@lwrjs/everywhere 0.22.9 → 0.22.10

package/build/__generated_site_amd_modules__/1/application/amd/l/en-US/ai/amd-bootstrap/configuration/ci/-/-/s/721912722105286076ed8c5d82681c16/config.js

@@ -0,0 +1,12 @@
+/* This script is generated */
+/* Client Bootstrap configuration */
+globalThis.LWR = globalThis.LWR || {};
+Object.assign(globalThis.LWR, {"appId":"amd-bootstrap","bootstrapModule":"@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10","autoBoot":true,"imports":{"/1/module/amd/1/l/en-US/mi/%40lwrjs%2Fapp-service%2Famd-bootstrap%2Fmodule%2Famd%2Fv%2F0_22_10/s/d4022ae1b3a47f5bb62c600fd6b8f139/@lwrjs_app-service_amd-bootstrap_module_amd.js":["@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2FpreInit%2Fv%2F0_22_10/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js":["lwr/preInit/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2Finit%2Fv%2F0_22_10/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js":["lwr/init/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2Fmetrics%2Fv%2F0_22_10/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js":["lwr/metrics/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2Fscheduler%2Fv%2F0_22_10/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js":["lwr/scheduler/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwc%2Fv%2F8_22_6/s/21cb42e66f1f2b4362fe6203653b692f/lwc.js":["lwc/v/8_22_6"],"/1/module/amd/1/l/en-US/mi/lwr%2FeverywhereAmd%2Fv%2F0_22_10/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js":["lwr/everywhereAmd/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2Fvault%2Fv%2F0_22_10/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js":["lwr/vault/v/0_22_10"]},"index":{"@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10":"/1/module/amd/1/l/en-US/mi/%40lwrjs%2Fapp-service%2Famd-bootstrap%2Fmodule%2Famd%2Fv%2F0_22_10/s/d4022ae1b3a47f5bb62c600fd6b8f139/@lwrjs_app-service_amd-bootstrap_module_amd.js","lwr/preInit/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2FpreInit%2Fv%2F0_22_10/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js","lwr/init/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Finit%2Fv%2F0_22_10/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js","lwr/metrics/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Fmetrics%2Fv%2F0_22_10/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js","lwr/scheduler/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Fscheduler%2Fv%2F0_22_10/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js","lwc/v/8_22_6":"/1/module/amd/1/l/en-US/mi/lwc%2Fv%2F8_22_6/s/21cb42e66f1f2b4362fe6203653b692f/lwc.js","lwr/everywhereAmd/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2FeverywhereAmd%2Fv%2F0_22_10/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js","lwr/vault/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Fvault%2Fv%2F0_22_10/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js"},"rootComponents":["lwr/everywhereAmd/v/0_22_10"],"serverData":{},"requiredModules":["@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10"],"preloadModules":["lwr/preInit/v/0_22_10","lwr/init/v/0_22_10","lwr/metrics/v/0_22_10","lwr/scheduler/v/0_22_10","lwc/v/8_22_6","lwr/everywhereAmd/v/0_22_10"],"endpoints":{"uris":{"mapping":"/1/mapping/amd/1/l/en-US/mp/"}}});
+globalThis.LWR = {...globalThis.LWR, env: {"SSR":false,"SSREnabled":false,"basePath":"","locale":"en-US","assetBasePath":"","uiBasePath":""}};
+globalThis.process={...globalThis.process,env:{...globalThis.process?.env,...{"NODE_ENV":"compat"}}};
+globalThis.lwcRuntimeFlags = { ENABLE_MIXED_SHADOW_MODE: false, ENABLE_WIRE_SYNC_EMIT: false };
+// Appended by Static Site Generator
+if (!globalThis.LWR.imports) { globalThis.LWR.imports = {}; }
+Object.assign(globalThis.LWR.imports, {"/1/module/amd/1/l/en-US/mi/lwr%2Fprofiler%2Fv%2F0_22_10/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js":["lwr/profiler/v/0_22_10"],"/1/module/amd/1/l/en-US/mi/lwr%2Floader%2Fv%2F0_22_10/s/12ccd89f3da2e8c2e1a0a994c4d1a2b8/lwr_loader.js":["lwr/loader/v/0_22_10"]})
+if (!globalThis.LWR.index) { globalThis.LWR.index = {}; }
+Object.assign(globalThis.LWR.index, {"lwr/profiler/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Fprofiler%2Fv%2F0_22_10/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js","lwr/loader/v/0_22_10":"/1/module/amd/1/l/en-US/mi/lwr%2Floader%2Fv%2F0_22_10/s/12ccd89f3da2e8c2e1a0a994c4d1a2b8/lwr_loader.js"})

