@lwrjs/view-registry 0.13.0-alpha.14 → 0.13.0-alpha.16

package/build/cjs/index.cjs

@@ -232,7 +232,7 @@ var LwrViewRegistry = class {
   async renderView(view, viewParams, runtimeEnvironment, runtimeParams = {}, renderOptions) {
     const {id, contentTemplate, rootComponent, layoutTemplate} = view;
     const lwrResourcesId = `__LWR_RESOURCES__${Date.now()}`;
-    const renderedContent = await this.render({id, contentTemplate, rootComponent}, {...viewParams, lwr_resources: lwrResourcesId}, runtimeParams, renderOptions);
+    const renderedContent = await this.render({id, contentTemplate, rootComponent}, {...viewParams, lwr_resources: lwrResourcesId}, runtimeParams, runtimeEnvironment, renderOptions);
     let normalizedRenderOptions = (0, import_utils.normalizeRenderOptions)(this.runtimeEnvironment, renderedContent.options, renderOptions);
     const layout = layoutTemplate || renderedContent.compiledView.layoutTemplate;
     if (!layout) {
@@ -252,7 +252,7 @@ var LwrViewRegistry = class {
       ...viewParams,
       body: renderedContent.renderedView,
       lwr_resources: lwrResourcesId
-    }, runtimeParams);
+    }, runtimeParams, runtimeEnvironment);
     normalizedRenderOptions = (0, import_utils.normalizeRenderOptions)(this.runtimeEnvironment, renderedLayout.options, normalizedRenderOptions);
     const renderedViewDef = await this.link({
       ...renderedLayout,
@@ -290,7 +290,7 @@ var LwrViewRegistry = class {
     });
     return renderedViewDef;
   }
-  async render(viewId, viewParams, runtimeParams, renderOptions) {
+  async render(viewId, viewParams, runtimeParams, runtimeEnvironment, renderOptions) {
     const globalContext = this.globalData;
     const {id, rootComponent, contentTemplate} = viewId;
     const compiledView = await this.getView({id, contentTemplate, rootComponent}, renderOptions?.skipCaching);
@@ -299,7 +299,7 @@ var LwrViewRegistry = class {
       ...globalContext,
       ...compiledView.properties,
       ...viewParams
-    });
+    }, runtimeEnvironment);
     const normalizedResult = (0, import_utils.normalizeRenderedResult)(result);
     return {
       compiledView,
@@ -365,7 +365,8 @@ var LwrViewRegistry = class {
       renderedView: linkedAssetContent,
       immutable,
       viewRecord: {
-        assetReferences: (0, import_utils.reduceSourceAssetReferences)(linkedMetadata.assetReferences)
+        assetReferences: (0, import_utils.reduceSourceAssetReferences)(linkedMetadata.assetReferences),
+        moduleResources: []
       },
       cache: {ttl: pageTtl}
     };

package/build/cjs/linkers/legacy_view_bootstrap.cjs

@@ -97,7 +97,8 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   const viewPreloads = {
     uris: [],
     specifiers: [],
-    groups: new Map()
+    groups: new Map(),
+    integrities: new Map()
   };
   const isSSR = view.bootstrap?.ssr;
   const version = view.bootstrap?.lwrVersion;
@@ -149,11 +150,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!uri) {
       throw Error(`Invalid Module Resource ${versionedSpecifier}`);
     }
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {isPreload: false, isSSR, nonce}));
+    const integrity = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, versionedSpecifier);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {integrity, isPreload: false, isSSR, nonce}));
     for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
       const uri2 = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
       if (uri2) {
-        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+        const integrity2 = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, depSpecifier);
+        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, integrity2, groups, viewPreloads);
       }
     }
     if ((0, import_shared_utils.isBundler)(defRegistry)) {
@@ -190,12 +193,14 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!isSSR || (0, import_shared_utils.getHydrateDirective)(props)) {
       const specifier = graph.graphs[0].specifier;
       const uri = graph.uriMap[specifier];
-      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, groups, viewPreloads);
+      const integrity = (0, import_utils2.getBundleIntegrity)(graph, specifier);
+      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, integrity, groups, viewPreloads);
       if (bundle) {
         for (const depSpecifier of graph.graphs[0].static) {
-          const uri2 = getPreloadUri(depSpecifier, graph.uriMap);
-          if (uri2) {
-            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+          const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+          if (depUri) {
+            const integrity2 = (0, import_utils2.getBundleIntegrity)(graph, depSpecifier);
+            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, depUri, integrity2, groups, viewPreloads);
           }
         }
       }
@@ -238,7 +243,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   }
   const dedupedUris = [...new Set(viewPreloads.uris)];
   for (const preloadUri of dedupedUris) {
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {isPreload: true, isSSR, nonce}));
+    const integrity = viewPreloads.integrities.get(preloadUri);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {
+      integrity,
+      isPreload: true,
+      isSSR,
+      nonce
+    }));
   }
   const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(import_utils.generateHtmlTag));
   return {
@@ -246,6 +257,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     viewRecord: {
       resources: requiredResources,
       customElements: customElementsRecords,
+      moduleResources,
       bootstrapModule: bootstrapModuleRef
     }
   };

