@lwrjs/loader 0.22.10 → 0.22.12

package/build/cjs/modules/lwr/loaderLegacy/importMap/importMap.cjs

@@ -86,7 +86,7 @@ function resolveAndComposePackages(packages, outPackages, baseUrl, parentMap, pa
     if (!mapped) {
       (0, import_utils.targetWarning)(p, rhs, "bare specifier did not resolve");
     } else {
-      outPackages[resolvedLhs] = mapped.uri;
+      (0, import_utils.mergeImportMapEntry)(resolvedLhs, mapped.uri, outPackages);
     }
   }
 }

package/build/cjs/modules/lwr/loaderLegacy/importMap/importMapResolver.cjs

@@ -27,6 +27,7 @@ __export(exports, {
   ImportMapResolver: () => ImportMapResolver
 });
 var import_importMap = __toModule(require("./importMap.cjs"));
+var import_utils = __toModule(require("./utils.cjs"));
 var ImportMapResolver = class {
   constructor(importMap) {
     this.importMap = importMap;
@@ -34,4 +35,15 @@ var ImportMapResolver = class {
   resolve(resolvedOrPlain, parentUrl) {
     return (0, import_importMap.resolveImportMapEntry)(this.importMap, resolvedOrPlain, parentUrl);
   }
+  addImportMapEntries(importMap) {
+    if (importMap.imports) {
+      const current = this.importMap;
+      if (!current.imports) {
+        current.imports = {};
+      }
+      for (const specifier in importMap.imports) {
+        (0, import_utils.mergeImportMapEntry)(specifier, importMap.imports[specifier], current.imports);
+      }
+    }
+  }
 };

package/build/cjs/modules/lwr/loaderLegacy/importMap/utils.cjs

@@ -25,6 +25,7 @@ var __toModule = (module2) => {
 __markAsModule(exports);
 __export(exports, {
   getMatch: () => getMatch,
+  mergeImportMapEntry: () => mergeImportMapEntry,
   targetWarning: () => targetWarning
 });
 var import_dom = __toModule(require("../utils/dom.cjs"));
@@ -38,10 +39,21 @@ function getMatch(path, matchObj) {
     if (segment in matchObj) {
       return segment;
     }
-  } while (path.length > 1 && (sepIndex = path.lastIndexOf("/", sepIndex - 1)) !== -1);
+    sepIndex = path.lastIndexOf("/", sepIndex - 1);
+  } while (sepIndex > 0);
 }
 function targetWarning(match, target, msg) {
   if (import_dom.hasConsole) {
     console.warn("Package target " + msg + ", resolving target '" + target + "' for " + match);
   }
 }
+function mergeImportMapEntry(specifier, uri, target) {
+  const existing = target[specifier];
+  if (existing !== void 0) {
+    if (existing !== uri) {
+      targetWarning(specifier, uri, `already mapped to "${existing}", ignoring conflicting mapping`);
+    }
+  } else {
+    target[specifier] = uri;
+  }
+}

