@salesforce/lds-runtime-aura 1.428.0-dev2 → 1.428.0-dev21

package/dist/types/fetch-service-descriptors/jwt-authorized-fetch-service.d.ts

@@ -1,6 +1,31 @@
+import { type JwtResolver } from '@conduit-client/jwt-manager';
 import { type FetchServiceDescriptor } from '@conduit-client/service-fetch-network/v1';
+import { type ExtraInfo } from '../network-sfap';
 import { type LoggerService } from '@conduit-client/utils';
+export declare function buildDispatchingSfapJwtResolver(legacyResolver: JwtResolver<ExtraInfo>, parameterizedResolver: JwtResolver<ExtraInfo>): JwtResolver<ExtraInfo>;
+export declare function prefetchSfapJwt(): Promise<undefined>;
 export declare function buildJwtAuthorizedSfapFetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+export declare function buildJwtAuthorizedData360FetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than

package/dist/types/network-sfap.d.ts

@@ -2,6 +2,7 @@ import type { FetchResponse, ResourceRequest, ResourceRequestContext } from '@lu
 import type { JwtResolver } from '@conduit-client/jwt-manager';
 export declare const SFAPController = "SalesforceApiPlatformController";
 export declare const SFAPJwtMethod = "getSFAPLightningJwtService";
+export declare const SFAPJwtPostMethod = "postSFAPLightningJwtService";
 export type ExtraInfo = {
     baseUri: string;
 };
@@ -10,7 +11,6 @@ export type ExtraInfo = {
  * {@link JwtResolver} for platform SFAP
  */
 export declare const platformSfapJwtResolver: JwtResolver<ExtraInfo>;
-export declare function prefetchSfapJwt(): Promise<undefined>;
 declare const composedNetworkAdapter: {
     shouldHandleRequest(resourceRequest: ResourceRequest): boolean;
     adapter: (resourceRequest: ResourceRequest, resourceRequestContext: ResourceRequestContext) => Promise<FetchResponse<any>>;

package/dist/types/parameterized-sfap-jwt-aura-resolver.d.ts

@@ -0,0 +1,34 @@
+import type { JwtMintParams, JwtResolver } from '@conduit-client/jwt-manager';
+import { type ParameterizedSfapExtraInfo } from './sfap-jwt-mint-params';
+/**
+ * Parameterized SFAP JWT resolver that mints over **Aura transport** instead of a
+ * direct HTTP `fetch`.
+ *
+ * It dispatches the SFAP Lightning JWT Service's parameterized POST via its
+ * auto-generated Aura controller method
+ * `SalesforceApiPlatformController.postSFAPLightningJwtService` (generated by
+ * `@ConnectSignature(..., generateAuraMethod = true)` on the Connect resource).
+ * The mint inputs ride as the single `requestBody` named param, in the same
+ * `{ scopes, dynamicParameters: { items } }` shape the HTTP resolver POSTs — built
+ * by the shared {@link buildRequestBody}, so the two transports stay in lockstep.
+ *
+ * Why Aura (not the HTTP resolver): the mint endpoint is a same-origin core
+ * resource, and routing it over Aura keeps session/CSRF handling inside the Aura
+ * stack rather than issuing a credentialed cross-cutting `fetch` from the client.
+ * This mirrors the legacy parameterless `platformSfapJwtResolver` in
+ * `network-sfap.ts`, which already mints over Aura via the `getSFAPLightningJwtService`
+ * generated method — this is the parameterized sibling of that call.
+ *
+ * A `JwtResolver` is invoked directly by `JwtManager` (not through Luvio's
+ * `appRouter`/`ResourceRequest` pipeline), so the correct mechanism is a direct
+ * named-controller `dispatchAuraAction`, not the `auraNetworkAdapter`/connect-route
+ * table. The SFAP JWT endpoint is not registered as a connect-over-Aura route, and
+ * a resolver has no `ResourceRequest` for the router to look up.
+ */
+export declare class ParameterizedSfapJwtAuraResolver implements JwtResolver<ParameterizedSfapExtraInfo> {
+    getJwt(params?: JwtMintParams): Promise<{
+        jwt: string;
+        extraInfo: ParameterizedSfapExtraInfo;
+    }>;
+}
+export declare function buildParameterizedSfapJwtAuraResolver(): ParameterizedSfapJwtAuraResolver;

