CSP, login/register redirects, pdfjs-dist externals, and canvas alias stay the same. package.json is unchanged.