@salesforce/lds-network-fetch 1.457.0 → 1.458.0

package/dist/ldsNetworkFetch.js

@@ -908,5 +908,276 @@ function instrument(newInstrumentation) {
     Object.assign(instrumentation, newInstrumentation);
 }
 
-export { instrument, setupFetchNetworkAdapter, setupLexNetworkAdapter };
-// version: 1.457.0-b38a7243f7
+/**
+ * Canonical registry of the UIAPI url paths LDS sends over HTTP and their
+ * read/write nature — the single source of truth for every runtime's transport
+ * allowlist and read-POST retry classifier. A leaf module (no local imports) so
+ * both can consume it without an import cycle: `network-fetch.ts` imports the
+ * retry interceptor, so the retry layer must import paths from here, not back
+ * from `network-fetch.ts`. Templates use `{segment}` placeholders (see
+ * `compilePathMatchers`); callers normalize trailing slashes.
+ */
+/**
+ * Public UIAPI paths verified for HTTP transport: no `UiTier` Connect
+ * clientFilter, and actually invoked by a Luvio adapter wired into
+ * `ldsEngineCreator.js`. All URL shapes an LDS adapter can hit are registered.
+ */
+const UIAPI_PUBLIC_PATH_ENTRIES = [
+    // ----- Object Info -----
+    // getObjectInfo — IObjectInfoResource
+    { path: '/ui-api/object-info/{objectApiName}' },
+    // getObjectInfos (batch) — IObjectInfoBatchResource
+    { path: '/ui-api/object-info/batch/{objectApiNames}' },
+    // getPicklistValues — IPicklistValuesResource
+    { path: '/ui-api/object-info/{objectApiName}/picklist-values/{recordTypeId}/{fieldApiName}' },
+    // getPicklistValuesByRecordType — IPicklistValuesByRecordTypeResource
+    { path: '/ui-api/object-info/{objectApiName}/picklist-values/{recordTypeId}' },
+    // ----- Records -----
+    // createRecord (POST) — IRecordDataCollectionResource
+    { path: '/ui-api/records' },
+    // getRecord / updateRecord (PATCH) / deleteRecord (DELETE) — IRecordDataResource
+    { path: '/ui-api/records/{recordId}' },
+    // getRecords (batch GET) — IBatchRecordDataResource
+    { path: '/ui-api/records/batch/{recordIds}' },
+    // executeBatchRecordOperations (POST, no recordIds segment) — IBatchRecordResource
+    { path: '/ui-api/records/batch' },
+    // getRecordUi — IRecordUiResource
+    { path: '/ui-api/record-ui/{recordIds}' },
+    // ----- Layout -----
+    // getLayout — ILayoutResource
+    { path: '/ui-api/layout/{objectApiName}' },
+    // getPathLayout — IPathLayoutResource
+    { path: '/ui-api/path/layout/{objectApiName}' },
+    // ----- Record Defaults -----
+    // getRecordCreateDefaults — IRecordCreateDefaultsResource
+    { path: '/ui-api/record-defaults/create/{objectApiName}' },
+    // getRecordDefaultsTemplateForCreate — IRecordDefaultsTemplateCreateResource
+    { path: '/ui-api/record-defaults/template/create/{objectApiName}' },
+    // getRecordDefaultsTemplateClone — IRecordDefaultsTemplateCloneResource
+    { path: '/ui-api/record-defaults/template/clone/{recordId}' },
+    // ----- Duplicates -----
+    // getDuplicateConfig — IDuplicateConfigResource
+    { path: '/ui-api/duplicates/{objectApiName}' },
+    // findDuplicates (POST) — IPredupeResource
+    { path: '/ui-api/predupe', retryableReadPost: true },
+    // ----- GraphQL -----
+    // executeGraphQL (POST) — IGraphQLResource (no /ui-api prefix).
+    // Query-only on the Luvio path: the GraphQL parser rejects non-`query`
+    // operations before they reach the network (see lds-graphql-parser gql.ts),
+    // so a mutation can never traverse this path.
+    { path: '/graphql', retryableReadPost: true },
+    // ----- List UI -----
+    // getListUiByName (2-segment form) — IListUiResource212
+    { path: '/ui-api/list-ui/{objectApiName}/{listViewApiName}' },
+    // 1-segment form covers both:
+    //   /ui-api/list-ui/{listViewId} — IListUiResource
+    //   /ui-api/list-ui/{objectApiName} — IListCollectionResource
+    { path: '/ui-api/list-ui/{objectApiNameOrListViewId}' },
+    // getListInfoByName (GET) / updateListInfoByApiName (PATCH) / deleteListInfo (DELETE) — IListInfoResource
+    // (Also covers /ui-api/list-info/{listViewId} via shape collision.)
