@salesforce-ui-embedding/internal-lightning-out-containers 2.2.7-rc.2

package/LICENSE.txt

@@ -0,0 +1,21 @@
+Terms of Use
+
+Copyright 2026 Salesforce, Inc. All rights reserved.
+
+These Terms of Use govern the download, installation, and/or use of this software provided by Salesforce, Inc. (“Salesforce”) (the “Software”), were last updated on April 15, 2022, ** and constitute a legally binding agreement between you and Salesforce. If you do not agree to these Terms of Use, do not install or use the Software. 
+ 
+Salesforce grants you a worldwide, non-exclusive, no-charge, royalty-free copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Software and derivative works subject to these Terms. These Terms shall be included in all copies or substantial portions of the Software. 
+
+Subject to the limited rights expressly granted hereunder, Salesforce reserves all rights, title, and interest in and to all intellectual property subsisting in the Software. No rights are granted to you hereunder other than as expressly set forth herein. Users residing in countries on the United States Office of Foreign Assets Control sanction list, or which are otherwise subject to a US export embargo, may not use the Software.
+ 
+Implementation of the Software may require development work, for which you are responsible. The Software may contain bugs, errors and incompatibilities and is made available on an AS IS basis without support, updates, or service level commitments. 
+ 
+Salesforce reserves the right at any time to modify, suspend, or discontinue, the Software (or any part thereof) with or without notice. You agree that Salesforce shall not be liable to you or to any third party for any modification, suspension, or discontinuance.
+
+You agree to defend Salesforce against any claim, demand, suit or proceeding made or brought against Salesforce by a third party arising out of or accruing from (a) your use of the Software, and (b) any application you develop with the Software that infringes any copyright, trademark, trade secret, trade dress, patent, or other intellectual property right of any person or defames any person or violates their rights of publicity or privacy (each a “Claim Against Salesforce”), and will indemnify Salesforce from any damages, attorney fees, and costs finally awarded against Salesforce as a result of, or for any amounts paid by Salesforce under a settlement approved by you in writing of, a Claim Against Salesforce, provided Salesforce (x) promptly gives you written notice of the Claim Against Salesforce, (y) gives you sole control of the defense and settlement of the Claim Against Salesforce (except that you may not settle any Claim Against Salesforce unless it unconditionally releases Salesforce of all liability), and (z) gives you all reasonable assistance, at your expense.
+
+WITHOUT LIMITING THE GENERALITY OF THE FOREGOING, THE SOFTWARE IS NOT SUPPORTED AND IS PROVIDED "AS IS," WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN NO EVENT SHALL SALESFORCE HAVE ANY LIABILITY FOR ANY DAMAGES, INCLUDING, BUT NOT LIMITED TO, DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES, OR DAMAGES BASED ON LOST PROFITS, DATA, OR USE, IN CONNECTION WITH THE SOFTWARE, HOWEVER CAUSED AND WHETHER IN CONTRACT, TORT, OR UNDER ANY OTHER THEORY OF LIABILITY, WHETHER OR NOT YOU HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ 
+These Terms of Use shall be governed exclusively by the internal laws of the State of California, without regard to its conflicts of laws rules. Each party hereby consents to the exclusive jurisdiction of the state and federal courts located in San Francisco County, California to adjudicate any dispute arising out of or relating to these Terms of Use and the download, installation, and/or use of the Software. Except as expressly stated herein, these Terms of Use constitute the entire agreement between the parties, and supersede all prior and contemporaneous agreements, proposals, or representations, written or oral, concerning their subject matter. No modification, amendment, or waiver of any provision of these Terms of Use shall be effective unless it is by an update to these Terms of Use that Salesforce makes available, or is in writing and signed by the party against whom the modification, amendment, or waiver is to be asserted.
+
+Data Privacy: Salesforce may collect, process, and store device, system, and other information related to your use of the Software. This information includes, but is not limited to, IP address, user metrics, and other data (“Usage Data”). Salesforce may use Usage Data for analytics, product development, and marketing purposes. You acknowledge that files generated in conjunction with the Software may contain sensitive or confidential data, and you are solely responsible for anonymizing and protecting such data.  

package/dist/modules/force/lightningOutBaseContainer/lightningOutBaseContainer.html

@@ -0,0 +1,12 @@
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+
+<template lwc:render-mode="light">
+    <lwc:component
+        lwc:is={embeddedCmpCtor}
+        lwc:ref="embeddedCmp"
+        lwc:spread={embeddedCmpProps}
+    ></lwc:component>
+</template>

package/dist/modules/force/lightningOutBaseContainer/lightningOutBaseContainer.js