package/build/cjs/modules/lwr/loaderLegacy/utils/validation.cjs

@@ -0,0 +1,93 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __markAsModule = (target) => __defProp(target, "__esModule", {value: true});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {get: all[name], enumerable: true});
+};
+var __exportStar = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, {get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable});
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __exportStar(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? {get: () => module2.default, enumerable: true} : {value: module2, enumerable: true})), module2);
+};
+
+// packages/@lwrjs/loader/src/modules/lwr/loaderLegacy/utils/validation.ts
+__markAsModule(exports);
+__export(exports, {
+  isProtectedSpecifier: () => isProtectedSpecifier,
+  validateAndConvertImportMapUpdate: () => validateAndConvertImportMapUpdate,
+  validateMappingUri: () => validateMappingUri,
+  validateSpecifier: () => validateSpecifier
+});
+var import_dom = __toModule(require("../utils/dom.cjs"));
+var PROTECTED_PATTERNS = [
+  /^lwc$/i,
+  /^lwc\/v\//i,
+  /^@lwc\//i,
+  /^lightningmobileruntime\//i
+];
+function isProtectedSpecifier(specifier) {
+  return PROTECTED_PATTERNS.some((pattern) => pattern.test(specifier));
+}
+function validateMappingUri(uri, specifier) {
+  const lowerUri = uri.toLowerCase();
+  if (lowerUri.startsWith("blob:")) {
+    throw new Error(`Cannot map ${specifier} to blob: URL`);
+  }
+  if (lowerUri.startsWith("data:")) {
+    throw new Error(`Cannot map ${specifier} to data: URL`);
+  }
+}
+function validateSpecifier(specifier) {
+  if (typeof specifier !== "string" || specifier.length === 0) {
+    throw new Error("Specifier must be a non-empty string");
+  }
+  if (isProtectedSpecifier(specifier)) {
+    throw new Error(`Cannot remap protected module: ${specifier}`);
+  }
+}
+function validateAndConvertImportMapUpdate(update) {
+  if (!update || typeof update !== "object") {
+    throw new Error("LWR.importMap() requires an object argument");
+  }
+  const entries = Object.entries(update);
+  if (entries.length === 0) {
+    if (import_dom.hasConsole) {
+      console.warn("LWR.importMap() called with empty update object");
+    }
+    return null;
+  }
+  const convertedImports = {};
+  for (const [moduleScriptURL, moduleNames] of entries) {
+    if (!Array.isArray(moduleNames)) {
+      throw new Error("moduleNames must be an array");
+    }
+    if (!moduleScriptURL || typeof moduleScriptURL !== "string") {
+      throw new Error("moduleScriptURL must be a string");
+    }
+    validateMappingUri(moduleScriptURL, moduleScriptURL);
+    for (const moduleName of moduleNames) {
+      validateSpecifier(moduleName);
+      if (moduleName in convertedImports) {
+        if (import_dom.hasConsole) {
+          console.warn(`LWR.importMap(): duplicate module "${moduleName}" \u2014 already mapped to "${convertedImports[moduleName]}", ignoring mapping to "${moduleScriptURL}"`);
+        }
+      } else {
+        convertedImports[moduleName] = moduleScriptURL;
+      }
+    }
+  }
+  return {
+    imports: convertedImports
+  };
+}

package/build/modules/lwr/esmLoader/esmLoader.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR ESM Module Loader v0.22.10 */
+/* LWR ESM Module Loader v0.22.12 */
 function _optionalChain$1(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 

package/build/modules/lwr/loader/loader.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader v0.22.10 */
+/* LWR Module Loader v0.22.12 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {

package/build/modules/lwr/loaderLegacy/importMap/importMap.js

@@ -4,7 +4,7 @@
  * This implementation is adapted from https://github.com/systemjs/systemjs/blob/master/src/features/import-map.js
  */
 import { resolveUrl, resolveIfNotPlainOrUrl, isUrl } from '../utils/url.js';
-import { getMatch, targetWarning } from './utils.js';
+import { getMatch, targetWarning, mergeImportMapEntry } from './utils.js';
 // Resolves an import map package entry
 function applyPackages(id, packages, defaultUri) {
     const pkgName = getMatch(id, packages);
@@ -79,7 +79,8 @@ function resolveAndComposePackages(packages, outPackages, baseUrl, parentMap, pa
             targetWarning(p, rhs, 'bare specifier did not resolve');
         }
         else {
-            outPackages[resolvedLhs] = mapped.uri;
+            // Merge into cache with write-once protection
+            mergeImportMapEntry(resolvedLhs, mapped.uri, outPackages);
         }
     }
 }

package/build/modules/lwr/loaderLegacy/importMap/importMapResolver.d.ts

@@ -4,5 +4,6 @@ export declare class ImportMapResolver implements ImportResolver {
     importMap: ImportMap;
     constructor(importMap: ImportMap);
     resolve(resolvedOrPlain: string, parentUrl: string): ImportDefinition | undefined;
+    addImportMapEntries(importMap: ImportMap): void;
 }
 //# sourceMappingURL=importMapResolver.d.ts.map