package/build/cjs/linkers/preload-utils.cjs

@@ -29,7 +29,7 @@ __export(exports, {
 });
 var import_diagnostics = __toModule(require("@lwrjs/diagnostics"));
 var import_shared_utils = __toModule(require("@lwrjs/shared-utils"));
-function setPreloadModulesMeta(specifier, uri, groups, preloads) {
+function setPreloadModulesMeta(specifier, uri, integrity, groups, preloads) {
   if (!uri) {
     throw (0, import_diagnostics.createSingleDiagnosticError)({
       description: import_diagnostics.descriptions.UNRESOLVABLE.PRELOAD_MODULE(specifier)
@@ -41,6 +41,7 @@ function setPreloadModulesMeta(specifier, uri, groups, preloads) {
   const preloadModulesSpecifiers = preloads.specifiers;
   const preloadBundleGroupsMap = preloads.groups;
   const preloadModulesURIs = preloads.uris;
+  const preloadModuleIntegrities = preloads.integrities;
   preloadModulesSpecifiers.push(specifier);
   const {specifier: unversionedSpecifier} = (0, import_shared_utils.explodeSpecifier)(specifier);
   const groupName = (0, import_shared_utils.getGroupName)(unversionedSpecifier, groups);
@@ -49,6 +50,7 @@ function setPreloadModulesMeta(specifier, uri, groups, preloads) {
   }
   preloadModulesURIs.push(uri);
   groupName && preloadBundleGroupsMap.set(groupName, true);
+  preloadModuleIntegrities.set(uri, integrity);
 }
 async function getPreloadModulesMeta(specifier, viewPreloads, bundleConfig, moduleRegistry, defRegistry, runtimeEnvironment, runtimeParams, pending) {
   const {exclude = [], external = {}, groups = {}} = bundleConfig;
@@ -72,9 +74,10 @@ async function getPreloadModulesMeta(specifier, viewPreloads, bundleConfig, modu
     });
     const uri = await defRegistry.resolveModuleUri(versionedModuleId, runtimeEnvironment, runtimeParams);
     const normalizedSpecifier = versionedModuleId.version === import_shared_utils.VERSION_NOT_PROVIDED ? specifier : versionedModuleSpecifier;
-    setPreloadModulesMeta(normalizedSpecifier, uri, groups, viewPreloads);
+    const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
+    const {integrity} = preloadModuleRecord;
+    setPreloadModulesMeta(normalizedSpecifier, uri, integrity, groups, viewPreloads);
     if (exclude.length || Object.keys(groups).length) {
-      const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
       const {imports} = preloadModuleRecord.bundleRecord;
       if (imports) {
         if (!pending) {

package/build/cjs/linkers/utils.cjs

@@ -25,6 +25,7 @@ var __toModule = (module2) => {
 __markAsModule(exports);
 __export(exports, {
   flattenCustomElements: () => flattenCustomElements,
+  getBundleIntegrity: () => getBundleIntegrity,
   getViewBootstrapConfigurationResource: () => getViewBootstrapConfigurationResource,
   getViewHmrConfigurationResource: () => getViewHmrConfigurationResource
 });
@@ -72,6 +73,7 @@ function getViewBootstrapConfigurationResource(viewInfo, config, runtimeEnvironm
       type: CONTENT_TYPE,
       content: configString,
       inline: false,
+      integrity: (0, import_shared_utils.createIntegrityHash)(configString),
       src: url
     };
   } else {
@@ -129,3 +131,8 @@ function flattenCustomElements(arr, isSSR = false) {
   flatten(arr);
   return ret;
 }
+function getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier) {
+  const def = bootstrapModuleGraph.linkedDefinitions[versionedSpecifier];
+  const integrity = def?.integrity;
+  return integrity;
+}

