@salesforce/lds-runtime-aura 1.443.0 → 1.445.0

package/dist/ldsEngineCreator.js

@@ -24,7 +24,7 @@ import { findExecutableOperation, buildGraphQLInputExtension, addTypenameToDocum
 import { print, resolveAndValidateGraphQLConfig, toGraphQLErrorResponse } from 'force/luvioOnestoreGraphqlParser';
 import getServices, { setServices } from 'force/luvioServiceProvisioner1';
 import { assertIsValid, JsonSchemaViolationError, MissingRequiredPropertyError } from 'force/luvioJsonschemaValidate5';
-import { dispatchGlobalEvent, executeGlobalControllerRawResponse } from 'aura';
+import { dispatchGlobalEvent as dispatchGlobalEvent$1, executeGlobalControllerRawResponse } from 'aura';
 import auraNetworkAdapter, { dispatchAuraAction, defaultActionConfig, instrument as instrument$1, forceRecordTransactionsDisabled as forceRecordTransactionsDisabled$1, ldsNetworkAdapterInstrument, CrudEventState, CrudEventType, UIAPI_RECORDS_PATH, UIAPI_RELATED_LIST_RECORDS_BATCH_PATH, UIAPI_RELATED_LIST_RECORDS_PATH } from 'force/ldsNetwork';
 import { ThirdPartyTracker } from 'instrumentation:thirdPartyTracker';
 import { markStart, markEnd, counter, registerCacheStats, perfStart, perfEnd, registerPeriodicLogger, interaction, timer, mark } from 'instrumentation/service';
@@ -137,7 +137,9 @@ function buildSubscribableResult$1(result, subscribe, refresh) {
 }
 function resolvedPromiseLike$2(result) {
   if (isPromiseLike$2(result)) {
-    return result.then((nextResult) => nextResult);
+    return result.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (onFulfilled, _onRejected) => {
@@ -154,7 +156,9 @@ function resolvedPromiseLike$2(result) {
 }
 function rejectedPromiseLike$2(reason) {
   if (isPromiseLike$2(reason)) {
-    return reason.then((nextResult) => nextResult);
+    return reason.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (_onFulfilled, onRejected) => {
@@ -173,8 +177,9 @@ function isPromiseLike$2(x) {
   return typeof x?.then === "function";
 }
 function stableJSONStringify$2(node) {
-  if (node && node.toJSON && typeof node.toJSON === "function") {
-    node = node.toJSON();
+  const withToJSON = node;
+  if (withToJSON && typeof withToJSON.toJSON === "function") {
+    node = withToJSON.toJSON();
   }
   if (node === void 0) {
     return;
@@ -200,11 +205,12 @@ function stableJSONStringify$2(node) {
   if (node === null) {
     return "null";
   }
-  const objKeys = keys$2(node).sort();
+  const record = node;
+  const objKeys = keys$2(record).sort();
   out = "";
   for (i = 0; i < objKeys.length; i++) {
     const key = objKeys[i];
-    const value = stableJSONStringify$2(node[key]);
+    const value = stableJSONStringify$2(record[key]);
     if (!value) {
       continue;
     }
@@ -234,6 +240,19 @@ var HttpStatusCode$1 = /* @__PURE__ */ ((HttpStatusCode2) => {
   HttpStatusCode2[HttpStatusCode2["GatewayTimeout"] = 504] = "GatewayTimeout";
   return HttpStatusCode2;
 })(HttpStatusCode$1 || {});
+function getFetchResponseFromAuraError(err2) {
+  const auraError = err2;
+  if (auraError.data !== void 0 && auraError.data.statusCode !== void 0) {
+    const data = auraError.data;
+    if (auraError.id !== void 0) {
+      data.id = auraError.id;
+    }
+    return new FetchResponse(data.statusCode, data);
+  }
+  return new FetchResponse(500, {
+    error: err2?.message
+  });
+}
 async function coerceResponseToFetchResponse(response) {
   const { status } = response;
   const responseHeaders = {};
@@ -286,9 +305,10 @@ function deepFreeze(value) {
       deepFreeze(value[i]);
     }
   } else {
-    const keys$1 = keys$2(value);
+    const record = value;
+    const keys$1 = keys$2(record);
     for (let i = 0, len = keys$1.length; i < len; i += 1) {
-      deepFreeze(value[keys$1[i]]);
+      deepFreeze(record[keys$1[i]]);
     }
   }
   freeze(value);
@@ -362,7 +382,7 @@ let NetworkCommand$1 = class NetworkCommand extends BaseCommand {
   async afterRequestHooks(_options) {
   }
 };
-function buildServiceDescriptor$r() {
+function buildServiceDescriptor$q() {
   return {
     type: "networkCommandBaseClass",
     version: "1.0",
@@ -388,7 +408,7 @@ class AuraNetworkCommand extends NetworkCommand$1 {
     );
   }
   coerceAuraErrors(auraErrors) {
-    return toError(auraErrors[0]);
+    return new UserVisibleError(getFetchResponseFromAuraError(auraErrors[0]));
   }
   /**
    * Customize how non-2xx fetch fallback responses are converted into errors.
