@cedarjs/vite 8.0.0-canary.3320 → 8.0.0-canary.3323

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export { cedarjsJobPathInjectorPlugin } from './plugins/vite-plugin-cedarjs-job-
 export { cedarMockCellDataPlugin } from './plugins/vite-plugin-cedar-mock-cell-data.js';
 export { cedarParsedScalarsPlugin } from './plugins/vite-plugin-cedar-parsed-scalars.js';
 export { cedarMergedConfig } from './plugins/vite-plugin-merged-config.js';
+export { cedarNetlifySkewProtectionPlugin } from './plugins/vite-plugin-cedar-netlify-skew-protection.js';
 export { cedarSwapApolloProvider } from './plugins/vite-plugin-swap-apollo-provider.js';
 export { cedarUniversalDeployPlugin } from './plugins/vite-plugin-cedar-universal-deploy.js';
 export { cedarWaitForApiServer } from './plugins/vite-plugin-cedar-wait-for-api-server.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAqCxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAA;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAA;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAA;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAA;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAA;AAE1F,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAE,aAAkB,GAAG,YAAY,EAAE,CAgDzE;AAED,8DAA8D;AAC9D,eAAe,KAAK,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,MAAM,CAAA;AAqCxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,iDAAiD,CAAA;AAC3F,OAAO,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAA;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAA;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAA;AACtF,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+CAA+C,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAA;AAC1F,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAA;AAC5E,OAAO,EAAE,+BAA+B,EAAE,MAAM,uDAAuD,CAAA;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAA;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,8CAA8C,CAAA;AAC/E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4DAA4D,CAAA;AACzG,OAAO,EAAE,2BAA2B,EAAE,MAAM,mDAAmD,CAAA;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,mDAAmD,CAAA;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,8DAA8D,CAAA;AACpH,OAAO,EAAE,4BAA4B,EAAE,MAAM,oDAAoD,CAAA;AACjG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAA;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wCAAwC,CAAA;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,wDAAwD,CAAA;AACzG,OAAO,EAAE,uBAAuB,EAAE,MAAM,+CAA+C,CAAA;AACvF,OAAO,EAAE,0BAA0B,EAAE,MAAM,iDAAiD,CAAA;AAC5F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAA;AAE1F,KAAK,aAAa,GAAG;IACnB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACzB,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAA;CACjC,CAAA;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAE,aAAkB,GAAG,YAAY,EAAE,CAgDzE;AAED,8DAA8D;AAC9D,eAAe,KAAK,CAAA"}

package/dist/index.js

@@ -52,6 +52,7 @@ import { cedarjsJobPathInjectorPlugin } from "./plugins/vite-plugin-cedarjs-job-
 import { cedarMockCellDataPlugin as cedarMockCellDataPlugin2 } from "./plugins/vite-plugin-cedar-mock-cell-data.js";
 import { cedarParsedScalarsPlugin as cedarParsedScalarsPlugin2 } from "./plugins/vite-plugin-cedar-parsed-scalars.js";
 import { cedarMergedConfig as cedarMergedConfig2 } from "./plugins/vite-plugin-merged-config.js";
+import { cedarNetlifySkewProtectionPlugin } from "./plugins/vite-plugin-cedar-netlify-skew-protection.js";
 import { cedarSwapApolloProvider as cedarSwapApolloProvider2 } from "./plugins/vite-plugin-swap-apollo-provider.js";
 import { cedarUniversalDeployPlugin } from "./plugins/vite-plugin-cedar-universal-deploy.js";
 import { cedarWaitForApiServer as cedarWaitForApiServer2 } from "./plugins/vite-plugin-cedar-wait-for-api-server.js";
@@ -109,6 +110,7 @@ export {
   cedarImportDirPlugin,
   cedarMergedConfig2 as cedarMergedConfig,
   cedarMockCellDataPlugin2 as cedarMockCellDataPlugin,
+  cedarNetlifySkewProtectionPlugin,
   cedarOtelWrappingPlugin,
   cedarParsedScalarsPlugin2 as cedarParsedScalarsPlugin,
   cedarRemoveDevFatalErrorPage2 as cedarRemoveDevFatalErrorPage,

