@salesforce/lwc-adapters-uiapi 1.453.0 → 1.455.0

package/dist/main.js

@@ -575,7 +575,7 @@ function createResourceParamsImpl(config, configMetadata) {
     }
     return resourceParams;
 }
-// engine version: 0.161.0-fe06f180
+// engine version: 0.161.2-bd1bd38a
 
 /**
  * Returns true if the value acts like a Promise, i.e. has a "then" function,
@@ -7813,7 +7813,7 @@ function buildAdapterValidationConfig(displayName, paramsMeta) {
 }
 const keyPrefix = 'UiApi';
 
-const { assign, create, freeze, isFrozen, keys } = Object;
+const { assign, create, freeze, getPrototypeOf, isFrozen, keys } = Object;
 const { hasOwnProperty } = Object.prototype;
 const { split, endsWith } = String.prototype;
 const { isArray } = Array;
@@ -11075,6 +11075,24 @@ function isFieldValueRepresentation(unknown) {
     }
     return 'value' in unknown && 'displayValue' in unknown;
 }
+/**
+ * Whether `value` is a plain data object safe to index into as a record's
+ * `fields` map. getField runs as trusted (system-mode) code walking a caller-
+ * supplied dot-path, so indexing into a host/exotic object (e.g. `window`) or
+ * reading a prototype-chain property (e.g. `__proto__`) would let it read host
+ * state on the caller's behalf -- the same class of confused-deputy sandbox
+ * escape fixed for `getSObjectValue` (W-23862210). Record field maps are
+ * JSON-derived plain objects, so we accept only a prototype chain that ends
+ * immediately at an `Object.prototype` (or `null`), which also keeps
+ * cross-realm/membrane records (LWS) valid.
+ */
+function isTraversableFieldsMap(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const proto = getPrototypeOf(value);
+    return proto === null || getPrototypeOf(proto) === null;
+}
 function getField(record, field) {
     const fieldApiName = getFieldApiName(field);
     if (fieldApiName === undefined) {
@@ -11084,7 +11102,13 @@ function getField(record, field) {
     const fields = unqualifiedField.split('.');
     let r = record;
     while (r && r.fields) {
+        if (isTraversableFieldsMap(r.fields) === false) {
+            return undefined;
+        }
         const f = fields.shift();
+        if (!hasOwnProperty.call(r.fields, f)) {
+            return undefined;
+        }
         const fvr = r.fields[f];
         if (fvr === undefined) {
             return undefined;
@@ -17438,8 +17462,29 @@ function validate$1N(obj, path = 'RecordLayoutSaveOptionRepresentation') {
         }
         const obj_restHeaderName = obj.restHeaderName;
         const path_restHeaderName = path + '.restHeaderName';
-        if (typeof obj_restHeaderName !== 'string') {
-            return new TypeError('Expected "string" but received "' + typeof obj_restHeaderName + '" (at "' + path_restHeaderName + '")');
+        let obj_restHeaderName_union0 = null;
+        const obj_restHeaderName_union0_error = (() => {
+            if (typeof obj_restHeaderName !== 'string') {
+                return new TypeError('Expected "string" but received "' + typeof obj_restHeaderName + '" (at "' + path_restHeaderName + '")');
+            }
+        })();
+        if (obj_restHeaderName_union0_error != null) {
+            obj_restHeaderName_union0 = obj_restHeaderName_union0_error.message;
+        }
+        let obj_restHeaderName_union1 = null;
+        const obj_restHeaderName_union1_error = (() => {
+            if (obj_restHeaderName !== null) {
+                return new TypeError('Expected "null" but received "' + typeof obj_restHeaderName + '" (at "' + path_restHeaderName + '")');
+            }
+        })();
+        if (obj_restHeaderName_union1_error != null) {
+            obj_restHeaderName_union1 = obj_restHeaderName_union1_error.message;
+        }
+        if (obj_restHeaderName_union0 && obj_restHeaderName_union1) {
+            let message = 'Object doesn\'t match union (at "' + path_restHeaderName + '")';
+            message += '\n' + obj_restHeaderName_union0.split('\n').map((line) => '\t' + line).join('\n');
+            message += '\n' + obj_restHeaderName_union1.split('\n').map((line) => '\t' + line).join('\n');
+            return new TypeError(message);
         }
         const obj_soapHeaderName = obj.soapHeaderName;
         const path_soapHeaderName = path + '.soapHeaderName';

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lwc-adapters-uiapi",
-    "version": "1.453.0",
+    "version": "1.455.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "UIAPI adapters with LWC bindings",
     "module": "dist/main.js",
@@ -31,10 +31,10 @@
         "clean": "rm -rf dist src/generated"
     },
     "devDependencies": {
-        "@salesforce/lds-adapters-uiapi": "^1.453.0"
+        "@salesforce/lds-adapters-uiapi": "^1.455.0"
     },
     "dependencies": {
-        "@luvio/lwc-luvio": "0.161.0",
-        "@salesforce/lds-default-luvio": "^1.453.0"
+        "@luvio/lwc-luvio": "0.161.2",
+        "@salesforce/lds-default-luvio": "^1.455.0"
     }
 }