@salesforce/lds-runtime-aura 1.449.0 → 1.451.0-dev1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -22,9 +22,9 @@ import { instrument, getRecordAvatarsAdapterFactory, getRecordAdapterFactory, co
22
22
  import { getInstrumentation } from 'o11y/client';
23
23
  import { findExecutableOperation, buildGraphQLInputExtension, addTypenameToDocument } from 'force/luvioGraphqlNormalization';
24
24
  import { print, resolveAndValidateGraphQLConfig, toGraphQLErrorResponse } from 'force/luvioOnestoreGraphqlParser';
25
- import getServices, { setServices } from 'force/luvioServiceProvisioner1';
26
- import { assertIsValid, JsonSchemaViolationError, MissingRequiredPropertyError } from 'force/luvioJsonschemaValidate5';
25
+ import getServices, { buildStaticServiceResolver, setServiceResolver, setServices } from 'force/luvioServiceProvisioner1';
27
26
  import { dispatchGlobalEvent as dispatchGlobalEvent$1, executeGlobalControllerRawResponse } from 'aura';
27
+ import { assertIsValid, JsonSchemaViolationError, MissingRequiredPropertyError } from 'force/luvioJsonschemaValidate5';
28
28
  import auraNetworkAdapter, { dispatchAuraAction, defaultActionConfig, instrument as instrument$1, forceRecordTransactionsDisabled as forceRecordTransactionsDisabled$1, ldsNetworkAdapterInstrument, CrudEventState, CrudEventType, UIAPI_RECORDS_PATH, UIAPI_RELATED_LIST_RECORDS_BATCH_PATH, UIAPI_RELATED_LIST_RECORDS_PATH } from 'force/ldsNetwork';
29
29
  import { ThirdPartyTracker } from 'instrumentation:thirdPartyTracker';
30
30
  import { markStart, markEnd, counter, registerCacheStats, perfStart, perfEnd, registerPeriodicLogger, interaction, timer, mark } from 'instrumentation/service';
@@ -40,11 +40,10 @@ import lightningConnectEnabled from '@salesforce/gate/ui.services.LightningConne
40
40
  import bypassAppRestrictionEnabled from '@salesforce/gate/ui.services.LightningConnect.BypassAppRestriction.enabled';
41
41
  import csrfValidationEnabled from '@salesforce/gate/ui.services.LightningConnect.CsrfValidation.enabled';
42
42
  import sessionApiEnabled from '@salesforce/gate/ui.uisdk.session.api.enabled';
43
+ import useHttpUiapiLex from '@salesforce/gate/lds.usehttpuiapilex';
44
+ import useHttpUiapiOneRuntime from '@salesforce/gate/lds.useHttpUiapiOneRuntime';
45
+ import useHttpUiapiAuraSites from '@salesforce/gate/lds.usehttpuiapiaurasites';
43
46
  import auraBasedRequestsEnabled from '@salesforce/gate/ui.services.auraBasedRequests.enabled';
44
- import useHttpUiapiOneAppPublic from '@salesforce/gate/lds.useHttpUiapiOneAppPublic';
45
- import useHttpUiapiOneAppPrivate from '@salesforce/gate/lds.useHttpUiapiOneAppPrivate';
46
- import useHttpUiapiOneRuntimePublic from '@salesforce/gate/lds.useHttpUiapiOneRuntimePublic';
47
- import useHttpUiapiOneRuntimePrivate from '@salesforce/gate/lds.useHttpUiapiOneRuntimePrivate';
48
47
  import disableCreateContentDocumentAndVersionHTTPLexRuntime from '@salesforce/gate/lds.lex.http.disableCreateContentDocumentAndVersion';
49
48
  import useHotspotLimit from '@salesforce/gate/lds.pdl.useHotspotLimit';
50
49
  import { createStorage, clearStorages } from 'force/ldsDurableStorage';
@@ -2591,7 +2590,7 @@ function buildServiceDescriptor$d(luvio) {
2591
2590
  },
2592
2591
  };
2593
2592
  }
2594
- // version: 1.449.0-83e1fb14eb
2593
+ // version: 1.451.0-dev1-a2c5e50338
2595
2594
 
2596
2595
  class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
2597
2596
  constructor(config, documentRootType, services) {
@@ -2930,7 +2929,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
2930
2929
  },
2931
2930
  };
2932
2931
  }
2933
- // version: 1.449.0-83e1fb14eb
2932
+ // version: 1.451.0-dev1-a2c5e50338
2934
2933
 
2935
2934
  class RetryService {
2936
2935
  constructor(defaultRetryPolicy) {
@@ -3082,6 +3081,90 @@ function buildServiceDescriptor$8(defaultRetryPolicy) {
3082
3081
  };
3083
3082
  }
3084
3083
 
3084
+ function tagsEqual(a, b) {
3085
+ const keys = Object.keys(b);
3086
+ return (a !== undefined && keys.length === Object.keys(a).length && keys.every((k) => a[k] === b[k]));
3087
+ }
3088
+ // W-23092947: on Aura sites HTTP-to-core is broken, so withhold every `fetch` service
3089
+ // except those whose request tags are in `allowedFetchTags` (the external hosts). A
3090
+ // withheld optional fetch resolves to `undefined`, making `AuraNetworkCommand` use Aura.