@@ -468,7 +488,7 @@ class AuraNetworkCommand extends NetworkCommand$1 {
     return resolvedPromiseLike$2(err$1(toError("Aura/Fetch network services not found")));
   }
 }
-function buildServiceDescriptor$q() {
+function buildServiceDescriptor$p() {
   return {
     type: "auraNetworkCommandBaseClass",
     version: "1.0",
@@ -510,7 +530,9 @@ function buildSubscribableResult(result, subscribe, refresh) {
 }
 function resolvedPromiseLike$1(result) {
   if (isPromiseLike$1(result)) {
-    return result.then((nextResult) => nextResult);
+    return result.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (onFulfilled, _onRejected) => {
@@ -527,7 +549,9 @@ function resolvedPromiseLike$1(result) {
 }
 function rejectedPromiseLike$1(reason) {
   if (isPromiseLike$1(reason)) {
-    return reason.then((nextResult) => nextResult);
+    return reason.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (_onFulfilled, onRejected) => {
@@ -573,7 +597,10 @@ function deepEquals$1(x, y) {
     }
     for (let i = 0; i < xkeys.length; ++i) {
       const key = xkeys[i];
-      if (!deepEquals$1(x[key], y[key])) {
+      if (!deepEquals$1(
+        x[key],
+        y[key]
+      )) {
         return false;
       }
     }
@@ -1018,144 +1045,6 @@ function mergeCacheControlConfigs(baseConfig, overrides) {
   };
 }
 
-let AuraCacheControlCommand$1 = class AuraCacheControlCommand extends CacheControlCommand {
-  constructor(services) {
-    super(services);
-    this.services = services;
-    this.actionConfig = {
-      background: false,
-      hotspot: true,
-      longRunning: false,
-      storable: false
-    };
-    this.networkPreference = "aura";
-  }
-  get fetchParams() {
-    throw new Error(
-      "Fetch parameters must be specified when using HTTP transport on an Aura adapter"
-    );
-  }
-  shouldUseAuraNetwork() {
-    return this.services.auraNetwork !== void 0 && (this.networkPreference === "aura" || !this.services.fetch);
-  }
-  shouldUseFetch() {
-    return this.services.fetch !== void 0 && (this.networkPreference === "http" || !this.services.auraNetwork);
-  }
-  requestFromNetwork() {
-    if (this.shouldUseAuraNetwork()) {
-      return this.convertAuraResponseToData(
-        this.services.auraNetwork(this.endpoint, this.auraParams, this.actionConfig),
-        (errs) => this.coerceAuraErrors(errs)
-      );
-    } else if (this.shouldUseFetch()) {
-      const params = this.fetchParams;
-      try {
-        return this.convertFetchResponseToData(this.services.fetch(...params));
-      } catch (reason) {
-        return resolvedPromiseLike$2(err$1(toError(reason)));
-      }
-    }
-    return resolvedPromiseLike$2(err$1(toError("Aura/Fetch network services not found")));
-  }
-  coerceAuraErrors(auraErrors) {
-    return toError(auraErrors[0]);
-  }
-  async coerceError(errorResponse) {
-    return toError(errorResponse.statusText);
-  }
-  processAuraReturnValue(auraReturnValue) {
-    return ok$2(auraReturnValue);
-  }
-  processFetchReturnValue(json) {
-    return ok$2(json);
-  }
-  convertAuraResponseToData(responsePromise, coerceError) {
-    return responsePromise.then((response) => {
-      return this.processAuraReturnValue(response.getReturnValue());
-    }).finally(() => {
-      try {
-        this.afterRequestHooks({ statusCode: 200 });
-      } catch {
-      }
-    }).catch((error) => {
-      if (!error) {
-        return err$1(toError("Failed to get error from response"));
-      }
-      if (!error.getError) {
-        return err$1(toError(error));
-      }
-      const actionErrors = error.getError();
-      if (actionErrors.length > 0) {
-        return err$1(coerceError(actionErrors));
-      }
-      return err$1(toError("Error fetching component"));
-    });
-  }
-  convertFetchResponseToData(response) {
-    return response.then(
-      (response2) => {
-        if (response2.ok) {
-          return response2.json().then(
-            (json) => {
-              return this.processFetchReturnValue(json);
-            },
-            (reason) => err$1(toError(reason))
-          ).finally(() => {
-            try {
-              this.afterRequestHooks({ statusCode: response2.status });
-            } catch {
-            }
-          });
-        } else {
-          return this.coerceError(response2).then((coercedError) => {
-            return err$1(coercedError);
-          }).finally(() => {
-            try {
-              this.afterRequestHooks({ statusCode: response2.status });
-            } catch {
-            }
-          });
-        }
-      },
-      (reason) => err$1(toError(reason))
-    );
-  }
-};
-class AuraResourceCacheControlCommand extends AuraCacheControlCommand$1 {
-  constructor(services) {
-    super(services);
-    this.services = services;
-  }
-  readFromCache(cache) {
-    const data = cache.get(this.buildKey())?.value;
-    if (data === void 0) {
-      return resolvedPromiseLike$2(err$1(new Error("Failed to find data in cache")));
-    }
-    return resolvedPromiseLike$2(ok$2(data));
-  }
-  writeToCache(cache, networkResult) {
-    if (networkResult.isOk()) {
-      cache.set(this.buildKey(), {
-        value: networkResult.value,
-        metadata: {
-          cacheControl: this.buildCacheControlMetadata(networkResult.value)