package/build/cjs/linkers/view_bootstrap.cjs

@@ -86,7 +86,8 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   const viewPreloads = {
     uris: [],
     specifiers: [],
-    groups: new Map()
+    groups: new Map(),
+    integrities: new Map()
   };
   const isSSR = view.bootstrap?.ssr;
   const version = view.bootstrap?.lwrVersion;
@@ -129,11 +130,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!uri) {
       throw Error(`Invalid Module Resource ${versionedSpecifier}`);
     }
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {isPreload: false, isSSR, nonce}));
+    const integrity = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, versionedSpecifier);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {integrity, isPreload: false, isSSR, nonce}));
     for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
       const uri2 = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
       if (uri2) {
-        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+        const integrity2 = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, depSpecifier);
+        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, integrity2, groups, viewPreloads);
       }
     }
     if ((0, import_shared_utils.isBundler)(defRegistry)) {
@@ -171,12 +174,14 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!isSSR || (0, import_shared_utils.getHydrateDirective)(props)) {
       const specifier = graph.graphs[0].specifier;
       const uri = graph.uriMap[specifier];
-      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, groups, viewPreloads);
+      const integrity = (0, import_utils2.getBundleIntegrity)(graph, specifier);
+      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, integrity, groups, viewPreloads);
       if (bundle) {
         for (const depSpecifier of graph.graphs[0].static) {
-          const uri2 = getPreloadUri(depSpecifier, graph.uriMap);
-          if (uri2) {
-            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+          const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+          if (depUri) {
+            const integrity2 = (0, import_utils2.getBundleIntegrity)(graph, depSpecifier);
+            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, depUri, integrity2, groups, viewPreloads);
           }
         }
       }
@@ -218,7 +223,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   }
   const dedupedUris = [...new Set(viewPreloads.uris)];
   for (const preloadUri of dedupedUris) {
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {isPreload: true, isSSR, nonce}));
+    const integrity = viewPreloads.integrities.get(preloadUri);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {
+      integrity,
+      isPreload: true,
+      isSSR,
+      nonce
+    }));
   }
   const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(import_utils.generateHtmlTag));
   const mapping = (0, import_shared_utils.getMappingUriPrefix)(runtimeEnvironment, runtimeParams);
@@ -234,6 +245,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       customElements: customElementsRecords,
       endpoints,
       importMetadata,
+      moduleResources,
       bootstrapModule: bootstrapModuleRef
     }
   };

