@salesforce/lds-runtime-aura 1.449.0 → 1.450.0

package/dist/ldsEngineCreator.js

@@ -40,11 +40,10 @@ import lightningConnectEnabled from '@salesforce/gate/ui.services.LightningConne
 import bypassAppRestrictionEnabled from '@salesforce/gate/ui.services.LightningConnect.BypassAppRestriction.enabled';
 import csrfValidationEnabled from '@salesforce/gate/ui.services.LightningConnect.CsrfValidation.enabled';
 import sessionApiEnabled from '@salesforce/gate/ui.uisdk.session.api.enabled';
+import useHttpUiapiLex from '@salesforce/gate/lds.usehttpuiapilex';
+import useHttpUiapiOneRuntime from '@salesforce/gate/lds.useHttpUiapiOneRuntime';
+import useHttpUiapiAuraSites from '@salesforce/gate/lds.usehttpuiapiaurasites';
 import auraBasedRequestsEnabled from '@salesforce/gate/ui.services.auraBasedRequests.enabled';
-import useHttpUiapiOneAppPublic from '@salesforce/gate/lds.useHttpUiapiOneAppPublic';
-import useHttpUiapiOneAppPrivate from '@salesforce/gate/lds.useHttpUiapiOneAppPrivate';
-import useHttpUiapiOneRuntimePublic from '@salesforce/gate/lds.useHttpUiapiOneRuntimePublic';
-import useHttpUiapiOneRuntimePrivate from '@salesforce/gate/lds.useHttpUiapiOneRuntimePrivate';
 import disableCreateContentDocumentAndVersionHTTPLexRuntime from '@salesforce/gate/lds.lex.http.disableCreateContentDocumentAndVersion';
 import useHotspotLimit from '@salesforce/gate/lds.pdl.useHotspotLimit';
 import { createStorage, clearStorages } from 'force/ldsDurableStorage';
@@ -2591,7 +2590,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.449.0-83e1fb14eb
+// version: 1.450.0-163071957b
 
 class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
   constructor(config, documentRootType, services) {
@@ -2930,7 +2929,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.449.0-83e1fb14eb
+// version: 1.450.0-163071957b
 
 class RetryService {
   constructor(defaultRetryPolicy) {
@@ -3143,6 +3142,15 @@ function buildUserlandError(error) {
   }
   return new Error("Internal error in Lightning Data Service adapter occurred.");
 }
+function unwrapUserlandError(error) {
+  if (isUserVisibleError(error)) {
+    return error.data;
+  }
+  return toError(error);
+}
+function throwUnwrappedUserlandError(error) {
+  throw unwrapUserlandError(error);
+}
 function logError(error) {
   if (isUserVisibleError(error)) {
     return;
@@ -3206,7 +3214,9 @@ class DefaultImperativeBindingsService {
         deepFreeze(result.value);
         return isSubscribableResult(result) ? result.value.data : result.value;
       }
-      throw toError(isSubscribableResult(result) ? result.error.failure : result.error);
+      throwUnwrappedUserlandError(
+        isSubscribableResult(result) ? result.error.failure : result.error
+      );
     });
   }
 }
@@ -3224,7 +3234,9 @@ class QueryImperativeBindingsService {
         deepFreeze(result.value);
         return isSubscribableResult(result) ? { data: result.value.data } : { data: result.value };
       }
-      throw toError(isSubscribableResult(result) ? result.error.failure : result.error);
+      throwUnwrappedUserlandError(
+        isSubscribableResult(result) ? result.error.failure : result.error
+      );
     });
   }
 }
@@ -3256,7 +3268,10 @@ class SubscribableImperativeBindingsService {
         subscribe: (cb) => {
           return result.value.subscribe((result2) => {
             if (result2.isErr()) {
-              return cb({ data: void 0, error: toError(result2.error) });
+              return cb({
+                data: void 0,
+                error: unwrapUserlandError(result2.error)
+              });
             }
             return cb({ data: result2.value, error: void 0 });
           });
@@ -3278,7 +3293,7 @@ class SubscribableImperativeBindingsService {
         return api;
       }
     } else {
-      throw toError(result.error.failure);
+      throwUnwrappedUserlandError(result.error.failure);
     }
   }
 }
@@ -3300,7 +3315,7 @@ class LegacyImperativeBindingsService {
           deepFreeze(result.value);
           callback({ data: result.value.data, error: void 0 });
         } else {
-          callback({ data: void 0, error: toError(result.error.failure) });
+          callback({ data: void 0, error: unwrapUserlandError(result.error.failure) });
         }
       } catch (error) {
         emitError(callback, error);
@@ -3315,14 +3330,20 @@ class LegacyImperativeBindingsService {
         command.execute(overrides).then(
           (result) => {
             if (!result.isOk()) {
-              callback({ data: void 0, error: toError(result.error.failure) });
+              callback({
+                data: void 0,
+                error: unwrapUserlandError(result.error.failure)
+              });
               return;
             }
             unsubscribe = result.value.subscribe((res) => {
               if (res.isOk()) {
                 callback({ data: res.value, error: void 0 });
               } else {
-                callback({ data: void 0, error: toError(res.error) });
+                callback({
+                  data: void 0,
+                  error: unwrapUserlandError(res.error)
+                });
               }
             });
             callback({ data: result.value.data, error: void 0 });
@@ -5822,7 +5843,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.449.0-7b415dc950
+// version: 1.450.0-b7557fd74b
 
