@salesforce/lds-runtime-aura 1.428.0-dev20 → 1.428.0-dev22

package/dist/ldsEngineCreator.js

@@ -26,7 +26,7 @@ import { instrument, getRecordAvatarsAdapterFactory, getRecordAdapterFactory, co
 import { getInstrumentation } from 'o11y/client';
 import { findExecutableOperation, buildGraphQLInputExtension, addTypenameToDocument } from 'force/luvioGraphqlNormalization';
 import { print, resolveAndValidateGraphQLConfig } from 'force/luvioOnestoreGraphqlParser';
-import { setServices } from 'force/luvioServiceProvisioner1';
+import { buildStaticServiceResolver, setServiceResolver, setServices } from 'force/luvioServiceProvisioner1';
 import { assertIsValid, MissingRequiredPropertyError, JsonSchemaViolationError } from 'force/luvioJsonschemaValidate5';
 import { dispatchGlobalEvent, executeGlobalControllerRawResponse } from 'aura';
 import auraNetworkAdapter, { dispatchAuraAction, defaultActionConfig, instrument as instrument$1, forceRecordTransactionsDisabled as forceRecordTransactionsDisabled$1, ldsNetworkAdapterInstrument, CrudEventState, CrudEventType, UIAPI_RECORDS_PATH, UIAPI_RELATED_LIST_RECORDS_BATCH_PATH, UIAPI_RELATED_LIST_RECORDS_PATH } from 'force/ldsNetwork';
@@ -402,6 +402,7 @@ class AuraNetworkCommand extends NetworkCommand$1 {
       storable: false
     };
     this.networkPreference = "aura";
+    this.additionalNullResponses = [];
   }
   get fetchParams() {
     throw new Error(
@@ -438,14 +439,37 @@ class AuraNetworkCommand extends NetworkCommand$1 {
       }
     });
   }
+  isSemanticNullResponse(response) {
+    return this.additionalNullResponses.includes(response.status);
+  }
+  isProtocolNoBodyStatus(status) {
+    return status === 204 || status === 205;
+  }
+  isUndeclaredNoBodyResponse(response) {
+    return this.isProtocolNoBodyStatus(response.status) && !this.isSemanticNullResponse(response);
+  }
   convertFetchResponseToData(response) {
     return response.then(
       (response2) => {
         if (response2.ok) {
-          return response2.json().then(
-            (json) => ok$2(json),
-            (reason) => err$1(toError(reason))
-          ).finally(() => {
+          let resultPromise;
+          if (this.isSemanticNullResponse(response2)) {
+            resultPromise = Promise.resolve(ok$2(null));
+          } else if (this.isUndeclaredNoBodyResponse(response2)) {
+            resultPromise = Promise.resolve(
+              err$1(
+                toError(
+                  `Unexpected ${response2.status} response: no-content status was not declared in the API specification. Declare this response in your OAS without a content property.`
+                )
+              )
+            );
+          } else {
+            resultPromise = response2.json().then(
+              (json) => ok$2(json),
+              (reason) => err$1(toError(reason))
+            );
+          }
+          return resultPromise.finally(() => {
             try {
               this.afterRequestHooks({ statusCode: response2.status });
             } catch {
@@ -2763,7 +2787,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.428.0-dev20-d72ac06681
+// version: 1.428.0-dev22-bfcb919e66
 
 /*!
  * Copyright (c) 2022, Salesforce, Inc.,
@@ -3116,7 +3140,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.428.0-dev20-d72ac06681
+// version: 1.428.0-dev22-bfcb919e66
 
 /*!
  * Copyright (c) 2022, Salesforce, Inc.,
@@ -3273,6 +3297,66 @@ function buildServiceDescriptor$8(defaultRetryPolicy) {
   };
 }
 
