@salesforce/lds-runtime-aura 1.428.0-dev2 → 1.428.0-dev21

package/dist/ldsEngineCreator.js

@@ -1354,6 +1354,7 @@ class HttpCacheControlCommand extends CacheControlCommand {
   constructor(services) {
     super(services);
     this.services = services;
+    this.additionalNullResponses = [];
   }
   requestFromNetwork() {
     return this.fetch();
@@ -1365,6 +1366,15 @@ class HttpCacheControlCommand extends CacheControlCommand {
       return resolvedPromiseLike$2(err$1(toError(reason)));
     }
   }
+  isSemanticNullResponse(response) {
+    return this.additionalNullResponses.includes(response.status);
+  }
+  isProtocolNoBodyStatus(status) {
+    return status === 204 || status === 205;
+  }
+  isUndeclaredNoBodyResponse(response) {
+    return this.isProtocolNoBodyStatus(response.status) && !this.isSemanticNullResponse(response);
+  }
   async coerceError(errorResponse) {
     return toError(errorResponse.statusText);
   }
@@ -1375,12 +1385,26 @@ class HttpCacheControlCommand extends CacheControlCommand {
     return response.then(
       (response2) => {
         if (response2.ok) {
-          return response2.json().then(
-            (json) => {
-              return this.processFetchReturnValue(json);
-            },
-            (reason) => err$1(toError(reason))
-          ).finally(() => {
+          let resultPromise;
+          if (this.isSemanticNullResponse(response2)) {
+            resultPromise = Promise.resolve(ok$2(null));
+          } else if (this.isUndeclaredNoBodyResponse(response2)) {
+            resultPromise = Promise.resolve(
+              err$1(
+                toError(
+                  `Unexpected ${response2.status} response: no-content status was not declared in the API specification. Declare this response in your OAS without a content property.`
+                )
+              )
+            );
+          } else {
+            resultPromise = response2.json().then(
+              (json) => {
+                return this.processFetchReturnValue(json);
+              },
+              (reason) => err$1(toError(reason))
+            );
+          }
+          return resultPromise.finally(() => {
             try {
               this.afterRequestHooks({ statusCode: response2.status });
             } catch {
@@ -1564,14 +1588,27 @@ const _FetchNetworkCommand = class _FetchNetworkCommand extends NetworkCommand {
   constructor(services) {
     super(services);
     this.services = services;
+    this.additionalNullResponses = [];
   }
-  fetch() {
+  fetch(contextSeed) {
     try {
-      return this.convertFetchResponseToData(this.services.fetch(...this.fetchParams));
+      const [input, init] = this.fetchParams;
+      const initWithSeed = contextSeed === void 0 ? init : { ...init, __contextSeed: contextSeed };
+      const fetchCall = initWithSeed === void 0 ? this.services.fetch(input) : this.services.fetch(input, initWithSeed);
+      return this.convertFetchResponseToData(fetchCall);
     } catch (reason) {
       return resolvedPromiseLike$2(err$1(toError(reason)));
     }
   }
+  isSemanticNullResponse(response) {
+    return this.additionalNullResponses.includes(response.status);
+  }
+  isProtocolNoBodyStatus(status) {
+    return status === 204 || status === 205;
+  }
+  isUndeclaredNoBodyResponse(response) {
+    return this.isProtocolNoBodyStatus(response.status) && !this.isSemanticNullResponse(response);
+  }
   async coerceError(errorResponse) {
     return toError(errorResponse.statusText);
   }
@@ -1579,10 +1616,24 @@ const _FetchNetworkCommand = class _FetchNetworkCommand extends NetworkCommand {
     return response.then(
       (response2) => {
         if (response2.ok) {
-          return response2.json().then(
-            (json) => ok$2(json),
-            (reason) => err$1(toError(reason))
-          ).finally(() => {
+          let resultPromise;
+          if (this.isSemanticNullResponse(response2)) {
+            resultPromise = Promise.resolve(ok$2(null));
+          } else if (this.isUndeclaredNoBodyResponse(response2)) {
+            resultPromise = Promise.resolve(
+              err$1(
+                toError(
+                  `Unexpected ${response2.status} response: no-content status was not declared in the API specification. Declare this response in your OAS without a content property.`
+                )
+              )
+            );
+          } else {
+            resultPromise = response2.json().then(
+              (json) => ok$2(json),
+              (reason) => err$1(toError(reason))
+            );
+          }
+          return resultPromise.finally(() => {
             try {
               this.afterRequestHooks({ statusCode: response2.status });
             } catch {
@@ -2712,7 +2763,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.428.0-dev2-2d5e0a6e5f
+// version: 1.428.0-dev21-133a7da4f5
 
 /*!
  * Copyright (c) 2022, Salesforce, Inc.,
@@ -3065,7 +3116,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.428.0-dev2-2d5e0a6e5f
+// version: 1.428.0-dev21-133a7da4f5
 
 /*!
  * Copyright (c) 2022, Salesforce, Inc.,
@@ -4153,11 +4204,13 @@ class JwtToken {
    * @param _token - The JWT string.
    * @param _decodedInfo - The decoded information from the JWT.
    * @param _extraInfo - Any additional information associated with the JWT.
+   * @param _mintParams - The parameters used to mint this token. Undefined for legacy parameterless tokens.
    */
-  constructor(_token, _decodedInfo, _extraInfo) {
+  constructor(_token, _decodedInfo, _extraInfo, _mintParams) {
     this._token = _token;
     this._decodedInfo = _decodedInfo;
     this._extraInfo = _extraInfo;
+    this._mintParams = _mintParams;
   }
   /**
    * Get the JWT string.
@@ -4183,6 +4236,14 @@ class JwtToken {
   get decodedInfo() {
     return this._decodedInfo;
   }
+  /**
+   * Get the mint parameters used to produce this token.
+   *
+   * @returns The mint parameters, or undefined for legacy parameterless tokens.
+   */
+  get mintParams() {
+    return this._mintParams;
+  }
   /**
    * Get the remaining time in seconds until the JWT expires.
