@lwrjs/loader 0.22.9 → 0.22.11

package/build/cjs/modules/lwr/loaderLegacy/utils/validation.cjs

@@ -0,0 +1,93 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __markAsModule = (target) => __defProp(target, "__esModule", {value: true});
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, {get: all[name], enumerable: true});
+};
+var __exportStar = (target, module2, desc) => {
+  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
+    for (let key of __getOwnPropNames(module2))
+      if (!__hasOwnProp.call(target, key) && key !== "default")
+        __defProp(target, key, {get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable});
+  }
+  return target;
+};
+var __toModule = (module2) => {
+  return __exportStar(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? {get: () => module2.default, enumerable: true} : {value: module2, enumerable: true})), module2);
+};
+
+// packages/@lwrjs/loader/src/modules/lwr/loaderLegacy/utils/validation.ts
+__markAsModule(exports);
+__export(exports, {
+  isProtectedSpecifier: () => isProtectedSpecifier,
+  validateAndConvertImportMapUpdate: () => validateAndConvertImportMapUpdate,
+  validateMappingUri: () => validateMappingUri,
+  validateSpecifier: () => validateSpecifier
+});
+var import_dom = __toModule(require("../utils/dom.cjs"));
+var PROTECTED_PATTERNS = [
+  /^lwc$/i,
+  /^lwc\/v\//i,
+  /^@lwc\//i,
+  /^lightningmobileruntime\//i
+];
+function isProtectedSpecifier(specifier) {
+  return PROTECTED_PATTERNS.some((pattern) => pattern.test(specifier));
+}
+function validateMappingUri(uri, specifier) {
+  const lowerUri = uri.toLowerCase();
+  if (lowerUri.startsWith("blob:")) {
+    throw new Error(`Cannot map ${specifier} to blob: URL`);
+  }
+  if (lowerUri.startsWith("data:")) {
+    throw new Error(`Cannot map ${specifier} to data: URL`);
+  }
+}
+function validateSpecifier(specifier) {
+  if (typeof specifier !== "string" || specifier.length === 0) {
+    throw new Error("Specifier must be a non-empty string");
+  }
+  if (isProtectedSpecifier(specifier)) {
+    throw new Error(`Cannot remap protected module: ${specifier}`);
+  }
+}
+function validateAndConvertImportMapUpdate(update) {
+  if (!update || typeof update !== "object") {
+    throw new Error("LWR.importMap() requires an object argument");
+  }
+  const entries = Object.entries(update);
+  if (entries.length === 0) {
+    if (import_dom.hasConsole) {
+      console.warn("LWR.importMap() called with empty update object");
+    }
+    return null;
+  }
+  const convertedImports = {};
+  for (const [moduleScriptURL, moduleNames] of entries) {
+    if (!Array.isArray(moduleNames)) {
+      throw new Error("moduleNames must be an array");
+    }
+    if (!moduleScriptURL || typeof moduleScriptURL !== "string") {
+      throw new Error("moduleScriptURL must be a string");
+    }
+    validateMappingUri(moduleScriptURL, moduleScriptURL);
+    for (const moduleName of moduleNames) {
+      validateSpecifier(moduleName);
+      if (moduleName in convertedImports) {
+        if (import_dom.hasConsole) {
+          console.warn(`LWR.importMap(): duplicate module "${moduleName}" \u2014 already mapped to "${convertedImports[moduleName]}", ignoring mapping to "${moduleScriptURL}"`);
+        }
+      } else {
+        convertedImports[moduleName] = moduleScriptURL;
+      }
+    }
+  }
+  return {
+    imports: convertedImports
+  };
+}

package/build/modules/lwr/esmLoader/esmLoader.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR ESM Module Loader v0.22.9 */
+/* LWR ESM Module Loader v0.22.11 */
 function _optionalChain$1(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
 
 

package/build/modules/lwr/loader/loader.js

@@ -4,7 +4,7 @@
 * SPDX-License-Identifier: MIT
 * For full license text, see the LICENSE file in the repo root or https://opensource.org/licenses/MIT
 */
-/* LWR Module Loader v0.22.9 */
+/* LWR Module Loader v0.22.11 */
 const templateRegex = /\{([0-9]+)\}/g;
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 function templateString(template, args) {
@@ -158,7 +158,7 @@ const NO_BLOB_IMPORT = Object.freeze({
     level: 0,
     message: 'Cannot import a blob URL',
 });
-Object.freeze({
+const NO_IMPORT_TRANSPORT = Object.freeze({
     code: 3025,
     level: 0,
     message: 'Cannot dynamically import "transport" with importer "{0}"',
@@ -1609,9 +1609,10 @@ function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else {
 
 
 
+
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -1624,7 +1625,7 @@ function validateLoadSpecifier(
     loaderSpecifier,
     errors,
 ) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
 
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
@@ -1640,6 +1641,18 @@ function validateLoadSpecifier(
         throw new LoaderError(NO_IMPORT_LOADER, [_nullishCoalesce(importer, () => ( 'unknown'))]);
     }
 