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/@lwrjs/app-service/amd-bootstrap/module/amd/v/{0_22_9 → 0_22_10}/s/d4022ae1b3a47f5bb62c600fd6b8f139/@lwrjs_app-service_amd-bootstrap_module_amd.js

@@ -1,15 +1,15 @@
-LWR.define('@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_9', ['lwr/loader/v/0_22_9', 'lwr/preInit/v/0_22_9', 'lwr/init/v/0_22_9'], (function (_0_22_9$2, _0_22_9, _0_22_9$1) { 'use strict';
+LWR.define('@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10', ['lwr/loader/v/0_22_10', 'lwr/preInit/v/0_22_10', 'lwr/init/v/0_22_10'], (function (_0_22_10$2, _0_22_10, _0_22_10$1) { 'use strict';
 
-    const clientBootstrapConfig = _0_22_9.getClientBootstrapConfig();
+    const clientBootstrapConfig = _0_22_10.getClientBootstrapConfig();
     const { serverData, rootComponents } = clientBootstrapConfig;
 
     // initialize additional non-configured root components
     Promise.all(rootComponents.map(async (rootSpecifier) => {
-        const element = _0_22_9$1.toKebabCase(rootSpecifier);
-        const { default: Ctor } = await _0_22_9$2.load(rootSpecifier, '@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_9');
+        const element = _0_22_10$1.toKebabCase(rootSpecifier);
+        const { default: Ctor } = await _0_22_10$2.load(rootSpecifier, '@lwrjs/app-service/amd-bootstrap/module/amd/v/0_22_10');
         return [element, Ctor];
     })).then((rootModules) => {
-        return _0_22_9$1.init(rootModules, serverData);
+        return _0_22_10$1.init(rootModules, serverData);
     }).then(() => {
         // Defer clearing so SSR'd components read ENABLE_WIRE_SYNC_EMIT: true in connectedCallback (timing varies by env)
         const clearSyncEmit = () => {

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/everywhereAmd/v/{0_22_9 → 0_22_10}/s/cb931ebef2b89dcf8ab51456e3a68864/lwr_everywhereAmd.js

@@ -1,10 +1,10 @@
-LWR.define('lwr/everywhereAmd/v/0_22_9', ['exports', 'lwr/vault/v/0_22_9'], (function (exports, _0_22_9) { 'use strict';
+LWR.define('lwr/everywhereAmd/v/0_22_10', ['exports', 'lwr/vault/v/0_22_10'], (function (exports, _0_22_10) { 'use strict';
 
   // IMPORTANT: Do not add any static imports to this file that are not bundled with the amd-client
 
   // Do an OAuthed fetch
   async function authFetch(url, accept = 'javascript') {
-    const authInfo = _0_22_9.getAuthInfo();
+    const authInfo = _0_22_10.getAuthInfo();
     if (authInfo) {
       return fetch(url, {
         headers: {
@@ -53,7 +53,7 @@ LWR.define('lwr/everywhereAmd/v/0_22_9', ['exports', 'lwr/vault/v/0_22_9'], (fun
   function authenticate(authInfo) {
     // Put OAuth info into the vault
     if (authInfo) {
-      _0_22_9.setAuthInfo(authInfo);
+      _0_22_10.setAuthInfo(authInfo);
     }
   }
 

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/init/v/{0_22_9 → 0_22_10}/s/c5c8bdc0e87baf3d6b68b0603d670664/lwr_init.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profiler/v/0_22_9', 'lwr/scheduler/v/0_22_9', 'lwc/v/8_22_6'], (function (exports, _0_22_9$1, _0_22_9, _0_22_9$2, _8_22_6) { 'use strict';
+LWR.define('lwr/init/v/0_22_10', ['exports', 'lwr/metrics/v/0_22_10', 'lwr/profiler/v/0_22_10', 'lwr/scheduler/v/0_22_10', 'lwc/v/8_22_6'], (function (exports, _0_22_10$1, _0_22_10, _0_22_10$2, _8_22_6) { 'use strict';
 
