@lwrjs/view-registry 0.13.0-alpha.2 → 0.13.0-alpha.21

package/build/cjs/index.cjs

@@ -57,7 +57,7 @@ var LwrViewRegistry = class {
     observer.onAssetSourceChange(({payload}) => this.onAssetSourceChange(payload));
   }
   async onModuleDefinitionChange(moduleDefinition) {
-    if (process.env.MRT_HMR === "true") {
+    if ((0, import_shared_utils.isLocalDev)()) {
       this.viewDefinitions.clear();
       return;
     }
@@ -80,7 +80,7 @@ var LwrViewRegistry = class {
     }
   }
   async onViewSourceChange(compiledView) {
-    if (process.env.MRT_HMR === "true") {
+    if ((0, import_shared_utils.isLocalDev)()) {
       this.viewDefinitions.clear();
       return;
     }
@@ -161,7 +161,8 @@ var LwrViewRegistry = class {
       freezeAssets,
       locale: runtimeParams?.locale,
       basePath: runtimeParams?.basePath,
-      debug: runtimeEnvironment.debug
+      debug: runtimeEnvironment.debug,
+      nonceEnabled: (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE
     });
     import_diagnostics.logger.debug(`[view-registry][hasViewDefinition] viewDefId=${viewDefId}`);
     const viewParamKey = viewParamCacheKey ? (0, import_shared_utils.getCacheKeyFromJson)(viewParamCacheKey) : (0, import_shared_utils.getCacheKeyFromJson)(viewParams);
@@ -182,7 +183,8 @@ var LwrViewRegistry = class {
         freezeAssets,
         locale: runtimeParams?.locale,
         basePath: runtimeParams?.basePath,
-        debug: runtimeEnvironment.debug
+        debug: runtimeEnvironment.debug,
+        nonceEnabled: (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE
       });
       import_diagnostics.logger.debug(`[view-registry][getViewDefinition] viewDefCacheKey=${viewDefCacheKey}`);
       const viewParamKey = viewParamCacheKey ? (0, import_shared_utils.getCacheKeyFromJson)(viewParamCacheKey) : (0, import_shared_utils.getCacheKeyFromJson)(viewParams);
@@ -194,6 +196,8 @@ var LwrViewRegistry = class {
           return viewDefinition2.viewDefinition;
         }
       }
+      const updatableViewParams = {...viewParams};
+      (0, import_utils.generateViewNonce)(updatableViewParams);
       const pendingViewDefCacheKey = viewDefCacheKey + viewParamKey;
       const viewDefinition = await this.pendingViewDefinitions.execute(pendingViewDefCacheKey, () => (0, import_instrumentation.getTracer)().trace({
         name: import_instrumentation.ViewSpan.RenderView,
@@ -201,10 +205,12 @@ var LwrViewRegistry = class {
           view: view.id,
           ssr: view.bootstrap?.ssr === true
         }
-      }, () => this.renderView(view, viewParams, runtimeEnvironment, runtimeParams, renderOptions)));
+      }, () => this.renderView(view, updatableViewParams, runtimeEnvironment, runtimeParams, renderOptions)));
+      viewDefinition.nonce = (0, import_utils.getViewNonce)(updatableViewParams);
       if (cacheDisabled === false) {
         const route = this.globalConfig.routes.find((r) => r.id === view.id);
-        const ttl = (0, import_shared_utils.shortestTtl)(viewDefinition.cache?.ttl, route?.cache?.ttl);
+        const maxTtl = process.env.MAX_VIEW_CACHE_TTL && parseInt(process.env.MAX_VIEW_CACHE_TTL, 10);
+        const ttl = (0, import_shared_utils.shortestTtl)(viewDefinition.cache?.ttl, route?.cache?.ttl, maxTtl);
         if (ttl !== 0) {
           this.viewDefinitions.set(viewDefCacheKey, {
             view,
@@ -227,7 +233,7 @@ var LwrViewRegistry = class {
   async renderView(view, viewParams, runtimeEnvironment, runtimeParams = {}, renderOptions) {
     const {id, contentTemplate, rootComponent, layoutTemplate} = view;
     const lwrResourcesId = `__LWR_RESOURCES__${Date.now()}`;
-    const renderedContent = await this.render({id, contentTemplate, rootComponent}, {...viewParams, lwr_resources: lwrResourcesId}, runtimeParams, renderOptions);
+    const renderedContent = await this.render({id, contentTemplate, rootComponent}, {...viewParams, lwr_resources: lwrResourcesId}, runtimeParams, runtimeEnvironment, renderOptions);
     let normalizedRenderOptions = (0, import_utils.normalizeRenderOptions)(this.runtimeEnvironment, renderedContent.options, renderOptions);
     const layout = layoutTemplate || renderedContent.compiledView.layoutTemplate;
     if (!layout) {
@@ -247,7 +253,7 @@ var LwrViewRegistry = class {
       ...viewParams,
       body: renderedContent.renderedView,
       lwr_resources: lwrResourcesId
-    }, runtimeParams);
+    }, runtimeParams, runtimeEnvironment);
     normalizedRenderOptions = (0, import_utils.normalizeRenderOptions)(this.runtimeEnvironment, renderedLayout.options, normalizedRenderOptions);
     const renderedViewDef = await this.link({
       ...renderedLayout,
@@ -285,7 +291,7 @@ var LwrViewRegistry = class {
     });
     return renderedViewDef;
   }
-  async render(viewId, viewParams, runtimeParams, renderOptions) {
+  async render(viewId, viewParams, runtimeParams, runtimeEnvironment, renderOptions) {
     const globalContext = this.globalData;
     const {id, rootComponent, contentTemplate} = viewId;
     const compiledView = await this.getView({id, contentTemplate, rootComponent}, renderOptions?.skipCaching);
@@ -294,7 +300,7 @@ var LwrViewRegistry = class {
       ...globalContext,
       ...compiledView.properties,
       ...viewParams
-    });
+    }, runtimeEnvironment);
     const normalizedResult = (0, import_utils.normalizeRenderedResult)(result);
     return {
       compiledView,
@@ -360,7 +366,8 @@ var LwrViewRegistry = class {
       renderedView: linkedAssetContent,
       immutable,
       viewRecord: {
-        assetReferences: (0, import_utils.reduceSourceAssetReferences)(linkedMetadata.assetReferences)
+        assetReferences: (0, import_utils.reduceSourceAssetReferences)(linkedMetadata.assetReferences),
+        moduleResources: []
       },
       cache: {ttl: pageTtl}
     };