@@ -0,0 +1,286 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import { api, LightningElement, track } from "lwc";
+import { pdpEventSchema } from "o11y_schema/sf_pdp";
+
+import { MSG } from "./utils/constants";
+import { EmbeddingResizer } from "./utils/EmbeddingResizer";
+import { createEnvContext } from "./utils/env";
+import { createGlobalError } from "./utils/errorHandling";
+import { createInstrumentation } from "./utils/instrumentation";
+import { applyCustomStyleProperties } from "./utils/style";
+
+const ENABLE_RESIZING = false;
+
+// These settings are important for layout and sizing.
+document.documentElement.style.display = "block";
+document.body.style.margin = "0px";
+document.body.style.display = "block";
+if (!ENABLE_RESIZING) {
+    document.documentElement.style.height = "100%";
+    document.body.style.height = "100%";
+}
+
+// Apply global style overrides from URL parameter during bootstrap
+const urlSearchParams = new URLSearchParams(window.location.search);
+const globalStyleParam = urlSearchParams.get("globalStyle");
+if (globalStyleParam) {
+    try {
+        // Apply CSS custom properties directly to document.documentElement
+        applyCustomStyleProperties(globalStyleParam, document.documentElement.style);
+    } catch (err) {
+        window.console.error("Failed to apply globalStyle parameter:", err);
+    }
+}
+
+export default class LightningOutBaseContainer extends LightningElement {
+    static renderMode = "light";
+
+    #embeddedCmp;
+    embeddedCmpCtor;
+    embeddedCmpName;
+    @track embeddedCmpProps;
+    embeddedCmpType = "lwc";
+
+    #env;
+    #eventListeners = new Map();
+    #renderActivity;
+    #renderActivityStopped = false;
+
+    #globalError;
+    isError = false;
+    #instrumentation;
+
+    // Resize observer
+    #resizer = null;
+
+    constructor() {
+        super();
+        this.#env = createEnvContext();
+        this.#instrumentation = createInstrumentation(
+            "LightningOutLWRApp",
+            this.#env.componentNameParam,
+            this.#env.loAppOrigin,
+        );
+        this.#globalError = createGlobalError(this.#env.parentPostMessage, this.#instrumentation.logError);
+        window.addEventListener("message", this.#messageListener);
+    }
+
+    @api
+    get embeddedCmp() {
+        return this.refs?.embeddedCmp;
+    }
+
+    getEnv() {
+        return this.#env;
+    }
+
+    getInstrumentation() {
+        return this.#instrumentation;
+    }
+
+    #messageListener = (event) => {
+        // Page must be in an <iframe> unless testMode
+        if (!this.#env.testMode && window.top === window.self) {
+            window.console.trace("Lightning Out: This page is not in an <iframe>");
+            return;
+        }
+        if (event.origin !== this.#env.loAppOrigin) {
+            window.console.log(
+                `Lightning Out: Message ignored due to different origin: ${event.origin} vs ${this.#env.loAppOrigin}`,
+            );
+            return;
+        }
+        switch (event.data.type) {
+            case MSG.ADD_EVENT_LISTENER: {
+                const eventName = event.data.name;
+                const eventOptions = event.data.options;
+                const listenerKey = event.data.listenerKey;
+                const listener = (evt) => {
+                    this.#env.parentPostMessage({
+                        name: eventName,
+                        detail: structuredClone(evt.detail),
+                        type: MSG.DISPATCH_EVENT,
+                    });
+                };
+                this.#embeddedCmp.addEventListener(eventName, listener, eventOptions);
+                this.#eventListeners.set(listenerKey, listener);
+                break;
+            }
+            case MSG.DISPATCH_EVENT: {
+                const customEvent = new CustomEvent(event.data.name, {
+                    detail: event.data.detail,
+                });
+                this.#embeddedCmp.dispatchEvent(customEvent);
+                break;
+            }
+            case MSG.REMOVE_EVENT_LISTENER: {
+                const eventName = event.data.name;
+                const eventOptions = event.data.options;
+                const listenerKey = event.data.listenerKey;
+                const listener = this.#eventListeners.get(listenerKey);
+                if (listener) {
+                    this.#embeddedCmp.removeEventListener(eventName, listener, eventOptions);
+                    this.#eventListeners.delete(listenerKey);
+                }
+                break;
+            }
+            case MSG.SET_COMPONENT_DATA: {
+                this.renderComponent(event.data.componentData);
+                break;
+            }
+            case MSG.SET_COMPONENT_PROPS: {
+                this.setComponentProps(event.data.componentProps);
+                break;
+            }
+            case MSG.RELOAD: {
+                window.location.reload();
+                break;
+            }
+            default: {
+                // noop
+            }
+        }
+    };
+
+    async renderComponent(componentData) {
+        this.embeddedCmpId = componentData.id;