   // eslint-disable-next-line lwr/only-allowed-type-imports
 
@@ -123,13 +123,13 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
   function init(rootModules, serverData = {}) {
     // eslint-disable-next-line lwr/no-unguarded-apis
     if (typeof globalThis.customElements === 'undefined' || typeof globalThis.document === 'undefined') {
-      _0_22_9.logOperationStart({
-        id: _0_22_9$1.BOOTSTRAP_END
+      _0_22_10.logOperationStart({
+        id: _0_22_10$1.BOOTSTRAP_END
       });
       return;
     }
-    _0_22_9.logOperationStart({
-      id: _0_22_9$1.INIT
+    _0_22_10.logOperationStart({
+      id: _0_22_10$1.INIT
     });
     (async () => {
       let index = 0;
@@ -138,15 +138,15 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
       for (const [specifier, ctor] of rootModules) {
         // Yield to the main thread during long hydration tasks
         // eslint-disable-next-line no-await-in-loop
-        await _0_22_9$2.yieldIfNecessary();
+        await _0_22_10$2.yieldIfNecessary();
         const specifierIndex = ++index;
         const elementName = toKebabCase(specifier);
 
         // initialize and inject the root module into the LWR Root or DOM if it is missing
         // eslint-disable-next-line lwr/no-unguarded-apis
         if (!document.body.querySelector(elementName)) {
-          _0_22_9.logOperationStart({
-            id: _0_22_9$1.INIT_MODULE,
+          _0_22_10.logOperationStart({
+            id: _0_22_10$1.INIT_MODULE,
             specifier,
             specifierIndex
           });
@@ -157,8 +157,8 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
           const container = document.querySelector('[lwr-root]');
           // eslint-disable-next-line lwr/no-unguarded-apis
           container ? container.appendChild(component) : document.body.appendChild(component);
-          _0_22_9.logOperationEnd({
-            id: _0_22_9$1.INIT_MODULE,
+          _0_22_10.logOperationEnd({
+            id: _0_22_10$1.INIT_MODULE,
             specifier,
             specifierIndex,
             metadata: {
@@ -172,8 +172,8 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
         // eslint-disable-next-line lwr/no-unguarded-apis
         const elements = document.querySelectorAll(elementName);
         for (const element of elements) {
-          _0_22_9.logOperationStart({
-            id: _0_22_9$1.INIT_MODULE,
+          _0_22_10.logOperationStart({
+            id: _0_22_10$1.INIT_MODULE,
             specifier,
             specifierIndex
           });
@@ -189,8 +189,8 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
               // hydrate the island immediately
               hydrateComponentProxy(element, ctor, serverData[propsId] || {});
             }
-            _0_22_9.logOperationEnd({
-              id: _0_22_9$1.INIT_MODULE,
+            _0_22_10.logOperationEnd({
+              id: _0_22_10$1.INIT_MODULE,
               specifier,
               specifierIndex,
               metadata: {
@@ -228,8 +228,8 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
           if (parent) {
             parent.replaceChild(component, element);
           }
-          _0_22_9.logOperationEnd({
-            id: _0_22_9$1.INIT_MODULE,
+          _0_22_10.logOperationEnd({
+            id: _0_22_10$1.INIT_MODULE,
             specifier,
             specifierIndex,
             metadata: {
@@ -239,11 +239,11 @@ LWR.define('lwr/init/v/0_22_9', ['exports', 'lwr/metrics/v/0_22_9', 'lwr/profile
         }
       }
     })();
-    _0_22_9.logOperationEnd({
-      id: _0_22_9$1.INIT
+    _0_22_10.logOperationEnd({
+      id: _0_22_10$1.INIT
     });
-    _0_22_9.logOperationStart({
-      id: _0_22_9$1.BOOTSTRAP_END
+    _0_22_10.logOperationStart({
+      id: _0_22_10$1.BOOTSTRAP_END
     });
   }
 

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/loader/v/{0_22_9/s/cf9b5a56165c94b547a9cf5c35ae474f → 0_22_10/s/12ccd89f3da2e8c2e1a0a994c4d1a2b8}/lwr_loader.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/loader/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
   /**
   * Copyright (c) 2021, salesforce.com, inc.
@@ -6,7 +6,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
   * SPDX-License-Identifier: MIT
   * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
   */
-  /* LWR Module Loader v0.22.9 */
+  /* LWR Module Loader v0.22.10 */
   const templateRegex = /\{([0-9]+)\}/g;
   // eslint-disable-next-line @typescript-eslint/no-explicit-any
   function templateString(template, args) {
@@ -152,7 +152,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
     level: 0,
     message: 'Cannot import a blob URL'
   });
-  Object.freeze({
+  const NO_IMPORT_TRANSPORT = Object.freeze({
     code: 3025,
     level: 0,
     message: 'Cannot dynamically import "transport" with importer "{0}"'
@@ -1475,7 +1475,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
 