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (
+        id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')
+    ) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [_nullishCoalesce(importer, () => ( 'unknown'))]);
+    }
+
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);
@@ -1751,6 +1764,7 @@ class Loader {
             LoaderError,
             NO_IMPORT_LWC,
             NO_IMPORT_LOADER,
+            NO_IMPORT_TRANSPORT,
             NO_BLOB_IMPORT,
         });
         return this.registry.load(id, importer);

package/build/modules/lwr/loader/validateLoadSpecifier.d.ts

@@ -8,11 +8,12 @@ export interface ValidateLoadSpecifierErrors {
     LoaderError: new (errorInfo: LoadSpecifierErrorInfo, errorArgs?: string[]) => Error;
     NO_IMPORT_LWC: LoadSpecifierErrorInfo;
     NO_IMPORT_LOADER: LoadSpecifierErrorInfo;
+    NO_IMPORT_TRANSPORT: LoadSpecifierErrorInfo;
     NO_BLOB_IMPORT: LoadSpecifierErrorInfo;
 }
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)

package/build/modules/lwr/loader/validateLoadSpecifier.js

@@ -1,6 +1,6 @@
 /**
  * Validates that the given module id is not one of the forbidden dynamic import specifiers.
- * Throws LoaderError for: lwc, the LWR loader, and blob URLs.
+ * Throws LoaderError for: lwc, the LWR loader, transport/webruntime/transport, and blob URLs.
  *
  * @param id - Module identifier or URL
  * @param importer - Versioned specifier of the module importer (for error reporting)
@@ -8,7 +8,7 @@
  * @param errors - Error class and message constants from the calling loader
  */
 export function validateLoadSpecifier(id, importer, loaderSpecifier, errors) {
-    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_BLOB_IMPORT } = errors;
+    const { LoaderError, NO_IMPORT_LWC, NO_IMPORT_LOADER, NO_IMPORT_TRANSPORT, NO_BLOB_IMPORT } = errors;
     // Throw an error if the specifier is "lwc" or a versioned lwc specifier
     // Dynamic import of LWC APIs is not allowed
     // Block both "lwc" and versioned forms like "lwc/v/8_20_1" to prevent bypass attempts
@@ -21,6 +21,15 @@ export function validateLoadSpecifier(id, importer, loaderSpecifier, errors) {
     if (id === loaderSpecifier || id.startsWith(`${loaderSpecifier}/v/`)) {
         throw new LoaderError(NO_IMPORT_LOADER, [importer ?? 'unknown']);
     }
+    // Throw an error if the specifier is "transport" or "webruntime/transport" (or versioned)
+    // Dynamic import of transport exposes unsandboxed fetch, bypassing LWS
+    // Reference: Hackforce report HF-3393
+    if (id === 'transport' ||
+        id.startsWith('transport/v/') ||
+        id === 'webruntime/transport' ||
+        id.startsWith('webruntime/transport/v/')) {
+        throw new LoaderError(NO_IMPORT_TRANSPORT, [importer ?? 'unknown']);
+    }
     // Throw an error if the specifier is a blob URL (case-insensitive check)
     if (id.toLowerCase().startsWith('blob:')) {
         throw new LoaderError(NO_BLOB_IMPORT);

package/build/modules/lwr/loaderLegacy/importMap/importMap.js

@@ -4,7 +4,7 @@
  * This implementation is adapted from https://github.com/systemjs/systemjs/blob/master/src/features/import-map.js
  */
 import { resolveUrl, resolveIfNotPlainOrUrl, isUrl } from '../utils/url.js';
-import { getMatch, targetWarning } from './utils.js';
+import { getMatch, targetWarning, mergeImportMapEntry } from './utils.js';
 // Resolves an import map package entry
 function applyPackages(id, packages, defaultUri) {
     const pkgName = getMatch(id, packages);
@@ -79,7 +79,8 @@ function resolveAndComposePackages(packages, outPackages, baseUrl, parentMap, pa
             targetWarning(p, rhs, 'bare specifier did not resolve');
         }
         else {
-            outPackages[resolvedLhs] = mapped.uri;
+            // Merge into cache with write-once protection
+            mergeImportMapEntry(resolvedLhs, mapped.uri, outPackages);
         }
     }
 }

package/build/modules/lwr/loaderLegacy/importMap/importMapResolver.d.ts

@@ -4,5 +4,6 @@ export declare class ImportMapResolver implements ImportResolver {
     importMap: ImportMap;
     constructor(importMap: ImportMap);
     resolve(resolvedOrPlain: string, parentUrl: string): ImportDefinition | undefined;
+    addImportMapEntries(importMap: ImportMap): void;
 }
 //# sourceMappingURL=importMapResolver.d.ts.map