3091
+ function buildAuraSiteServiceResolver(services, allowedFetchTags) {
3092
+ const staticResolver = buildStaticServiceResolver(services);
3093
+ const isWithheld = (req) => req.type === 'fetch' && !allowedFetchTags.some((allowed) => tagsEqual(req.tags, allowed));
3094
+ return (requested) => {
3095
+ const passthrough = {};
3096
+ const withheldUnresolved = [];
3097
+ for (const [name, req] of Object.entries(requested)) {
3098
+ if (!isWithheld(req)) {
3099
+ passthrough[name] = req;
3100
+ }
3101
+ else if (!('optional' in req && req.optional)) {
3102
+ withheldUnresolved.push(name);
3103
+ }
3104
+ }
3105
+ return staticResolver(passthrough).then(([resolved, unresolved]) => [
3106
+ resolved,
3107
+ [...unresolved, ...withheldUnresolved],
3108
+ ]);
3109
+ };
3110
+ }
3111
+
3112
+ /**
3113
+ * Helpers for reaching the Aura framework from the LDS Aura runtime.
3114
+ *
3115
+ * `window.$A` is only present when the runtime is hosted inside Aura (LEX or
3116
+ * an Aura site); in tests and non-Aura runtimes it is absent. `getAura()`
3117
+ * centralizes the guarded lookup so the `$A` access lives in one place instead
3118
+ * of being duplicated across modules.
3119
+ */
3120
+ /**
3121
+ * Returns the Aura framework global (`window.$A`) when running inside Aura
3122
+ * (LEX or an Aura site), or `undefined` in tests and non-Aura runtimes.
3123
+ * Centralizes the guarded `$A` lookup so callers reach for it once and read
3124
+ * intent instead of repeating `typeof window` / `$A` guards.
3125
+ */
3126
+ function getAura() {
3127
+ if (typeof window === 'undefined') {
3128
+ return undefined;
3129
+ }
3130
+ return window.$A;
3131
+ }
3132
+ /**
3133
+ * Fires an Aura application-level event (e.g. `aura:invalidSession`). Thin
3134
+ * pass-through to the `aura` framework module so callers depend on this util
3135
+ * rather than importing `aura` directly.
3136
+ */
3137
+ function dispatchGlobalEvent(...args) {
3138
+ dispatchGlobalEvent$1(...args);
3139
+ }
3140
+ /**
3141
+ * Returns `$A.clientService` when running inside an Aura environment, or
3142
+ * `undefined` otherwise. Defensive: never throws.
3143
+ */
3144
+ function getAuraClientService() {
3145
+ return getAura()?.clientService;
3146
+ }
3147
+ /**
3148
+ * Returns `true` when the Aura runtime is hosted inside an Aura/Experience
3149
+ * site (Experience Builder / `communityApp`) rather than LEX (one.app).
3150
+ * `$A.get('$Site')` is present and truthy on Aura sites and absent/falsy in
3151
+ * LEX. A stable per-page signal, so it is safe to evaluate once at module
3152
+ * load. Defensive: never throws.
3153
+ *
3154
+ * Used to keep the OneStore GraphQL adapter — and the HTTP UIAPI fetch path —
3155
+ * on the Aura transport for sites, because the HTTP transport's CSRF handling
3156
+ * does not work in the Aura Sites runtime (W-23092947).