   /**
    * Validates that the given module id is not one of the forbidden dynamic import specifiers.
-   * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+   * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
    *
    * @param id - Module identifier or URL
    * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -1487,6 +1487,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
       LoaderError,
       NO_IMPORT_LWC,
       NO_IMPORT_LOADER,
+      NO_IMPORT_TRANSPORT,
       NO_BLOB_IMPORT
     } = errors;
 
@@ -1504,6 +1505,13 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
       throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => 'unknown')]);
     }
 
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (id === 'transport' || id.startsWith('transport/v/') || id === 'webruntime/transport' || id.startsWith('webruntime/transport/v/')) {
+      throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => 'unknown')]);
+    }
+
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
       throw new LoaderError(NO_BLOB_IMPORT);
@@ -1604,6 +1612,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
         LoaderError,
         NO_IMPORT_LWC,
         NO_IMPORT_LOADER,
+        NO_IMPORT_TRANSPORT,
         NO_BLOB_IMPORT
       });
       return this.registry.load(id, importer);

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/metrics/v/{0_22_9 → 0_22_10}/s/fb8c5dd340c69fdf7ded52d3eba633b9/lwr_metrics.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/metrics/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/metrics/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
 	// Bootstrap / shim
 	const BOOTSTRAP_PREFIX = 'lwr.bootstrap.';

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/preInit/v/{0_22_9 → 0_22_10}/s/7d064ec3a80dbbccaa4845ea5eaef125/lwr_preInit.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/preInit/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/preInit/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
   /**
    * This module is called in the ABS module (app bootstrap module) to perform neccesary pre initialization steps for an LWR app.

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/profiler/v/{0_22_9 → 0_22_10}/s/9f74c8370534ce02c6e7637abdcffedf/lwr_profiler.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/profiler/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/profiler/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
   var Phase = /*#__PURE__*/function (Phase) {
     Phase[Phase["Start"] = 0] = "Start";

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/scheduler/v/{0_22_9 → 0_22_10}/s/fd3fe53248b540ca046ead92862ca496/lwr_scheduler.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/scheduler/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/scheduler/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
   /**
    * Result of checking whether to yield to the main thread

package/build/__generated_site_amd_modules__/1/module/amd/1/l/en-US/mi/lwr/vault/v/{0_22_9 → 0_22_10}/s/c92abd8c1fec2d7eff62e4b097abbe14/lwr_vault.js

@@ -1,4 +1,4 @@
-LWR.define('lwr/vault/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/vault/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
   // Credential vault for storing setters and subscribers for OAuth info
   // This module is a SINGLETON and must be excluded from ESM bundling

package/build/__generated_site_amd_modules__/1/resource/amd/lwr-error-shim.js/v/{0_22_9 → 0_22_10}/lwr-error-shim.js

@@ -4,5 +4,5 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Error Shim v0.22.9 */
+/* LWR Error Shim v0.22.10 */
 !function(){"use strict";const o=globalThis;if(!(o.LWR&&o.LWR.define)){const r=new Error("The LWR application failed to bootstrap");if(!o.LWR||!o.LWR.onError)throw r;o.LWR.onError(r)}}();

package/build/__generated_site_amd_modules__/1/resource/amd/lwr-loader-shim.bundle.js/v/{0_22_9 → 0_22_10}/lwr-loader-shim.bundle.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader Shim v0.22.9 */
+/* LWR Module Loader Shim v0.22.10 */
 (function () {
   'use strict';
 