package/build/cjs/linkers/legacy_view_bootstrap.cjs

@@ -49,9 +49,8 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     resourceRegistry,
     viewMetadata
   } = resourceContext;
-  const {lwrVersion, format, hmrEnabled, bundle, debug, minify} = runtimeEnvironment;
+  const {format, hmrEnabled, bundle, debug, minify} = runtimeEnvironment;
   const {customElements, serverData, serverDebug} = viewMetadata;
-  const version = lwrVersion;
   const isAMD = format === "amd";
   const {bundleConfig} = resourceContext;
   const {external = {}, exclude = []} = bundleConfig;
@@ -98,9 +97,12 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   const viewPreloads = {
     uris: [],
     specifiers: [],
-    groups: new Map()
+    groups: new Map(),
+    integrities: new Map()
   };
   const isSSR = view.bootstrap?.ssr;
+  const version = view.bootstrap?.lwrVersion;
+  const nonce = (0, import_utils.getViewNonce)(viewParams);
   let bootstrapModuleRef, versionedSpecifier = bootstrapSpecifier;
   const customElementsRecords = [];
   const flattenedElements = (0, import_utils2.flattenCustomElements)(customElements, isSSR);
@@ -125,6 +127,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       if (!def.inline && !def.src) {
         throw Error(`Invalid Shim ${shimBundle}: ${JSON.stringify(def)}`);
       }
+      (0, import_utils.addExternalScriptNonce)(def, nonce);
       requiredResources.push(def);
       const errorShimDef = await resourceRegistry.getResource({specifier: "lwr-error-shim.js", version}, runtimeEnvironment, runtimeParams);
       if (!errorShimDef) {
@@ -133,6 +136,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       if (!errorShimDef.inline && !errorShimDef.src) {
         throw Error(`Invalid Shim lwr-error-shim.js: ${JSON.stringify(errorShimDef)}`);
       }
+      (0, import_utils.addExternalScriptNonce)(errorShimDef, nonce);
       requiredResources.push(errorShimDef);
     }
     const bootstrapModuleGraph = await (0, import_shared_utils.getModuleGraphs)(bootstrapSpecifier, {includeUris: true, includeLinkedDefinitions: true, depth}, moduleRegistry, defRegistry, runtimeEnvironment, runtimeParams, visitedCache);
@@ -146,11 +150,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!uri) {
       throw Error(`Invalid Module Resource ${versionedSpecifier}`);
     }
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {isPreload: false, isSSR}));
+    const integrity = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, versionedSpecifier);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {integrity, isPreload: false, isSSR, nonce}));
     for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
       const uri2 = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
       if (uri2) {
-        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+        const integrity2 = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, depSpecifier);
+        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, integrity2, groups, viewPreloads);
       }
     }
     if ((0, import_shared_utils.isBundler)(defRegistry)) {
@@ -187,12 +193,14 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!isSSR || (0, import_shared_utils.getHydrateDirective)(props)) {
       const specifier = graph.graphs[0].specifier;
       const uri = graph.uriMap[specifier];
-      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, groups, viewPreloads);
+      const integrity = (0, import_utils2.getBundleIntegrity)(graph, specifier);
+      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, integrity, groups, viewPreloads);
       if (bundle) {
         for (const depSpecifier of graph.graphs[0].static) {
-          const uri2 = getPreloadUri(depSpecifier, graph.uriMap);
-          if (uri2) {
-            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+          const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+          if (depUri) {
+            const integrity2 = (0, import_utils2.getBundleIntegrity)(graph, depSpecifier);
+            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, depUri, integrity2, groups, viewPreloads);
           }
         }
       }
@@ -211,6 +219,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     }
   }));
   if (viewContainsLiveElements) {
+    if ((0, import_shared_utils.isLocalDev)()) {
+      const localDevSpecifier = "lwr_local_dev/bootstrap";
+      rootComponents.push(localDevSpecifier);
+      const localDevMod = await (0, import_utils.getModuleResource)({specifier: localDevSpecifier, version: ""}, runtimeEnvironment, {}, moduleRegistry, runtimeParams);
+      if (localDevMod.src)
+        imports[localDevSpecifier] = localDevMod.src;
+    }
     configResources.unshift((0, import_utils2.getViewBootstrapConfigurationResource)({
       id: view.id,
       url: viewParams?.page?.url,
@@ -235,7 +250,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   }
   const dedupedUris = [...new Set(viewPreloads.uris)];
   for (const preloadUri of dedupedUris) {
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {isPreload: true, isSSR}));
+    const integrity = viewPreloads.integrities.get(preloadUri);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {
+      integrity,
+      isPreload: true,
+      isSSR,
+      nonce
+    }));
   }
   const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(import_utils.generateHtmlTag));
   return {
@@ -243,6 +264,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     viewRecord: {
       resources: requiredResources,
       customElements: customElementsRecords,
+      moduleResources,
       bootstrapModule: bootstrapModuleRef
     }
   };

package/build/cjs/linkers/preload-utils.cjs

@@ -29,7 +29,7 @@ __export(exports, {
 });
 var import_diagnostics = __toModule(require("@lwrjs/diagnostics"));
 var import_shared_utils = __toModule(require("@lwrjs/shared-utils"));
-function setPreloadModulesMeta(specifier, uri, groups, preloads) {
+function setPreloadModulesMeta(specifier, uri, integrity, groups, preloads) {
   if (!uri) {
     throw (0, import_diagnostics.createSingleDiagnosticError)({
       description: import_diagnostics.descriptions.UNRESOLVABLE.PRELOAD_MODULE(specifier)
@@ -41,6 +41,7 @@ function setPreloadModulesMeta(specifier, uri, groups, preloads) {
   const preloadModulesSpecifiers = preloads.specifiers;
   const preloadBundleGroupsMap = preloads.groups;
   const preloadModulesURIs = preloads.uris;
+  const preloadModuleIntegrities = preloads.integrities;
   preloadModulesSpecifiers.push(specifier);
   const {specifier: unversionedSpecifier} = (0, import_shared_utils.explodeSpecifier)(specifier);
   const groupName = (0, import_shared_utils.getGroupName)(unversionedSpecifier, groups);
@@ -49,6 +50,7 @@ function setPreloadModulesMeta(specifier, uri, groups, preloads) {
   }
   preloadModulesURIs.push(uri);
   groupName && preloadBundleGroupsMap.set(groupName, true);
+  preloadModuleIntegrities.set(uri, integrity);
 }
 async function getPreloadModulesMeta(specifier, viewPreloads, bundleConfig, moduleRegistry, defRegistry, runtimeEnvironment, runtimeParams, pending) {
   const {exclude = [], external = {}, groups = {}} = bundleConfig;
@@ -72,9 +74,10 @@ async function getPreloadModulesMeta(specifier, viewPreloads, bundleConfig, modu
     });
     const uri = await defRegistry.resolveModuleUri(versionedModuleId, runtimeEnvironment, runtimeParams);
     const normalizedSpecifier = versionedModuleId.version === import_shared_utils.VERSION_NOT_PROVIDED ? specifier : versionedModuleSpecifier;
-    setPreloadModulesMeta(normalizedSpecifier, uri, groups, viewPreloads);
+    const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
+    const {integrity} = preloadModuleRecord;
+    setPreloadModulesMeta(normalizedSpecifier, uri, integrity, groups, viewPreloads);
     if (exclude.length || Object.keys(groups).length) {
-      const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
       const {imports} = preloadModuleRecord.bundleRecord;
       if (imports) {
         if (!pending) {

package/build/cjs/linkers/utils.cjs

@@ -25,6 +25,7 @@ var __toModule = (module2) => {
 __markAsModule(exports);
 __export(exports, {
   flattenCustomElements: () => flattenCustomElements,
+  getBundleIntegrity: () => getBundleIntegrity,
   getViewBootstrapConfigurationResource: () => getViewBootstrapConfigurationResource,
   getViewHmrConfigurationResource: () => getViewHmrConfigurationResource
 });
@@ -72,6 +73,7 @@ function getViewBootstrapConfigurationResource(viewInfo, config, runtimeEnvironm
       type: CONTENT_TYPE,
       content: configString,
       inline: false,
+      integrity: (0, import_shared_utils.createIntegrityHash)(configString),
       src: url
     };
   } else {
@@ -129,3 +131,8 @@ function flattenCustomElements(arr, isSSR = false) {
   flatten(arr);
   return ret;
 }
+function getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier) {
+  const def = bootstrapModuleGraph.linkedDefinitions[versionedSpecifier];
+  const integrity = def?.integrity;
+  return integrity;
+}