+        this.embeddedCmpName = componentData.name;
+        this.embeddedCmpProps = componentData.props;
+        if (!this.embeddedCmpName || !this.embeddedCmpProps) {
+            this.#globalError(`Missing 'componentName' or 'componentProps,' both must be specified.`);
+        }
+
+        const { specifier, type } = this.resolveEmbeddedCmpSpecifier(this.embeddedCmpName);
+        this.embeddedCmpType = type;
+
+        this.#renderActivity = this.#instrumentation.startRenderActivity({
+            componentName: specifier,
+            componentType: type,
+            loAppOrigin: this.#env.loAppOrigin,
+        });
+
+        try {
+            // eslint-disable-next-line @lwc/lwc-platform/no-dynamic-import-identifier
+            const { default: ctor } = await import(specifier);
+            this.embeddedCmpCtor = ctor;
+        } catch (err) {
+            this.isError = true;
+            this.#instrumentation.errorRenderActivity(this.#renderActivity, err, {
+                componentName: specifier,
+                componentType: type,
+                componentProps: JSON.stringify(this.embeddedCmpProps || {}),
+                message: err?.message,
+                hasError: this.isError,
+                loAppOrigin: this.#env.loAppOrigin,
+            });
+
+            // Direct-to-Argus: count render errors.
+            this.#instrumentation.incrementCounter("lo2.render.error.count", 1, true, {
+                componentType: type,
+                componentName: specifier,
+            });
+            this.#globalError(err);
+        } finally {
+            if (this.isError && this.#renderActivity && !this.#renderActivityStopped) {
+                this.#instrumentation.stopRenderActivity(this.#renderActivity, {
+                    componentName: specifier,
+                    componentType: type,
+                    hasError: this.isError,
+                    loAppOrigin: this.#env.loAppOrigin,
+                });
+                this.#renderActivityStopped = true;
+            }
+        }
+    }
+
+    setComponentProps(componentProps) {
+        if (componentProps.style && this.embeddedCmp) {
+            applyCustomStyleProperties(componentProps.style, this.embeddedCmp.style);
+            delete componentProps.style;
+        }
+        if (Object.keys(componentProps).length) {
+            this.embeddedCmpProps = componentProps;
+        }
+    }
+
+    resolveEmbeddedCmpSpecifier(embeddedCmpName) {
+        const [name] = embeddedCmpName.split("/v/");
+        const type = name.includes(":") ? "aura" : "lwc";
+        if (type === "aura") {
+            this.#globalError("Aura components require using 'lightningOutOneRuntimeContainer' instead.");
+        }
+        return { specifier: name, type };
+    }
+
+    connectedCallback() {
+        this.#env.parentPostMessage({ type: MSG.LOADED });
+        const componentData = this.#env.testMode ? this.#env.getComponentData() : null;
+        if (componentData) {
+            this.renderComponent(componentData);
+        } else {
+            this.#env.parentPostMessage({ type: MSG.GET_COMPONENT_DATA });
+        }
+    }
+
+    disconnectedCallback() {
+        if (ENABLE_RESIZING) {
+            this.#resizer?.stop();
+            this.#resizer = null;
+        }
+    }
+
+    #setupResizeObserver = () => {
+        this.#resizer = new EmbeddingResizer({
+            targetElement: document.body,
+            onResize: (height) => {
+                this.#env.parentPostMessage({
+                    type: MSG.RESIZE,
+                    height,
+                });
+            },
+            waitForDOMReady: false, // Already connected, no need to wait
+        });
+
+        this.#resizer.start();
+    };
+
+    renderedCallback() {
+        if (!this.#embeddedCmp && this.refs?.embeddedCmp) {
+            this.#embeddedCmp = this.refs.embeddedCmp;
+            this.#env.parentPostMessage({ type: MSG.READY });
+            if (ENABLE_RESIZING) {
+                this.#setupResizeObserver();
+            }
+
+            // PDP_ProductUsage telemetry
+            if (this.#instrumentation?.log) {
+                this.#instrumentation.log(pdpEventSchema, {
+                    eventName: "lightningOutContainer.ready",
+                    productFeatureId: "aJCEE000000152T4AQ",
+                    contextName: "componentType",
+                    contextValue: this.embeddedCmpType,
+                });
+            }
+
+            if (this.#renderActivity && !this.#renderActivityStopped) {
+                this.#instrumentation.stopRenderActivity(this.#renderActivity, {
+                    componentName: this.embeddedCmpName,
+                    componentType: this.embeddedCmpType,
+                    hasError: this.isError,
+                    loAppOrigin: this.#env.loAppOrigin,
+                });
+                this.#renderActivityStopped = true;
+
+                // Direct-to-Argus: count successful renders.
+                this.#instrumentation.incrementCounter("lo2.render.count", 1, false, {
+                    componentType: this.embeddedCmpType,
+                });
+            }
+        }
+    }
+}