@@ -105,19 +105,114 @@
     }
   }
 
+  /**
+   * Parse AMD define args. Supports define(id, deps, factory).
+   */
+  function parseDefine(def) {
+      const [, depsOrFactory, factory] = def;
+      if (Array.isArray(depsOrFactory) && typeof factory === 'function') {
+          return { deps: depsOrFactory, factory };
+      }
+      if (typeof depsOrFactory === 'function') {
+          return { deps: [], factory: depsOrFactory };
+      }
+      throw new Error('Invalid module definition');
+  }
+
+  /**
+   * Resolve a loader dependency: 'exports' returns the bag; otherwise look up in cache and instantiate.
+   * Loader deps are assumed to be leaf modules (no deps of their own)—no recursive resolution.
+   */
+  function resolveDep(dep, exportsObj, cache) {
+      if (dep === 'exports') return exportsObj;
+      const mod = cache[dep];
+      if (!mod) {
+          throw new Error(`Dependency "${dep}" not found in defineCache for loader`);
+      }
+      try {
+          return instantiateLeafModule(mod);
+      } catch (e) {
+          const msg = e instanceof Error ? e.message : String(e);
+          throw new Error(`Loader dependency "${dep}" has invalid definition: ${msg}`);
+      }
+  }
+
+  /**
+   * Instantiate a leaf module (loader dep). Assumes the module has no dependencies of its own.
+   * Supports only deps: [] or ['exports']; any other dep list throws.
+   */
+  function instantiateLeafModule(def) {
+      const { deps, factory } = parseDefine(def);
+      if (deps.length > 1 || (deps.length === 1 && deps[0] !== 'exports')) {
+          throw new Error(
+              `Loader dependencies must have no deps or only ['exports']; got [${deps.join(', ')}]`,
+          );
+      }
+      const exports = {};
+      const out = factory(exports);
+      return out !== undefined ? out : exports;
+  }
+
+  /**
+   * Normalize loader definition to canonical (exports, ...deps). Injects 'exports' if missing.
+   */
+  function normalizeLoaderDefinition(def) {
+      const { deps, factory } = parseDefine(def);
+      if (deps.includes('exports')) {
+          return { deps, factory };
+      }
+      const isEmptyDeps = deps.length === 0;
+      const normalizedFactory = (exports, ...rest) => {
+          const result = isEmptyDeps ? factory(exports) : factory(...rest);
+          if (result !== undefined && typeof result === 'object') {
+              Object.assign(exports, result);
+          }
+      };
+      return { deps: ['exports', ...deps], factory: normalizedFactory };
+  }
+
+  /**
+   * Resolve the loader's dependencies from defineCache. Throws if definition is invalid or deps cannot be resolved.
+   */
+  function resolveLoaderDepsFromDefineCache(
+      loaderSpecifier,
+      definition,
+      defineCache,
+  ) {
+      try {
+          const { deps, factory } = normalizeLoaderDefinition(definition);
+          const exportsObj = {};
+          const args = deps.map((dep) => resolveDep(dep, exportsObj, defineCache)) ;
+          return { factory: factory , args, exportsObj };
+      } catch (e) {
+          const msg = e instanceof Error ? e.message : String(e);
+          throw new Error(`Expected loader with specifier "${loaderSpecifier}" to be a module. ${msg}`);
+      }
+  }
+
+  /**
+   * Create a loader from a definition. Original API preserved.
+   * Optional defineCache for resolving loader deps (when loader has dependencies).
+   */
   function createLoader(
       name,
       definition,
       config,
       externalModules,
+      defineCache,
   ) {
       if (!definition || typeof definition[2] !== 'function') {
           throw new Error(`Expected loader with specifier "${name}" to be a module`);
       }
 
-      // Create a Loader instance
       const exports = {};
-      definition[2].call(null, exports);
+      if (defineCache) {
+          const { factory, args, exportsObj } = resolveLoaderDepsFromDefineCache(name, definition, defineCache);
+          factory(...args);
+          Object.assign(exports, exportsObj);
+      } else {
+          definition[2].call(null, exports);
+      }
       const { Loader } = exports;
       if (!Loader) {
           throw new Error('Expected Loader class to be defined');
@@ -214,7 +309,7 @@
           // Parse configuration
           this.global = global;
           this.config = global.LWR ;
-          this.loaderSpecifier = 'lwr/loader/v/0_22_9';
+          this.loaderSpecifier = 'lwr/loader/v/0_22_10';
 
