@cfast/core 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Daniel Schmidt
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,510 @@
+# @cfast/core
+
+**The app object that wires @cfast/\* packages together.**
+
+`@cfast/core` is the optional composition layer for the cfast framework. It provides `createApp()` — a single definition that connects env, auth, db, storage, and any other plugins into a typed per-request context on the server and a unified provider tree on the client.
+
+Individual packages remain fully usable on their own. Core is for when you want them to work together without wiring boilerplate in every route.
+
+## Why This Exists
+
+Without core, every route loader in a cfast app repeats the same initialization:
+
+```typescript
+export async function loader({ request, context }: Route.LoaderArgs) {
+  const env = context.cloudflare.env;
+  const ctx = await requireAuthContext(request);
+  const db = createCfDb(env.DB, ctx);
+  // NOW you can do your thing
+}
+```
+
+Three lines of setup, duplicated across every route. On the client side, there's no unified provider tree — each package that needs a React context requires separate setup.
+
+`@cfast/core` eliminates this by running a plugin chain once per request (server) and composing providers automatically (client).
+
+## Design Decisions and Their Rationale
+
+### Why a plugin system instead of a config object?
+
+We considered three approaches:
+
+1. **Declarative config** — `createApp({ auth: authConfig, db: dbConfig })` where core knows about all packages. Simple DX, but core must depend on every package and changes require new core releases.
+2. **Plugin registration** — `createApp().use(authPlugin()).use(dbPlugin())` where packages own their integration logic. Core stays thin and decoupled.
+3. **Callback composition** — `createApp({ getContext: async (req) => { ... } })` where the user writes the wiring function. Maximum flexibility, but doesn't eliminate boilerplate — just moves it.
+
+We chose **plugins** because cfast's identity is "composable libraries." Core shouldn't be a monolithic hub that knows about every package. Each package can ship its own plugin, and third-party packages can integrate without waiting for core releases.
+
+### Why namespaced context instead of flat merging?
+
+Each plugin's `setup()` return is nested under its `name` key:
+
+```typescript
+// ctx.auth.user — not ctx.user
+// ctx.db.client — not ctx.db
+```
+
+This prevents plugins from silently overriding each other's values. Two plugins that both return `{ client }` would collide in a flat merge — with namespacing, they're `ctx.foo.client` and `ctx.bar.client`. Core throws at startup if two plugins share a `name`.
+
+### Why are plugins ordered and not dependency-sorted?
+
+Plugins run in registration order, not topologically sorted by their `requires` declarations. This is simpler to reason about — you read the `.use()` chain top to bottom and know exactly what runs when. Core validates at startup that each plugin's requirements are met by prior plugins, and throws with a clear error if not.
+
+The alternative (automatic sorting) would make the execution order implicit and harder to debug when something goes wrong.
+
+### Why `requires` as a generic parameter?
+
+Plugin dependencies are declared via a TypeScript generic on `definePlugin<TRequires>()`. Earlier designs used an `as` cast on a `requires` property (`requires: {} as { auth: {...} }`), but a generic parameter is cleaner — no phantom runtime values, and the intent is unambiguous.
+
+Because TypeScript cannot partially infer generic parameters in a single call, dependent plugins use a **curried form** — you specify `TRequires` explicitly and let the compiler infer the rest:
+
+```typescript
+import type { AuthPluginProvides } from '@cfast/auth';
+definePlugin<AuthPluginProvides>()({ name: 'db', setup(ctx) { ... } })
+//                              ^^ curried call
+```
+
+This creates a compile-time contract: if `authPlugin` renames a field, dependent plugins break at the type level.
+
+---
+
+## Setup
+
+```typescript
+// app/cfast.ts
+import { createApp } from '@cfast/core';
+import { authPlugin } from '@cfast/auth';
+import { dbPlugin } from '@cfast/db';
+import { storagePlugin } from '@cfast/storage';
+import { envSchema } from './env';
+import { permissions } from './permissions';
+
+export const app = createApp({ env: envSchema, permissions })
+  .use(authPlugin({
+    magicLink: { sendMagicLink: async ({ email, url }) => { /* ... */ } },
+    session: { expiresIn: '30d' },
