@cedarjs/vite 8.0.0-canary.3324 → 8.0.0-canary.3326

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts

@@ -1,52 +1,73 @@
-import type { Plugin } from 'vite';
+import type { Plugin, ResolvedConfig } from 'vite';
 export interface CedarNetlifySkewProtectionPluginOptions {
     headerName?: string;
     queryName?: string;
     cookieName?: string;
     /**
-     * How long (in seconds) the skew-token cookie should pin a client to this
-     * deploy before expiring. Netlify's own guidance is to keep this short to
-     * minimize the window where a client could end up pinned to a deploy
-     * that's since been cleaned up — but long enough to outlast a normal
-     * session. Defaults to 4 hours.
+     * How long (in seconds) the skew-token cookie pins a client's asset and API
+     * requests to the deploy it last loaded a page from. Page loads are never
+     * pinned and always refresh the cookie, so a long value can't keep anyone
+     * on an old version; it only bounds how long an open tab can keep loading
+     * lazy chunks from the deploy it started on. Defaults to 24 hours.
      */
     cookieMaxAge?: number;
 }
 /**
- * Generates Netlify's `.netlify/v1/skew-protection.json` build output and
- * stamps the current deploy's skew token into the SSR bundle.
+ * The paths Netlify should route to a client's pinned deploy, and the paths
+ * the edge function doesn't need to run on.
+ */
+export interface SkewProtectionPaths {
+    /** Regexes for Netlify's `skew-protection.json` `patterns` */
+    patterns: string[];
+    /** Globs for the edge function's `excludedPath` */
+    excludedPaths: string[];
+}
+/**
+ * Pins hashed build assets (the lazy-loaded chunks an already-open tab
+ * requests after a new deploy) and Cedar's API routes (so an old client keeps
+ * talking to the API it was built against). Page loads are not pinned, so a
+ * reload or a fresh visit always gets the latest deploy.
+ */
+export declare function getSkewProtectionPaths(config: Pick<ResolvedConfig, 'base' | 'build' | 'plugins'>): SkewProtectionPaths;
+/**
+ * Generates Netlify's `.netlify/v1/skew-protection.json` build output, an
+ * edge function that stamps the skew-token cookie on static HTML, and wraps
+ * Universal Deploy's catch-all Fetchable so server-rendered HTML gets the
+ * same cookie.
  *
  * Background: https://docs.netlify.com/build/frameworks/frameworks-api/#netlifyv1skew-protectionjson
- * Netlify exposes the current deploy's unique fingerprint at build time via
- * `NETLIFY_SKEW_PROTECTION_TOKEN`, and at runtime via `context.deploy.skewProtectionToken`
- * on the Functions/Edge Functions `context` object. Cedar's universal-deploy
- * entries are plain `(request: Request) => Response` Fetchables with no
- * platform-specific `context` forwarded through, so we can't read the
- * runtime-provided token there. Instead we stamp the build-time value
- * (identical to the runtime one — both describe the same deploy) into the
- * bundle as a virtual module, then wrap Universal Deploy's catch-all
- * Fetchable so every response pins the client to this deploy via a
- * `Set-Cookie`. Cookies are the only one of Netlify's three skew-protection
- * sources (cookie, header, query) that propagates for free — the browser
- * resends them on every same-origin request without any client-side code
- * having to attach anything, so that's the only mechanism this phase
- * implements. Header/query propagation would only matter for requests that
- * don't carry cookies (e.g. cross-origin calls), which is a narrower,
- * separate follow-up.
  *
- * The UD wrapper above only covers requests that actually reach the UD
- * Fetchable, though — a visitor's very first request, for the static HTML
- * document itself, is served straight out of Netlify's CDN from `web/dist`
- * and never reaches it. Netlify's own `_headers`-based custom headers
- * explicitly warn that `Set-Cookie` there "may be overridden by Netlify
- * cookie handling", so this also emits a small framework-authored Edge
- * Function (via `.netlify/v1/edge-functions/`, auto-registered, no
- * `netlify.toml` entry needed) that runs on every request, calls
- * `context.next()`, and stamps the same cookie using the genuinely
- * runtime-provided `context.deploy.skewProtectionToken` — which Edge
- * Functions, unlike UD's Fetchables, do have access to. It skips responses
- * that already carry our cookie (set by the UD wrapper above) so the two
- * layers don't double-stamp the same request.
+ * How it works:
+ * - Every HTML response sets `Set-Cookie: <cookieName>=<deploy token>`.
+ *   Netlify exposes the token at build time as `NETLIFY_SKEW_PROTECTION_TOKEN`
+ *   and at runtime as `context.deploy.skewProtectionToken`.
+ * - Requests matching `patterns` (build assets and API routes, see
+ *   `getSkewProtectionPaths`) that carry the cookie are served by the deploy
+ *   the token belongs to. A tab that loaded an old build keeps loading its
+ *   own lazy chunks after a new deploy, instead of getting 404s.
+ * - Page loads don't match `patterns`, so they're always served by the
+ *   latest deploy, and its HTML sets the latest token. Reloading is therefore
+ *   always enough to get the newest version.
+ * - Only HTML responses to page loads set the cookie. Responses to pinned
+ *   asset and API requests can come from an old deploy and would otherwise
+ *   renew the old token.
+ *
+ * The cookie is set in two places:
+ * - Static HTML (prerendered pages and the SPA shell) is served from
+ *   Netlify's CDN and never reaches Cedar's server code. A framework-authored
+ *   edge function (`.netlify/v1/edge-functions/`, registered automatically)
+ *   stamps it using `context.deploy.skewProtectionToken`.
+ * - Server-rendered HTML comes from Universal Deploy's catch-all Fetchable.
+ *   Fetchables are plain `(request: Request) => Response` functions that
+ *   don't get Netlify's `context`, so the build-time token (identical to the
+ *   runtime one, both describe the same deploy) is stamped into the SSR
+ *   bundle as a virtual module, and the Fetchable is wrapped to set the
+ *   cookie.
+ *
+ * Cookies are the only one of Netlify's three token sources (cookie, header,
+ * query) that browsers send automatically, so they're the only one Cedar
+ * sets. The header and query sources are registered so clients that can't
+ * use cookies can still pin requests by sending the token themselves.
  */
 export declare function cedarNetlifySkewProtectionPlugin(options?: CedarNetlifySkewProtectionPluginOptions): Plugin;
 //# sourceMappingURL=vite-plugin-cedar-netlify-skew-protection.d.ts.map