           // Set up error handler
           this.errorHandler = this.config.onError ;
@@ -322,6 +417,7 @@
                   this.defineCache[this.loaderSpecifier],
                   loaderConfig,
                   this.config.preloadModules,
+                  this.defineCache,
               );
               this.mountApp(loader);
               if (
@@ -345,6 +441,7 @@
               if (document.body) {
                   resolve();
               } else {
+                  /* istanbul ignore next */
                   const observer = new MutationObserver(() => {
                       // eslint-disable-next-line lwr/no-unguarded-apis
                       if (document.body) {
@@ -377,7 +474,7 @@
           const exporter = (exports) => {
               Object.assign(exports, { logOperationStart, logOperationEnd });
           };
-          define('lwr/profiler/v/0_22_9', ['exports'], exporter);
+          define('lwr/profiler/v/0_22_10', ['exports'], exporter);
       }
 
       // Set up the application globals, import map, root custom element...
@@ -417,7 +514,7 @@
               ])
               .then(() => {
                   // eslint-disable-next-line lwr/no-unguarded-apis
-                  if (typeof window === 'undefined' || typeof document === undefined) {
+                  if (typeof window === 'undefined' || typeof document === 'undefined') {
                       return Promise.resolve();
                   }
                   if (initDeferDOM) {
@@ -477,14 +574,14 @@
   // The loader module is ALWAYS required
   const GLOBAL = globalThis ;
   GLOBAL.LWR.requiredModules = GLOBAL.LWR.requiredModules || [];
-  if (GLOBAL.LWR.requiredModules.indexOf('lwr/loader/v/0_22_9') < 0) {
-      GLOBAL.LWR.requiredModules.push('lwr/loader/v/0_22_9');
+  if (GLOBAL.LWR.requiredModules.indexOf('lwr/loader/v/0_22_10') < 0) {
+      GLOBAL.LWR.requiredModules.push('lwr/loader/v/0_22_10');
   }
   new LoaderShim(GLOBAL);
 
 })();
 
-LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict';
+LWR.define('lwr/loader/v/0_22_10', ['exports'], (function (exports) { 'use strict';
 
     const templateRegex = /\{([0-9]+)\}/g;
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -639,7 +736,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
         level: 0,
         message: 'Cannot import a blob URL',
     });
-    Object.freeze({
+    const NO_IMPORT_TRANSPORT = Object.freeze({
         code: 3025,
         level: 0,
         message: 'Cannot dynamically import "transport" with importer "{0}"',
@@ -2089,9 +2186,10 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
 
 
 
+
     /**
      * Validates that the given module id is not one of the forbidden dynamic import specifiers.
-     * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+     * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
      *
      * @param id - Module identifier or URL
      * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -2104,7 +2202,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
         loaderSpecifier,
         errors,
     ) {
-        const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+        const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
 
         // Throw an error if the specifier is "lwc" or a versioned lwc specifier
         // Dynamic import of LWC APIs is not allowed
@@ -2120,6 +2218,18 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
             throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
         }
 
+        // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+        // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+        // Reference: Hackforce report HF-3393
+        if (
+            id === 'transport' ||
+            id.startsWith('transport/v/') ||
+            id === 'webruntime/transport' ||
+            id.startsWith('webruntime/transport/v/')
+        ) {
+            throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+        }
+
         // Throw an error if the specifier is a blob URL (case-insensitive check)
         if (id.toLowerCase().startsWith('blob:')) {
             throw new LoaderError(NO_BLOB_IMPORT);
@@ -2231,6 +2341,7 @@ LWR.define('lwr/loader/v/0_22_9', ['exports'], (function (exports) { 'use strict
                 LoaderError,
                 NO_IMPORT_LWC,
                 NO_IMPORT_LOADER,
+                NO_IMPORT_TRANSPORT,
                 NO_BLOB_IMPORT,
             });
             return this.registry.load(id, importer);

package/build/assets/amd/lwr-everywhere-debug.js

@@ -20,7 +20,7 @@ function getConfiguration(options) {
         : `${ORIGIN}${PREFIX}/module/${format}/${POSTFIX}/mi/`;
 
     // Component specifiers and URIs
-    const BOOT_MODULE = `lwr/everywhere${format === 'esm' ? 'Esm' : 'Amd'}/v/0_22_9`;
+    const BOOT_MODULE = `lwr/everywhere${format === 'esm' ? 'Esm' : 'Amd'}/v/0_22_10`;
     const BOOT_URI = `${ENDPOINT}${encodeURIComponent(BOOT_MODULE)}/latest${debug ? '?debug' : ''}`;
 