package/dist/modules/force/lightningOutBaseContainer/lightningOutBaseContainer.js-meta.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+<LightningComponentBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <isExposed>false</isExposed>
+</LightningComponentBundle>

package/dist/modules/force/lightningOutBaseContainer/utils/EmbeddingResizer.js

@@ -0,0 +1,117 @@
+/**
+ * EmbeddingResizer - Handles dynamic iframe/container resizing
+ * Uses ResizeObserver to monitor element size changes and notify the host
+ */
+class EmbeddingResizer {
+    #observer = null;
+    #targetElement;
+    #onResize;
+    #onReady;
+    #waitForDOMReady;
+    #lastHeight = -1;
+    #scheduled = false;
+    #isObserving = false;
+    constructor(options) {
+        this.#targetElement = options.targetElement || document.body;
+        this.#onResize = options.onResize;
+        this.#onReady = options.onReady;
+        this.#waitForDOMReady = options.waitForDOMReady ?? true;
+    }
+    /**
+     * Start observing the target element for size changes
+     */
+    start() {
+        if (this.#isObserving) {
+            return;
+        }
+        if (this.#waitForDOMReady && document.readyState === "loading") {
+            document.addEventListener("DOMContentLoaded", () => this.#startObserver(), { once: true });
+        } else {
+            this.#startObserver();
+        }
+    }
+    /**
+     * Stop observing and clean up resources
+     */
+    stop() {
+        if (this.#observer) {
+            this.#observer.disconnect();
+            this.#observer = null;
+        }
+        this.#isObserving = false;
+        this.#lastHeight = -1;
+        this.#scheduled = false;
+    }
+    /**
+     * Get the current observed height
+     */
+    getLastHeight() {
+        return this.#lastHeight;
+    }
+    /**
+     * Check if currently observing
+     */
+    isObserving() {
+        return this.#isObserving;
+    }
+    #startObserver = () => {
+        this.#observer = new ResizeObserver((entries) => {
+            this.#handleResize(entries);
+        });
+        this.#observer.observe(this.#targetElement, { box: "border-box" });
+        this.#isObserving = true;
+        // Invoke ready callback if provided
+        if (this.#onReady) {
+            this.#onReady();
+        }
+    };
+    #handleResize = (entries) => {
+        if (!entries || entries.length === 0) {
+            return;
+        }
+        const entry = entries[0];
+        const measuredHeight = this.#extractHeight(entry);
+        const heightPx = Math.max(0, Math.ceil(Number(measuredHeight)));
+        if (!Number.isFinite(heightPx)) {
+            return;
+        }
+        if (heightPx === this.#lastHeight) {
+            return;
+        }
+        this.#lastHeight = heightPx;
+        if (!this.#scheduled) {
+            this.#scheduled = true;
+            // eslint-disable-next-line @lwc/lwc/no-async-operation
+            requestAnimationFrame(() => {
+                this.#scheduled = false;
+                if (!this.#isObserving) return;
+                try {
+                    this.#onResize(this.#lastHeight);
+                } catch {
+                    // Swallow: a throwing consumer (e.g. disposed bridge) must not wedge the rAF loop.
+                }
+            });
+        }
+    };
+    #extractHeight = (entry) => {
+        // Try borderBoxSize first (more accurate)
+        if (entry.borderBoxSize) {
+            if (Array.isArray(entry.borderBoxSize)) {
+                return entry.borderBoxSize[0]?.blockSize || 0;
+            }
+            // Some browsers return a single object instead of array
+            return entry.borderBoxSize.blockSize || 0;
+        }
+        // Fallback to contentRect
+        if (entry.contentRect && typeof entry.contentRect.height === "number") {
+            return entry.contentRect.height;
+        }
+        // Last resort: getBoundingClientRect
+        if (entry.target && typeof entry.target.getBoundingClientRect === "function") {
+            return entry.target.getBoundingClientRect().height;
+        }
+        return 0;
+    };
+}
+
+export { EmbeddingResizer };

package/dist/modules/force/lightningOutBaseContainer/utils/__tests__/env.test.js

@@ -0,0 +1,78 @@
+/*
+ * Copyright 2026 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import { assertBareSpecifier } from "../env";
+import { isComponentNameCheckDisabled } from "../gater";
+
+jest.mock("../gater", () => ({
+    isComponentNameCheckDisabled: jest.fn(() => false),
+}));
+
+const mockIsDisabled = isComponentNameCheckDisabled;
+
+describe("assertBareSpecifier", () => {
+    beforeEach(() => {
+        mockIsDisabled.mockReturnValue(false);
+    });
+
+    describe("accepts bare identifiers", () => {
+        it.each([
+            "c/foo",
+            "c/dealerLocator",
+            "namespace/component",
+            "c/foo/v/1_0_0",
+            "aura/interop/v/0_0_1",
+            "ns/name/v/2_3_4",
+            "c:foo",
+            "namespace:component",
+        ])("accepts %s", (value) => {
+            expect(assertBareSpecifier(value)).toBe(value);
+        });
+    });
+
+    describe("rejects URL-shaped and unsafe strings", () => {
+        it.each([
+            "//www.arcgis.com/sharing/rest?f=json&callback=x",
+            "https://evil.com/payload.js",
+            "http://evil.com/payload.js",
+            "/absolute/path",
+            "../traversal/here",
+            "c/foo?query=1",
+            "c/foo#hash",
+            "c/foo/v/1_0_0?x=1",
+            "c/foo bar",
+            " c/foo",
+            "c/foo ",
+            "",
+            "c",
+            "/c/foo",
+            "c//foo",
+            "-invalid/foo",
+            "c/-invalid",
+            "c/foo/v/",
+            "c/foo/v/1.0.0",
+        ])("rejects %s", (value) => {
+            expect(() => assertBareSpecifier(value)).toThrow(/Invalid componentName/);
+        });
+    });
+
+    it("returns null for null input (missing URL param)", () => {
+        expect(assertBareSpecifier(null)).toBeNull();
+    });
+
+    describe("kill-switch gate", () => {
+        it("bypasses validation and returns value unchanged when gate is open", () => {
+            mockIsDisabled.mockReturnValue(true);
+            const unsafe = "https://evil.com/payload.js";
+            expect(assertBareSpecifier(unsafe)).toBe(unsafe);
+        });
+
+        it("still returns null for null input when gate is open", () => {
+            mockIsDisabled.mockReturnValue(true);
+            expect(assertBareSpecifier(null)).toBeNull();
+        });
+    });
+});

package/dist/modules/force/lightningOutBaseContainer/utils/constants.js

@@ -0,0 +1,18 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+export const MSG = {
+    LOADED: "lo.loaded",
+    READY: "lo.ready",
+    ADD_EVENT_LISTENER: "lo.addEventListener",
+    REMOVE_EVENT_LISTENER: "lo.removeEventListener",
+    DISPATCH_EVENT: "lo.dispatchEvent",
+    SET_COMPONENT_DATA: "lo.setComponentData",
+    SET_COMPONENT_PROPS: "lo.setComponentProps",
+    RELOAD: "lo.reload",
+    GET_COMPONENT_DATA: "lo.getComponentData",
+    RESIZE: "lo.resize",
+};

