@salesforce/ui-design-mode 10.9.1 → 10.10.0

package/dist/protocol/messageTypes.d.cts

@@ -44,7 +44,19 @@ export interface TextChangeMessage {
     text: string;
     sourceLocation?: SourceLocation;
 }
-/** Apply a media-element change (e.g. `<img src>`, `<video src>`). */
+/**
+ * Apply a media-element change (e.g. `<img src>`, `<video src>`).
+ *
+ * `attributes` is a sparse map: only the keys the panel intends to change are
+ * present, and `undefined` means "leave untouched". The map is intentionally a
+ * loose `Record` so the contract stays additive across future media tags — it
+ * is NOT a license to set arbitrary DOM attributes. The iframe runtime applies
+ * it through a per-tag whitelist (see `mediaAppliers` in
+ * interactionsController.ts): each tag's applier reads only the attribute keys
+ * valid for that tag (for `img`: `src`/`alt`/`width`/`height`) and ignores any
+ * others, so an unexpected key never reaches the element. Keep that whitelist
+ * authoritative — do not switch the apply path to spreading this map.
+ */
 export interface MediaChangeMessage {
     type: "media-change";
     tag: string;

package/dist/protocol/messageTypes.d.ts

@@ -44,7 +44,19 @@ export interface TextChangeMessage {
     text: string;
     sourceLocation?: SourceLocation;
 }
-/** Apply a media-element change (e.g. `<img src>`, `<video src>`). */
+/**
+ * Apply a media-element change (e.g. `<img src>`, `<video src>`).
+ *
+ * `attributes` is a sparse map: only the keys the panel intends to change are
+ * present, and `undefined` means "leave untouched". The map is intentionally a
+ * loose `Record` so the contract stays additive across future media tags — it
+ * is NOT a license to set arbitrary DOM attributes. The iframe runtime applies
+ * it through a per-tag whitelist (see `mediaAppliers` in
+ * interactionsController.ts): each tag's applier reads only the attribute keys
+ * valid for that tag (for `img`: `src`/`alt`/`width`/`height`) and ignores any
+ * others, so an unexpected key never reaches the element. Keep that whitelist
+ * authoritative — do not switch the apply path to spreading this map.
+ */
 export interface MediaChangeMessage {
     type: "media-change";
     tag: string;

package/dist/protocol/messageTypes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"messageTypes.d.ts","sourceRoot":"","sources":["../../src/protocol/messageTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;GASG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,sBAAsB,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,sEAAsE;AACtE,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAC5B,yBAAyB,GACzB,0BAA0B,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,CAAC;AAItB,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,0BAA0B,CAAC;IACjC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAC5B,8BAA8B,GAC9B,wBAAwB,GACxB,kBAAkB,CAAC;AAItB;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,CAAC;AAEvC,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,uBAAuB,EAAG,qBAA8B,CAAC;AACtE,eAAO,MAAM,wBAAwB,EAAG,sBAA+B,CAAC;AACxE,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,eAAe,EAAG,aAAsB,CAAC;AACtD,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,4BAA4B,EAAG,0BAAmC,CAAC;AAChF,eAAO,MAAM,sBAAsB,EAAG,oBAA6B,CAAC;AACpE,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC"}
+{"version":3,"file":"messageTypes.d.ts","sourceRoot":"","sources":["../../src/protocol/messageTypes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;;;;;;GASG;AAEH;;;;;;;;GAQG;AACH,MAAM,WAAW,cAAc;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,yBAAyB;IACzC,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,EAAE,sBAAsB,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,MAAM,mBAAmB,GAC5B,yBAAyB,GACzB,0BAA0B,GAC1B,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,CAAC;AAItB,MAAM,WAAW,8BAA8B;IAC9C,IAAI,EAAE,0BAA0B,CAAC;IACjC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,oBAAoB,CAAC;IAC3B,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAC5B,8BAA8B,GAC9B,wBAAwB,GACxB,kBAAkB,CAAC;AAItB;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC9B,GAAG,EAAE,KAAK,CAAC;IACX,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,cAAc,CAAC;AAEvC,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE,SAAS,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,cAAc,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,eAAO,MAAM,uBAAuB,EAAG,qBAA8B,CAAC;AACtE,eAAO,MAAM,wBAAwB,EAAG,sBAA+B,CAAC;AACxE,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,eAAe,EAAG,aAAsB,CAAC;AACtD,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC;AACxD,eAAO,MAAM,4BAA4B,EAAG,0BAAmC,CAAC;AAChF,eAAO,MAAM,sBAAsB,EAAG,oBAA6B,CAAC;AACpE,eAAO,MAAM,gBAAgB,EAAG,cAAuB,CAAC"}

