@lwrjs/loader 0.22.8 → 0.22.10

package/build/modules/lwr/loader/loader.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader v0.22.8 */
+/* LWR Module Loader v0.22.10 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {
@@ -158,7 +158,7 @@ const NO_BLOB_IMPORT = Object.freeze({
     level: 0,
     message: 'Cannot import a blob URL',
 });
-Object.freeze({
+const NO_IMPORT_TRANSPORT = Object.freeze({
     code: 3025,
     level: 0,
     message: 'Cannot dynamically import "transport" with importer "{0}"',
@@ -1609,9 +1609,10 @@ function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else {
 
 
 
+
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -1624,7 +1625,7 @@ function validateLoadSpecifier(
     loaderSpecifier,
     errors,
 ) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
 
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
@@ -1640,6 +1641,18 @@ function validateLoadSpecifier(
         throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
     }
 
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (
+        id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')
+    ) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+    }
+
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);
@@ -1751,6 +1764,7 @@ class Loader {
             LoaderError,
             NO_IMPORT_LWC,
             NO_IMPORT_LOADER,
+            NO_IMPORT_TRANSPORT,
             NO_BLOB_IMPORT,
         });
         return this.registry.load(id, importer);

package/build/modules/lwr/loader/validateLoadSpecifier.d.ts

@@ -8,11 +8,12 @@ export interface ValidateLoadSpecifierErrors {
     LoaderError: new (errorInfo: LoadSpecifierErrorInfo, errorArgs?: string[]) => Error;
     NO_IMPORT_LWC: LoadSpecifierErrorInfo;
     NO_IMPORT_LOADER: LoadSpecifierErrorInfo;
+    NO_IMPORT_TRANSPORT: LoadSpecifierErrorInfo;
     NO_BLOB_IMPORT: LoadSpecifierErrorInfo;
 }
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)

package/build/modules/lwr/loader/validateLoadSpecifier.js

@@ -1,6 +1,6 @@
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -8,7 +8,7 @@
  * @param errors - Error class and message constants from the calling loader
  */
 export function validateLoadSpecifier(id, importer, loaderSpecifier, errors) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
     // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
@@ -21,6 +21,15 @@ export function validateLoadSpecifier(id, importer, loaderSpecifier, errors) {
     if (id === loaderSpecifier || id.startsWith(`${loaderSpecifier}/v/`)) {
         throw new LoaderError(NO_IMPORT_LOADER, [importer ?? 'unknown']);
     }
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [importer ?? 'unknown']);
+    }
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);

package/build/modules/lwr/loaderLegacy/loaderLegacy.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Legacy Module Loader v0.22.8 */
+/* LWR Legacy Module Loader v0.22.10 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {
@@ -143,7 +143,7 @@ const NO_IMPORT_LOADER = Object.freeze({
     level: 0,
     message: 'Cannot dynamically import the LWR loader with importer "{0}"',
 });
-Object.freeze({
+const NO_IMPORT_TRANSPORT = Object.freeze({
     code: 3025,
     level: 0,
     message: 'Cannot dynamically import "transport" with importer "{0}"',
@@ -1399,9 +1399,10 @@ function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else {
 
 
 
+
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -1414,7 +1415,7 @@ function validateLoadSpecifier(
     loaderSpecifier,
     errors,
 ) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
 
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
@@ -1430,6 +1431,18 @@ function validateLoadSpecifier(
         throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
     }
 
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (
+        id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')
+    ) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+    }
+
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);
@@ -1794,6 +1807,7 @@ class Loader {
             LoaderError,
             NO_IMPORT_LWC,
             NO_IMPORT_LOADER,
+            NO_IMPORT_TRANSPORT,
             NO_BLOB_IMPORT,
         });
         return this.registry.load(id, importer);

package/build/shim/defineCacheResolver.d.ts

@@ -0,0 +1,10 @@
+import type { DefineArguments, DefineArgsInput, ParseDefineResult, ResolvedLoader } from '../types.js';
+/**
+ * Parse AMD define args. Supports define(id, deps, factory).
+ */
+export declare function parseDefine(def: DefineArgsInput): ParseDefineResult;
+/**
+ * Resolve the loader's dependencies from defineCache. Throws if definition is invalid or deps cannot be resolved.
+ */
+export declare function resolveLoaderDepsFromDefineCache(loaderSpecifier: string, definition: DefineArguments, defineCache: Record<string, DefineArguments>): ResolvedLoader;
+//# sourceMappingURL=defineCacheResolver.d.ts.map

