@salesforce/lds-runtime-aura 1.447.0 → 1.448.0

package/dist/ldsEngineCreator.js

@@ -40,6 +40,7 @@ import lightningConnectEnabled from '@salesforce/gate/ui.services.LightningConne
 import bypassAppRestrictionEnabled from '@salesforce/gate/ui.services.LightningConnect.BypassAppRestriction.enabled';
 import csrfValidationEnabled from '@salesforce/gate/ui.services.LightningConnect.CsrfValidation.enabled';
 import sessionApiEnabled from '@salesforce/gate/ui.uisdk.session.api.enabled';
+import auraBasedRequestsEnabled from '@salesforce/gate/ui.services.auraBasedRequests.enabled';
 import useHttpUiapiOneAppPublic from '@salesforce/gate/lds.useHttpUiapiOneAppPublic';
 import useHttpUiapiOneAppPrivate from '@salesforce/gate/lds.useHttpUiapiOneAppPrivate';
 import useHttpUiapiOneRuntimePublic from '@salesforce/gate/lds.useHttpUiapiOneRuntimePublic';
@@ -474,7 +475,14 @@ class AuraNetworkCommand extends NetworkCommand$1 {
   fetch() {
     if (this.shouldUseAuraNetwork()) {
       return this.convertAuraResponseToData(
-        this.services.auraNetwork(this.endpoint, this.auraParams, this.actionConfig),
+        // The Aura transport is untyped at the network boundary (getReturnValue: () =>
+        // Record<string, unknown>); assert it to this command's concrete Data here so the
+        // untyped boundary is isolated to this single site rather than leaking `any`.
+        this.services.auraNetwork(
+          this.endpoint,
+          this.auraParams,
+          this.actionConfig
+        ),
         this.coerceAuraErrors
       );
     } else if (this.shouldUseFetch()) {
@@ -1070,8 +1078,13 @@ class AuraCacheControlCommand extends CacheControlCommand {
   }
   requestFromNetwork() {
     if (this.shouldUseAuraNetwork()) {
+      const responsePromise = this.services.auraNetwork(
+        this.endpoint,
+        this.auraParams,
+        this.actionConfig
+      );
       return this.convertAuraResponseToData(
-        this.services.auraNetwork(this.endpoint, this.auraParams, this.actionConfig),
+        responsePromise,
         (errs) => this.coerceAuraErrors(errs)
       );
     } else if (this.shouldUseFetch()) {
@@ -1724,6 +1737,14 @@ class O11ySpan {
     this.attributes = { ...this.attributes, ...attributes };
     return this;
   }
+  addLink(_link) {
+    this.logger.warn("O11ySpan does not support addLink.");
+    return this;
+  }
+  addLinks(_links) {
+    this.logger.warn("O11ySpan does not support addLinks.");
+    return this;
+  }
   addEvent(_name, _attributesOrStartTime, _startTime) {
     this.logger.warn("O11ySpan does not support addEvents.");
     return this;
@@ -1783,6 +1804,9 @@ class O11yMeter {
     }
     return new O11yCounter(name, this.o11yInstrumentation, this.logger);
   }
+  createGauge(_name, _options) {
+    return new O11yGauge(this.logger);
+  }
   createUpDownCounter(_name, _options) {
     return new O11yUpDownCounter(this.logger);
   }
@@ -1840,6 +1864,14 @@ class O11yHistogram {
     );
   }
 }
+class O11yGauge {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  record(_value, _attributes, _context) {
+    this.logger.warn("O11yGauge not supported yet.");
+  }
+}
 class O11yUpDownCounter {
   constructor(logger) {
     this.logger = logger;
@@ -2535,7 +2567,7 @@ function buildServiceDescriptor$d(luvio) {
         },
     };
 }
-// version: 1.447.0-9045666657
+// version: 1.448.0-ea92d38c8e
 