+    { path: '/ui-api/list-info/{objectApiName}/{listViewApiName}' },
+    // getListInfosByObjectName (GET) / createListInfo (POST) — IListInfoCreationAndCollectionResource
+    // (Also covers /ui-api/list-info/batch — IListInfoBatchResource — via shape collision.)
+    { path: '/ui-api/list-info/{objectApiName}' },
+    // getListObjectInfo — IListObjectInfoResource
+    { path: '/ui-api/list-object-info/{objectApiName}' },
+    // postListRecordsByName (POST) — IListRecordsResource
+    { path: '/ui-api/list-records/{objectApiName}/{listViewApiName}', retryableReadPost: true },
+    // getListPreferences (GET) / updateListPreferences (PATCH) — IListPreferencesResource
+    { path: '/ui-api/list-preferences/{objectApiName}/{listViewApiName}' },
+    // ----- Related List UI -----
+    // getRelatedListInfo (GET) / updateRelatedListInfo (PATCH) — IRelatedListInfoResource
+    // (Also covers /ui-api/related-list-info/{parentRecordId}/{relatedListId} via shape collision.)
+    { path: '/ui-api/related-list-info/{parentObjectApiName}/{relatedListId}' },
+    // getRelatedListInfoBatch — IRelatedListInfoBatchResource
+    { path: '/ui-api/related-list-info/batch/{parentObjectApiName}/{relatedListNames}' },
+    // getRelatedListsInfo (collection) — IRelatedListInfoCollectionResource
+    { path: '/ui-api/related-list-info/{parentObjectApiName}' },
+    // postRelatedListRecords (POST) — IRelatedListRecordsResource
+    {
+        path: '/ui-api/related-list-records/{parentRecordId}/{relatedListId}',
+        retryableReadPost: true,
+    },
+    // postRelatedListRecordsBatch (POST, 3-segment form) — IRelatedListRecordsBatchResource
+    { path: '/ui-api/related-list-records/batch/{parentRecordId}', retryableReadPost: true },
+    // getRelatedListRecordsBatch (GET, 4-segment form) — IRelatedListRecordsBatchResource [newly added]
+    { path: '/ui-api/related-list-records/batch/{parentRecordId}/{relatedListIds}' },
+    // getRelatedListCount — IRelatedListRecordCountResource
+    { path: '/ui-api/related-list-count/{parentRecordId}/{relatedListId}' },
+    // getRelatedListsCount (batch) — IRelatedListRecordCountBatchResource
+    { path: '/ui-api/related-list-count/batch/{parentRecordId}/{relatedListNames}' },
+    // getRelatedListPreferences (GET) / updateRelatedListPreferences (PATCH) — IRelatedListPreferencesResource
+    { path: '/ui-api/related-list-preferences/{preferencesId}' },
+    // getRelatedListPreferencesBatch — IRelatedListPreferencesBatchResource
+    { path: '/ui-api/related-list-preferences/batch/{preferencesIds}' },
+    // ----- Actions -----
+    // getGlobalActions — IActionGlobalResource
+    { path: '/ui-api/actions/global' },
+    // getActionLayout — IActionLayoutResource
+    { path: '/ui-api/actions/layout/{actionApiName}' },
+    // getLookupActions — IActionLookupResource
+    { path: '/ui-api/actions/lookup/{objectApiNames}' },
+    // getObjectCreateActions — IActionObjectResource
+    { path: '/ui-api/actions/object/{objectApiName}/record-create' },
+    // getActionOverrides — IActionOverrideResource
+    { path: '/ui-api/actions/overrides/{objectApiName}' },
+    // performQuickAction (POST) / performUpdateRecordQuickAction (PATCH) — IActionPerformQuickActionResource
+    { path: '/ui-api/actions/perform-quick-action/{actionApiName}' },
+    // getQuickActionInfo — IActionQuickActionInfoResource
+    { path: '/ui-api/actions/quick-action-info/{actionApiName}' },
+    // getRecordActions — IActionRecordResource
+    { path: '/ui-api/actions/record/{recordIds}' },
+    // getRecordEditActions — IActionRecordEditResource
+    { path: '/ui-api/actions/record/{recordIds}/record-edit' },