+function tagsEqual(a, b) {
+    const keys = Object.keys(b);
+    return (a !== undefined && keys.length === Object.keys(a).length && keys.every((k) => a[k] === b[k]));
+}
+// W-23092947: on Aura sites HTTP-to-core is broken, so withhold every `fetch` service
+// except those whose request tags are in `allowedFetchTags` (the external hosts). A
+// withheld optional fetch resolves to `undefined`, making `AuraNetworkCommand` use Aura.
+function buildAuraSiteServiceResolver(services, allowedFetchTags) {
+    const staticResolver = buildStaticServiceResolver(services);
+    const isWithheld = (req) => req.type === 'fetch' && !allowedFetchTags.some((allowed) => tagsEqual(req.tags, allowed));
+    return (requested) => {
+        const passthrough = {};
+        const withheldUnresolved = [];
+        for (const [name, req] of Object.entries(requested)) {
+            if (!isWithheld(req)) {
+                passthrough[name] = req;
+            }
+            else if (!('optional' in req && req.optional)) {
+                withheldUnresolved.push(name);
+            }
+        }
+        return staticResolver(passthrough).then(([resolved, unresolved]) => [
+            resolved,
+            [...unresolved, ...withheldUnresolved],
+        ]);
+    };
+}
+
+/**
+ * Helpers for reaching the Aura framework from the LDS Aura runtime.
+ *
+ * `window.$A` is only present when the runtime is hosted inside Aura (LEX or an
+ * Aura site); in tests and non-Aura runtimes it is absent.
+ */
+/**
+ * Returns the Aura framework global (`window.$A`) when running inside Aura, or
+ * `undefined` in tests and non-Aura runtimes. Never throws.
+ */
+function getAura() {
+    if (typeof window === 'undefined') {
+        return undefined;
+    }
+    return window.$A;
+}
+/**
+ * Returns `true` when the Aura runtime is hosted inside an Aura/Experience site
+ * (Experience Builder / `communityApp`) rather than LEX (one.app).
+ * `$A.get('$Site')` is present and truthy on Aura sites, absent/falsy in LEX. A
+ * stable per-page signal. Defensive: never throws. (W-23092947)
+ */
+function isAuraSite() {
+    const aura = getAura();
+    try {
+        return !!aura?.get?.('$Site');
+    }
+    catch {
+        return false;
+    }
+}
+
 /*!
  * Copyright (c) 2022, Salesforce, Inc.,
  * All rights reserved.
@@ -5992,7 +6076,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.428.0-dev20-d72ac06681
+// version: 1.428.0-dev22-bfcb919e66
 
 const environmentHasAura = typeof window !== 'undefined' && typeof window.$A !== 'undefined';
 const defaultConfig = {
@@ -7354,6 +7438,26 @@ function buildJwtParameterizationInterceptor(jwtManager, jwtRequestModifier = (_
 }
 