    *
@@ -4200,6 +4261,12 @@ class JwtToken {
     return this.tokenRemainingSeconds <= 0;
   }
 }
+function cacheKeyFor(params) {
+  if (params === void 0) {
+    return "jwt:";
+  }
+  return `jwt:${stableJSONStringify$2(params) ?? ""}`;
+}
 let defaultLogger = {
   trace: () => {
   },
@@ -4233,85 +4300,146 @@ class JwtRepository {
     this.limitInSeconds = limitInSeconds;
     this.defaultTokenTTLInSeconds = defaultTokenTTLInSeconds;
     this.logger = logger;
+    this._tokens = /* @__PURE__ */ new Map();
+    this.timeoutHandlers = /* @__PURE__ */ new Map();
     this.observers = [];
   }
   /**
-   * Get the current token.
+   * Get the legacy (parameterless) token. Equivalent to `getToken()` with
+   * no args. Preserved for backward compatibility with code that reads the
+   * `token` property directly.
    */
   get token() {
-    return this._token;
+    return this.getToken();
+  }
+  /**
+   * Get the cached token for the given mint params.
+   *
+   * @param params - The mint params identifying the token. Omit for the legacy global token.
+   */
+  getToken(params) {
+    return this._tokens.get(cacheKeyFor(params));
   }
   /**
-   * Set the current token.
+   * Set the cached token for the given mint params.
    *
    * @param token - JWT token as a string.
    * @param extraInfo - Optional extra information.
+   * @param params - The mint params identifying the token. Omit for the legacy global token.
    */
-  setToken(token, extraInfo) {
+  setToken(token, extraInfo, params) {
     const decodedInfo = computeDecodedInfo(
       token,
       this.defaultTokenTTLInSeconds,
       this.logger
     );
-    this._token = new JwtToken(token, decodedInfo, extraInfo);
-    this.observeTokenExpiration();
-    return this._token;
+    const key = cacheKeyFor(params);
+    const jwtToken = new JwtToken(token, decodedInfo, extraInfo, params);
+    this._tokens.set(key, jwtToken);
+    this.observeTokenExpiration(key);
+    return jwtToken;
+  }
+  /**
+   * Remove the cached token for the given mint params.
+   *
+   * @param params - The mint params identifying the token. Omit to remove
+   * only the legacy global-key entry (matches today's behavior of "remove
+   * the only token there is").
+   */
+  removeToken(params) {
+    const key = cacheKeyFor(params);
+    this._tokens.delete(key);
+    this.clearTimeoutHandler(key);
   }
   /**
-   * Remove the current token.
+   * Remove every cached token and clear every near-expiry timer. Used by
+   * test teardown and full auth-reset paths that previously called
+   * `removeToken()` to clear the single token.
    */
-  removeToken() {
-    this._token = void 0;
-    this.clearTimeoutHandler();
+  clearAllTokens() {
+    for (const key of Array.from(this.timeoutHandlers.keys())) {
+      this.clearTimeoutHandler(key);
+    }
+    this._tokens.clear();
   }
   /**
-   * Subscribe to the token nearing its expiration.
+   * Subscribe to any cached token nearing its expiration.
+   *
+   * The callback receives the specific token whose timer fired. Use
+   * `token.mintParams` to determine which token-set the expiry belongs to.
    *
-   * @param cb - Callback function to execute when token is nearing expiration.
+   * Already-cached tokens are armed at subscribe time. Tokens added later
+   * via `setToken` arm their own timers from inside `setToken`, so this
+   * loop only needs to cover the existing entries.
+   *
+   * @param cb - Callback function to execute when a token is nearing expiration.
    */
   subscribeToTokenNearExpiration(cb) {
     this.observers.push(cb);
-    this.observeTokenExpiration();
+    for (const key of this._tokens.keys()) {
+      this.observeTokenExpiration(key);
+    }
     return () => {
       this.observers = this.observers.filter((observer) => observer !== cb);
+      if (this.observers.length === 0) {
+        for (const key of Array.from(this.timeoutHandlers.keys())) {
+          this.clearTimeoutHandler(key);
+        }
+      }
     };
   }
   /**
-   * Clear the timeout handler.
+   * Number of currently cached tokens. Exposed for size observability so
+   * runtime callers can emit a metric on cache growth and detect adapters
+   * that misuse `dynamicParams` for per-request values.
+   */
+  get size() {
+    return this._tokens.size;
+  }
+  /**
+   * Clear the timeout handler for a specific cache key.
    */
-  clearTimeoutHandler() {
-    if (this.timeoutHandler !== void 0) {
-      clearTimeout(this.timeoutHandler);
+  clearTimeoutHandler(key) {
+    const handler = this.timeoutHandlers.get(key);
+    if (handler !== void 0) {
+      clearTimeout(handler);
+      this.timeoutHandlers.delete(key);
     }
   }
   /**
-   * Observe and handle token expiration.
+   * Observe and handle expiration of the token at the given cache key.
    */
-  observeTokenExpiration() {
-    this.clearTimeoutHandler();
-    if (this.observers.length === 0 || this.token === void 0) {
+  observeTokenExpiration(key) {
+    this.clearTimeoutHandler(key);
+    const token = this._tokens.get(key);
+    if (this.observers.length === 0 || token === void 0) {
       return;
     }
-    this.timeoutHandler = setTimeout(
-      () => this.notifyTokenIsExpiring(),
-      this.computeTimeoutTimeInMs()
+    const handler = setTimeout(
+      () => this.notifyTokenIsExpiring(key),
+      this.computeTimeoutTimeInMs(token)
     );
+    this.timeoutHandlers.set(key, handler);
   }
   /**
-   * Compute the timeout time in milliseconds.
+   * Compute the timeout time in milliseconds for the given token.