3157
+ */
3158
+ function isAuraSite() {
3159
+ const aura = getAura();
3160
+ try {
3161
+ return !!aura?.get?.('$Site');
3162
+ }
3163
+ catch {
3164
+ return false;
3165
+ }
3166
+ }
3167
+
3085
3168
  class BasicRenewableResourceManager {
3086
3169
  constructor(config) {
3087
3170
  this.config = config;
@@ -3143,6 +3226,15 @@ function buildUserlandError(error) {
3143
3226
  }
3144
3227
  return new Error("Internal error in Lightning Data Service adapter occurred.");
3145
3228
  }
3229
+ function unwrapUserlandError(error) {
3230
+ if (isUserVisibleError(error)) {
3231
+ return error.data;
3232
+ }
3233
+ return toError(error);
3234
+ }
3235
+ function throwUnwrappedUserlandError(error) {
3236
+ throw unwrapUserlandError(error);
3237
+ }
3146
3238
  function logError(error) {
3147
3239
  if (isUserVisibleError(error)) {
3148
3240
  return;
@@ -3206,7 +3298,9 @@ class DefaultImperativeBindingsService {
3206
3298
  deepFreeze(result.value);
3207
3299
  return isSubscribableResult(result) ? result.value.data : result.value;
3208
3300
  }
3209
- throw toError(isSubscribableResult(result) ? result.error.failure : result.error);
3301
+ throwUnwrappedUserlandError(
3302
+ isSubscribableResult(result) ? result.error.failure : result.error
3303
+ );
3210
3304
  });
3211
3305
  }
3212
3306
  }
@@ -3224,7 +3318,9 @@ class QueryImperativeBindingsService {
3224
3318
  deepFreeze(result.value);
3225
3319
  return isSubscribableResult(result) ? { data: result.value.data } : { data: result.value };
3226
3320
  }
3227
- throw toError(isSubscribableResult(result) ? result.error.failure : result.error);
3321
+ throwUnwrappedUserlandError(
3322
+ isSubscribableResult(result) ? result.error.failure : result.error
3323
+ );
3228
3324
  });
3229
3325
  }
3230
3326
  }
@@ -3256,7 +3352,10 @@ class SubscribableImperativeBindingsService {
3256
3352
  subscribe: (cb) => {
3257
3353
  return result.value.subscribe((result2) => {
3258
3354
  if (result2.isErr()) {
3259
- return cb({ data: void 0, error: toError(result2.error) });
3355
+ return cb({
3356
+ data: void 0,
3357
+ error: unwrapUserlandError(result2.error)
3358
+ });
3260
3359
  }
3261
3360
  return cb({ data: result2.value, error: void 0 });
3262
3361
  });
@@ -3278,7 +3377,7 @@ class SubscribableImperativeBindingsService {
3278
3377
  return api;
3279
3378
  }
3280
3379
  } else {
3281
- throw toError(result.error.failure);
3380
+ throwUnwrappedUserlandError(result.error.failure);
3282
3381
  }
3283
3382
  }
3284
3383
  }
@@ -3300,7 +3399,7 @@ class LegacyImperativeBindingsService {
3300
3399
  deepFreeze(result.value);
3301
3400
  callback({ data: result.value.data, error: void 0 });
3302
3401
  } else {
3303
- callback({ data: void 0, error: toError(result.error.failure) });
3402
+ callback({ data: void 0, error: unwrapUserlandError(result.error.failure) });
3304
3403
  }
3305
3404
  } catch (error) {
3306
3405
  emitError(callback, error);
@@ -3315,14 +3414,20 @@ class LegacyImperativeBindingsService {
3315
3414
  command.execute(overrides).then(
3316
3415
  (result) => {
3317
3416
  if (!result.isOk()) {
3318
- callback({ data: void 0, error: toError(result.error.failure) });
3417
+ callback({
3418
+ data: void 0,
3419
+ error: unwrapUserlandError(result.error.failure)
3420
+ });
3319
3421
  return;
3320
3422
  }
3321
3423
  unsubscribe = result.value.subscribe((res) => {
3322
3424
  if (res.isOk()) {
3323
3425
  callback({ data: res.value, error: void 0 });
3324
3426
  } else {
3325
- callback({ data: void 0, error: toError(res.error) });
3427
+ callback({
3428
+ data: void 0,
3429
+ error: unwrapUserlandError(res.error)
3430
+ });
3326
3431
  }
3327
3432
  });
3328
3433
  callback({ data: result.value.data, error: void 0 });
@@ -5822,63 +5927,7 @@ function getEnvironmentSetting(name) {
5822
5927
  }
5823
5928
  return undefined;
5824
5929
  }
5825
- // version: 1.449.0-7b415dc950
5826
-
5827
- /**
5828
- * Helpers for reaching the Aura framework from the LDS Aura runtime.
5829
- *
5830
- * `window.$A` is only present when the runtime is hosted inside Aura (LEX or
5831
- * an Aura site); in tests and non-Aura runtimes it is absent. `getAura()`
5832
- * centralizes the guarded lookup so the `$A` access lives in one place instead
5833
- * of being duplicated across modules.
5834
- */
5835
- /**
5836
- * Returns the Aura framework global (`window.$A`) when running inside Aura
5837
- * (LEX or an Aura site), or `undefined` in tests and non-Aura runtimes.
5838
- * Centralizes the guarded `$A` lookup so callers reach for it once and read
5839
- * intent instead of repeating `typeof window` / `$A` guards.
5840
- */
5841
- function getAura() {
5842
- if (typeof window === 'undefined') {
5843
- return undefined;
5844
- }
5845
- return window.$A;
5846
- }
5847
- /**
5848
- * Fires an Aura application-level event (e.g. `aura:invalidSession`). Thin
5849
- * pass-through to the `aura` framework module so callers depend on this util
5850
- * rather than importing `aura` directly.
