@cedarjs/vite 7.0.1-next.333 → 7.0.1-next.466

package/dist/apiDevMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apiDevMiddleware.d.ts","sourceRoot":"","sources":["../src/apiDevMiddleware.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,MAAM,CAAA;AAoE7D,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,aAAa,iBAe/D;AA8GD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAyMlE;AA0BD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI,CA0EhE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,KAIrB,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAiGnD;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,aAAa,CAAA;IACzB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjD,CAAC,CAcD"}
+{"version":3,"file":"apiDevMiddleware.d.ts","sourceRoot":"","sources":["../src/apiDevMiddleware.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAsB,aAAa,EAAE,MAAM,MAAM,CAAA;AAwE7D,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,aAAa,iBAe/D;AA8GD,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,aAAa,CAAC,CAoNlE;AA0BD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,aAAa,GAAG,IAAI,CA0EhE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,KAIrB,SAAS,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC,CAiGnD;AAED,wBAAsB,qBAAqB,IAAI,OAAO,CAAC;IACrD,UAAU,EAAE,aAAa,CAAA;IACzB,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjD,CAAC,CAcD"}

package/dist/apiDevMiddleware.js

@@ -20,7 +20,11 @@ import {
 import { getAsyncStoreInstance } from "@cedarjs/context/dist/store";
 import { createGraphQLServer } from "@cedarjs/graphql-server";
 import { applyGqlormInject } from "@cedarjs/internal/dist/build/api-graphql-transforms.js";
-import { getConfig, getPaths } from "@cedarjs/project-config";
+import {
+  createPrismaClientFileMatcher,
+  getConfig,
+  getPaths
+} from "@cedarjs/project-config";
 import { generateDiffSourceMap } from "./lib/generateDiffSourceMap.js";
 import { getWorkspacePackageAliases } from "./lib/workspacePackageAliases.js";
 import { cedarAutoImportsPlugin } from "./plugins/vite-plugin-cedar-auto-import.js";
@@ -145,6 +149,7 @@ async function createApiViteServer() {
   const cedarPaths = getPaths();
   const cedarConfig = getConfig();
   const normalizedBase = normalizePath(cedarPaths.base);
+  const prismaClientFiles = createPrismaClientFileMatcher();
   const babelPlugins = getApiSideBabelConfigPath() ? getApiSideBabelPluginsForVite() : null;
   const workspacePkgSourceMap = Object.fromEntries(
     Object.entries(getWorkspacePackageAliases(cedarPaths, cedarConfig)).map(
@@ -198,6 +203,9 @@ async function createApiViteServer() {
       {
         name: "cedar-api-babel-transform",
         enforce: "pre",
+        async buildStart() {
+          await prismaClientFiles.load();
+        },
         async transform(code, id) {
           if (!/\.(ts|tsx|js|jsx)$/.test(id)) {
             return null;
@@ -208,6 +216,9 @@ async function createApiViteServer() {
           if (!id.startsWith(normalizedBase)) {
             return null;
           }
+          if (await prismaClientFiles.matches(id)) {
+            return null;
+          }
           let sourceCode = code;
           let sourceMap = null;
           if (normalizePath(id).endsWith("/graphql.ts") || normalizePath(id).endsWith("/graphql.js")) {

package/dist/buildApp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"buildApp.d.ts","sourceRoot":"","sources":["../src/buildApp.ts"],"names":[],"mappings":"AA6DA,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,OAAe,EACf,SAA0B,EAC1B,EAAU,GACX,GAAE,oBAAyB,iBAsa3B"}
+{"version":3,"file":"buildApp.d.ts","sourceRoot":"","sources":["../src/buildApp.ts"],"names":[],"mappings":"AAuEA,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,OAAO,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,EAAE,CAAC,EAAE,OAAO,CAAA;CACb;AAED;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CAAC,EAClC,OAAe,EACf,SAA0B,EAC1B,EAAU,GACX,GAAE,oBAAyB,iBAyd3B"}

package/dist/buildApp.js

@@ -20,8 +20,17 @@ import {
   applySrcAlias
 } from "@cedarjs/internal/dist/build/api.js";
 import { findApiFiles } from "@cedarjs/internal/dist/files.js";
-import { getConfig, getPaths } from "@cedarjs/project-config";
+import {
+  createPrismaClientFileMatcher,
+  getConfig,
+  getPaths
+} from "@cedarjs/project-config";
 import { generateDiffSourceMap } from "./lib/generateDiffSourceMap.js";
+import {
+  copySandboxChildrenIntoVercelFunctions,
+  findSandboxChildScripts,
+  SANDBOX_CHILDREN_DIR
+} from "./lib/sandboxChildren.js";
 import { getWorkspacePackageAliases } from "./lib/workspacePackageAliases.js";
 import { cedarAutoImportsPlugin } from "./plugins/vite-plugin-cedar-auto-import.js";
 import { cedarDirectoryNamedImportPlugin } from "./plugins/vite-plugin-cedar-directory-named-import.js";
@@ -30,6 +39,7 @@ import { cedarGraphqlOptionsExtractPlugin } from "./plugins/vite-plugin-cedar-gr
 import { cedarImportDirPlugin } from "./plugins/vite-plugin-cedar-import-dir.js";
 import { cedarMockCellDataPlugin } from "./plugins/vite-plugin-cedar-mock-cell-data.js";
 import { cedarOtelWrappingPlugin } from "./plugins/vite-plugin-cedar-otel-wrapping.js";
+import { cedarSandboxChildrenPlugin } from "./plugins/vite-plugin-cedar-sandbox-children.js";
 import { cedarjsJobPathInjectorPlugin } from "./plugins/vite-plugin-cedarjs-job-path-injector.js";
 import { handlerAlsWrappingPlugin } from "./plugins/vite-plugin-handler-als-wrapping.js";
 function resolveWithExtensions(id) {
@@ -52,6 +62,7 @@ async function buildCedarApp({
   const cedarPaths = getPaths();
   const cedarConfig = getConfig();
   const environments = {};
+  let sandboxChildren = {};
   if (workspace.includes("web")) {
     environments.client = {
       build: {
@@ -93,15 +104,16 @@ async function buildCedarApp({
       }
     };
     if (ud) {
+      sandboxChildren = findSandboxChildScripts(cedarPaths.api.src);
       environments["ssr"] = {
         build: {
           ssr: true,
           outDir: path.join(cedarPaths.api.dist, "ud"),
           emptyOutDir: true,
           rollupOptions: {
-            input: catchAllEntry,
+            input: { index: catchAllEntry, ...sandboxChildren },
             output: {
-              entryFileNames: "index.js"
+              entryFileNames: "[name].js"
             },
             external: (id) => {
               if (id.startsWith("virtual:")) {
@@ -197,6 +209,12 @@ async function buildCedarApp({
   ];
   if (ud) {
     plugins.push(catchAll());
+    plugins.push(
+      cedarSandboxChildrenPlugin({
+        environment: "ssr",
+        children: sandboxChildren
+      })
+    );
     plugins.push({
       name: "cedar-ud-verify-routes",
       configResolved() {
@@ -258,9 +276,13 @@ async function buildCedarApp({
   }
   plugins.push(cedarMockCellDataPlugin());
   if (workspace.includes("api")) {
+    const prismaClientFiles = createPrismaClientFileMatcher();
     plugins.push({
       name: "cedar-vite-api-babel-transform",
       enforce: "pre",
+      async buildStart() {
+        await prismaClientFiles.load();
+      },
       async transform(code, id) {
         if (!/\.(js|ts|tsx|jsx)$/.test(id)) {
           return null;
@@ -271,6 +293,16 @@ async function buildCedarApp({
         if (!normalizePath(id).startsWith(normalizePath(cedarPaths.api.base))) {
           return null;
         }
+        if (await prismaClientFiles.matches(id)) {
+          const rewrittenCode2 = applyImportExtensions(code, id);
+          if (rewrittenCode2 === code) {
+            return null;
+          }
+          return {
+            code: rewrittenCode2,
+            map: generateDiffSourceMap(code, rewrittenCode2)
+          };
+        }
         const babelPlugins = getApiSideBabelConfigPath() ? getApiSideBabelPluginsForVite() : null;
         const fromDirRelativeToApiSrc = path.relative(
           cedarPaths.api.src,
@@ -323,7 +355,19 @@ async function buildCedarApp({
     },
     plugins
   });
-  return builder.buildApp();
+  await builder.buildApp();
+  const vercelNode = builder.environments["vercel_node"];
+  if (ud && vercelNode && Object.keys(sandboxChildren).length > 0) {
+    const outDir = path.resolve(
+      vercelNode.config.root,
+      vercelNode.config.build.outDir
+    );
+    copySandboxChildrenIntoVercelFunctions({
+      appRoot: cedarPaths.base,
+      childrenDir: path.join(cedarPaths.api.dist, "ud", SANDBOX_CHILDREN_DIR),
+      functionsDir: path.join(outDir, "functions")
+    });
+  }
 }
 export {
   buildCedarApp

