D2YIi76S.js";
 /* empty css                */
 var j = c("sticky-note", [["path", {
 	d: "M21 9a2.4 2.4 0 0 0-.706-1.706l-3.588-3.588A2.4 2.4 0 0 0 15 3H5a2 2 0 0 0-2 2v14a2 2 0 0 0 2 2h14a2 2 0 0 0 2-2z",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marimo-team/islands",
-  "version": "0.25.3-dev244",
+  "version": "0.25.3-dev246",
   "main": "dist/main.js",
   "types": "dist/index.d.ts",
   "type": "module",

package/src/plugins/layout/__test__/DownloadPlugin.test.tsx

@@ -79,6 +79,11 @@ describe("DownloadPlugin", () => {
     { data: "data:text/plain,hello", filename: "loaded.txt" },
     { data: "", filename: "renamed.csv" },
     { data: "data:text/plain,hello", filename: null },
+    { data: "data:audio/x-wav;base64,AAA=", filename: "audio.wav" },
+    {
+      data: "data:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;base64,AAA=",
+      filename: "results.xlsx",
+    },
   ])("downloads lazy data with metadata fallbacks: %j", async (loadedData) => {
     const load = vi.fn<Load>().mockResolvedValue(loadedData);
     const { button } = renderDownload({ lazy: true }, load);
@@ -93,6 +98,7 @@ describe("DownloadPlugin", () => {
       ]);
     });
     expect(load).toHaveBeenCalledExactlyOnceWith({});
+    expect(toast).not.toHaveBeenCalled();
   });
 
   it.each([false, true])("ignores disabled clicks (lazy=%s)", (lazy) => {
@@ -122,10 +128,13 @@ describe("DownloadPlugin", () => {
     },
   );
 
-  it("validates the lazy response even when the initial URL is valid", async () => {
-    const load = vi
-      .fn<Load>()
-      .mockResolvedValue({ data: "javascript:alert(1)" });
+  it.each([
+    "javascript:alert(1)",
+    "data:text/html,<h1>hello</h1>",
+    "data:image/svg+xml,<svg/>",
+    "data:application/x-javascript,alert(1)",
+  ])("validates the lazy response URL %s", async (data) => {
+    const load = vi.fn<Load>().mockResolvedValue({ data });
     const { button } = renderDownload({ lazy: true }, load);
     fireEvent.click(button);
 

package/src/utils/__tests__/download.test.tsx

@@ -11,6 +11,7 @@ import {
   downloadExportedFile,
   downloadHTMLAsImage,
   getImageDataUrlForCell,
+  isDownloadUrl,
   withLoadingToast,
 } from "../download";
 