package/build/cjs/linkers/view_bootstrap.cjs

@@ -41,10 +41,9 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     resourceRegistry,
     viewMetadata
   } = resourceContext;
-  const {lwrVersion, format, hmrEnabled, bundle, debug, minify} = runtimeEnvironment;
+  const {format, hmrEnabled, bundle, debug, minify} = runtimeEnvironment;
   const {customElements, serverData, serverDebug} = viewMetadata;
   const defRegistry = bundle ? moduleBundler : moduleRegistry;
-  const version = lwrVersion;
   const isAMD = format === "amd";
   const depth = isAMD ? {static: import_shared_utils.GraphDepth.ALL, dynamic: 1} : {static: import_shared_utils.GraphDepth.NONE, dynamic: 1};
   const {bundleConfig} = resourceContext;
@@ -87,9 +86,12 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   const viewPreloads = {
     uris: [],
     specifiers: [],
-    groups: new Map()
+    groups: new Map(),
+    integrities: new Map()
   };
   const isSSR = view.bootstrap?.ssr;
+  const version = view.bootstrap?.lwrVersion;
+  const nonce = (0, import_utils.getViewNonce)(viewParams);
   let bootstrapModuleRef, versionedSpecifier = bootstrapSpecifier;
   let importMetadata = {imports: {}};
   const customElementsRecords = [];
@@ -105,6 +107,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       if (!def.inline && !def.src) {
         throw Error(`Invalid Shim ${shimBundle}: ${JSON.stringify(def)}`);
       }
+      (0, import_utils.addExternalScriptNonce)(def, nonce);
       requiredResources.push(def);
       const errorShimDef = await resourceRegistry.getResource({specifier: "lwr-error-shim.js", version}, runtimeEnvironment, runtimeParams);
       if (!errorShimDef) {
@@ -113,6 +116,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       if (!errorShimDef.inline && !errorShimDef.src) {
         throw Error(`Invalid Shim lwr-error-shim.js: ${JSON.stringify(errorShimDef)}`);
       }
+      (0, import_utils.addExternalScriptNonce)(errorShimDef, nonce);
       requiredResources.push(errorShimDef);
     }
     const bootstrapModuleGraph = await (0, import_shared_utils.getModuleGraphs)(bootstrapSpecifier, {includeUris: true, includeLinkedDefinitions: true, depth}, moduleRegistry, defRegistry, runtimeEnvironment, runtimeParams, visitedCache);
@@ -126,11 +130,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!uri) {
       throw Error(`Invalid Module Resource ${versionedSpecifier}`);
     }
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {isPreload: false, isSSR}));
+    const integrity = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, versionedSpecifier);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(uri, runtimeEnvironment, {integrity, isPreload: false, isSSR, nonce}));
     for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
       const uri2 = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
       if (uri2) {
-        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+        const integrity2 = (0, import_utils2.getBundleIntegrity)(bootstrapModuleGraph, depSpecifier);
+        (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, integrity2, groups, viewPreloads);
       }
     }
     if ((0, import_shared_utils.isBundler)(defRegistry)) {
@@ -168,12 +174,14 @@ async function getHtmlResources(view, viewParams, resourceContext) {
     if (!isSSR || (0, import_shared_utils.getHydrateDirective)(props)) {
       const specifier = graph.graphs[0].specifier;
       const uri = graph.uriMap[specifier];
-      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, groups, viewPreloads);
+      const integrity = (0, import_utils2.getBundleIntegrity)(graph, specifier);
+      (0, import_preload_utils.setPreloadModulesMeta)(specifier, uri, integrity, groups, viewPreloads);
       if (bundle) {
         for (const depSpecifier of graph.graphs[0].static) {
-          const uri2 = getPreloadUri(depSpecifier, graph.uriMap);
-          if (uri2) {
-            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, uri2, groups, viewPreloads);
+          const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+          if (depUri) {
+            const integrity2 = (0, import_utils2.getBundleIntegrity)(graph, depSpecifier);
+            (0, import_preload_utils.setPreloadModulesMeta)(depSpecifier, depUri, integrity2, groups, viewPreloads);
           }
         }
       }
@@ -215,7 +223,13 @@ async function getHtmlResources(view, viewParams, resourceContext) {
   }
   const dedupedUris = [...new Set(viewPreloads.uris)];
   for (const preloadUri of dedupedUris) {
-    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {isPreload: true, isSSR}));
+    const integrity = viewPreloads.integrities.get(preloadUri);
+    moduleResources.push((0, import_utils.getModuleResourceByUri)(preloadUri, runtimeEnvironment, {
+      integrity,
+      isPreload: true,
+      isSSR,
+      nonce
+    }));
   }
   const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(import_utils.generateHtmlTag));
   const mapping = (0, import_shared_utils.getMappingUriPrefix)(runtimeEnvironment, runtimeParams);
@@ -231,6 +245,7 @@ async function getHtmlResources(view, viewParams, resourceContext) {
       customElements: customElementsRecords,
       endpoints,
       importMetadata,
+      moduleResources,
       bootstrapModule: bootstrapModuleRef
     }
   };

package/build/cjs/utils.cjs

@@ -24,11 +24,14 @@ var __toModule = (module2) => {
 // packages/@lwrjs/view-registry/src/utils.ts
 __markAsModule(exports);
 __export(exports, {
+  addExternalScriptNonce: () => addExternalScriptNonce,
   createJsonModule: () => createJsonModule,
   generateHtmlTag: () => generateHtmlTag,
   generatePageContext: () => generatePageContext,
+  generateViewNonce: () => generateViewNonce,
   getModuleResource: () => getModuleResource,
   getModuleResourceByUri: () => getModuleResourceByUri,
+  getViewNonce: () => getViewNonce,
   isViewResponse: () => isViewResponse,
   normalizeRenderOptions: () => normalizeRenderOptions,
   normalizeRenderedResult: () => normalizeRenderedResult,
@@ -38,17 +41,26 @@ __export(exports, {
 var import_path = __toModule(require("path"));
 var import_shared_utils = __toModule(require("@lwrjs/shared-utils"));
 var import_identity = __toModule(require("@lwrjs/app-service/identity"));
+var import_crypto = __toModule(require("crypto"));
 function generateExternalStyle(src) {
   return `<link rel="stylesheet" href="${src}">`;
 }
-function generateExternalScript(type = "application/javascript", src, async, defer) {
+function generateExternalScript(type = "application/javascript", src, async, defer, nonce, integrity) {
   let scriptLoadOrder = "";
   if (defer) {
     scriptLoadOrder = " defer";
   } else if (async) {
     scriptLoadOrder = " async";
   }
-  return `<script type="${type}"${scriptLoadOrder} src="${src}"></script>`;
+  let cspHashAttr = "";
+  if ((0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE) {
+    if (integrity) {
+      cspHashAttr = ` integrity="${integrity}"`;
+    } else if (nonce) {
+      cspHashAttr = ` nonce="${nonce}"`;
+    }
+  }
+  return `<script type="${type}"${scriptLoadOrder}${cspHashAttr} src="${src}"></script>`;
 }
 function generateLinkPreloadTag({href, type}) {
   if (type === "module") {
@@ -57,19 +69,27 @@ function generateLinkPreloadTag({href, type}) {
     return `<link rel="preload" href="${href}" type="${type}" />`;
   }
 }
-function generateExternalTag({type, src = "", async, defer, isPreload}) {
+function generateExternalTag({
+  type,
+  src = "",
+  async,
+  defer,
+  isPreload,
+  nonce,
+  integrity
+}) {
   if (isPreload) {
     return generateLinkPreloadTag({href: src, type});
   } else if (type === "text/css") {
     return generateExternalStyle(src);
   } else {
-    return generateExternalScript(type, src, async, defer);
+    return generateExternalScript(type, src, async, defer, nonce, integrity);
   }
 }
 async function generateInlineTag({specifier, type, content, stream, nonce}) {
   const typeStr = type === "text/css" ? "" : ` type="${type}"`;
   const tag = type === "text/css" ? "style" : "script";
-  const nonceStr = nonce ? ` nonce="${nonce}"` : "";
+  const nonceStr = (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE && nonce && nonce ? ` nonce="${nonce}"` : "";
   if (!content && !stream) {
     throw new Error(`Invalid inline Resource Definition: must have either "content" or "stream": "${specifier}"`);
   }
@@ -223,14 +243,16 @@ async function getModuleResource(moduleId, runtimeEnvironment, moduleResourceMet
   };
 }
 function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMeta) {
-  const {isSSR = false, isPreload = false} = moduleResourceMeta;
+  const {integrity, isSSR = false, isPreload = false, nonce} = moduleResourceMeta;
   const {format} = runtimeEnvironment;
   return {
     src: uri,
     type: format === "amd" ? "application/javascript" : "module",
     async: !isSSR && isPreload,
     defer: isSSR,
-    isPreload: format !== "amd" && isPreload
+    isPreload: format !== "amd" && isPreload,
+    integrity,
+    nonce
   };
 }
 async function createJsonModule(specifier, moduleRegistry, environment, params) {
@@ -252,3 +274,21 @@ async function createJsonModule(specifier, moduleRegistry, environment, params)
     }
   };
 }
+function getViewNonce(viewParams) {
+  return (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE ? viewParams?.page?.nonce : void 0;
+}
+function generateViewNonce(viewParams) {
+  if ((0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE) {
+    const nonce = import_crypto.default.randomBytes(16).toString("base64");
+    if (!viewParams.page) {
+      viewParams.page = {nonce};
+    } else {
+      viewParams.page.nonce = nonce;
+    }
+  }
+}
+function addExternalScriptNonce(def, nonce) {
+  if (nonce && (0, import_shared_utils.getFeatureFlags)().ENABLE_NONCE && !def.inline) {
+    def.nonce = nonce;
+  }
+}