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export { cedarjsJobPathInjectorPlugin } from './plugins/vite-plugin-cedarjs-job-
 export { cedarMockCellDataPlugin } from './plugins/vite-plugin-cedar-mock-cell-data.js';
 export { cedarParsedScalarsPlugin } from './plugins/vite-plugin-cedar-parsed-scalars.js';
 export { cedarMergedConfig } from './plugins/vite-plugin-merged-config.js';
+export { cedarNetlifySkewProtectionPlugin } from './plugins/vite-plugin-cedar-netlify-skew-protection.js';
 export { cedarSwapApolloProvider } from './plugins/vite-plugin-swap-apollo-provider.js';
 export { cedarUniversalDeployPlugin } from './plugins/vite-plugin-cedar-universal-deploy.js';
 export { cedarWaitForApiServer } from './plugins/vite-plugin-cedar-wait-for-api-server.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAqCxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAA;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAA;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAA;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAA;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAA;AAE1F,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAE,aAAkB,GAAG,YAAY,EAAE,CAgDzE;AAED,8DAA8D;AAC9D,eAAe,KAAK,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAqCxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAA;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAA;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAA;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAA;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAA;AAE1F,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAE,aAAkB,GAAG,YAAY,EAAE,CAgDzE;AAED,8DAA8D;AAC9D,eAAe,KAAK,CAAA"}

package/dist/index.js

@@ -52,6 +52,7 @@ import { cedarjsJobPathInjectorPlugin } from "./plugins/vite-plugin-cedarjs-job-
 import { cedarMockCellDataPlugin as cedarMockCellDataPlugin2 } from "./plugins/vite-plugin-cedar-mock-cell-data.js";
 import { cedarParsedScalarsPlugin as cedarParsedScalarsPlugin2 } from "./plugins/vite-plugin-cedar-parsed-scalars.js";
 import { cedarMergedConfig as cedarMergedConfig2 } from "./plugins/vite-plugin-merged-config.js";
+import { cedarNetlifySkewProtectionPlugin } from "./plugins/vite-plugin-cedar-netlify-skew-protection.js";
 import { cedarSwapApolloProvider as cedarSwapApolloProvider2 } from "./plugins/vite-plugin-swap-apollo-provider.js";
 import { cedarUniversalDeployPlugin } from "./plugins/vite-plugin-cedar-universal-deploy.js";
 import { cedarWaitForApiServer as cedarWaitForApiServer2 } from "./plugins/vite-plugin-cedar-wait-for-api-server.js";
@@ -109,6 +110,7 @@ export {
   cedarImportDirPlugin,
   cedarMergedConfig2 as cedarMergedConfig,
   cedarMockCellDataPlugin2 as cedarMockCellDataPlugin,
+  cedarNetlifySkewProtectionPlugin,
   cedarOtelWrappingPlugin,
   cedarParsedScalarsPlugin2 as cedarParsedScalarsPlugin,
   cedarRemoveDevFatalErrorPage2 as cedarRemoveDevFatalErrorPage,

package/dist/jobsDevMiddleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jobsDevMiddleware.d.ts","sourceRoot":"","sources":["../src/jobsDevMiddleware.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAyEzC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B;AAKD,KAAK,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;AAE3D;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA8FhC"}
+{"version":3,"file":"jobsDevMiddleware.d.ts","sourceRoot":"","sources":["../src/jobsDevMiddleware.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAsGzC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC1B;AAKD,KAAK,eAAe,GAAG,IAAI,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;AAE3D;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA6GhC"}

package/dist/jobsDevMiddleware.js

@@ -1,8 +1,13 @@
+import fs from "node:fs";
+import { hostname } from "node:os";
+import path from "node:path";
 import { pathToFileURL } from "node:url";
 import ansis from "ansis";
 import {
+  isJobModuleFile,
   JobNotFoundError,
   JobsLibNotFoundError,
+  jobsFromModules,
   setJobLoaderOverrides
 } from "@cedarjs/jobs";
 import { getPaths } from "@cedarjs/project-config";
@@ -40,10 +45,27 @@ async function loadJobViaVite(viteServer, { name: jobName, path: jobPath }) {
   }
   return mod[jobName];
 }
+async function loadAllJobsViaVite(viteServer) {
+  const jobsDir = getPaths().api.jobs;
+  if (!fs.existsSync(jobsDir)) {
+    return [];
+  }
+  const files = fs.readdirSync(jobsDir, { recursive: true, encoding: "utf-8" }).filter(isJobModuleFile).sort();
+  const modules = [];
+  for (const file of files) {
+    modules.push(
+      await viteServer.ssrLoadModule(
+        pathToFileURL(path.join(jobsDir, file)).href
+      )
+    );
+  }
+  return jobsFromModules(modules);
+}
 async function startJobsDevWorkers(viteServer) {
   setJobLoaderOverrides({
     loadJobsManager: () => loadJobsManagerViaVite(viteServer),
-    loadJob: (computedProperties) => loadJobViaVite(viteServer, computedProperties)
+    loadJob: (computedProperties) => loadJobViaVite(viteServer, computedProperties),
+    loadAllJobs: () => loadAllJobsViaVite(viteServer)
   });
   let jobsManager;
   try {
@@ -61,12 +83,17 @@ async function startJobsDevWorkers(viteServer) {
     setJobLoaderOverrides(void 0);
     return null;
   }
+  try {
+    await jobsManager.syncSchedules();
+  } catch (e) {
+    logger.error("[CedarJS Jobs] Could not sync the declared schedules", e);
+  }
   logger.warn(
     `[CedarJS Jobs] Starting ${numWorkers.length} worker(s) in-process (Unified Dev)...`
   );
   const workers = numWorkers.map(([index, id]) => {
     const workerConfig = jobsManager.workers[index];
-    const processName = `ud-jobs.${[workerConfig.queue].flat().join("-")}.${id}`;
+    const processName = `ud-jobs.${[workerConfig.queue].flat().join("-")}.${id} host:${hostname()} pid:${process.pid}`;
     return jobsManager.createWorker({
       index,
       clear: false,