package/dist/types/request-interceptors/jwt-parameterization.d.ts

@@ -0,0 +1,50 @@
+import type { FetchParameters, RequestInterceptor } from '@conduit-client/service-fetch-network/v1';
+import { type JwtRequestModifier } from '@conduit-client/service-fetch-network/v1';
+import type { JwtManager } from '@conduit-client/jwt-manager';
+import type { ExtraInfo } from '../network-sfap';
+/**
+ * The context-seed key under which a custom command forwards its JWT mint
+ * parameters. The framework's `buildServiceDescriptor` merges the request init's
+ * `__contextSeed` onto the per-request interceptor context, so this interceptor
+ * reads the params off `context[JWT_MINT_PARAMS_SEED_KEY]`.
+ *
+ * This is a cross-team contract: the custom command writes this key, this
+ * interceptor reads it. It is intentionally an opaque key — OneStore does not
+ * define it and never inspects the param shape; the typed shape lives in the
+ * resolver.
+ */
+export declare const JWT_MINT_PARAMS_SEED_KEY = "jwtMintParams";
+/**
+ * Returns `true` if the fetch arguments already carry an `Authorization` header,
+ * across the three shapes the framework's `setHeader` handles: a `Request`
+ * resource's own headers, an `options.headers` `Headers` instance, or a plain
+ * record. The descriptor's guarded legacy interceptor uses this to skip when the
+ * parameterized interceptor has already authorized the request — avoiding a second
+ * mint and the throw `setHeaderAuthorization` raises on an existing header.
+ */
+export declare function hasAuthorizationHeader([resource, options]: FetchParameters): boolean;
+/**
+ * Builds the request interceptor that bridges the per-request context seed to the
+ * dispatching SFAP JwtManager for the **parameterized** mint path.
+ *
+ * For a parameterized SFAP command, the context carries `jwtMintParams`. This
+ * interceptor reads them, calls `jwtManager.getJwt(params)` (which the dispatching
+ * resolver routes to the parameterized resolver), attaches the `Authorization`
+ * header, and rewrites the request URL via the minted `baseUri`. The presence of
+ * that `Authorization` header is the signal the descriptor's guarded legacy
+ * interceptor uses to skip — so the legacy path does not mint a second time.
+ *
+ * For a legacy parameterless command the context carries no `jwtMintParams`, so
+ * this interceptor **early-returns on its first line** and the request flows
+ * unchanged to the legacy `buildJwtRequestHeaderInterceptor` — guaranteeing zero
+ * behavior change for non-opted-in adapters.
+ *
+ * Lives in `lds-lightning-platform` (not OneStore) beside the existing SFAP/CSRF
+ * interceptors, per the JWT-parameterization ADR §5: OneStore provides only the
+ * generic interceptor mechanism and the opaque context-seed channel; the service-
+ * specific bridge is a runtime-layer concern.
+ *
+ * @param jwtManager - the dispatching SFAP JwtManager
+ * @param jwtRequestModifier - applies the minted `extraInfo.baseUri` to the request URL
+ */
+export declare function buildJwtParameterizationInterceptor(jwtManager: JwtManager<unknown, ExtraInfo>, jwtRequestModifier?: JwtRequestModifier): RequestInterceptor;

package/dist/types/retry-policies/csrf-token-retry-policy.d.ts

@@ -1,4 +1,5 @@
-import { RetryPolicy, RetryContext } from '@conduit-client/service-retry/v1';
+import type { RetryContext } from '@conduit-client/service-retry/v1';
+import { RetryPolicy } from '@conduit-client/service-retry/v1';
 import type { FetchParameters } from '@conduit-client/service-fetch-network/v1';
 type CsrfTokenRetryPolicyConfig = {
     /**