package/build/shim/defineCacheResolver.js

@@ -0,0 +1,78 @@
+/**
+ * Parse AMD define args. Supports define(id, deps, factory).
+ */
+export function parseDefine(def) {
+    const [, depsOrFactory, factory] = def;
+    if (Array.isArray(depsOrFactory) && typeof factory === 'function') {
+        return { deps: depsOrFactory, factory };
+    }
+    if (typeof depsOrFactory === 'function') {
+        return { deps: [], factory: depsOrFactory };
+    }
+    throw new Error('Invalid module definition');
+}
+/**
+ * Resolve a loader dependency: 'exports' returns the bag; otherwise look up in cache and instantiate.
+ * Loader deps are assumed to be leaf modules (no deps of their own)—no recursive resolution.
+ */
+function resolveDep(dep, exportsObj, cache) {
+    if (dep === 'exports')
+        return exportsObj;
+    const mod = cache[dep];
+    if (!mod) {
+        throw new Error(`Dependency "${dep}" not found in defineCache for loader`);
+    }
+    try {
+        return instantiateLeafModule(mod);
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Loader dependency "${dep}" has invalid definition: ${msg}`);
+    }
+}
+/**
+ * Instantiate a leaf module (loader dep). Assumes the module has no dependencies of its own.
+ * Supports only deps: [] or ['exports']; any other dep list throws.
+ */
+function instantiateLeafModule(def) {
+    const { deps, factory } = parseDefine(def);
+    if (deps.length > 1 || (deps.length === 1 && deps[0] !== 'exports')) {
+        throw new Error(`Loader dependencies must have no deps or only ['exports']; got [${deps.join(', ')}]`);
+    }
+    const exports = {};
+    const out = factory(exports);
+    return out !== undefined ? out : exports;
+}
+/**
+ * Normalize loader definition to canonical (exports, ...deps). Injects 'exports' if missing.
+ */
+function normalizeLoaderDefinition(def) {
+    const { deps, factory } = parseDefine(def);
+    if (deps.includes('exports')) {
+        return { deps, factory };
+    }
+    const isEmptyDeps = deps.length === 0;
+    const normalizedFactory = (exports, ...rest) => {
+        const result = isEmptyDeps ? factory(exports) : factory(...rest);
+        if (result !== undefined && typeof result === 'object') {
+            Object.assign(exports, result);
+        }
+    };
+    return { deps: ['exports', ...deps], factory: normalizedFactory };
+}
+/**
+ * Resolve the loader's dependencies from defineCache. Throws if definition is invalid or deps cannot be resolved.
+ */
+export function resolveLoaderDepsFromDefineCache(loaderSpecifier, definition, defineCache) {
+    try {
+        const { deps, factory } = normalizeLoaderDefinition(definition);
+        const exportsObj = {};
+        const args = deps.map((dep) => resolveDep(dep, exportsObj, defineCache));
+        return { factory: factory, args, exportsObj };
+    }
+    catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        throw new Error(`Expected loader with specifier "${loaderSpecifier}" to be a module. ${msg}`);
+    }
+}
+//# sourceMappingURL=defineCacheResolver.js.map

package/build/shim/loader.d.ts

@@ -1,3 +1,7 @@
 import type { DefineArguments, FingerprintsLoaderAPI as LoaderAPI, FingerprintsLoaderConfig as LoaderConfig } from '../types.js';
-export declare function createLoader(name: string, definition: DefineArguments, config: LoaderConfig, externalModules?: string[]): LoaderAPI;
+/**
+ * Create a loader from a definition. Original API preserved.
+ * Optional defineCache for resolving loader deps (when loader has dependencies).
+ */
+export declare function createLoader(name: string, definition: DefineArguments, config: LoaderConfig, externalModules?: string[], defineCache?: Record<string, DefineArguments>): LoaderAPI;
 //# sourceMappingURL=loader.d.ts.map

package/build/shim/loader.js

@@ -1,10 +1,21 @@
-export function createLoader(name, definition, config, externalModules) {
+import { resolveLoaderDepsFromDefineCache } from './defineCacheResolver.js';
+/**
+ * Create a loader from a definition. Original API preserved.
+ * Optional defineCache for resolving loader deps (when loader has dependencies).
+ */
+export function createLoader(name, definition, config, externalModules, defineCache) {
     if (!definition || typeof definition[2] !== 'function') {
         throw new Error(`Expected loader with specifier "${name}" to be a module`);
     }
-    // Create a Loader instance
     const exports = {};
-    definition[2].call(null, exports);
+    if (defineCache) {
+        const { factory, args, exportsObj } = resolveLoaderDepsFromDefineCache(name, definition, defineCache);
+        factory(...args);
+        Object.assign(exports, exportsObj);
+    }
+    else {
+        definition[2].call(null, exports);
+    }
     const { Loader } = exports;
     if (!Loader) {
         throw new Error('Expected Loader class to be defined');