package/dist/lib/sandboxChildren.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The folder in `api/dist/ud` a bundled API build puts every sandboxed
+ * child script in, as `<name>.child.js`, with a `node_modules` holding the
+ * packages they import. `findChildScript()` in `@cedarjs/api/sandbox`
+ * looks for `api/dist/ud/sandbox-children` from its caller's folder up.
+ */
+export declare const SANDBOX_CHILDREN_DIR = "sandbox-children";
+/**
+ * Every sandboxed child script in `apiSrc` (`**\/*.child.{ts,js,mts,mjs}`),
+ * as `{ 'sandbox-children/<name>.child': file }`, for a bundled build's
+ * `input`. Throws when two have the same name: in a bundle they all go in
+ * one folder, and `findChildScript()` finds them by name.
+ */
+export declare function findSandboxChildScripts(apiSrc: string): Record<string, string>;
+export interface SandboxChildImports {
+    /** The child script's source file, which its imports resolve from */
+    source: string;
+    /** What it imports: package names and Node builtins */
+    imports: string[];
+}
+/**
+ * Copies the packages the child scripts import, and everything those
+ * depend on, into `<childrenDir>/node_modules`, so the folder runs on its
+ * own wherever it's deployed: a serverless function's file tracing doesn't
+ * follow a child script (nothing imports it), and it would miss what
+ * native packages load at run time anyway (sharp's libvips).
+ *
+ * Follows each package's `dependencies`, and the `optionalDependencies`
+ * and `peerDependencies` that are installed, which is how native packages
+ * ship their platform's binaries (`@img/sharp-linux-x64`,
+ * `@img/sharp-libvips-linux-x64`).
+ *
+ * The copy keeps each package's choices, so it finds the same versions
+ * it does in the app: a dependency nested in a package's own
+ * `node_modules` is copied into the copy's `node_modules`; one beside it
+ * in a `node_modules` (pnpm's layout), or shadowed in the copy by another
+ * version, goes next to the dependent's copy; one in the app's own
+ * `node_modules` folders goes at the top. A package already reachable from
+ * the dependent's copy is reused. When two versions would still need the
+ * same place, it throws instead of letting one overwrite the other. So
+ * does a package or regular dependency that isn't installed: the child
+ * couldn't import it either.
+ */
+export declare function vendorSandboxChildPackages(childrenDir: string, children: SandboxChildImports[]): void;
+/**
+ * Copies the bundled build's sandboxed children (and their `node_modules`)
+ * into every Node function in a Vercel Build Output API folder
+ * (`.vercel/output/functions/*.func`), at the same path as in the app
+ * (`api/dist/ud/sandbox-children`). Each Vercel function is a single
+ * bundled file with nothing else from the app, and `findChildScript()`
+ * looks for the children from the function's folder up.
+ */
+export declare function copySandboxChildrenIntoVercelFunctions({ appRoot, childrenDir, functionsDir, }: {
+    appRoot: string;
+    childrenDir: string;
+    functionsDir: string;
+}): string[];
+//# sourceMappingURL=sandboxChildren.d.ts.map

package/dist/lib/sandboxChildren.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxChildren.d.ts","sourceRoot":"","sources":["../../src/lib/sandboxChildren.ts"],"names":[],"mappings":"AAMA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AAEtD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GACb,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAyBxB;AA6CD,MAAM,WAAW,mBAAmB;IAClC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAA;IACd,uDAAuD;IACvD,OAAO,EAAE,MAAM,EAAE,CAAA;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,mBAAmB,EAAE,QA+GhC;AAgBD;;;;;;;GAOG;AACH,wBAAgB,sCAAsC,CAAC,EACrD,OAAO,EACP,WAAW,EACX,YAAY,GACb,EAAE;IACD,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;CACrB,YAgCA"}