     // Client Bootstrap Config
@@ -52,7 +52,7 @@ function getConfiguration(options) {
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader v0.22.9 */
+/* LWR Module Loader v0.22.10 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {
@@ -206,7 +206,7 @@ const NO_BLOB_IMPORT = Object.freeze({
     level: 0,
     message: 'Cannot import a blob URL',
 });
-Object.freeze({
+const NO_IMPORT_TRANSPORT = Object.freeze({
     code: 3025,
     level: 0,
     message: 'Cannot dynamically import "transport" with importer "{0}"',
@@ -1657,9 +1657,10 @@ function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else {
 
 
 
+
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -1672,7 +1673,7 @@ function validateLoadSpecifier(
     loaderSpecifier,
     errors,
 ) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
 
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
@@ -1688,6 +1689,18 @@ function validateLoadSpecifier(
         throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
     }
 
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (
+        id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')
+    ) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+    }
+
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);
@@ -1799,6 +1812,7 @@ class Loader {
             LoaderError,
             NO_IMPORT_LWC,
             NO_IMPORT_LOADER,
+            NO_IMPORT_TRANSPORT,
             NO_BLOB_IMPORT,
         });
         return this.registry.load(id, importer);
@@ -1855,7 +1869,7 @@ const { bootstrapModule, endpoints, baseUrl, imports, index } = configuration;
 
 // Initialize the AMD loader (its code is bundled into the LWR Everywhere module)
 const loader = new Loader({ endpoints, baseUrl });
-loader.define('lwr/loader/v/0_22_9', ['exports'], (exports) => {
+loader.define('lwr/loader/v/0_22_10', ['exports'], (exports) => {
     Object.assign(exports, {
         define: loader.define.bind(loader),
         load: loader.load.bind(loader),
@@ -1865,12 +1879,12 @@ await loader.registerImportMappings({ imports, index }, [bootstrapModule]);
 (globalThis ).LWR = Object.freeze({ define: loader.define.bind(loader) });
 
 // Define preload modules (ie: ABS, vault, etc) BEFORE loading them
-LWR.define('lwr/everywhereAmd/v/0_22_9', ['exports', 'lwr/vault/v/0_22_9'], (function (exports, _0_22_9) {
+LWR.define('lwr/everywhereAmd/v/0_22_10', ['exports', 'lwr/vault/v/0_22_10'], (function (exports, _0_22_10) {
   // IMPORTANT: Do not add any static imports to this file that are not bundled with the amd-client
 
   // Do an OAuthed fetch
   async function authFetch(url, accept = 'javascript') {
-    const authInfo = _0_22_9.getAuthInfo();
+    const authInfo = _0_22_10.getAuthInfo();
     if (authInfo) {
       return fetch(url, {
         headers: {
@@ -1919,7 +1933,7 @@ LWR.define('lwr/everywhereAmd/v/0_22_9', ['exports', 'lwr/vault/v/0_22_9'], (fun
   function authenticate(authInfo) {
     // Put OAuth info into the vault
     if (authInfo) {
-      _0_22_9.setAuthInfo(authInfo);
+      _0_22_10.setAuthInfo(authInfo);
     }
   }
 
@@ -1929,7 +1943,7 @@ LWR.define('lwr/everywhereAmd/v/0_22_9', ['exports', 'lwr/vault/v/0_22_9'], (fun
   Object.defineProperty(exports, '__esModule', { value: true });
 
 }));
-LWR.define('lwr/vault/v/0_22_9', ['exports'], (function (exports) {
+LWR.define('lwr/vault/v/0_22_10', ['exports'], (function (exports) {
   // Credential vault for storing setters and subscribers for OAuth info
   // This module is a SINGLETON and must be excluded from ESM bundling
 
@@ -1953,7 +1967,7 @@ LWR.define('lwr/vault/v/0_22_9', ['exports'], (function (exports) {
 
 // Set up the AMD loader hooks for OAuth
 const { initAmd, authenticate } = await loader.load(bootstrapModule);
-initAmd(loader.services, _optionalChain([endpoints, 'optionalAccess', _ => _.uris, 'access', _2 => _2.mapping]), '0_22_9');
+initAmd(loader.services, _optionalChain([endpoints, 'optionalAccess', _ => _.uris, 'access', _2 => _2.mapping]), '0_22_10');
 
 // Wrap the createComponent API to allow proper ordering of module definitions:
 //  1. LWRE module bundle (this): lwr/loader, lwr/everywhereAmd, lwr/vault