5851
- */
5852
- function dispatchGlobalEvent(...args) {
5853
- dispatchGlobalEvent$1(...args);
5854
- }
5855
- /**
5856
- * Returns `$A.clientService` when running inside an Aura environment, or
5857
- * `undefined` otherwise. Defensive: never throws.
5858
- */
5859
- function getAuraClientService() {
5860
- return getAura()?.clientService;
5861
- }
5862
- /**
5863
- * Returns `true` when the Aura runtime is hosted inside an Aura/Experience
5864
- * site (Experience Builder / `communityApp`) rather than LEX (one.app).
5865
- * `$A.get('$Site')` is present and truthy on Aura sites and absent/falsy in
5866
- * LEX. A stable per-page signal, so it is safe to evaluate once at module
5867
- * load. Defensive: never throws.
5868
- *
5869
- * Used to keep the OneStore GraphQL adapter — and the HTTP UIAPI fetch path —
5870
- * on the Aura transport for sites, because the HTTP transport's CSRF handling
5871
- * does not work in the Aura Sites runtime (W-23092947).
5872
- */
5873
- function isAuraSite() {
5874
- const aura = getAura();
5875
- try {
5876
- return !!aura?.get?.('$Site');
5877
- }
5878
- catch {
5879
- return false;
5880
- }
5881
- }
5930
+ // version: 1.451.0-dev1-70d3966695
5882
5931
 
5883
5932
  const auraClientService = getAuraClientService();
5884
5933
  const defaultConfig = {
@@ -6431,21 +6480,16 @@ async function getCsrfToken() {
6431
6480
  }
6432
6481
  }
6433
6482
  /**
6434
- * Checks if all server-side UiSdk gates required for the HTTP UIAPI path are
6435
- * open. These mirror the gates core evaluates when accepting a SID-based
6436
- * (first-party) Connect request; the CSRF token is only attached when all are
6437
- * open. All are required OPEN — `auraBasedRequests` expands the set of
6438
- * Connect resources reachable over HTTP, it is not an aura-vs-http toggle.
6483
+ * Checks if all required gates are enabled for CSRF token interceptor.
6439
6484
  *
6440
6485
  * @returns true if all gates are enabled, false otherwise
6441
6486
  */
6442
- function areHttpGatesEnabled() {
6487
+ function areCsrfGatesEnabled() {
6443
6488
  try {
6444
6489
  return (lightningConnectEnabled.isOpen({ fallback: false }) &&
6445
6490
  bypassAppRestrictionEnabled.isOpen({ fallback: false }) &&
6446
6491
  csrfValidationEnabled.isOpen({ fallback: false }) &&
6447
- sessionApiEnabled.isOpen({ fallback: false }) &&
6448
- auraBasedRequestsEnabled.isOpen({ fallback: false }));
6492
+ sessionApiEnabled.isOpen({ fallback: false }));
6449
6493
  }
6450
6494
  catch (error) {
6451
6495
  // If any gate check fails, disable CSRF interceptor
@@ -6479,7 +6523,7 @@ function isCsrfMethod(method) {
6479
6523
  function buildCsrfTokenInterceptor() {
6480
6524
  return async (fetchArgs) => {
6481
6525
  // Check if all required gates are enabled before running
6482
- if (!areHttpGatesEnabled()) {
6526
+ if (!areCsrfGatesEnabled()) {
6483
6527
  return resolvedPromiseLike$2(fetchArgs);
6484
6528
  }
6485
6529
  const [urlOrRequest, options] = fetchArgs;
@@ -6512,7 +6556,7 @@ function buildCsrfTokenInterceptor() {
6512
6556
  function buildLuvioCsrfTokenInterceptor() {
6513
6557
  return async (resourceRequest) => {
6514
6558
  // Check if all required gates are enabled before running
6515
- if (!areHttpGatesEnabled()) {
6559
+ if (!areCsrfGatesEnabled()) {
6516
6560
  return resolvedPromiseLike$2(resourceRequest);
6517
6561
  }
6518
6562
  // Ensure headers object exists
@@ -7273,41 +7317,67 @@ const CONTENT_DOCUMENTS_VERSIONS_PATH = '/ui-api/records/content-documents/conte
7273
7317
  * paths: ['/ui-api/some-endpoint/{id}'],
7274
7318
  * }
7275
7319
  */
7320
+ // Each runtime uses a SINGLE LDS gate that enables both the public and
7321
+ // private path lists. The public/private split is preserved as two separate
7322
+ // arrays because the PRIVATE paths carry an extra condition: the server-side
7323
+ // `auraBasedRequests` UiSdk gate. If UiSdk turns that gate off, private
7324
+ // (UiTier-restricted) Connect resources can no longer be served over HTTP and
7325
+ // must fall back to Aura, whereas public/allowlisted paths are unaffected.