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts

@@ -0,0 +1,52 @@
+import type { Plugin } from 'vite';
+export interface CedarNetlifySkewProtectionPluginOptions {
+    headerName?: string;
+    queryName?: string;
+    cookieName?: string;
+    /**
+     * How long (in seconds) the skew-token cookie should pin a client to this
+     * deploy before expiring. Netlify's own guidance is to keep this short to
+     * minimize the window where a client could end up pinned to a deploy
+     * that's since been cleaned up — but long enough to outlast a normal
+     * session. Defaults to 4 hours.
+     */
+    cookieMaxAge?: number;
+}
+/**
+ * Generates Netlify's `.netlify/v1/skew-protection.json` build output and
+ * stamps the current deploy's skew token into the SSR bundle.
+ *
+ * Background: https://docs.netlify.com/build/frameworks/frameworks-api/#netlifyv1skew-protectionjson
+ * Netlify exposes the current deploy's unique fingerprint at build time via
+ * `NETLIFY_SKEW_PROTECTION_TOKEN`, and at runtime via `context.deploy.skewProtectionToken`
+ * on the Functions/Edge Functions `context` object. Cedar's universal-deploy
+ * entries are plain `(request: Request) => Response` Fetchables with no
+ * platform-specific `context` forwarded through, so we can't read the
+ * runtime-provided token there. Instead we stamp the build-time value
+ * (identical to the runtime one — both describe the same deploy) into the
+ * bundle as a virtual module, then wrap Universal Deploy's catch-all
+ * Fetchable so every response pins the client to this deploy via a
+ * `Set-Cookie`. Cookies are the only one of Netlify's three skew-protection
+ * sources (cookie, header, query) that propagates for free — the browser
+ * resends them on every same-origin request without any client-side code
+ * having to attach anything, so that's the only mechanism this phase
+ * implements. Header/query propagation would only matter for requests that
+ * don't carry cookies (e.g. cross-origin calls), which is a narrower,
+ * separate follow-up.
+ *
+ * The UD wrapper above only covers requests that actually reach the UD
+ * Fetchable, though — a visitor's very first request, for the static HTML
+ * document itself, is served straight out of Netlify's CDN from `web/dist`
+ * and never reaches it. Netlify's own `_headers`-based custom headers
+ * explicitly warn that `Set-Cookie` there "may be overridden by Netlify
+ * cookie handling", so this also emits a small framework-authored Edge
+ * Function (via `.netlify/v1/edge-functions/`, auto-registered, no
+ * `netlify.toml` entry needed) that runs on every request, calls
+ * `context.next()`, and stamps the same cookie using the genuinely
+ * runtime-provided `context.deploy.skewProtectionToken` — which Edge
+ * Functions, unlike UD's Fetchables, do have access to. It skips responses
+ * that already carry our cookie (set by the UD wrapper above) so the two
+ * layers don't double-stamp the same request.
+ */
+export declare function cedarNetlifySkewProtectionPlugin(options?: CedarNetlifySkewProtectionPluginOptions): Plugin;
+//# sourceMappingURL=vite-plugin-cedar-netlify-skew-protection.d.ts.map

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vite-plugin-cedar-netlify-skew-protection.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-netlify-skew-protection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAIlC,MAAM,WAAW,uCAAuC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,uCAA4C,GACpD,MAAM,CAgOR"}