    */
-  computeTimeoutTimeInMs() {
-    const remainingSeconds = this.token.tokenRemainingSeconds;
-    let timeoutTimeInSeconds = remainingSeconds - this.limitInSeconds;
+  computeTimeoutTimeInMs(token) {
+    const remainingSeconds = token.tokenRemainingSeconds;
+    const timeoutTimeInSeconds = remainingSeconds - this.limitInSeconds;
     return timeoutTimeInSeconds < 0 ? 0 : timeoutTimeInSeconds * 1e3;
   }
   /**
-   * Notify all observers that the token is expiring.
+   * Notify all observers that the token at the given cache key is expiring.
    */
-  notifyTokenIsExpiring() {
+  notifyTokenIsExpiring(key) {
+    const token = this._tokens.get(key);
+    if (token === void 0) {
+      return;
+    }
     this.observers.forEach((cb) => {
       try {
-        cb.call(void 0, this.token);
+        cb.call(void 0, token);
       } catch (e2) {
         this.logger.error(e2.message);
       }
@@ -4329,57 +4457,68 @@ class JwtManager {
   constructor(jwtRepository, resolver, options) {
     this.jwtRepository = jwtRepository;
     this.resolver = resolver;
+    this.inflightPromises = /* @__PURE__ */ new Map();
     if (options == null ? void 0 : options.keepTokenUpdated) {
-      jwtRepository.subscribeToTokenNearExpiration(() => this.refreshToken());
+      jwtRepository.subscribeToTokenNearExpiration(
+        (token) => this.refreshToken(token.mintParams)
+      );
     }
   }
   /**
-   * Method to get a JWT token.
-   * If there's a token request in progress, it will return the Promise of this request.
-   * If the current token is undefined or expired, it will initiate a token refresh.
-   * Otherwise, it will return the current token.
+   * Method to get a JWT token for the given mint params.
    *
-   * @returns {JwtToken<T, ExtraInfo> | Promise<JwtToken<T, ExtraInfo>>} The current token or the Promise of a token request.
+   * If a request for the same params is in flight, returns its promise. If
+   * a cached token for those params exists and is not expired, returns it
+   * synchronously. Otherwise initiates a refresh.
+   *
+   * @param params - Optional mint parameters. Omit for the legacy parameterless token.
+   * @returns The cached token (sync) or a promise that resolves to the refreshed token.
    */
-  getJwt() {
-    if (this.inflightPromise) {
-      return this.inflightPromise;
+  getJwt(params) {
+    const key = cacheKeyFor(params);
+    const inflight = this.inflightPromises.get(key);
+    if (inflight) {
+      return inflight;
     }
-    const token = this.jwtRepository.token;
+    const token = this.jwtRepository.getToken(params);
     if (token === void 0 || token.isExpired) {
-      return this.refreshToken();
+      return this.refreshToken(params);
     }
     return token;
   }
   /**
-   * Method to refresh a JWT token.
-   * If a refresh request is already in progress, it will return the Promise of this request.
-   * Otherwise, it will start a new refresh request and return its Promise.
+   * Method to refresh a JWT token for the given mint params.
    *
-   * @returns {Promise<JwtToken<T, ExtraInfo>>} Promise of the refreshed token.
+   * @param params - Optional mint parameters. Omit for the legacy parameterless token.
+   * @returns Promise of the refreshed token.
    */
-  refreshToken() {
-    if (this.inflightPromise === void 0) {
-      this.inflightPromise = new Promise((resolve, reject) => {
-        this.resolver.getJwt().then(({ jwt, extraInfo }) => {
-          this.inflightPromise = void 0;
-          const token = this.jwtRepository.setToken(jwt, extraInfo);
-          resolve(token);
-        }).catch((reason) => {
-          this.inflightPromise = void 0;
-          reject(reason);
-        });
+  refreshToken(params) {
+    const key = cacheKeyFor(params);
+    const existing = this.inflightPromises.get(key);
+    if (existing !== void 0) {
+      return existing;
+    }
+    const resolverPromise = params === void 0 ? this.resolver.getJwt() : this.resolver.getJwt(params);
+    const promise = new Promise((resolve, reject) => {
+      resolverPromise.then(({ jwt, extraInfo }) => {
+        this.inflightPromises.delete(key);
+        const token = this.jwtRepository.setToken(jwt, extraInfo, params);
+        resolve(token);
+      }).catch((reason) => {
+        this.inflightPromises.delete(key);
+        reject(reason);
       });
-    }
-    return this.inflightPromise;
+    });
+    this.inflightPromises.set(key, promise);
+    return promise;
   }
   /**
-   * Method to check if a token refresh is in progress.
+   * Method to check if any token refresh is in progress.
    *
-   * @returns {boolean} true if a token refresh is in progress, false otherwise.
+   * @returns {boolean} true if at least one refresh is in flight, false otherwise.