package/dist/modules/force/lightningOutBaseContainer/utils/env.js

@@ -0,0 +1,74 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import { isComponentNameCheckDisabled } from "./gater";
+
+// Bare LWC (namespace/name) or Aura (namespace:name) identifier, with optional /v/<version> suffix.
+// Rejects URL-shaped strings — a specifier reaching `import()` must be resolved as a module,
+// not a URL. LWR's AMD loader treats URL-shaped specifiers as fetchable script sources, which
+// would allow an attacker who controls the `componentName` URL param to load arbitrary script
+// from any origin permitted by the page's CSP.
+const BARE_SPECIFIER = /^[a-zA-Z][a-zA-Z0-9_-]*[/:][a-zA-Z][a-zA-Z0-9_-]*(\/v\/[a-zA-Z0-9_]+)?$/;
+
+export function assertBareSpecifier(value) {
+    if (value === null) return null;
+    if (isComponentNameCheckDisabled()) return value;
+    if (!BARE_SPECIFIER.test(value)) {
+        throw new Error(`Invalid componentName: ${value}`);
+    }
+    return value;
+}
+
+const urlSearchParams = new URLSearchParams(window.location.search);
+
+export function createEnvContext() {
+    const loAppOrigin = urlSearchParams.get("loAppOrigin");
+    const parentElementId = urlSearchParams.get("parentElementId");
+    const componentNameParam = assertBareSpecifier(urlSearchParams.get("componentName"));
+    const testMode = urlSearchParams.get("testMode") === "true";
+
+    try {
+        const isInBuilder = window.self !== window.top && window.name === "sitePreviewFrame";
+        const isInBuilderContext =
+            urlSearchParams.get("app") === "commeditor" && urlSearchParams.get("view") === "editor";
+        if (!isInBuilder && !isInBuilderContext) {
+            (() => new URL(loAppOrigin))();
+        }
+    } catch (err) {
+        throw new Error(`${err.message} (loAppOrigin: ${loAppOrigin})`);
+    }
+
+    function parentPostMessage(message) {
+        if (typeof message !== "string") {
+            message.id = parentElementId;
+        }
+        window.parent.postMessage(message, loAppOrigin);
+    }
+
+    function getComponentData() {
+        const componentProps = urlSearchParams.get("componentProps");
+        if (!componentProps) {
+            return null;
+        }
+        try {
+            return {
+                name: componentNameParam,
+                props: JSON.parse(componentProps),
+            };
+        } catch {
+            throw new Error(`Invalid component properties: ${componentProps}`);
+        }
+    }
+
+    return {
+        loAppOrigin,
+        parentElementId,
+        componentNameParam,
+        testMode,
+        parentPostMessage,
+        getComponentData,
+    };
+}

package/dist/modules/force/lightningOutBaseContainer/utils/errorHandling.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+export function createGlobalError(parentPostMessage, logError) {
+    return function globalError(err) {
+        const msg = err?.message || `${err}`;
+        const fullMsg = `Lightning-Out Container Error: ${msg}`;
+        logError(fullMsg);
+        window.console.error(fullMsg);
+        parentPostMessage(fullMsg);
+        throw new Error(fullMsg);
+    };
+}

package/dist/modules/force/lightningOutBaseContainer/utils/gater.js

@@ -0,0 +1,16 @@
+/*
+ * Copyright 2026 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import disableComponentNameCheckGate from "@salesforce/gate/org.salesforce.lo2.lwr.disableComponentNameCheck";
+
+/**
+ * Kill-switch for componentName bare-specifier validation (W-23730644).
+ * SECURITY: opening re-enables arbitrary-script-load via URL-shaped componentName;
+ * bounded only by CSP. See env.ts BARE_SPECIFIER for the regex + threat model.
+ */
+export function isComponentNameCheckDisabled() {
+    return disableComponentNameCheckGate.isOpen({ fallback: false });
+}