@@ -616,9 +617,26 @@ describe("downloadByURL", () => {
     "DATA:TEXT/PLAIN;base64,aGVsbG8=",
     "data:application/json,%7B%7D",
     "data:application/octet-stream;base64,AAA=",
+    "data:audio/x-wav;base64,AAA=",
+    "data:AUDIO/MPEG;codecs=mp3;base64,AAA=",
+    "data:video/mp4;base64,AAA=",
+    "data:image/tiff;base64,AAA=",
+    "data:application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;base64,AAA=",
+    "data:application/vnd.ms-excel;base64,AAA=",
+    "data:application/vnd.apache.parquet;base64,AAA=",
+    "data:application/x-hdf5;base64,AAA=",
+    "data:application/x-custom-format;base64,AAA=",
+    "data:application/geo+json,%7B%7D",
+    "data:application/epub+zip;base64,AAA=",
+    "data:font/woff2;base64,AAA=",
+    "data:text/markdown;charset=utf-8,%23%20Title",
+    "data:application/pdf;base64,AAA=",
     "data:,hello",
     "data:;base64,aGVsbG8=",
     "data:text/plain,",
+    "data:text/plain,javascript:alert(1)",
+    "data:text/plain,hello?name=world#fragment",
+    "data:application/javascript-source,source%20code",
     " https://example.com/results.csv ",
   ])("downloads %s without an explicit filename", (url) => {
     downloadByURL(url);
@@ -644,6 +662,31 @@ describe("downloadByURL", () => {
     "data:image/svg+xml,<svg/>",
     "data:application/xhtml+xml,<html/>",
     "data:text/javascript,alert(1)",
+    "data:application/javascript;charset=utf-8,alert(1)",
+    "data:application/x-javascript;base64,AAA=",
+    "data:application/ecmascript,alert(1)",
+    "data:application/x-ecmascript,alert(1)",
+    "data:text/ecmascript,alert(1)",
+    "data:text/x-ecmascript,alert(1)",
+    "data:text/x-javascript,alert(1)",
+    "data:text/javascript1.0,alert(1)",
+    "data:text/javascript1.1,alert(1)",
+    "data:text/javascript1.2,alert(1)",
+    "data:text/javascript1.3,alert(1)",
+    "data:text/javascript1.4,alert(1)",
+    "data:text/javascript1.5,alert(1)",
+    "data:text/jscript,alert(1)",
+    "data:text/livescript,alert(1)",
+    "data:text/vbscript,msgbox(1)",
+    "data:text/xml,<root/>",
+    "data:application/xml,<root/>",
+    "data:IMAGE/SVG+XML;charset=utf-8;base64,AAA=",
+    "data:application/custom+xml,<root/>",
+    "data:invalid,hello",
+    "data:text/,hello",
+    "data:/plain,hello",
+    "data:text/pl ain,hello",
+    "data:text/plain/extra,hello",
     "data:text/plain",
     "https://[invalid",
     "",
@@ -654,28 +697,92 @@ describe("downloadByURL", () => {
     expect(mockAnchor.click).not.toHaveBeenCalled();
   });
 
-  it("downloads an exported file with its returned metadata", async () => {
-    let downloadedBlob: Blob | undefined;
-    vi.stubGlobal(
-      "URL",
-      class extends URL {
-        public static override createObjectURL = vi.fn((blob: Blob) => {
-          downloadedBlob = blob;
-          return "blob:export";
-        });
-        public static override revokeObjectURL = vi.fn();
-      },
-    );
-
-    downloadExportedFile({
-      contents: "notebook",
-      filename: "résumé.qmd",
-      mediaType: "text/plain; charset=utf-8",
-    });
+  it.each(Array.from({ length: 33 }, (_, code) => code))(
+    "rejects a script scheme with leading ASCII character %i",
+    (code) => {
+      const url = `${String.fromCharCode(code)}JaVa\nScRi\tPt:alert(1)`;
+      expect(() => downloadByURL(url)).toThrow("Unsupported download URL");
+      expect(document.createElement).not.toHaveBeenCalled();
+    },
+  );
 
-    expect(downloadedBlob?.type).toBe("text/plain; charset=utf-8");
-    expect(await downloadedBlob?.text()).toBe("notebook");
-    expect(mockAnchor.download).toBe("résumé.qmd");
-    expect(URL.revokeObjectURL).toHaveBeenCalledWith("blob:export");
+  it.each([
+    "text/html",
+    "application/xhtml+xml",
+    "image/svg+xml",
+    "application/custom+xml",
+    "text/javascript1.4",
+    "text/javascript2.0",
+    "application/x-javascript2.0",
+    "text/ecmascript2026",
+    "text/livescript",
+  ])("rejects normalized and parameterized data MIME type %s", (mimeType) => {
+    const urls = [
+      `DATA:${mimeType.toUpperCase()},payload`,
+      `data: ${mimeType} ;charset=utf-8,payload`,
+      `data:${mimeType};charset="utf-8";base64,cGF5bG9hZA==`,
+      `da\tta:${mimeType};name=file.txt,payload?query#fragment`,
+    ];
+    for (const url of urls) {
+      expect(() => downloadByURL(url)).toThrow("Unsupported download URL");
+    }
+    expect(document.createElement).not.toHaveBeenCalled();
   });
+
+  it.each([
+    null,
+    undefined,
+    42,
+    false,
+    {},
+    [],
+    new String("https://example.com"),
+  ])("rejects non-string input %j without throwing or coercing it", (url) => {
+    expect(isDownloadUrl(url)).toBe(false);
+  });
+
+  it.each([false, true])(
+    "releases exported files after a click (fails=%s)",
+    async (fails) => {
+      let downloadedBlob: Blob | undefined;
+      vi.stubGlobal(
+        "URL",
+        class extends URL {
+          public static override createObjectURL = vi.fn((blob: Blob) => {
+            downloadedBlob = blob;
+            return "blob:export";
+          });
+          public static override revokeObjectURL = vi.fn();
+        },
+      );
+
+      if (fails) {
+        vi.mocked(mockAnchor.click).mockImplementation(() => {
+          throw new Error("Download failed");
+        });
+      }
+      const download = () =>
+        downloadExportedFile({
+          contents: "notebook",
+          filename: "résumé.qmd",
+          mediaType: "text/plain; charset=utf-8",
+        });
+      let caughtError: unknown;
+      try {
+        download();
+      } catch (error) {
+        caughtError = error;
+      }
+
+      expect(caughtError).toEqual(
+        fails ? new Error("Download failed") : undefined,
+      );
+
+      expect(downloadedBlob?.type).toBe("text/plain; charset=utf-8");
+      expect(await downloadedBlob?.text()).toBe("notebook");
+      expect(mockAnchor.download).toBe("résumé.qmd");
+      expect(mockAnchor.remove).toHaveBeenCalledOnce();
+      expect(URL.revokeObjectURL).toHaveBeenCalledWith("blob:export");
+    },
+  );
 });

