@lwrjs/everywhere 0.21.5 → 0.21.7

package/build/__generated_site_amd_modules__/1/application/amd/l/en-US/ai/amd-bootstrap/configuration/ci/-/-/s/121a212d1c1430305d01594ee3058c1f/config.js

@@ -0,0 +1,12 @@
+/* This script is generated */
+/* Client Bootstrap configuration */
+globalThis.LWR = globalThis.LWR || {};
+Object.assign(globalThis.LWR, {"appId":"amd-bootstrap","bootstrapModule":"@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7","autoBoot":true,"imports":{"/1/module/amd/1/l/en-US/mi/%40lwrjs%2Fapp-service%2Famd-bootstrap%2Fmodule%2Famd%2Fv%2F0_21_7/s/3aba11034f11c8d5598c93bfca4d4690/@lwrjs_app-service_amd-bootstrap_module_amd.js":["@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2FpreInit%2Fv%2F0_21_7/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js":["lwr/preInit/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2Finit%2Fv%2F0_21_7/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js":["lwr/init/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2Fmetrics%2Fv%2F0_21_7/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js":["lwr/metrics/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2Fscheduler%2Fv%2F0_21_7/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js":["lwr/scheduler/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwc%2Fv%2F8_20_1/s/13f9f9934fd3a3c9f52760160b464d00/lwc.js":["lwc/v/8_20_1"],"/1/module/amd/1/l/en-US/mi/lwr%2FeverywhereAmd%2Fv%2F0_21_7/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js":["lwr/everywhereAmd/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2Fvault%2Fv%2F0_21_7/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js":["lwr/vault/v/0_21_7"]},"index":{"@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7":"/1/module/amd/1/l/en-US/mi/%40lwrjs%2Fapp-service%2Famd-bootstrap%2Fmodule%2Famd%2Fv%2F0_21_7/s/3aba11034f11c8d5598c93bfca4d4690/@lwrjs_app-service_amd-bootstrap_module_amd.js","lwr/preInit/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2FpreInit%2Fv%2F0_21_7/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js","lwr/init/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Finit%2Fv%2F0_21_7/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js","lwr/metrics/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Fmetrics%2Fv%2F0_21_7/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js","lwr/scheduler/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Fscheduler%2Fv%2F0_21_7/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js","lwc/v/8_20_1":"/1/module/amd/1/l/en-US/mi/lwc%2Fv%2F8_20_1/s/13f9f9934fd3a3c9f52760160b464d00/lwc.js","lwr/everywhereAmd/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2FeverywhereAmd%2Fv%2F0_21_7/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js","lwr/vault/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Fvault%2Fv%2F0_21_7/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js"},"rootComponents":["lwr/everywhereAmd/v/0_21_7"],"serverData":{},"requiredModules":["@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7"],"preloadModules":["lwr/preInit/v/0_21_7","lwr/init/v/0_21_7","lwr/metrics/v/0_21_7","lwr/scheduler/v/0_21_7","lwc/v/8_20_1","lwr/everywhereAmd/v/0_21_7"],"endpoints":{"uris":{"mapping":"/1/mapping/amd/1/l/en-US/mp/"}}});
+globalThis.LWR = {...globalThis.LWR, env: {"SSR":false,"SSREnabled":false,"basePath":"","locale":"en-US","assetBasePath":"","uiBasePath":""}};
+globalThis.process={...globalThis.process,env:{...globalThis.process?.env,...{"NODE_ENV":"compat"}}};
+globalThis.lwcRuntimeFlags = { ENABLE_MIXED_SHADOW_MODE: false, ENABLE_WIRE_SYNC_EMIT: false };
+// Appended by Static Site Generator
+if (!globalThis.LWR.imports) { globalThis.LWR.imports = {}; }
+Object.assign(globalThis.LWR.imports, {"/1/module/amd/1/l/en-US/mi/lwr%2Fprofiler%2Fv%2F0_21_7/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js":["lwr/profiler/v/0_21_7"],"/1/module/amd/1/l/en-US/mi/lwr%2Floader%2Fv%2F0_21_7/s/730dbe56c23f7b421f45c317e351be6f/lwr_loader.js":["lwr/loader/v/0_21_7"]})
+if (!globalThis.LWR.index) { globalThis.LWR.index = {}; }
+Object.assign(globalThis.LWR.index, {"lwr/profiler/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Fprofiler%2Fv%2F0_21_7/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js","lwr/loader/v/0_21_7":"/1/module/amd/1/l/en-US/mi/lwr%2Floader%2Fv%2F0_21_7/s/730dbe56c23f7b421f45c317e351be6f/lwr_loader.js"})