package/dist/modules/force/lightningOutBaseContainer/utils/instrumentation.js

@@ -0,0 +1,71 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import { getInstrumentation } from "o11y/client";
+import { lightningOutComponentRenderSchema } from "o11y_schema/sf_lightningOut";
+
+export function createInstrumentation(channelName, componentName, loAppOrigin) {
+    const instrumentation = getInstrumentation(channelName);
+
+    function logError(error) {
+        if (instrumentation) {
+            instrumentation.error(error, lightningOutComponentRenderSchema, {
+                componentName,
+                message: error.message || String(error),
+                hasError: true,
+                loAppOrigin,
+            });
+        }
+    }
+
+    function log(schema, payload) {
+        if (instrumentation && typeof instrumentation.log === "function") {
+            instrumentation.log(schema, payload);
+        }
+    }
+
+    function startRenderActivity(instrumentationContext) {
+        if (instrumentation && typeof instrumentation.startActivity === "function") {
+            return instrumentation.startActivity("component-render", {
+                instrumentationContext,
+            });
+        }
+        return null;
+    }
+
+    function errorRenderActivity(activity, err, details) {
+        if (activity) {
+            activity.error(err, lightningOutComponentRenderSchema, details);
+        }
+    }
+
+    function stopRenderActivity(activity, details) {
+        if (activity) {
+            activity.stop(lightningOutComponentRenderSchema, details);
+        }
+    }
+
+    // Direct-to-Argus counter emission. In production the o11y client's
+    // incrementCounter() flows through Core → Funnel → Argus.
+    // Metric naming: core_ui_LightningOutLWRApp:<scope>.<name>.COUNT.Count
+    function incrementCounter(name, value, isError, tags) {
+        if (!instrumentation || typeof instrumentation.incrementCounter !== "function") return;
+        try {
+            instrumentation.incrementCounter(name, value, isError, tags || {});
+        } catch {
+            // swallow — telemetry must never break the container
+        }
+    }
+
+    return {
+        logError,
+        startRenderActivity,
+        errorRenderActivity,
+        stopRenderActivity,
+        log,
+        incrementCounter,
+    };
+}

package/dist/modules/force/lightningOutBaseContainer/utils/style.js

@@ -0,0 +1,21 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+export function applyCustomStyleProperties(componentPropsStyle, embeddedCmpStyle) {
+    for (let i = 0, len = embeddedCmpStyle.length; i < len; i++) {
+        const prop = embeddedCmpStyle.item(i);
+        if (prop && prop.startsWith("--")) {
+            embeddedCmpStyle.removeProperty(prop);
+        }
+    }
+    const allStyles = componentPropsStyle.split(";");
+    allStyles.forEach((style) => {
+        const [prop, val] = style.split(":");
+        if (prop && prop.trim().startsWith("--")) {
+            embeddedCmpStyle.setProperty(prop.trim(), val ?? "");
+        }
+    });
+}

package/dist/modules/force/lightningOutLWRAuraContainer/lightningOutLWRAuraContainer.html

@@ -0,0 +1,22 @@
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+
+<template lwc:render-mode="light">
+    <div lwc:if={includeBeacon}>
+        <aura-interop
+            descriptor="instrumentation:beacon"
+            config={config}
+        ></aura-interop>
+    </div>
+    <lwrlex-instrumentation></lwrlex-instrumentation>
+
+    <div lwc:if={componentName}>
+    <aura-interop
+        descriptor={componentName}
+        lwc:ref="embeddedCmp"
+        lwc:spread={embeddedCmpProps}>
+    </aura-interop>
+   </div>
+</template>

package/dist/modules/force/lightningOutLWRAuraContainer/lightningOutLWRAuraContainer.js

@@ -0,0 +1,125 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import LightningOutBaseContainer from "force/lightningOutBaseContainer";
+import { pdpEventSchema } from "o11y_schema/sf_pdp";
+
+import { createErrorHooks } from "./utils/errorHandling";
+import { isBeaconEnabled } from "./utils/gater";
+
+export default class LightningOutLWRAuraContainer extends LightningOutBaseContainer {
+    #includeBeacon = false;
+    componentName = null;
+    config = {
+        usePageTransactions: false,
+        disableAvroValidation: false,
+    };
+    #renderActivity;
+    #renderActivityStopped = false;
+    #telemetryLogged = false;
+
+    constructor() {
+        super();
+        this.#includeBeacon = isBeaconEnabled();
+        createErrorHooks(this.getEnv().parentPostMessage, this.getInstrumentation().logError);
+    }
+
+    get includeBeacon() {
+        return this.#includeBeacon;
+    }
+
+    async renderComponent(componentData) {
+        if (!componentData.name) {
+            const error = new Error("LightningOutLWRAuraContainer requires 'componentName'.");
+            this.getInstrumentation().logError(error);
+            throw error;
+        }
+
+        const isAura = componentData.name.includes(":");
+        this.embeddedCmpType = isAura ? "aura" : "lwc";
+        this.embeddedCmpId = componentData.id || "componentId";
+        this.embeddedCmpName = componentData.name;
+        this.embeddedCmpProps = componentData.props || {};
+        this.componentName = componentData.name;
+        this.isError = false;
+
+        this.#renderActivityStopped = false;
+        this.#renderActivity = this.getInstrumentation().startRenderActivity(this._getInstrumentationContext());
+
+        try {
+            this.getEnv().parentPostMessage({ type: "lo.ready" });
+        } catch (err) {
+            this.isError = true;
+            this._handleRenderError(err);
+        }
+    }
+
+    setComponentProps(componentProps) {
+        if (!componentProps) {
+            return;
+        }
+        this.embeddedCmpProps = componentProps;
+    }
+
+    resolveEmbeddedCmpSpecifier(embeddedCmpName) {
+        const [, version] = embeddedCmpName.split("/v/");
+        const calculatedVersion = version || "0_0_1";
+
+        return { specifier: `aura/interop/v/${calculatedVersion}`, type: "aura" };
+    }
+
+    renderedCallback() {
+        super.renderedCallback();
+        if (this.refs?.embeddedCmp) {
+            this._stopRenderActivity();
+
+            // PDP_ProductUsage telemetry - component is now fully rendered (log only once)
+            if (!this.#telemetryLogged) {
+                this.#telemetryLogged = true;
+                if (this.getInstrumentation().log) {
+                    this.getInstrumentation().log(pdpEventSchema, {
+                        eventName: "lightningOutComponent.rendered",
+                        productFeatureId: "aJCEE000000152T4AQ",
+                        componentId: this.embeddedCmpId,
+                        eventVolume: 1,
+                        contextName: "componentType",
+                        contextValue: this.embeddedCmpType,
+                    });
+                }
+            }
+        }
+    }
+
+    _handleRenderError(err) {
+        this.getInstrumentation().errorRenderActivity(this.#renderActivity, err, {
+            ...this._getInstrumentationContext(),
+            componentProps: JSON.stringify(this.embeddedCmpProps || {}),
+            message: err?.message,
+            hasError: true,
+        });
+        this._stopRenderActivity({ hasError: true });
+    }
+
+    _stopRenderActivity(details = {}) {
+        if (!this.#renderActivity || this.#renderActivityStopped) {
+            return;
+        }
+        this.getInstrumentation().stopRenderActivity(this.#renderActivity, {
+            ...this._getInstrumentationContext(),
+            hasError: this.isError,
+            ...details,
+        });
+        this.#renderActivityStopped = true;
+    }
+
+    _getInstrumentationContext() {
+        return {
+            componentName: this.embeddedCmpName,
+            componentType: this.embeddedCmpType,
+            loAppOrigin: this.getEnv().loAppOrigin,
+        };
+    }
+}