7326
+ //
7327
+ // Runtimes are mutually exclusive: One Runtime (globalThis.LWR), Aura Sites
7328
+ // ($Site present), and LEX/one.app (everything else). Each has its own gate.
7276
7329
  const PREDICATE_PATH_SETS = [
7277
7330
  // One Runtime — public UIAPI endpoints
7278
7331
  {
7279
- predicate: () => isOneRuntime() && useHttpUiapiOneRuntimePublic.isOpen({ fallback: false }),
7332
+ predicate: () => isOneRuntime() && useHttpUiapiOneRuntime.isOpen({ fallback: false }),
7280
7333
  paths: UIAPI_PUBLIC_PATHS,
7281
7334
  },
7282
- // One Runtime — private UIAPI endpoints
7335
+ // One Runtime — private UIAPI endpoints (also require the UiSdk gate)
7283
7336
  {
7284
- predicate: () => isOneRuntime() && useHttpUiapiOneRuntimePrivate.isOpen({ fallback: false }),
7337
+ predicate: () => isOneRuntime() &&
7338
+ useHttpUiapiOneRuntime.isOpen({ fallback: false }) &&
7339
+ auraBasedRequestsEnabled.isOpen({ fallback: false }),
7285
7340
  paths: UIAPI_PRIVATE_PATHS,
7286
7341
  },
7287
- // one.app — public UIAPI endpoints
7342
+ // Aura Sites — public UIAPI endpoints.
7343
+ // Gate defaults closed, which keeps HTTP UIAPI OFF on Aura/Experience sites:
7344
+ // the HTTP transport's CSRF handling is broken there (W-23092947), so until
7345
+ // that is fixed this gate must not be opened. Wiring it as a normal gated
7346
+ // predicate (rather than a hard block) lets it be flipped on once CSRF works.
7288
7347
  {
7289
- predicate: () => !isOneRuntime() && useHttpUiapiOneAppPublic.isOpen({ fallback: false }),
7348
+ predicate: () => isAuraSite() && useHttpUiapiAuraSites.isOpen({ fallback: false }),
7290
7349
  paths: UIAPI_PUBLIC_PATHS,
7291
7350
  },
7292
- // one.app — private UIAPI endpoints
7351
+ // Aura Sites — private UIAPI endpoints (also require the UiSdk gate)
7293
7352
  {
7294
- predicate: () => !isOneRuntime() && useHttpUiapiOneAppPrivate.isOpen({ fallback: false }),
7353
+ predicate: () => isAuraSite() &&
7354
+ useHttpUiapiAuraSites.isOpen({ fallback: false }) &&
7355
+ auraBasedRequestsEnabled.isOpen({ fallback: false }),
7295
7356
  paths: UIAPI_PRIVATE_PATHS,
7296
7357
  },
7297
- // disableCreateContentDocumentAndVersionHTTPLexRuntime killswitch
7358
+ // LEX (one.app) — public UIAPI endpoints
7298
7359
  {
7299
- predicate: () => !disableCreateContentDocumentAndVersionHTTPLexRuntime.isOpen({ fallback: false }),
7360
+ predicate: () => !isOneRuntime() && !isAuraSite() && useHttpUiapiLex.isOpen({ fallback: false }),
7361
+ paths: UIAPI_PUBLIC_PATHS,
7362
+ },
7363
+ // LEX (one.app) — private UIAPI endpoints (also require the UiSdk gate)
7364
+ {
7365
+ predicate: () => !isOneRuntime() &&
7366
+ !isAuraSite() &&
7367
+ useHttpUiapiLex.isOpen({ fallback: false }) &&
7368
+ auraBasedRequestsEnabled.isOpen({ fallback: false }),
7369
+ paths: UIAPI_PRIVATE_PATHS,
7370
+ },
7371
+ // disableCreateContentDocumentAndVersionHTTPLexRuntime killswitch.
7372
+ // Excluded on Aura Sites for the same broken-CSRF reason as the UIAPI paths
7373
+ // (W-23092947); LEX / One Runtime are unaffected.
7374
+ {
7375
+ predicate: () => !isAuraSite() &&
7376
+ !disableCreateContentDocumentAndVersionHTTPLexRuntime.isOpen({ fallback: false }),
7300
7377
  paths: [CONTENT_DOCUMENTS_VERSIONS_PATH],
7301
7378
  },
7302
7379
  ];
7303
7380
  function getEnabledPaths() {
7304
- // On Aura/Experience sites the HTTP UIAPI transport's CSRF handling is
7305
- // broken (W-23092947), so disable every HTTP UIAPI path here and let LDS
7306
- // fall back to the Aura transport. LEX (one.app / OneRuntime) is
7307
- // unaffected. This guards all current and future predicates in one place.