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/@lwrjs/app-service/amd-bootstrap/module/amd/v/{0_21_5 → 0_21_7}/s/3aba11034f11c8d5598c93bfca4d4690/@lwrjs_app-service_amd-bootstrap_module_amd.js

@@ -1,15 +1,15 @@
-LWR.define('@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_5', ['lwr/loader/v/0_21_5', 'lwr/preInit/v/0_21_5', 'lwr/init/v/0_21_5'], (function (_0_21_5$2, _0_21_5, _0_21_5$1) { 'use strict';
+LWR.define('@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7', ['lwr/loader/v/0_21_7', 'lwr/preInit/v/0_21_7', 'lwr/init/v/0_21_7'], (function (_0_21_7$2, _0_21_7, _0_21_7$1) { 'use strict';
 
-    const clientBootstrapConfig = _0_21_5.getClientBootstrapConfig();
+    const clientBootstrapConfig = _0_21_7.getClientBootstrapConfig();
     const { serverData, rootComponents } = clientBootstrapConfig;
 
     // initialize additional non-configured root components
     Promise.all(rootComponents.map(async (rootSpecifier) => {
-        const element = _0_21_5$1.toKebabCase(rootSpecifier);
-        const { default: Ctor } = await _0_21_5$2.load(rootSpecifier, '@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_5');
+        const element = _0_21_7$1.toKebabCase(rootSpecifier);
+        const { default: Ctor } = await _0_21_7$2.load(rootSpecifier, '@lwrjs/app-service/amd-bootstrap/module/amd/v/0_21_7');
         return [element, Ctor];
     })).then((rootModules) => {
-        return _0_21_5$1.init(rootModules, serverData);
+        return _0_21_7$1.init(rootModules, serverData);
     }).then(() => {
         globalThis?.lwcRuntimeFlags?.ENABLE_WIRE_SYNC_EMIT &&
             (globalThis.lwcRuntimeFlags = {

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/everywhereAmd/v/{0_21_5 → 0_21_7}/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js

@@ -1,10 +1,10 @@
-LWR.define('lwr/everywhereAmd/v/0_21_5', ['exports', 'lwr/vault/v/0_21_5'], (function (exports, _0_21_5) { 'use strict';
+LWR.define('lwr/everywhereAmd/v/0_21_7', ['exports', 'lwr/vault/v/0_21_7'], (function (exports, _0_21_7) { 'use strict';
 
   // IMPORTANT: Do not add any static imports to this file that are not bundled with the amd-client
 
   // Do an OAuthed fetch
   async function authFetch(url, accept = 'javascript') {
-    const authInfo = _0_21_5.getAuthInfo();
+    const authInfo = _0_21_7.getAuthInfo();
     if (authInfo) {
       return fetch(url, {
         headers: {
@@ -53,7 +53,7 @@ LWR.define('lwr/everywhereAmd/v/0_21_5', ['exports', 'lwr/vault/v/0_21_5'], (fun
   function authenticate(authInfo) {
     // Put OAuth info into the vault
     if (authInfo) {
-      _0_21_5.setAuthInfo(authInfo);
+      _0_21_7.setAuthInfo(authInfo);
     }
   }
 

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/init/v/{0_21_5 → 0_21_7}/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profiler/v/0_21_5', 'lwr/scheduler/v/0_21_5', 'lwc/v/8_20_1'], (function (exports, _0_21_5$1, _0_21_5, _0_21_5$2, _8_20_1) { 'use strict';
+LWR.define('lwr/init/v/0_21_7', ['exports', 'lwr/metrics/v/0_21_7', 'lwr/profiler/v/0_21_7', 'lwr/scheduler/v/0_21_7', 'lwc/v/8_20_1'], (function (exports, _0_21_7$1, _0_21_7, _0_21_7$2, _8_20_1) { 'use strict';
 