package/dist/modules/force/lightningOutLWRAuraContainer/lightningOutLWRAuraContainer.js-meta.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+<LightningComponentBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <isExposed>false</isExposed>
+</LightningComponentBundle>

package/dist/modules/force/lightningOutLWRAuraContainer/utils/errorHandling.js

@@ -0,0 +1,55 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import {
+    CLIENT_ERROR_TYPES,
+    onError,
+    onHttpError,
+    onInvalidSession,
+    onUnhandledRejection,
+} from "@lwrjs/globalErrorHandler";
+
+export function createErrorHooks(parentPostMessage, logError) {
+    function post(type, payload) {
+        parentPostMessage({ type: "lo.error", error: { ...payload, type } });
+        logError(payload);
+        return { handled: true };
+    }
+
+    onError((error, type) => post(type, { message: `Error: ${error.message}` }));
+    onUnhandledRejection((error, type) =>
+        post(type, {
+            message: `Unhandled Promise Rejection: ${error.message}`,
+        }),
+    );
+    onInvalidSession((error, type) => post(type, { message: `Invalid Session: ${error.message}` }));
+    onHttpError((error, type) => {
+        if (type === CLIENT_ERROR_TYPES.HTTP_ERROR) {
+            const status = error.status || (error.response && error.response.status);
+            if (status) {
+                let message = "";
+                switch (status) {
+                    case 401:
+                        message = "Session expired or unauthorized. Please log in again.";
+                        break;
+                    case 429:
+                        message = "Too many requests. Please try again later.";
+                        break;
+                    default:
+                        if (status >= 500) {
+                            message = "A server error occurred. Please try again later.";
+                        }
+                        break;
+                }
+                return post(type, {
+                    status,
+                    message: `HTTP Error: ${message}`,
+                });
+            }
+        }
+        return { handled: false };
+    });
+}

package/dist/modules/force/lightningOutLWRAuraContainer/utils/gater.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import disableBeaconGate from "@salesforce/gate/org.salesforce.lo2.lwr.disableBeacon";
+
+/**
+ * @returns {boolean} Checks if the beacon feature is enabled.
+ */
+export function isBeaconEnabled() {
+    return !disableBeaconGate.isOpen({ fallback: false });
+}

package/dist/modules/force/lightningOutLWRContainer/lightningOutLWRContainer.html

@@ -0,0 +1,12 @@
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+
+<template lwc:render-mode="light">
+    <lwc:component
+        lwc:is={embeddedCmpCtor}
+        lwc:ref="embeddedCmp"
+        lwc:spread={embeddedCmpProps}
+    ></lwc:component>
+</template>

package/dist/modules/force/lightningOutLWRContainer/lightningOutLWRContainer.js

@@ -0,0 +1,7 @@
+/*
+ * Copyright 2024 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+export { default } from "force/lightningOutBaseContainer";

package/dist/modules/force/lightningOutLWRContainer/lightningOutLWRContainer.js-meta.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+<LightningComponentBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <isExposed>true</isExposed>
+    <targets>
+        <target>lightningCommunity__Page</target>
+        <target>lightningCommunity__Default</target>
+    </targets>
+</LightningComponentBundle>

package/dist/modules/force/lightningOutOneRuntimeContainer/lightningOutOneRuntimeContainer.html

@@ -0,0 +1,19 @@
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+
+<template lwc:render-mode="light">
+    <div lwc:if={includeBeacon}>
+        <aura-interop
+            descriptor="instrumentation:beacon"
+            config={config}
+        ></aura-interop>
+    </div>
+    <lwrlex-instrumentation></lwrlex-instrumentation>
+    <lwc:component
+        lwc:is={embeddedCmpCtor}
+        lwc:ref="embeddedCmp"
+        lwc:spread={embeddedCmpProps}
+    ></lwc:component>
+</template>

package/dist/modules/force/lightningOutOneRuntimeContainer/lightningOutOneRuntimeContainer.js