-        }
-      });
-    }
-    return resolvedPromiseLike$2(void 0);
-  }
-  buildKey() {
-    return `{"endpoint":${this.endpoint},"params":${stableJSONStringify$2(this.auraParams)}}`;
-  }
-}
-function buildServiceDescriptor$p() {
-  return {
-    type: "auraResourceCacheControlCommand",
-    version: "1.0",
-    service: AuraResourceCacheControlCommand
-  };
-}
-
 class AuraCacheControlCommand extends CacheControlCommand {
   constructor(services) {
     super(services);
@@ -1441,16 +1330,16 @@ class NetworkCommand extends BaseCommand {
   }
 }
 function isAbortableCommand(command) {
-  return "isAbortableCommand" in command && command.isAbortableCommand === true;
+  return !!command && typeof command === "object" && "isAbortableCommand" in command && command.isAbortableCommand === true;
 }
 function hasFetchParams(command) {
-  return command && typeof command === "object" && "fetchParams" in command;
+  return !!command && typeof command === "object" && "fetchParams" in command;
 }
 function createAbortableDecorator(command, options) {
-  if (!options?.signal || !(options?.signal instanceof AbortSignal)) {
+  const signal = options?.signal;
+  if (!signal || !(signal instanceof AbortSignal)) {
     return command;
   }
-  const { signal } = options;
   if (isAbortableCommand(command)) {
     if (process.env.NODE_ENV !== "production") {
       console.warn(
@@ -1461,14 +1350,15 @@ function createAbortableDecorator(command, options) {
   }
   if (!hasFetchParams(command)) {
     if (process.env.NODE_ENV !== "production") {
+      const commandName = typeof command === "object" && command !== null ? command.constructor.name : typeof command;
       console.warn(
-        `Command ${command.constructor.name} does not support fetch operations. AbortSignal will be ignored.`
+        `Command ${commandName} does not support fetch operations. AbortSignal will be ignored.`
       );
     }
     return command;
   }
   try {
-    return new Proxy(command, {
+    const handler = {
       get(target, prop, receiver) {
         if (prop === "isAbortableCommand") {
           return true;
@@ -1477,8 +1367,8 @@ function createAbortableDecorator(command, options) {
           return signal;
         }
         if (prop === "fetchParams") {
-          const originalFetchParams = target[prop];
-          const isInternal = target.isInternalExecution === true;
+          const originalFetchParams = Reflect.get(target, prop, receiver);
+          const isInternal = Reflect.get(target, "isInternalExecution", receiver) === true;
           if (typeof originalFetchParams === "function") {
             return function(...args) {
               const originalReturnValue = originalFetchParams.apply(this, args);
@@ -1504,7 +1394,8 @@ function createAbortableDecorator(command, options) {
         }
         return Reflect.has(target, prop);
       }
-    });
+    };
+    return new Proxy(command, handler);
   } catch (error) {
     if (process.env.NODE_ENV !== "production") {
       console.error(
@@ -2644,7 +2535,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.443.0-be70f6bb6e
+// version: 1.445.0-117c9de71a
 
 class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
   constructor(config, documentRootType, services) {
@@ -2982,7 +2873,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.443.0-be70f6bb6e
+// version: 1.445.0-117c9de71a
 
 class RetryService {
   constructor(defaultRetryPolicy) {
@@ -3408,7 +3299,10 @@ class GraphQLImperativeBindingsService {
           const options = {
             acceptedOperations: ["query"]
           };
-          const result = resolveAndValidateGraphQLConfig(params[0], options);
+          const result = resolveAndValidateGraphQLConfig(
+            params[0],
+            options
+          );
           if (result?.isErr()) {
             return result.error;
           }
@@ -3605,7 +3499,10 @@ class GraphQLMutationBindingsService {
           const options = {
             acceptedOperations: ["mutation"]
           };
-          const result2 = resolveAndValidateGraphQLConfig(params[0], options);
+          const result2 = resolveAndValidateGraphQLConfig(
+            params[0],
+            options
+          );
           if (result2?.isErr()) {
             return {
               data: void 0,
@@ -4667,7 +4564,7 @@ var TypeCheckShapes;
     TypeCheckShapes[TypeCheckShapes["Integer"] = 3] = "Integer";
     TypeCheckShapes[TypeCheckShapes["Unsupported"] = 4] = "Unsupported";
 })(TypeCheckShapes || (TypeCheckShapes = {}));
-// engine version: 0.160.5-e6ada846
+// engine version: 0.161.0-fe06f180
 
 const { keys: keys$1 } = Object;
 
@@ -4762,6 +4659,10 @@ const SALESFORCE_API_BASE_URI_FLAG = 'api.salesforce.com';
 const X_REQUEST_ID_HEADER = 'x-request-id';
 const SFAPController = 'SalesforceApiPlatformController';
 const SFAPJwtMethod = 'getSFAPLightningJwtService';
+// Parameterized mint: the POST signature's auto-generated Aura method
+// (`@ConnectSignature(..., generateAuraMethod = true)` on the SFAP Lightning JWT
+// Service Connect resource). Takes a single `requestBody` named param.
+const SFAPJwtPostMethod = 'postSFAPLightningJwtService';
 /**
  * We expect jwt info and baseUri to be present in the response.