+    // getAllRelatedListActionsForRecord (4-segment form) — IActionRelatedListResource [newly added]
+    { path: '/ui-api/actions/record/{recordIds}/related-list' },
+    // postRelatedListActions (POST) — IActionRelatedListResource
+    { path: '/ui-api/actions/record/{recordIds}/related-list/{relatedListId}' },
+    // postRelatedListsActions (POST) / getRelatedListsActions (GET, 5-segment form) — IActionRelatedListBatchResource
+    { path: '/ui-api/actions/record/{recordIds}/related-list/batch' },
+    // getRelatedListsActions (GET, 6-segment form) — IActionRelatedListBatchResource [newly added]
+    { path: '/ui-api/actions/record/{recordIds}/related-list/batch/{relatedListIds}' },
+    // getRelatedListRecordActions — IActionRelatedListRecordResource
+    { path: '/ui-api/actions/record/{recordIds}/related-list-record/{relatedListRecordIds}' },
+    // getQuickActionDefaults — IActionQuickActionDefaultsResource
+    { path: '/ui-api/actions/record-defaults/{actionApiName}' },
+    // getFlexipageFormulaOverrides — IActionFlexipageFormulaActivationResource
+    { path: '/ui-api/actions/formula-activation/{actionFeature}' },
+    // ----- Lookup / Search -----
+    // getLookupRecords issues lookup as a POST — ILookupEntityResource.
+    // The POST form is 2-segment: /ui-api/lookups/{objectApiName}/{fieldApiName}
+    // (targetApiName is a query param, not a path segment). The 3-segment GET
+    // form exists on the same resource but no wired LDS adapter emits it, so
+    // only the POST shape is registered.
+    { path: '/ui-api/lookups/{objectApiName}/{fieldApiName}', retryableReadPost: true },
+    // searchResults (POST) — ISearchResultsResource
+    { path: '/ui-api/search/results', retryableReadPost: true },
+    // searchKeywordResults (POST) — IKeywordSearchResultsResource
+    { path: '/ui-api/search/results/keyword', retryableReadPost: true },
+    // getSearchFilterMetadata — ISearchInfoFilterMetadataCollectionResource
+    { path: '/ui-api/search-info/{objectApiName}/filters' },
+    // getSearchFilterOptions — ISearchInfoFilterOptionsResource
+    { path: '/ui-api/search-info/{objectApiName}/filters/{filterApiName}/options' },
+    // getLookupMetadata — ILookupMetadataResource
+    { path: '/ui-api/search-info/{objectApiName}/lookup/{fieldApiName}' },
+    // ----- MRU Lists -----
+    // getMruListUi — IMruListUiResource
+    { path: '/ui-api/mru-list-ui/{objectApiName}' },
+    // getMruListRecords — IMruListRecordsResource
+    { path: '/ui-api/mru-list-records/{objectApiName}' },
+    // ----- Apps / Nav -----
+    // getNavItems — INavItemsResource
+    { path: '/ui-api/nav-items' },
+    // getAllApps — IAppsResource
+    { path: '/ui-api/apps' },
+    // getAppDetails — IAppResource
+    { path: '/ui-api/apps/{appId}' },
+];
+/**
+ * Private UIAPI paths gated by the per-runtime private-endpoint gates: the
+ * Connect resource carries a `UiTier` clientFilter (UI-tier callers only, not
+ * the public REST API) and LDS invokes it via a Luvio adapter.
+ */
+const UIAPI_PRIVATE_PATH_ENTRIES = [
+    // ----- Record Avatars -----
+    // getRecordAvatars (batch) — IRecordAvatarsBatchResource
+    { path: '/ui-api/record-avatars/batch/{recordIds}' },
+    // updateRecordAvatar (POST) — IRecordAvatarsAssociationResource
+    { path: '/ui-api/record-avatars/{recordId}/association' },
+    // ----- Layout -----
+    // getLayoutUserState (GET) / updateLayoutUserState (PATCH) — ILayoutUserStateResource
+    { path: '/ui-api/layout/{objectApiName}/user-state' },
+    // ----- GraphQL -----
+    // executeGraphQLBatch (POST) — IGraphQLBatchResource (no /ui-api prefix).
+    // Query-only for the same reason as /graphql (parser rejects non-queries).