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.js

@@ -0,0 +1,184 @@
+import fs from "node:fs";
+import path from "node:path";
+import { catchAllEntry } from "@universal-deploy/store";
+import { getPaths } from "@cedarjs/project-config";
+const VIRTUAL_SKEW_TOKEN_ID = "virtual:cedar-netlify-skew-token";
+const RESOLVED_SKEW_TOKEN_ID = "\0" + VIRTUAL_SKEW_TOKEN_ID;
+function cedarNetlifySkewProtectionPlugin(options = {}) {
+  const {
+    headerName = "cedar-skew-token",
+    queryName = "skew",
+    cookieName = "cedar-skew-token",
+    cookieMaxAge = 60 * 60 * 4
+  } = options;
+  const skewToken = process.env.NETLIFY_SKEW_PROTECTION_TOKEN ?? "";
+  return {
+    name: "cedar-netlify-skew-protection",
+    apply: "build",
+    transform(code, id) {
+      if (this.environment?.name !== "ssr" || id !== catchAllEntry) {
+        return void 0;
+      }
+      const wrappedCode = code.replace(
+        /^export default \{/m,
+        "const __cedarSkewCatchAllHandler = {"
+      );
+      if (wrappedCode === code) {
+        this.warn(
+          'cedar-netlify-skew-protection: expected "export default {" in the Universal Deploy catch-all entry but did not find it \u2014 skipping runtime skew-token cookie propagation. This likely means @universal-deploy/vite changed how it generates the catch-all entry.'
+        );
+        return void 0;
+      }
+      return {
+        code: [
+          `import { CEDAR_SKEW_TOKEN, CEDAR_SKEW_COOKIE_NAME } from ${JSON.stringify(VIRTUAL_SKEW_TOKEN_ID)}`,
+          wrappedCode,
+          "",
+          "const __cedarSkewOriginalFetch =",
+          "  __cedarSkewCatchAllHandler.fetch.bind(__cedarSkewCatchAllHandler)",
+          "",
+          "__cedarSkewCatchAllHandler.fetch = async (request, ...args) => {",
+          "  const response = await __cedarSkewOriginalFetch(request, ...args)",
+          "",
+          "  // No token (e.g. a local `cedar build --ud` run outside a",
+          "  // Netlify build) or no response (an unmatched route) \u2014 nothing",
+          "  // to stamp. Statuses outside 200-599 (e.g. 101 for a WebSocket",
+          "  // upgrade) make the Response constructor below throw, and 204/304",
+          "  // responses have no body semantics worth re-wrapping \u2014 leave all",
+          "  // of those untouched. Also skip if a `Set-Cookie` for our cookie",
+          "  // name is already present (e.g. set further up the handler chain,",
+          "  // or by the edge function below) to avoid sending a duplicate.",
+          "  if (",
+          "    !CEDAR_SKEW_TOKEN ||",
+          "    !response ||",
+          "    response.status < 200 ||",
+          "    response.status > 599 ||",
+          "    response.status === 204 ||",
+          "    response.status === 304 ||",
+          '    (response.headers.get("set-cookie") ?? "").includes(',
+          "      `${CEDAR_SKEW_COOKIE_NAME}=`,",
+          "    )",
+          "  ) {",
+          "    return response",
+          "  }",
+          "",
+          "  const headers = new Headers(response.headers)",
+          "  headers.append(",
+          '    "set-cookie",',
+          `    \`\${CEDAR_SKEW_COOKIE_NAME}=\${CEDAR_SKEW_TOKEN}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; Secure; SameSite=Lax\`,`,
+          "  )",
+          "",
+          "  return new Response(response.body, {",
+          "    status: response.status,",
+          "    statusText: response.statusText,",
+          "    headers,",
+          "  })",
+          "}",
+          "",
+          "export default __cedarSkewCatchAllHandler"
+        ].join("\n"),
+        map: null
+      };
+    },
+    resolveId(id) {
+      if (id === VIRTUAL_SKEW_TOKEN_ID) {
+        return RESOLVED_SKEW_TOKEN_ID;
+      }
+      return void 0;
+    },
+    load(id) {
+      if (id !== RESOLVED_SKEW_TOKEN_ID) {
+        return void 0;
+      }
+      return [
+        `export const CEDAR_SKEW_TOKEN = ${JSON.stringify(skewToken)}`,
+        `export const CEDAR_SKEW_HEADER_NAME = ${JSON.stringify(headerName)}`,
+        `export const CEDAR_SKEW_QUERY_NAME = ${JSON.stringify(queryName)}`,
+        `export const CEDAR_SKEW_COOKIE_NAME = ${JSON.stringify(cookieName)}`,
+        ""
+      ].join("\n");
+    },
+    writeBundle() {
+      if (this.environment?.name !== "client") {
+        return;
+      }
+      if (!skewToken) {
+        return;
+      }
+      const netlifyV1Dir = path.join(getPaths().web.base, ".netlify", "v1");
+      fs.mkdirSync(netlifyV1Dir, { recursive: true });
+      const manifest = {
+        // Match every path: Cedar can't assume a fixed static-asset
+        // directory convention, and Netlify's own docs example matches
+        // assets too, so there's no correctness reason to narrow this.
+        patterns: [".*"],
+        sources: [
+          { type: "header", name: headerName },
+          { type: "query", name: queryName },
+          { type: "cookie", name: cookieName }
+        ]
+      };
+      fs.writeFileSync(
+        path.join(netlifyV1Dir, "skew-protection.json"),