7308
- if (isAuraSite()) {
7309
- return [];
7310
- }
7311
7381
  const enabled = new Set();
7312
7382
  for (const { predicate, paths } of PREDICATE_PATH_SETS) {
7313
7383
  if (predicate()) {
@@ -7712,6 +7782,12 @@ function buildJwtAuthorizedData360FetchServiceDescriptor(logger) {
7712
7782
  request: [
7713
7783
  buildThirdPartyTrackerRegisterInterceptor(),
7714
7784
  buildData360HostRewriteInterceptor(logger),
7785
+ // Compression runs LAST, after the host-rewrite interceptor has minted,
7786
+ // attached the Bearer token, and rewritten the URL — so it only ever sees
7787
+ // the final request body. It is a strict pass-through: bodies that are
7788
+ // missing, non-string, or under the 1KB threshold flow through untouched,
7789
+ // preserving the tuple (URL + Authorization header) the rewrite produced.
7790
+ buildCompressionInterceptor({ algorithm: 'gzip' }),
7715
7791
  ],
7716
7792
  finally: [buildThirdPartyTrackerFinishInterceptor()],
7717
7793
  });
@@ -7874,6 +7950,7 @@ function buildData360HostRewriteInterceptor(logger) {
7874
7950
  // to `string` for the `.replace` below.
7875
7951
  if (typeof cdpUrl !== 'string' || cdpUrl.length === 0) {
7876
7952
  logger.warn(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim. The org may not be Data Cloud provisioned.`);
7953
+ // eslint-disable-next-line @salesforce/lds/no-error-in-production
7877
7954
  throw new Error(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim; cannot route the request to a Data Cloud tenant endpoint.`);
7878
7955
  }
7879
7956
  // `cdp_url` is a bare host (no scheme); prepend https so `new URL`
@@ -11163,6 +11240,9 @@ function buildAuraDurableCacheInclusionPolicyService(config) {
11163
11240
  };
11164
11241
  }
11165
11242
 
11243
+ // Registration published on the force/ldsEngine bus so shared (cross-runtime) laf
11244
+ // loaders can read buildPredictorForContext without importing a bootstrap bundle.
11245
+ const PDL_ENGINE_REGISTRATION_ID = '@salesforce/lds-pdl-engine';
11166
11246
  // This code *should* be in lds-network-adapter, but when combined with the Aura
11167
11247
  // component test workaround in lds-default-luvio it creates a circular dependecy
11168
11248
  // between lds-default-luvio and lds-network-adapter. We do the register on behalf
@@ -11171,6 +11251,16 @@ register({
11171
11251
  id: '@salesforce/lds-network-adapter',
11172
11252
  instrument: ldsNetworkAdapterInstrument,
11173
11253
  });
11254
+ // Publish buildPredictorForContext on the force/ldsEngine registration bus so that
11255
+ // shared laf loaders can obtain it without a dynamic import("force/ldsEngineCreator"),
11256
+ // which would evaluate this whole bootstrap a second time. See ADR
11257
+ // 2026-07-10-pdl-service-provisioner-decoupling. buildPredictorForContext is a hoisted
11258
+ // function declaration and internally no-ops (returns undefined) when the PDL gate is
11259
+ // off, so registering it unconditionally is safe.
11260
+ register({
11261
+ id: PDL_ENGINE_REGISTRATION_ID,
11262
+ buildPredictorForContext,
11263
+ });
11174
11264
  function setTrackedFieldsConfig() {
11175
11265
  configuration.setTrackedFieldDepthOnCacheMiss(1);
11176
11266
  configuration.setTrackedFieldDepthOnCacheMergeConflict(1);
@@ -11372,6 +11462,13 @@ function initializeLDS() {
11372
11462
  }
11373
11463
  return luvio; // Return the luvio instance so that we can inject it for OneStore
11374
11464
  }
11465
+ // W-23092947: fetch request tags allowed to stay on HTTP on Aura sites (external hosts).
11466
+ // Everything else (core UIAPI/GraphQL) is withheld so it falls back to Aura transport.
11467
+ const AURA_SITE_ALLOWED_FETCH_TAGS = [
11468
+ { authenticationScopes: 'sfap_api' },
11469
+ { authenticationScopes: 'data_360_cdp_url_rewrite' },
11470
+ { specialHacksFor: 'copilot' }, // copilot
11471
+ ];
11375
11472
  // Initializes OneStore in LEX
11376
11473
  function initializeOneStore(luvio) {
11377
11474
  const loggerService = new ConsoleLogger('ERROR');
@@ -11466,7 +11563,13 @@ function initializeOneStore(luvio) {
11466
11563
  prefetchSfapJwtServiceDescriptor,
11467
11564
  csrfTokenManagerServiceDescriptor,
11468
11565
  ];
11469
- setServices(services);
11566
+ // W-23092947: Aura sites route core-bound commands over Aura (see the resolver).