package/build/cjs/view-handler.cjs

@@ -130,6 +130,8 @@ var LwrViewHandler = class {
     const paths = {rootDir, assets, contentDir, layoutsDir};
     const locale = runtimeParams.locale;
     const basePath = runtimeParams.basePath;
+    const assetBasePath = runtimeParams.assetBasePath;
+    const uiBasePath = runtimeParams.assetBasePath;
     const viewApi = this.getBoundApi(viewRequest, route, runtimeEnvironment, runtimeParams);
     const response = await (0, import_instrumentation.getTracer)().trace({
       name: import_instrumentation.ViewSpan.ExecuteRouteHandler,
@@ -139,7 +141,7 @@ var LwrViewHandler = class {
       }
     }, async () => {
       try {
-        return await routeHandlerFn({...viewRequest, locale, basePath}, {route, viewApi, ...paths}, routeHandlerOptions);
+        return await routeHandlerFn({...viewRequest, locale, basePath, assetBasePath, uiBasePath}, {route, viewApi, ...paths}, routeHandlerOptions);
       } catch (err) {
         if (err instanceof import_diagnostics.DiagnosticsError) {
           throw err;
@@ -148,6 +150,9 @@ var LwrViewHandler = class {
         throw (0, import_diagnostics.createSingleDiagnosticError)({description: import_diagnostics.descriptions.APPLICATION.ROUTE_HANDLER_ERROR(route.id, message)}, import_diagnostics.LwrApplicationError);
       }
     });
+    if (response?.locale) {
+      runtimeParams.locale = response.locale;
+    }
     return response;
   }
   getBoundApi(viewRequest, route, runtimeEnvironment, runtimeParams) {
@@ -164,6 +169,9 @@ var LwrViewHandler = class {
   async getViewResponse(viewRequest, route, runtimeEnvironment, runtimeParams = {}, view, viewParams, renderOptions) {
     const {id, bootstrap} = route;
     const managedView = {...view, id, bootstrap};
+    if (view.locale) {
+      runtimeParams.locale = view.locale;
+    }
     const viewResponse = {
       view: managedView,
       viewParams,

package/build/es/index.js

@@ -1,7 +1,8 @@
-import { InflightTasks, createStringBuilder, extractMetadataFromHtml, getCacheKeyFromJson, getSpecifier, normalizeResourcePath, shortestTtl, } from '@lwrjs/shared-utils';
+import { InflightTasks, createStringBuilder, extractMetadataFromHtml, getCacheKeyFromJson, getFeatureFlags, getSpecifier, isLocalDev, normalizeResourcePath, shortestTtl, } from '@lwrjs/shared-utils';
 import { getTracer, ViewSpan } from '@lwrjs/instrumentation';
-import { normalizeRenderOptions, normalizeRenderedResult, reduceSourceAssetReferences } from './utils.js';
+import { generateViewNonce, getViewNonce, normalizeRenderOptions, normalizeRenderedResult, reduceSourceAssetReferences, } from './utils.js';
 import { linkLwrResources } from './linkers/link-lwr-resources.js';
+// TODO: investigate perf impact W-16056356
 import { LRUCache } from 'lru-cache';
 import { DiagnosticsError, LwrServerError, createSingleDiagnosticError, descriptions, logger, } from '@lwrjs/diagnostics';
 export { LwrViewHandler } from './view-handler.js';
@@ -37,7 +38,7 @@ export class LwrViewRegistry {
     }
     async onModuleDefinitionChange(moduleDefinition) {
         // TODO we will make this more robust in the future w/ full MRT HMR
-        if (process.env.MRT_HMR === 'true') {
+        if (isLocalDev()) {
             this.viewDefinitions.clear();
             return;
         }
@@ -63,7 +64,7 @@ export class LwrViewRegistry {
     }
     async onViewSourceChange(compiledView) {
         // TODO we will make this more robust in the future w/ full MRT HMR
-        if (process.env.MRT_HMR === 'true') {
+        if (isLocalDev()) {
             this.viewDefinitions.clear();
             return;
         }
@@ -150,9 +151,11 @@ export class LwrViewRegistry {
             locale: runtimeParams?.locale,
             basePath: runtimeParams?.basePath,
             debug: runtimeEnvironment.debug,
+            // Add a variable on if the nonce is enabled
+            nonceEnabled: getFeatureFlags().ENABLE_NONCE,
         });
         logger.debug(`[view-registry][hasViewDefinition] viewDefId=${viewDefId}`);
-        // viewParams is an unbounded object and can be very large (17MB/view for developer.salesforce.com). Allowing conusmers
+        // viewParams is an unbounded object and can be very large (17MB/view for developer.salesforce.com). Allowing consumers
         // to provide a simple override avoids the excess memory / performance overhead of serializing & storing the viewParams
         // on every request, while still reusing our caching logic.
         const viewParamKey = viewParamCacheKey
@@ -177,6 +180,8 @@ export class LwrViewRegistry {
                 locale: runtimeParams?.locale,
                 basePath: runtimeParams?.basePath,
                 debug: runtimeEnvironment.debug,
+                // Add a variable on if the nonce is enabled
+                nonceEnabled: getFeatureFlags().ENABLE_NONCE,
             });
             logger.debug(`[view-registry][getViewDefinition] viewDefCacheKey=${viewDefCacheKey}`);
             // viewParams is an unbounded object and can be very large (17MB/view for developer.salesforce.com). Allowing consumers
@@ -196,6 +201,9 @@ export class LwrViewRegistry {
                     return viewDefinition.viewDefinition;
                 }
             }
+            // If we missed cache generate a nonce in the page context (we do not want it part of the cache key)
+            const updatableViewParams = { ...viewParams };
+            generateViewNonce(updatableViewParams);
             const pendingViewDefCacheKey = viewDefCacheKey + viewParamKey;
             const viewDefinition = await this.pendingViewDefinitions.execute(pendingViewDefCacheKey, () => getTracer().trace({
                 name: ViewSpan.RenderView,
@@ -203,10 +211,14 @@ export class LwrViewRegistry {
                     view: view.id,
                     ssr: view.bootstrap?.ssr === true,
                 },
-            }, () => this.renderView(view, viewParams, runtimeEnvironment, runtimeParams, renderOptions)));
+            }, () => this.renderView(view, updatableViewParams, runtimeEnvironment, runtimeParams, renderOptions)));
+            // Once the view is generated add the nonce to the response so it can be cached and then added to the headers
+            viewDefinition.nonce = getViewNonce(updatableViewParams);
             if (cacheDisabled === false) {
                 const route = this.globalConfig.routes.find((r) => r.id === view.id);
-                const ttl = shortestTtl(viewDefinition.cache?.ttl, route?.cache?.ttl);
+                // optionally set a max TTL on the view registry cache
+                const maxTtl = process.env.MAX_VIEW_CACHE_TTL && parseInt(process.env.MAX_VIEW_CACHE_TTL, 10);
+                const ttl = shortestTtl(viewDefinition.cache?.ttl, route?.cache?.ttl, maxTtl);
                 if (ttl !== 0) {
                     // cache view definition for the shortest ttl or until it is the least recently used when ttl is undefined
                     this.viewDefinitions.set(viewDefCacheKey, {
@@ -233,7 +245,7 @@ export class LwrViewRegistry {
     async renderView(view, viewParams, runtimeEnvironment, runtimeParams = {}, renderOptions) {
         const { id, contentTemplate, rootComponent, layoutTemplate } = view;
         const lwrResourcesId = `__LWR_RESOURCES__${Date.now()}`;
-        const renderedContent = await this.render({ id, contentTemplate, rootComponent }, { ...viewParams, lwr_resources: lwrResourcesId }, runtimeParams, renderOptions);
+        const renderedContent = await this.render({ id, contentTemplate, rootComponent }, { ...viewParams, lwr_resources: lwrResourcesId }, runtimeParams, runtimeEnvironment, renderOptions);
         // normalize the renderOptions provided by the CompiledView content with the request options.
         let normalizedRenderOptions = normalizeRenderOptions(this.runtimeEnvironment, renderedContent.options, renderOptions);
         const layout = layoutTemplate || renderedContent.compiledView.layoutTemplate;
@@ -257,7 +269,7 @@ export class LwrViewRegistry {
             ...viewParams,
             body: renderedContent.renderedView,
             lwr_resources: lwrResourcesId,
-        }, runtimeParams);
+        }, runtimeParams, runtimeEnvironment);
         normalizedRenderOptions = normalizeRenderOptions(this.runtimeEnvironment, renderedLayout.options, normalizedRenderOptions);
         const renderedViewDef = await this.link({
             ...renderedLayout,
@@ -301,7 +313,7 @@ export class LwrViewRegistry {
         });
         return renderedViewDef;
     }
-    async render(viewId, viewParams, runtimeParams, renderOptions) {
+    async render(viewId, viewParams, runtimeParams, runtimeEnvironment, renderOptions) {
         const globalContext = this.globalData;
         const { id, rootComponent, contentTemplate } = viewId;
         const compiledView = await this.getView({ id, contentTemplate, rootComponent }, renderOptions?.skipCaching);
@@ -320,7 +332,7 @@ export class LwrViewRegistry {
             ...globalContext,
             ...compiledView.properties,
             ...viewParams,
-        });
+        }, runtimeEnvironment);
         const normalizedResult = normalizeRenderedResult(result);
         return {
             compiledView,
@@ -345,6 +357,7 @@ export class LwrViewRegistry {
             importer: importer || renderedView.compiledView.filePath,
         };
         const stringBuilder = createStringBuilder(renderedViewContent);
+        // Note: this is the TTL for the page NOT for the view registry cache
         let pageTtl = renderedView.cache.ttl;
         for (const viewTransformer of this.viewTransformers) {
             // eslint-disable-next-line no-await-in-loop
@@ -384,6 +397,7 @@ export class LwrViewRegistry {
             immutable,
             viewRecord: {
                 assetReferences: reduceSourceAssetReferences(linkedMetadata.assetReferences),
+                moduleResources: [],
             },
             cache: { ttl: pageTtl },
         };