 class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheControlCommand {
   constructor(config, documentRootType, services) {
@@ -2682,6 +2714,7 @@ class AuraGraphQLNormalizedCacheControlCommand extends AuraNormalizedCacheContro
     }
     return addTypenameToDocument(augmentedQueryResult.value);
   }
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any -- load-bearing: GraphQLResponse.data is `Record<string,any> | null | undefined`, but WriteInput<Data>.data requires `Data`. Narrowing the Data arg to GraphQLData yields TS2322 at the return (`data.data` includes null|undefined; tests write `data: undefined` for error responses — see error-handling spec). The `any` faithfully models that the cache write accepts the nullable response payload. Same #870 GraphQLData/GraphQLResponse contravariance family.
   buildWriteInput(data) {
     const extensionResult = buildGraphQLInputExtension({
       ...this.config,
@@ -2873,7 +2906,7 @@ function buildServiceDescriptor$9(notifyRecordUpdateAvailable, getNormalizedLuvi
         },
     };
 }
-// version: 1.447.0-9045666657
+// version: 1.448.0-ea92d38c8e
 
 class RetryService {
   constructor(defaultRetryPolicy) {
@@ -5765,7 +5798,7 @@ function getEnvironmentSetting(name) {
     }
     return undefined;
 }
-// version: 1.447.0-b75721e8dd
+// version: 1.448.0-8bacde725a
 
 /**
  * Helpers for reaching the Aura framework from the LDS Aura runtime.
@@ -6374,16 +6407,21 @@ async function getCsrfToken() {
     }
 }
 /**
- * Checks if all required gates are enabled for CSRF token interceptor.
+ * Checks if all server-side UiSdk gates required for the HTTP UIAPI path are
+ * open. These mirror the gates core evaluates when accepting a SID-based
+ * (first-party) Connect request; the CSRF token is only attached when all are
+ * open. All are required OPEN — `auraBasedRequests` expands the set of
+ * Connect resources reachable over HTTP, it is not an aura-vs-http toggle.
  *
  * @returns true if all gates are enabled, false otherwise
  */
-function areCsrfGatesEnabled() {
+function areHttpGatesEnabled() {
     try {
         return (lightningConnectEnabled.isOpen({ fallback: false }) &&
             bypassAppRestrictionEnabled.isOpen({ fallback: false }) &&
             csrfValidationEnabled.isOpen({ fallback: false }) &&
-            sessionApiEnabled.isOpen({ fallback: false }));
+            sessionApiEnabled.isOpen({ fallback: false }) &&
+            auraBasedRequestsEnabled.isOpen({ fallback: false }));
     }
     catch (error) {
         // If any gate check fails, disable CSRF interceptor
@@ -6417,7 +6455,7 @@ function isCsrfMethod(method) {
 function buildCsrfTokenInterceptor() {
     return async (fetchArgs) => {
         // Check if all required gates are enabled before running
-        if (!areCsrfGatesEnabled()) {
+        if (!areHttpGatesEnabled()) {
             return resolvedPromiseLike$2(fetchArgs);
         }
         const [urlOrRequest, options] = fetchArgs;
@@ -6450,7 +6488,7 @@ function buildCsrfTokenInterceptor() {
 function buildLuvioCsrfTokenInterceptor() {
     return async (resourceRequest) => {
         // Check if all required gates are enabled before running
-        if (!areCsrfGatesEnabled()) {
+        if (!areHttpGatesEnabled()) {
             return resolvedPromiseLike$2(resourceRequest);
         }
         // Ensure headers object exists
@@ -7561,6 +7599,27 @@ function buildJwtParameterizationInterceptor(jwtManager, jwtRequestModifier = (_
 }
 