+    defaultRoles: ['reader'],
+  }))
+  .use(dbPlugin({ schema }))
+  .use(storagePlugin(storageSchema));
+```
+
+`createApp` takes the two leaf packages (`env` and `permissions`) as direct config because every cfast app needs them and they have no dependencies. Everything else is a plugin.
+
+## Server API
+
+### `app.init(rawEnv)`
+
+Call once in the Workers entry point. Validates env bindings (delegates to `@cfast/env`).
+
+```typescript
+// workers/app.ts
+import { app } from '~/cfast';
+import { requestHandler } from 'react-router';
+
+export default {
+  async fetch(request: Request, rawEnv: Record<string, unknown>, ctx: ExecutionContext) {
+    app.init(rawEnv);
+    return requestHandler(request, {
+      cloudflare: { env: app.env(), ctx },
+    });
+  },
+};
+```
+
+### `app.env()`
+
+Returns the typed, validated environment. Same as calling `env.get()` directly, but accessible from the app object.
+
+### `app.permissions`
+
+The permissions config passed to `createApp()`, exposed for direct access (e.g., checking grants outside a request context).
+
+### `app.context(request, context)`
+
+Builds the per-request context by running each plugin's `setup()` in registration order.
+
+```typescript
+// app/routes/posts.tsx
+import { app } from '~/cfast';
+
+export async function loader({ request, context }: Route.LoaderArgs) {
+  const ctx = await app.context(request, context);
+  return ctx.db.client.query(posts).findMany().run({});
+}
+```
+
+The return type is the intersection of all plugin namespaces:
+
+```typescript
+// With authPlugin + dbPlugin + storagePlugin:
+type AppContext = {
+  env: ParsedEnv<typeof envSchema>;
+  auth: { user: AuthUser | null; grants: Grant[]; instance: AuthInstance };
+  db: { client: Db };
+  storage: { handle: HandleFn; getSignedUrl: SignedUrlFn; /* ... */ };
+};
+```
+
+**Each plugin's `setup()` receives everything prior plugins have provided**, plus `request` and `env`:
+
+1. `authPlugin.setup({ request, env })` → returns `{ user, grants, instance }`
+2. `dbPlugin.setup({ request, env, auth: { user, grants, instance } })` → returns `{ client }`
+3. `storagePlugin.setup({ request, env, auth: {...}, db: {...} })` → returns `{ handle, ... }`
+
+If a plugin's `setup()` throws, the error is wrapped with the plugin name:
+
+```
+CfastPluginError: Plugin "db" setup failed: D1 binding not found
+  Caused by: Error: D1 binding not found
+```
+
+### `app.loader(loaderFn)` and `app.action(actionFn)`
+
+Optional convenience wrappers that call `app.context()` and pass the result as the first argument:
+
+```typescript
+export const loader = app.loader(async (ctx, { params }) => {
+  return ctx.db.client.query(posts).findMany().run({});
+});
+```
+
+These are thin sugar — `app.context()` is always available for cases where you need more control (e.g., routes that don't need the full context, or actions already handled by `@cfast/actions`).
+
+### Integration with `@cfast/actions`
+
+`@cfast/actions` has its own context mechanism via `createActions({ getContext })`. With core, the wiring becomes a one-liner:
+
+```typescript
+// app/actions.server.ts
+import { createActions } from '@cfast/actions';
+import { app } from '~/cfast';
+
+export const { createAction, composeActions } = createActions({
+  getContext: async ({ request, context }) => {
+    const ctx = await app.context(request, context);
+    return { db: ctx.db.client, user: ctx.auth.user, grants: ctx.auth.grants };
+  },
+});
+```
+
+Core doesn't wrap or replace `@cfast/actions` — actions own their execution semantics.
+
+---
+
+## Client API
+
+### `<app.Provider>`
+
+Composes all plugin providers into a single tree. Plugins without a `Provider` are skipped.
+
+```typescript
+// app/root.tsx
+import { app } from '~/cfast';
+
+export function Layout({ children }: { children: React.ReactNode }) {
+  return (
+    <html>
+      <body>
+        <app.Provider>
+          {children}
+        </app.Provider>
+      </body>
+    </html>
+  );
+}
+```
+
+The rendered tree nests providers in registration order:
+
+```tsx
+<CoreContext.Provider value={clientValues}>
+  <AuthProvider>          {/* from authPlugin */}
+    <StorageProvider>     {/* from storagePlugin */}
+      {children}
+    </StorageProvider>
+  </AuthProvider>
+</CoreContext.Provider>
+```
+
+### `useApp()`
+
+Typed access to all plugins' client-side exports:
+
+```typescript
+import { useApp } from '@cfast/core/client';
+
+function MyComponent() {
+  const { auth, storage } = useApp();
+  const user = auth.useCurrentUser();
