@trinityui/design-system 2.11.0 → 2.11.1

package/CHANGELOG.md

@@ -1,3 +1,57 @@
+## [2.11.1](https://github.com/Trinity-UI-Components/trinity-design-system/compare/v1.0.0...v2.11.1) (2026-10-05)
+
+### Features
+
+* **a11y:** add behavior contract ratchet check and remediation plans ([5d1931a](https://github.com/Trinity-UI-Components/trinity-design-system/commit/5d1931a4d14c9d2812cc14b07f145b206f89903b))
+* **a11y:** brand-color Option A — text.link/success/warning now WCAG AA ([812241b](https://github.com/Trinity-UI-Components/trinity-design-system/commit/812241b2013010a834511dbd75968fba62517fd7)), closes [#27AAE1](https://github.com/Trinity-UI-Components/trinity-design-system/issues/27AAE1) [#0E62CA](https://github.com/Trinity-UI-Components/trinity-design-system/issues/0E62CA) [#16A34A](https://github.com/Trinity-UI-Components/trinity-design-system/issues/16A34A) [#15803D](https://github.com/Trinity-UI-Components/trinity-design-system/issues/15803D) [#D97706](https://github.com/Trinity-UI-Components/trinity-design-system/issues/D97706) [#B45309](https://github.com/Trinity-UI-Components/trinity-design-system/issues/B45309)
+* **a11y:** track A+B fixes — contrast tokens, addon-vitest, deprecation milestones ([296ae23](https://github.com/Trinity-UI-Components/trinity-design-system/commit/296ae23360132cd0f9f6e792e45f62404f177931))
+* add AI agent guide story, custom CSF indexer, and split agent docs ([5545d77](https://github.com/Trinity-UI-Components/trinity-design-system/commit/5545d7708d6e9482506eb05ef02eb61dd9d1a96b))
+* add copy-paste UI pattern examples and component API details to agent prompts ([a647c9a](https://github.com/Trinity-UI-Components/trinity-design-system/commit/a647c9a8633f3164f9065743719e74376705c9fd))
+* add DocumentCard component with configurable features ([41e3370](https://github.com/Trinity-UI-Components/trinity-design-system/commit/41e3370f8cf460d82b3c53159887ad04cb60f764))
+* **ai:** add AIChainOfThought component and Storybook docs for all AI components\n\n- Add AIChainOfThought component with 5 phase types: Understanding, Plan,\n  Execution, Output, and Insight. Features collapsible thought process toggle,\n  auto-collapse, typing indicators, error/retry flows, artifact cards, and\n  reuses AIMessage, AISourcesPanel, AIRelatedQuestions, AISuggestedAction.\n- Add 10 stories for AIChainOfThought (PipelineAnalysis, ErrorAndRetry,\n  LiveSimulation, etc.)\n- Add Storybook stories for 12 previously undocumented AI components:\n  AILabel, AIAvatar, AIActions, AIContainer, AIExplainability, AIVisuals,\n  AIChat, UserMessage, ChatThread, InsightEngine\n- Export AIChainOfThought and all related types from public API\n- Fix Storybook theme: purple buttons, darker text, a11y context parameter\n- Add white-on-purple button text CSS in manager-head.html" ([27032ab](https://github.com/Trinity-UI-Components/trinity-design-system/commit/27032abb4403838de1d1cecbe7202e66492da928))
+* **ai:** attachment upload states + fix composer gradient glow ([934ae68](https://github.com/Trinity-UI-Components/trinity-design-system/commit/934ae684c83baa8b99b959cd58e058b0df79b3e5))
+* **ai:** enterprise InsightEngineInput composer + functional voice mode ([3694d3b](https://github.com/Trinity-UI-Components/trinity-design-system/commit/3694d3ba16795206e03b40e6529424043aa6437a))
+* **Combobox:** add visible checkboxes and Select All option ([435e01a](https://github.com/Trinity-UI-Components/trinity-design-system/commit/435e01a71f0c6ba7fab9decb7d0d9b5cd760bbb1))
+* **components:** add new component & template library, Figma parity tooling ([d549e44](https://github.com/Trinity-UI-Components/trinity-design-system/commit/d549e44743027cdbd652f2196b82ddd403e712ba))
+* **components:** ship 70-fix roadmap across 10 phases ([544febc](https://github.com/Trinity-UI-Components/trinity-design-system/commit/544febce403ca60a511d30c490a513e28534b0dd))