package/build/modules/lwr/loaderLegacy/importMap/importMapResolver.js

@@ -1,4 +1,5 @@
 import { resolveImportMapEntry } from './importMap.js';
+import { mergeImportMapEntry } from './utils.js';
 /* spec based import map resolver */
 export class ImportMapResolver {
     constructor(importMap) {
@@ -7,5 +8,17 @@ export class ImportMapResolver {
     resolve(resolvedOrPlain, parentUrl) {
         return resolveImportMapEntry(this.importMap, resolvedOrPlain, parentUrl);
     }
+    addImportMapEntries(importMap) {
+        if (importMap.imports) {
+            const current = this.importMap;
+            if (!current.imports) {
+                current.imports = {};
+            }
+            // Merge into cache with write-once protection
+            for (const specifier in importMap.imports) {
+                mergeImportMapEntry(specifier, importMap.imports[specifier], current.imports);
+            }
+        }
+    }
 }
 //# sourceMappingURL=importMapResolver.js.map

package/build/modules/lwr/loaderLegacy/importMap/utils.d.ts

@@ -1,4 +1,15 @@
 declare function getMatch(path: string, matchObj: Record<string, unknown>): string | undefined;
 declare function targetWarning(match: string, target: string, msg: string): void;
-export { getMatch, targetWarning };
+/**
+ * Import map entries are write-once: once a specifier is mapped, it cannot be overridden.
+ * This ensures deterministic module resolution and prevents runtime mutation of previously
+ * resolved dependencies. Conflicting mappings are ignored with a warning.
+ *
+ * Merges a single import map entry into a target imports object.
+ * - If the specifier doesn't exist, it is added.
+ * - If it exists with the same value, it is silently skipped.
+ * - If it exists with a different value, a warning is logged and the entry is skipped.
+ */
+declare function mergeImportMapEntry(specifier: string, uri: string, target: Record<string, string>): void;
+export { getMatch, targetWarning, mergeImportMapEntry };
 //# sourceMappingURL=utils.d.ts.map

package/build/modules/lwr/loaderLegacy/importMap/utils.js

@@ -11,7 +11,8 @@ function getMatch(path, matchObj) {
         if (segment in matchObj) {
             return segment;
         }
-    } while (path.length > 1 && (sepIndex = path.lastIndexOf('/', sepIndex - 1)) !== -1);
+        sepIndex = path.lastIndexOf('/', sepIndex - 1);
+    } while (sepIndex > 0);
 }
 function targetWarning(match, target, msg) {
     if (hasConsole) {
@@ -19,5 +20,26 @@ function targetWarning(match, target, msg) {
         console.warn('Package target ' + msg + ", resolving target '" + target + "' for " + match);
     }
 }
-export { getMatch, targetWarning };
+/**
+ * Import map entries are write-once: once a specifier is mapped, it cannot be overridden.
+ * This ensures deterministic module resolution and prevents runtime mutation of previously
+ * resolved dependencies. Conflicting mappings are ignored with a warning.
+ *
+ * Merges a single import map entry into a target imports object.
+ * - If the specifier doesn't exist, it is added.
+ * - If it exists with the same value, it is silently skipped.
+ * - If it exists with a different value, a warning is logged and the entry is skipped.
+ */
+function mergeImportMapEntry(specifier, uri, target) {
+    const existing = target[specifier];
+    if (existing !== undefined) {
+        if (existing !== uri) {
+            targetWarning(specifier, uri, `already mapped to "${existing}", ignoring conflicting mapping`);
+        }
+    }
+    else {
+        target[specifier] = uri;
+    }
+}
+export { getMatch, targetWarning, mergeImportMapEntry };
 //# sourceMappingURL=utils.js.map