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-netlify-skew-protection.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-netlify-skew-protection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAIlC,MAAM,WAAW,uCAAuC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAKD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,uCAA4C,GACpD,MAAM,CAgOR"}
+{"version":3,"file":"vite-plugin-cedar-netlify-skew-protection.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-netlify-skew-protection.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,MAAM,CAAA;AAOlD,MAAM,WAAW,uCAAuC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,mDAAmD;IACnD,aAAa,EAAE,MAAM,EAAE,CAAA;CACxB;AAoBD;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC,GACzD,mBAAmB,CAgCrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,GAAE,uCAA4C,GACpD,MAAM,CAwOR"}

package/dist/plugins/vite-plugin-cedar-netlify-skew-protection.js

@@ -2,19 +2,57 @@ import fs from "node:fs";
 import path from "node:path";
 import { catchAllEntry } from "@universal-deploy/store";
 import { getPaths } from "@cedarjs/project-config";
+import { CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME } from "./vite-plugin-cedar-universal-deploy.js";
 const VIRTUAL_SKEW_TOKEN_ID = "virtual:cedar-netlify-skew-token";
 const RESOLVED_SKEW_TOKEN_ID = "\0" + VIRTUAL_SKEW_TOKEN_ID;
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function isUniversalDeployPluginApi(api) {
+  return typeof api === "object" && api !== null && "routes" in api && Array.isArray(api.routes);
+}
+function getSkewProtectionPaths(config) {
+  const patterns = [];
+  const excludedPaths = [];
+  const baseIsUrl = /^([a-z][a-z\d+.-]*:)?\/\//i.test(config.base);
+  if (!baseIsUrl) {
+    const basePath = config.base.startsWith("/") ? config.base : "/";
+    const assetsPath = path.posix.join(basePath, config.build.assetsDir);
+    patterns.push(`^${escapeRegExp(assetsPath)}/`);
+    excludedPaths.push(`${assetsPath}/*`);
+  }
+  const udApi = config.plugins.find(
+    (plugin) => plugin.name === CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME
+  )?.api;
+  if (isUniversalDeployPluginApi(udApi)) {
+    for (const route of udApi.routes) {
+      if (route.path.includes("*")) {
+        continue;
+      }
+      patterns.push(`^${escapeRegExp(route.path)}(/.*)?$`);
+      excludedPaths.push(route.path, `${route.path}/*`);
+    }
+  }
+  return { patterns, excludedPaths };
+}
 function cedarNetlifySkewProtectionPlugin(options = {}) {
   const {
     headerName = "cedar-skew-token",
     queryName = "skew",
     cookieName = "cedar-skew-token",
-    cookieMaxAge = 60 * 60 * 4
+    cookieMaxAge = 60 * 60 * 24
   } = options;
   const skewToken = process.env.NETLIFY_SKEW_PROTECTION_TOKEN ?? "";
+  let skewProtectionPaths = {
+    patterns: [],
+    excludedPaths: []
+  };
   return {
     name: "cedar-netlify-skew-protection",
     apply: "build",
+    configResolved(config) {
+      skewProtectionPaths = getSkewProtectionPaths(config);
+    },
     transform(code, id) {
       if (this.environment?.name !== "ssr" || id !== catchAllEntry) {
         return void 0;
@@ -25,7 +63,7 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
       );
       if (wrappedCode === code) {
         this.warn(
-          'cedar-netlify-skew-protection: expected "export default {" in the Universal Deploy catch-all entry but did not find it \u2014 skipping runtime skew-token cookie propagation. This likely means @universal-deploy/vite changed how it generates the catch-all entry.'
+          'cedar-netlify-skew-protection: expected "export default {" in the Universal Deploy catch-all entry but did not find it \u2014 skipping skew-token cookie stamping on server-rendered HTML. This likely means @universal-deploy/vite changed how it generates the catch-all entry.'
         );
         return void 0;
       }
@@ -34,20 +72,28 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
           `import { CEDAR_SKEW_TOKEN, CEDAR_SKEW_COOKIE_NAME } from ${JSON.stringify(VIRTUAL_SKEW_TOKEN_ID)}`,
           wrappedCode,
           "",
+          "const __cedarSkewPinnedPatterns = [",
+          ...skewProtectionPaths.patterns.map(
+            (pattern) => `  new RegExp(${JSON.stringify(pattern)}),`
+          ),
+          "]",
+          "",
           "const __cedarSkewOriginalFetch =",
           "  __cedarSkewCatchAllHandler.fetch.bind(__cedarSkewCatchAllHandler)",
           "",
           "__cedarSkewCatchAllHandler.fetch = async (request, ...args) => {",
           "  const response = await __cedarSkewOriginalFetch(request, ...args)",
           "",
-          "  // No token (e.g. a local `cedar build --ud` run outside a",
-          "  // Netlify build) or no response (an unmatched route) \u2014 nothing",
-          "  // to stamp. Statuses outside 200-599 (e.g. 101 for a WebSocket",
-          "  // upgrade) make the Response constructor below throw, and 204/304",