package/dist/lib/sandboxChildren.js

@@ -0,0 +1,157 @@
+import fs from "node:fs";
+import { isBuiltin } from "node:module";
+import path from "node:path";
+import fg from "fast-glob";
+const SANDBOX_CHILDREN_DIR = "sandbox-children";
+function findSandboxChildScripts(apiSrc) {
+  const files = fg.sync("**/*.child.{ts,js,mts,mjs}", {
+    cwd: apiSrc,
+    absolute: true,
+    ignore: ["**/node_modules/**", "**/__tests__/**"]
+  }).sort();
+  const entries = {};
+  for (const file of files) {
+    const name = path.basename(file).replace(/\.(ts|js|mts|mjs)$/, "");
+    const key = `${SANDBOX_CHILDREN_DIR}/${name}`;
+    if (entries[key]) {
+      throw new Error(
+        `Two sandboxed child scripts are named ${name}: ${path.relative(apiSrc, entries[key])} and ${path.relative(apiSrc, file)}. A bundled build puts every child script in one folder, so their names must be unique.`
+      );
+    }
+    entries[key] = path.normalize(file);
+  }
+  return entries;
+}
+const packageName = (specifier) => {
+  const parts = specifier.split("/");
+  return specifier.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+};
+const readPackageJson = (dir) => {
+  const parsed = JSON.parse(
+    fs.readFileSync(path.join(dir, "package.json"), "utf8")
+  );
+  return parsed && typeof parsed === "object" ? parsed : {};
+};
+const findPackage = (name, dir) => {
+  let current = dir;
+  for (; ; ) {
+    const candidate = path.join(current, "node_modules", name);
+    if (fs.existsSync(path.join(candidate, "package.json"))) {
+      return { realDir: fs.realpathSync(candidate), foundIn: current };
+    }
+    const parent = path.dirname(current);
+    if (parent === current) {
+      return null;
+    }
+    current = parent;
+  }
+};
+function vendorSandboxChildPackages(childrenDir, children) {
+  const copyOf = /* @__PURE__ */ new Map();
+  const occupied = /* @__PURE__ */ new Map();
+  const inNodeModules = (dir) => dir.split(path.sep).includes("node_modules");
+  const reachableFrom = (copy, name) => {
+    let dir = copy;
+    for (; ; ) {
+      const there = occupied.get(path.join(dir, "node_modules", name));
+      if (there || dir === childrenDir) {
+        return there?.realDir;
+      }
+      dir = path.dirname(dir);
+    }
+  };
+  const visit = (name, fromDir, dependentCopy, required, dependent) => {
+    const found = findPackage(name, fromDir);
+    if (!found) {
+      if (required) {
+        throw new Error(
+          `Can't find package "${name}", which ${dependent} imports, in a node_modules folder above ${fromDir}`
+        );
+      }
+      return;
+    }
+    const { realDir, foundIn } = found;
+    const reachable = reachableFrom(dependentCopy, name);
+    if (reachable === realDir) {
+      return;
+    }
+    const copiedFolder = copyOf.get(foundIn);
+    const besideDependent = path.join(dependentCopy, "node_modules", name);
+    const target = copiedFolder ? path.join(copiedFolder, "node_modules", name) : inNodeModules(foundIn) || reachable ? besideDependent : path.join(childrenDir, "node_modules", name);
+    const there = occupied.get(target);
+    if (there) {
+      throw new Error(
+        `Sandboxed child scripts need two versions of "${name}" in one place: ${there.realDir} (for ${there.neededBy}) and ${realDir} (for ${dependent}). Install a single version of it, or move the children so their imports resolve the same way.`
+      );
+    }
+    occupied.set(target, { realDir, neededBy: dependent });
+    if (!copyOf.has(realDir)) {
+      copyOf.set(realDir, target);
+    }
+    fs.cpSync(realDir, target, {
+      recursive: true,
+      dereference: true,
+      // Its own node_modules are copied as dependencies, when they're needed
+      filter: (src) => src !== path.join(realDir, "node_modules")
+    });
+    const pkg = readPackageJson(realDir);
+    const optional = /* @__PURE__ */ new Set([
+      ...Object.keys(pkg.optionalDependencies ?? {}),
+      ...Object.keys(pkg.peerDependencies ?? {})
+    ]);
+    for (const dep of Object.keys(pkg.dependencies ?? {})) {
+      visit(dep, realDir, target, !optional.has(dep), name);
+    }
+    for (const dep of optional) {
+      visit(dep, realDir, target, false, name);
+    }
+  };
+  for (const { source, imports } of children) {
+    for (const specifier of imports) {
+      if (isBuiltin(specifier) || specifier.startsWith("#")) {
+        continue;
+      }
+      visit(
+        packageName(specifier),
+        fs.realpathSync(path.dirname(source)),
+        childrenDir,
+        true,
+        path.basename(source)
+      );
+    }
+  }
+}
+const findVercelFunctionDirs = (dir) => fs.existsSync(dir) ? fs.readdirSync(dir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).flatMap((entry) => {
+  const entryPath = path.join(dir, entry.name);
+  return entry.name.endsWith(".func") ? [entryPath] : findVercelFunctionDirs(entryPath);
+}) : [];
+function copySandboxChildrenIntoVercelFunctions({
+  appRoot,
+  childrenDir,
+  functionsDir
+}) {
+  const childrenDirInApp = path.relative(appRoot, childrenDir);
+  if (!fs.existsSync(childrenDir)) {
+    return [];
+  }
+  const functionDirs = findVercelFunctionDirs(functionsDir).filter((dir) => {
+    const config = path.join(dir, ".vc-config.json");
+    if (!fs.existsSync(config)) {
+      return false;
+    }
+    const parsed = JSON.parse(fs.readFileSync(config, "utf8"));
+    return !!parsed && typeof parsed === "object" && "runtime" in parsed && typeof parsed.runtime === "string" && parsed.runtime.startsWith("nodejs");
+  });
+  for (const dir of functionDirs) {
+    fs.cpSync(childrenDir, path.join(dir, childrenDirInApp), {
+      recursive: true
+    });
+  }
+  return functionDirs;
+}
+export {
+  SANDBOX_CHILDREN_DIR,
+  copySandboxChildrenIntoVercelFunctions,
+  findSandboxChildScripts,
+  vendorSandboxChildPackages
+};

package/dist/plugins/vite-plugin-cedar-auto-import.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-auto-import.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-auto-import.ts"],"names":[],"mappings":"AAuBA,wBAAgB,sBAAsB,UA2ErC"}
+{"version":3,"file":"vite-plugin-cedar-auto-import.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-auto-import.ts"],"names":[],"mappings":"AA2BA,wBAAgB,sBAAsB,UAyFrC"}

package/dist/plugins/vite-plugin-cedar-auto-import.js

@@ -13,10 +13,15 @@ import {
   getPaths,
   importStatementPath
 } from "@cedarjs/project-config";
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
 function cedarAutoImportsPlugin() {
   const config = getConfig();
   const cedarPaths = getPaths();
   const useTrustedDocumentsGqlTag = config?.graphql?.trustedDocuments;
+  const apiBase = cedarPaths.api.base.replace(/\\/g, "/");
+  const apiSrcPattern = new RegExp(`^${escapeRegExp(apiBase)}/.*\\.[tj]sx?$`);
   return [
     autoImport({
       // targets to transform
@@ -44,7 +49,14 @@ function cedarAutoImportsPlugin() {
     }),
     autoImport({
       // targets to transform
-      include: [/\.[tj]sx?$/],
+      //
+      // This must stay scoped to api/ only. @cedarjs/context relies on
+      // Node's AsyncLocalStorage, which isn't available in the browser.
+      // If this ever matches web/ files too, an unrelated identifier
+      // named `context` in a web-side file (e.g. a function parameter)
+      // would get auto-imported from @cedarjs/context, pulling
+      // AsyncLocalStorage into the web build and breaking it. See #2892.
+      include: [apiSrcPattern],
       // global imports to register
       imports: [
         {
@@ -56,7 +68,7 @@ function cedarAutoImportsPlugin() {
     }),
     autoImport({
       // targets to transform
-      include: [/api\/.*\.[tj]sx?$/],
+      include: [apiSrcPattern],
       // global imports to register
       imports: [
         // import gql from 'graphql-tag'

package/dist/plugins/vite-plugin-cedar-import-dir.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-import-dir.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-import-dir.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAIlC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CA4H7C"}
+{"version":3,"file":"vite-plugin-cedar-import-dir.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-import-dir.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAQlC;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAqI7C"}

package/dist/plugins/vite-plugin-cedar-import-dir.js

@@ -3,15 +3,26 @@ import path from "node:path";
 import MagicString from "magic-string";
 import { parseSync } from "oxc-parser";
 import { normalizePath } from "vite";
-import { importStatementPath, getPaths } from "@cedarjs/project-config";
+import {
+  createPrismaClientFileMatcher,
+  importStatementPath,
+  getPaths
+} from "@cedarjs/project-config";
 function cedarImportDirPlugin() {
+  const prismaClientFiles = createPrismaClientFileMatcher();
   return {
     name: "vite-plugin-cedar-import-dir",
     enforce: "pre",
+    async buildStart() {
+      await prismaClientFiles.load();
+    },
     async transform(code, id) {
       if (!code.includes("/**/")) {
         return null;
       }
+      if (await prismaClientFiles.matches(id)) {
+        return null;
+      }
       let program;
       try {
         program = parseSync(id, code).program;