package/build/shim/shim.js

@@ -112,7 +112,7 @@ export default class LoaderShim {
                     rootComponents: this.config.rootComponents,
                 },
             };
-            const loader = createLoader(this.loaderSpecifier, this.defineCache[this.loaderSpecifier], loaderConfig, this.config.preloadModules);
+            const loader = createLoader(this.loaderSpecifier, this.defineCache[this.loaderSpecifier], loaderConfig, this.config.preloadModules, this.defineCache);
             this.mountApp(loader);
             if (loader &&
                 typeof loader.getModuleWarnings === 'function' &&
@@ -134,6 +134,7 @@ export default class LoaderShim {
                 resolve();
             }
             else {
+                /* istanbul ignore next */
                 const observer = new MutationObserver(() => {
                     // eslint-disable-next-line lwr/no-unguarded-apis
                     if (document.body) {
@@ -198,7 +199,7 @@ export default class LoaderShim {
         ])
             .then(() => {
             // eslint-disable-next-line lwr/no-unguarded-apis
-            if (typeof window === 'undefined' || typeof document === undefined) {
+            if (typeof window === 'undefined' || typeof document === 'undefined') {
                 return Promise.resolve();
             }
             if (initDeferDOM) {

package/build/shim-legacy/loaderLegacy.d.ts

@@ -1,3 +1,8 @@
-import type { LoaderConfig, DefineArguments, LoaderAPI } from '../types.js';
-export declare function createLoader(name: string, definition: DefineArguments, config: LoaderConfig, externalModules?: string[]): LoaderAPI;
+import type { LoaderAPI, LoaderConfig, DefineArguments } from '../types.js';
+/**
+ * Create a loader from a definition. Original API preserved.
+ * Optional defineCache for resolving loader deps.
+ * definition[3] (signatures: ownHash, hashes) is passed to loader.define for cache invalidation.
+ */
+export declare function createLoader(name: string, definition: DefineArguments, config: LoaderConfig, externalModules?: string[], defineCache?: Record<string, DefineArguments>): LoaderAPI;
 //# sourceMappingURL=loaderLegacy.d.ts.map

package/build/shim-legacy/loaderLegacy.js

@@ -1,16 +1,27 @@
-export function createLoader(name, definition, config, externalModules) {
+import { resolveLoaderDepsFromDefineCache } from '../shim/defineCacheResolver.js';
+/**
+ * Create a loader from a definition. Original API preserved.
+ * Optional defineCache for resolving loader deps.
+ * definition[3] (signatures: ownHash, hashes) is passed to loader.define for cache invalidation.
+ */
+export function createLoader(name, definition, config, externalModules, defineCache) {
     if (!definition || typeof definition[2] !== 'function') {
         throw new Error(`Expected loader with specifier "${name}" to be a module`);
     }
-    // Create a Loader instance
     const exports = {};
-    definition[2].call(null, exports);
+    if (defineCache) {
+        const { factory, args, exportsObj } = resolveLoaderDepsFromDefineCache(name, definition, defineCache);
+        factory(...args);
+        Object.assign(exports, exportsObj);
+    }
+    else {
+        definition[2].call(null, exports);
+    }
     const { Loader } = exports;
     if (!Loader) {
         throw new Error('Expected Loader class to be defined');
     }
     const loader = new Loader(config);
-    // register externally loaded modules
     if (externalModules && externalModules.length) {
         loader.registerExternalModules(externalModules);
     }

package/build/shim-legacy/shimLegacy.js

@@ -99,7 +99,7 @@ export default class LoaderShim {
                     rootComponents: this.config.rootComponents,
                 },
             };
-            const loader = createLoader(this.loaderModule, this.defineCache[this.loaderModule], loaderConfig, this.config.preloadModules);
+            const loader = createLoader(this.loaderModule, this.defineCache[this.loaderModule], loaderConfig, this.config.preloadModules, this.defineCache);
             this.mountApp(loader);
             if (loader &&
                 typeof loader.getModuleWarnings === 'function' &&
@@ -180,7 +180,7 @@ export default class LoaderShim {
             .registerImportMappings(importMappings)
             .then(() => {
             // eslint-disable-next-line lwr/no-unguarded-apis
-            if (typeof window === 'undefined' || typeof document === undefined) {
+            if (typeof window === 'undefined' || typeof document === 'undefined') {
                 return Promise.resolve();
             }
             if (initDeferDOM) {