@@ -0,0 +1,57 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import LightningOutBaseContainer from "force/lightningOutBaseContainer";
+import { pdpEventSchema } from "o11y_schema/sf_pdp";
+
+import { createErrorHooks } from "./utils/errorHandling";
+import { isBeaconEnabled } from "./utils/gater";
+
+export default class LightningOutOneRuntimeContainer extends LightningOutBaseContainer {
+    #includeBeacon = false;
+    #telemetryLogged = false;
+    config = {
+        usePageTransactions: false,
+        disableAvroValidation: false,
+    };
+
+    constructor() {
+        super();
+        createErrorHooks(this.getEnv().parentPostMessage, this.getInstrumentation().logError);
+        this.#includeBeacon = isBeaconEnabled();
+    }
+
+    get includeBeacon() {
+        return this.#includeBeacon;
+    }
+
+    renderedCallback() {
+        super.renderedCallback();
+        if (this.refs?.embeddedCmp && !this.#telemetryLogged) {
+            this.#telemetryLogged = true;
+            if (this.getInstrumentation().log) {
+                this.getInstrumentation().log(pdpEventSchema, {
+                    eventName: "lightningOutComponent.rendered",
+                    productFeatureId: "aJCEE000000152T4AQ",
+                    componentId: this.embeddedCmpId,
+                    eventVolume: 1,
+                    contextName: "componentType",
+                    contextValue: this.embeddedCmpType,
+                });
+            }
+        }
+    }
+
+    resolveEmbeddedCmpSpecifier(embeddedCmpName) {
+        const [name, version] = embeddedCmpName.split("/v/");
+        const type = name.includes(":") ? "aura" : "lwc";
+        const calculatedVersion = version || "0_0_1";
+        if (type === "aura") {
+            return { specifier: `aura/interop/v/${calculatedVersion}`, type };
+        }
+        return { specifier: `${name}/v/${calculatedVersion}`, type };
+    }
+}

package/dist/modules/force/lightningOutOneRuntimeContainer/lightningOutOneRuntimeContainer.js-meta.xml

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Copyright 2026 Salesforce, Inc. All rights reserved.
+  For full license text, see the LICENSE.txt file in this package.
+-->
+
+<LightningComponentBundle xmlns="http://soap.sforce.com/2006/04/metadata">
+    <isExposed>false</isExposed>
+</LightningComponentBundle>

package/dist/modules/force/lightningOutOneRuntimeContainer/utils/errorHandling.js

@@ -0,0 +1,49 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import {
+    CLIENT_ERROR_TYPES,
+    onError,
+    onHttpError,
+    onInvalidSession,
+    onUnhandledRejection,
+} from "@lwrjs/globalErrorHandler";
+
+export function createErrorHooks(parentPostMessage, logError) {
+    function post(type, payload) {
+        parentPostMessage({ type: "lo.error", error: { ...payload, type } });
+        logError(payload);
+        return { handled: true };
+    }
+
+    onError((error, type) => post(type, { message: `Error: ${error.message}` }));
+    onUnhandledRejection((error, type) =>
+        post(type, {
+            message: `Unhandled Promise Rejection: ${error.message}`,
+        }),
+    );
+    onInvalidSession((error, type) => post(type, { message: `Invalid Session: ${error.message}` }));
+    onHttpError((error, type) => {
+        if (type === CLIENT_ERROR_TYPES.HTTP_ERROR) {
+            const status = error.status || (error.response && error.response.status);
+            if (status) {
+                let message = "";
+                if (status === 401) {
+                    message = "Session expired or unauthorized. Please log in again.";
+                } else if (status === 429) {
+                    message = "Too many requests. Please try again later.";
+                } else if (status >= 500) {
+                    message = "A server error occurred. Please try again later.";
+                }
+                return post(type, {
+                    status,
+                    message: `HTTP Error: ${message}`,
+                });
+            }
+        }
+        return { handled: false };
+    });
+}

package/dist/modules/force/lightningOutOneRuntimeContainer/utils/gater.js

@@ -0,0 +1,14 @@
+/*
+ * Copyright 2025 salesforce.com, inc.
+ * All Rights Reserved
+ * Company Confidential
+ */
+
+import disableBeaconGate from "@salesforce/gate/org.salesforce.lo2.lwr.disableBeacon";
+
+/**
+ * @returns {boolean} Checks if the beacon feature is enabled.
+ */
+export function isBeaconEnabled() {
+    return !disableBeaconGate.isOpen({ fallback: false });
+}

package/package.json

@@ -0,0 +1,24 @@
+{
+    "name": "@salesforce-ui-embedding/internal-lightning-out-containers",
+    "version": "2.2.7-rc.2",
+    "private": false,
+    "description": "Lightning Out 2.0 Container Components",
+    "license": "SEE LICENSE IN LICENSE.txt",
+    "type": "module",
+    "files": [
+        "dist/",
+        "!dist/__tests__/",
+        "!dist/__mocks__/",
+        "!dist/*.test.js",
+        "!dist/*.map",
+        "LICENSE.txt"
+    ],
+    "scripts": {
+        "build": "node scripts/build.mjs",
+        "typecheck": "tsc --noEmit",
+        "clean": "rimraf dist"
+    },
+    "publishConfig": {
+        "access": "public"
+    }
+}