@salesforce/lds-runtime-aura 1.443.0 → 1.445.0

package/dist/types/aura-utils.d.ts

@@ -1,11 +1,34 @@
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
  *
- * `window.$A` is only present when the runtime is hosted inside LEX; in tests
- * and non-Aura runtimes it is absent. Centralizing the guarded access keeps the
- * `$A` lookup in one place instead of duplicating the `environmentHasAura`
- * check across modules.
+ * `window.$A` is only present when the runtime is hosted inside Aura (LEX or
+ * an Aura site); in tests and non-Aura runtimes it is absent. `getAura()`
+ * centralizes the guarded lookup so the `$A` access lives in one place instead
+ * of being duplicated across modules.
  */
+import { dispatchGlobalEvent as auraDispatchGlobalEvent } from 'aura';
+/**
+ * The subset of the Aura framework global (`window.$A`) that LDS reaches for.
+ * Members are optional/loosely typed because availability depends on the
+ * host's Aura version and the runtime context.
+ */
+interface Aura {
+    clientService?: AuraClientService;
+    get?: (expression: string) => unknown;
+}
+/**
+ * Returns the Aura framework global (`window.$A`) when running inside Aura
+ * (LEX or an Aura site), or `undefined` in tests and non-Aura runtimes.
+ * Centralizes the guarded `$A` lookup so callers reach for it once and read
+ * intent instead of repeating `typeof window` / `$A` guards.
+ */
+export declare function getAura(): Aura | undefined;
+/**
+ * Fires an Aura application-level event (e.g. `aura:invalidSession`). Thin
+ * pass-through to the `aura` framework module so callers depend on this util
+ * rather than importing `aura` directly.
+ */
+export declare function dispatchGlobalEvent(...args: Parameters<typeof auraDispatchGlobalEvent>): void;
 /**
  * The subset of the Aura client service LDS reaches for. Methods are optional
  * because availability depends on the host's Aura version and server gates.
@@ -19,3 +42,16 @@ export interface AuraClientService {
  * `undefined` otherwise. Defensive: never throws.
  */
 export declare function getAuraClientService(): AuraClientService | undefined;
+/**
+ * Returns `true` when the Aura runtime is hosted inside an Aura/Experience
+ * site (Experience Builder / `communityApp`) rather than LEX (one.app).
+ * `$A.get('$Site')` is present and truthy on Aura sites and absent/falsy in
+ * LEX. A stable per-page signal, so it is safe to evaluate once at module
+ * load. Defensive: never throws.
+ *
+ * Used to keep the OneStore GraphQL adapter — and the HTTP UIAPI fetch path —
+ * on the Aura transport for sites, because the HTTP transport's CSRF handling
+ * does not work in the Aura Sites runtime (W-23092947).
+ */
+export declare function isAuraSite(): boolean;
+export {};

package/dist/types/fetch-service-descriptors/jwt-authorized-fetch-service.d.ts

@@ -1,5 +1,8 @@
+import { type JwtResolver } from '@conduit-client/jwt-manager';
 import { type FetchServiceDescriptor } from '@conduit-client/service-fetch-network/v1';
+import { type ExtraInfo } from '../network-sfap';
 import { type LoggerService } from '@conduit-client/utils';
+export declare function buildDispatchingSfapJwtResolver(legacyResolver: JwtResolver<ExtraInfo>, parameterizedResolver: JwtResolver<ExtraInfo>): JwtResolver<ExtraInfo>;
 export declare function prefetchSfapJwt(): Promise<undefined>;
 export declare function buildJwtAuthorizedSfapFetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
 /**

package/dist/types/network-sfap.d.ts

@@ -2,6 +2,7 @@ import type { FetchResponse, ResourceRequest, ResourceRequestContext } from '@lu
 import type { JwtResolver } from '@conduit-client/jwt-manager';
 export declare const SFAPController = "SalesforceApiPlatformController";
 export declare const SFAPJwtMethod = "getSFAPLightningJwtService";
+export declare const SFAPJwtPostMethod = "postSFAPLightningJwtService";
 export type ExtraInfo = {
     baseUri: string;
 };