+  const upload = storage.useUpload('avatar');
+}
+```
+
+The type reflects only plugins that declared a `client` export. Plugins without client exports don't appear.
+
+Individual package hooks (`useCurrentUser()`, `useUpload()`) continue to work directly — `useApp()` is additive, not a replacement.
+
+---
+
+## Plugin API
+
+### `definePlugin(config)` / `definePlugin<TRequires>()(config)`
+
+Creates a plugin. This is the API package authors use.
+
+The direct form (no dependencies) infers all type parameters:
+
+```typescript
+import { definePlugin } from '@cfast/core';
+
+export const myPlugin = (config: MyConfig) =>
+  definePlugin({
+    name: 'my-plugin',
+    setup(ctx) {
+      // ctx is { request, env } when no dependencies
+      return { /* values exposed as ctx['my-plugin'] */ };
+    },
+  });
+```
+
+The curried form (with dependencies) lets you specify `TRequires` while inferring the rest:
+
+```typescript
+definePlugin<AuthPluginProvides>()({
+  name: 'db',
+  setup(ctx) {
+    ctx.auth.user // typed from TRequires
+    return { client };
+  },
+});
+```
+
+### Plugin config
+
+| Field | Type | Required | Description |
+|---|---|---|---|
+| `name` | `string` | Yes | Unique identifier. Used as the namespace key in context. |
+| `setup` | `(ctx) => TProvides \| Promise<TProvides>` | Yes | Called per-request. Receives `{ request, env }` plus all prior plugin namespaces. Returns the values this plugin provides. |
+| `Provider` | `React.ComponentType<{ children: ReactNode }>` | No | Client-side React provider. Composed into `app.Provider`. |
+| `client` | `Record<string, unknown>` | No | Client-side values exposed via `useApp()`. |
+
+### Declaring dependencies
+
+Import the type token from the package you depend on:
+
+```typescript
+import { definePlugin } from '@cfast/core';
+import type { AuthPluginProvides } from '@cfast/auth';
+
+export const dbPlugin = (config: DbPluginConfig) =>
+  definePlugin<AuthPluginProvides>()({
+    name: 'db',
+    setup(ctx) {
+      // ctx.auth.user and ctx.auth.grants are typed
+      const client = createDb({
+        d1: ctx.env.DB,
+        schema: config.schema,
+        grants: ctx.auth.grants,
+        user: ctx.auth.user,
+      });
+      return { client };
+    },
+  });
+```
+
+Each package that ships a plugin should export a `PluginProvides` type:
+
+```typescript
+// @cfast/auth exports:
+export type AuthPluginProvides = PluginProvides<typeof authPlugin>;
+// Resolves to: { auth: { user: AuthUser | null; grants: Grant[]; instance: AuthInstance } }
+```
+
+`PluginProvides<T>` is a utility type exported by `@cfast/core` that extracts `{ [name]: ReturnType<setup> }` from any plugin definition.
+
+### Multiple dependencies
+
+Intersect the type tokens:
+
+```typescript
+import type { AuthPluginProvides } from '@cfast/auth';
+import type { DbPluginProvides } from '@cfast/db';
+
+export const adminPlugin = (config: AdminConfig) =>
+  definePlugin<AuthPluginProvides & DbPluginProvides>()({
+    name: 'admin',
+    setup(ctx) {
+      ctx.auth.user       // typed
+      ctx.db.client       // typed
+      return { /* ... */ };
+    },
+  });
+```
+
+### No dependencies (leaf plugins)
+
+Omit the generic — `TRequires` defaults to `{}`:
+
+```typescript
+export const analyticsPlugin = (config: AnalyticsConfig) =>
+  definePlugin({
+    name: 'analytics',
+    setup(ctx) {
+      // ctx has { request, env } only
+      return { track: (event: string) => { /* ... */ } };
+    },
+  });
+```
+
+### Client-only plugins
+
+Plugins that only provide client-side functionality can return `{}` from `setup`:
+
+```typescript
+export const themePlugin = (config: ThemeConfig) =>
+  definePlugin({
+    name: 'theme',
+    setup() {
+      return {};
+    },
+    Provider({ children }) {
+      return <ThemeProvider theme={config.theme}>{children}</ThemeProvider>;
+    },
+    client: {
+      useTheme: () => useContext(ThemeContext),
+    },
+  });
+```
+
+---
+
+## Writing a Plugin: Complete Example
+
+A rate-limiting plugin that uses KV to track request counts:
+
+```typescript
+// packages/rate-limit/src/plugin.ts
+import { definePlugin, type PluginProvides } from '@cfast/core';
+import type { AuthPluginProvides } from '@cfast/auth';
+
+export type RateLimitConfig = {
+  kv: string;           // env binding name for KV namespace
+  maxRequests: number;  // per window
+  windowMs: number;     // window size in milliseconds
+};
+
+export const rateLimitPlugin = (config: RateLimitConfig) =>
+  definePlugin<AuthPluginProvides>()({
+    name: 'rate-limit',