package/build/types.d.ts

@@ -8,7 +8,25 @@ export type GlobalThis = {
     [key: string]: unknown;
 };
 export type LoaderDefine = (id: string, deps: string[], exporter: Function, hash?: object) => void;
+/** define(id, deps, factory, hash?) - full form. Same shape as LoaderDefine args. (from main) */
 export type DefineArguments = [string, string[], Function, object?];
+/** Raw args from define() - at least [id, depsOrFactory]; may include factory, hash. Used for parsing. */
+export type DefineArgsInput = readonly [id: string, depsOrFactory: unknown, factory?: unknown, hash?: object];
+export interface ParseDefineResult {
+    deps: string[];
+    /** Same as DefineArguments[2] / LoaderDefine exporter */
+    factory: Function;
+}
+/** Normalized loader factory: receives (exports, ...resolvedDeps). Used after resolveLoaderDepsFromDefineCache. */
+export type LoaderFactory = (exports: object, ...deps: unknown[]) => void;
+/** Args passed to the loader factory: [exports, ...resolvedDeps]. First element is always the exports bag. */
+export type LoaderFactoryArgs = [exports: object, ...deps: unknown[]];
+/** Result of resolveLoaderDepsFromDefineCache. Typed for createLoader consumption. */
+export interface ResolvedLoader {
+    factory: LoaderFactory;
+    args: LoaderFactoryArgs;
+    exportsObj: object;
+}
 export type LoaderClass = {
     new (config?: LoaderConfig): LoaderAPI;
 };

package/package.json

@@ -5,7 +5,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.22.8",
+    "version": "0.22.10",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -44,10 +44,10 @@
         "package.cjs"
     ],
     "scripts": {
-        "test:browser": "rm tsconfig.tsbuildinfo; yarn build; JEST_PUPPETEER_CONFIG=jest-puppeteer.config.cjs jest --verbose --runInBand --config jest.browser.config.cjs",
-        "test:browser:ci": "rm tsconfig.tsbuildinfo; yarn build; JEST_PUPPETEER_CONFIG=jest-puppeteer.config.cjs jest --runInBand --no-cache --config jest.browser.config.cjs",
-        "test:browserLegacy": "rm tsconfig.tsbuildinfo; yarn build; JEST_PUPPETEER_CONFIG=jest-puppeteer-legacy.config.cjs jest --verbose --runInBand --config jest.browser-legacy.config.cjs",
-        "test:browserLegacy:ci": "rm tsconfig.tsbuildinfo; yarn build; JEST_PUPPETEER_CONFIG=jest-puppeteer-legacy.config.cjs jest --runInBand --no-cache --config jest.browser-legacy.config.cjs",
+        "test:browser": "shx rm -f tsconfig.tsbuildinfo; yarn build; cross-env JEST_PUPPETEER_CONFIG=jest-puppeteer.config.cjs jest --verbose --runInBand --config jest.browser.config.cjs",
+        "test:browser:ci": "shx rm -f tsconfig.tsbuildinfo; yarn build; cross-env JEST_PUPPETEER_CONFIG=jest-puppeteer.config.cjs jest --runInBand --no-cache --config jest.browser.config.cjs",
+        "test:browserLegacy": "shx rm -f tsconfig.tsbuildinfo; yarn build; cross-env JEST_PUPPETEER_CONFIG=jest-puppeteer-legacy.config.cjs jest --verbose --runInBand --config jest.browser-legacy.config.cjs",
+        "test:browserLegacy:ci": "shx rm -f tsconfig.tsbuildinfo; yarn build; cross-env JEST_PUPPETEER_CONFIG=jest-puppeteer-legacy.config.cjs jest --runInBand --no-cache --config jest.browser-legacy.config.cjs",
         "start:testserver": "node build/__tests__/shim/browser/test_server.js",
         "start:testserverLegacy": "node build/__tests__/shim-legacy/browser/test_server.js",
         "build:platform": "yarn build:shim && yarn build:error-shim && node ./scripts/platform-versioning.js",
@@ -61,16 +61,16 @@
     },
     "devDependencies": {
         "@locker/trusted-types": "0.26.4",
-        "@lwrjs/diagnostics": "0.22.8",
-        "@lwrjs/types": "0.22.8",
+        "@lwrjs/diagnostics": "0.22.10",
+        "@lwrjs/types": "0.22.10",
         "@rollup/plugin-node-resolve": "^15.2.3",
         "@rollup/plugin-sucrase": "^5.0.2",
         "@rollup/plugin-terser": "^0.4.4",
         "rollup": "^2.80.0"
     },
     "dependencies": {
-        "@lwrjs/client-modules": "0.22.8",
-        "@lwrjs/shared-utils": "0.22.8"
+        "@lwrjs/client-modules": "0.22.10",
+        "@lwrjs/shared-utils": "0.22.10"
     },
     "lwc": {
         "modules": [
@@ -90,5 +90,5 @@
     "volta": {
         "extends": "../../../package.json"
     },
-    "gitHead": "66f71f33f5b12fa4e7c7969f0a6239a590c999d1"
+    "gitHead": "52b77087a10567ad62b48bde04607c627580105d"
 }