+    { path: '/graphql/batch', retryableReadPost: true },
+    // ----- Aggregate UI -----
+    // executeAggregateUi (POST) — IAggregateUiResource
+    { path: '/ui-api/aggregate-ui', retryableReadPost: true },
+];
+/** Public transport paths, derived from the canonical registry above. */
+const UIAPI_PUBLIC_PATHS = UIAPI_PUBLIC_PATH_ENTRIES.map((entry) => entry.path);
+/** Private (gated) transport paths, derived from the canonical registry above. */
+const UIAPI_PRIVATE_PATHS = UIAPI_PRIVATE_PATH_ENTRIES.map((entry) => entry.path);
+/**
+ * Compiles path templates into anchored matchers: each `{...}` placeholder
+ * becomes `[^/]+` (one segment), anchored with `^`/`$`.
+ */
+function compilePathMatchers(paths) {
+    return paths.map((path) => new RegExp(`^${path.replace(/\{.+?\}/g, '[^/]+')}$`));
+}
+// The read-POST subset, precompiled once at module load from the same entries
+// so a retryable path is always also a registered transport path.
+const RETRYABLE_READ_POST_MATCHERS = compilePathMatchers([...UIAPI_PUBLIC_PATH_ENTRIES, ...UIAPI_PRIVATE_PATH_ENTRIES]
+    .filter((entry) => entry.retryableReadPost)
+    .map((entry) => entry.path));
+/**
+ * True when the request path is a known read issued over POST (GraphQL,
+ * aggregate-ui, search, …), so the Luvio throttling policy can replay it on
+ * 429/503. Complements `isRetryableMethod` (GET). Normalizes the trailing slash
+ * the same way the transport allowlist does before matching.
+ */
+function isRetryableReadPost(basePath) {
+    if (!basePath) {
+        return false;
+    }
+    let path = basePath.trim();
+    if (path.endsWith('/')) {
+        path = path.substring(0, path.length - 1);
+    }
+    return RETRYABLE_READ_POST_MATCHERS.some((matcher) => matcher.test(path));
+}
+
+/**
+ * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
+ * precedence: an options.method override wins over a Request object's method
+ * (e.g. `fetch(new Request(url, { method: 'GET' }), { method: 'POST' })`
+ * resolves to `POST`).
+ */
+function getFetchMethod([urlOrRequest, options]) {
+    if (options && 'method' in options) {
+        return options.method;
+    }
+    if (typeof urlOrRequest !== 'string' && 'method' in urlOrRequest) {
+        return urlOrRequest.method;
+    }
+    return undefined;
+}
+/**
+ * Only GET requests are safe to replay automatically on 429/503 — replaying a
+ * write (POST/PUT/PATCH/DELETE) risks executing a mutation more than once.
+ * Shared by both the Luvio and generic-fetch throttling retry policies so the
+ * write-guard rule lives in exactly one place.
+ */
+function isRetryableMethod(method) {
+    return method?.toLowerCase() === 'get';
+}
+/**
+ * A request whose operationType is `query` is a read, so it is safe to replay
+ * automatically on 429/503 even when the transport uses a non-GET method (e.g.
+ * a GraphQL/aggregate-ui read issued as a POST). This complements
+ * `isRetryableMethod`: OneStore seeds the command's operationType into the
+ * per-request context, and the throttling policy retries when either the method
+ * is GET or the operationType is `query`. Only `query` is retryable — `mutation`
+ * and an absent/`graphql` operationType are never replayed.
+ */
+function isRetryableOperationType(operationType) {
+    return operationType === 'query';
+}
+/**
+ * Determines if the HTTP method requires CSRF protection.
+ * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ */
+function isCsrfMethod(method) {
+    if (!method) {
+        return false;
+    }
+    const normalizedMethod = method.toLowerCase();
+    return (normalizedMethod === 'post' ||
+        normalizedMethod === 'put' ||
+        normalizedMethod === 'patch' ||
+        normalizedMethod === 'delete');
+}
+
+export { UIAPI_PRIVATE_PATHS, UIAPI_PUBLIC_PATHS, compilePathMatchers, getFetchMethod, instrument, isCsrfMethod, isRetryableMethod, isRetryableOperationType, isRetryableReadPost, setupFetchNetworkAdapter, setupLexNetworkAdapter };
+// version: 1.458.0-5aef0572f2

package/dist/types/http-utils.d.ts

@@ -0,0 +1,30 @@
+import type { FetchParameters } from '@conduit-client/service-fetch-network/v1';
+/**
+ * Extracts the HTTP method from FetchParameters, matching the Fetch API's own
+ * precedence: an options.method override wins over a Request object's method
+ * (e.g. `fetch(new Request(url, { method: 'GET' }), { method: 'POST' })`
+ * resolves to `POST`).