  *
@@ -4908,6 +4809,151 @@ function generateRequestId$1() {
     }
 }
 
+/**
+ * Normalize SFAP-shaped params into the opaque `JwtMintParams` bag that callers
+ * hand to `JwtManager.getJwt(params)`. Scopes are sorted because they are
+ * semantically a set — without this, `['a', 'b']` and `['b', 'a']` would cache
+ * as separate entries (OneStore treats arrays as ordered under stable-JSON
+ * serialization; see ADR "JWT Parameterization" §2).
+ *
+ * MANDATORY CONSUMER ENTRY POINT. Every consumer that mints a parameterized
+ * SFAP JWT MUST assemble its params through this function before calling the
+ * manager. The cache key is derived by `JwtManager` from the caller's params
+ * (`cacheKeyFor(params)`) *before* the resolver runs — so the resolver cannot
+ * normalize after the fact. Set-stable caching therefore depends on the caller
+ * routing params through here. Do NOT sort inside the resolver: that would only
+ * reorder the wire body, not the cache key, and mutating the caller's params
+ * mid-call would desync the in-flight-dedup key from the stored-token key.
+ */
+/**
+ * Validate and narrow an opaque `JwtMintParams` bag to the SFAP-shaped subset the
+ * resolver forwards. Returns `{ error }` (surfaced as a resolver rejection) for a
+ * malformed bag rather than throwing.
+ */
+function coerceToSfapParams(params) {
+    const scopes = params.scopes;
+    const dynamicParams = params.dynamicParams;
+    if (scopes !== undefined && !isStringArray(scopes)) {
+        return { error: 'SFAP JWT params.scopes must be a string[] when provided.' };
+    }
+    if (dynamicParams !== undefined && !isPrimitiveRecord(dynamicParams)) {
+        return {
+            error: 'SFAP JWT params.dynamicParams must be a Record<string, string | boolean | number> when provided.',
+        };
+    }
+    return { params: { scopes, dynamicParams } };
+}
+function isStringArray(value) {
+    return Array.isArray(value) && value.every((s) => typeof s === 'string');
+}
+/**
+ * A record whose values are JSON primitives (string, boolean, or number) — the
+ * value types the SFAP Lightning JWT Service accepts for a dynamic parameter
+ * (see {@link SfapDynamicParamValue}). Booleans/numbers are forwarded natively
+ * (not stringified) so claim handlers that gate on a native `Boolean` see the
+ * intended value. Nested objects/arrays, `null`, and `undefined` are rejected.
+ */
+function isPrimitiveRecord(value) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        return false;
+    }
+    return Object.values(value).every((v) => typeof v === 'string' || typeof v === 'boolean' || typeof v === 'number');
+}
+/**
+ * Build the SFAP mint request body from the coerced params: `scopes` joined into a
+ * single space-delimited string, `dynamicParams` mapped to `dynamicParameters.items`.
+ * Empty scopes / dynamic params are omitted.
+ */
+function buildRequestBody(params) {
+    const body = {};
+    if (params.scopes && params.scopes.length > 0) {
+        body.scopes = params.scopes.join(' ');
+    }
+    if (params.dynamicParams) {
+        const items = Object.entries(params.dynamicParams).map(([name, value]) => ({ name, value }));
+        if (items.length > 0) {
+            body.dynamicParameters = { items };
+        }
+    }
+    return body;
+}
+
+/**
+ * Parameterized SFAP JWT resolver that mints over **Aura transport** instead of a
+ * direct HTTP `fetch`.
+ *
+ * It dispatches the SFAP Lightning JWT Service's parameterized POST via its
+ * auto-generated Aura controller method
+ * `SalesforceApiPlatformController.postSFAPLightningJwtService` (generated by
+ * `@ConnectSignature(..., generateAuraMethod = true)` on the Connect resource).
+ * The mint inputs ride as the single `requestBody` named param, in the same
+ * `{ scopes, dynamicParameters: { items } }` shape the HTTP resolver POSTs — built
+ * by the shared {@link buildRequestBody}, so the two transports stay in lockstep.
+ *
+ * Why Aura (not the HTTP resolver): the mint endpoint is a same-origin core
+ * resource, and routing it over Aura keeps session/CSRF handling inside the Aura
+ * stack rather than issuing a credentialed cross-cutting `fetch` from the client.
+ * This mirrors the legacy parameterless `platformSfapJwtResolver` in
+ * `network-sfap.ts`, which already mints over Aura via the `getSFAPLightningJwtService`
+ * generated method — this is the parameterized sibling of that call.
+ *
+ * A `JwtResolver` is invoked directly by `JwtManager` (not through Luvio's
+ * `appRouter`/`ResourceRequest` pipeline), so the correct mechanism is a direct
+ * named-controller `dispatchAuraAction`, not the `auraNetworkAdapter`/connect-route
+ * table. The SFAP JWT endpoint is not registered as a connect-over-Aura route, and
+ * a resolver has no `ResourceRequest` for the router to look up.
+ */
+class ParameterizedSfapJwtAuraResolver {
+    getJwt(params) {
+        return new Promise((resolve, reject) => {
+            if (params === undefined) {
+                // Misuse: the dispatching resolver routes parameterless calls to the
+                // legacy resolver. Reject so production fails loudly here.