package/build/cjs/utils.cjs

@@ -45,15 +45,22 @@ var import_crypto = __toModule(require("crypto"));
 function generateExternalStyle(src) {
   return `<link rel="stylesheet" href="${src}">`;
 }
-function generateExternalScript(type = "application/javascript", src, async, defer, nonce) {
+function generateExternalScript(type = "application/javascript", src, async, defer, nonce, integrity) {
   let scriptLoadOrder = "";
   if (defer) {
     scriptLoadOrder = " defer";
   } else if (async) {
     scriptLoadOrder = " async";
   }
-  const nonceAttr = (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE && nonce ? ` nonce="${nonce}"` : "";
-  return `<script type="${type}"${scriptLoadOrder}${nonceAttr} src="${src}"></script>`;
+  let cspHashAttr = "";
+  if ((0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE) {
+    if (integrity) {
+      cspHashAttr = ` integrity="${integrity}"`;
+    } else if (nonce) {
+      cspHashAttr = ` nonce="${nonce}"`;
+    }
+  }
+  return `<script type="${type}"${scriptLoadOrder}${cspHashAttr} src="${src}"></script>`;
 }
 function generateLinkPreloadTag({href, type}) {
   if (type === "module") {
@@ -62,13 +69,21 @@ function generateLinkPreloadTag({href, type}) {
     return `<link rel="preload" href="${href}" type="${type}" />`;
   }
 }
-function generateExternalTag({type, src = "", async, defer, isPreload, nonce}) {
+function generateExternalTag({
+  type,
+  src = "",
+  async,
+  defer,
+  isPreload,
+  nonce,
+  integrity
+}) {
   if (isPreload) {
     return generateLinkPreloadTag({href: src, type});
   } else if (type === "text/css") {
     return generateExternalStyle(src);
   } else {
-    return generateExternalScript(type, src, async, defer, nonce);
+    return generateExternalScript(type, src, async, defer, nonce, integrity);
   }
 }
 async function generateInlineTag({specifier, type, content, stream, nonce}) {
@@ -228,7 +243,7 @@ async function getModuleResource(moduleId, runtimeEnvironment, moduleResourceMet
   };
 }
 function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMeta) {
-  const {isSSR = false, isPreload = false, nonce} = moduleResourceMeta;
+  const {integrity, isSSR = false, isPreload = false, nonce} = moduleResourceMeta;
   const {format} = runtimeEnvironment;
   return {
     src: uri,
@@ -236,6 +251,7 @@ function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMeta) {
     async: !isSSR && isPreload,
     defer: isSSR,
     isPreload: format !== "amd" && isPreload,
+    integrity,
     nonce
   };
 }

package/build/es/index.js

@@ -242,7 +242,7 @@ export class LwrViewRegistry {
     async renderView(view, viewParams, runtimeEnvironment, runtimeParams = {}, renderOptions) {
         const { id, contentTemplate, rootComponent, layoutTemplate } = view;
         const lwrResourcesId = `__LWR_RESOURCES__${Date.now()}`;
-        const renderedContent = await this.render({ id, contentTemplate, rootComponent }, { ...viewParams, lwr_resources: lwrResourcesId }, runtimeParams, renderOptions);
+        const renderedContent = await this.render({ id, contentTemplate, rootComponent }, { ...viewParams, lwr_resources: lwrResourcesId }, runtimeParams, runtimeEnvironment, renderOptions);
         // normalize the renderOptions provided by the CompiledView content with the request options.
         let normalizedRenderOptions = normalizeRenderOptions(this.runtimeEnvironment, renderedContent.options, renderOptions);
         const layout = layoutTemplate || renderedContent.compiledView.layoutTemplate;
@@ -266,7 +266,7 @@ export class LwrViewRegistry {
             ...viewParams,
             body: renderedContent.renderedView,
             lwr_resources: lwrResourcesId,
-        }, runtimeParams);
+        }, runtimeParams, runtimeEnvironment);
         normalizedRenderOptions = normalizeRenderOptions(this.runtimeEnvironment, renderedLayout.options, normalizedRenderOptions);
         const renderedViewDef = await this.link({
             ...renderedLayout,
@@ -310,7 +310,7 @@ export class LwrViewRegistry {
         });
         return renderedViewDef;
     }
-    async render(viewId, viewParams, runtimeParams, renderOptions) {
+    async render(viewId, viewParams, runtimeParams, runtimeEnvironment, renderOptions) {
         const globalContext = this.globalData;
         const { id, rootComponent, contentTemplate } = viewId;
         const compiledView = await this.getView({ id, contentTemplate, rootComponent }, renderOptions?.skipCaching);
@@ -329,7 +329,7 @@ export class LwrViewRegistry {
             ...globalContext,
             ...compiledView.properties,
             ...viewParams,
-        });
+        }, runtimeEnvironment);
         const normalizedResult = normalizeRenderedResult(result);
         return {
             compiledView,
@@ -393,6 +393,7 @@ export class LwrViewRegistry {
             immutable,
             viewRecord: {
                 assetReferences: reduceSourceAssetReferences(linkedMetadata.assetReferences),
+                moduleResources: [],
             },
             cache: { ttl: pageTtl },
         };