package/build/modules/lwr/loaderLegacy/loaderLegacy.d.ts

@@ -1,13 +1,14 @@
 import { Module, ModuleDefinitionSignatures } from './moduleRegistry/moduleRegistry.js';
 import { ImportMap } from './importMap/importMap.js';
 import type { ServiceAPI } from '@lwrjs/types';
-import type { LoaderConfig } from '../../../types.js';
+import type { LoaderConfig, ImportMapUpdate } from '../../../types.js';
 /**
  * The LWR loader is inspired and borrows from the algorithms and native browser principles of https://github.com/systemjs/systemjs
  */
 export declare class Loader {
     private registry;
     private baseUrl;
+    private importMapResolver?;
     readonly services: Readonly<Pick<ServiceAPI, 'addLoaderPlugin' | 'handleStaleModule' | 'appMetadata'>>;
     constructor(config?: LoaderConfig);
     /**
@@ -54,6 +55,15 @@ export declare class Loader {
      * @param modules - list of module identifiers
      */
     registerExternalModules(modules: string[]): void;
+    /**
+     * Apply import map updates at runtime.
+     * Enables adding new import mappings dynamically.
+     *
+     * @param updates - Import Map Update object containing:
+    -   [moduleScriptURL] - Script URL containing LWR define statements
+    -   string[] - array of module names which are included in the given script
+     */
+    importMap(update: ImportMapUpdate): void;
     getModuleWarnings(isAppMounted?: boolean): Record<string, string[]>;
 }
 //# sourceMappingURL=loaderLegacy.d.ts.map

package/build/modules/lwr/loaderLegacy/loaderLegacy.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Legacy Module Loader v0.22.10 */
+/* LWR Legacy Module Loader v0.22.12 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {
@@ -1461,7 +1461,8 @@ function getMatch(path, matchObj) {
         if (segment in matchObj) {
             return segment;
         }
-    } while (path.length > 1 && (sepIndex = path.lastIndexOf('/', sepIndex - 1)) !== -1);
+        sepIndex = path.lastIndexOf('/', sepIndex - 1);
+    } while (sepIndex > 0);
 }
 function targetWarning(match, target, msg) {
     if (hasConsole) {
@@ -1470,6 +1471,27 @@ function targetWarning(match, target, msg) {
     }
 }
 
+/**
+ * Import map entries are write-once: once a specifier is mapped, it cannot be overridden.
+ * This ensures deterministic module resolution and prevents runtime mutation of previously
+ * resolved dependencies. Conflicting mappings are ignored with a warning.
+ *
+ * Merges a single import map entry into a target imports object.
+ * - If the specifier doesn't exist, it is added.
+ * - If it exists with the same value, it is silently skipped.
+ * - If it exists with a different value, a warning is logged and the entry is skipped.
+ */
+function mergeImportMapEntry(specifier, uri, target) {
+    const existing = target[specifier];
+    if (existing !== undefined) {
+        if (existing !== uri) {
+            targetWarning(specifier, uri, `already mapped to "${existing}", ignoring conflicting mapping`);
+        }
+    } else {
+        target[specifier] = uri;
+    }
+}
+
 /**
  * Import map support for LWR based on the spec: https://github.com/WICG/import-maps
  *
@@ -1591,7 +1613,8 @@ function resolveAndComposePackages(
         if (!mapped) {
             targetWarning(p, rhs, 'bare specifier did not resolve');
         } else {
-            outPackages[resolvedLhs] = mapped.uri;
+            // Merge into cache with write-once protection
+            mergeImportMapEntry(resolvedLhs, mapped.uri, outPackages);
         }
     }
 }
@@ -1642,6 +1665,20 @@ class ImportMapResolver  {
     resolve(resolvedOrPlain, parentUrl) {
         return resolveImportMapEntry(this.importMap, resolvedOrPlain, parentUrl);
     }
+
+    addImportMapEntries(importMap) {
+        if (importMap.imports) {
+            const current = this.importMap;
+            if (!current.imports) {
+                current.imports = {};
+            }
+
+            // Merge into cache with write-once protection
+            for (const specifier in importMap.imports) {
+                mergeImportMapEntry(specifier, importMap.imports[specifier], current.imports);
+            }
+        }
+    }
 }
 
 /**
@@ -1713,15 +1750,134 @@ async function evaluateImportMaps(baseUrl) {
     return importMapPromise;
 }
 
-function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+/**
+ * List of protected module patterns that cannot be remapped.
+ * Uses case-insensitive matching to prevent bypass attempts (e.g., HF-1027).
+ */
+const PROTECTED_PATTERNS = [
+    /^lwc$/i, // Core LWC
+    /^lwc\/v\//i, // Versioned LWC variants
+    /^@lwc\//i, // LWC scoped packages
+    /^lightningmobileruntime\//i, // Lightning mobile runtime
+];
 