 const SFAP_BASE_URL = 'api.salesforce.com';
+// The fetch-service tag the Data360 (direct-to-Data Cloud) custom command binds
+// to. Distinct from SFAP's `sfap_api` so the Data360 host-rewrite interceptor only
+// ever runs for that command — zero blast radius on the SFAP fleet.
+//
+// The tag is deliberately named after the *mechanism* (the `cdp_url` host rewrite),
+// not a capability, because this whole descriptor is interim: it exists only while
+// the mint service returns the fixed SFAP `baseUri` regardless of platform. When the
+// service returns the correct per-platform `baseUri`, the data 360 route can be re-evaluated.
+// This mechanism is NOT intended to be re-used outside of this initial context.
+// This is a client-side routing key only.
+const DATA_360_CDP_URL_REWRITE_AUTH_SCOPE = 'data_360_cdp_url_rewrite';
+// The minted-JWT claim carrying the Data Cloud tenant-specific endpoint (TSE).
+// The server's `SFAPJwtClaimHandlerImpl` emits it for CDP-provisioned orgs as a
+// verbatim passthrough of `DataCloudTenant.getApiEndpoint()` — no normalization.
+// The exact FORM therefore varies and must not be assumed: it may be a bare host
+// (`<hash>.c360a.salesforce.com`) or a full URL with scheme
+// (`https://a360.cdp.<region>.aws.sfdc.cl`), and the suffix is cloud-dependent
+// (commercial `.salesforce.com`, substrate `.aws.sfdc.cl`, GovCloud
+// `.salesforce.mil`). This is why the interceptor strips any scheme before parsing
+// and applies no host-suffix policy — see the interceptor docblock's trust boundary.
+const CDP_URL_CLAIM = 'cdp_url';
 function buildDispatchingSfapJwtResolver(legacyResolver, parameterizedResolver) {
     return {
         getJwt(params) {
@@ -7604,6 +7663,40 @@ function buildJwtAuthorizedSfapFetchServiceDescriptor(logger) {
         tags: { authenticationScopes: 'sfap_api' },
     };
 }
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+function buildJwtAuthorizedData360FetchServiceDescriptor(logger) {
+    const data360FetchService = buildServiceDescriptor$2({
+        createContext: createInstrumentationIdContext(),
+        request: [
+            buildThirdPartyTrackerRegisterInterceptor(),
+            buildData360HostRewriteInterceptor(logger),
+        ],
+        finally: [buildThirdPartyTrackerFinishInterceptor()],
+    });
+    return {
+        ...data360FetchService,
+        tags: { authenticationScopes: DATA_360_CDP_URL_REWRITE_AUTH_SCOPE },
+    };
+}
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than
@@ -7704,6 +7797,74 @@ function buildSfapJwtRequestModifier(logger) {
 function buildJwtRequestInterceptor(logger) {
     return buildJwtRequestHeaderInterceptor(sfapJwtManager, buildSfapJwtRequestModifier(logger));
 }
+/**
+ * Request interceptor for the direct-to-Data360 command. It cannot use the
+ * standard `JwtRequestModifier` seam because the tenant host is a JWT *claim*
+ * (`cdp_url`), and modifiers only receive `extraInfo`. So — like the copilot
+ * interceptor that reads `decodedInfo.iss` — it holds the token directly:
+ *
+ *   1. Read the command's `jwtMintParams` off the per-request context seed and
+ *      mint (via the parameterized SFAP resolver, routed by the dispatching
+ *      resolver inside `sfapJwtManager`). Without mint params there is no token
+ *      to authorize with, so leave the request untouched.
+ *   2. Decode `cdp_url` from the JWT and resolve the tenant-specific endpoint
+ *      (TSE). `cdp_url` is a bare host, so a scheme is prepended before parsing
+ *      and the protocol is forced to `https:`.
+ *   3. Only after a usable `cdp_url` is confirmed, attach `Authorization: Bearer
+ *      <jwt>` and rewrite the request URL's host/protocol to the TSE.
+ *
+ * **Trust boundary.** `cdp_url` is a claim on a first-party, server-minted JWT
+ * delivered over the same-origin Aura transport, so the interceptor does NOT police
+ * its contents (no host-suffix or format allowlist) — the routing host is the
+ * minting service's responsibility, and this mirrors the SFAP sibling, which
+ * likewise trusts the server-provided `baseUri` rewrite target. The one guard that
+ * remains is shape hygiene: if `cdp_url` is absent/empty/non-string (org not
+ * CDP-provisioned, so the server's claim gate did not fire) the interceptor throws
+ * a developer-facing error instead of an opaque parse failure. A minted token is
+ * never attached until a usable host is in hand.
