@lwrjs/loader 0.22.11 → 0.22.13

package/build/modules/lwr/loader/moduleRegistry/importMetadataResolver.js

@@ -44,11 +44,7 @@ export class ImportMetadataResolver {
     getBaseUrl() {
         return this.config.baseUrl || '';
     }
-    registerImportMappings(newImportMetadata, rootSpecifiers) {
-        if (!rootSpecifiers || rootSpecifiers.length === 0) {
-            const imports = newImportMetadata ? JSON.stringify(newImportMetadata) : 'undefined';
-            throw new LoaderError(BAD_IMPORT_METADATA, [imports, rootSpecifiers ? '[]' : 'undefined']);
-        }
+    registerImportMappings(newImportMetadata, rootSpecifiers = []) {
         if (!newImportMetadata) {
             throw new LoaderError(BAD_IMPORT_METADATA, ['undefined', JSON.stringify(rootSpecifiers)]);
         }
@@ -58,6 +54,8 @@ export class ImportMetadataResolver {
                 JSON.stringify(rootSpecifiers),
             ]);
         }
+        // An empty rootSpecifiers list is valid for non-bootstrap registrations;
+        // any specifier not in the list receives isRoot: false.
         const index = newImportMetadata.index || {};
         for (const [uri, specifiers] of Object.entries(newImportMetadata.imports)) {
             specifiers.forEach((specifier) => {
@@ -80,6 +78,15 @@ export class ImportMetadataResolver {
             });
         }
     }
+    /**
+     * Returns the raw URI stored for a specifier, or `undefined` if not yet mapped.
+     * Used by the runtime `importMap()` path to detect cross-call duplicates while
+     * allowing truly idempotent re-registrations (same specifier, same URI) to pass
+     * through silently.
+     */
+    getMappingUri(specifier) {
+        return this.importURICache.get(specifier)?.uri;
+    }
     // Get URL from the local cache or return undefiend
     getURI(specifier) {
         return this.importURICache && this.importURICache.has(specifier)

package/build/modules/lwr/loader/utils/validation.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Validation for LWR.importMap() on the fingerprints loader (URL → specifiers `ImportMetadata`).
+ *
+ * Aligned with `ImportMap` / `ImportMetadata` from @lwrjs/types.
+ */
+import type { ImportMapUpdate, ImportMetadata } from '@lwrjs/types';
+/**
+ * Validates an ImportMapUpdate and wraps it as ImportMetadata for the fingerprints loader.
+ *
+ * Does not apply legacy-style protected-specifier blocking; system modules are expected to be
+ * defined at bootstrap, and `importMap` write-once semantics handle redundant runtime entries.
+ *
+ * Duplicate specifiers in the same update are de-duplicated silently (first occurrence wins).
+ * An empty object is a silent no-op (returns null).
+ */
+export declare function validateAndWrapAsImportMetadata(update: ImportMapUpdate): ImportMetadata | null;
+//# sourceMappingURL=validation.d.ts.map

package/build/modules/lwr/loader/utils/validation.js

@@ -0,0 +1,68 @@
+/**
+ * Validation for LWR.importMap() on the fingerprints loader (URL → specifiers `ImportMetadata`).
+ *
+ * Aligned with `ImportMap` / `ImportMetadata` from @lwrjs/types.
+ */
+/**
+ * Ensures the update object key is a safe, loader-supported script URL (not a bare specifier).
+ * Covers dangerous schemes and URL-key shape in one place.
+ */
+function assertValidImportMapUrlKey(moduleScriptURL) {
+    const lowerUri = moduleScriptURL.toLowerCase();
+    if (lowerUri.startsWith('blob:')) {
+        throw new Error(`Cannot map ${moduleScriptURL} to blob: URL`);
+    }
+    if (lowerUri.startsWith('data:')) {
+        throw new Error(`Cannot map ${moduleScriptURL} to data: URL`);
+    }
+    if (!/^[./]|^https?:/.test(moduleScriptURL)) {
+        throw new Error(`LWR.importMap(): "${moduleScriptURL}" is not a valid URL key. Keys must be URL paths (e.g. "/path/to/module.js"), not module specifiers. Transitive specifier aliasing is not supported by this loader.`);
+    }
+}
+/**
+ * Validates an ImportMapUpdate and wraps it as ImportMetadata for the fingerprints loader.
+ *
+ * Does not apply legacy-style protected-specifier blocking; system modules are expected to be
+ * defined at bootstrap, and `importMap` write-once semantics handle redundant runtime entries.
+ *
+ * Duplicate specifiers in the same update are de-duplicated silently (first occurrence wins).
+ * An empty object is a silent no-op (returns null).
+ */
+export function validateAndWrapAsImportMetadata(update) {
+    if (!update || typeof update !== 'object') {
+        throw new Error('LWR.importMap() requires an object argument');
+    }
+    const entries = Object.entries(update);
+    if (entries.length === 0) {
+        return null;
+    }
+    const seenSpecifiers = new Set();
+    const validatedImports = {};
+    for (const [moduleScriptURL, moduleNames] of entries) {
+        if (!moduleScriptURL || typeof moduleScriptURL !== 'string') {
+            throw new Error('moduleScriptURL must be a string');
+        }
+        if (!Array.isArray(moduleNames)) {
+            throw new Error('moduleNames must be an array');
+        }
+        assertValidImportMapUrlKey(moduleScriptURL);
+        const validatedNames = [];
+        for (const moduleName of moduleNames) {
+            if (typeof moduleName !== 'string' || moduleName.length === 0) {
+                throw new Error('Specifier must be a non-empty string');
+            }
+            if (!seenSpecifiers.has(moduleName)) {
+                seenSpecifiers.add(moduleName);
+                validatedNames.push(moduleName);
+            }
+        }
+        if (validatedNames.length > 0) {
+            validatedImports[moduleScriptURL] = validatedNames;
+        }
+    }
+    if (Object.keys(validatedImports).length === 0) {
+        return null;
+    }
+    return { imports: validatedImports };
+}
+//# sourceMappingURL=validation.js.map