+                reject('ParameterizedSfapJwtAuraResolver requires JwtMintParams. The legacy parameterless path should be served by platformSfapJwtResolver.');
+                return;
+            }
+            const coerced = coerceToSfapParams(params);
+            if ('error' in coerced) {
+                reject(coerced.error);
+                return;
+            }
+            // The mint inputs become the single `requestBody` named param of the
+            // generated Aura method (Aura binds top-level keys to the controller
+            // method's named args). Reuses the HTTP resolver's body builder so both
+            // transports send an identical shape.
+            const requestBody = buildRequestBody(coerced.params);
+            // No fetchImpl / requestInterceptor / CSRF / credentials handling here —
+            // the Aura stack owns session + CSRF. Matches the legacy resolver's call.
+            dispatchAuraAction(`${SFAPController}.${SFAPJwtPostMethod}`, { requestBody }, defaultActionConfig)
+                .then((response) => {
+                const body = response.body;
+                if (!body || typeof body.jwt !== 'string' || typeof body.baseUri !== 'string') {
+                    // Never serialize the body into the error — it may carry a JWT.
+                    reject('SFAP JWT response missing required fields (jwt, baseUri)');
+                    return;
+                }
+                resolve({ jwt: body.jwt, extraInfo: { baseUri: body.baseUri } });
+            })
+                .catch((error) => {
+                // Error mapping ported from the legacy platformSfapJwtResolver
+                // (network-sfap.ts): plain Errors carry a message; non-500
+                // AuraFetchResponses are ConnectInJava errors with a typed body;
+                // 500s carry an { error } body.
+                if (error instanceof Error) {
+                    reject(error.message);
+                    return;
+                }
+                const { status } = error;
+                if (status !== HttpStatusCode$2.ServerError) {
+                    reject(error.body.message);
+                    return;
+                }
+                reject(error.body.error);
+            });
+        });
+    }
+}
+
 /**
  * Observability / Critical Availability Program (230+)
  *
@@ -5658,7 +5704,9 @@ class PrioritizedConfigService {
   // ConfigService.set
   set(priority, setter) {
     this.validated = false;
-    return setter(this.prioritizedConfigData[priority]);
+    return setter(
+      this.prioritizedConfigData[priority]
+    );
   }
   // returns the highest priority value for a given path, undefined if no value
   // is defined for the path at any priority
@@ -5717,25 +5765,62 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.443.0-3de9a44799
+// version: 1.445.0-6d38a08808
 
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
  *
- * `window.$A` is only present when the runtime is hosted inside LEX; in tests
- * and non-Aura runtimes it is absent. Centralizing the guarded access keeps the
- * `$A` lookup in one place instead of duplicating the `environmentHasAura`
- * check across modules.
+ * `window.$A` is only present when the runtime is hosted inside Aura (LEX or
+ * an Aura site); in tests and non-Aura runtimes it is absent. `getAura()`
+ * centralizes the guarded lookup so the `$A` access lives in one place instead
+ * of being duplicated across modules.
  */
+/**
+ * Returns the Aura framework global (`window.$A`) when running inside Aura
+ * (LEX or an Aura site), or `undefined` in tests and non-Aura runtimes.
+ * Centralizes the guarded `$A` lookup so callers reach for it once and read
+ * intent instead of repeating `typeof window` / `$A` guards.
+ */
+function getAura() {
+    if (typeof window === 'undefined') {
+        return undefined;
+    }
+    return window.$A;
+}
+/**
+ * Fires an Aura application-level event (e.g. `aura:invalidSession`). Thin
+ * pass-through to the `aura` framework module so callers depend on this util
+ * rather than importing `aura` directly.
+ */
+function dispatchGlobalEvent(...args) {
+    dispatchGlobalEvent$1(...args);
+}
 /**
  * Returns `$A.clientService` when running inside an Aura environment, or
  * `undefined` otherwise. Defensive: never throws.
  */
 function getAuraClientService() {
-    if (typeof window === 'undefined' || typeof window.$A === 'undefined') {
-        return undefined;
+    return getAura()?.clientService;
+}
+/**
+ * Returns `true` when the Aura runtime is hosted inside an Aura/Experience
+ * site (Experience Builder / `communityApp`) rather than LEX (one.app).
+ * `$A.get('$Site')` is present and truthy on Aura sites and absent/falsy in
+ * LEX. A stable per-page signal, so it is safe to evaluate once at module
+ * load. Defensive: never throws.
+ *
+ * Used to keep the OneStore GraphQL adapter — and the HTTP UIAPI fetch path —
+ * on the Aura transport for sites, because the HTTP transport's CSRF handling
+ * does not work in the Aura Sites runtime (W-23092947).
+ */
+function isAuraSite() {
+    const aura = getAura();
+    try {
+        return !!aura?.get?.('$Site');
+    }
+    catch {
+        return false;
     }
-    return window.$A.clientService;
 }
 
 const auraClientService = getAuraClientService();
@@ -5997,34 +6082,54 @@ function buildLuvioPageScopedCacheRequestInterceptor() {
     };
 }
 
-function buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger) {
+// Two distinct session-expiration cases on the LEX runtime path:
+// - 401 + INVALID_SESSION_ID — auth token rejected
+// - 403 + `x-sfdc-csrf-failure: true` — CSRF token rejected, session is dead
+// Both fire `aura:invalidSession`, which routes the user back to login.