-          "  // responses have no body semantics worth re-wrapping \u2014 leave all",
-          "  // of those untouched. Also skip if a `Set-Cookie` for our cookie",
-          "  // name is already present (e.g. set further up the handler chain,",
-          "  // or by the edge function below) to avoid sending a duplicate.",
+          "  // Only HTML responses to page loads set the cookie (see",
+          "  // vite-plugin-cedar-netlify-skew-protection.ts). Requests to pinned",
+          "  // paths are never page loads, even if an API function returns",
+          "  // HTML, and may be served by an old deploy. Nothing to stamp",
+          "  // without a token (e.g. a local `cedar build --ud` run outside a",
+          "  // Netlify build) or a response (an unmatched route). Statuses",
+          "  // outside 200-599 (e.g. 101 for a WebSocket upgrade) make the",
+          "  // Response constructor below throw, and 204/304 responses have no",
+          "  // body worth re-wrapping. Responses that already set our cookie",
+          "  // are left alone to avoid a duplicate.",
           "  if (",
           "    !CEDAR_SKEW_TOKEN ||",
           "    !response ||",
@@ -55,6 +101,10 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
           "    response.status > 599 ||",
           "    response.status === 204 ||",
           "    response.status === 304 ||",
+          '    !(response.headers.get("content-type") ?? "").includes("text/html") ||',
+          "    __cedarSkewPinnedPatterns.some((pattern) =>",
+          "      pattern.test(new URL(request.url).pathname),",
+          "    ) ||",
           '    (response.headers.get("set-cookie") ?? "").includes(',
           "      `${CEDAR_SKEW_COOKIE_NAME}=`,",
           "    )",
@@ -108,10 +158,7 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
       const netlifyV1Dir = path.join(getPaths().web.base, ".netlify", "v1");
       fs.mkdirSync(netlifyV1Dir, { recursive: true });
       const manifest = {
-        // Match every path: Cedar can't assume a fixed static-asset
-        // directory convention, and Netlify's own docs example matches
-        // assets too, so there's no correctness reason to narrow this.
-        patterns: [".*"],
+        patterns: skewProtectionPaths.patterns,
         sources: [
           { type: "header", name: headerName },
           { type: "query", name: queryName },
@@ -127,26 +174,25 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
       fs.writeFileSync(
         path.join(edgeFunctionsDir, "cedar-skew-cookie.js"),
         [
-          "// Generated by @cedarjs/vite \u2014 stamps the skew-protection cookie",
-          "// on requests that don't reach Universal Deploy's catch-all",
-          "// Fetchable (most notably the initial HTML document load, served",
-          "// directly from Netlify's CDN). See",
+          "// Generated by @cedarjs/vite. Stamps the skew-protection cookie on",
+          "// static HTML served from Netlify's CDN. See",
           "// vite-plugin-cedar-netlify-skew-protection.ts for the full picture.",
           "export default async (request, context) => {",
           "  const response = await context.next()",
           "",
           `  const cookieName = ${JSON.stringify(cookieName)}`,
           "",
-          "  // Statuses outside 200-599 (e.g. 101 for a WebSocket upgrade)",
-          "  // make the Response constructor below throw, and 204/304",
-          "  // responses have no body semantics worth re-wrapping. Also skip",
-          "  // if already stamped \u2014 either by the UD wrapper further down the",
-          "  // chain, or (if this ran twice somehow) by this function itself.",
+          "  // Only HTML responses set the cookie. Statuses outside 200-599",
+          "  // (e.g. 101 for a WebSocket upgrade) make the Response",
+          "  // constructor below throw, and 204/304 responses have no body",
+          "  // worth re-wrapping. Responses that already set our cookie (from",
+          "  // the Universal Deploy wrapper) are left alone.",
           "  if (",
           "    response.status < 200 ||",
           "    response.status > 599 ||",
           "    response.status === 204 ||",
           "    response.status === 304 ||",
+          '    !(response.headers.get("content-type") ?? "").includes("text/html") ||',
           '    (response.headers.get("set-cookie") ?? "").includes(`${cookieName}=`)',
           "  ) {",
           "    return response",
@@ -172,6 +218,7 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
           "",
           "export const config = {",
           '  path: "/*",',
+          `  excludedPath: ${JSON.stringify(skewProtectionPaths.excludedPaths)},`,
           "}",
           ""
         ].join("\n")
@@ -180,5 +227,6 @@ function cedarNetlifySkewProtectionPlugin(options = {}) {
   };
 }
 export {
-  cedarNetlifySkewProtectionPlugin
+  cedarNetlifySkewProtectionPlugin,
+  getSkewProtectionPaths
 };