 const SFAP_BASE_URL = 'api.salesforce.com';
+// The fetch-service tag the Data360 (direct-to-Data Cloud) custom command binds
+// to. Distinct from SFAP's `sfap_api` so the Data360 host-rewrite interceptor only
+// ever runs for that command — zero blast radius on the SFAP fleet.
+//
+// The tag is deliberately named after the *mechanism* (the `cdp_url` host rewrite),
+// not a capability, because this whole descriptor is interim: it exists only while
+// the mint service returns the fixed SFAP `baseUri` regardless of platform. When the
+// service returns the correct per-platform `baseUri`, the data 360 route can be re-evaluated.
+// This mechanism is NOT intended to be re-used outside of this initial context.
+// This is a client-side routing key only.
+const DATA_360_CDP_URL_REWRITE_AUTH_SCOPE = 'data_360_cdp_url_rewrite';
+// The minted-JWT claim carrying the Data Cloud tenant-specific endpoint (TSE).
+// The server's `SFAPJwtClaimHandlerImpl` emits it for CDP-provisioned orgs as a
+// verbatim passthrough of `DataCloudTenant.getApiEndpoint()` — no normalization.
+// The exact FORM therefore varies and must not be assumed: it may be a bare host
+// (`<host>`) or a full URL with scheme (`<scheme>://<host>`), and the host suffix
+// (`<domain-suffix>`) is environment-dependent — it differs per deployment
+// environment. This is why the interceptor strips any scheme before parsing
+// and applies no host-suffix policy — see the interceptor docblock's trust boundary.
+const CDP_URL_CLAIM = 'cdp_url';
 function buildDispatchingSfapJwtResolver(legacyResolver, parameterizedResolver) {
     return {
         getJwt(params) {
@@ -7397,6 +7501,46 @@ function buildJwtAuthorizedSfapFetchServiceDescriptor(logger) {
         tags: { authenticationScopes: 'sfap_api' },
     };
 }
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+function buildJwtAuthorizedData360FetchServiceDescriptor(logger) {
+    const data360FetchService = buildServiceDescriptor$2({
+        createContext: createInstrumentationIdContext(),
+        request: [
+            buildThirdPartyTrackerRegisterInterceptor(),
+            buildData360HostRewriteInterceptor(logger),
+            // Compression runs LAST, after the host-rewrite interceptor has minted,
+            // attached the Bearer token, and rewritten the URL — so it only ever sees
+            // the final request body. It is a strict pass-through: bodies that are
+            // missing, non-string, or under the 1KB threshold flow through untouched,
+            // preserving the tuple (URL + Authorization header) the rewrite produced.
+            buildCompressionInterceptor({ algorithm: 'gzip' }),
+        ],
+        finally: [buildThirdPartyTrackerFinishInterceptor()],
+    });
+    return {
+        ...data360FetchService,
+        tags: { authenticationScopes: DATA_360_CDP_URL_REWRITE_AUTH_SCOPE },
+    };
+}
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than
@@ -7497,6 +7641,75 @@ function buildSfapJwtRequestModifier(logger) {
 function buildJwtRequestInterceptor(logger) {
     return buildJwtRequestHeaderInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger));
 }
+/**
+ * Request interceptor for the direct-to-Data360 command. It cannot use the
+ * standard `JwtRequestModifier` seam because the tenant host is a JWT *claim*
+ * (`cdp_url`), and modifiers only receive `extraInfo`. So — like the copilot
+ * interceptor that reads `decodedInfo.iss` — it holds the token directly:
+ *
+ *   1. Read the command's `jwtMintParams` off the per-request context seed and
+ *      mint (via the parameterized SFAP resolver, routed by the dispatching
+ *      resolver inside `sfapJwtManager`). Without mint params there is no token
+ *      to authorize with, so leave the request untouched.
+ *   2. Decode `cdp_url` from the JWT and resolve the tenant-specific endpoint
+ *      (TSE). `cdp_url` is a bare host, so a scheme is prepended before parsing
+ *      and the protocol is forced to `https:`.
+ *   3. Only after a usable `cdp_url` is confirmed, attach `Authorization: Bearer
+ *      <jwt>` and rewrite the request URL's host/protocol to the TSE.
+ *
+ * **Trust boundary.** `cdp_url` is a claim on a first-party, server-minted JWT
+ * delivered over the same-origin Aura transport, so the interceptor does NOT police
+ * its contents (no host-suffix or format allowlist) — the routing host is the
+ * minting service's responsibility, and this mirrors the SFAP sibling, which
+ * likewise trusts the server-provided `baseUri` rewrite target. The one guard that
+ * remains is shape hygiene: if `cdp_url` is absent/empty/non-string (org not
+ * CDP-provisioned, so the server's claim gate did not fire) the interceptor throws
+ * a developer-facing error instead of an opaque parse failure. A minted token is