package/build/es/linkers/legacy_view_bootstrap.js

@@ -2,7 +2,7 @@ import { logger } from '@lwrjs/diagnostics';
 import { kebabCaseToModuleSpecifier, getModuleGraphs, GraphDepth, getModuleUriPrefix, explodeSpecifier, isBundler, getHydrateDirective, isGroupie, isExternalSpecifier, } from '@lwrjs/shared-utils';
 import { AppResourceEnum, getAppSpecifier } from '@lwrjs/app-service/identity';
 import { addExternalScriptNonce, generateHtmlTag, getModuleResourceByUri, getViewNonce } from '../utils.js';
-import { flattenCustomElements, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
+import { flattenCustomElements, getBundleIntegrity, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
 import { setPreloadModulesMeta, getPreloadModulesMeta } from './preload-utils.js';
 function includeIdFactory(bundleConfig) {
     return (moduleRef) => {
@@ -88,6 +88,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         uris: [],
         specifiers: [],
         groups: new Map(),
+        integrities: new Map(),
     };
     // Determine if server side rendering view modules
     const isSSR = view.bootstrap?.ssr;
@@ -160,12 +161,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         if (!uri) {
             throw Error(`Invalid Module Resource ${versionedSpecifier}`);
         }
-        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { isPreload: false, isSSR, nonce }));
+        const integrity = getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier);
+        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { integrity, isPreload: false, isSSR, nonce }));
         // PRELOAD the bootstrap module static dependencies as preloaded script resources
         for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
             const uri = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
             if (uri) {
-                setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                const integrity = getBundleIntegrity(bootstrapModuleGraph, depSpecifier);
+                setPreloadModulesMeta(depSpecifier, uri, integrity, groups, viewPreloads);
             }
         }
         // PRELOAD configured preloadModules as preloaded script resources
@@ -215,13 +218,15 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             // PRELOAD the custom element module as a link resource
             const specifier = graph.graphs[0].specifier;
             const uri = graph.uriMap[specifier];
-            setPreloadModulesMeta(specifier, uri, groups, viewPreloads);
+            const integrity = getBundleIntegrity(graph, specifier);
+            setPreloadModulesMeta(specifier, uri, integrity, groups, viewPreloads);
             // PRELOAD custom element static deps as link resources when bundling is ON
             if (bundle) {
                 for (const depSpecifier of graph.graphs[0].static) {
-                    const uri = getPreloadUri(depSpecifier, graph.uriMap);
-                    if (uri) {
-                        setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                    const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+                    if (depUri) {
+                        const integrity = getBundleIntegrity(graph, depSpecifier);
+                        setPreloadModulesMeta(depSpecifier, depUri, integrity, groups, viewPreloads);
                     }
                 }
             }
@@ -270,7 +275,13 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
     const dedupedUris = [...new Set(viewPreloads.uris)];
     // PRELOAD script resources for preload module URIs after the bootstrap module
     for (const preloadUri of dedupedUris) {
-        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, { isPreload: true, isSSR, nonce }));
+        const integrity = viewPreloads.integrities.get(preloadUri);
+        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, {
+            integrity,
+            isPreload: true,
+            isSSR,
+            nonce,
+        }));
     }
     // generate html partial
     const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(generateHtmlTag));
@@ -279,6 +290,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         viewRecord: {
             resources: requiredResources,
             customElements: customElementsRecords,
+            moduleResources,
             bootstrapModule: bootstrapModuleRef,
         },
     };

package/build/es/linkers/preload-utils.d.ts

@@ -3,11 +3,12 @@ export type ViewPreloads = {
     groups: Map<string, boolean>;
     uris: string[];
     specifiers: string[];
+    integrities: Map<string, string | undefined>;
 };
 /**
  * keeps track of preloadModules metadata
  */
-export declare function setPreloadModulesMeta(specifier: string, uri: string, groups: BundleGroups, preloads: ViewPreloads): void;
+export declare function setPreloadModulesMeta(specifier: string, uri: string, integrity: string | undefined, groups: BundleGroups, preloads: ViewPreloads): void;
 /**
  * Recursively gets preloadModules metadata starting with a specifier
  * Note: don't call me unless you got bundles