   // eslint-disable-next-line lwr/only-allowed-type-imports
 
@@ -123,13 +123,13 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
   function init(rootModules, serverData = {}) {
     // eslint-disable-next-line lwr/no-unguarded-apis
     if (typeof globalThis.customElements === 'undefined' || typeof globalThis.document === 'undefined') {
-      _0_21_5.logOperationStart({
-        id: _0_21_5$1.BOOTSTRAP_END
+      _0_21_7.logOperationStart({
+        id: _0_21_7$1.BOOTSTRAP_END
       });
       return;
     }
-    _0_21_5.logOperationStart({
-      id: _0_21_5$1.INIT
+    _0_21_7.logOperationStart({
+      id: _0_21_7$1.INIT
     });
     (async () => {
       let index = 0;
@@ -138,15 +138,15 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
       for (const [specifier, ctor] of rootModules) {
         // Yield to the main thread during long hydration tasks
         // eslint-disable-next-line no-await-in-loop
-        await _0_21_5$2.yieldIfNecessary();
+        await _0_21_7$2.yieldIfNecessary();
         const specifierIndex = ++index;
         const elementName = toKebabCase(specifier);
 
         // initialize and inject the root module into the LWR Root or DOM if it is missing
         // eslint-disable-next-line lwr/no-unguarded-apis
         if (!document.body.querySelector(elementName)) {
-          _0_21_5.logOperationStart({
-            id: _0_21_5$1.INIT_MODULE,
+          _0_21_7.logOperationStart({
+            id: _0_21_7$1.INIT_MODULE,
             specifier,
             specifierIndex
           });
@@ -157,8 +157,8 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
           const container = document.querySelector('[lwr-root]');
           // eslint-disable-next-line lwr/no-unguarded-apis
           container ? container.appendChild(component) : document.body.appendChild(component);
-          _0_21_5.logOperationEnd({
-            id: _0_21_5$1.INIT_MODULE,
+          _0_21_7.logOperationEnd({
+            id: _0_21_7$1.INIT_MODULE,
             specifier,
             specifierIndex,
             metadata: {
@@ -172,8 +172,8 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
         // eslint-disable-next-line lwr/no-unguarded-apis
         const elements = document.querySelectorAll(elementName);
         for (const element of elements) {
-          _0_21_5.logOperationStart({
-            id: _0_21_5$1.INIT_MODULE,
+          _0_21_7.logOperationStart({
+            id: _0_21_7$1.INIT_MODULE,
             specifier,
             specifierIndex
           });
@@ -189,8 +189,8 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
               // hydrate the island immediately
               hydrateComponentProxy(element, ctor, serverData[propsId] || {});
             }
-            _0_21_5.logOperationEnd({
-              id: _0_21_5$1.INIT_MODULE,
+            _0_21_7.logOperationEnd({
+              id: _0_21_7$1.INIT_MODULE,
               specifier,
               specifierIndex,
               metadata: {
@@ -228,8 +228,8 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
           if (parent) {
             parent.replaceChild(component, element);
           }
-          _0_21_5.logOperationEnd({
-            id: _0_21_5$1.INIT_MODULE,
+          _0_21_7.logOperationEnd({
+            id: _0_21_7$1.INIT_MODULE,
             specifier,
             specifierIndex,
             metadata: {
@@ -239,11 +239,11 @@ LWR.define('lwr/init/v/0_21_5', ['exports', 'lwr/metrics/v/0_21_5', 'lwr/profile
         }
       }
     })();
-    _0_21_5.logOperationEnd({
-      id: _0_21_5$1.INIT
+    _0_21_7.logOperationEnd({
+      id: _0_21_7$1.INIT
     });
-    _0_21_5.logOperationStart({
-      id: _0_21_5$1.BOOTSTRAP_END
+    _0_21_7.logOperationStart({
+      id: _0_21_7$1.BOOTSTRAP_END
     });
   }
 