+ * never attached until a usable host is in hand.
+ */
+function buildData360HostRewriteInterceptor(logger) {
+    return (fetchArgs, context) => {
+        const mintParams = context?.[JWT_MINT_PARAMS_SEED_KEY];
+        // No mint params → not a parameterized Data360 request. Nothing to do.
+        if (mintParams === undefined) {
+            return resolvedPromiseLike$2(fetchArgs);
+        }
+        return resolvedPromiseLike$2(sfapJwtManager.getJwt(mintParams)).then((token) => {
+            const [resource, request] = fetchArgs;
+            if (typeof resource !== 'string' && !(resource instanceof URL)) {
+                // istanbul ignore else: not exercised under NODE_ENV=production
+                if (process.env.NODE_ENV !== 'production') {
+                    throw new Error('Data360 fetch service expects a string or URL resource');
+                }
+                return fetchArgs;
+            }
+            const cdpUrl = token.decodedInfo?.[CDP_URL_CLAIM];
+            // Require a non-empty string. This is shape hygiene, NOT a content
+            // policy: the routing host is the minting service's responsibility, and
+            // we deliberately do not couple to its contents (no host-suffix/format
+            // check — the SFAP sibling likewise trusts its server-provided rewrite
+            // target). We only confirm we were handed a usable host string; a
+            // missing/empty/non-string claim (org not Data Cloud provisioned, so the
+            // server's claim gate did not fire) fails with a clear error rather than
+            // an opaque `new URL` TypeError. The `typeof` check also narrows `cdpUrl`
+            // to `string` for the `.replace` below.
+            if (typeof cdpUrl !== 'string' || cdpUrl.length === 0) {
+                logger.warn(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim. The org may not be Data Cloud provisioned.`);
+                // eslint-disable-next-line @salesforce/lds/no-error-in-production
+                throw new Error(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim; cannot route the request to a Data Cloud tenant endpoint.`);
+            }
+            // `cdp_url` is a bare host (no scheme); prepend https so `new URL`
+            // parses it as an origin. Force https regardless of any scheme in the
+            // claim — the TSE is always TLS.
+            const tse = new URL(`https://${cdpUrl.replace(/^[a-z]+:\/\//i, '')}`);
+            const authorizedArgs = setHeaderAuthorization(token, [resource, request]);
+            const url = typeof resource === 'string' ? new URL(resource) : new URL(resource.toString());
+            url.host = tse.host;
+            url.protocol = 'https:';
+            return [url, authorizedArgs[1]];
+        });
+    };
+}
 /**
  * Wraps the legacy `buildJwtRequestHeaderInterceptor` with a pass-through guard:
  * when the parameterized interceptor has already authorized the request (an
@@ -10854,6 +11067,13 @@ function initializeLDS() {
     }
     return luvio; // Return the luvio instance so that we can inject it for OneStore
 }
+// W-23092947: fetch request tags allowed to stay on HTTP on Aura sites (external hosts).
+// Everything else (core UIAPI/GraphQL) is withheld so it falls back to Aura transport.
+const AURA_SITE_ALLOWED_FETCH_TAGS = [
+    { authenticationScopes: 'sfap_api' },
+    { authenticationScopes: 'data_360_cdp_url_rewrite' },
+    { specialHacksFor: 'copilot' }, // copilot
+];
 // Initializes OneStore in LEX
 function initializeOneStore(luvio) {
     const loggerService = new ConsoleLogger('ERROR');
@@ -10904,6 +11124,7 @@ function initializeOneStore(luvio) {
         buildLexRuntimeDefaultFetchServiceDescriptor(loggerService, retryService),
         buildUnauthorizedFetchServiceDescriptor(),
         buildJwtAuthorizedSfapFetchServiceDescriptor(loggerService),
+        buildJwtAuthorizedData360FetchServiceDescriptor(loggerService),
         buildCopilotFetchServiceDescriptor(loggerService),
         buildAuraNetworkService(),
         buildServiceDescriptor$j(instrumentationServiceDescriptor.service),
@@ -10940,7 +11161,13 @@ function initializeOneStore(luvio) {
         configServiceDescriptor,
         prefetchSfapJwtServiceDescriptor,
     ];
-    setServices(services);
+    // W-23092947: Aura sites route core-bound commands over Aura (see the resolver).
+    if (isAuraSite()) {
+        setServiceResolver(buildAuraSiteServiceResolver(services, AURA_SITE_ALLOWED_FETCH_TAGS));
+    }
+    else {
+        setServices(services);
+    }
 }
 function buildAuraNetworkService() {
     return {
@@ -10958,4 +11185,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.428.0-dev20-1b319a0432
+// version: 1.428.0-dev22-319313a317