+
+    async setup(ctx) {
+      const kv = ctx.env[config.kv] as KVNamespace;
+      const key = ctx.auth.user?.id ?? ctx.request.headers.get('cf-connecting-ip') ?? 'unknown';
+      const windowKey = `rl:${key}:${Math.floor(Date.now() / config.windowMs)}`;
+
+      const current = parseInt(await kv.get(windowKey) ?? '0', 10);
+      const remaining = Math.max(0, config.maxRequests - current);
+      const limited = current >= config.maxRequests;
+
+      return {
+        limited,
+        remaining,
+        async consume() {
+          await kv.put(windowKey, String(current + 1), {
+            expirationTtl: Math.ceil(config.windowMs / 1000),
+          });
+        },
+      };
+    },
+  });
+
+// Type token for dependents
+export type RateLimitPluginProvides = PluginProvides<ReturnType<typeof rateLimitPlugin>>;
+```
+
+Usage:
+
+```typescript
+// app/cfast.ts
+import { rateLimitPlugin } from '@cfast/rate-limit';
+
+export const app = createApp({ env: envSchema, permissions })
+  .use(authPlugin({ /* ... */ }))
+  .use(rateLimitPlugin({ kv: 'RATE_LIMIT', maxRequests: 100, windowMs: 60_000 }))
+  .use(dbPlugin({ schema }));
+
+// app/routes/api.tsx
+export async function loader({ request, context }: Route.LoaderArgs) {
+  const ctx = await app.context(request, context);
+
+  if (ctx['rate-limit'].limited) {
+    throw new Response('Too many requests', { status: 429 });
+  }
+  await ctx['rate-limit'].consume();
+
+  return ctx.db.client.query(posts).findMany().run({});
+}
+```
+
+---
+
+## Startup Validation
+
+`createApp().use()` performs validation eagerly (at import time, not per-request):
+
+1. **Duplicate names** — If two plugins share a `name`, `.use()` throws a `CfastConfigError` immediately.
+2. **Missing requirements** — If a plugin's `TRequires` includes keys not provided by prior plugins, TypeScript reports a type error at the `.use()` call site. This is compile-time only — there is no runtime check for missing requirements.
+
+If plugin `setup()` throws during `app.context()`, the error is wrapped in a `CfastPluginError` with the plugin name for diagnostics.
+
+---
+
+## Exports
+
+Server (`@cfast/core`):
+
+```typescript
+export { createApp } from './create-app.js';
+export { definePlugin } from './define-plugin.js';
+export { CfastPluginError, CfastConfigError } from './errors.js';
+export type {
+  CfastPlugin, CreateAppConfig, PluginSetupContext,
+  AppContext, PluginProvides, App, RouteArgs,
+} from './types.js';
+```
+
+Client (`@cfast/core/client`):
+
+```typescript
+export { useApp } from './client/use-app.js';
+export { createCoreProvider, CoreContext } from './client/provider.js';
+```
+
+---
+
+## Integration with Other @cfast Packages
+
+- **`@cfast/env`** — Core accepts the env schema directly and delegates to `defineEnv` internally. `app.init()` calls `env.init()`, `app.env()` calls `env.get()`.
+- **`@cfast/permissions`** — Core accepts the permissions config directly and makes it available to all plugins via `ctx.env` (the env binding) and the base context.
+- **`@cfast/auth`**, **`@cfast/db`**, **`@cfast/storage`**, etc. — Each ships an optional plugin export alongside their standalone API. The plugin wraps their existing factory function and registers it with core.
+- **`@cfast/actions`** — Not wrapped by core. Actions have their own context mechanism. Core's `app.context()` feeds into `createActions({ getContext })`.
+- **`@cfast/admin`** — Can ship an `adminPlugin` that depends on auth + db + forms plugins.
+
+---
+
+## Known Limitations
+
+### 1. Plugin setup runs on every request
+
+There is no caching of plugin `setup()` results across requests. Each call to `app.context()` runs the full plugin chain. This is intentional — most setup work is cheap (object construction, cookie parsing) and the per-request user context makes caching unsafe.
+
+If a plugin has expensive one-time initialization, it should do that work in the plugin factory (the outer function) rather than in `setup()`.
+
+### 2. Provider ordering matches registration order
+
+Client-side providers nest in the order plugins were registered. If a provider needs to wrap another provider (e.g., auth must wrap storage for token access), the plugins must be registered in the correct order. This is the same constraint as the server-side `setup()` chain.
+
+### 3. `useApp()` requires `app.Provider` in the tree
+
+Calling `useApp()` outside of `app.Provider` throws a context error. Individual package hooks may or may not have this requirement depending on their implementation.