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts

@@ -0,0 +1,73 @@
+import type { Plugin, ResolvedConfig } from 'vite';
+export interface CedarNetlifySkewProtectionPluginOptions {
+    headerName?: string;
+    queryName?: string;
+    cookieName?: string;
+    /**
+     * How long (in seconds) the skew-token cookie pins a client's asset and API
+     * requests to the deploy it last loaded a page from. Page loads are never
+     * pinned and always refresh the cookie, so a long value can't keep anyone
+     * on an old version; it only bounds how long an open tab can keep loading
+     * lazy chunks from the deploy it started on. Defaults to 24 hours.
+     */
+    cookieMaxAge?: number;
+}
+/**
+ * The paths Netlify should route to a client's pinned deploy, and the paths
+ * the edge function doesn't need to run on.
+ */
+export interface SkewProtectionPaths {
+    /** Regexes for Netlify's `skew-protection.json` `patterns` */
+    patterns: string[];
+    /** Globs for the edge function's `excludedPath` */
+    excludedPaths: string[];
+}
+/**
+ * Pins hashed build assets (the lazy-loaded chunks an already-open tab
+ * requests after a new deploy) and Cedar's API routes (so an old client keeps
+ * talking to the API it was built against). Page loads are not pinned, so a
+ * reload or a fresh visit always gets the latest deploy.
+ */
+export declare function getSkewProtectionPaths(config: Pick<ResolvedConfig, 'base' | 'build' | 'plugins'>): SkewProtectionPaths;
+/**
+ * Generates Netlify's `.netlify/v1/skew-protection.json` build output, an
+ * edge function that stamps the skew-token cookie on static HTML, and wraps
+ * Universal Deploy's catch-all Fetchable so server-rendered HTML gets the
+ * same cookie.
+ *
+ * Background: https://docs.netlify.com/build/frameworks/frameworks-api/#netlifyv1skew-protectionjson
+ *
+ * How it works:
+ * - Every HTML response sets `Set-Cookie: <cookieName>=<deploy token>`.
+ *   Netlify exposes the token at build time as `NETLIFY_SKEW_PROTECTION_TOKEN`
+ *   and at runtime as `context.deploy.skewProtectionToken`.
+ * - Requests matching `patterns` (build assets and API routes, see
+ *   `getSkewProtectionPaths`) that carry the cookie are served by the deploy
+ *   the token belongs to. A tab that loaded an old build keeps loading its
+ *   own lazy chunks after a new deploy, instead of getting 404s.
+ * - Page loads don't match `patterns`, so they're always served by the
+ *   latest deploy, and its HTML sets the latest token. Reloading is therefore
+ *   always enough to get the newest version.
+ * - Only HTML responses to page loads set the cookie. Responses to pinned
+ *   asset and API requests can come from an old deploy and would otherwise
+ *   renew the old token.
+ *
+ * The cookie is set in two places:
+ * - Static HTML (prerendered pages and the SPA shell) is served from
+ *   Netlify's CDN and never reaches Cedar's server code. A framework-authored
+ *   edge function (`.netlify/v1/edge-functions/`, registered automatically)
+ *   stamps it using `context.deploy.skewProtectionToken`.
+ * - Server-rendered HTML comes from Universal Deploy's catch-all Fetchable.
+ *   Fetchables are plain `(request: Request) => Response` functions that
+ *   don't get Netlify's `context`, so the build-time token (identical to the
+ *   runtime one, both describe the same deploy) is stamped into the SSR
+ *   bundle as a virtual module, and the Fetchable is wrapped to set the
+ *   cookie.
+ *
+ * Cookies are the only one of Netlify's three token sources (cookie, header,
+ * query) that browsers send automatically, so they're the only one Cedar
+ * sets. The header and query sources are registered so clients that can't
+ * use cookies can still pin requests by sending the token themselves.
+ */
+export declare function cedarNetlifySkewProtectionPlugin(options?: CedarNetlifySkewProtectionPluginOptions): Plugin;
+//# sourceMappingURL=vite-plugin-cedar-netlify-skew-protection.d.ts.map

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-plugin-cedar-netlify-skew-protection.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-netlify-skew-protection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,MAAM,CAAA;AAOlD,MAAM,WAAW,uCAAuC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,mDAAmD;IACnD,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAoBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACzD,mBAAmB,CAgCrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,uCAA4C,GACpD,MAAM,CAwOR"}

