v0-sdk

Fixes the double border on the v0-clone prompt input, reported by @Alex Grover. The outer form had its own rounded-2xl shadow, and the inner drew a second rounded-md border and shadow inside it. Moved the card styles (radius, border color, background, shadow) from the form onto the inner , so only one outline renders.

Summary Repair the stale v0 dependency pins in bun.lock that blocked the 3.0.10 release. Run bun install --lockfile-only a second time after bumping package versions. Bun 1.4.2 updates workspace versions on the first pass but refreshes their dependency pins on the second. Validate frozen installs before opening release PRs, and enforce frozen installs in CI. Verification Reproduced the original failure from the pre-release repository snapshot using Bun 1.4.2. Ran the revised bump → canary → restore workflow locally: both v0 pins match 3.0.10 and frozen installs succeed. bun run fmt:check passes. Fixes the failure in https://github.com/vercel/v0-sdk/actions/runs/37958183039/job/113913949705.

Summary Provide browser helpers for API customers to enable and save edits from the existing v0 Design Mode preview runtime. Backend support is already merged in vercel/v0#31168. This PR supplies the frontend integration surface; it does not export an editor component or replace the runtime. Problem API customers can submit headless Design Mode edits, and v0 previews already include the visual-editing runtime, but connecting a customer-owned parent app requires reproducing private postMessage/BIDC plumbing. Customers also need to normalize runtime screenshots and instructions before forwarding them to API v2, without exposing their API key in the browser. Solution Export from : enable/disable, Apply callbacks, immutable selection/tree snapshots, layer controls, runtime reconnection, and disposal. Authenticate the MessagePort handshake against the exact iframe window and origin. Reuse 0.0.3 encode/decode for compatibility with the existing runtime protocol, with bounded incoming messages and timeout/cancellation handling for control RPCs. Export from both and to preserve all existing edit types, combine instructions with edits, omit empty messages, and convert JPEG region/element screenshots to API data URIs. Export for backend validation and copying of normalized input. Strip unrelated fields such as model overrides and MCP server IDs. Restore desired enabled state after iframe navigation, reject concurrent Apply requests, never automatically resubmit saves, and abort the Apply callback's signal on disposal. Keep the authenticated client off the browser helper's source graph. The browser bridge never reads an API key or calls the API directly; customers provide their own authenticated backend callback. Document preview-proxy requirements, customer-owned chat authorization, Apply acknowledgement semantics, layer controls, and cleanup. Apply is emitted by the editor's button inside the iframe. This does not invent an unsupported parent-side Apply/undo/screenshot RPC. Consumers must authenticate application users and authorize their chat access on their own backend. Aborting a client fetch does not guarantee cancellation of an already accepted generation. Architecture The customer's API credential remains exclusively on the backend. Origin/source checks establish the preview connection; they do not replace application-user or chat authorization. Validation passed, including package declaration/exports validation. passed across SDK and example workspaces. : 122 tests passed across , , and . passed with existing warnings only. Formatting checks for all changed files passed. passed; lockfile changes are limited to the new codec dependency. Manual Chromium smoke test against a cross-origin BIDC runtime fixture passed: enable, Apply normalization/acknowledgement, disable, iframe reload/reconnection without repeated saves, layer RPC, and disposal. This fixture validates the browser transport, not a live hosted v0 preview or a new model generation. Tests include real MessagePort/BIDC interoperability, both initialization orders, forged-origin/source handshakes, invalid payloads, screenshot limits and precedence, backend field stripping, immutable snapshots, the runtime's 300 DOM nodes plus synthetic tree root, Apply failures/concurrency, RPC timeouts, failed setup cleanup, reconnection, disposal, and browser/server entrypoint separation. Runnable example integration The v0-clone example now exercises the helpers through its real preview and server-side SDK path: Preview toolbar: Design Mode toggle, runtime connection/saving status, errors, and iframe refresh. New endpoint uses the existing origin guard and credential resolution, validates/strips input, and waits for a successful completed assistant turn before acknowledging Apply. Message/file caches refresh after saving; code refreshes without remounting the Apply iframe. Confirmed saves remain acknowledged even if cache revalidation fails, preventing accidental duplicate generations. Normal chat actions and Design Mode saves cannot overlap in the UI. Switching away from Preview or encountering a read-only/busy chat disables editing. Added 20 UI/endpoint tests, including the workspace iframe-preservation regression. Run from the repository root: Open http://localhost:3000, configure the API key through the existing dialog (or environment on both apps), create/open a chat, and use Preview → Design Mode → select/tweak → Apply. Inspect Code afterward. Full steps and the existing shared-workspace/no-auth warning are in . Updated validation: 142 workspace tests passed, workspace type checks and lint passed, frozen-lockfile installation passed, and the example web app's Next.js production build passed. Example tests mock generation and do not spend credits; manually testing Apply uses normal API credits. Responsive chat feedback and compact rendering Following manual example testing, Design Mode saves now use end-to-end rather than waiting on a synchronous response: Show a compact optimistic user turn and processing indicator immediately, before response headers or the first assistant event arrive. Stream assistant activities into the chat panel and reconcile by server message ID without duplicating turns. Keep Apply pending until the final assistant message confirms , then hand off to persisted history and refresh code. Render persisted Design Mode turns as human instructions or "Design Mode edit", not the internal refinement prompt/JSON. Hide user attachment cards while retaining screenshot context in the API request. Render user text as wrapping plain text and bound the chat column to prevent long URLs/payloads from expanding or clipping the bubble. Validation: 154 workspace tests passed, including optimistic timing, live SSE activity delivery before completion, final-acknowledgement gating, error forwarding, turn reconciliation, compact rendering, hidden attachments, and long-token wrapping. Workspace type checks, lint, formatting checks, frozen-lockfile installation, and the example web production build passed. The running localhost example remains available with these updates; no extra live model generation was used for these regression checks.