package/build/es/linkers/legacy_view_bootstrap.js

@@ -1,8 +1,8 @@
 import { logger } from '@lwrjs/diagnostics';
-import { kebabCaseToModuleSpecifier, getModuleGraphs, GraphDepth, getModuleUriPrefix, explodeSpecifier, isBundler, getHydrateDirective, isGroupie, isExternalSpecifier, } from '@lwrjs/shared-utils';
+import { kebabCaseToModuleSpecifier, getModuleGraphs, GraphDepth, getModuleUriPrefix, explodeSpecifier, isBundler, getHydrateDirective, isGroupie, isExternalSpecifier, isLocalDev, } from '@lwrjs/shared-utils';
 import { AppResourceEnum, getAppSpecifier } from '@lwrjs/app-service/identity';
-import { generateHtmlTag, getModuleResourceByUri } from '../utils.js';
-import { flattenCustomElements, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
+import { addExternalScriptNonce, generateHtmlTag, getModuleResource, getModuleResourceByUri, getViewNonce, } from '../utils.js';
+import { flattenCustomElements, getBundleIntegrity, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
 import { setPreloadModulesMeta, getPreloadModulesMeta } from './preload-utils.js';
 function includeIdFactory(bundleConfig) {
     return (moduleRef) => {
@@ -17,9 +17,8 @@ function includeIdFactory(bundleConfig) {
 }
 export async function getHtmlResources(view, viewParams, resourceContext) {
     const { runtimeEnvironment, runtimeParams, moduleRegistry, moduleBundler, resourceRegistry, viewMetadata, } = resourceContext;
-    const { lwrVersion, format, hmrEnabled, bundle, debug, minify } = runtimeEnvironment;
+    const { format, hmrEnabled, bundle, debug, minify } = runtimeEnvironment;
     const { customElements, serverData, serverDebug } = viewMetadata;
-    const version = lwrVersion;
     const isAMD = format === 'amd';
     const { bundleConfig } = resourceContext;
     const { external = {}, exclude = [] } = bundleConfig;
@@ -89,9 +88,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         uris: [],
         specifiers: [],
         groups: new Map(),
+        integrities: new Map(),
     };
     // Determine if server side rendering view modules
     const isSSR = view.bootstrap?.ssr;
+    // Determine the LWR client version
+    const version = view.bootstrap?.lwrVersion;
+    // Page level nonce for script tags
+    const nonce = getViewNonce(viewParams);
     // ABS module and custom element references
     let bootstrapModuleRef, versionedSpecifier = bootstrapSpecifier;
     const customElementsRecords = [];
@@ -107,7 +111,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             let def = (await resourceRegistry.getResource({ specifier: shimBundle, version }, runtimeEnvironment, runtimeParams));
             if (!def) {
                 // HACK: fallback to looking for the other shim.
-                // TODO: remove this once we solve debug mode in MRT
+                // TODO: remove this once KJ fixes W-15953000
                 let fallbackShimBundle;
                 if (shimBundle === 'lwr-loader-shim-legacy.bundle.js') {
                     fallbackShimBundle = 'lwr-loader-shim-legacy.bundle.min.js';
@@ -126,6 +130,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             if (!def.inline && !def.src) {
                 throw Error(`Invalid Shim ${shimBundle}: ${JSON.stringify(def)}`);
             }
+            addExternalScriptNonce(def, nonce);
             requiredResources.push(def);
             // Always inline the error shim script after the shim
             const errorShimDef = (await resourceRegistry.getResource({ specifier: 'lwr-error-shim.js', version }, runtimeEnvironment, runtimeParams));
@@ -136,6 +141,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             if (!errorShimDef.inline && !errorShimDef.src) {
                 throw Error(`Invalid Shim lwr-error-shim.js: ${JSON.stringify(errorShimDef)}`);
             }
+            addExternalScriptNonce(errorShimDef, nonce);
             requiredResources.push(errorShimDef);
         }
         // ------- Application Bootstrap module
@@ -155,12 +161,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         if (!uri) {
             throw Error(`Invalid Module Resource ${versionedSpecifier}`);
         }
-        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { isPreload: false, isSSR }));
+        const integrity = getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier);
+        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { integrity, isPreload: false, isSSR, nonce }));
         // PRELOAD the bootstrap module static dependencies as preloaded script resources
         for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
             const uri = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
             if (uri) {
-                setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                const integrity = getBundleIntegrity(bootstrapModuleGraph, depSpecifier);
+                setPreloadModulesMeta(depSpecifier, uri, integrity, groups, viewPreloads);
             }
         }
         // PRELOAD configured preloadModules as preloaded script resources
@@ -210,13 +218,15 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             // PRELOAD the custom element module as a link resource
             const specifier = graph.graphs[0].specifier;
             const uri = graph.uriMap[specifier];
-            setPreloadModulesMeta(specifier, uri, groups, viewPreloads);
+            const integrity = getBundleIntegrity(graph, specifier);
+            setPreloadModulesMeta(specifier, uri, integrity, groups, viewPreloads);
             // PRELOAD custom element static deps as link resources when bundling is ON
             if (bundle) {
                 for (const depSpecifier of graph.graphs[0].static) {
-                    const uri = getPreloadUri(depSpecifier, graph.uriMap);
-                    if (uri) {
-                        setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                    const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+                    if (depUri) {
+                        const integrity = getBundleIntegrity(graph, depSpecifier);
+                        setPreloadModulesMeta(depSpecifier, depUri, integrity, groups, viewPreloads);
                     }
                 }
             }
@@ -238,6 +248,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         }
     }));
     if (viewContainsLiveElements) {
+        if (isLocalDev()) {
+            // ADD the client-side bootstrap module and mapping for local-dev
+            const localDevSpecifier = 'lwr_local_dev/bootstrap';
+            rootComponents.push(localDevSpecifier);
+            const localDevMod = await getModuleResource({ specifier: localDevSpecifier, version: '' }, runtimeEnvironment, {}, moduleRegistry, runtimeParams);
+            if (localDevMod.src)
+                imports[localDevSpecifier] = localDevMod.src;
+        }
         // ADD configuration of the bootstrapModule
         configResources.unshift(getViewBootstrapConfigurationResource({
             id: view.id,
@@ -265,7 +283,13 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
     const dedupedUris = [...new Set(viewPreloads.uris)];
     // PRELOAD script resources for preload module URIs after the bootstrap module
     for (const preloadUri of dedupedUris) {
-        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, { isPreload: true, isSSR }));
+        const integrity = viewPreloads.integrities.get(preloadUri);
+        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, {
+            integrity,
+            isPreload: true,
+            isSSR,
+            nonce,
+        }));
     }
     // generate html partial
     const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(generateHtmlTag));
@@ -274,6 +298,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         viewRecord: {
             resources: requiredResources,
             customElements: customElementsRecords,
+            moduleResources,
             bootstrapModule: bootstrapModuleRef,
         },
     };