+ */
+function buildData360HostRewriteInterceptor(logger) {
+    return (fetchArgs, context) => {
+        const mintParams = context?.[JWT_MINT_PARAMS_SEED_KEY];
+        // No mint params → not a parameterized Data360 request. Nothing to do.
+        if (mintParams === undefined) {
+            return resolvedPromiseLike$2(fetchArgs);
+        }
+        return resolvedPromiseLike$2(sfapJwtManager.getJwt(mintParams)).then((token) => {
+            const [resource, request] = fetchArgs;
+            if (typeof resource !== 'string' && !(resource instanceof URL)) {
+                // istanbul ignore else: not exercised under NODE_ENV=production
+                if (process.env.NODE_ENV !== 'production') {
+                    throw new Error('Data360 fetch service expects a string or URL resource');
+                }
+                return fetchArgs;
+            }
+            const cdpUrl = token.decodedInfo?.[CDP_URL_CLAIM];
+            // Require a non-empty string. This is shape hygiene, NOT a content
+            // policy: the routing host is the minting service's responsibility, and
+            // we deliberately do not couple to its contents (no host-suffix/format
+            // check — the SFAP sibling likewise trusts its server-provided rewrite
+            // target). We only confirm we were handed a usable host string; a
+            // missing/empty/non-string claim (org not Data Cloud provisioned, so the
+            // server's claim gate did not fire) fails with a clear error rather than
+            // an opaque `new URL` TypeError. The `typeof` check also narrows `cdpUrl`
+            // to `string` for the `.replace` below.
+            if (typeof cdpUrl !== 'string' || cdpUrl.length === 0) {
+                logger.warn(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim. The org may not be Data Cloud provisioned.`);
+                throw new Error(`Data360 fetch service: minted JWT has no usable "${CDP_URL_CLAIM}" claim; cannot route the request to a Data Cloud tenant endpoint.`);
+            }
+            // `cdp_url` is a bare host (no scheme); prepend https so `new URL`
+            // parses it as an origin. Force https regardless of any scheme in the
+            // claim — the TSE is always TLS.
+            const tse = new URL(`https://${cdpUrl.replace(/^[a-z]+:\/\//i, '')}`);
+            const authorizedArgs = setHeaderAuthorization(token, [resource, request]);
+            const url = typeof resource === 'string' ? new URL(resource) : new URL(resource.toString());
+            url.host = tse.host;
+            url.protocol = 'https:';
+            return [url, authorizedArgs[1]];
+        });
+    };
+}
 /**
  * Wraps the legacy `buildJwtRequestHeaderInterceptor` with a pass-through guard:
  * when the parameterized interceptor has already authorized the request (an
@@ -11234,16 +11395,18 @@ function initializeOneStore(luvio) {
     };
     // set flags based on gates
     featureFlagsService.set('useOneStoreGraphQL', useOneStoreGraphql.isOpen({ fallback: false }));
-    // On Aura/Experience sites the HTTP transport's CSRF handling is broken
-    // (W-23092947), so signal the OneStore GraphQL command to use the Aura
-    // transport there. HTTP remains the default in LEX. Paired with the HTTP
-    // UIAPI fetch path being disabled on sites (see network-fetch.ts).
-    featureFlagsService.set('graphQLUseAura', isAuraSite());
+    // Use the Aura transport for the OneStore GraphQL command by default. The
+    // HTTP transport's CSRF handling is broken on Aura/Experience sites
+    // (W-23092947), and defaulting to Aura keeps a single, known-good transport
+    // across LEX and sites. Paired with the HTTP UIAPI fetch path being
+    // disabled on sites (see network-fetch.ts).
+    featureFlagsService.set('graphQLUseAura', true);
     const services = [
         instrumentationServiceDescriptor,
         buildLexRuntimeDefaultFetchServiceDescriptor(loggerService, retryService),
         buildUnauthorizedFetchServiceDescriptor(),
         buildJwtAuthorizedSfapFetchServiceDescriptor(loggerService),
+        buildJwtAuthorizedData360FetchServiceDescriptor(loggerService),
         buildCopilotFetchServiceDescriptor(loggerService),
         buildAuraNetworkService(),
         buildServiceDescriptor$j(instrumentationServiceDescriptor.service),
@@ -11298,4 +11461,4 @@ function ldsEngineCreator() {
 }
 