package/build/modules/lwr/loaderLegacy/loaderLegacy.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Legacy Module Loader v0.22.11 */
+/* LWR Legacy Module Loader v0.22.13 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {

package/build/shim/shim.js

@@ -25,7 +25,7 @@ export default class LoaderShim {
         this.errorHandler = this.config.onError;
         // Set up onAppInit handler
         this.initAppHandler = this.config.onInitApp;
-        // Set up the temporary LWR.define function and customInit hook
+        // Set up the temporary LWR.define function
         const tempDefine = this.tempDefine.bind(this);
         global.LWR.define = tempDefine;
         this.bootReady = this.config.autoBoot;
@@ -171,9 +171,12 @@ export default class LoaderShim {
     mountApp(loader) {
         const { bootstrapModule, rootComponent, rootComponents, serverData, endpoints, imports, index } = this.config;
         const importsObj = imports || {};
-        // Set global LWR.define to loader.define
+        // Set global LWR.define to loader.define and expose the public-only importMap.
+        // The wrapper intentionally omits the internal rootSpecifiers parameter so external
+        // callers cannot bypass runtime validation by triggering the bootstrap path.
         this.global.LWR = Object.freeze({
             define: loader.define.bind(loader),
+            importMap: (update) => loader.importMap(update),
             rootComponent,
             rootComponents,
             serverData: serverData || {},
@@ -193,10 +196,7 @@ export default class LoaderShim {
         const { initDeferDOM } = this.config;
         // Load the import mappings and application bootstrap module
         loader
-            .registerImportMappings({ imports: importsObj, index }, [
-            bootstrapModule,
-            rootComponent,
-        ])
+            .importMap({ imports: importsObj, index }, [bootstrapModule, rootComponent])
             .then(() => {
             // eslint-disable-next-line lwr/no-unguarded-apis
             if (typeof window === 'undefined' || typeof document === 'undefined') {

package/build/types.d.ts

@@ -1,5 +1,4 @@
-import type { ImportMetadata, AppMetadata, ServerData, ClientBootstrapConfig } from '@lwrjs/types';
-import type { ImportMap } from './modules/lwr/loaderLegacy/importMap/importMap.js';
+import type { ImportMap, ImportMapUpdate, ImportMetadata, AppMetadata, ServerData, ClientBootstrapConfig } from '@lwrjs/types';
 import type { ProfilerAPI, LogDispatcher } from 'lwr/profiler';
 export type GlobalThis = {
     LWR: Partial<ClientBootstrapConfig> & {
@@ -31,7 +30,7 @@ export interface ResolvedLoader {
 export type LoaderClass = {
     new (config?: LoaderConfig): LoaderAPI;
 };
-export type ImportMapUpdate = Record<string, string[]>;
+export type { ImportMapUpdate };
 export type LwrImportMapUpdateMethod = (update: ImportMapUpdate) => void;
 export interface BaseLoaderAPI {
     define: LoaderDefine;
@@ -72,6 +71,8 @@ export type Endpoints = {
  * Fingerprints loader extensions
  */
 export interface FingerprintsLoaderAPI extends BaseLoaderAPI {
+    importMap(update: ImportMapUpdate | ImportMetadata, rootSpecifiers?: string[]): Promise<void>;
+    /** @deprecated Use `importMap(metadata, rootSpecifiers)` instead. */
     registerImportMappings(importMetadata: ImportMetadata, rootSpecifiers: string[]): Promise<void>;
 }
 export interface FingerprintsLoaderConfig extends LoaderConfig {

package/package.json

@@ -5,7 +5,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.22.11",
+    "version": "0.22.13",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -61,16 +61,16 @@
     },
     "devDependencies": {
         "@locker/trusted-types": "0.26.4",
-        "@lwrjs/diagnostics": "0.22.11",
-        "@lwrjs/types": "0.22.11",
+        "@lwrjs/diagnostics": "0.22.13",
+        "@lwrjs/types": "0.22.13",
         "@rollup/plugin-node-resolve": "^15.2.3",
         "@rollup/plugin-sucrase": "^5.0.2",
         "@rollup/plugin-terser": "^0.4.4",
         "rollup": "^2.80.0"
     },
     "dependencies": {
-        "@lwrjs/client-modules": "0.22.11",
-        "@lwrjs/shared-utils": "0.22.11"
+        "@lwrjs/client-modules": "0.22.13",
+        "@lwrjs/shared-utils": "0.22.13"
     },
     "lwc": {
         "modules": [
@@ -90,5 +90,5 @@
     "volta": {
         "extends": "../../../package.json"
     },
-    "gitHead": "85710371aa359747e08a064d4b4a2b3dfed1d30a"
+    "gitHead": "0696ace9a947340156151fba686a029fbc7466bf"
 }