package/dist/types/aura-site-service-resolver.d.ts

@@ -0,0 +1,5 @@
+import { type PublishedService, type ServiceResolver, type ServicesRequest } from '@conduit-client/service-provisioner/v1';
+import { type ServiceDescriptor } from '@conduit-client/utils';
+type Tags = Record<string, string>;
+export declare function buildAuraSiteServiceResolver<R extends ServicesRequest<ServiceDescriptor<unknown>>>(services: PublishedService[], allowedFetchTags: ReadonlyArray<Tags>): ServiceResolver<R>;
+export {};

package/dist/types/aura-utils.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Helpers for reaching the Aura framework from the LDS Aura runtime.
+ *
+ * `window.$A` is only present when the runtime is hosted inside Aura (LEX or an
+ * Aura site); in tests and non-Aura runtimes it is absent.
+ */
+interface Aura {
+    get?: (expression: string) => unknown;
+}
+/**
+ * Returns the Aura framework global (`window.$A`) when running inside Aura, or
+ * `undefined` in tests and non-Aura runtimes. Never throws.
+ */
+export declare function getAura(): Aura | undefined;
+/**
+ * Returns `true` when the Aura runtime is hosted inside an Aura/Experience site
+ * (Experience Builder / `communityApp`) rather than LEX (one.app).
+ * `$A.get('$Site')` is present and truthy on Aura sites, absent/falsy in LEX. A
+ * stable per-page signal. Defensive: never throws. (W-23092947)
+ */
+export declare function isAuraSite(): boolean;
+export {};