package/dist/types/parameterized-sfap-jwt-aura-resolver.d.ts

@@ -0,0 +1,34 @@
+import type { JwtMintParams, JwtResolver } from '@conduit-client/jwt-manager';
+import { type ParameterizedSfapExtraInfo } from './sfap-jwt-mint-params';
+/**
+ * Parameterized SFAP JWT resolver that mints over **Aura transport** instead of a
+ * direct HTTP `fetch`.
+ *
+ * It dispatches the SFAP Lightning JWT Service's parameterized POST via its
+ * auto-generated Aura controller method
+ * `SalesforceApiPlatformController.postSFAPLightningJwtService` (generated by
+ * `@ConnectSignature(..., generateAuraMethod = true)` on the Connect resource).
+ * The mint inputs ride as the single `requestBody` named param, in the same
+ * `{ scopes, dynamicParameters: { items } }` shape the HTTP resolver POSTs — built
+ * by the shared {@link buildRequestBody}, so the two transports stay in lockstep.
+ *
+ * Why Aura (not the HTTP resolver): the mint endpoint is a same-origin core
+ * resource, and routing it over Aura keeps session/CSRF handling inside the Aura
+ * stack rather than issuing a credentialed cross-cutting `fetch` from the client.
+ * This mirrors the legacy parameterless `platformSfapJwtResolver` in
+ * `network-sfap.ts`, which already mints over Aura via the `getSFAPLightningJwtService`
+ * generated method — this is the parameterized sibling of that call.
+ *
+ * A `JwtResolver` is invoked directly by `JwtManager` (not through Luvio's
+ * `appRouter`/`ResourceRequest` pipeline), so the correct mechanism is a direct
+ * named-controller `dispatchAuraAction`, not the `auraNetworkAdapter`/connect-route
+ * table. The SFAP JWT endpoint is not registered as a connect-over-Aura route, and
+ * a resolver has no `ResourceRequest` for the router to look up.
+ */
+export declare class ParameterizedSfapJwtAuraResolver implements JwtResolver<ParameterizedSfapExtraInfo> {
+    getJwt(params?: JwtMintParams): Promise<{
+        jwt: string;
+        extraInfo: ParameterizedSfapExtraInfo;
+    }>;
+}
+export declare function buildParameterizedSfapJwtAuraResolver(): ParameterizedSfapJwtAuraResolver;