package/dist/types/sfap-jwt-mint-params.d.ts

@@ -0,0 +1,80 @@
+import type { JwtMintParams } from '@conduit-client/jwt-manager';
+/**
+ * JSON-primitive value a dynamic mint parameter may take.
+ *
+ * Mirrors the SFAP Lightning JWT Service's own `validateValue`
+ * (`SFAPLightningJwtServiceResource.java`), which accepts native `Boolean`,
+ * `Number`, or `String` and lets the minted claim's type follow the JSON type.
+ * The resolver therefore forwards these primitives verbatim — it must NOT
+ * stringify booleans/numbers, because the `data_cloud_user_claims` handler gates
+ * on native `Boolean.TRUE.equals(...)` and silently drops a stringified `"true"`.
+ */
+export type SfapDynamicParamValue = string | boolean | number;
+/**
+ * Typed shape of the params the SFAP Lightning JWT Service understands.
+ * Lives in the resolver layer because OneStore is param-shape-agnostic; it
+ * sees only an opaque `JwtMintParams` bag and stable-JSON-stringifies it for
+ * cache keying.
+ */
+export type SfapJwtMintParams = {
+    scopes?: string[];
+    dynamicParams?: Record<string, SfapDynamicParamValue>;
+};
+/**
+ * The `extraInfo` the SFAP JWT resolver returns alongside the minted token: the
+ * per-tenant base URI the downstream SFAP API request is rewritten to.
+ */
+export type ParameterizedSfapExtraInfo = {
+    baseUri: string;
+};
+type DynamicParameterItem = {
+    name: string;
+    value: SfapDynamicParamValue;
+};
+/**
+ * The SFAP Lightning JWT Service mint request body. Sent as the `requestBody`
+ * named param of the `postSFAPLightningJwtService` Aura controller method.
+ * Matches the server's `SFAPLightningJwtServiceInputRepresentation`: `scopes` is
+ * a single space-delimited string; `dynamicParameters` is `{ items: [{ name, value }] }`.
+ */
+export type SfapJwtRequestBody = {
+    scopes?: string;
+    dynamicParameters?: {
+        items: DynamicParameterItem[];
+    };
+};
+/**
+ * Normalize SFAP-shaped params into the opaque `JwtMintParams` bag that callers
+ * hand to `JwtManager.getJwt(params)`. Scopes are sorted because they are
+ * semantically a set — without this, `['a', 'b']` and `['b', 'a']` would cache
+ * as separate entries (OneStore treats arrays as ordered under stable-JSON
+ * serialization; see ADR "JWT Parameterization" §2).
+ *
+ * MANDATORY CONSUMER ENTRY POINT. Every consumer that mints a parameterized
+ * SFAP JWT MUST assemble its params through this function before calling the
+ * manager. The cache key is derived by `JwtManager` from the caller's params
+ * (`cacheKeyFor(params)`) *before* the resolver runs — so the resolver cannot
+ * normalize after the fact. Set-stable caching therefore depends on the caller
+ * routing params through here. Do NOT sort inside the resolver: that would only
+ * reorder the wire body, not the cache key, and mutating the caller's params
+ * mid-call would desync the in-flight-dedup key from the stored-token key.
+ */
+export declare function buildSfapJwtMintParams(params: SfapJwtMintParams): JwtMintParams;
+export type SfapParamsResult = {
+    params: SfapJwtMintParams;
+} | {
+    error: string;
+};
+/**
+ * Validate and narrow an opaque `JwtMintParams` bag to the SFAP-shaped subset the
+ * resolver forwards. Returns `{ error }` (surfaced as a resolver rejection) for a
+ * malformed bag rather than throwing.
+ */
+export declare function coerceToSfapParams(params: JwtMintParams): SfapParamsResult;
+/**
+ * Build the SFAP mint request body from the coerced params: `scopes` joined into a
+ * single space-delimited string, `dynamicParams` mapped to `dynamicParameters.items`.
+ * Empty scopes / dynamic params are omitted.
+ */
+export declare function buildRequestBody(params: SfapJwtMintParams): SfapJwtRequestBody;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-aura",
-    "version": "1.428.0-dev2",
+    "version": "1.428.0-dev21",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for Aura runtime",
     "main": "dist/ldsEngineCreator.js",
@@ -34,59 +34,60 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.18.0",
-        "@conduit-client/tools-core": "3.18.0",
-        "@salesforce/lds-adapters-apex": "^1.428.0-dev2",
-        "@salesforce/lds-adapters-uiapi": "^1.428.0-dev2",
-        "@salesforce/lds-ads-bridge": "^1.428.0-dev2",
-        "@salesforce/lds-aura-storage": "^1.428.0-dev2",
-        "@salesforce/lds-bindings": "^1.428.0-dev2",
-        "@salesforce/lds-instrumentation": "^1.428.0-dev2",
-        "@salesforce/lds-network-aura": "^1.428.0-dev2",
-        "@salesforce/lds-network-fetch": "^1.428.0-dev2",
+        "@conduit-client/service-provisioner": "3.19.0-dev3",