package/build/es/linkers/preload-utils.d.ts

@@ -3,11 +3,12 @@ export type ViewPreloads = {
     groups: Map<string, boolean>;
     uris: string[];
     specifiers: string[];
+    integrities: Map<string, string | undefined>;
 };
 /**
  * keeps track of preloadModules metadata
  */
-export declare function setPreloadModulesMeta(specifier: string, uri: string, groups: BundleGroups, preloads: ViewPreloads): void;
+export declare function setPreloadModulesMeta(specifier: string, uri: string, integrity: string | undefined, groups: BundleGroups, preloads: ViewPreloads): void;
 /**
  * Recursively gets preloadModules metadata starting with a specifier
  * Note: don't call me unless you got bundles

package/build/es/linkers/preload-utils.js

@@ -3,7 +3,7 @@ import { explodeSpecifier, getGroupName, getVersionedModuleId, normalizeVersionT
 /**
  * keeps track of preloadModules metadata
  */
-export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
+export function setPreloadModulesMeta(specifier, uri, integrity, groups, preloads) {
     // Throw a very specific error if we get this back and the uri property is not set
     if (!uri) {
         throw createSingleDiagnosticError({
@@ -20,6 +20,7 @@ export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
     const preloadModulesSpecifiers = preloads.specifiers;
     const preloadBundleGroupsMap = preloads.groups;
     const preloadModulesURIs = preloads.uris;
+    const preloadModuleIntegrities = preloads.integrities;
     preloadModulesSpecifiers.push(specifier);
     const { specifier: unversionedSpecifier } = explodeSpecifier(specifier);
     const groupName = getGroupName(unversionedSpecifier, groups);
@@ -29,6 +30,7 @@ export function setPreloadModulesMeta(specifier, uri, groups, preloads) {
     // With bundling groups, we only want to include one URI
     preloadModulesURIs.push(uri);
     groupName && preloadBundleGroupsMap.set(groupName, true);
+    preloadModuleIntegrities.set(uri, integrity);
 }
 /**
  * Recursively gets preloadModules metadata starting with a specifier
@@ -60,12 +62,13 @@ viewPreloads, bundleConfig, moduleRegistry, defRegistry, runtimeEnvironment, run
         const uri = 
         // eslint-disable-next-line no-await-in-loop
         await defRegistry.resolveModuleUri(versionedModuleId, runtimeEnvironment, runtimeParams);
-        // fallback to unversioned specifier if needed
+        // fallback to un-versioned specifier if needed
         const normalizedSpecifier = versionedModuleId.version === VERSION_NOT_PROVIDED ? specifier : versionedModuleSpecifier;
-        setPreloadModulesMeta(normalizedSpecifier, uri, groups, viewPreloads);
+        // Will set the integrity after loading the record below
+        const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
+        const { integrity } = preloadModuleRecord;
+        setPreloadModulesMeta(normalizedSpecifier, uri, integrity, groups, viewPreloads);
         if (exclude.length || Object.keys(groups).length) {
-            // check if we need to also preload any excluded dependencies of this preload module
-            const preloadModuleRecord = await defRegistry.getModuleBundle(versionedModuleId, runtimeEnvironment, runtimeParams);
             const { imports } = preloadModuleRecord.bundleRecord;
             if (imports) {
                 if (!pending) {

package/build/es/linkers/utils.d.ts

@@ -1,5 +1,6 @@
-import type { ClientBootstrapConfig, RuntimeEnvironment, RuntimeParams, ResourceDefinition, RenderedViewMetadata, CustomElementReference, View, ViewInfo } from '@lwrjs/types';
+import type { ClientBootstrapConfig, RuntimeEnvironment, RuntimeParams, ResourceDefinition, RenderedViewMetadata, CustomElementReference, View, ViewInfo, FlattenedModuleGraphs } from '@lwrjs/types';
 export declare function getViewBootstrapConfigurationResource(viewInfo: ViewInfo, config: ClientBootstrapConfig, runtimeEnvironment: RuntimeEnvironment, runtimeParams: RuntimeParams, debugMessage?: string): ResourceDefinition;
 export declare function getViewHmrConfigurationResource(view: View, viewMetadata: RenderedViewMetadata): ResourceDefinition;
 export declare function flattenCustomElements(arr: CustomElementReference[], isSSR?: boolean): CustomElementReference[];
+export declare function getBundleIntegrity(bootstrapModuleGraph: FlattenedModuleGraphs, versionedSpecifier: string): string | undefined;
 //# sourceMappingURL=utils.d.ts.map

package/build/es/linkers/utils.js

@@ -1,4 +1,4 @@
-import { buildEnvironmentContext, getMappingUriPrefix, getModuleUriPrefix, getClientBootstrapConfigurationUri, hashContent, } from '@lwrjs/shared-utils';
+import { buildEnvironmentContext, getMappingUriPrefix, getModuleUriPrefix, getClientBootstrapConfigurationUri, hashContent, createIntegrityHash, } from '@lwrjs/shared-utils';
 const CONTENT_TYPE = 'application/javascript';
 export function getViewBootstrapConfigurationResource(viewInfo, config, runtimeEnvironment, runtimeParams, debugMessage) {
     const { compat, debug, hmrEnabled, apiVersion, format } = runtimeEnvironment;
@@ -49,6 +49,7 @@ export function getViewBootstrapConfigurationResource(viewInfo, config, runtimeE
             type: CONTENT_TYPE,
             content: configString,
             inline: false,
+            integrity: createIntegrityHash(configString),
             src: url,
         };
     }
@@ -111,4 +112,9 @@ export function flattenCustomElements(arr, isSSR = false) {
     flatten(arr);
     return ret;
 }
+export function getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier) {
+    const def = bootstrapModuleGraph.linkedDefinitions[versionedSpecifier];
+    const integrity = def?.integrity;
+    return integrity;
+}
 //# sourceMappingURL=utils.js.map