+//
+// 403 access denials (INSUFFICIENT_ACCESS / INSUFFICIENT_ACCESS_OR_READONLY) are
+// intentionally NOT handled here — `aura:noAccess` without a `redirectURL`
+// triggers AuraClientService.hardRefresh() which is too heavy-handed for routine
+// "feature not enabled for this org" responses. The wire layer surfaces those
+// as normal errors; onestore PR #838 (`aura-network-command`) handles the
+// gack-noise on the Aura action path.
+function isSessionExpired(status, headers, body) {
+    if (status === 403) {
+        return headers && headers['x-sfdc-csrf-failure'] === 'true';
+    }
+    if (status === 401) {
+        // Connect REST returns errors as `[{ errorCode, ... }, ...]`; Aura Shape A
+        // uses `{ errorCode, ... }`. This interceptor runs before
+        // `buildLuvioErrorBodyNormalizationInterceptor`, so handle both.
+        const errorCode = Array.isArray(body)
+            ? body[0] && body[0].errorCode
+            : body && body.errorCode;
+        return errorCode === 'INVALID_SESSION_ID';
+    }
+    return false;
+}
+function buildLexRuntimeSessionExpirationResponseInterceptor(logger) {
     return async (response) => {
-        if (response.status === 401) {
-            try {
-                const coercedResponse = (await coerceResponseToFetchResponse(response.clone()));
-                if (coercedResponse.body.errorCode === 'INVALID_SESSION_ID') {
-                    logger.warn(`Received ${response.status} status code from LEX runtime service`);
-                    // Fire the event asynchronously, similar to the legacy setTimeout pattern
-                    window.setTimeout(() => {
-                        dispatchGlobalEvent('aura:invalidSession');
-                    }, 0);
-                }
-            }
-            catch (error) {
-                logger.warn(`Error parsing response from LEX runtime service: ${error}`);
+        const { status } = response;
+        if (status !== 401 && status !== 403)
+            return response;
+        try {
+            const coerced = (await coerceResponseToFetchResponse(response.clone()));
+            if (isSessionExpired(status, coerced.headers, coerced.body)) {
+                logger.warn(`Received ${status} status code from LEX runtime service`);
+                window.setTimeout(() => dispatchGlobalEvent('aura:invalidSession'), 0);
             }
         }
+        catch (error) {
+            logger.warn(`Error parsing response from LEX runtime service: ${error}`);
+        }
         return response;
     };
 }
-function buildLexRuntimeLuvioAuthExpirationRedirectResponseInterceptor() {
+function buildLexRuntimeLuvioSessionExpirationResponseInterceptor() {
     return async (response) => {
-        if (response.status === 401) {
-            if (response.body.errorCode === 'INVALID_SESSION_ID') {
-                window.setTimeout(() => {
-                    dispatchGlobalEvent('aura:invalidSession');
-                }, 0);
-            }
+        if (isSessionExpired(response.status, response.headers, response.body)) {
+            window.setTimeout(() => dispatchGlobalEvent('aura:invalidSession'), 0);
         }
         return response;
     };
@@ -7134,6 +7239,13 @@ const PREDICATE_PATH_SETS = [
     },
 ];
 function getEnabledPaths() {
+    // On Aura/Experience sites the HTTP UIAPI transport's CSRF handling is
+    // broken (W-23092947), so disable every HTTP UIAPI path here and let LDS
+    // fall back to the Aura transport. LEX (one.app / OneRuntime) is
+    // unaffected. This guards all current and future predicates in one place.
+    if (isAuraSite()) {
+        return [];
+    }
     const enabled = new Set();
     for (const { predicate, paths } of PREDICATE_PATH_SETS) {
         if (predicate()) {
@@ -7203,7 +7315,7 @@ const composedFetchNetworkAdapter = {
         retry: buildLuvioFetchRetryInterceptor(),
         response: [
             buildLexRuntimeLuvio5xxStatusResponseInterceptor(),
-            buildLexRuntimeLuvioAuthExpirationRedirectResponseInterceptor(),
+            buildLexRuntimeLuvioSessionExpirationResponseInterceptor(),
             buildLuvioErrorBodyNormalizationInterceptor(),
             buildLuvioTransportMarksReceiveInterceptor(),
             buildLuvioActionMarksReceiveInterceptor(),
@@ -7369,9 +7481,106 @@ function buildCsrfRetryInterceptor() {
     };
 }
 
+/**
+ * The context-seed key under which a custom command forwards its JWT mint
+ * parameters. The framework's `buildServiceDescriptor` merges the request init's
+ * `__contextSeed` onto the per-request interceptor context, so this interceptor
+ * reads the params off `context[JWT_MINT_PARAMS_SEED_KEY]`.
+ *
+ * This is a cross-team contract: the custom command writes this key, this
+ * interceptor reads it. It is intentionally an opaque key — OneStore does not
+ * define it and never inspects the param shape; the typed shape lives in the
+ * resolver.
+ */
+const JWT_MINT_PARAMS_SEED_KEY = 'jwtMintParams';
+/**
+ * Returns `true` if the fetch arguments already carry an `Authorization` header,
+ * across the three shapes the framework's `setHeader` handles: a `Request`
+ * resource's own headers, an `options.headers` `Headers` instance, or a plain
+ * record. The descriptor's guarded legacy interceptor uses this to skip when the
+ * parameterized interceptor has already authorized the request — avoiding a second
+ * mint and the throw `setHeaderAuthorization` raises on an existing header.