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
@@ -6431,21 +6452,16 @@ async function getCsrfToken() {
     }
 }
 /**
- * Checks if all server-side UiSdk gates required for the HTTP UIAPI path are
- * open. These mirror the gates core evaluates when accepting a SID-based
- * (first-party) Connect request; the CSRF token is only attached when all are
- * open. All are required OPEN — `auraBasedRequests` expands the set of
- * Connect resources reachable over HTTP, it is not an aura-vs-http toggle.
+ * Checks if all required gates are enabled for CSRF token interceptor.
  *
  * @returns true if all gates are enabled, false otherwise
  */
-function areHttpGatesEnabled() {
+function areCsrfGatesEnabled() {
     try {
         return (lightningConnectEnabled.isOpen({ fallback: false }) &&
             bypassAppRestrictionEnabled.isOpen({ fallback: false }) &&
             csrfValidationEnabled.isOpen({ fallback: false }) &&
-            sessionApiEnabled.isOpen({ fallback: false }) &&
-            auraBasedRequestsEnabled.isOpen({ fallback: false }));
+            sessionApiEnabled.isOpen({ fallback: false }));
     }
     catch (error) {
         // If any gate check fails, disable CSRF interceptor
@@ -6479,7 +6495,7 @@ function isCsrfMethod(method) {
 function buildCsrfTokenInterceptor() {
     return async (fetchArgs) => {
         // Check if all required gates are enabled before running
-        if (!areHttpGatesEnabled()) {
+        if (!areCsrfGatesEnabled()) {
             return resolvedPromiseLike$2(fetchArgs);
         }
         const [urlOrRequest, options] = fetchArgs;
@@ -6512,7 +6528,7 @@ function buildCsrfTokenInterceptor() {
 function buildLuvioCsrfTokenInterceptor() {
     return async (resourceRequest) => {
         // Check if all required gates are enabled before running
-        if (!areHttpGatesEnabled()) {
+        if (!areCsrfGatesEnabled()) {
             return resolvedPromiseLike$2(resourceRequest);
         }
         // Ensure headers object exists
@@ -7273,41 +7289,67 @@ const CONTENT_DOCUMENTS_VERSIONS_PATH = '/ui-api/records/content-documents/conte
  *   paths: ['/ui-api/some-endpoint/{id}'],
  * }
  */
+// Each runtime uses a SINGLE LDS gate that enables both the public and
+// private path lists. The public/private split is preserved as two separate
+// arrays because the PRIVATE paths carry an extra condition: the server-side
+// `auraBasedRequests` UiSdk gate. If UiSdk turns that gate off, private
+// (UiTier-restricted) Connect resources can no longer be served over HTTP and
+// must fall back to Aura, whereas public/allowlisted paths are unaffected.
+//
+// Runtimes are mutually exclusive: One Runtime (globalThis.LWR), Aura Sites
+// ($Site present), and LEX/one.app (everything else). Each has its own gate.
 const PREDICATE_PATH_SETS = [
     // One Runtime — public UIAPI endpoints
     {
-        predicate: () => isOneRuntime() && useHttpUiapiOneRuntimePublic.isOpen({ fallback: false }),
+        predicate: () => isOneRuntime() && useHttpUiapiOneRuntime.isOpen({ fallback: false }),
         paths: UIAPI_PUBLIC_PATHS,
     },
-    // One Runtime — private UIAPI endpoints
+    // One Runtime — private UIAPI endpoints (also require the UiSdk gate)
     {
-        predicate: () => isOneRuntime() && useHttpUiapiOneRuntimePrivate.isOpen({ fallback: false }),
+        predicate: () => isOneRuntime() &&
+            useHttpUiapiOneRuntime.isOpen({ fallback: false }) &&
+            auraBasedRequestsEnabled.isOpen({ fallback: false }),
         paths: UIAPI_PRIVATE_PATHS,
     },
-    // one.app — public UIAPI endpoints
+    // Aura Sites — public UIAPI endpoints.
+    // Gate defaults closed, which keeps HTTP UIAPI OFF on Aura/Experience sites:
+    // the HTTP transport's CSRF handling is broken there (W-23092947), so until
+    // that is fixed this gate must not be opened. Wiring it as a normal gated