+        JSON.stringify(manifest, null, 2) + "\n"
+      );
+      const edgeFunctionsDir = path.join(netlifyV1Dir, "edge-functions");
+      fs.mkdirSync(edgeFunctionsDir, { recursive: true });
+      fs.writeFileSync(
+        path.join(edgeFunctionsDir, "cedar-skew-cookie.js"),
+        [
+          "// Generated by @cedarjs/vite \u2014 stamps the skew-protection cookie",
+          "// on requests that don't reach Universal Deploy's catch-all",
+          "// Fetchable (most notably the initial HTML document load, served",
+          "// directly from Netlify's CDN). See",
+          "// vite-plugin-cedar-netlify-skew-protection.ts for the full picture.",
+          "export default async (request, context) => {",
+          "  const response = await context.next()",
+          "",
+          `  const cookieName = ${JSON.stringify(cookieName)}`,
+          "",
+          "  // Statuses outside 200-599 (e.g. 101 for a WebSocket upgrade)",
+          "  // make the Response constructor below throw, and 204/304",
+          "  // responses have no body semantics worth re-wrapping. Also skip",
+          "  // if already stamped \u2014 either by the UD wrapper further down the",
+          "  // chain, or (if this ran twice somehow) by this function itself.",
+          "  if (",
+          "    response.status < 200 ||",
+          "    response.status > 599 ||",
+          "    response.status === 204 ||",
+          "    response.status === 304 ||",
+          '    (response.headers.get("set-cookie") ?? "").includes(`${cookieName}=`)',
+          "  ) {",
+          "    return response",
+          "  }",
+          "",
+          "  const token = context.deploy?.skewProtectionToken",
+          "  if (!token) {",
+          "    return response",
+          "  }",
+          "",
+          "  const headers = new Headers(response.headers)",
+          "  headers.append(",
+          '    "set-cookie",',
+          `    \`\${cookieName}=\${token}; Path=/; Max-Age=${cookieMaxAge}; HttpOnly; Secure; SameSite=Lax\`,`,
+          "  )",
+          "",
+          "  return new Response(response.body, {",
+          "    status: response.status,",
+          "    statusText: response.statusText,",
+          "    headers,",
+          "  })",
+          "}",
+          "",
+          "export const config = {",
+          '  path: "/*",',
+          "}",
+          ""
+        ].join("\n")
+      );
+    }
+  };
+}
+export {
+  cedarNetlifySkewProtectionPlugin
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/vite",
-  "version": "8.0.0-canary.3320",
+  "version": "8.0.0-canary.3323",
   "description": "Vite configuration package for CedarJS",
   "repository": {
     "type": "git",
@@ -54,17 +54,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.8",
     "@babel/types": "7.29.8",
-    "@cedarjs/api": "8.0.0-canary.3320",
-    "@cedarjs/api-server": "8.0.0-canary.3320",
-    "@cedarjs/babel-config": "8.0.0-canary.3320",
-    "@cedarjs/context": "8.0.0-canary.3320",
-    "@cedarjs/graphql-server": "8.0.0-canary.3320",
-    "@cedarjs/internal": "8.0.0-canary.3320",
-    "@cedarjs/jobs": "8.0.0-canary.3320",
-    "@cedarjs/project-config": "8.0.0-canary.3320",
-    "@cedarjs/server-store": "8.0.0-canary.3320",
-    "@cedarjs/structure": "8.0.0-canary.3320",
-    "@cedarjs/testing": "8.0.0-canary.3320",
+    "@cedarjs/api": "8.0.0-canary.3323",
+    "@cedarjs/api-server": "8.0.0-canary.3323",
+    "@cedarjs/babel-config": "8.0.0-canary.3323",
+    "@cedarjs/context": "8.0.0-canary.3323",
+    "@cedarjs/graphql-server": "8.0.0-canary.3323",
+    "@cedarjs/internal": "8.0.0-canary.3323",
+    "@cedarjs/jobs": "8.0.0-canary.3323",
+    "@cedarjs/project-config": "8.0.0-canary.3323",
+    "@cedarjs/server-store": "8.0.0-canary.3323",
+    "@cedarjs/structure": "8.0.0-canary.3323",
+    "@cedarjs/testing": "8.0.0-canary.3323",
     "@swc/core": "1.16.13",
     "@universal-deploy/store": "^0.2.1",
     "@universal-deploy/vite": "^0.1.9",
@@ -94,10 +94,10 @@
     "yargs-parser": "21.1.1"
   },
   "devDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3320",
-    "@cedarjs/framework-tools": "8.0.0-canary.3320",
-    "@cedarjs/router": "8.0.0-canary.3320",
-    "@cedarjs/web": "8.0.0-canary.3320",
+    "@cedarjs/auth": "8.0.0-canary.3323",
+    "@cedarjs/framework-tools": "8.0.0-canary.3323",
+    "@cedarjs/router": "8.0.0-canary.3323",
+    "@cedarjs/web": "8.0.0-canary.3323",
     "@dr.pogodin/react-helmet": "2.0.4",
     "@hyrious/esbuild-plugin-commonjs": "0.2.6",
     "@jridgewell/trace-mapping": "0.3.31",
@@ -113,15 +113,15 @@
     "publint": "0.3.24",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "rollup": "4.63.5",
+    "rollup": "4.63.6",
     "ts-dedent": "2.3.0",
     "typescript": "5.9.3",
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3320",
-    "@cedarjs/router": "8.0.0-canary.3320",
-    "@cedarjs/web": "8.0.0-canary.3320",
+    "@cedarjs/auth": "8.0.0-canary.3323",
+    "@cedarjs/router": "8.0.0-canary.3323",
+    "@cedarjs/web": "8.0.0-canary.3323",
     "react": "19.3.0",
     "react-dom": "19.3.0"
   },