sunpeak 0.20.18 → 0.20.19

package/dist/lib/utils.d.ts

@@ -1,2 +1,13 @@
 import { ClassValue } from 'clsx';
 export declare function cn(...inputs: ClassValue[]): string;
+/**
+ * Returns true when `icon` is safe to use as the `src` of an `<img>` rendered
+ * inside the inspector chrome. Accepts http(s) URLs and `data:image/*` URIs
+ * for raster image types only. SVG data URIs are rejected because they can
+ * include `<script>`/event handlers that execute when the document parses
+ * the inline document (the `<img>` tag itself does not run scripts in modern
+ * browsers, but adjacent <object>/<embed>/<iframe> renders would). Anything
+ * else (emoji, plain text, javascript:, file:, etc.) falls through to the
+ * text-rendering path that already handles emoji icons.
+ */
+export declare function isAllowedIconUrl(icon: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sunpeak",
-  "version": "0.20.18",
+  "version": "0.20.19",
   "description": "App framework, testing framework, and inspector for MCP Apps.",
   "type": "module",
   "main": "./dist/index.cjs",

package/template/dist/albums/albums.json

@@ -12,5 +12,5 @@
     }
   },
   "name": "albums",
-  "uri": "ui://albums-moulf6ph"
+  "uri": "ui://albums-movyulvx"
 }

package/template/dist/carousel/carousel.json

@@ -12,5 +12,5 @@
     }
   },
   "name": "carousel",
-  "uri": "ui://carousel-moulf6ph"
+  "uri": "ui://carousel-movyulvx"
 }

package/template/dist/map/map.json

@@ -18,5 +18,5 @@
     }
   },
   "name": "map",
-  "uri": "ui://map-moulf6ph"
+  "uri": "ui://map-movyulvx"
 }

package/template/dist/review/review.json

@@ -12,5 +12,5 @@
     }
   },
   "name": "review",
-  "uri": "ui://review-moulf6ph"
+  "uri": "ui://review-movyulvx"
 }