    */
   get isRefreshingToken() {
-    return this.inflightPromise !== void 0;
+    return this.inflightPromises.size > 0;
   }
 }
 
@@ -4397,9 +4536,18 @@ function buildServiceDescriptor$2(interceptors = {
   return {
     type: "fetch",
     version: "1.0",
-    service: function(...args) {
+    service: function(input, init) {
       var _a;
-      const context = (_a = interceptors.createContext) == null ? void 0 : _a.call(interceptors);
+      let contextSeed;
+      let cleanInit = init;
+      if (init !== void 0 && "__contextSeed" in init) {
+        const { __contextSeed, ...initWithoutSeed } = init;
+        contextSeed = __contextSeed;
+        cleanInit = Object.keys(initWithoutSeed).length === 0 ? void 0 : initWithoutSeed;
+      }
+      const fetchArgs = cleanInit === void 0 ? [input] : [input, cleanInit];
+      const baseContext = (_a = interceptors.createContext) == null ? void 0 : _a.call(interceptors);
+      const context = contextSeed === void 0 ? baseContext : { ...baseContext, ...contextSeed };
       const {
         request: requestInterceptors = [],
         retry: retryInterceptor = void 0,
@@ -4407,17 +4555,17 @@ function buildServiceDescriptor$2(interceptors = {
         finally: finallyInterceptors = []
       } = interceptors;
       const pending = requestInterceptors.reduce(
-        (previousPromise, interceptor) => previousPromise.then((args2) => interceptor(args2, context)),
-        resolvedPromiseLike$2(args)
+        (previousPromise, interceptor) => previousPromise.then((args) => interceptor(args, context)),
+        resolvedPromiseLike$2(fetchArgs)
       );
-      return Promise.resolve(pending).then((args2) => {
+      return Promise.resolve(pending).then((args) => {
         if (retryInterceptor) {
-          return retryInterceptor(args2, retryService, context);
+          return retryInterceptor(args, retryService, context);
         } else {
           if (retryService) {
-            return retryService.applyRetry(() => fetch(...args2));
+            return retryService.applyRetry(() => fetch(...args));
           }
-          return fetch(...args2);
+          return fetch(...args);
         }
       }).then((response) => {
         return responseInterceptors.reduce(
@@ -4638,7 +4786,7 @@ var TypeCheckShapes;
     TypeCheckShapes[TypeCheckShapes["Integer"] = 3] = "Integer";
     TypeCheckShapes[TypeCheckShapes["Unsupported"] = 4] = "Unsupported";
 })(TypeCheckShapes || (TypeCheckShapes = {}));
-// engine version: 0.160.3-354dc58b
+// engine version: 0.160.4-dev1-4b808818
 
 const { keys: keys$1 } = Object;
 
@@ -4711,12 +4859,13 @@ const fetchNetworkAdapter = async (resourceRequest, _resourceRequestContext) =>
     };
 };
 function generateQueryString(params) {
-    const queryStrings = [];
+    const searchParams = new URLSearchParams();
     for (const key of keys$1(params)) {
-        queryStrings.push(`${key}=${params[key]}`);
+        searchParams.append(key, String(params[key]));
     }
-    if (queryStrings.length > 0) {
-        return `?${queryStrings.join('&')}`;
+    const queryString = searchParams.toString();
+    if (queryString.length > 0) {
+        return `?${queryString}`;
     }
     return '';
 }
@@ -4732,6 +4881,10 @@ const SALESFORCE_API_BASE_URI_FLAG = 'api.salesforce.com';
 const X_REQUEST_ID_HEADER = 'x-request-id';
 const SFAPController = 'SalesforceApiPlatformController';
 const SFAPJwtMethod = 'getSFAPLightningJwtService';
+// Parameterized mint: the POST signature's auto-generated Aura method
+// (`@ConnectSignature(..., generateAuraMethod = true)` on the SFAP Lightning JWT
+// Service Connect resource). Takes a single `requestBody` named param.
+const SFAPJwtPostMethod = 'postSFAPLightningJwtService';
 /**
  * We expect jwt info and baseUri to be present in the response.
  *
@@ -4782,13 +4935,6 @@ const platformSfapJwtResolver = {
     },
 };
 const jwtManager = new JwtManager(new JwtRepository(), platformSfapJwtResolver);
-function prefetchSfapJwt() {
-    const maybePromise = jwtManager.getJwt();
-    if ('then' in maybePromise) {
-        return maybePromise.then(() => undefined).catch(() => undefined);
-    }
-    return Promise.resolve(undefined);
-}
 const authenticateRequest = (resourceRequest, jwt) => {
     const { token } = jwt;
     const { headers } = resourceRequest;
@@ -4885,6 +5031,151 @@ function generateRequestId$1() {
     }
 }
 
+/**
+ * Normalize SFAP-shaped params into the opaque `JwtMintParams` bag that callers
+ * hand to `JwtManager.getJwt(params)`. Scopes are sorted because they are
+ * semantically a set — without this, `['a', 'b']` and `['b', 'a']` would cache
+ * as separate entries (OneStore treats arrays as ordered under stable-JSON
+ * serialization; see ADR "JWT Parameterization" §2).
+ *
+ * MANDATORY CONSUMER ENTRY POINT. Every consumer that mints a parameterized
+ * SFAP JWT MUST assemble its params through this function before calling the
+ * manager. The cache key is derived by `JwtManager` from the caller's params
+ * (`cacheKeyFor(params)`) *before* the resolver runs — so the resolver cannot
+ * normalize after the fact. Set-stable caching therefore depends on the caller
+ * routing params through here. Do NOT sort inside the resolver: that would only
+ * reorder the wire body, not the cache key, and mutating the caller's params
+ * mid-call would desync the in-flight-dedup key from the stored-token key.
+ */
+/**
+ * Validate and narrow an opaque `JwtMintParams` bag to the SFAP-shaped subset the
+ * resolver forwards. Returns `{ error }` (surfaced as a resolver rejection) for a
+ * malformed bag rather than throwing.
+ */
+function coerceToSfapParams(params) {
+    const scopes = params.scopes;
+    const dynamicParams = params.dynamicParams;
+    if (scopes !== undefined && !isStringArray(scopes)) {
+        return { error: 'SFAP JWT params.scopes must be a string[] when provided.' };
+    }
+    if (dynamicParams !== undefined && !isPrimitiveRecord(dynamicParams)) {
+        return {
+            error: 'SFAP JWT params.dynamicParams must be a Record<string, string | boolean | number> when provided.',
+        };
+    }
+    return { params: { scopes, dynamicParams } };
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((s) => typeof s === 'string');
+}
+/**
+ * A record whose values are JSON primitives (string, boolean, or number) — the
+ * value types the SFAP Lightning JWT Service accepts for a dynamic parameter
+ * (see {@link SfapDynamicParamValue}). Booleans/numbers are forwarded natively
+ * (not stringified) so claim handlers that gate on a native `Boolean` see the
+ * intended value. Nested objects/arrays, `null`, and `undefined` are rejected.
+ */
+function isPrimitiveRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).every((v) => typeof v === 'string' || typeof v === 'boolean' || typeof v === 'number');
+}
+/**
+ * Build the SFAP mint request body from the coerced params: `scopes` joined into a
+ * single space-delimited string, `dynamicParams` mapped to `dynamicParameters.items`.