package/src/utils/download.ts

@@ -178,26 +178,18 @@ export async function downloadHTMLAsImage(opts: {
   }
 }
 
-const DOWNLOAD_DATA_TYPES = new Set([
-  "text/plain",
-  "text/csv",
-  "text/tab-separated-values",
-  "application/json",
-  "application/octet-stream",
-  "application/pdf",
-  "application/zip",
-  "application/gzip",
-  "image/png",
-  "image/jpeg",
-  "image/gif",
-  "image/webp",
-  "image/avif",
-  "image/bmp",
-  "image/x-icon",
+// mo.download supports arbitrary file formats, so a MIME allowlist is too restrictive.
+const NON_DOWNLOAD_DATA_TYPES = new Set([
+  "text/html",
+  "text/xml",
+  "application/xml",
+  "text/jscript",
+  "text/livescript",
+  "text/vbscript",
 ]);
 
-export function isDownloadUrl(url: string): boolean {
-  if (!url.trim()) {
+export function isDownloadUrl(url: unknown): url is string {
+  if (typeof url !== "string" || !url.trim()) {
     return false;
   }
   try {
@@ -218,7 +210,18 @@ export function isDownloadUrl(url: string): boolean {
           .trim()
           .toLowerCase();
         // An omitted MIME type defaults to text/plain.
-        return DOWNLOAD_DATA_TYPES.has(mimeType || "text/plain");
+        if (!mimeType) {
+          return true;
+        }
+        return (
+          /^[\w!#$%&'*+.^`|~-]+\/[\w!#$%&'*+.^`|~-]+$/.test(mimeType) &&
+          !NON_DOWNLOAD_DATA_TYPES.has(mimeType) &&
+          // Include versioned and x- aliases without enumerating each version.
+          !/^(?:text|application)\/(?:x-)?(?:java|ecma)script(?:\d+(?:\.\d+)*)?$/.test(
+            mimeType,
+          ) &&
+          !mimeType.endsWith("+xml")
+        );
       }
       default:
         return false;
@@ -235,14 +238,20 @@ export function downloadByURL(url: string, filename?: string) {
   const a = document.createElement("a");
   a.href = url;
   a.download = filename ?? "";
-  a.click();
-  a.remove();
+  try {
+    a.click();
+  } finally {
+    a.remove();
+  }
 }
 
 export function downloadBlob(blob: Blob, filename: string) {
   const url = URL.createObjectURL(blob);
-  downloadByURL(url, filename);
-  URL.revokeObjectURL(url);
+  try {
+    downloadByURL(url, filename);
+  } finally {
+    URL.revokeObjectURL(url);
+  }
 }
 
 export function downloadExportedFile({