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/loader/v/{0_21_5/s/57bf8d56d32c292a51a4beacf4ac3058 → 0_21_7/s/730dbe56c23f7b421f45c317e351be6f}/lwr_loader.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/loader/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
   /**
   * Copyright (c) 2021, salesforce.com, inc.
@@ -6,7 +6,7 @@ LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict
   * SPDX-License-Identifier: MIT
   * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
   */
-  /* LWR Module Loader v0.21.5 */
+  /* LWR Module Loader v0.21.7 */
   const templateRegex = /\{([0-9]+)\}/g;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function templateString(template, args) {
@@ -1465,6 +1465,58 @@ LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict
       }
     }
   }
+  function _nullishCoalesce(lhs, rhsFn) {
+    if (lhs != null) {
+      return lhs;
+    } else {
+      return rhsFn();
+    }
+  } /** Error info shape used for load specifier validation (code, message, level). */
+
+  /**
+   * Validates that the given module id is not one of the forbidden dynamic import specifiers.
+   * Throws LoaderError for: lwc, the LWR loader, transport, and blob URLs.
+   *
+   * @param id - Module identifier or URL
+   * @param importer - Versioned specifier of the module importer (for error reporting)
+   * @param loaderSpecifier - The loader module specifier to block (e.g. 'lwr/loader' or 'lwr/loaderLegacy')
+   * @param errors - Error class and message constants from the calling loader
+   */
+  function validateLoadSpecifier(id, importer, loaderSpecifier, errors) {
+    const {
+      LoaderError,
+      NO_IMPORT_LWC,
+      NO_IMPORT_LOADER,
+      NO_IMPORT_TRANSPORT,
+      NO_BLOB_IMPORT
+    } = errors;
+
+    // Throw an error if the specifier is "lwc" or a versioned lwc specifier
+    // Dynamic import of LWC APIs is not allowed
+    // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
+    // Reference: Hackforce reports HF-1023, HF-1021, HF-1026, HF-1027
+    if (id === 'lwc' || id.startsWith('lwc/v/')) {
+      throw new LoaderError(NO_IMPORT_LWC, [_nullishCoalesce(importer, () => 'unknown')]);
+    }
+
+    // Throw an error if the specifier is the LWR loader or versioned
+    // Nobody should be dynamically importing the LWR loader; it is an app-level API
+    if (id === loaderSpecifier || id.startsWith(`${loaderSpecifier}/v/`)) {
+      throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => 'unknown')]);
+    }
+
+    // Throw an error if the specifier is "transport" or versioned
+    // The transport module provides unsandboxed fetch, which can bypass Lightning Web Security
+    // Reference: Hackforce vulnerability report - LWS bypass through transport module
+    if (id === 'transport' || id.startsWith('transport/v/')) {
+      throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => 'unknown')]);
+    }
+
+    // Throw an error if the specifier is a blob URL (case-insensitive check)
+    if (id.toLowerCase().startsWith('blob:')) {
+      throw new LoaderError(NO_BLOB_IMPORT);
+    }
+  }
 
   /**
    * The LWR loader is inspired and borrows from the algorithms and native browser principles of https://github.com/systemjs/systemjs
@@ -1556,31 +1608,13 @@ LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict
      * @return {Promise<Module>}
      */
     async load(id, importer) {
-      // Throw an error if the specifier is "lwc" or a versioned lwc specifier and the importer is defined
-      // This indicates a variable dynamic import, which is not allowed for LWC APIs
-      // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
-      // Reference: Hackforce reports HF-1023, HF-1021, HF-1026, HF-1027
-      if ((id === 'lwc' || id.startsWith('lwc/v/')) && importer !== undefined) {
-        throw new LoaderError(NO_IMPORT_LWC, [importer]);
-      }
-
-      // Throw an error if the specifier is "lwr/loader" or versioned and the importer is defined
-      // Nobody should be dynamically importing the LWR loader; it is an app-level API
-      if ((id === 'lwr/loader' || id.startsWith('lwr/loader/v/')) && importer !== undefined) {
-        throw new LoaderError(NO_IMPORT_LOADER, [importer]);
-      }
-
-      // Throw an error if the specifier is "transport" or versioned and the importer is defined
-      // The transport module provides unsandboxed fetch, which can bypass Lightning Web Security
-      // Reference: Hackforce vulnerability report - LWS bypass through transport module
-      if ((id === 'transport' || id.startsWith('transport/v/')) && importer !== undefined) {
-        throw new LoaderError(NO_IMPORT_TRANSPORT, [importer]);
-      }
-
-      // Throw an error if the specifier is a blob URL (case-insensitive check)
-      if (id.toLowerCase().startsWith('blob:')) {
-        throw new LoaderError(NO_BLOB_IMPORT);
-      }
+      validateLoadSpecifier(id, importer, 'lwr/loader', {
+        LoaderError,
+        NO_IMPORT_LWC,
+        NO_IMPORT_LOADER,
+        NO_IMPORT_TRANSPORT,
+        NO_BLOB_IMPORT
+      });
       return this.registry.load(id, importer);
     }
 