package/build/es/linkers/preload-utils.js

@@ -3,7 +3,7 @@ import { explodeSpecifier, getGroupName, getVersionedModuleId, normalizeVersionT
 /**
  * keeps track of preloadModules metadata
  */
-export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
+export function setPreloadModulesMeta(specifier, uri, integrity, groups, preloads) {
     // Throw a very specific error if we get this back and the uri property is not set
     if (!uri) {
         throw createSingleDiagnosticError({
@@ -20,6 +20,7 @@ export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
     const preloadModulesSpecifiers = preloads.specifiers;
     const preloadBundleGroupsMap = preloads.groups;
     const preloadModulesURIs = preloads.uris;
+    const preloadModuleIntegrities = preloads.integrities;
     preloadModulesSpecifiers.push(specifier);
     const { specifier: unversionedSpecifier } = explodeSpecifier(specifier);
     const groupName = getGroupName(unversionedSpecifier, groups);
@@ -29,6 +30,7 @@ export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
     // With bundling groups, we only want to include one URI
     preloadModulesURIs.push(uri);
     groupName && preloadBundleGroupsMap.set(groupName, true);
+    preloadModuleIntegrities.set(uri, integrity);
 }
 /**
  * Recursively gets preloadModules metadata starting with a specifier
@@ -60,12 +62,13 @@ viewPreloads, bundleConfig, moduleRegistry, defRegistry, runtimeEnvironment, run
         const uri = 
         // eslint-disable-next-line no-await-in-loop
         await defRegistry.resolveModuleUri(versionedModuleId, runtimeEnvironment, runtimeParams);
-        // fallback to unversioned specifier if needed
+        // fallback to un-versioned specifier if needed
         const normalizedSpecifier = versionedModuleId.version === VERSION_NOT_PROVIDED ? specifier : versionedModuleSpecifier;
-        setPreloadModulesMeta(normalizedSpecifier, uri, groups, viewPreloads);
+        // Will set the integrity after loading the record below
+        const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
+        const { integrity } = preloadModuleRecord;
+        setPreloadModulesMeta(normalizedSpecifier, uri, integrity, groups, viewPreloads);
         if (exclude.length || Object.keys(groups).length) {
-            // check if we need to also preload any excluded dependencies of this preload module
-            const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
             const { imports } = preloadModuleRecord.bundleRecord;
             if (imports) {
                 if (!pending) {

package/build/es/linkers/utils.d.ts

@@ -1,5 +1,6 @@
-import type { ClientBootstrapConfig, RuntimeEnvironment, RuntimeParams, ResourceDefinition, RenderedViewMetadata, CustomElementReference, View, ViewInfo } from '@lwrjs/types';
+import type { ClientBootstrapConfig, RuntimeEnvironment, RuntimeParams, ResourceDefinition, RenderedViewMetadata, CustomElementReference, View, ViewInfo, FlattenedModuleGraphs } from '@lwrjs/types';
 export declare function getViewBootstrapConfigurationResource(viewInfo: ViewInfo, config: ClientBootstrapConfig, runtimeEnvironment: RuntimeEnvironment, runtimeParams: RuntimeParams, debugMessage?: string): ResourceDefinition;
 export declare function getViewHmrConfigurationResource(view: View, viewMetadata: RenderedViewMetadata): ResourceDefinition;
 export declare function flattenCustomElements(arr: CustomElementReference[], isSSR?: boolean): CustomElementReference[];
+export declare function getBundleIntegrity(bootstrapModuleGraph: FlattenedModuleGraphs, versionedSpecifier: string): string | undefined;
 //# sourceMappingURL=utils.d.ts.map

package/build/es/linkers/utils.js

@@ -1,4 +1,4 @@
-import { buildEnvironmentContext, getMappingUriPrefix, getModuleUriPrefix, getClientBootstrapConfigurationUri, hashContent, } from '@lwrjs/shared-utils';
+import { buildEnvironmentContext, getMappingUriPrefix, getModuleUriPrefix, getClientBootstrapConfigurationUri, hashContent, createIntegrityHash, } from '@lwrjs/shared-utils';
 const CONTENT_TYPE = 'application/javascript';
 export function getViewBootstrapConfigurationResource(viewInfo, config, runtimeEnvironment, runtimeParams, debugMessage) {
     const { compat, debug, hmrEnabled, apiVersion, format } = runtimeEnvironment;
@@ -49,6 +49,7 @@ export function getViewBootstrapConfigurationResource(viewInfo, config, runtimeE
             type: CONTENT_TYPE,
             content: configString,
             inline: false,
+            integrity: createIntegrityHash(configString),
             src: url,
         };
     }
@@ -111,4 +112,9 @@ export function flattenCustomElements(arr, isSSR = false) {
     flatten(arr);
     return ret;
 }
+export function getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier) {
+    const def = bootstrapModuleGraph.linkedDefinitions[versionedSpecifier];
+    const integrity = def?.integrity;
+    return integrity;
+}
 //# sourceMappingURL=utils.js.map