package/build/es/linkers/view_bootstrap.js

@@ -1,15 +1,14 @@
 import { logger } from '@lwrjs/diagnostics';
 import { kebabCaseToModuleSpecifier, toImportMetadata, getModuleGraphs, getMappingUriPrefix, GraphDepth, explodeSpecifier, isBundler, getHydrateDirective, isGroupie, } from '@lwrjs/shared-utils';
 import { AppResourceEnum, getAppSpecifier } from '@lwrjs/app-service/identity';
-import { generateHtmlTag, getModuleResourceByUri } from '../utils.js';
-import { flattenCustomElements, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
+import { addExternalScriptNonce, generateHtmlTag, getModuleResourceByUri, getViewNonce } from '../utils.js';
+import { flattenCustomElements, getBundleIntegrity, getViewBootstrapConfigurationResource, getViewHmrConfigurationResource, } from './utils.js';
 import { setPreloadModulesMeta, getPreloadModulesMeta } from './preload-utils.js';
 export async function getHtmlResources(view, viewParams, resourceContext) {
     const { runtimeEnvironment, runtimeParams, moduleRegistry, moduleBundler, resourceRegistry, viewMetadata, } = resourceContext;
-    const { lwrVersion, format, hmrEnabled, bundle, debug, minify } = runtimeEnvironment;
+    const { format, hmrEnabled, bundle, debug, minify } = runtimeEnvironment;
     const { customElements, serverData, serverDebug } = viewMetadata;
     const defRegistry = bundle ? moduleBundler : moduleRegistry;
-    const version = lwrVersion;
     const isAMD = format === 'amd';
     const depth = isAMD
         ? { static: GraphDepth.ALL, dynamic: 1 }
@@ -72,9 +71,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         uris: [],
         specifiers: [],
         groups: new Map(),
+        integrities: new Map(),
     };
     // Determine if server side rendering view modules
     const isSSR = view.bootstrap?.ssr;
+    // Determine the LWR client version
+    const version = view.bootstrap?.lwrVersion;
+    // Page level nonce for script tags
+    const nonce = getViewNonce(viewParams);
     // ABS module and custom element references
     let bootstrapModuleRef, versionedSpecifier = bootstrapSpecifier;
     let importMetadata = { imports: {} };
@@ -94,6 +98,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             if (!def.inline && !def.src) {
                 throw Error(`Invalid Shim ${shimBundle}: ${JSON.stringify(def)}`);
             }
+            addExternalScriptNonce(def, nonce);
             requiredResources.push(def);
             // Always inline the error shim script after the shim
             const errorShimDef = (await resourceRegistry.getResource({ specifier: 'lwr-error-shim.js', version }, runtimeEnvironment, runtimeParams));
@@ -104,6 +109,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             if (!errorShimDef.inline && !errorShimDef.src) {
                 throw Error(`Invalid Shim lwr-error-shim.js: ${JSON.stringify(errorShimDef)}`);
             }
+            addExternalScriptNonce(errorShimDef, nonce);
             requiredResources.push(errorShimDef);
         }
         // ------- Application Bootstrap module
@@ -122,12 +128,14 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
         if (!uri) {
             throw Error(`Invalid Module Resource ${versionedSpecifier}`);
         }
-        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { isPreload: false, isSSR }));
+        const integrity = getBundleIntegrity(bootstrapModuleGraph, versionedSpecifier);
+        moduleResources.push(getModuleResourceByUri(uri, runtimeEnvironment, { integrity, isPreload: false, isSSR, nonce }));
         // PRELOAD the bootstrap module static dependencies as preloaded script resources
         for (const depSpecifier of bootstrapModuleGraph.graphs[0].static) {
             const uri = getPreloadUri(depSpecifier, bootstrapModuleGraph.uriMap);
             if (uri) {
-                setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                const integrity = getBundleIntegrity(bootstrapModuleGraph, depSpecifier);
+                setPreloadModulesMeta(depSpecifier, uri, integrity, groups, viewPreloads);
             }
         }
         // PRELOAD configured preloadModules as preloaded script resources
@@ -179,13 +187,15 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             // PRELOAD the custom element module as a link resource
             const specifier = graph.graphs[0].specifier;
             const uri = graph.uriMap[specifier];
-            setPreloadModulesMeta(specifier, uri, groups, viewPreloads);
+            const integrity = getBundleIntegrity(graph, specifier);
+            setPreloadModulesMeta(specifier, uri, integrity, groups, viewPreloads);
             // PRELOAD custom element static deps as link resources when bundling is ON
             if (bundle) {
                 for (const depSpecifier of graph.graphs[0].static) {
-                    const uri = getPreloadUri(depSpecifier, graph.uriMap);
-                    if (uri) {
-                        setPreloadModulesMeta(depSpecifier, uri, groups, viewPreloads);
+                    const depUri = getPreloadUri(depSpecifier, graph.uriMap);
+                    if (depUri) {
+                        const integrity = getBundleIntegrity(graph, depSpecifier);
+                        setPreloadModulesMeta(depSpecifier, depUri, integrity, groups, viewPreloads);
                     }
                 }
             }
@@ -234,7 +244,13 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
     // PRELOAD script resources for preload module URIs after the bootstrap module
     const dedupedUris = [...new Set(viewPreloads.uris)];
     for (const preloadUri of dedupedUris) {
-        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, { isPreload: true, isSSR }));
+        const integrity = viewPreloads.integrities.get(preloadUri);
+        moduleResources.push(getModuleResourceByUri(preloadUri, runtimeEnvironment, {
+            integrity,
+            isPreload: true,
+            isSSR,
+            nonce,
+        }));
     }
     // generate html partial
     const htmlResources = await Promise.all([...configResources, ...requiredResources, ...moduleResources].map(generateHtmlTag));
@@ -251,6 +267,7 @@ export async function getHtmlResources(view, viewParams, resourceContext) {
             customElements: customElementsRecords,
             endpoints,
             importMetadata,
+            moduleResources,
             bootstrapModule: bootstrapModuleRef,
         },
     };

package/build/es/utils.d.ts

@@ -1,4 +1,4 @@
-import type { AssetReference, JsonCompatible, LinkedViewDefinition, LwrErrorRoute, LwrRoute, ModuleBundler, ModuleId, ModuleJson, ModuleRegistry, NormalizedRenderingResult, PublicModuleRegistry, RenderOptions, RenderedAssetReference, RenderingResult, ResourceDefinition, RouteHandlerViewResponse, RuntimeEnvironment, RuntimeParams, ViewModuleResourceContext, ViewPageContext, ViewRequest, ViewResponse } from '@lwrjs/types';
+import type { AssetReference, JsonCompatible, LinkedViewDefinition, LwrErrorRoute, LwrRoute, ModuleBundler, ModuleId, ModuleJson, ModuleRegistry, NormalizedRenderingResult, PublicModuleRegistry, RenderOptions, RenderedAssetReference, RenderingResult, ResourceDefinition, RouteHandlerViewResponse, RuntimeEnvironment, RuntimeParams, ViewModuleResourceContext, ViewPageContext, ViewParams, ViewRequest, ViewResponse } from '@lwrjs/types';
 export type HTMLResource = Partial<ResourceDefinition>;
 export declare function generateHtmlTag(definition: HTMLResource): Promise<string>;
 export declare function normalizeRenderedResult({ renderedView, metadata, options, cache, }: RenderingResult): NormalizedRenderingResult;
@@ -10,4 +10,16 @@ export declare function toJsonFormat(viewRequest: ViewRequest, viewDefinition: L
 export declare function getModuleResource(moduleId: Pick<ModuleId, 'specifier' | 'version'>, runtimeEnvironment: RuntimeEnvironment, moduleResourceMeta: ViewModuleResourceContext, defRegistry: ModuleRegistry | ModuleBundler, runtimeParams: RuntimeParams): Promise<ResourceDefinition>;
 export declare function getModuleResourceByUri(uri: string, runtimeEnvironment: RuntimeEnvironment, moduleResourceMeta: ViewModuleResourceContext): ResourceDefinition;
 export declare function createJsonModule(specifier: string, moduleRegistry: PublicModuleRegistry, environment: RuntimeEnvironment, params: RuntimeParams): Promise<ModuleJson>;
+/**
+ * Get the nonce set on the page context of the view params
+ */
+export declare function getViewNonce(viewParams: ViewParams): string | undefined;
+/**
+ * Generate a nonce in the page context of the view params
+ */
+export declare function generateViewNonce(viewParams: ViewParams): void;
+/**
+ * Add a nonce to a script definition in view if it is external (not inline)
+ */
+export declare function addExternalScriptNonce(def: ResourceDefinition, nonce?: string): void;
 //# sourceMappingURL=utils.d.ts.map