+ * Empty scopes / dynamic params are omitted.
+ */
+function buildRequestBody(params) {
+    const body = {};
+    if (params.scopes && params.scopes.length > 0) {
+        body.scopes = params.scopes.join(' ');
+    }
+    if (params.dynamicParams) {
+        const items = Object.entries(params.dynamicParams).map(([name, value]) => ({ name, value }));
+        if (items.length > 0) {
+            body.dynamicParameters = { items };
+        }
+    }
+    return body;
+}
+
+/**
+ * Parameterized SFAP JWT resolver that mints over **Aura transport** instead of a
+ * direct HTTP `fetch`.
+ *
+ * It dispatches the SFAP Lightning JWT Service's parameterized POST via its
+ * auto-generated Aura controller method
+ * `SalesforceApiPlatformController.postSFAPLightningJwtService` (generated by
+ * `@ConnectSignature(..., generateAuraMethod = true)` on the Connect resource).
+ * The mint inputs ride as the single `requestBody` named param, in the same
+ * `{ scopes, dynamicParameters: { items } }` shape the HTTP resolver POSTs — built
+ * by the shared {@link buildRequestBody}, so the two transports stay in lockstep.
+ *
+ * Why Aura (not the HTTP resolver): the mint endpoint is a same-origin core
+ * resource, and routing it over Aura keeps session/CSRF handling inside the Aura
+ * stack rather than issuing a credentialed cross-cutting `fetch` from the client.
+ * This mirrors the legacy parameterless `platformSfapJwtResolver` in
+ * `network-sfap.ts`, which already mints over Aura via the `getSFAPLightningJwtService`
+ * generated method — this is the parameterized sibling of that call.
+ *
+ * A `JwtResolver` is invoked directly by `JwtManager` (not through Luvio's
+ * `appRouter`/`ResourceRequest` pipeline), so the correct mechanism is a direct
+ * named-controller `dispatchAuraAction`, not the `auraNetworkAdapter`/connect-route
+ * table. The SFAP JWT endpoint is not registered as a connect-over-Aura route, and
+ * a resolver has no `ResourceRequest` for the router to look up.
+ */
+class ParameterizedSfapJwtAuraResolver {
+    getJwt(params) {
+        return new Promise((resolve, reject) => {
+            if (params === undefined) {
+                // Misuse: the dispatching resolver routes parameterless calls to the
+                // legacy resolver. Reject so production fails loudly here.
+                reject('ParameterizedSfapJwtAuraResolver requires JwtMintParams. The legacy parameterless path should be served by platformSfapJwtResolver.');
+                return;
+            }
+            const coerced = coerceToSfapParams(params);
+            if ('error' in coerced) {
+                reject(coerced.error);
+                return;
+            }
+            // The mint inputs become the single `requestBody` named param of the
+            // generated Aura method (Aura binds top-level keys to the controller
+            // method's named args). Reuses the HTTP resolver's body builder so both
+            // transports send an identical shape.
+            const requestBody = buildRequestBody(coerced.params);
+            // No fetchImpl / requestInterceptor / CSRF / credentials handling here —
+            // the Aura stack owns session + CSRF. Matches the legacy resolver's call.
+            dispatchAuraAction(`${SFAPController}.${SFAPJwtPostMethod}`, { requestBody }, defaultActionConfig)
+                .then((response) => {
+                const body = response.body;
+                if (!body || typeof body.jwt !== 'string' || typeof body.baseUri !== 'string') {
+                    // Never serialize the body into the error — it may carry a JWT.
+                    reject('SFAP JWT response missing required fields (jwt, baseUri)');
+                    return;
+                }
+                resolve({ jwt: body.jwt, extraInfo: { baseUri: body.baseUri } });
+            })
+                .catch((error) => {
+                // Error mapping ported from the legacy platformSfapJwtResolver
+                // (network-sfap.ts): plain Errors carry a message; non-500
+                // AuraFetchResponses are ConnectInJava errors with a typed body;
+                // 500s carry an { error } body.
+                if (error instanceof Error) {
+                    reject(error.message);
+                    return;
+                }
+                const { status } = error;
+                if (status !== HttpStatusCode$2.ServerError) {
+                    reject(error.body.message);
+                    return;
+                }
+                reject(error.body.error);
+            });
+        });
+    }
+}
+
 function e(e){this.message=e;}e.prototype=new Error,e.prototype.name="InvalidCharacterError";"undefined"!=typeof window&&window.atob&&window.atob.bind(window)||function(r){var t=String(r).replace(/=+$/,"");if(t.length%4==1)throw new e("'atob' failed: The string to be decoded is not correctly encoded.");for(var n,o,a=0,i=0,c="";o=t.charAt(i++);~o&&(n=a%4?64*n+o:o,a++%4)?c+=String.fromCharCode(255&n>>(-2*a&6)):0)o="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=".indexOf(o);return c};function n(e){this.message=e;}n.prototype=new Error,n.prototype.name="InvalidTokenError";
 
 /**
@@ -5701,7 +5992,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.428.0-dev2-2d5e0a6e5f
+// version: 1.428.0-dev21-133a7da4f5
 
 const environmentHasAura = typeof window !== 'undefined' && typeof window.$A !== 'undefined';
 const defaultConfig = {
@@ -5961,12 +6252,20 @@ function buildLuvioPageScopedCacheRequestInterceptor() {
     };
 }
 
+// Connect REST returns errors as an array `[{ errorCode, ... }, ...]`; the Aura
+// action path uses a bare object `{ errorCode, ... }`. HTTP-based adapters hit
+// Connect REST directly, so the body arrives array-shaped and a plain
+// `body.errorCode` read would miss it. Handle both shapes.