+* **css-package:** generate trinity.css from tokens.ts (v2.5.0) ([640fd75](https://github.com/Trinity-UI-Components/trinity-design-system/commit/640fd75ee52bb020866606851704c6d9e8dd65de))
+* **css:** expand trinity.css with comprehensive design tokens ([e1a9f22](https://github.com/Trinity-UI-Components/trinity-design-system/commit/e1a9f22c97d58959afcbf0d4c1aa76a76db52126))
+* **docs:** add AI Agent Guide (CSS edition) for non-React stacks ([3eeb7af](https://github.com/Trinity-UI-Components/trinity-design-system/commit/3eeb7afecdf9b5487ba9d9691493b47f9a4020e1))
+* fix button styling, add TopNav features, and add MuiAppBar override ([2354390](https://github.com/Trinity-UI-Components/trinity-design-system/commit/235439022d372696e5904f47ac03f9b44091f6ef))
+* simplify dependencies - remove date-pickers, add SimpleTable ([ee02f3e](https://github.com/Trinity-UI-Components/trinity-design-system/commit/ee02f3e299e13173e77355925dca513f3becf8a4))
+* simplify developer experience with essentials entry point ([a7e4a2f](https://github.com/Trinity-UI-Components/trinity-design-system/commit/a7e4a2fb1b221da9c2ee01f1b8c1a851f4e45697))
+* **storybook:** add Figma design links to stories via addon-designs ([4cb7a5d](https://github.com/Trinity-UI-Components/trinity-design-system/commit/4cb7a5dce1f96fdb8772511f9d19310f92c72f30))
+* **storybook:** add interactive Component Picker page ([2642326](https://github.com/Trinity-UI-Components/trinity-design-system/commit/2642326fbb68d30c865ea008cdb283fff96562a1))
+* **storybook:** add Trinity branding with custom logo and theme ([8859283](https://github.com/Trinity-UI-Components/trinity-design-system/commit/8859283b58ad77f22b303f0e31f915c0f4f9aecd)), closes [#050742](https://github.com/Trinity-UI-Components/trinity-design-system/issues/050742) [#7841C9](https://github.com/Trinity-UI-Components/trinity-design-system/issues/7841C9)
+* **theme:** add theme presets system for app variations ([ec21481](https://github.com/Trinity-UI-Components/trinity-design-system/commit/ec2148114bfb33b508755675abcd00a0abf3662c))
+* **TopNav:** add white-label logo support with invert option ([0d0a337](https://github.com/Trinity-UI-Components/trinity-design-system/commit/0d0a337de5500ac75919b4ccead9c6b159775600))
+
+### Bug Fixes
+
+* add non-null assertion for darkMode status tokens to fix TS18048 ([dac98bb](https://github.com/Trinity-UI-Components/trinity-design-system/commit/dac98bb46fab6ca9e61f7e3a053a55e90aa339bd))
+* add visual identity requirements to AI agent prompts ([3eba2d8](https://github.com/Trinity-UI-Components/trinity-design-system/commit/3eba2d8243907cac70fbcc6d50c1d38e3cd94d2c))
+* **ai:** apply URL and image policies to AITextBlock, AISources and InsightEngineInput ([c26fc6c](https://github.com/Trinity-UI-Components/trinity-design-system/commit/c26fc6c85e8db1711ad33af66095cc82b7c25e9b))
+* **ai:** render AIChainOfThought content through the safe-content allowlist ([3286b3b](https://github.com/Trinity-UI-Components/trinity-design-system/commit/3286b3b9b2cb59f079d0276a20fefa88cfc18b6a))
+* **ci:** drop redundant pnpm version input from workflows ([7695cfd](https://github.com/Trinity-UI-Components/trinity-design-system/commit/7695cfdb004fcee7a37bf16f8f0081e8f2ea9fb1))
+* **combobox:** make creatable mode usable and prevent duplicates ([665a787](https://github.com/Trinity-UI-Components/trinity-design-system/commit/665a7878cecf3048f9e7dabfcf3a66f660c75f38))
+* **DataCard:** use theme-aware status backgrounds for dark mode ([621a039](https://github.com/Trinity-UI-Components/trinity-design-system/commit/621a039446736238cabb7ed5919333c97145f009)), closes [#F0FDF4](https://github.com/Trinity-UI-Components/trinity-design-system/issues/F0FDF4) [#FFFBEB](https://github.com/Trinity-UI-Components/trinity-design-system/issues/FFFBEB)
+* footer dark/light theme, token compliance, and component overhaul ([31c0dd4](https://github.com/Trinity-UI-Components/trinity-design-system/commit/31c0dd450c1725eb1992eab665de3fe491609837))