 export { LexRequestStrategy, PdlPrefetcherEventType, PdlRequestPriority, buildPredictorForContext, configService, ldsEngineCreator as default, initializeLDS, initializeOneStore, notifyUpdateAvailableFactory, registerRequestStrategy, saveRequestAsPrediction, subscribeToPrefetcherEvents, unregisterRequestStrategy, whenPredictionsReady };
-// version: 1.447.0-9045666657
+// version: 1.448.0-ea92d38c8e

package/dist/types/fetch-service-descriptors/jwt-authorized-fetch-service.d.ts

@@ -5,6 +5,27 @@ import { type LoggerService } from '@conduit-client/utils';
 export declare function buildDispatchingSfapJwtResolver(legacyResolver: JwtResolver<ExtraInfo>, parameterizedResolver: JwtResolver<ExtraInfo>): JwtResolver<ExtraInfo>;
 export declare function prefetchSfapJwt(): Promise<undefined>;
 export declare function buildJwtAuthorizedSfapFetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
+/**
+ * Returns a service descriptor for the **direct-to-Data360** custom command
+ * (CDP Query v3, host `*.c360a.salesforce.com`).
+ *
+ * Unlike SFAP, the per-tenant base host is NOT returned in the mint response's
+ * `baseUri` (which is the fixed SFAP host); it rides on the minted JWT as the
+ * `cdp_url` claim. The standard `JwtRequestModifier` only receives `extraInfo`,
+ * never the decoded claims, so the host rewrite cannot be expressed as a modifier
+ * — it must read the token directly. This descriptor therefore uses a bespoke
+ * interceptor ({@link buildData360HostRewriteInterceptor}) that mints the
+ * parameterized SFAP JWT, attaches the Bearer token, decodes `cdp_url`, and
+ * rewrites the request host to that TSE.
+ *
+ * It reuses the module's `sfapJwtManager`: `cdp_url` is emitted on the same
+ * `SFAP_API`-scope JWT, so the Data360 command mints the same kind of token — it
+ * just forwards the data-cloud scopes via the context-seed `jwtMintParams`.
+ *
+ * Gated behind its own `data_360_cdp_url_rewrite` auth-scope tag so it binds ONLY to
+ * the Data360 command — the SFAP fleet never flows past this interceptor.
+ */
+export declare function buildJwtAuthorizedData360FetchServiceDescriptor(logger: LoggerService): FetchServiceDescriptor;
 /**
  * Returns a service descriptor for a fetch service that includes one-off copilot
  * hacks. This fetch service is not intended for use by anything other than