package/dist/chunk-DFUBJVKG.js

@@ -0,0 +1,31 @@
+// src/client/provider.tsx
+import { createContext } from "react";
+import { jsx } from "react/jsx-runtime";
+var CoreContext = createContext(null);
+function createCoreProvider(plugins) {
+  const clientValue = {};
+  for (const plugin of plugins) {
+    if (plugin.client) {
+      clientValue[plugin.name] = plugin.client;
+    }
+  }
+  const providers = [];
+  for (const p of plugins) {
+    if (p.Provider) {
+      providers.push(p.Provider);
+    }
+  }
+  return function CfastProvider({ children }) {
+    let tree = children;
+    for (let i = providers.length - 1; i >= 0; i--) {
+      const P = providers[i];
+      tree = /* @__PURE__ */ jsx(P, { children: tree });
+    }
+    return /* @__PURE__ */ jsx(CoreContext.Provider, { value: clientValue, children: tree });
+  };
+}
+
+export {
+  CoreContext,
+  createCoreProvider
+};

package/dist/client/index.d.ts

@@ -0,0 +1,44 @@
+import * as react from 'react';
+import { ComponentType, ReactNode } from 'react';
+import { d as RuntimePlugin } from '../types-L3fwnDhg.js';
+import '@cfast/env';
+import '@cfast/permissions';
+
+/**
+ * Accesses all plugins' client-side exports from the nearest `app.Provider`.
+ *
+ * The returned object is keyed by plugin name, containing each plugin's `client` values.
+ * Throws if called outside of `<app.Provider>`.
+ *
+ * @typeParam T - The expected shape of the client context (defaults to `Record<string, unknown>`).
+ * @returns The merged client-side plugin values.
+ *
+ * @example
+ * ```tsx
+ * import { useApp } from '@cfast/core/client';
+ *
+ * function MyComponent() {
+ *   const { auth, storage } = useApp();
+ *   const user = auth.useCurrentUser();
+ * }
+ * ```
+ */
+declare function useApp<T = Record<string, unknown>>(): T;
+
+/** React context holding client-side plugin values for `useApp()`. */
+declare const CoreContext: react.Context<Record<string, unknown> | null>;
+type ProviderComponent = ComponentType<{
+    children: ReactNode;
+}>;
+/**
+ * Creates a composed React provider that nests all plugin providers and exposes
+ * client-side plugin values via {@link CoreContext}.
+ *
+ * Plugins are nested in registration order (first registered = outermost).
+ *
+ * @param plugins - The registered plugins, each with optional `Provider` and `client`.
+ * @returns A React component that wraps children with all plugin providers and the core context.
+ */
+declare function createCoreProvider(plugins: Pick<RuntimePlugin, "name" | "Provider" | "client">[]): ProviderComponent;
+
+export { CoreContext, createCoreProvider, useApp };