+/**
+ * Checks if a specifier matches any protected module pattern.
+ *
+ * @param specifier - The module specifier to check
+ * @returns true if the specifier is protected, false otherwise
+ */
+function isProtectedSpecifier(specifier) {
+    return PROTECTED_PATTERNS.some((pattern) => pattern.test(specifier));
+}
 
+/**
+ * Validates that a URI does not use dangerous URL schemes.
+ *
+ * Blocks:
+ * - blob: URLs (HF-1027 bypass prevention) - case-insensitive
+ * - data: URLs (inline code injection) - case-insensitive
+ *
+ * @param uri - The URI to validate
+ * @param specifier - The specifier being mapped (for error messages)
+ * @throws Error if the URI uses a dangerous scheme
+ */
+function validateMappingUri(uri, specifier) {
+    const lowerUri = uri.toLowerCase();
+
+    if (lowerUri.startsWith('blob:')) {
+        throw new Error(`Cannot map ${specifier} to blob: URL`);
+    }
+
+    if (lowerUri.startsWith('data:')) {
+        throw new Error(`Cannot map ${specifier} to data: URL`);
+    }
+}
+
+/**
+ * Validates that a specifier is well-formed and not protected.
+ *
+ * @param specifier - The module specifier to validate
+ * @throws Error if the specifier is invalid or protected
+ */
+function validateSpecifier(specifier) {
+    if (typeof specifier !== 'string' || specifier.length === 0) {
+        throw new Error('Specifier must be a non-empty string');
+    }
+
+    if (isProtectedSpecifier(specifier)) {
+        throw new Error(`Cannot remap protected module: ${specifier}`);
+    }
+}
+
+/**
+ * Validates and converts an ImportMapUpdate to ImportMap format.
+ *
+ * Performs validation checks and then converts from:
+ *   { moduleScriptURL: [moduleName1, moduleName2] }
+ * To:
+ *   { imports: { moduleName1: moduleScriptURL, moduleName2: moduleScriptURL } }
+ *
+ * @param update - The ImportMapUpdate object to validate and convert
+ * @returns The converted ImportMap, or null if the update is empty
+ * @throws Error if any validation fails
+ */
+function validateAndConvertImportMapUpdate(update) {
+    if (!update || typeof update !== 'object') {
+        throw new Error('LWR.importMap() requires an object argument');
+    }
+
+    // Check if update is empty
+    const entries = Object.entries(update);
+    if (entries.length === 0) {
+        if (hasConsole) {
+            // eslint-disable-next-line lwr/no-unguarded-apis
+            console.warn('LWR.importMap() called with empty update object');
+        }
+        return null;
+    }
+
+    const convertedImports = {};
+
+    for (const [moduleScriptURL, moduleNames] of entries) {
+        if (!Array.isArray(moduleNames)) {
+            throw new Error('moduleNames must be an array');
+        }
+
+        if (!moduleScriptURL || typeof moduleScriptURL !== 'string') {
+            throw new Error('moduleScriptURL must be a string');
+        }
+
+        validateMappingUri(moduleScriptURL, moduleScriptURL);
+
+        for (const moduleName of moduleNames) {
+            validateSpecifier(moduleName);
+            if (moduleName in convertedImports) {
+                if (hasConsole) {
+                    // eslint-disable-next-line lwr/no-unguarded-apis
+                    console.warn(
+                        `LWR.importMap(): duplicate module "${moduleName}" — already mapped to "${convertedImports[moduleName]}", ignoring mapping to "${moduleScriptURL}"`,
+                    );
+                }
+            } else {
+                convertedImports[moduleName] = moduleScriptURL;
+            }
+        }
+    }
+
+    return {
+        imports: convertedImports,
+    };
+}
+
+function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 /**
  * The LWR loader is inspired and borrows from the algorithms and native browser principles of https://github.com/systemjs/systemjs
  */
 class Loader {
     