package/dist/types/request-interceptors/jwt-parameterization.d.ts

@@ -0,0 +1,50 @@
+import type { FetchParameters, RequestInterceptor } from '@conduit-client/service-fetch-network/v1';
+import { type JwtRequestModifier } from '@conduit-client/service-fetch-network/v1';
+import type { JwtManager } from '@conduit-client/jwt-manager';
+import type { ExtraInfo } from '../network-sfap';
+/**
+ * The context-seed key under which a custom command forwards its JWT mint
+ * parameters. The framework's `buildServiceDescriptor` merges the request init's
+ * `__contextSeed` onto the per-request interceptor context, so this interceptor
+ * reads the params off `context[JWT_MINT_PARAMS_SEED_KEY]`.
+ *
+ * This is a cross-team contract: the custom command writes this key, this
+ * interceptor reads it. It is intentionally an opaque key — OneStore does not
+ * define it and never inspects the param shape; the typed shape lives in the
+ * resolver.
+ */
+export declare const JWT_MINT_PARAMS_SEED_KEY = "jwtMintParams";
+/**
+ * Returns `true` if the fetch arguments already carry an `Authorization` header,
+ * across the three shapes the framework's `setHeader` handles: a `Request`
+ * resource's own headers, an `options.headers` `Headers` instance, or a plain
+ * record. The descriptor's guarded legacy interceptor uses this to skip when the
+ * parameterized interceptor has already authorized the request — avoiding a second
+ * mint and the throw `setHeaderAuthorization` raises on an existing header.
+ */
+export declare function hasAuthorizationHeader([resource, options]: FetchParameters): boolean;
+/**
+ * Builds the request interceptor that bridges the per-request context seed to the
+ * dispatching SFAP JwtManager for the **parameterized** mint path.
+ *
+ * For a parameterized SFAP command, the context carries `jwtMintParams`. This
+ * interceptor reads them, calls `jwtManager.getJwt(params)` (which the dispatching
+ * resolver routes to the parameterized resolver), attaches the `Authorization`
+ * header, and rewrites the request URL via the minted `baseUri`. The presence of
+ * that `Authorization` header is the signal the descriptor's guarded legacy
+ * interceptor uses to skip — so the legacy path does not mint a second time.
+ *
+ * For a legacy parameterless command the context carries no `jwtMintParams`, so
+ * this interceptor **early-returns on its first line** and the request flows
+ * unchanged to the legacy `buildJwtRequestHeaderInterceptor` — guaranteeing zero
+ * behavior change for non-opted-in adapters.
+ *
+ * Lives in `lds-lightning-platform` (not OneStore) beside the existing SFAP/CSRF
+ * interceptors, per the JWT-parameterization ADR §5: OneStore provides only the
+ * generic interceptor mechanism and the opaque context-seed channel; the service-
+ * specific bridge is a runtime-layer concern.
+ *
+ * @param jwtManager - the dispatching SFAP JwtManager
+ * @param jwtRequestModifier - applies the minted `extraInfo.baseUri` to the request URL
+ */
+export declare function buildJwtParameterizationInterceptor(jwtManager: JwtManager<unknown, ExtraInfo>, jwtRequestModifier?: JwtRequestModifier): RequestInterceptor;

package/dist/types/response-interceptors/{lex-runtime-auth-expiration-redirect.d.ts → lex-runtime-session-expiration.d.ts}

@@ -1,5 +1,5 @@
 import type { LoggerService } from '@conduit-client/utils';
 import type { ResponseInterceptor } from '@conduit-client/service-fetch-network/v1';
 import type { ResponseInterceptor as LuvioResponseInterceptor } from '@salesforce/lds-network-fetch';
-export declare function buildLexRuntimeAuthExpirationRedirectResponseInterceptor(logger: LoggerService): ResponseInterceptor;
-export declare function buildLexRuntimeLuvioAuthExpirationRedirectResponseInterceptor(): LuvioResponseInterceptor;
+export declare function buildLexRuntimeSessionExpirationResponseInterceptor(logger: LoggerService): ResponseInterceptor;
+export declare function buildLexRuntimeLuvioSessionExpirationResponseInterceptor(): LuvioResponseInterceptor;