+function isInvalidSession(body) {
+    const errorCode = Array.isArray(body) ? body[0] && body[0].errorCode : body && body.errorCode;
+    return errorCode === 'INVALID_SESSION_ID';
+}
 function buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger) {
     return async (response) => {
         if (response.status === 401) {
             try {
                 const coercedResponse = (await coerceResponseToFetchResponse(response.clone()));
-                if (coercedResponse.body.errorCode === 'INVALID_SESSION_ID') {
+                if (isInvalidSession(coercedResponse.body)) {
                     logger.warn(`Received ${response.status} status code from LEX runtime service`);
                     // Fire the event asynchronously, similar to the legacy setTimeout pattern
                     window.setTimeout(() => {
@@ -5984,7 +6283,7 @@ function buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger) {
 function buildLexRuntimeLuvioAuthExpirationRedirectResponseInterceptor() {
     return async (response) => {
         if (response.status === 401) {
-            if (response.body.errorCode === 'INVALID_SESSION_ID') {
+            if (isInvalidSession(response.body)) {
                 window.setTimeout(() => {
                     dispatchGlobalEvent('aura:invalidSession');
                 }, 0);
@@ -6883,12 +7182,12 @@ class CsrfTokenRetryPolicy extends RetryPolicy {
         if (context.attempt >= this.config.maxRetries) {
             return false;
         }
-        // Only retry on 400 status
-        if (result.status !== 400) {
+        // Connect may return 401 or 400 for invalid CSRF scenarios
+        if (result.status !== 400 && result.status !== 401) {
             return false;
         }
         // Check if this is a CSRF error by examining the response body
-        // This avoids retrying all 400s (validation errors, bad requests, etc.)
+        // This avoids retrying all 400s/401s (validation errors, auth errors, etc.)
         return await isCsrfError(result);
     }
     /**
@@ -6975,14 +7274,143 @@ function buildCsrfRetryInterceptor() {
     };
 }
 
+/**
+ * The context-seed key under which a custom command forwards its JWT mint
+ * parameters. The framework's `buildServiceDescriptor` merges the request init's
+ * `__contextSeed` onto the per-request interceptor context, so this interceptor
+ * reads the params off `context[JWT_MINT_PARAMS_SEED_KEY]`.
+ *
+ * This is a cross-team contract: the custom command writes this key, this
+ * interceptor reads it. It is intentionally an opaque key — OneStore does not
+ * define it and never inspects the param shape; the typed shape lives in the
+ * resolver.
+ */
+const JWT_MINT_PARAMS_SEED_KEY = 'jwtMintParams';
+/**
+ * Returns `true` if the fetch arguments already carry an `Authorization` header,
+ * across the three shapes the framework's `setHeader` handles: a `Request`
+ * resource's own headers, an `options.headers` `Headers` instance, or a plain
+ * record. The descriptor's guarded legacy interceptor uses this to skip when the
+ * parameterized interceptor has already authorized the request — avoiding a second
+ * mint and the throw `setHeaderAuthorization` raises on an existing header.
+ */
+function hasAuthorizationHeader([resource, options]) {
+    if (resource instanceof Request && resource.headers.has('Authorization')) {
+        return true;
+    }
+    const headers = options?.headers;
+    if (headers === undefined) {
+        return false;
+    }
+    if (headers instanceof Headers) {
+        return headers.has('Authorization');
+    }
+    if (Array.isArray(headers)) {
+        return headers.some(([name]) => name.toLowerCase() === 'authorization');
+    }
+    return Reflect.has(headers, 'Authorization');
+}
+/**
+ * Builds the request interceptor that bridges the per-request context seed to the
+ * dispatching SFAP JwtManager for the **parameterized** mint path.
+ *
+ * For a parameterized SFAP command, the context carries `jwtMintParams`. This
+ * interceptor reads them, calls `jwtManager.getJwt(params)` (which the dispatching
+ * resolver routes to the parameterized resolver), attaches the `Authorization`
+ * header, and rewrites the request URL via the minted `baseUri`. The presence of
+ * that `Authorization` header is the signal the descriptor's guarded legacy
+ * interceptor uses to skip — so the legacy path does not mint a second time.
+ *
+ * For a legacy parameterless command the context carries no `jwtMintParams`, so
+ * this interceptor **early-returns on its first line** and the request flows
+ * unchanged to the legacy `buildJwtRequestHeaderInterceptor` — guaranteeing zero
+ * behavior change for non-opted-in adapters.
+ *
+ * Lives in `lds-lightning-platform` (not OneStore) beside the existing SFAP/CSRF
+ * interceptors, per the JWT-parameterization ADR §5: OneStore provides only the
+ * generic interceptor mechanism and the opaque context-seed channel; the service-
+ * specific bridge is a runtime-layer concern.
+ *
+ * @param jwtManager - the dispatching SFAP JwtManager
+ * @param jwtRequestModifier - applies the minted `extraInfo.baseUri` to the request URL
+ */
+function buildJwtParameterizationInterceptor(jwtManager, jwtRequestModifier = (_extraInfo, fetchArgs) => fetchArgs) {
+    return (fetchArgs, context) => {
+        const jwtContext = context;
+        const mintParams = jwtContext?.[JWT_MINT_PARAMS_SEED_KEY];
+        // No mint params → not a parameterized request. Do nothing; the legacy
+        // interceptor handles it. This MUST be the first statement so non-opted-in
+        // SFAP commands observe no work at all.
+        if (mintParams === undefined) {
+            return resolvedPromiseLike$2(fetchArgs);
+        }
+        return resolvedPromiseLike$2(jwtManager.getJwt(mintParams)).then((token) => {
+            const fetchArgsWithAuthorization = setHeaderAuthorization(token, fetchArgs);
+            return token.extraInfo
+                ? jwtRequestModifier(token.extraInfo, fetchArgsWithAuthorization)
+                : fetchArgsWithAuthorization;
+        });
+    };
+}
+
 const SFAP_BASE_URL = 'api.salesforce.com';
+// The fetch-service tag the Data360 (direct-to-Data Cloud) custom command binds
+// to. Distinct from SFAP's `sfap_api` so the Data360 host-rewrite interceptor only
+// ever runs for that command — zero blast radius on the SFAP fleet.