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/metrics/v/{0_21_5 → 0_21_7}/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/metrics/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/metrics/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
 	// Bootstrap / shim
 	const BOOTSTRAP_PREFIX = 'lwr.bootstrap.';

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/preInit/v/{0_21_5 → 0_21_7}/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/preInit/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/preInit/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
   /**
    * This module is called in the ABS module (app bootstrap module) to perform neccesary pre initialization steps for an LWR app.

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/profiler/v/{0_21_5 → 0_21_7}/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/profiler/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/profiler/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
   var Phase = /*#__PURE__*/function (Phase) {
     Phase[Phase["Start"] = 0] = "Start";

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/scheduler/v/{0_21_5 → 0_21_7}/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/scheduler/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/scheduler/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
   /**
    * Result of checking whether to yield to the main thread

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/vault/v/{0_21_5 → 0_21_7}/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/vault/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/vault/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
   // Credential vault for storing setters and subscribers for OAuth info
   // This module is a SINGLETON and must be excluded from ESM bundling

package/build/__generated_site_amd_modules__/1/resource/amd/lwr-error-shim.js/v/{0_21_5 → 0_21_7}/lwr-error-shim.js

@@ -4,5 +4,5 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Error Shim v0.21.5 */
+/* LWR Error Shim v0.21.7 */
 !function(){"use strict";const o=globalThis;if(!(o.LWR&&o.LWR.define)){const r=new Error("The LWR application failed to bootstrap");if(!o.LWR||!o.LWR.onError)throw r;o.LWR.onError(r)}}();

package/build/__generated_site_amd_modules__/1/resource/amd/lwr-loader-shim.bundle.js/v/{0_21_5 → 0_21_7}/lwr-loader-shim.bundle.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader Shim v0.21.5 */
+/* LWR Module Loader Shim v0.21.7 */
 (function () {
   'use strict';
 
@@ -214,7 +214,7 @@
           // Parse configuration
           this.global = global;
           this.config = global.LWR ;
-          this.loaderSpecifier = 'lwr/loader/v/0_21_5';
+          this.loaderSpecifier = 'lwr/loader/v/0_21_7';
 
           // Set up error handler
           this.errorHandler = this.config.onError ;
@@ -377,7 +377,7 @@
           const exporter = (exports) => {
               Object.assign(exports, { logOperationStart, logOperationEnd });
           };
-          define('lwr/profiler/v/0_21_5', ['exports'], exporter);
+          define('lwr/profiler/v/0_21_7', ['exports'], exporter);
       }
 
       // Set up the application globals, import map, root custom element...
@@ -477,14 +477,14 @@
   // The loader module is ALWAYS required
   const GLOBAL = globalThis ;
   GLOBAL.LWR.requiredModules = GLOBAL.LWR.requiredModules || [];
-  if (GLOBAL.LWR.requiredModules.indexOf('lwr/loader/v/0_21_5') < 0) {
-      GLOBAL.LWR.requiredModules.push('lwr/loader/v/0_21_5');
+  if (GLOBAL.LWR.requiredModules.indexOf('lwr/loader/v/0_21_7') < 0) {
+      GLOBAL.LWR.requiredModules.push('lwr/loader/v/0_21_7');
   }
   new LoaderShim(GLOBAL);
 
 })();
 
-LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/loader/v/0_21_7', ['exports'], (function (exports) { 'use strict';
 
     const templateRegex = /\{([0-9]+)\}/g;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -2075,6 +2075,65 @@ LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict
         }
     }
 