+    // predicate (rather than a hard block) lets it be flipped on once CSRF works.
     {
-        predicate: () => !isOneRuntime() && useHttpUiapiOneAppPublic.isOpen({ fallback: false }),
+        predicate: () => isAuraSite() && useHttpUiapiAuraSites.isOpen({ fallback: false }),
         paths: UIAPI_PUBLIC_PATHS,
     },
-    // one.app — private UIAPI endpoints
+    // Aura Sites — private UIAPI endpoints (also require the UiSdk gate)
     {
-        predicate: () => !isOneRuntime() && useHttpUiapiOneAppPrivate.isOpen({ fallback: false }),
+        predicate: () => isAuraSite() &&
+            useHttpUiapiAuraSites.isOpen({ fallback: false }) &&
+            auraBasedRequestsEnabled.isOpen({ fallback: false }),
         paths: UIAPI_PRIVATE_PATHS,
     },
-    // disableCreateContentDocumentAndVersionHTTPLexRuntime killswitch
+    // LEX (one.app) — public UIAPI endpoints
     {
-        predicate: () => !disableCreateContentDocumentAndVersionHTTPLexRuntime.isOpen({ fallback: false }),
+        predicate: () => !isOneRuntime() && !isAuraSite() && useHttpUiapiLex.isOpen({ fallback: false }),
+        paths: UIAPI_PUBLIC_PATHS,
+    },
+    // LEX (one.app) — private UIAPI endpoints (also require the UiSdk gate)
+    {
+        predicate: () => !isOneRuntime() &&
+            !isAuraSite() &&
+            useHttpUiapiLex.isOpen({ fallback: false }) &&
+            auraBasedRequestsEnabled.isOpen({ fallback: false }),
+        paths: UIAPI_PRIVATE_PATHS,
+    },
+    // disableCreateContentDocumentAndVersionHTTPLexRuntime killswitch.
+    // Excluded on Aura Sites for the same broken-CSRF reason as the UIAPI paths
+    // (W-23092947); LEX / One Runtime are unaffected.
+    {
+        predicate: () => !isAuraSite() &&
+            !disableCreateContentDocumentAndVersionHTTPLexRuntime.isOpen({ fallback: false }),
         paths: [CONTENT_DOCUMENTS_VERSIONS_PATH],
     },
 ];
 function getEnabledPaths() {
-    // On Aura/Experience sites the HTTP UIAPI transport's CSRF handling is
-    // broken (W-23092947), so disable every HTTP UIAPI path here and let LDS
-    // fall back to the Aura transport. LEX (one.app / OneRuntime) is
-    // unaffected. This guards all current and future predicates in one place.
-    if (isAuraSite()) {
-        return [];
-    }
     const enabled = new Set();
     for (const { predicate, paths } of PREDICATE_PATH_SETS) {
         if (predicate()) {
@@ -7712,6 +7754,12 @@ function buildJwtAuthorizedData360FetchServiceDescriptor(logger) {
         request: [
             buildThirdPartyTrackerRegisterInterceptor(),
             buildData360HostRewriteInterceptor(logger),
+            // Compression runs LAST, after the host-rewrite interceptor has minted,
+            // attached the Bearer token, and rewritten the URL — so it only ever sees
+            // the final request body. It is a strict pass-through: bodies that are
+            // missing, non-string, or under the 1KB threshold flow through untouched,
+            // preserving the tuple (URL + Authorization header) the rewrite produced.
+            buildCompressionInterceptor({ algorithm: 'gzip' }),
         ],
         finally: [buildThirdPartyTrackerFinishInterceptor()],
     });
@@ -7874,6 +7922,7 @@ function buildData360HostRewriteInterceptor(logger) {
             // to `string` for the `.replace` below.
             if (typeof cdpUrl !== 'string' || cdpUrl.length === 0) {
                 logger.warn(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim. The org may not be Data Cloud provisioned.`);
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
                 throw new Error(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim; cannot route the request to a Data Cloud tenant endpoint.`);
             }
             // `cdp_url` is a bare host (no scheme); prepend https so `new URL`
@@ -11163,6 +11212,9 @@ function buildAuraDurableCacheInclusionPolicyService(config) {
     };
 }
 