package/build/es/linkers/view_bootstrap.js

@@ -2,7 +2,7 @@ import { logger } from '@lwrjs/diagnostics';
 import { kebabCaseToModuleSpecifier, toImportMetadata, getModuleGraphs, getMappingUriPrefix, GraphDepth, explodeSpecifier, isBundler, getHydrateDirective, isGroupie, } from '@lwrjs/shared-utils';
 import { AppResourceEnum, getAppSpecifier } from '@lwrjs/app-service/identity';
 import { addExternalScriptNonce, generateHtmlTag, getModuleResourceByUri, getViewNonce } from '../utils.js';
-import { flattenCustomElements, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
+import { flattenCustomElements, getBundleIntegrity, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
 import { setPreloadModulesMeta, getPreloadModulesMeta } from './preload-utils.js';
 export async function getHtmlResources(view, viewParams, resourceContext) {
     const { runtimeEnvironment, runtimeParams, moduleRegistry, moduleBundler, resourceRegistry, viewMetadata, } = resourceContext;
@@ -71,6 +71,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         uris: [],
         specifiers: [],
         groups: new Map(),
+        integrities: new Map(),
     };
     // Determine if server side rendering view modules
     const isSSR = view.bootstrap?.ssr;
@@ -127,12 +128,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         if (!uri) {
             throw Error(`Invalid Module Resource ${versionedSpecifier}`);
         }
-        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { isPreload: false, isSSR, nonce }));
+        const integrity = getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier);
+        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { integrity, isPreload: false, isSSR, nonce }));
         // PRELOAD the bootstrap module static dependencies as preloaded script resources
         for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
             const uri = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
             if (uri) {
-                setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                const integrity = getBundleIntegrity(bootstrapModuleGraph, depSpecifier);
+                setPreloadModulesMeta(depSpecifier, uri, integrity, groups, viewPreloads);
             }
         }
         // PRELOAD configured preloadModules as preloaded script resources
@@ -184,13 +187,15 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             // PRELOAD the custom element module as a link resource
             const specifier = graph.graphs[0].specifier;
             const uri = graph.uriMap[specifier];
-            setPreloadModulesMeta(specifier, uri, groups, viewPreloads);
+            const integrity = getBundleIntegrity(graph, specifier);
+            setPreloadModulesMeta(specifier, uri, integrity, groups, viewPreloads);
             // PRELOAD custom element static deps as link resources when bundling is ON
             if (bundle) {
                 for (const depSpecifier of graph.graphs[0].static) {
-                    const uri = getPreloadUri(depSpecifier, graph.uriMap);
-                    if (uri) {
-                        setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                    const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+                    if (depUri) {
+                        const integrity = getBundleIntegrity(graph, depSpecifier);
+                        setPreloadModulesMeta(depSpecifier, depUri, integrity, groups, viewPreloads);
                     }
                 }
             }
@@ -239,7 +244,13 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
     // PRELOAD script resources for preload module URIs after the bootstrap module
     const dedupedUris = [...new Set(viewPreloads.uris)];
     for (const preloadUri of dedupedUris) {
-        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, { isPreload: true, isSSR, nonce }));
+        const integrity = viewPreloads.integrities.get(preloadUri);
+        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, {
+            integrity,
+            isPreload: true,
+            isSSR,
+            nonce,
+        }));
     }
     // generate html partial
     const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(generateHtmlTag));
@@ -256,6 +267,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             customElements: customElementsRecords,
             endpoints,
             importMetadata,
+            moduleResources,
             bootstrapModule: bootstrapModuleRef,
         },
     };