+ */
+function hasAuthorizationHeader([resource, options]) {
+    if (resource instanceof Request && resource.headers.has('Authorization')) {
+        return true;
+    }
+    const headers = options?.headers;
+    if (headers === undefined) {
+        return false;
+    }
+    if (headers instanceof Headers) {
+        return headers.has('Authorization');
+    }
+    if (Array.isArray(headers)) {
+        return headers.some(([name]) => name.toLowerCase() === 'authorization');
+    }
+    return Reflect.has(headers, 'Authorization');
+}
+/**
+ * Builds the request interceptor that bridges the per-request context seed to the
+ * dispatching SFAP JwtManager for the **parameterized** mint path.
+ *
+ * For a parameterized SFAP command, the context carries `jwtMintParams`. This
+ * interceptor reads them, calls `jwtManager.getJwt(params)` (which the dispatching
+ * resolver routes to the parameterized resolver), attaches the `Authorization`
+ * header, and rewrites the request URL via the minted `baseUri`. The presence of
+ * that `Authorization` header is the signal the descriptor's guarded legacy
+ * interceptor uses to skip — so the legacy path does not mint a second time.
+ *
+ * For a legacy parameterless command the context carries no `jwtMintParams`, so
+ * this interceptor **early-returns on its first line** and the request flows
+ * unchanged to the legacy `buildJwtRequestHeaderInterceptor` — guaranteeing zero
+ * behavior change for non-opted-in adapters.
+ *
+ * Lives in `lds-lightning-platform` (not OneStore) beside the existing SFAP/CSRF
+ * interceptors, per the JWT-parameterization ADR §5: OneStore provides only the
+ * generic interceptor mechanism and the opaque context-seed channel; the service-
+ * specific bridge is a runtime-layer concern.
+ *
+ * @param jwtManager - the dispatching SFAP JwtManager
+ * @param jwtRequestModifier - applies the minted `extraInfo.baseUri` to the request URL
+ */
+function buildJwtParameterizationInterceptor(jwtManager, jwtRequestModifier = (_extraInfo, fetchArgs) => fetchArgs) {
+    return (fetchArgs, context) => {
+        const jwtContext = context;
+        const mintParams = jwtContext?.[JWT_MINT_PARAMS_SEED_KEY];
+        // No mint params → not a parameterized request. Do nothing; the legacy
+        // interceptor handles it. This MUST be the first statement so non-opted-in
+        // SFAP commands observe no work at all.
+        if (mintParams === undefined) {
+            return resolvedPromiseLike$2(fetchArgs);
+        }
+        return resolvedPromiseLike$2(jwtManager.getJwt(mintParams)).then((token) => {
+            const fetchArgsWithAuthorization = setHeaderAuthorization(token, fetchArgs);
+            return token.extraInfo
+                ? jwtRequestModifier(token.extraInfo, fetchArgsWithAuthorization)
+                : fetchArgsWithAuthorization;
+        });
+    };
+}
+
 const SFAP_BASE_URL = 'api.salesforce.com';
+function buildDispatchingSfapJwtResolver(legacyResolver, parameterizedResolver) {
+    return {
+        getJwt(params) {
+            if (params === undefined) {
+                return legacyResolver.getJwt();
+            }
+            return parameterizedResolver.getJwt(params);
+        },
+    };
+}
+// The parameterized mint is dispatched over **Aura transport**:
+// the resolver calls the SFAP Lightning JWT Service's auto-generated Aura method
+// `SalesforceApiPlatformController.postSFAPLightningJwtService`, so session + CSRF
+// are handled inside the Aura stack. This mirrors the legacy parameterless
+// `platformSfapJwtResolver`, which already mints over Aura. The minted JWT is then
+// attached as a Bearer token on the downstream SFAP API request (which stays HTTP).
+const parameterizedSfapJwtResolver = new ParameterizedSfapJwtAuraResolver();
+const sfapJwtResolver = buildDispatchingSfapJwtResolver(platformSfapJwtResolver, parameterizedSfapJwtResolver);
 const sfapJwtRepository = new JwtRepository();
-const sfapJwtManager = new JwtManager(sfapJwtRepository, platformSfapJwtResolver);
+const sfapJwtManager = new JwtManager(sfapJwtRepository, sfapJwtResolver);
 function prefetchSfapJwt() {
     const maybePromise = sfapJwtManager.getJwt();
     if ('then' in maybePromise) {
@@ -7382,8 +7591,12 @@ function prefetchSfapJwt() {
 function buildJwtAuthorizedSfapFetchServiceDescriptor(logger) {
     const jwtAuthorizedFetchService = buildServiceDescriptor$2({
         createContext: createInstrumentationIdContext(),
-        request: [buildThirdPartyTrackerRegisterInterceptor(), buildJwtRequestInterceptor(logger)],
-        retry: buildCsrfRetryInterceptor(),
+        request: [
+            buildThirdPartyTrackerRegisterInterceptor(),
+            buildJwtParameterizationInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger)),
+            // Guarded so it is skipped once the parameterized interceptor handled the request.
+            buildGuardedLegacyJwtRequestInterceptor(logger),
+        ],
         finally: [buildThirdPartyTrackerFinishInterceptor()],
     });
     return {
@@ -7463,8 +7676,13 @@ function buildUnauthorizedFetchServiceDescriptor() {
         tags: { authenticationScopes: '' },
     };
 }
-function buildJwtRequestInterceptor(logger) {
-    const jwtRequestModifier = ({ baseUri }, [resource, request]) => {
+/**
+ * The `JwtRequestModifier` shared by both the legacy and parameterized SFAP
+ * interceptors: it rewrites the request URL's host/protocol to the minted
+ * `extraInfo.baseUri` (only for `api.salesforce.com` resources).