     
+    
 
     
     constructor(config) {
@@ -1850,10 +2006,13 @@ class Loader {
             // import maps spec if we do this after resolving any imports
             importMap = resolveAndComposeImportMap(mappings, this.baseUrl, this.parentImportMap);
         }
-        this.parentImportMap = importMap;
-        if (this.parentImportMap) {
-            const importMapResolver = new ImportMapResolver(this.parentImportMap);
-            this.registry.setImportResolver(importMapResolver);
+        if (importMap) {
+            if (this.importMapResolver || this.parentImportMap) {
+                throw new LoaderError(BAD_IMPORT_MAP);
+            }
+            this.importMapResolver = new ImportMapResolver(importMap);
+            this.registry.setImportResolver(this.importMapResolver);
+            this.parentImportMap = this.importMapResolver.importMap;
         }
     }
 
@@ -1866,6 +2025,35 @@ class Loader {
         this.registry.registerExternalModules(modules);
     }
 
+    /**
+     * Apply import map updates at runtime.
+     * Enables adding new import mappings dynamically.
+     *
+     * @param updates - Import Map Update object containing:
+    -   [moduleScriptURL] - Script URL containing LWR define statements
+    -   string[] - array of module names which are included in the given script
+     */
+    importMap(update) {
+        // Validate and convert the import map update to the ImportMap format (moduleName -> moduleScriptURL)
+        const importMap = validateAndConvertImportMapUpdate(update);
+
+        // Early return if update was empty
+        if (!importMap) {
+            return;
+        }
+
+        if (!this.parentImportMap || !this.importMapResolver) {
+            throw new LoaderError(BAD_IMPORT_MAP);
+        }
+
+        // Merge the new mappings with the base import map - note this goes against
+        // import maps spec if we do this after resolving any imports
+        const resolvedImportMap = resolveAndComposeImportMap(importMap, this.baseUrl, this.parentImportMap);
+
+        this.importMapResolver.addImportMapEntries(resolvedImportMap);
+        this.parentImportMap = this.importMapResolver.importMap;
+    }
+
     getModuleWarnings(isAppMounted = false) {
         return this.registry.getModuleWarnings(isAppMounted);
     }

package/build/modules/lwr/loaderLegacy/utils/validation.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Validation logic for LWR.importMap() API
+ *
+ * This module provides validation functions to ensure that import map updates:
+ * 1. Do not remap protected system modules (lwc, lwr/*, etc.)
+ * 2. Do not use dangerous URL schemes (blob:, data:)
+ * 3. Have well-formed specifiers and URIs
+ */
+import type { ImportMapUpdate } from '../../../../types.js';
+import type { ImportMap } from '../importMap/importMap.js';
+/**
+ * Checks if a specifier matches any protected module pattern.
+ *
+ * @param specifier - The module specifier to check
+ * @returns true if the specifier is protected, false otherwise
+ */
+export declare function isProtectedSpecifier(specifier: string): boolean;
+/**
+ * Validates that a URI does not use dangerous URL schemes.
+ *
+ * Blocks:
+ * - blob: URLs (HF-1027 bypass prevention) - case-insensitive
+ * - data: URLs (inline code injection) - case-insensitive
+ *
+ * @param uri - The URI to validate
+ * @param specifier - The specifier being mapped (for error messages)
+ * @throws Error if the URI uses a dangerous scheme
+ */
+export declare function validateMappingUri(uri: string, specifier: string): void;
+/**
+ * Validates that a specifier is well-formed and not protected.
+ *
+ * @param specifier - The module specifier to validate
+ * @throws Error if the specifier is invalid or protected
+ */
+export declare function validateSpecifier(specifier: string): void;
+/**
+ * Validates and converts an ImportMapUpdate to ImportMap format.
+ *
+ * Performs validation checks and then converts from:
+ *   { moduleScriptURL: [moduleName1, moduleName2] }
+ * To:
+ *   { imports: { moduleName1: moduleScriptURL, moduleName2: moduleScriptURL } }
+ *
+ * @param update - The ImportMapUpdate object to validate and convert
+ * @returns The converted ImportMap, or null if the update is empty
+ * @throws Error if any validation fails
+ */
+export declare function validateAndConvertImportMapUpdate(update: ImportMapUpdate): ImportMap | null;
+//# sourceMappingURL=validation.d.ts.map