+* **form:** eliminate register/validate render loop and stale validation state ([65c9f79](https://github.com/Trinity-UI-Components/trinity-design-system/commit/65c9f79012cb13d84e7df4ff3f17ef8ec05be30d))
+* **html-to-mui:** enforce the shared allowlist and block remote images by default ([f00e07c](https://github.com/Trinity-UI-Components/trinity-design-system/commit/f00e07c7c30a58adc8379520c08a3f8fde44e30d))
+* improve AI agent migration prompts and fix download button ([654c7eb](https://github.com/Trinity-UI-Components/trinity-design-system/commit/654c7ebe871c5e1e9167704324e7fc3dacc3bcc1))
+* improve Storybook configurability and documentation ([912194f](https://github.com/Trinity-UI-Components/trinity-design-system/commit/912194f35d20903d9252f25cb87ae7b7fc266db5))
+* **mentions:** restore textarea aria-label under MUI v9 ([6950879](https://github.com/Trinity-UI-Components/trinity-design-system/commit/69508794046ba0fa390fad733fd2b78d06a40c1f))
+* pre-launch blockers — build errors, secret removal, deprecation cleanup ([d8cedf1](https://github.com/Trinity-UI-Components/trinity-design-system/commit/d8cedf19ef15537ea53df325fc3285a566792fa1))
+* preserve Storybook deep links through Azure AD authentication ([4467667](https://github.com/Trinity-UI-Components/trinity-design-system/commit/4467667a2d9c81c8b36d4c60c3d81f17c0d91042))
+* replace hardcoded colors with token references across stories ([c962ab7](https://github.com/Trinity-UI-Components/trinity-design-system/commit/c962ab78cbc1b648f91157c200cba401944574f2)), closes [#fff](https://github.com/Trinity-UI-Components/trinity-design-system/issues/fff) [eee/#444](https://github.com/eee/trinity-design-system/issues/444) [FFFFFF/#E5E7EB](https://github.com/FFFFFF/trinity-design-system/issues/E5E7EB) [#e0e0e0](https://github.com/Trinity-UI-Components/trinity-design-system/issues/e0e0e0) [e0e0e0/#30363d](https://github.com/e0e0e0/trinity-design-system/issues/30363d)
+* replace light-mode-only overlays with theme-aware action palette ([00ff8ad](https://github.com/Trinity-UI-Components/trinity-design-system/commit/00ff8adb5a5b345e6a8c239da792276d2e38aa94))
+* **sandbox:** default SandboxedIframeRenderer to strict with a network-blocking CSP ([85e8b5f](https://github.com/Trinity-UI-Components/trinity-design-system/commit/85e8b5fa5865f3de220b464a9d72df98e573802c))
+* **security:** add shared safe-content module for untrusted HTML and URLs ([53c742a](https://github.com/Trinity-UI-Components/trinity-design-system/commit/53c742a6488332ed1551a30b6f1b78bcfb752464))
+* sync theme.ts with token system and spec ([78ae04c](https://github.com/Trinity-UI-Components/trinity-design-system/commit/78ae04c7e8e0e50a70b66e6dbcdf6a8154af4f4c)), closes [#fff](https://github.com/Trinity-UI-Components/trinity-design-system/issues/fff) [#1DC286](https://github.com/Trinity-UI-Components/trinity-design-system/issues/1DC286) [#FFB400](https://github.com/Trinity-UI-Components/trinity-design-system/issues/FFB400)
+* sync trinity.css with theme.ts and tokens.ts ([ac3209e](https://github.com/Trinity-UI-Components/trinity-design-system/commit/ac3209e2f26c8b71c7b990f7192bc03d2c2c467c))
+* **testing:** replace invalid axe rule and strip deprecation warnings from production builds ([ca5ff1e](https://github.com/Trinity-UI-Components/trinity-design-system/commit/ca5ff1e61a97616b38f7578b2b2c2bc0c4d304c5))
+* **tests:** repair AG Grid test env + a11y fixes; add StatusHero/TopRisksStrip/DateRangePicker ([69e3be2](https://github.com/Trinity-UI-Components/trinity-design-system/commit/69e3be27678466d7f95b9d9a4bbf745908e4f564))
+* update CSS theme to match brandColors from theme.ts ([481e0ca](https://github.com/Trinity-UI-Components/trinity-design-system/commit/481e0cafb55eed6c6d426115f25c3cfaef918b1e))
 ## [2.11.0](https://github.com/Trinity-UI-Components/trinity-design-system/compare/v1.0.0...v2.11.0) (2026-10-05)
 