package/dist/client/index.js

@@ -0,0 +1,21 @@
+import {
+  CoreContext,
+  createCoreProvider
+} from "../chunk-DFUBJVKG.js";
+
+// src/client/use-app.ts
+import { useContext } from "react";
+function useApp() {
+  const ctx = useContext(CoreContext);
+  if (ctx === null) {
+    throw new Error(
+      "@cfast/core: useApp() must be used inside <app.Provider>. Wrap your app with the Provider from createApp()."
+    );
+  }
+  return ctx;
+}
+export {
+  CoreContext,
+  createCoreProvider,
+  useApp
+};

package/dist/index.d.ts

@@ -0,0 +1,104 @@
+import { Schema } from '@cfast/env';
+import { Permissions } from '@cfast/permissions';
+import { C as CreateAppConfig, A as App, P as PluginSetupContext, a as CfastPlugin } from './types-L3fwnDhg.js';
+export { b as AppContext, c as PluginProvides, R as RouteArgs } from './types-L3fwnDhg.js';
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Creates a cfast application instance that wires env, permissions, and plugins into a typed per-request context.
+ *
+ * Call `.use(plugin)` to register plugins, then use `app.context(request, context)` in route
+ * loaders/actions to build the per-request context with all plugin values.
+ *
+ * @param config - Application configuration containing the env schema and permissions definition.
+ * @returns An `App` instance with methods for context creation, route helpers, and plugin registration.
+ *
+ * @example
+ * ```ts
+ * import { createApp } from '@cfast/core';
+ * import { authPlugin } from '@cfast/auth';
+ * import { envSchema } from './env';
+ * import { permissions } from './permissions';
+ *
+ * export const app = createApp({ env: envSchema, permissions })
+ *   .use(authPlugin({ magicLink: { sendMagicLink: async ({ email, url }) => {} } }));
+ * ```
+ */
+declare function createApp<TSchema extends Schema, TPermissions extends Permissions>(config: CreateAppConfig<TSchema, TPermissions>): App<TSchema, TPermissions, unknown, unknown>;
+
+/**
+ * Defines a cfast plugin for use with `createApp().use()`.
+ *
+ * Has two call signatures:
+ * - **Direct form** (no dependencies): `definePlugin({ name, setup, ... })` -- types are fully inferred.
+ * - **Curried form** (with dependencies): `definePlugin<TRequires>()({ name, setup, ... })` --
+ *   specify `TRequires` explicitly so `setup(ctx)` receives typed prior-plugin context.
+ *
+ * @param config - Plugin configuration with `name`, `setup`, and optional `Provider`/`client`.
+ * @returns A `CfastPlugin` instance ready to pass to `app.use()`.
+ *
+ * @example
+ * ```ts
+ * // Leaf plugin (no dependencies)
+ * const analyticsPlugin = definePlugin({
+ *   name: 'analytics',
+ *   setup(ctx) {
+ *     return { track: (event: string) => {} };
+ *   },
+ * });
+ *
+ * // Plugin with dependencies (curried)
+ * import type { AuthPluginProvides } from '@cfast/auth';
+ * const dbPlugin = definePlugin<AuthPluginProvides>()({
+ *   name: 'db',
+ *   setup(ctx) {
+ *     ctx.auth.user; // typed from AuthPluginProvides
+ *     return { client: createDb({}) };
+ *   },
+ * });
+ * ```
+ */
+declare function definePlugin<TName extends string, TProvides, TClient = unknown>(config: {
+    name: TName;
+    setup: (ctx: PluginSetupContext<unknown>) => TProvides | Promise<TProvides>;
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    client?: TClient;
+}): CfastPlugin<TName, Awaited<TProvides>, unknown, TClient>;
+declare function definePlugin<TRequires>(): <TName extends string, TProvides, TClient = unknown>(config: {
+    name: TName;
+    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    client?: TClient;
+}) => CfastPlugin<TName, Awaited<TProvides>, TRequires, TClient>;
+
+/**
+ * Error thrown when a plugin's `setup()` function fails during `app.context()`.
+ *
+ * Wraps the original error with the plugin name for diagnostics.
+ */
+declare class CfastPluginError extends Error {
+    /** The name of the plugin whose `setup()` threw. */
+    readonly pluginName: string;
+    /** The original error thrown by the plugin. */
+    readonly cause: unknown;
+    /**
+     * @param pluginName - The name of the plugin that failed.
+     * @param cause - The original error thrown by the plugin's `setup()`.
+     */
+    constructor(pluginName: string, cause: unknown);
+}
+/**
+ * Error thrown for configuration issues detected at startup (e.g., duplicate plugin names).
+ */
+declare class CfastConfigError extends Error {
+    /**
+     * @param message - Description of the configuration error.
+     */
+    constructor(message: string);
+}
+
+export { App, CfastConfigError, CfastPlugin, CfastPluginError, CreateAppConfig, PluginSetupContext, createApp, definePlugin };