package/dist/plugins/vite-plugin-cedar-universal-deploy.d.ts

@@ -1,6 +1,16 @@
 import type { Plugin } from 'vite';
+import type { CedarRouteRecord } from '@cedarjs/api/runtime';
 export interface CedarUniversalDeployPluginOptions {
     apiRootPath?: string;
 }
+/**
+ * Exposed as the plugin's `api` property so other plugins (e.g.
+ * `cedarNetlifySkewProtectionPlugin`) can find the API routes this plugin
+ * registers.
+ */
+export interface CedarUniversalDeployPluginApi {
+    routes: CedarRouteRecord[];
+}
+export declare const CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME = "cedar-universal-deploy";
 export declare function cedarUniversalDeployPlugin(options?: CedarUniversalDeployPluginOptions): Plugin;
 //# sourceMappingURL=vite-plugin-cedar-universal-deploy.d.ts.map

package/dist/plugins/vite-plugin-cedar-universal-deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-plugin-cedar-universal-deploy.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-universal-deploy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAgBlC,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AA6GD,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,MAAM,CA0GR"}
+{"version":3,"file":"vite-plugin-cedar-universal-deploy.d.ts","sourceRoot":"","sources":["../../src/plugins/vite-plugin-cedar-universal-deploy.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAA;AAGlC,OAAO,KAAK,EAEV,gBAAgB,EAEjB,MAAM,sBAAsB,CAAA;AAS7B,MAAM,WAAW,iCAAiC;IAChD,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAC3B;AAED,eAAO,MAAM,kCAAkC,2BAA2B,CAAA;AA6G1E,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,iCAAsC,GAC9C,MAAM,CA6GR"}