 ### Features

package/MIGRATION.md

@@ -4,6 +4,31 @@ This document outlines breaking changes and migration paths for the Trinity Desi
 
 ---
 
+## `@trinityui/design-system` v2.11.1 — Untrusted AI content hardening (security)
+
+**No code changes required.** Upgrade to receive the fix for SEC-01 – SEC-04 (untrusted AI content rendered as HTML, unsafe URLs). Full record: [docs/remediation/SEC-01-ai-content-safety.md](docs/remediation/SEC-01-ai-content-safety.md).
+
+### Behavior corrections
+
+| Component | Before | After | Verified by |
+|---|---|---|---|
+| `AIChainOfThought` (`thoughts`, insight `content`) | Raw HTML (`dangerouslySetInnerHTML`): scripts, event handlers and `javascript:` links could run | Rendered through an allowlist: `b strong i em code br p ul ol li span a mark`, plus `<span class="insight-highlight">`. Other tags show as text (block elements such as headings, divs and table cells become space-separated text); HTML 4 named references decode, HTML5-only ones (e.g. `&check;`) stay literal; `style`, `id`, `data-*` and other classes are dropped; links keep only http(s), mailto, tel and relative URLs and use the theme's link colours; `<mark>` shows a theme-tinted highlight; the insight confidence bar is now named "Confidence" for assistive technology | `AIChainOfThought.security.test.tsx`, `AIChainOfThought.test.tsx` |
+| `AITextBlock` markdown links | Any URL became a link | Only http(s), mailto, tel and relative URLs become links; others show as plain text | `AIUrlPolicy.security.test.tsx`, `AIResponseRenderer.test.tsx` |
+| `AISource` `url` / `favicon` | Any URL / image source | Unsafe URLs show as text; favicons load only from safe sources, lazily and without a referrer | `AIUrlPolicy.security.test.tsx` |
+| `InsightEngineInput` attachment `previewUrl` | Any source | Only blob:, http(s), relative or raster `data:image/*`; others show the file icon | `AIUrlPolicy.security.test.tsx` |
+| Development console | — | `AITextBlock`, `AISource` and `InsightEngineInput` log a one-time warning naming the component when a link or image URL is blocked (silent in production builds); `AIChainOfThought` drops blocked links silently | `safeContent.test.tsx`, `AIUrlPolicy.security.test.tsx` |
+
+### Internal components (not exported; listed for contributors)
+
+- `HtmlToMui` / `StreamingHtmlToMui`: URL, style and class policies always apply; remote images blocked by default (`remoteImages`); MUI/Emotion classes filtered; `allowedClasses` to restrict further; blocked images show their alt text; content is clipped to the component's box; tables scroll horizontally inside a focusable, named container.
+- `SandboxedIframeRenderer`: `strict` by default; a CSP meta blocks network resource loads (`contentSecurityPolicy`, or `false`); `allow-scripts` is never combined with `allow-same-origin` (any letter case); framed documents send no referrer while `allow-same-origin` is absent (opaque origin; `referrerPolicy="no-referrer"` covers only the iframe's own request).
+
+### Images and schemes that no longer render
+
+`data:image/svg+xml`, non-raster data URIs, and app-shell schemes (`file:`, `asset:`, `tauri:`, `capacitor:`) are refused as image sources; custom link schemes (e.g. `msteams:`, `sms:`) render as text. Serve such assets over http(s), as blob: URLs, or as raster data URIs.
+
+---
+
 ## `@trinityui/design-system-css` v2.5.0 — CSS is now token-generated
 
 **Non-breaking for the 602 variable names shipped in v2.4.x.** Every CSS variable that existed in the hand-maintained `trinity.css` is still present, at the same name, with the same or WCAG-improved value.