package/dist/index.js

@@ -0,0 +1,113 @@
+import {
+  createCoreProvider
+} from "./chunk-DFUBJVKG.js";
+
+// src/create-app.ts
+import { defineEnv } from "@cfast/env";
+
+// src/errors.ts
+var CfastPluginError = class extends Error {
+  /** The name of the plugin whose `setup()` threw. */
+  pluginName;
+  /** The original error thrown by the plugin. */
+  cause;
+  /**
+   * @param pluginName - The name of the plugin that failed.
+   * @param cause - The original error thrown by the plugin's `setup()`.
+   */
+  constructor(pluginName, cause) {
+    const causeMessage = cause instanceof Error ? cause.message : String(cause);
+    super(`Plugin "${pluginName}" setup failed: ${causeMessage}`);
+    this.name = "CfastPluginError";
+    this.pluginName = pluginName;
+    this.cause = cause;
+  }
+};
+var CfastConfigError = class extends Error {
+  /**
+   * @param message - Description of the configuration error.
+   */
+  constructor(message) {
+    super(message);
+    this.name = "CfastConfigError";
+  }
+};
+
+// src/create-app.ts
+function createApp(config) {
+  const envInstance = defineEnv(config.env);
+  return buildApp(
+    envInstance,
+    config.permissions,
+    []
+  );
+}
+function buildApp(envInstance, permissions, plugins) {
+  const pluginNames = new Set(plugins.map((p) => p.name));
+  const app = {
+    permissions,
+    init(rawEnv) {
+      envInstance.init(rawEnv);
+    },
+    env() {
+      return envInstance.get();
+    },
+    async context(request, _context) {
+      const env = envInstance.get();
+      const accumulated = {};
+      for (const plugin of plugins) {
+        const setupCtx = {
+          request,
+          env,
+          ...accumulated
+        };
+        try {
+          const result = await plugin.setup(
+            setupCtx
+          );
+          accumulated[plugin.name] = result;
+        } catch (e) {
+          if (e instanceof CfastPluginError) throw e;
+          throw new CfastPluginError(plugin.name, e);
+        }
+      }
+      return { env, ...accumulated };
+    },
+    loader(fn) {
+      return async (args) => {
+        const ctx = await app.context(args.request, args.context);
+        return fn(ctx, args);
+      };
+    },
+    action(fn) {
+      return async (args) => {
+        const ctx = await app.context(args.request, args.context);
+        return fn(ctx, args);
+      };
+    },
+    use(plugin) {
+      if (pluginNames.has(plugin.name)) {
+        throw new CfastConfigError(
+          `Duplicate plugin name "${plugin.name}". Each plugin must have a unique name.`
+        );
+      }
+      return buildApp(envInstance, permissions, [...plugins, plugin]);
+    },
+    Provider: createCoreProvider(plugins)
+  };
+  return app;
+}
+
+// src/define-plugin.ts
+function definePlugin(config) {
+  if (config === void 0) {
+    return (innerConfig) => innerConfig;
+  }
+  return config;
+}
+export {
+  CfastConfigError,
+  CfastPluginError,
+  createApp,
+  definePlugin
+};

package/dist/types-B3KP3EKS.d.ts

@@ -0,0 +1,49 @@
+import { Schema, ParsedEnv } from '@cfast/env';
+import { Permissions } from '@cfast/permissions';
+import { ComponentType, ReactNode } from 'react';
+
+type CreateAppConfig<TSchema extends Schema, TPermissions extends Permissions> = {
+    env: TSchema;
+    permissions: TPermissions;
+};
+type PluginSetupContext<TRequires> = {
+    request: Request;
+    env: Record<string, unknown>;
+} & TRequires;
+type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = {}, TClient = {}> = {
+    name: TName;
+    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    client?: TClient;
+};
+type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown> ? {
+    [K in N]: P;
+} : never;
+type AppContext<TSchema extends Schema, TPluginContext> = {
+    env: ParsedEnv<TSchema>;
+} & TPluginContext;
+type RouteArgs = {
+    request: Request;
+    params: Record<string, string | undefined>;
+    context: unknown;
+};
+type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContext, TClientContext> = {
+    init(rawEnv: Record<string, unknown>): void;
+    env(): ParsedEnv<TSchema>;
+    context(request: Request, context?: unknown): Promise<AppContext<TSchema, TPluginContext>>;
+    loader<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    action<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    use<TName extends string, TProvides, TClient>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient>): App<TSchema, TPermissions, TPluginContext & {
+        [K in TName]: TProvides;
+    }, TClientContext & (TClient extends {} ? {
+        [K in TName]: TClient;
+    } : {})>;
+    Provider: ComponentType<{
+        children: ReactNode;
+    }>;
+    permissions: TPermissions;
+};
+
+export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RouteArgs as R, CfastPlugin as a, AppContext as b, PluginProvides as c };