11567
+ if (isAuraSite()) {
11568
+ setServiceResolver(buildAuraSiteServiceResolver(services, AURA_SITE_ALLOWED_FETCH_TAGS));
11569
+ }
11570
+ else {
11571
+ setServices(services);
11572
+ }
11470
11573
  }
11471
11574
  function buildAuraNetworkService() {
11472
11575
  return {
@@ -11483,5 +11586,5 @@ function ldsEngineCreator() {
11483
11586
  return { name: 'ldsEngineCreator' };
11484
11587
  }
11485
11588
 
11486
- export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
11487
- // version: 1.449.0-83e1fb14eb
11589
+ export { LexRequestStrategy, PDL_ENGINE_REGISTRATION_ID, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
11590
+ // version: 1.451.0-dev1-a2c5e50338
@@ -0,0 +1,5 @@
1
+ import { type PublishedService, type ServiceResolver, type ServicesRequest } from '@conduit-client/service-provisioner/v1';
2
+ import { type ServiceDescriptor } from '@conduit-client/utils';
3
+ type Tags = Record<string, string>;
4
+ export declare function buildAuraSiteServiceResolver<R extends ServicesRequest<ServiceDescriptor<unknown>>>(services: PublishedService[], allowedFetchTags: ReadonlyArray<Tags>): ServiceResolver<R>;
5
+ export {};
@@ -7,6 +7,11 @@ import { type LexRequest } from './predictive-loading/lex';
7
7
  export { PdlRequestPriority, PdlPrefetcherEventType } from './predictive-loading';
8
8
  export { LexRequestStrategy } from './predictive-loading/request-strategy/lex-request-strategy';
9
9
  export { configService } from './config-service-util';
10
+ export declare const PDL_ENGINE_REGISTRATION_ID = "@salesforce/lds-pdl-engine";
11
+ export type PdlEngineRegistration = {
12
+ id: typeof PDL_ENGINE_REGISTRATION_ID;
13
+ buildPredictorForContext: typeof buildPredictorForContext;
14
+ };
10
15
  /**
11
16
  * Registers a request strategy to be utilized by PDL.
12
17
  * @param requestStrategy - {@link LexRequestStrategy} The request strategy/strategies to register.
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@salesforce/lds-runtime-aura",
3
- "version": "1.449.0",
3
+ "version": "1.451.0-dev1",
4
4
  "license": "SEE LICENSE IN LICENSE.txt",
5
5
  "description": "LDS engine for Aura runtime.",
6
6
  "main": "dist/ldsEngineCreator.js",
@@ -34,61 +34,61 @@
34
34
  "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
35
35
  },
36
36
  "devDependencies": {
37
- "@conduit-client/service-provisioner": "3.25.1",
38
- "@conduit-client/tools-core": "3.25.1",
39
- "@salesforce/lds-adapters-apex": "^1.449.0",
40
- "@salesforce/lds-adapters-uiapi": "^1.449.0",
41
- "@salesforce/lds-ads-bridge": "^1.449.0",
42
- "@salesforce/lds-aura-storage": "^1.449.0",
43
- "@salesforce/lds-bindings": "^1.449.0",
44
- "@salesforce/lds-instrumentation": "^1.449.0",
45
- "@salesforce/lds-network-adapter": "^1.449.0",
46
- "@salesforce/lds-network-aura": "^1.449.0",
47
- "@salesforce/lds-network-fetch": "^1.449.0",
37
+ "@conduit-client/service-provisioner": "3.26.0",
38
+ "@conduit-client/tools-core": "3.26.0",
39
+ "@salesforce/lds-adapters-apex": "^1.451.0-dev1",
40
+ "@salesforce/lds-adapters-uiapi": "^1.451.0-dev1",
41
+ "@salesforce/lds-ads-bridge": "^1.451.0-dev1",
42
+ "@salesforce/lds-aura-storage": "^1.451.0-dev1",
43
+ "@salesforce/lds-bindings": "^1.451.0-dev1",
44
+ "@salesforce/lds-instrumentation": "^1.451.0-dev1",
45
+ "@salesforce/lds-network-adapter": "^1.451.0-dev1",
46
+ "@salesforce/lds-network-aura": "^1.451.0-dev1",
47
+ "@salesforce/lds-network-fetch": "^1.451.0-dev1",
48
48
  "jwt-encode": "1.0.1"
49
49
  },
50
50
  "dependencies": {
51
- "@conduit-client/command-aura-graphql-normalized-cache-control": "3.25.1",
52
- "@conduit-client/command-aura-network": "3.25.1",
53