package/dist/types/request-interceptors/jwt-parameterization.d.ts

@@ -47,4 +47,4 @@ export declare function hasAuthorizationHeader([resource, options]: FetchParamet
  * @param jwtManager - the dispatching SFAP JwtManager
  * @param jwtRequestModifier - applies the minted `extraInfo.baseUri` to the request URL
  */
-export declare function buildJwtParameterizationInterceptor(jwtManager: JwtManager<unknown, ExtraInfo>, jwtRequestModifier?: JwtRequestModifier): RequestInterceptor;
+export declare function buildJwtParameterizationInterceptor(jwtManager: JwtManager<unknown, ExtraInfo>, jwtRequestModifier?: JwtRequestModifier<ExtraInfo>): RequestInterceptor;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@salesforce/lds-runtime-aura",
-    "version": "1.447.0",
+    "version": "1.448.0",
     "license": "SEE LICENSE IN LICENSE.txt",
     "description": "LDS engine for Aura runtime.",
     "main": "dist/ldsEngineCreator.js",
@@ -34,61 +34,61 @@
         "release:corejar": "yarn build && ../core-build/scripts/core.js --name=lds-runtime-aura"
     },
     "devDependencies": {
-        "@conduit-client/service-provisioner": "3.24.0",
-        "@conduit-client/tools-core": "3.24.0",
-        "@salesforce/lds-adapters-apex": "^1.447.0",
-        "@salesforce/lds-adapters-uiapi": "^1.447.0",
-        "@salesforce/lds-ads-bridge": "^1.447.0",
-        "@salesforce/lds-aura-storage": "^1.447.0",
-        "@salesforce/lds-bindings": "^1.447.0",
-        "@salesforce/lds-instrumentation": "^1.447.0",
-        "@salesforce/lds-network-adapter": "^1.447.0",
-        "@salesforce/lds-network-aura": "^1.447.0",
-        "@salesforce/lds-network-fetch": "^1.447.0",
+        "@conduit-client/service-provisioner": "3.25.0",
+        "@conduit-client/tools-core": "3.25.0",
+        "@salesforce/lds-adapters-apex": "^1.448.0",
+        "@salesforce/lds-adapters-uiapi": "^1.448.0",
+        "@salesforce/lds-ads-bridge": "^1.448.0",
+        "@salesforce/lds-aura-storage": "^1.448.0",
+        "@salesforce/lds-bindings": "^1.448.0",
+        "@salesforce/lds-instrumentation": "^1.448.0",
+        "@salesforce/lds-network-adapter": "^1.448.0",
+        "@salesforce/lds-network-aura": "^1.448.0",
+        "@salesforce/lds-network-fetch": "^1.448.0",
         "jwt-encode": "1.0.1"
     },
     "dependencies": {
-        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.24.0",
-        "@conduit-client/command-aura-network": "3.24.0",
-        "@conduit-client/command-aura-normalized-cache-control": "3.24.0",
-        "@conduit-client/command-fetch-network": "3.24.0",
-        "@conduit-client/command-http-graphql-normalized-cache-control": "3.24.0",
-        "@conduit-client/command-http-normalized-cache-control": "3.24.0",
-        "@conduit-client/command-ndjson": "3.24.0",
-        "@conduit-client/command-network": "3.24.0",
-        "@conduit-client/command-sse": "3.24.0",
-        "@conduit-client/command-streaming": "3.24.0",
-        "@conduit-client/jwt-manager": "3.24.0",
-        "@conduit-client/service-aura-network": "3.24.0",
-        "@conduit-client/service-bindings-imperative": "3.24.0",
-        "@conduit-client/service-bindings-lwc": "3.24.0",
-        "@conduit-client/service-cache": "3.24.0",
-        "@conduit-client/service-cache-control": "3.24.0",
-        "@conduit-client/service-cache-inclusion-policy": "3.24.0",
-        "@conduit-client/service-config": "3.24.0",
-        "@conduit-client/service-feature-flags": "3.24.0",
-        "@conduit-client/service-fetch-network": "3.24.0",
-        "@conduit-client/service-instrument-command": "3.24.0",
-        "@conduit-client/service-pubsub": "3.24.0",
-        "@conduit-client/service-renewable-resource-manager": "3.24.0",
-        "@conduit-client/service-store": "3.24.0",
-        "@conduit-client/utils": "3.24.0",
+        "@conduit-client/command-aura-graphql-normalized-cache-control": "3.25.0",
+        "@conduit-client/command-aura-network": "3.25.0",
+        "@conduit-client/command-aura-normalized-cache-control": "3.25.0",
+        "@conduit-client/command-fetch-network": "3.25.0",
+        "@conduit-client/command-http-graphql-normalized-cache-control": "3.25.0",
+        "@conduit-client/command-http-normalized-cache-control": "3.25.0",
+        "@conduit-client/command-ndjson": "3.25.0",
+        "@conduit-client/command-network": "3.25.0",
+        "@conduit-client/command-sse": "3.25.0",
+        "@conduit-client/command-streaming": "3.25.0",
+        "@conduit-client/jwt-manager": "3.25.0",
+        "@conduit-client/service-aura-network": "3.25.0",
+        "@conduit-client/service-bindings-imperative": "3.25.0",
+        "@conduit-client/service-bindings-lwc": "3.25.0",
+        "@conduit-client/service-cache": "3.25.0",
+        "@conduit-client/service-cache-control": "3.25.0",
+        "@conduit-client/service-cache-inclusion-policy": "3.25.0",
+        "@conduit-client/service-config": "3.25.0",
+        "@conduit-client/service-feature-flags": "3.25.0",
+        "@conduit-client/service-fetch-network": "3.25.0",
+        "@conduit-client/service-instrument-command": "3.25.0",
+        "@conduit-client/service-pubsub": "3.25.0",
+        "@conduit-client/service-renewable-resource-manager": "3.25.0",
+        "@conduit-client/service-store": "3.25.0",
+        "@conduit-client/utils": "3.25.0",
         "@luvio/network-adapter-composable": "0.161.0",
         "@luvio/network-adapter-fetch": "0.161.0",
         "@lwc/state": "^0.29.0",
-        "@salesforce/lds-adapters-onestore-graphql": "^1.447.0",
+        "@salesforce/lds-adapters-onestore-graphql": "^1.448.0",
         "@salesforce/lds-adapters-uiapi-lex": "^1.415.0",
-        "@salesforce/lds-durable-storage": "^1.447.0",
-        "@salesforce/lds-luvio-service": "^1.447.0",
-        "@salesforce/lds-luvio-uiapi-records-service": "^1.447.0"
+        "@salesforce/lds-durable-storage": "^1.448.0",
+        "@salesforce/lds-luvio-service": "^1.448.0",
+        "@salesforce/lds-luvio-uiapi-records-service": "^1.448.0"
     },
     "luvioBundlesize": [
         {
             "path": "./dist/ldsEngineCreator.js",
             "maxSize": {
-                "none": "410 kB",
+                "none": "412 kB",
                 "min": "190 kB",
-                "compressed": "71 kB"
+                "compressed": "72 kB"
             }
         }
     ],