+        "@conduit-client/tools-core": "3.19.0-dev3",
+        "@salesforce/lds-adapters-apex": "^1.428.0-dev21",
+        "@salesforce/lds-adapters-uiapi": "^1.428.0-dev21",
+        "@salesforce/lds-ads-bridge": "^1.428.0-dev21",
+        "@salesforce/lds-aura-storage": "^1.428.0-dev21",
+        "@salesforce/lds-bindings": "^1.428.0-dev21",
+        "@salesforce/lds-instrumentation": "^1.428.0-dev21",
+        "@salesforce/lds-network-aura": "^1.428.0-dev21",
+        "@salesforce/lds-network-fetch": "^1.428.0-dev21",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.18.0",
-        "@conduit-client/command-aura-network": "3.18.0",
-        "@conduit-client/command-aura-normalized-cache-control": "3.18.0",
-        "@conduit-client/command-aura-resource-cache-control": "3.18.0",
-        "@conduit-client/command-fetch-network": "3.18.0",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.18.0",
-        "@conduit-client/command-http-normalized-cache-control": "3.18.0",
-        "@conduit-client/command-ndjson": "3.18.0",
-        "@conduit-client/command-network": "3.18.0",
-        "@conduit-client/command-sse": "3.18.0",
-        "@conduit-client/command-streaming": "3.18.0",
-        "@conduit-client/service-aura-network": "3.18.0",
-        "@conduit-client/service-bindings-imperative": "3.18.0",
-        "@conduit-client/service-bindings-lwc": "3.18.0",
-        "@conduit-client/service-cache": "3.18.0",
-        "@conduit-client/service-cache-control": "3.18.0",
-        "@conduit-client/service-cache-inclusion-policy": "3.18.0",
-        "@conduit-client/service-config": "3.18.0",
-        "@conduit-client/service-feature-flags": "3.18.0",
-        "@conduit-client/service-fetch-network": "3.18.0",
-        "@conduit-client/service-instrument-command": "3.18.0",
-        "@conduit-client/service-pubsub": "3.18.0",
-        "@conduit-client/service-store": "3.18.0",
-        "@conduit-client/utils": "3.18.0",
-        "@luvio/network-adapter-composable": "0.160.3",
-        "@luvio/network-adapter-fetch": "0.160.3",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.19.0-dev3",
+        "@conduit-client/command-aura-network": "3.19.0-dev3",
+        "@conduit-client/command-aura-normalized-cache-control": "3.19.0-dev3",
+        "@conduit-client/command-aura-resource-cache-control": "3.19.0-dev3",
+        "@conduit-client/command-fetch-network": "3.19.0-dev3",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.19.0-dev3",
+        "@conduit-client/command-http-normalized-cache-control": "3.19.0-dev3",
+        "@conduit-client/command-ndjson": "3.19.0-dev3",
+        "@conduit-client/command-network": "3.19.0-dev3",
+        "@conduit-client/command-sse": "3.19.0-dev3",
+        "@conduit-client/command-streaming": "3.19.0-dev3",
+        "@conduit-client/jwt-manager": "3.19.0-dev3",
+        "@conduit-client/service-aura-network": "3.19.0-dev3",
+        "@conduit-client/service-bindings-imperative": "3.19.0-dev3",
+        "@conduit-client/service-bindings-lwc": "3.19.0-dev3",
+        "@conduit-client/service-cache": "3.19.0-dev3",
+        "@conduit-client/service-cache-control": "3.19.0-dev3",
+        "@conduit-client/service-cache-inclusion-policy": "3.19.0-dev3",
+        "@conduit-client/service-config": "3.19.0-dev3",
+        "@conduit-client/service-feature-flags": "3.19.0-dev3",
+        "@conduit-client/service-fetch-network": "3.19.0-dev3",
+        "@conduit-client/service-instrument-command": "3.19.0-dev3",
+        "@conduit-client/service-pubsub": "3.19.0-dev3",
+        "@conduit-client/service-store": "3.19.0-dev3",
+        "@conduit-client/utils": "3.19.0-dev3",
+        "@luvio/network-adapter-composable": "0.160.4-dev1",
+        "@luvio/network-adapter-fetch": "0.160.4-dev1",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.428.0-dev2",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.428.0-dev21",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.428.0-dev2",
-        "@salesforce/lds-luvio-service": "^1.428.0-dev2",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.428.0-dev2"
+        "@salesforce/lds-durable-storage": "^1.428.0-dev21",
+        "@salesforce/lds-luvio-service": "^1.428.0-dev21",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.428.0-dev21"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/ldsEngineCreator.js",
             "maxSize": {
-                "none": "370 kB",
+                "none": "410 kB",
                 "min": "190 kB",
-                "compressed": "61.9 kB"
+                "compressed": "71.5 kB"
             }
         }
     ],