package/build/es/utils.js

@@ -1,10 +1,12 @@
 import { basename, extname } from 'path';
-import { explodeSpecifier, getMappingUriPrefix, getSpecifier, getClientBootstrapConfigurationUri, mimeLookup, DEFAULT_TITLE, streamToString, } from '@lwrjs/shared-utils';
+import { explodeSpecifier, getMappingUriPrefix, getSpecifier, getClientBootstrapConfigurationUri, mimeLookup, DEFAULT_TITLE, streamToString, getFeatureFlags, } from '@lwrjs/shared-utils';
 import { AppResourceEnum, getAppSpecifier, ResourceIdentityTypes, } from '@lwrjs/app-service/identity';
+import crypto from 'crypto';
 function generateExternalStyle(src) {
     return `<link rel="stylesheet" href="${src}">`;
 }
-function generateExternalScript(type = 'application/javascript', src, async, defer) {
+function generateExternalScript(type = 'application/javascript', src, async, defer, nonce, integrity) {
+    // add script loader order attribute
     let scriptLoadOrder = '';
     if (defer) {
         scriptLoadOrder = ' defer';
@@ -12,7 +14,19 @@ function generateExternalScript(type = 'application/javascript', src, async, def
     else if (async) {
         scriptLoadOrder = ' async';
     }
-    return `<script type="${type}"${scriptLoadOrder} src="${src}"></script>`;
+    // add the right CSP header attribute
+    let cspHashAttr = '';
+    // For now use the ENABLE_NONCE to gate adding nonce or integrity
+    // W-15868505 is open to create a better config
+    if (getFeatureFlags().ENABLE_NONCE) {
+        if (integrity) {
+            cspHashAttr = ` integrity="${integrity}"`;
+        }
+        else if (nonce) {
+            cspHashAttr = ` nonce="${nonce}"`;
+        }
+    }
+    return `<script type="${type}"${scriptLoadOrder}${cspHashAttr} src="${src}"></script>`;
 }
 function generateLinkPreloadTag({ href, type }) {
     if (type === 'module') {
@@ -22,7 +36,7 @@ function generateLinkPreloadTag({ href, type }) {
         return `<link rel="preload" href="${href}" type="${type}" />`;
     }
 }
-function generateExternalTag({ type, src = '', async, defer, isPreload }) {
+function generateExternalTag({ type, src = '', async, defer, isPreload, nonce, integrity, }) {
     if (isPreload) {
         return generateLinkPreloadTag({ href: src, type: type });
     }
@@ -30,13 +44,13 @@ function generateExternalTag({ type, src = '', async, defer, isPreload }) {
         return generateExternalStyle(src);
     }
     else {
-        return generateExternalScript(type, src, async, defer);
+        return generateExternalScript(type, src, async, defer, nonce, integrity);
     }
 }
 async function generateInlineTag({ specifier, type, content, stream, nonce }) {
     const typeStr = type === 'text/css' ? '' : ` type="${type}"`;
     const tag = type === 'text/css' ? 'style' : 'script';
-    const nonceStr = nonce ? ` nonce="${nonce}"` : '';
+    const nonceStr = getFeatureFlags().ENABLE_NONCE && nonce && nonce ? ` nonce="${nonce}"` : '';
     if (!content && !stream) {
         throw new Error(`Invalid inline Resource Definition: must have either "content" or "stream": "${specifier}"`);
     }
@@ -203,7 +217,7 @@ export async function getModuleResource(moduleId, runtimeEnvironment, moduleReso
     };
 }
 export function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMeta) {
-    const { isSSR = false, isPreload = false } = moduleResourceMeta;
+    const { integrity, isSSR = false, isPreload = false, nonce } = moduleResourceMeta;
     const { format } = runtimeEnvironment;
     return {
         src: uri,
@@ -213,6 +227,8 @@ export function getModuleResourceByUri(uri, runtimeEnvironment, moduleResourceMe
         // only use link preload for ESM for compat reasons.
         // AMD should use regular script tags for preloading
         isPreload: format !== 'amd' && isPreload,
+        integrity,
+        nonce,
     };
 }
 // Given a specifier and resource type, return the JSON serialized Module data
@@ -236,4 +252,34 @@ export async function createJsonModule(specifier, moduleRegistry, environment, p
         },
     };
 }
+/**
+ * Get the nonce set on the page context of the view params
+ */
+export function getViewNonce(viewParams) {
+    return getFeatureFlags().ENABLE_NONCE
+        ? viewParams?.page?.nonce
+        : undefined;
+}
+/**
+ * Generate a nonce in the page context of the view params
+ */
+export function generateViewNonce(viewParams) {
+    if (getFeatureFlags().ENABLE_NONCE) {
+        const nonce = crypto.randomBytes(16).toString('base64');
+        if (!viewParams.page) {
+            viewParams.page = { nonce };
+        }
+        else {
+            viewParams.page.nonce = nonce;
+        }
+    }
+}
+/**
+ * Add a nonce to a script definition in view if it is external (not inline)
+ */
+export function addExternalScriptNonce(def, nonce) {
+    if (nonce && getFeatureFlags().ENABLE_NONCE && !def.inline) {
+        def.nonce = nonce;
+    }
+}
 //# sourceMappingURL=utils.js.map

package/build/es/view-handler.js

@@ -146,6 +146,8 @@ export class LwrViewHandler {
         const paths = { rootDir, assets, contentDir, layoutsDir };
         const locale = runtimeParams.locale;
         const basePath = runtimeParams.basePath;
+        const assetBasePath = runtimeParams.assetBasePath;
+        const uiBasePath = runtimeParams.assetBasePath;
         const viewApi = this.getBoundApi(viewRequest, route, runtimeEnvironment, runtimeParams);
         const response = await getTracer().trace({
             name: ViewSpan.ExecuteRouteHandler,
@@ -155,7 +157,7 @@ export class LwrViewHandler {
             },
         }, async () => {
             try {
-                return await routeHandlerFn({ ...viewRequest, locale, basePath }, { route: route, viewApi, ...paths }, routeHandlerOptions);
+                return await routeHandlerFn({ ...viewRequest, locale, basePath, assetBasePath, uiBasePath }, { route: route, viewApi, ...paths }, routeHandlerOptions);
             }
             catch (err) {
                 if (err instanceof DiagnosticsError) {
@@ -165,6 +167,10 @@ export class LwrViewHandler {
                 throw createSingleDiagnosticError({ description: descriptions.APPLICATION.ROUTE_HANDLER_ERROR(route.id, message) }, LwrApplicationError);
             }
         });
+        // if the locale was returned by the route handler update the runtime time params
+        if (response?.locale) {
+            runtimeParams.locale = response.locale;
+        }
         return response;
     }
     /*
@@ -191,6 +197,11 @@ export class LwrViewHandler {
     view, viewParams, renderOptions) {
         const { id, bootstrap } = route;
         const managedView = { ...view, id, bootstrap };
+        // If this is a localized view request (could have come from a route handler)
+        // Update the runtime params
+        if (view.locale) {
+            runtimeParams.locale = view.locale;
+        }
         const viewResponse = {
             view: managedView,
             viewParams,

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.13.0-alpha.2",
+    "version": "0.13.0-alpha.21",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -29,18 +29,21 @@
         "build/**/*.cjs",
         "build/**/*.d.ts"
     ],
+    "scripts": {
+        "build": "tsc -b"
+    },
     "dependencies": {
-        "@lwrjs/app-service": "0.13.0-alpha.2",
-        "@lwrjs/diagnostics": "0.13.0-alpha.2",
-        "@lwrjs/instrumentation": "0.13.0-alpha.2",
-        "@lwrjs/shared-utils": "0.13.0-alpha.2",
-        "lru-cache": "^10.2.0"
+        "@lwrjs/app-service": "0.13.0-alpha.21",
+        "@lwrjs/diagnostics": "0.13.0-alpha.21",
+        "@lwrjs/instrumentation": "0.13.0-alpha.21",
+        "@lwrjs/shared-utils": "0.13.0-alpha.21",
+        "lru-cache": "^10.2.2"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.13.0-alpha.2"
+        "@lwrjs/types": "0.13.0-alpha.21"
     },
     "engines": {
         "node": ">=18.0.0"
     },
-    "gitHead": "3ae1051ef1eb282f9c1fb54f6aab44ab5ba48480"
+    "gitHead": "d272dcd07881fa469ee73bd28d2f30f99957e122"
 }