package/dist/types/sfap-jwt-mint-params.d.ts

@@ -0,0 +1,80 @@
+import type { JwtMintParams } from '@conduit-client/jwt-manager';
+/**
+ * JSON-primitive value a dynamic mint parameter may take.
+ *
+ * Mirrors the SFAP Lightning JWT Service's own `validateValue`
+ * (`SFAPLightningJwtServiceResource.java`), which accepts native `Boolean`,
+ * `Number`, or `String` and lets the minted claim's type follow the JSON type.
+ * The resolver therefore forwards these primitives verbatim — it must NOT
+ * stringify booleans/numbers, because the `data_cloud_user_claims` handler gates
+ * on native `Boolean.TRUE.equals(...)` and silently drops a stringified `"true"`.
+ */
+export type SfapDynamicParamValue = string | boolean | number;
+/**
+ * Typed shape of the params the SFAP Lightning JWT Service understands.
+ * Lives in the resolver layer because OneStore is param-shape-agnostic; it
+ * sees only an opaque `JwtMintParams` bag and stable-JSON-stringifies it for
+ * cache keying.
+ */
+export type SfapJwtMintParams = {
+    scopes?: string[];
+    dynamicParams?: Record<string, SfapDynamicParamValue>;
+};
+/**
+ * The `extraInfo` the SFAP JWT resolver returns alongside the minted token: the
+ * per-tenant base URI the downstream SFAP API request is rewritten to.
+ */
+export type ParameterizedSfapExtraInfo = {
+    baseUri: string;
+};
+type DynamicParameterItem = {
+    name: string;
+    value: SfapDynamicParamValue;
+};
+/**
+ * The SFAP Lightning JWT Service mint request body. Sent as the `requestBody`
+ * named param of the `postSFAPLightningJwtService` Aura controller method.
+ * Matches the server's `SFAPLightningJwtServiceInputRepresentation`: `scopes` is
+ * a single space-delimited string; `dynamicParameters` is `{ items: [{ name, value }] }`.
+ */
+export type SfapJwtRequestBody = {
+    scopes?: string;
+    dynamicParameters?: {
+        items: DynamicParameterItem[];
+    };
+};
+/**
+ * Normalize SFAP-shaped params into the opaque `JwtMintParams` bag that callers
+ * hand to `JwtManager.getJwt(params)`. Scopes are sorted because they are
+ * semantically a set — without this, `['a', 'b']` and `['b', 'a']` would cache
+ * as separate entries (OneStore treats arrays as ordered under stable-JSON
+ * serialization; see ADR "JWT Parameterization" §2).
+ *
+ * MANDATORY CONSUMER ENTRY POINT. Every consumer that mints a parameterized
+ * SFAP JWT MUST assemble its params through this function before calling the
+ * manager. The cache key is derived by `JwtManager` from the caller's params
+ * (`cacheKeyFor(params)`) *before* the resolver runs — so the resolver cannot
+ * normalize after the fact. Set-stable caching therefore depends on the caller
+ * routing params through here. Do NOT sort inside the resolver: that would only
+ * reorder the wire body, not the cache key, and mutating the caller's params
+ * mid-call would desync the in-flight-dedup key from the stored-token key.
+ */
+export declare function buildSfapJwtMintParams(params: SfapJwtMintParams): JwtMintParams;
+export type SfapParamsResult = {
+    params: SfapJwtMintParams;
+} | {
+    error: string;
+};
+/**
+ * Validate and narrow an opaque `JwtMintParams` bag to the SFAP-shaped subset the
+ * resolver forwards. Returns `{ error }` (surfaced as a resolver rejection) for a
+ * malformed bag rather than throwing.
+ */
+export declare function coerceToSfapParams(params: JwtMintParams): SfapParamsResult;
+/**
+ * Build the SFAP mint request body from the coerced params: `scopes` joined into a
+ * single space-delimited string, `dynamicParams` mapped to `dynamicParameters.items`.
+ * Empty scopes / dynamic params are omitted.
+ */
+export declare function buildRequestBody(params: SfapJwtMintParams): SfapJwtRequestBody;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-aura",
-    "version": "1.443.0",
+    "version": "1.445.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for Aura runtime.",
     "main": "dist/ldsEngineCreator.js",
@@ -34,61 +34,61 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.22.0",
-        "@conduit-client/tools-core": "3.22.0",
-        "@salesforce/lds-adapters-apex": "^1.443.0",
-        "@salesforce/lds-adapters-uiapi": "^1.443.0",
-        "@salesforce/lds-ads-bridge": "^1.443.0",
-        "@salesforce/lds-aura-storage": "^1.443.0",
-        "@salesforce/lds-bindings": "^1.443.0",
-        "@salesforce/lds-instrumentation": "^1.443.0",
-        "@salesforce/lds-network-adapter": "^1.443.0",
-        "@salesforce/lds-network-aura": "^1.443.0",
-        "@salesforce/lds-network-fetch": "^1.443.0",