package/dist/plugins/vite-plugin-cedar-universal-deploy.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { addEntry } from "@universal-deploy/store";
 import { findApiServerFunctions } from "@cedarjs/internal/dist/files.js";
 import { getPaths } from "@cedarjs/project-config";
+const CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME = "cedar-universal-deploy";
 const VIRTUAL_CEDAR_FN_PREFIX = "virtual:cedar-api:fn:";
 const RESOLVED_CEDAR_FN_PREFIX = "\0virtual:cedar-api:fn:";
 const GRAPHQL_METHODS = ["GET", "POST", "OPTIONS"];
@@ -66,9 +67,11 @@ function toEntryMeta(route) {
 function cedarUniversalDeployPlugin(options = {}) {
   const effectiveApiRootPath = process.env.CEDAR_API_ROOT_PATH ?? options.apiRootPath;
   const routes = discoverCedarRoutes(effectiveApiRootPath ?? "/");
+  const api = { routes };
   return {
-    name: "cedar-universal-deploy",
+    name: CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME,
     apply: "build",
+    api,
     config: {
       order: "pre",
       handler() {
@@ -308,5 +311,6 @@ function createGraphQLFetch(graphqlOptions) {
   };
 }
 export {
+  CEDAR_UNIVERSAL_DEPLOY_PLUGIN_NAME,
   cedarUniversalDeployPlugin
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cedarjs/vite",
-  "version": "8.0.0-canary.3324",
+  "version": "8.0.0-canary.3326",
   "description": "Vite configuration package for CedarJS",
   "repository": {
     "type": "git",
@@ -54,17 +54,17 @@
     "@babel/preset-typescript": "7.29.7",
     "@babel/traverse": "7.29.8",
     "@babel/types": "7.29.8",
-    "@cedarjs/api": "8.0.0-canary.3324",
-    "@cedarjs/api-server": "8.0.0-canary.3324",
-    "@cedarjs/babel-config": "8.0.0-canary.3324",
-    "@cedarjs/context": "8.0.0-canary.3324",
-    "@cedarjs/graphql-server": "8.0.0-canary.3324",
-    "@cedarjs/internal": "8.0.0-canary.3324",
-    "@cedarjs/jobs": "8.0.0-canary.3324",
-    "@cedarjs/project-config": "8.0.0-canary.3324",
-    "@cedarjs/server-store": "8.0.0-canary.3324",
-    "@cedarjs/structure": "8.0.0-canary.3324",
-    "@cedarjs/testing": "8.0.0-canary.3324",
+    "@cedarjs/api": "8.0.0-canary.3326",
+    "@cedarjs/api-server": "8.0.0-canary.3326",
+    "@cedarjs/babel-config": "8.0.0-canary.3326",
+    "@cedarjs/context": "8.0.0-canary.3326",
+    "@cedarjs/graphql-server": "8.0.0-canary.3326",
+    "@cedarjs/internal": "8.0.0-canary.3326",
+    "@cedarjs/jobs": "8.0.0-canary.3326",
+    "@cedarjs/project-config": "8.0.0-canary.3326",
+    "@cedarjs/server-store": "8.0.0-canary.3326",
+    "@cedarjs/structure": "8.0.0-canary.3326",
+    "@cedarjs/testing": "8.0.0-canary.3326",
     "@swc/core": "1.16.13",
     "@universal-deploy/store": "^0.2.1",
     "@universal-deploy/vite": "^0.1.9",
@@ -94,10 +94,10 @@
     "yargs-parser": "21.1.1"
   },
   "devDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3324",
-    "@cedarjs/framework-tools": "8.0.0-canary.3324",
-    "@cedarjs/router": "8.0.0-canary.3324",
-    "@cedarjs/web": "8.0.0-canary.3324",
+    "@cedarjs/auth": "8.0.0-canary.3326",
+    "@cedarjs/framework-tools": "8.0.0-canary.3326",
+    "@cedarjs/router": "8.0.0-canary.3326",
+    "@cedarjs/web": "8.0.0-canary.3326",
     "@dr.pogodin/react-helmet": "2.0.4",
     "@hyrious/esbuild-plugin-commonjs": "0.2.6",
     "@jridgewell/trace-mapping": "0.3.31",
@@ -119,9 +119,9 @@
     "vitest": "4.1.11"
   },
   "peerDependencies": {
-    "@cedarjs/auth": "8.0.0-canary.3324",
-    "@cedarjs/router": "8.0.0-canary.3324",
-    "@cedarjs/web": "8.0.0-canary.3324",
+    "@cedarjs/auth": "8.0.0-canary.3326",
+    "@cedarjs/router": "8.0.0-canary.3326",
+    "@cedarjs/web": "8.0.0-canary.3326",
     "react": "19.3.0",
     "react-dom": "19.3.0"
   },