+ */
+export declare function getFetchMethod([urlOrRequest, options]: FetchParameters): string | undefined;
+/**
+ * Only GET requests are safe to replay automatically on 429/503 — replaying a
+ * write (POST/PUT/PATCH/DELETE) risks executing a mutation more than once.
+ * Shared by both the Luvio and generic-fetch throttling retry policies so the
+ * write-guard rule lives in exactly one place.
+ */
+export declare function isRetryableMethod(method: string | undefined): boolean;
+/**
+ * A request whose operationType is `query` is a read, so it is safe to replay
+ * automatically on 429/503 even when the transport uses a non-GET method (e.g.
+ * a GraphQL/aggregate-ui read issued as a POST). This complements
+ * `isRetryableMethod`: OneStore seeds the command's operationType into the
+ * per-request context, and the throttling policy retries when either the method
+ * is GET or the operationType is `query`. Only `query` is retryable — `mutation`
+ * and an absent/`graphql` operationType are never replayed.
+ */
+export declare function isRetryableOperationType(operationType: string | undefined): boolean;
+/**
+ * Determines if the HTTP method requires CSRF protection.
+ * Only mutating operations (POST, PUT, PATCH, DELETE) require CSRF tokens.
+ */
+export declare function isCsrfMethod(method: string | undefined): boolean;

package/dist/types/main.d.ts

@@ -2,3 +2,5 @@ export { setupFetchNetworkAdapter, setupLexNetworkAdapter } from './networkAdapt
 export type { RequestLogger } from './networkAdapter';
 export type { RequestInterceptor, ResponseInterceptor, LuvioRetryInterceptor, Interceptors, } from './utils';
 export { instrument, FetchNetworkInstrumentation } from './instrumentation';
+export { UIAPI_PUBLIC_PATHS, UIAPI_PRIVATE_PATHS, compilePathMatchers, isRetryableReadPost, } from './uiapi-http-paths';
+export { getFetchMethod, isRetryableMethod, isRetryableOperationType, isCsrfMethod, } from './http-utils';

package/dist/types/uiapi-http-paths.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Canonical registry of the UIAPI url paths LDS sends over HTTP and their
+ * read/write nature — the single source of truth for every runtime's transport
+ * allowlist and read-POST retry classifier. A leaf module (no local imports) so
+ * both can consume it without an import cycle: `network-fetch.ts` imports the
+ * retry interceptor, so the retry layer must import paths from here, not back
+ * from `network-fetch.ts`. Templates use `{segment}` placeholders (see
+ * `compilePathMatchers`); callers normalize trailing slashes.
+ */
+/** Public transport paths, derived from the canonical registry above. */
+export declare const UIAPI_PUBLIC_PATHS: string[];
+/** Private (gated) transport paths, derived from the canonical registry above. */
+export declare const UIAPI_PRIVATE_PATHS: string[];
+/**
+ * Compiles path templates into anchored matchers: each `{...}` placeholder
+ * becomes `[^/]+` (one segment), anchored with `^`/`$`.
+ */
+export declare function compilePathMatchers(paths: string[]): RegExp[];
+/**
+ * True when the request path is a known read issued over POST (GraphQL,
+ * aggregate-ui, search, …), so the Luvio throttling policy can replay it on
+ * 429/503. Complements `isRetryableMethod` (GET). Normalizes the trailing slash
+ * the same way the transport allowlist does before matching.
+ */
+export declare function isRetryableReadPost(basePath: string | undefined): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-network-fetch",
-    "version": "1.457.0",
+    "version": "1.458.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS Network Adapter using fetch",
     "main": "dist/ldsNetworkFetch.js",
@@ -34,11 +34,12 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-network-fetch"
     },
     "dependencies": {
+        "@conduit-client/service-fetch-network": "3.27.1",
         "@luvio/engine": "0.161.2",
         "@luvio/network-adapter-fetch": "0.161.2"
     },
     "devDependencies": {
-        "@salesforce/lds-network-aura": "^1.457.0"
+        "@salesforce/lds-network-aura": "^1.458.0"
     },
     "volta": {
         "extends": "../../package.json"