package/build/modules/lwr/loaderLegacy/importMap/importMapResolver.js

@@ -1,4 +1,5 @@
 import { resolveImportMapEntry } from './importMap.js';
+import { mergeImportMapEntry } from './utils.js';
 /* spec based import map resolver */
 export class ImportMapResolver {
     constructor(importMap) {
@@ -7,5 +8,17 @@ export class ImportMapResolver {
     resolve(resolvedOrPlain, parentUrl) {
         return resolveImportMapEntry(this.importMap, resolvedOrPlain, parentUrl);
     }
+    addImportMapEntries(importMap) {
+        if (importMap.imports) {
+            const current = this.importMap;
+            if (!current.imports) {
+                current.imports = {};
+            }
+            // Merge into cache with write-once protection
+            for (const specifier in importMap.imports) {
+                mergeImportMapEntry(specifier, importMap.imports[specifier], current.imports);
+            }
+        }
+    }
 }
 //# sourceMappingURL=importMapResolver.js.map

package/build/modules/lwr/loaderLegacy/importMap/utils.d.ts

@@ -1,4 +1,15 @@
 declare function getMatch(path: string, matchObj: Record<string, unknown>): string | undefined;
 declare function targetWarning(match: string, target: string, msg: string): void;
-export { getMatch, targetWarning };
+/**
+ * Import map entries are write-once: once a specifier is mapped, it cannot be overridden.
+ * This ensures deterministic module resolution and prevents runtime mutation of previously
+ * resolved dependencies. Conflicting mappings are ignored with a warning.
+ *
+ * Merges a single import map entry into a target imports object.
+ * - If the specifier doesn't exist, it is added.
+ * - If it exists with the same value, it is silently skipped.
+ * - If it exists with a different value, a warning is logged and the entry is skipped.
+ */
+declare function mergeImportMapEntry(specifier: string, uri: string, target: Record<string, string>): void;
+export { getMatch, targetWarning, mergeImportMapEntry };
 //# sourceMappingURL=utils.d.ts.map

package/build/modules/lwr/loaderLegacy/importMap/utils.js

@@ -11,7 +11,8 @@ function getMatch(path, matchObj) {
         if (segment in matchObj) {
             return segment;
         }
-    } while (path.length > 1 && (sepIndex = path.lastIndexOf('/', sepIndex - 1)) !== -1);
+        sepIndex = path.lastIndexOf('/', sepIndex - 1);
+    } while (sepIndex > 0);
 }
 function targetWarning(match, target, msg) {
     if (hasConsole) {
@@ -19,5 +20,26 @@ function targetWarning(match, target, msg) {
         console.warn('Package target ' + msg + ", resolving target '" + target + "' for " + match);
     }
 }
-export { getMatch, targetWarning };
+/**
+ * Import map entries are write-once: once a specifier is mapped, it cannot be overridden.
+ * This ensures deterministic module resolution and prevents runtime mutation of previously
+ * resolved dependencies. Conflicting mappings are ignored with a warning.
+ *
+ * Merges a single import map entry into a target imports object.
+ * - If the specifier doesn't exist, it is added.
+ * - If it exists with the same value, it is silently skipped.
+ * - If it exists with a different value, a warning is logged and the entry is skipped.
+ */
+function mergeImportMapEntry(specifier, uri, target) {
+    const existing = target[specifier];
+    if (existing !== undefined) {
+        if (existing !== uri) {
+            targetWarning(specifier, uri, `already mapped to "${existing}", ignoring conflicting mapping`);
+        }
+    }
+    else {
+        target[specifier] = uri;
+    }
+}
+export { getMatch, targetWarning, mergeImportMapEntry };
 //# sourceMappingURL=utils.js.map

package/build/modules/lwr/loaderLegacy/loaderLegacy.d.ts

@@ -1,13 +1,14 @@
 import { Module, ModuleDefinitionSignatures } from './moduleRegistry/moduleRegistry.js';
 import { ImportMap } from './importMap/importMap.js';
 import type { ServiceAPI } from '@lwrjs/types';
-import type { LoaderConfig } from '../../../types.js';
+import type { LoaderConfig, ImportMapUpdate } from '../../../types.js';
 /**
  * The LWR loader is inspired and borrows from the algorithms and native browser principles of https://github.com/systemjs/systemjs
  */
 export declare class Loader {
     private registry;
     private baseUrl;
+    private importMapResolver?;
     readonly services: Readonly<Pick<ServiceAPI, 'addLoaderPlugin' | 'handleStaleModule' | 'appMetadata'>>;
     constructor(config?: LoaderConfig);
     /**
@@ -54,6 +55,15 @@ export declare class Loader {
      * @param modules - list of module identifiers
      */
     registerExternalModules(modules: string[]): void;
+    /**
+     * Apply import map updates at runtime.
+     * Enables adding new import mappings dynamically.
+     *
+     * @param updates - Import Map Update object containing:
+    -   [moduleScriptURL] - Script URL containing LWR define statements
+    -   string[] - array of module names which are included in the given script
+     */
+    importMap(update: ImportMapUpdate): void;
     getModuleWarnings(isAppMounted?: boolean): Record<string, string[]>;
 }
 //# sourceMappingURL=loaderLegacy.d.ts.map