package/dist/types/fetch-service-descriptors/jwt-authorized-fetch-service.d.ts

@@ -5,6 +5,27 @@ import { type LoggerService } from '@conduit-client/utils';
 export declare function buildDispatchingSfapJwtResolver(legacyResolver: JwtResolver<ExtraInfo>, parameterizedResolver: JwtResolver<ExtraInfo>): JwtResolver<ExtraInfo>;
 export declare function prefetchSfapJwt(): Promise<undefined>;
 export declare function buildJwtAuthorizedSfapFetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+export declare function buildJwtAuthorizedData360FetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-aura",
-    "version": "1.428.0-dev20",
+    "version": "1.428.0-dev22",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for Aura runtime",
     "main": "dist/ldsEngineCreator.js",
@@ -34,60 +34,60 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.19.0-dev3",
-        "@conduit-client/tools-core": "3.19.0-dev3",
-        "@salesforce/lds-adapters-apex": "^1.428.0-dev20",
-        "@salesforce/lds-adapters-uiapi": "^1.428.0-dev20",
-        "@salesforce/lds-ads-bridge": "^1.428.0-dev20",
-        "@salesforce/lds-aura-storage": "^1.428.0-dev20",
-        "@salesforce/lds-bindings": "^1.428.0-dev20",
-        "@salesforce/lds-instrumentation": "^1.428.0-dev20",
-        "@salesforce/lds-network-aura": "^1.428.0-dev20",
-        "@salesforce/lds-network-fetch": "^1.428.0-dev20",
+        "@conduit-client/service-provisioner": "3.19.0-dev4",
+        "@conduit-client/tools-core": "3.19.0-dev4",
+        "@salesforce/lds-adapters-apex": "^1.428.0-dev22",
+        "@salesforce/lds-adapters-uiapi": "^1.428.0-dev22",
+        "@salesforce/lds-ads-bridge": "^1.428.0-dev22",
+        "@salesforce/lds-aura-storage": "^1.428.0-dev22",
+        "@salesforce/lds-bindings": "^1.428.0-dev22",
+        "@salesforce/lds-instrumentation": "^1.428.0-dev22",
+        "@salesforce/lds-network-aura": "^1.428.0-dev22",
+        "@salesforce/lds-network-fetch": "^1.428.0-dev22",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.19.0-dev3",
-        "@conduit-client/command-aura-network": "3.19.0-dev3",
-        "@conduit-client/command-aura-normalized-cache-control": "3.19.0-dev3",
-        "@conduit-client/command-aura-resource-cache-control": "3.19.0-dev3",
-        "@conduit-client/command-fetch-network": "3.19.0-dev3",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.19.0-dev3",
-        "@conduit-client/command-http-normalized-cache-control": "3.19.0-dev3",
-        "@conduit-client/command-ndjson": "3.19.0-dev3",
-        "@conduit-client/command-network": "3.19.0-dev3",
-        "@conduit-client/command-sse": "3.19.0-dev3",
-        "@conduit-client/command-streaming": "3.19.0-dev3",
-        "@conduit-client/jwt-manager": "3.19.0-dev3",
-        "@conduit-client/service-aura-network": "3.19.0-dev3",
-        "@conduit-client/service-bindings-imperative": "3.19.0-dev3",
-        "@conduit-client/service-bindings-lwc": "3.19.0-dev3",
-        "@conduit-client/service-cache": "3.19.0-dev3",
-        "@conduit-client/service-cache-control": "3.19.0-dev3",
-        "@conduit-client/service-cache-inclusion-policy": "3.19.0-dev3",
-        "@conduit-client/service-config": "3.19.0-dev3",
-        "@conduit-client/service-feature-flags": "3.19.0-dev3",
-        "@conduit-client/service-fetch-network": "3.19.0-dev3",
-        "@conduit-client/service-instrument-command": "3.19.0-dev3",
-        "@conduit-client/service-pubsub": "3.19.0-dev3",
-        "@conduit-client/service-store": "3.19.0-dev3",
-        "@conduit-client/utils": "3.19.0-dev3",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.19.0-dev4",
+        "@conduit-client/command-aura-network": "3.19.0-dev4",
+        "@conduit-client/command-aura-normalized-cache-control": "3.19.0-dev4",
+        "@conduit-client/command-aura-resource-cache-control": "3.19.0-dev4",
+        "@conduit-client/command-fetch-network": "3.19.0-dev4",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.19.0-dev4",
+        "@conduit-client/command-http-normalized-cache-control": "3.19.0-dev4",
+        "@conduit-client/command-ndjson": "3.19.0-dev4",
+        "@conduit-client/command-network": "3.19.0-dev4",
+        "@conduit-client/command-sse": "3.19.0-dev4",
+        "@conduit-client/command-streaming": "3.19.0-dev4",
+        "@conduit-client/jwt-manager": "3.19.0-dev4",
+        "@conduit-client/service-aura-network": "3.19.0-dev4",
+        "@conduit-client/service-bindings-imperative": "3.19.0-dev4",
+        "@conduit-client/service-bindings-lwc": "3.19.0-dev4",
+        "@conduit-client/service-cache": "3.19.0-dev4",
+        "@conduit-client/service-cache-control": "3.19.0-dev4",
+        "@conduit-client/service-cache-inclusion-policy": "3.19.0-dev4",
+        "@conduit-client/service-config": "3.19.0-dev4",
+        "@conduit-client/service-feature-flags": "3.19.0-dev4",
+        "@conduit-client/service-fetch-network": "3.19.0-dev4",
+        "@conduit-client/service-instrument-command": "3.19.0-dev4",
+        "@conduit-client/service-pubsub": "3.19.0-dev4",
+        "@conduit-client/service-store": "3.19.0-dev4",
+        "@conduit-client/utils": "3.19.0-dev4",
         "@luvio/network-adapter-composable": "0.160.4-dev1",
         "@luvio/network-adapter-fetch": "0.160.4-dev1",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.428.0-dev20",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.428.0-dev22",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.428.0-dev20",
-        "@salesforce/lds-luvio-service": "^1.428.0-dev20",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.428.0-dev20"
+        "@salesforce/lds-durable-storage": "^1.428.0-dev22",
+        "@salesforce/lds-luvio-service": "^1.428.0-dev22",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.428.0-dev22"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/ldsEngineCreator.js",
             "maxSize": {
-                "none": "410 kB",
+                "none": "413 kB",
                 "min": "190 kB",
-                "compressed": "71 kB"
+                "compressed": "73 kB"
             }
         }
     ],