- "@conduit-client/command-aura-normalized-cache-control": "3.25.1",
54
- "@conduit-client/command-fetch-network": "3.25.1",
55
- "@conduit-client/command-http-graphql-normalized-cache-control": "3.25.1",
56
- "@conduit-client/command-http-normalized-cache-control": "3.25.1",
57
- "@conduit-client/command-ndjson": "3.25.1",
58
- "@conduit-client/command-network": "3.25.1",
59
- "@conduit-client/command-sse": "3.25.1",
60
- "@conduit-client/command-streaming": "3.25.1",
61
- "@conduit-client/jwt-manager": "3.25.1",
62
- "@conduit-client/service-aura-network": "3.25.1",
63
- "@conduit-client/service-bindings-imperative": "3.25.1",
64
- "@conduit-client/service-bindings-lwc": "3.25.1",
65
- "@conduit-client/service-cache": "3.25.1",
66
- "@conduit-client/service-cache-control": "3.25.1",
67
- "@conduit-client/service-cache-inclusion-policy": "3.25.1",
68
- "@conduit-client/service-config": "3.25.1",
69
- "@conduit-client/service-feature-flags": "3.25.1",
70
- "@conduit-client/service-fetch-network": "3.25.1",
71
- "@conduit-client/service-instrument-command": "3.25.1",
72
- "@conduit-client/service-pubsub": "3.25.1",
73
- "@conduit-client/service-renewable-resource-manager": "3.25.1",
74
- "@conduit-client/service-store": "3.25.1",
75
- "@conduit-client/utils": "3.25.1",
51
+ "@conduit-client/command-aura-graphql-normalized-cache-control": "3.26.0",
52
+ "@conduit-client/command-aura-network": "3.26.0",
53
+ "@conduit-client/command-aura-normalized-cache-control": "3.26.0",
54
+ "@conduit-client/command-fetch-network": "3.26.0",
55
+ "@conduit-client/command-http-graphql-normalized-cache-control": "3.26.0",
56
+ "@conduit-client/command-http-normalized-cache-control": "3.26.0",
57
+ "@conduit-client/command-ndjson": "3.26.0",
58
+ "@conduit-client/command-network": "3.26.0",
59
+ "@conduit-client/command-sse": "3.26.0",
60
+ "@conduit-client/command-streaming": "3.26.0",
61
+ "@conduit-client/jwt-manager": "3.26.0",
62
+ "@conduit-client/service-aura-network": "3.26.0",
63
+ "@conduit-client/service-bindings-imperative": "3.26.0",
64
+ "@conduit-client/service-bindings-lwc": "3.26.0",
65
+ "@conduit-client/service-cache": "3.26.0",
66
+ "@conduit-client/service-cache-control": "3.26.0",
67
+ "@conduit-client/service-cache-inclusion-policy": "3.26.0",
68
+ "@conduit-client/service-config": "3.26.0",
69
+ "@conduit-client/service-feature-flags": "3.26.0",
70
+ "@conduit-client/service-fetch-network": "3.26.0",
71
+ "@conduit-client/service-instrument-command": "3.26.0",
72
+ "@conduit-client/service-pubsub": "3.26.0",
73
+ "@conduit-client/service-renewable-resource-manager": "3.26.0",
74
+ "@conduit-client/service-store": "3.26.0",
75
+ "@conduit-client/utils": "3.26.0",
76
76
  "@luvio/network-adapter-composable": "0.161.0",
77
77
  "@luvio/network-adapter-fetch": "0.161.0",
78
78
  "@lwc/state": "^0.29.0",
79
- "@salesforce/lds-adapters-onestore-graphql": "^1.449.0",
79
+ "@salesforce/lds-adapters-onestore-graphql": "^1.451.0-dev1",
80
80
  "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
81
- "@salesforce/lds-durable-storage": "^1.449.0",
82
- "@salesforce/lds-luvio-service": "^1.449.0",
83
- "@salesforce/lds-luvio-uiapi-records-service": "^1.449.0"
81
+ "@salesforce/lds-durable-storage": "^1.451.0-dev1",
82
+ "@salesforce/lds-luvio-service": "^1.451.0-dev1",
83
+ "@salesforce/lds-luvio-uiapi-records-service": "^1.451.0-dev1"
84
84
  },
85
85
  "luvioBundlesize": [
86
86
  {
87
87
  "path": "./dist/ldsEngineCreator.js",
88
88
  "maxSize": {
89
- "none": "412 kB",
89
+ "none": "418 kB",
90
90
  "min": "190 kB",
91
- "compressed": "72 kB"
91
+ "compressed": "73 kB"
92
92
  }
93
93
  }
94
94
  ],