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.js

@@ -0,0 +1,232 @@
+import fs from "node:fs";
+import path from "node:path";
+import { catchAllEntry } from "@universal-deploy/store";
+import { getPaths } from "@cedarjs/project-config";
+import { CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME } from "./vite-plugin-cedar-universal-deploy.js";
+const VIRTUAL_SKEW_TOKEN_ID = "virtual:cedar-netlify-skew-token";
+const RESOLVED_SKEW_TOKEN_ID = "\0" + VIRTUAL_SKEW_TOKEN_ID;
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isUniversalDeployPluginApi(api) {
+  return typeof api === "object" && api !== null && "routes" in api && Array.isArray(api.routes);
+}
+function getSkewProtectionPaths(config) {
+  const patterns = [];
+  const excludedPaths = [];
+  const baseIsUrl = /^([a-z][a-z\d+.-]*:)?\/\//i.test(config.base);
+  if (!baseIsUrl) {
+    const basePath = config.base.startsWith("/") ? config.base : "/";
+    const assetsPath = path.posix.join(basePath, config.build.assetsDir);
+    patterns.push(`^${escapeRegExp(assetsPath)}/`);
+    excludedPaths.push(`${assetsPath}/*`);
+  }
+  const udApi = config.plugins.find(
+    (plugin) => plugin.name === CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME
+  )?.api;
+  if (isUniversalDeployPluginApi(udApi)) {
+    for (const route of udApi.routes) {
+      if (route.path.includes("*")) {
+        continue;
+      }
+      patterns.push(`^${escapeRegExp(route.path)}(/.*)?$`);
+      excludedPaths.push(route.path, `${route.path}/*`);
+    }
+  }
+  return { patterns, excludedPaths };
+}
+function cedarNetlifySkewProtectionPlugin(options = {}) {
+  const {
+    headerName = "cedar-skew-token",
+    queryName = "skew",
+    cookieName = "cedar-skew-token",
+    cookieMaxAge = 60 * 60 * 24
+  } = options;
+  const skewToken = process.env.NETLIFY_SKEW_PROTECTION_TOKEN ?? "";
+  let skewProtectionPaths = {
+    patterns: [],
+    excludedPaths: []
+  };
+  return {
+    name: "cedar-netlify-skew-protection",
+    apply: "build",
+    configResolved(config) {
+      skewProtectionPaths = getSkewProtectionPaths(config);
+    },
+    transform(code, id) {
+      if (this.environment?.name !== "ssr" || id !== catchAllEntry) {
+        return void 0;
+      }
+      const wrappedCode = code.replace(
+        /^export default \{/m,
+        "const __cedarSkewCatchAllHandler = {"
+      );
+      if (wrappedCode === code) {
+        this.warn(
+          'cedar-netlify-skew-protection: expected "export default {" in the Universal Deploy catch-all entry but did not find it \u2014 skipping skew-token cookie stamping on server-rendered HTML. This likely means @universal-deploy/vite changed how it generates the catch-all entry.'
+        );
+        return void 0;
+      }
+      return {
+        code: [
+          `import { CEDAR_SKEW_TOKEN, CEDAR_SKEW_COOKIE_NAME } from ${JSON.stringify(VIRTUAL_SKEW_TOKEN_ID)}`,
+          wrappedCode,
+          "",
+          "const __cedarSkewPinnedPatterns = [",
+          ...skewProtectionPaths.patterns.map(
+            (pattern) => `  new RegExp(${JSON.stringify(pattern)}),`
+          ),
+          "]",
+          "",
+          "const __cedarSkewOriginalFetch =",
+          "  __cedarSkewCatchAllHandler.fetch.bind(__cedarSkewCatchAllHandler)",
+          "",
+          "__cedarSkewCatchAllHandler.fetch = async (request, ...args) => {",
+          "  const response = await __cedarSkewOriginalFetch(request, ...args)",
+          "",
+          "  // Only HTML responses to page loads set the cookie (see",
+          "  // vite-plugin-cedar-netlify-skew-protection.ts). Requests to pinned",
+          "  // paths are never page loads, even if an API function returns",
+          "  // HTML, and may be served by an old deploy. Nothing to stamp",
+          "  // without a token (e.g. a local `cedar build --ud` run outside a",
+          "  // Netlify build) or a response (an unmatched route). Statuses",
+          "  // outside 200-599 (e.g. 101 for a WebSocket upgrade) make the",
+          "  // Response constructor below throw, and 204/304 responses have no",
+          "  // body worth re-wrapping. Responses that already set our cookie",
+          "  // are left alone to avoid a duplicate.",
+          "  if (",
+          "    !CEDAR_SKEW_TOKEN ||",
+          "    !response ||",
+          "    response.status < 200 ||",
+          "    response.status > 599 ||",
+          "    response.status === 204 ||",
+          "    response.status === 304 ||",
+          '    !(response.headers.get("content-type") ?? "").includes("text/html") ||',
+          "    __cedarSkewPinnedPatterns.some((pattern) =>",
+          "      pattern.test(new URL(request.url).pathname),",
+          "    ) ||",
+          '    (response.headers.get("set-cookie") ?? "").includes(',
+          "      `${CEDAR_SKEW_COOKIE_NAME}=`,",
+          "    )",
+          "  ) {",
+          "    return response",
+          "  }",
+          "",
+          "  const headers = new Headers(response.headers)",
+          "  headers.append(",
+          '    "set-cookie",',
+          `    \`\${CEDAR_SKEW_COOKIE_NAME}=\${CEDAR_SKEW_TOKEN}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; Secure; SameSite=Lax\`,`,
+          "  )",
+          "",
+          "  return new Response(response.body, {",
+          "    status: response.status,",
+          "    statusText: response.statusText,",
+          "    headers,",
+          "  })",
+          "}",
+          "",
+          "export default __cedarSkewCatchAllHandler"
+        ].join("\n"),
+        map: null
+      };
+    },
+    resolveId(id) {
+      if (id === VIRTUAL_SKEW_TOKEN_ID) {
+        return RESOLVED_SKEW_TOKEN_ID;
+      }
+      return void 0;
+    },
+    load(id) {
+      if (id !== RESOLVED_SKEW_TOKEN_ID) {
+        return void 0;
+      }
+      return [
+        `export const CEDAR_SKEW_TOKEN = ${JSON.stringify(skewToken)}`,
+        `export const CEDAR_SKEW_HEADER_NAME = ${JSON.stringify(headerName)}`,
+        `export const CEDAR_SKEW_QUERY_NAME = ${JSON.stringify(queryName)}`,
+        `export const CEDAR_SKEW_COOKIE_NAME = ${JSON.stringify(cookieName)}`,
+        ""
+      ].join("\n");
+    },
+    writeBundle() {
+      if (this.environment?.name !== "client") {
+        return;
+      }
+      if (!skewToken) {
+        return;
+      }
+      const netlifyV1Dir = path.join(getPaths().web.base, ".netlify", "v1");
+      fs.mkdirSync(netlifyV1Dir, { recursive: true });
+      const manifest = {
+        patterns: skewProtectionPaths.patterns,
+        sources: [
+          { type: "header", name: headerName },
+          { type: "query", name: queryName },
+          { type: "cookie", name: cookieName }
+        ]
+      };
+      fs.writeFileSync(
+        path.join(netlifyV1Dir, "skew-protection.json"),
+        JSON.stringify(manifest, null, 2) + "\n"
+      );
+      const edgeFunctionsDir = path.join(netlifyV1Dir, "edge-functions");
+      fs.mkdirSync(edgeFunctionsDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(edgeFunctionsDir, "cedar-skew-cookie.js"),
+        [
+          "// Generated by @cedarjs/vite. Stamps the skew-protection cookie on",
+          "// static HTML served from Netlify's CDN. See",
+          "// vite-plugin-cedar-netlify-skew-protection.ts for the full picture.",
+          "export default async (request, context) => {",
+          "  const response = await context.next()",
+          "",
+          `  const cookieName = ${JSON.stringify(cookieName)}`,
+          "",
+          "  // Only HTML responses set the cookie. Statuses outside 200-599",
+          "  // (e.g. 101 for a WebSocket upgrade) make the Response",
+          "  // constructor below throw, and 204/304 responses have no body",
+          "  // worth re-wrapping. Responses that already set our cookie (from",
+          "  // the Universal Deploy wrapper) are left alone.",
+          "  if (",
+          "    response.status < 200 ||",
+          "    response.status > 599 ||",
+          "    response.status === 204 ||",
+          "    response.status === 304 ||",
+          '    !(response.headers.get("content-type") ?? "").includes("text/html") ||',
+          '    (response.headers.get("set-cookie") ?? "").includes(`${cookieName}=`)',
+          "  ) {",
+          "    return response",
+          "  }",
+          "",
+          "  const token = context.deploy?.skewProtectionToken",
+          "  if (!token) {",
+          "    return response",
+          "  }",
+          "",
+          "  const headers = new Headers(response.headers)",
+          "  headers.append(",
+          '    "set-cookie",',
+          `    \`\${cookieName}=\${token}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; Secure; SameSite=Lax\`,`,
+          "  )",
+          "",
+          "  return new Response(response.body, {",
+          "    status: response.status,",
+          "    statusText: response.statusText,",
+          "    headers,",
+          "  })",
+          "}",
+          "",
+          "export const config = {",
+          '  path: "/*",',
+          `  excludedPath: ${JSON.stringify(skewProtectionPaths.excludedPaths)},`,
+          "}",
+          ""
+        ].join("\n")
+      );
+    }
+  };
+}
+export {
+  cedarNetlifySkewProtectionPlugin,
+  getSkewProtectionPaths
+};

package/dist/plugins/vite-plugin-cedar-otel-wrapping.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-otel-wrapping.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-otel-wrapping.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAKlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAwBhD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CA+Ef"}
+{"version":3,"file":"vite-plugin-cedar-otel-wrapping.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-otel-wrapping.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAQlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAkChD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CA+Ef"}