+    function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } }/** Error info shape used for load specifier validation (code, message, level). */
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+    /**
+     * Validates that the given module id is not one of the forbidden dynamic import specifiers.
+     * Throws LoaderError for: lwc, the LWR loader, transport, and blob URLs.
+     *
+     * @param id - Module identifier or URL
+     * @param importer - Versioned specifier of the module importer (for error reporting)
+     * @param loaderSpecifier - The loader module specifier to block (e.g. 'lwr/loader' or 'lwr/loaderLegacy')
+     * @param errors - Error class and message constants from the calling loader
+     */
+    function validateLoadSpecifier(
+        id,
+        importer,
+        loaderSpecifier,
+        errors,
+    ) {
+        const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
+
+        // Throw an error if the specifier is "lwc" or a versioned lwc specifier
+        // Dynamic import of LWC APIs is not allowed
+        // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
+        // Reference: Hackforce reports HF-1023, HF-1021, HF-1026, HF-1027
+        if (id === 'lwc' || id.startsWith('lwc/v/')) {
+            throw new LoaderError(NO_IMPORT_LWC, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+        }
+
+        // Throw an error if the specifier is the LWR loader or versioned
+        // Nobody should be dynamically importing the LWR loader; it is an app-level API
+        if (id === loaderSpecifier || id.startsWith(`${loaderSpecifier}/v/`)) {
+            throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+        }
+
+        // Throw an error if the specifier is "transport" or versioned
+        // The transport module provides unsandboxed fetch, which can bypass Lightning Web Security
+        // Reference: Hackforce vulnerability report - LWS bypass through transport module
+        if (id === 'transport' || id.startsWith('transport/v/')) {
+            throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+        }
+
+        // Throw an error if the specifier is a blob URL (case-insensitive check)
+        if (id.toLowerCase().startsWith('blob:')) {
+            throw new LoaderError(NO_BLOB_IMPORT);
+        }
+    }
+
     /**
      * The LWR loader is inspired and borrows from the algorithms and native browser principles of https://github.com/systemjs/systemjs
      */
@@ -2176,32 +2235,13 @@ LWR.define('lwr/loader/v/0_21_5', ['exports'], (function (exports) { 'use strict
          * @return {Promise<Module>}
          */
         async load(id, importer) {
-            // Throw an error if the specifier is "lwc" or a versioned lwc specifier and the importer is defined
-            // This indicates a variable dynamic import, which is not allowed for LWC APIs
-            // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
-            // Reference: Hackforce reports HF-1023, HF-1021, HF-1026, HF-1027
-            if ((id === 'lwc' || id.startsWith('lwc/v/')) && importer !== undefined) {
-                throw new LoaderError(NO_IMPORT_LWC, [importer]);
-            }
-
-            // Throw an error if the specifier is "lwr/loader" or versioned and the importer is defined
-            // Nobody should be dynamically importing the LWR loader; it is an app-level API
-            if ((id === 'lwr/loader' || id.startsWith('lwr/loader/v/')) && importer !== undefined) {
-                throw new LoaderError(NO_IMPORT_LOADER, [importer]);
-            }
-
-            // Throw an error if the specifier is "transport" or versioned and the importer is defined
-            // The transport module provides unsandboxed fetch, which can bypass Lightning Web Security
-            // Reference: Hackforce vulnerability report - LWS bypass through transport module
-            if ((id === 'transport' || id.startsWith('transport/v/')) && importer !== undefined) {
-                throw new LoaderError(NO_IMPORT_TRANSPORT, [importer]);
-            }
-
-            // Throw an error if the specifier is a blob URL (case-insensitive check)
-            if (id.toLowerCase().startsWith('blob:')) {
-                throw new LoaderError(NO_BLOB_IMPORT);
-            }
-
+            validateLoadSpecifier(id, importer, 'lwr/loader', {
+                LoaderError,
+                NO_IMPORT_LWC,
+                NO_IMPORT_LOADER,
+                NO_IMPORT_TRANSPORT,
+                NO_BLOB_IMPORT,
+            });
             return this.registry.load(id, importer);
         }