package/build/es/utils.js

@@ -5,7 +5,8 @@ import crypto from 'crypto';
 function generateExternalStyle(src) {
     return `<link rel="stylesheet" href="${src}">`;
 }
-function generateExternalScript(type = 'application/javascript', src, async, defer, nonce) {
+function generateExternalScript(type = 'application/javascript', src, async, defer, nonce, integrity) {
+    // add script loader order attribute
     let scriptLoadOrder = '';
     if (defer) {
         scriptLoadOrder = ' defer';
@@ -13,8 +14,19 @@ function generateExternalScript(type = 'application/javascript', src, async, def
     else if (async) {
         scriptLoadOrder = ' async';
     }
-    const nonceAttr = getFeatureFlags().ENABLE_NONCE && nonce ? ` nonce="${nonce}"` : '';
-    return `<script type="${type}"${scriptLoadOrder}${nonceAttr} src="${src}"></script>`;
+    // add the right CSP header attribute
+    let cspHashAttr = '';
+    // For now use the ENABLE_NONCE to gate adding nonce or integrity
+    // W-15868505 is open to create a better config
+    if (getFeatureFlags().ENABLE_NONCE) {
+        if (integrity) {
+            cspHashAttr = ` integrity="${integrity}"`;
+        }
+        else if (nonce) {
+            cspHashAttr = ` nonce="${nonce}"`;
+        }
+    }
+    return `<script type="${type}"${scriptLoadOrder}${cspHashAttr} src="${src}"></script>`;
 }
 function generateLinkPreloadTag({ href, type }) {
     if (type === 'module') {
@@ -24,7 +36,7 @@ function generateLinkPreloadTag({ href, type }) {
         return `<link rel="preload" href="${href}" type="${type}" />`;
     }
 }
-function generateExternalTag({ type, src = '', async, defer, isPreload, nonce }) {
+function generateExternalTag({ type, src = '', async, defer, isPreload, nonce, integrity, }) {
     if (isPreload) {
         return generateLinkPreloadTag({ href: src, type: type });
     }
@@ -32,7 +44,7 @@ function generateExternalTag({ type, src = '', async, defer, isPreload, nonce })
         return generateExternalStyle(src);
     }
     else {
-        return generateExternalScript(type, src, async, defer, nonce);
+        return generateExternalScript(type, src, async, defer, nonce, integrity);
     }
 }
 async function generateInlineTag({ specifier, type, content, stream, nonce }) {
@@ -205,7 +217,7 @@ export async function getModuleResource(moduleId, runtimeEnvironment, moduleReso
     };
 }
 export function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMeta) {
-    const { isSSR = false, isPreload = false, nonce } = moduleResourceMeta;
+    const { integrity, isSSR = false, isPreload = false, nonce } = moduleResourceMeta;
     const { format } = runtimeEnvironment;
     return {
         src: uri,
@@ -215,6 +227,7 @@ export function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMe
         // only use link preload for ESM for compat reasons.
         // AMD should use regular script tags for preloading
         isPreload: format !== 'amd' && isPreload,
+        integrity,
         nonce,
     };
 }

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.13.0-alpha.14",
+    "version": "0.13.0-alpha.16",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -29,18 +29,21 @@
         "build/**/*.cjs",
         "build/**/*.d.ts"
     ],
+    "scripts": {
+        "build": "tsc -b"
+    },
     "dependencies": {
-        "@lwrjs/app-service": "0.13.0-alpha.14",
-        "@lwrjs/diagnostics": "0.13.0-alpha.14",
-        "@lwrjs/instrumentation": "0.13.0-alpha.14",
-        "@lwrjs/shared-utils": "0.13.0-alpha.14",
+        "@lwrjs/app-service": "0.13.0-alpha.16",
+        "@lwrjs/diagnostics": "0.13.0-alpha.16",
+        "@lwrjs/instrumentation": "0.13.0-alpha.16",
+        "@lwrjs/shared-utils": "0.13.0-alpha.16",
         "lru-cache": "^10.2.2"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.13.0-alpha.14"
+        "@lwrjs/types": "0.13.0-alpha.16"
     },
     "engines": {
         "node": ">=18.0.0"
     },
-    "gitHead": "7276973cd522d9117256026fbd35ca12a9032304"
+    "gitHead": "5aabb958d70a4a962b207da21e852d7a801d7d44"
 }