+ */
+function buildSfapJwtRequestModifier(logger) {
+    return ({ baseUri }, [resource, request]) => {
         if (typeof resource !== 'string' && !(resource instanceof URL)) {
             // istanbul ignore else: this will not be tested in NODE_ENV = production for test coverage
             if (process.env.NODE_ENV !== 'production') {
@@ -7482,8 +7700,22 @@ function buildJwtRequestInterceptor(logger) {
         url.protocol = overrideUrl.protocol;
         return [url, request];
     };
-    const jwtRequestHeaderInterceptor = buildJwtRequestHeaderInterceptor(sfapJwtManager, jwtRequestModifier);
-    return jwtRequestHeaderInterceptor;
+}
+function buildJwtRequestInterceptor(logger) {
+    return buildJwtRequestHeaderInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger));
+}
+/**
+ * Wraps the legacy `buildJwtRequestHeaderInterceptor` with a pass-through guard:
+ * when the parameterized interceptor has already authorized the request (an
+ * `Authorization` header is present), this returns `args` untouched so the legacy
+ * interceptor does not mint a second time or attempt to set a duplicate
+ * Authorization header (which `setHeaderAuthorization` throws on). For every legacy
+ * (non-parameterized) request no Authorization header is present yet, so the legacy
+ * interceptor runs exactly as before — a strict pass-through.
+ */
+function buildGuardedLegacyJwtRequestInterceptor(logger) {
+    const legacyInterceptor = buildJwtRequestInterceptor(logger);
+    return (args) => hasAuthorizationHeader(args) ? resolvedPromiseLike$2(args) : legacyInterceptor(args);
 }
 
 const PDL_EXECUTE_ASYNC_OPTIONS = {
@@ -9650,7 +9882,9 @@ function addAllToSet(targetSet, sourceSet) {
 }
 function resolvedPromiseLike(result) {
   if (isPromiseLike(result)) {
-    return result.then((nextResult) => nextResult);
+    return result.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (onFulfilled, _onRejected) => {
@@ -9667,7 +9901,9 @@ function resolvedPromiseLike(result) {
 }
 function rejectedPromiseLike(reason) {
   if (isPromiseLike(reason)) {
-    return reason.then((nextResult) => nextResult);
+    return reason.then(
+      (nextResult) => nextResult
+    );
   }
   return {
     then: (_onFulfilled, onRejected) => {
@@ -10146,7 +10382,7 @@ function getLexRuntimeDefaultInterceptorConfig(logger) {
         retry: buildCsrfRetryInterceptor(),
         response: [
             buildLexRuntime5xxStatusResponseInterceptor(logger),
-            buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger),
+            buildLexRuntimeSessionExpirationResponseInterceptor(logger),
             buildTransportMarksReceiveInterceptor(),
             buildActionMarksReceiveInterceptor(),
         ],
@@ -10163,7 +10399,7 @@ function buildLexRuntimeAllow5xxFetchServiceDescriptor(logger, retryService) {
         ...config,
         // Omit 5xx interceptor - allow 5xx responses to pass through
         response: [
-            buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger),
+            buildLexRuntimeSessionExpirationResponseInterceptor(logger),
             buildTransportMarksReceiveInterceptor(),
             buildActionMarksReceiveInterceptor(),
         ],
@@ -10998,6 +11234,11 @@ function initializeOneStore(luvio) {
     };
     // set flags based on gates
     featureFlagsService.set('useOneStoreGraphQL', useOneStoreGraphql.isOpen({ fallback: false }));
+    // On Aura/Experience sites the HTTP transport's CSRF handling is broken
+    // (W-23092947), so signal the OneStore GraphQL command to use the Aura
+    // transport there. HTTP remains the default in LEX. Paired with the HTTP
+    // UIAPI fetch path being disabled on sites (see network-fetch.ts).
+    featureFlagsService.set('graphQLUseAura', isAuraSite());
     const services = [
         instrumentationServiceDescriptor,
         buildLexRuntimeDefaultFetchServiceDescriptor(loggerService, retryService),
@@ -11009,13 +11250,12 @@ function initializeOneStore(luvio) {
         // Ordering of services matters - L1 only CacheControlService must come before durable
         buildServiceDescriptor$g(cacheServiceDescriptor.service, inMemoryCacheInclusionPolicyServiceDescriptor.service, instrumentationServiceDescriptor.service),
         durableCacheControlService,
-        buildServiceDescriptor$q(),
+        buildServiceDescriptor$p(),
         buildServiceDescriptor$e(),
         buildServiceDescriptor$m(),
-        buildServiceDescriptor$r(),
+        buildServiceDescriptor$q(),
         buildServiceDescriptor$l(),
         buildServiceDescriptor$k(),
-        buildServiceDescriptor$p(),
         buildServiceDescriptor$o(),
         buildServiceDescriptor$n(),
         buildServiceDescriptor$f(),
@@ -11058,4 +11298,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.443.0-be70f6bb6e
+// version: 1.445.0-117c9de71a