+//
+// The tag is deliberately named after the *mechanism* (the `cdp_url` host rewrite),
+// not a capability, because this whole descriptor is interim: it exists only while
+// the mint service returns the fixed SFAP `baseUri` regardless of platform. When the
+// service returns the correct per-platform `baseUri`, the data 360 route can be re-evaluated.
+// This mechanism is NOT intended to be re-used outside of this initial context.
+// This is a client-side routing key only.
+const DATA_360_CDP_URL_REWRITE_AUTH_SCOPE = 'data_360_cdp_url_rewrite';
+// The minted-JWT claim carrying the Data Cloud tenant-specific endpoint (TSE).
+// The server's `SFAPJwtClaimHandlerImpl` emits it for CDP-provisioned orgs as a
+// verbatim passthrough of `DataCloudTenant.getApiEndpoint()` — no normalization.
+// The exact FORM therefore varies and must not be assumed: it may be a bare host
+// (`<hash>.c360a.salesforce.com`) or a full URL with scheme
+// (`https://a360.cdp.<region>.aws.sfdc.cl`), and the suffix is cloud-dependent
+// (commercial `.salesforce.com`, substrate `.aws.sfdc.cl`, GovCloud
+// `.salesforce.mil`). This is why the interceptor strips any scheme before parsing
+// and applies no host-suffix policy — see the interceptor docblock's trust boundary.
+const CDP_URL_CLAIM = 'cdp_url';
+function buildDispatchingSfapJwtResolver(legacyResolver, parameterizedResolver) {
+    return {
+        getJwt(params) {
+            if (params === undefined) {
+                return legacyResolver.getJwt();
+            }
+            return parameterizedResolver.getJwt(params);
+        },
+    };
+}
+// The parameterized mint is dispatched over **Aura transport**:
+// the resolver calls the SFAP Lightning JWT Service's auto-generated Aura method
+// `SalesforceApiPlatformController.postSFAPLightningJwtService`, so session + CSRF
+// are handled inside the Aura stack. This mirrors the legacy parameterless
+// `platformSfapJwtResolver`, which already mints over Aura. The minted JWT is then
+// attached as a Bearer token on the downstream SFAP API request (which stays HTTP).
+const parameterizedSfapJwtResolver = new ParameterizedSfapJwtAuraResolver();
+const sfapJwtResolver = buildDispatchingSfapJwtResolver(platformSfapJwtResolver, parameterizedSfapJwtResolver);
 const sfapJwtRepository = new JwtRepository();
-const sfapJwtManager = new JwtManager(sfapJwtRepository, platformSfapJwtResolver);
+const sfapJwtManager = new JwtManager(sfapJwtRepository, sfapJwtResolver);
+function prefetchSfapJwt() {
+    const maybePromise = sfapJwtManager.getJwt();
+    if ('then' in maybePromise) {
+        return maybePromise.then(() => undefined).catch(() => undefined);
+    }
+    return Promise.resolve(undefined);
+}
 function buildJwtAuthorizedSfapFetchServiceDescriptor(logger) {
     const jwtAuthorizedFetchService = buildServiceDescriptor$2({
         createContext: createInstrumentationIdContext(),
-        request: [buildThirdPartyTrackerRegisterInterceptor(), buildJwtRequestInterceptor(logger)],
-        retry: buildCsrfRetryInterceptor(),
+        request: [
+            buildThirdPartyTrackerRegisterInterceptor(),
+            buildJwtParameterizationInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger)),
+            // Guarded so it is skipped once the parameterized interceptor handled the request.
+            buildGuardedLegacyJwtRequestInterceptor(logger),
+        ],
         finally: [buildThirdPartyTrackerFinishInterceptor()],
     });
     return {
@@ -6990,6 +7418,46 @@ function buildJwtAuthorizedSfapFetchServiceDescriptor(logger) {
         tags: { authenticationScopes: 'sfap_api' },
     };
 }
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+function buildJwtAuthorizedData360FetchServiceDescriptor(logger) {
+    const data360FetchService = buildServiceDescriptor$2({
+        createContext: createInstrumentationIdContext(),
+        request: [
+            buildThirdPartyTrackerRegisterInterceptor(),
+            buildData360HostRewriteInterceptor(logger),
+            // Compression runs LAST, after the host-rewrite interceptor has minted,
+            // attached the Bearer token, and rewritten the URL — so it only ever sees
+            // the final request body. It is a strict pass-through: bodies that are
+            // missing, non-string, or under the 1KB threshold flow through untouched,
+            // preserving the tuple (URL + Authorization header) the rewrite produced.
+            buildCompressionInterceptor({ algorithm: 'gzip' }),
+        ],
+        finally: [buildThirdPartyTrackerFinishInterceptor()],
+    });
+    return {
+        ...data360FetchService,
+        tags: { authenticationScopes: DATA_360_CDP_URL_REWRITE_AUTH_SCOPE },
+    };
+}
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than
@@ -7062,8 +7530,13 @@ function buildUnauthorizedFetchServiceDescriptor() {
         tags: { authenticationScopes: '' },
     };
 }
-function buildJwtRequestInterceptor(logger) {
-    const jwtRequestModifier = ({ baseUri }, [resource, request]) => {
+/**
+ * The `JwtRequestModifier` shared by both the legacy and parameterized SFAP
+ * interceptors: it rewrites the request URL's host/protocol to the minted
+ * `extraInfo.baseUri` (only for `api.salesforce.com` resources).