package/dist/runtime/design-mode-interactions.js

@@ -642,6 +642,10 @@
 
   // src/runtime/interactions/interactionsController.ts
   var mediaAppliers = {
+    // Whitelist by construction: this applier reads only the attribute keys
+    // valid for <img> and ignores anything else in `attrs`. The map is never
+    // spread onto the element, so a host→iframe payload cannot set arbitrary
+    // attributes (see MediaChangeMessage in protocol/messageTypes.ts).
     img: (el, attrs) => {
       const img = el;
       if (attrs.src !== void 0) img.setAttribute("src", attrs.src);

package/dist/runtime/interactions/interactionsController.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interactionsController.d.ts","sourceRoot":"","sources":["../../../src/runtime/interactions/interactionsController.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,qBAAqB,CAAC;AAmC7B,qBAAa,sBAAsB;IAClC,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,QAAQ,CAAU;IAE1B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,OAAO,UAAO;IAwD1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAiBlB;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,OAAO,IAAI,IAAI;IAMf,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI;IAMxF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI;IAMpE;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC9C,cAAc,CAAC,EAAE,cAAc,GAC7B,IAAI;IAUP;;OAEG;IACH,OAAO,IAAI,IAAI;CAOf"}
+{"version":3,"file":"interactionsController.d.ts","sourceRoot":"","sources":["../../../src/runtime/interactions/interactionsController.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EAGN,KAAK,cAAc,EACnB,MAAM,qBAAqB,CAAC;AAuC7B,qBAAa,sBAAsB;IAClC,OAAO,CAAC,OAAO,CAAU;IACzB,OAAO,CAAC,QAAQ,CAAU;IAE1B,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,aAAa,CAAgB;gBAEzB,OAAO,UAAO;IAwD1B;;OAEG;IACH,UAAU,IAAI,IAAI;IAiBlB;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,OAAO,IAAI,IAAI;IAMf,OAAO,CAAC,cAAc;IAWtB;;;;OAIG;IACH,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI;IAMxF,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,IAAI;IAMpE;;;;;;;;;;;;;;;OAeG;IACH,gBAAgB,CACf,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,EAC9C,cAAc,CAAC,EAAE,cAAc,GAC7B,IAAI;IAUP;;OAEG;IACH,OAAO,IAAI,IAAI;CAOf"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@salesforce/ui-design-mode",
   "description": "Hybrid editor (design-mode) authoring UI, iframe runtime, source-locator, and protocol for Salesforce UI Bundles",
-  "version": "10.9.1",
+  "version": "10.10.0",
   "license": "SEE LICENSE IN LICENSE.txt",
   "type": "module",
   "exports": {
@@ -35,6 +35,16 @@
         "default": "./dist/runtime/index.cjs"
       }
     },
+    "./authoring/host": {
+      "import": {
+        "types": "./dist/authoring/host/index.d.ts",
+        "default": "./dist/authoring/host/index.js"
+      },
+      "require": {
+        "types": "./dist/authoring/host/index.d.cts",
+        "default": "./dist/authoring/host/index.cjs"
+      }
+    },
     "./authoring/react": {
       "types": "./dist/authoring/react/index.d.ts",
       "import": "./dist/authoring/react/index.js"
@@ -80,6 +90,7 @@
     "@types/react": "19.2.14",
     "@types/react-dom": "19.2.3",
     "esbuild": "^0.24.0",
+    "jsdom": "^27.0.0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
     "ts-morph": "^25.0.0",