package/dist/plugins/vite-plugin-cedar-otel-wrapping.js

@@ -1,10 +1,17 @@
 import { parseSync } from "oxc-parser";
 import { normalizePath } from "vite";
-import { getPaths } from "@cedarjs/project-config";
+import {
+  createPrismaClientFileMatcher,
+  getPaths
+} from "@cedarjs/project-config";
 function cedarOtelWrappingPlugin() {
+  const prismaClientFiles = createPrismaClientFileMatcher();
   return {
     name: "cedar-otel-wrapping",
-    transform(code, id) {
+    async buildStart() {
+      await prismaClientFiles.load();
+    },
+    async transform(code, id) {
       let apiSrc;
       try {
         apiSrc = normalizePath(getPaths().api.src);
@@ -14,6 +21,9 @@ function cedarOtelWrappingPlugin() {
       if (!normalizePath(id).startsWith(apiSrc + "/")) {
         return null;
       }
+      if (await prismaClientFiles.matches(id)) {
+        return null;
+      }
       const relativePath = normalizePath(id).slice(apiSrc.length + 1);
       const apiFolder = relativePath.split("/")[0] ?? "?";
       const result = applyOtelWrapping(code, id, apiFolder);

package/dist/plugins/vite-plugin-cedar-sandbox-children.d.ts

@@ -0,0 +1,20 @@
+import type { Plugin } from 'vite';
+/**
+ * For the bundled API build (`cedar build --ud`): the sandboxed child
+ * scripts in api/src are extra entries of the build (see
+ * `findSandboxChildScripts()`), so each comes out as
+ * `sandbox-children/<name>.child.js`. This plugin checks that each child
+ * stands alone, importing only packages and Node builtins (it can read
+ * nothing of the app), and then copies the packages they import into
+ * `sandbox-children/node_modules`.
+ *
+ * `findChildScript()` from `@cedarjs/api/sandbox` finds the children there
+ * from code in the bundle.
+ */
+export declare function cedarSandboxChildrenPlugin({ environment, children, }: {
+    /** The bundled build's environment */
+    environment: string;
+    /** The child scripts' entries: `{ 'sandbox-children/x.child': file }` */
+    children: Record<string, string>;
+}): Plugin;
+//# sourceMappingURL=vite-plugin-cedar-sandbox-children.d.ts.map

package/dist/plugins/vite-plugin-cedar-sandbox-children.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-plugin-cedar-sandbox-children.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-sandbox-children.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AASlC;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CAAC,EACzC,WAAW,EACX,QAAQ,GACT,EAAE;IACD,sCAAsC;IACtC,WAAW,EAAE,MAAM,CAAA;IACnB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACjC,GAAG,MAAM,CAmDT"}

package/dist/plugins/vite-plugin-cedar-sandbox-children.js

@@ -0,0 +1,58 @@
+import path from "node:path";
+import { normalizePath } from "vite";
+import {
+  SANDBOX_CHILDREN_DIR,
+  vendorSandboxChildPackages
+} from "../lib/sandboxChildren.js";
+function cedarSandboxChildrenPlugin({
+  environment,
+  children
+}) {
+  const sources = new Set(
+    Object.values(children).map((file) => normalizePath(file))
+  );
+  let imports = [];
+  return {
+    name: "cedar-sandbox-children",
+    apply: "build",
+    applyToEnvironment(env) {
+      return env.name === environment;
+    },
+    generateBundle(_options, bundle) {
+      imports = [];
+      for (const chunk of Object.values(bundle)) {
+        if (chunk.type !== "chunk" || !chunk.facadeModuleId) {
+          continue;
+        }
+        const source = normalizePath(chunk.facadeModuleId);
+        if (!sources.has(source)) {
+          continue;
+        }
+        const bundled = [...chunk.imports, ...chunk.dynamicImports].filter(
+          (id) => id in bundle
+        );
+        if (bundled.length > 0) {
+          this.error(
+            `${path.basename(source)} imports your app's own code (${bundled.join(", ")}). A sandboxed child script may import only packages and Node builtins: it runs in a process that can't read the rest of your app.`
+          );
+        }
+        imports.push({
+          source,
+          imports: [...chunk.imports, ...chunk.dynamicImports]
+        });
+      }
+    },
+    writeBundle(options) {
+      if (imports.length === 0 || !options.dir) {
+        return;
+      }
+      vendorSandboxChildPackages(
+        path.join(options.dir, SANDBOX_CHILDREN_DIR),
+        imports
+      );
+    }
+  };
+}
+export {
+  cedarSandboxChildrenPlugin
+};

package/dist/plugins/vite-plugin-cedar-universal-deploy.d.ts

@@ -1,6 +1,16 @@
 import type { Plugin } from 'vite';
+import type { CedarRouteRecord } from '@cedarjs/api/runtime';
 export interface CedarUniversalDeployPluginOptions {
     apiRootPath?: string;
 }
+/**
+ * Exposed as the plugin's `api` property so other plugins (e.g.
+ * `cedarNetlifySkewProtectionPlugin`) can find the API routes this plugin
+ * registers.
+ */
+export interface CedarUniversalDeployPluginApi {
+    routes: CedarRouteRecord[];
+}
+export declare const CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME = "cedar-universal-deploy";
 export declare function cedarUniversalDeployPlugin(options?: CedarUniversalDeployPluginOptions): Plugin;
 //# sourceMappingURL=vite-plugin-cedar-universal-deploy.d.ts.map

package/dist/plugins/vite-plugin-cedar-universal-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-universal-deploy.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-universal-deploy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAgBlC,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AA6GD,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,MAAM,CA0GR"}
+{"version":3,"file":"vite-plugin-cedar-universal-deploy.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-universal-deploy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAGlC,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,sBAAsB,CAAA;AAS7B,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,eAAO,MAAM,kCAAkC,2BAA2B,CAAA;AA6G1E,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,MAAM,CA6GR"}

package/dist/plugins/vite-plugin-cedar-universal-deploy.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { addEntry } from "@universal-deploy/store";
 import { findApiServerFunctions } from "@cedarjs/internal/dist/files.js";
 import { getPaths } from "@cedarjs/project-config";
+const CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME = "cedar-universal-deploy";
 const VIRTUAL_CEDAR_FN_PREFIX = "virtual:cedar-api:fn:";
 const RESOLVED_CEDAR_FN_PREFIX = "\0virtual:cedar-api:fn:";
 const GRAPHQL_METHODS = ["GET", "POST", "OPTIONS"];
@@ -66,9 +67,11 @@ function toEntryMeta(route) {
 function cedarUniversalDeployPlugin(options = {}) {
   const effectiveApiRootPath = process.env.CEDAR_API_ROOT_PATH ?? options.apiRootPath;
   const routes = discoverCedarRoutes(effectiveApiRootPath ?? "/");
+  const api = { routes };
   return {
-    name: "cedar-universal-deploy",
+    name: CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME,
     apply: "build",
+    api,
     config: {
       order: "pre",
       handler() {
@@ -308,5 +311,6 @@ function createGraphQLFetch(graphqlOptions) {
   };
 }
 export {
+  CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME,
   cedarUniversalDeployPlugin
 };