+// Registration published on the force/ldsEngine bus so shared (cross-runtime) laf
+// loaders can read buildPredictorForContext without importing a bootstrap bundle.
+const PDL_ENGINE_REGISTRATION_ID = '@salesforce/lds-pdl-engine';
 // This code *should* be in lds-network-adapter, but when combined with the Aura
 // component test workaround in lds-default-luvio it creates a circular dependecy
 // between lds-default-luvio and lds-network-adapter. We do the register on behalf
@@ -11171,6 +11223,16 @@ register({
     id: '@salesforce/lds-network-adapter',
     instrument: ldsNetworkAdapterInstrument,
 });
+// Publish buildPredictorForContext on the force/ldsEngine registration bus so that
+// shared laf loaders can obtain it without a dynamic import("force/ldsEngineCreator"),
+// which would evaluate this whole bootstrap a second time. See ADR
+// 2026-07-10-pdl-service-provisioner-decoupling. buildPredictorForContext is a hoisted
+// function declaration and internally no-ops (returns undefined) when the PDL gate is
+// off, so registering it unconditionally is safe.
+register({
+    id: PDL_ENGINE_REGISTRATION_ID,
+    buildPredictorForContext,
+});
 function setTrackedFieldsConfig() {
     configuration.setTrackedFieldDepthOnCacheMiss(1);
     configuration.setTrackedFieldDepthOnCacheMergeConflict(1);
@@ -11483,5 +11545,5 @@ function ldsEngineCreator() {
     return { name: 'ldsEngineCreator' };
 }
 