+ */
+function buildSfapJwtRequestModifier(logger) {
+    return ({ baseUri }, [resource, request]) => {
         if (typeof resource !== 'string' && !(resource instanceof URL)) {
             // istanbul ignore else: this will not be tested in NODE_ENV = production for test coverage
             if (process.env.NODE_ENV !== 'production') {
@@ -7081,8 +7554,91 @@ function buildJwtRequestInterceptor(logger) {
         url.protocol = overrideUrl.protocol;
         return [url, request];
     };
-    const jwtRequestHeaderInterceptor = buildJwtRequestHeaderInterceptor(sfapJwtManager, jwtRequestModifier);
-    return jwtRequestHeaderInterceptor;
+}
+function buildJwtRequestInterceptor(logger) {
+    return buildJwtRequestHeaderInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger));
+}
+/**
+ * Request interceptor for the direct-to-Data360 command. It cannot use the
+ * standard `JwtRequestModifier` seam because the tenant host is a JWT *claim*
+ * (`cdp_url`), and modifiers only receive `extraInfo`. So — like the copilot
+ * interceptor that reads `decodedInfo.iss` — it holds the token directly:
+ *
+ *   1. Read the command's `jwtMintParams` off the per-request context seed and
+ *      mint (via the parameterized SFAP resolver, routed by the dispatching
+ *      resolver inside `sfapJwtManager`). Without mint params there is no token
+ *      to authorize with, so leave the request untouched.
+ *   2. Decode `cdp_url` from the JWT and resolve the tenant-specific endpoint
+ *      (TSE). `cdp_url` is a bare host, so a scheme is prepended before parsing
+ *      and the protocol is forced to `https:`.
+ *   3. Only after a usable `cdp_url` is confirmed, attach `Authorization: Bearer
+ *      <jwt>` and rewrite the request URL's host/protocol to the TSE.
+ *
+ * **Trust boundary.** `cdp_url` is a claim on a first-party, server-minted JWT
+ * delivered over the same-origin Aura transport, so the interceptor does NOT police
+ * its contents (no host-suffix or format allowlist) — the routing host is the
+ * minting service's responsibility, and this mirrors the SFAP sibling, which
+ * likewise trusts the server-provided `baseUri` rewrite target. The one guard that
+ * remains is shape hygiene: if `cdp_url` is absent/empty/non-string (org not
+ * CDP-provisioned, so the server's claim gate did not fire) the interceptor throws
+ * a developer-facing error instead of an opaque parse failure. A minted token is
+ * never attached until a usable host is in hand.
+ */
+function buildData360HostRewriteInterceptor(logger) {
+    return (fetchArgs, context) => {
+        const mintParams = context?.[JWT_MINT_PARAMS_SEED_KEY];
+        // No mint params → not a parameterized Data360 request. Nothing to do.
+        if (mintParams === undefined) {
+            return resolvedPromiseLike$2(fetchArgs);
+        }
+        return resolvedPromiseLike$2(sfapJwtManager.getJwt(mintParams)).then((token) => {
+            const [resource, request] = fetchArgs;
+            if (typeof resource !== 'string' && !(resource instanceof URL)) {
+                // istanbul ignore else: not exercised under NODE_ENV=production
+                if (process.env.NODE_ENV !== 'production') {
+                    throw new Error('Data360 fetch service expects a string or URL resource');
+                }
+                return fetchArgs;
+            }
+            const cdpUrl = token.decodedInfo?.[CDP_URL_CLAIM];
+            // Require a non-empty string. This is shape hygiene, NOT a content
+            // policy: the routing host is the minting service's responsibility, and
+            // we deliberately do not couple to its contents (no host-suffix/format
+            // check — the SFAP sibling likewise trusts its server-provided rewrite
+            // target). We only confirm we were handed a usable host string; a
+            // missing/empty/non-string claim (org not Data Cloud provisioned, so the
+            // server's claim gate did not fire) fails with a clear error rather than
+            // an opaque `new URL` TypeError. The `typeof` check also narrows `cdpUrl`
+            // to `string` for the `.replace` below.
+            if (typeof cdpUrl !== 'string' || cdpUrl.length === 0) {
+                logger.warn(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim. The org may not be Data Cloud provisioned.`);
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim; cannot route the request to a Data Cloud tenant endpoint.`);
+            }
+            // `cdp_url` is a bare host (no scheme); prepend https so `new URL`
+            // parses it as an origin. Force https regardless of any scheme in the
+            // claim — the TSE is always TLS.
+            const tse = new URL(`https://${cdpUrl.replace(/^[a-z]+:\/\//i, '')}`);
+            const authorizedArgs = setHeaderAuthorization(token, [resource, request]);
+            const url = typeof resource === 'string' ? new URL(resource) : new URL(resource.toString());
+            url.host = tse.host;
+            url.protocol = 'https:';
+            return [url, authorizedArgs[1]];
+        });
+    };
+}
+/**
+ * Wraps the legacy `buildJwtRequestHeaderInterceptor` with a pass-through guard:
+ * when the parameterized interceptor has already authorized the request (an
+ * `Authorization` header is present), this returns `args` untouched so the legacy
+ * interceptor does not mint a second time or attempt to set a duplicate
+ * Authorization header (which `setHeaderAuthorization` throws on). For every legacy
+ * (non-parameterized) request no Authorization header is present yet, so the legacy
+ * interceptor runs exactly as before — a strict pass-through.
+ */
+function buildGuardedLegacyJwtRequestInterceptor(logger) {
+    const legacyInterceptor = buildJwtRequestInterceptor(logger);
+    return (args) => hasAuthorizationHeader(args) ? resolvedPromiseLike$2(args) : legacyInterceptor(args);
 }
 
 const PDL_EXECUTE_ASYNC_OPTIONS = {
@@ -10478,6 +11034,7 @@ function initializeOneStore(luvio) {
         buildLexRuntimeDefaultFetchServiceDescriptor(loggerService, retryService),
         buildUnauthorizedFetchServiceDescriptor(),
         buildJwtAuthorizedSfapFetchServiceDescriptor(loggerService),
+        buildJwtAuthorizedData360FetchServiceDescriptor(loggerService),
         buildCopilotFetchServiceDescriptor(loggerService),
         buildAuraNetworkService(),
         buildServiceDescriptor$j(instrumentationServiceDescriptor.service),
@@ -10532,4 +11089,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.428.0-dev2-ad2109c7a1
+// version: 1.428.0-dev21-c9faba50c9