package/dist/rsc/rscBuildClient.d.ts

@@ -3,5 +3,5 @@
  * buildFeServer -> buildRscFeServer -> rscBuildClient
  * Generate the client bundle
  */
-export declare function rscBuildClient(clientEntryFiles: Record<string, string>): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputChunk | import("rollup").OutputAsset)[]]>;
+export declare function rscBuildClient(clientEntryFiles: Record<string, string>): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputAsset | import("rollup").OutputChunk)[]]>;
 //# sourceMappingURL=rscBuildClient.d.ts.map

package/dist/rsc/rscBuildForServer.d.ts

@@ -3,5 +3,5 @@
  * buildFeServer -> buildRscFeServer -> rscBuildForServer
  * Generate the output to be used by the rsc worker (not the actual server!)
  */
-export declare function rscBuildForServer(clientEntryFiles: Record<string, string>, serverEntryFiles: Record<string, string>, customModules: Record<string, string>): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputChunk | import("rollup").OutputAsset)[]]>;
+export declare function rscBuildForServer(clientEntryFiles: Record<string, string>, serverEntryFiles: Record<string, string>, customModules: Record<string, string>): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputAsset | import("rollup").OutputChunk)[]]>;
 //# sourceMappingURL=rscBuildForServer.d.ts.map

package/dist/rsc/rscBuildForSsr.d.ts

@@ -5,5 +5,5 @@
 export declare function rscBuildForSsr({ clientEntryFiles, verbose, }: {
     clientEntryFiles: Record<string, string>;
     verbose?: boolean;
-}): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputChunk | import("rollup").OutputAsset)[]]>;
+}): Promise<[import("rollup").OutputChunk, ...(import("rollup").OutputAsset | import("rollup").OutputChunk)[]]>;
 //# sourceMappingURL=rscBuildForSsr.d.ts.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/vite",
-  "version": "7.0.1-next.333",
+  "version": "7.0.1-next.466",
   "description": "Vite configuration package for CedarJS",
   "repository": {
     "type": "git",
@@ -52,41 +52,41 @@
     "@babel/generator": "7.29.8",
     "@babel/parser": "7.29.9",
     "@babel/preset-typescript": "7.29.7",
-    "@babel/traverse": "7.29.8",
+    "@babel/traverse": "7.29.10",
     "@babel/types": "7.29.8",
-    "@cedarjs/api": "7.0.1-next.333",
-    "@cedarjs/api-server": "7.0.1-next.333",
-    "@cedarjs/babel-config": "7.0.1-next.333",
-    "@cedarjs/context": "7.0.1-next.333",
-    "@cedarjs/graphql-server": "7.0.1-next.333",
-    "@cedarjs/internal": "7.0.1-next.333",
-    "@cedarjs/jobs": "7.0.1-next.333",
-    "@cedarjs/project-config": "7.0.1-next.333",
-    "@cedarjs/server-store": "7.0.1-next.333",
-    "@cedarjs/structure": "7.0.1-next.333",
-    "@cedarjs/testing": "7.0.1-next.333",
-    "@swc/core": "1.16.2",
-    "@universal-deploy/store": "^0.2.1",
-    "@universal-deploy/vite": "^0.1.9",
+    "@cedarjs/api": "7.0.1-next.466",
+    "@cedarjs/api-server": "7.0.1-next.466",
+    "@cedarjs/babel-config": "7.0.1-next.466",
+    "@cedarjs/context": "7.0.1-next.466",
+    "@cedarjs/graphql-server": "7.0.1-next.466",
+    "@cedarjs/internal": "7.0.1-next.466",
+    "@cedarjs/jobs": "7.0.1-next.466",
+    "@cedarjs/project-config": "7.0.1-next.466",
+    "@cedarjs/server-store": "7.0.1-next.466",
+    "@cedarjs/structure": "7.0.1-next.466",
+    "@cedarjs/testing": "7.0.1-next.466",
+    "@swc/core": "1.16.18",
+    "@universal-deploy/store": "^0.3.0",
+    "@universal-deploy/vite": "^0.2.0",
     "@vitejs/plugin-react": "4.7.0",
-    "@whatwg-node/fetch": "0.12.0",
+    "@whatwg-node/fetch": "0.12.1",
     "@whatwg-node/server": "0.13.0",
-    "acorn": "8.18.0",
+    "acorn": "8.19.0",
     "acorn-loose": "8.5.2",
     "ansis": "4.4.0",
     "busboy": "^1.6.0",
     "dotenv-defaults": "5.0.2",
-    "express": "5.2.1",
+    "express": "5.3.0",
     "fast-glob": "3.3.3",
-    "find-my-way": "9.9.0",
+    "find-my-way": "9.10.0",
     "http-proxy-middleware": "3.0.7",
     "isbot": "5.2.2",
     "magic-string": "0.30.21",
-    "oxc-parser": "0.151.0",
+    "oxc-parser": "0.153.0",
     "react-server-dom-webpack": "19.3.0",
     "unimport": "5.7.0",
     "unplugin-auto-import": "19.3.0",
-    "vite": "7.3.6",
+    "vite": "7.3.7",
     "vite-plugin-cjs-interop": "2.4.4",
     "vite-plugin-graphql-tag": "0.1.1",
     "vite-tsconfig-paths": "^6.1.1",
@@ -94,34 +94,34 @@
     "yargs-parser": "21.1.1"
   },
   "devDependencies": {
-    "@cedarjs/auth": "7.0.1-next.333",
-    "@cedarjs/framework-tools": "7.0.1-next.333",
-    "@cedarjs/router": "7.0.1-next.333",
-    "@cedarjs/web": "7.0.1-next.333",
+    "@cedarjs/auth": "7.0.1-next.466",
+    "@cedarjs/framework-tools": "7.0.1-next.466",
+    "@cedarjs/router": "7.0.1-next.466",
+    "@cedarjs/web": "7.0.1-next.466",
     "@dr.pogodin/react-helmet": "2.0.4",
     "@hyrious/esbuild-plugin-commonjs": "0.2.6",
     "@jridgewell/trace-mapping": "0.3.31",
-    "@oxc-project/types": "^0.151.0",
-    "@types/aws-lambda": "8.10.163",
+    "@oxc-project/types": "^0.153.0",
+    "@types/aws-lambda": "8.10.164",
     "@types/busboy": "^1",
     "@types/express": "5.0.6",
     "@types/react": "^19.2.0",
     "@types/ws": "^8",
     "@types/yargs-parser": "21.0.3",
-    "concurrently": "9.2.4",
-    "memfs": "4.79.0",
-    "publint": "0.3.24",
+    "concurrently": "9.2.5",
+    "memfs": "4.80.0",
+    "publint": "0.3.25",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "rollup": "4.63.5",
+    "rollup": "4.64.5",
     "ts-dedent": "2.3.0",
     "typescript": "5.9.3",
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "7.0.1-next.333",
-    "@cedarjs/router": "7.0.1-next.333",
-    "@cedarjs/web": "7.0.1-next.333",
+    "@cedarjs/auth": "7.0.1-next.466",
+    "@cedarjs/router": "7.0.1-next.466",
+    "@cedarjs/web": "7.0.1-next.466",
     "react": "19.3.0",
     "react-dom": "19.3.0"
   },