+        "@conduit-client/service-provisioner": "3.24.0",
+        "@conduit-client/tools-core": "3.24.0",
+        "@salesforce/lds-adapters-apex": "^1.445.0",
+        "@salesforce/lds-adapters-uiapi": "^1.445.0",
+        "@salesforce/lds-ads-bridge": "^1.445.0",
+        "@salesforce/lds-aura-storage": "^1.445.0",
+        "@salesforce/lds-bindings": "^1.445.0",
+        "@salesforce/lds-instrumentation": "^1.445.0",
+        "@salesforce/lds-network-adapter": "^1.445.0",
+        "@salesforce/lds-network-aura": "^1.445.0",
+        "@salesforce/lds-network-fetch": "^1.445.0",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.22.0",
-        "@conduit-client/command-aura-network": "3.22.0",
-        "@conduit-client/command-aura-normalized-cache-control": "3.22.0",
-        "@conduit-client/command-aura-resource-cache-control": "3.22.0",
-        "@conduit-client/command-fetch-network": "3.22.0",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.22.0",
-        "@conduit-client/command-http-normalized-cache-control": "3.22.0",
-        "@conduit-client/command-ndjson": "3.22.0",
-        "@conduit-client/command-network": "3.22.0",
-        "@conduit-client/command-sse": "3.22.0",
-        "@conduit-client/command-streaming": "3.22.0",
-        "@conduit-client/service-aura-network": "3.22.0",
-        "@conduit-client/service-bindings-imperative": "3.22.0",
-        "@conduit-client/service-bindings-lwc": "3.22.0",
-        "@conduit-client/service-cache": "3.22.0",
-        "@conduit-client/service-cache-control": "3.22.0",
-        "@conduit-client/service-cache-inclusion-policy": "3.22.0",
-        "@conduit-client/service-config": "3.22.0",
-        "@conduit-client/service-feature-flags": "3.22.0",
-        "@conduit-client/service-fetch-network": "3.22.0",
-        "@conduit-client/service-instrument-command": "3.22.0",
-        "@conduit-client/service-pubsub": "3.22.0",
-        "@conduit-client/service-renewable-resource-manager": "3.22.0",
-        "@conduit-client/service-store": "3.22.0",
-        "@conduit-client/utils": "3.22.0",
-        "@luvio/network-adapter-composable": "0.160.5",
-        "@luvio/network-adapter-fetch": "0.160.5",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.24.0",
+        "@conduit-client/command-aura-network": "3.24.0",
+        "@conduit-client/command-aura-normalized-cache-control": "3.24.0",
+        "@conduit-client/command-fetch-network": "3.24.0",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.24.0",
+        "@conduit-client/command-http-normalized-cache-control": "3.24.0",
+        "@conduit-client/command-ndjson": "3.24.0",
+        "@conduit-client/command-network": "3.24.0",
+        "@conduit-client/command-sse": "3.24.0",
+        "@conduit-client/command-streaming": "3.24.0",
+        "@conduit-client/jwt-manager": "3.24.0",
+        "@conduit-client/service-aura-network": "3.24.0",
+        "@conduit-client/service-bindings-imperative": "3.24.0",
+        "@conduit-client/service-bindings-lwc": "3.24.0",
+        "@conduit-client/service-cache": "3.24.0",
+        "@conduit-client/service-cache-control": "3.24.0",
+        "@conduit-client/service-cache-inclusion-policy": "3.24.0",
+        "@conduit-client/service-config": "3.24.0",
+        "@conduit-client/service-feature-flags": "3.24.0",
+        "@conduit-client/service-fetch-network": "3.24.0",
+        "@conduit-client/service-instrument-command": "3.24.0",
+        "@conduit-client/service-pubsub": "3.24.0",
+        "@conduit-client/service-renewable-resource-manager": "3.24.0",
+        "@conduit-client/service-store": "3.24.0",
+        "@conduit-client/utils": "3.24.0",
+        "@luvio/network-adapter-composable": "0.161.0",
+        "@luvio/network-adapter-fetch": "0.161.0",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.443.0",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.445.0",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.443.0",
-        "@salesforce/lds-luvio-service": "^1.443.0",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.443.0"
+        "@salesforce/lds-durable-storage": "^1.445.0",
+        "@salesforce/lds-luvio-service": "^1.445.0",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.445.0"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/ldsEngineCreator.js",
             "maxSize": {
-                "none": "390 kB",
+                "none": "410 kB",
                 "min": "190 kB",
-                "compressed": "65.5 kB"
+                "compressed": "71 kB"
             }
         }
     ],