-export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.449.0-83e1fb14eb
+export { LexRequestStrategy, PDL_ENGINE_REGISTRATION_ID, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
+// version: 1.450.0-163071957b

package/dist/types/main.d.ts

@@ -7,6 +7,11 @@ import { type LexRequest } from './predictive-loading/lex';
 export { PdlRequestPriority, PdlPrefetcherEventType } from './predictive-loading';
 export { LexRequestStrategy } from './predictive-loading/request-strategy/lex-request-strategy';
 export { configService } from './config-service-util';
+export declare const PDL_ENGINE_REGISTRATION_ID = "@salesforce/lds-pdl-engine";
+export type PdlEngineRegistration = {
+    id: typeof PDL_ENGINE_REGISTRATION_ID;
+    buildPredictorForContext: typeof buildPredictorForContext;
+};
 /**
  * Registers a request strategy to be utilized by PDL.
  * @param requestStrategy - {@link LexRequestStrategy} The request strategy/strategies to register.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-aura",
-    "version": "1.449.0",
+    "version": "1.450.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for Aura runtime.",
     "main": "dist/ldsEngineCreator.js",
@@ -34,61 +34,61 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.25.1",
-        "@conduit-client/tools-core": "3.25.1",
-        "@salesforce/lds-adapters-apex": "^1.449.0",
-        "@salesforce/lds-adapters-uiapi": "^1.449.0",
-        "@salesforce/lds-ads-bridge": "^1.449.0",
-        "@salesforce/lds-aura-storage": "^1.449.0",
-        "@salesforce/lds-bindings": "^1.449.0",
-        "@salesforce/lds-instrumentation": "^1.449.0",
-        "@salesforce/lds-network-adapter": "^1.449.0",
-        "@salesforce/lds-network-aura": "^1.449.0",
-        "@salesforce/lds-network-fetch": "^1.449.0",
+        "@conduit-client/service-provisioner": "3.26.0",
+        "@conduit-client/tools-core": "3.26.0",
+        "@salesforce/lds-adapters-apex": "^1.450.0",
+        "@salesforce/lds-adapters-uiapi": "^1.450.0",
+        "@salesforce/lds-ads-bridge": "^1.450.0",
+        "@salesforce/lds-aura-storage": "^1.450.0",
+        "@salesforce/lds-bindings": "^1.450.0",
+        "@salesforce/lds-instrumentation": "^1.450.0",
+        "@salesforce/lds-network-adapter": "^1.450.0",
+        "@salesforce/lds-network-aura": "^1.450.0",
+        "@salesforce/lds-network-fetch": "^1.450.0",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.25.1",
-        "@conduit-client/command-aura-network": "3.25.1",
-        "@conduit-client/command-aura-normalized-cache-control": "3.25.1",
-        "@conduit-client/command-fetch-network": "3.25.1",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.25.1",
-        "@conduit-client/command-http-normalized-cache-control": "3.25.1",
-        "@conduit-client/command-ndjson": "3.25.1",
-        "@conduit-client/command-network": "3.25.1",
-        "@conduit-client/command-sse": "3.25.1",
-        "@conduit-client/command-streaming": "3.25.1",
-        "@conduit-client/jwt-manager": "3.25.1",
-        "@conduit-client/service-aura-network": "3.25.1",
-        "@conduit-client/service-bindings-imperative": "3.25.1",
-        "@conduit-client/service-bindings-lwc": "3.25.1",
-        "@conduit-client/service-cache": "3.25.1",
-        "@conduit-client/service-cache-control": "3.25.1",
-        "@conduit-client/service-cache-inclusion-policy": "3.25.1",
-        "@conduit-client/service-config": "3.25.1",
-        "@conduit-client/service-feature-flags": "3.25.1",
-        "@conduit-client/service-fetch-network": "3.25.1",
-        "@conduit-client/service-instrument-command": "3.25.1",
-        "@conduit-client/service-pubsub": "3.25.1",
-        "@conduit-client/service-renewable-resource-manager": "3.25.1",
-        "@conduit-client/service-store": "3.25.1",
-        "@conduit-client/utils": "3.25.1",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.26.0",
+        "@conduit-client/command-aura-network": "3.26.0",
+        "@conduit-client/command-aura-normalized-cache-control": "3.26.0",
+        "@conduit-client/command-fetch-network": "3.26.0",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.26.0",
+        "@conduit-client/command-http-normalized-cache-control": "3.26.0",
+        "@conduit-client/command-ndjson": "3.26.0",
+        "@conduit-client/command-network": "3.26.0",
+        "@conduit-client/command-sse": "3.26.0",
+        "@conduit-client/command-streaming": "3.26.0",
+        "@conduit-client/jwt-manager": "3.26.0",
+        "@conduit-client/service-aura-network": "3.26.0",
+        "@conduit-client/service-bindings-imperative": "3.26.0",
+        "@conduit-client/service-bindings-lwc": "3.26.0",
+        "@conduit-client/service-cache": "3.26.0",
+        "@conduit-client/service-cache-control": "3.26.0",
+        "@conduit-client/service-cache-inclusion-policy": "3.26.0",
+        "@conduit-client/service-config": "3.26.0",
+        "@conduit-client/service-feature-flags": "3.26.0",
+        "@conduit-client/service-fetch-network": "3.26.0",
+        "@conduit-client/service-instrument-command": "3.26.0",
+        "@conduit-client/service-pubsub": "3.26.0",
+        "@conduit-client/service-renewable-resource-manager": "3.26.0",
+        "@conduit-client/service-store": "3.26.0",
+        "@conduit-client/utils": "3.26.0",
         "@luvio/network-adapter-composable": "0.161.0",
         "@luvio/network-adapter-fetch": "0.161.0",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.449.0",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.450.0",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.449.0",
-        "@salesforce/lds-luvio-service": "^1.449.0",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.449.0"
+        "@salesforce/lds-durable-storage": "^1.450.0",
+        "@salesforce/lds-luvio-service": "^1.450.0",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.450.0"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/ldsEngineCreator.js",
             "maxSize": {
-                "none": "412 kB",
+                "none": "415 kB",
                 "min": "190 kB",
-                "compressed": "72 kB"
+                "compressed": "73 kB"
             }
         }
     ],