package/dist/types-C7BT5Gwe.d.ts

@@ -0,0 +1,49 @@
+import { Schema, ParsedEnv } from '@cfast/env';
+import { Permissions } from '@cfast/permissions';
+import { ComponentType, ReactNode } from 'react';
+
+type CreateAppConfig<TSchema extends Schema, TPermissions extends Permissions> = {
+    env: TSchema;
+    permissions: TPermissions;
+};
+type PluginSetupContext<TRequires> = {
+    request: Request;
+    env: Record<string, unknown>;
+} & TRequires;
+type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = unknown, TClient = unknown> = {
+    name: TName;
+    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    client?: TClient;
+};
+type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown> ? {
+    [K in N]: P;
+} : never;
+type AppContext<TSchema extends Schema, TPluginContext> = {
+    env: ParsedEnv<TSchema>;
+} & TPluginContext;
+type RouteArgs = {
+    request: Request;
+    params: Record<string, string | undefined>;
+    context: unknown;
+};
+type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContext, TClientContext> = {
+    init(rawEnv: Record<string, unknown>): void;
+    env(): ParsedEnv<TSchema>;
+    context(request: Request, context?: unknown): Promise<AppContext<TSchema, TPluginContext>>;
+    loader<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    action<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    use<TName extends string, TProvides, TClient>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient>): App<TSchema, TPermissions, TPluginContext & {
+        [K in TName]: TProvides;
+    }, TClientContext & (TClient extends object ? {
+        [K in TName]: TClient;
+    } : unknown)>;
+    Provider: ComponentType<{
+        children: ReactNode;
+    }>;
+    permissions: TPermissions;
+};
+
+export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RouteArgs as R, CfastPlugin as a, AppContext as b, PluginProvides as c };

package/dist/types-CcpyQoE6.d.ts

@@ -0,0 +1,123 @@
+import { Schema, ParsedEnv } from '@cfast/env';
+import { Permissions } from '@cfast/permissions';
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Configuration object for {@link createApp}.
+ *
+ * @typeParam TSchema - The env schema type from `@cfast/env`.
+ * @typeParam TPermissions - The permissions definition from `@cfast/permissions`.
+ */
+type CreateAppConfig<TSchema extends Schema, TPermissions extends Permissions> = {
+    /** The environment variable schema. Validated at `app.init()` time via `@cfast/env`. */
+    env: TSchema;
+    /** The permissions config from `definePermissions()`. Made available to all plugins. */
+    permissions: TPermissions;
+};
+/**
+ * The context object passed to a plugin's `setup()` function.
+ *
+ * Contains the current request, validated env, and all values provided by prior plugins
+ * (typed via `TRequires`).
+ *
+ * @typeParam TRequires - Intersection of prior plugin provides (e.g., `AuthPluginProvides`).
+ */
+type PluginSetupContext<TRequires> = {
+    /** The incoming HTTP request for the current invocation. */
+    request: Request;
+    /** The validated environment bindings. */
+    env: Record<string, unknown>;
+} & TRequires;
+/**
+ * A cfast plugin definition created by {@link definePlugin}.
+ *
+ * Plugins provide server-side context values via `setup()`, optional client-side React providers,
+ * and optional client-side values accessible via `useApp()`.
+ *
+ * @typeParam TName - The unique plugin name, used as the namespace key in `AppContext`.
+ * @typeParam TProvides - The type returned by `setup()`, accessible as `ctx[name]`.
+ * @typeParam TRequires - The context shape this plugin depends on from prior plugins.
+ * @typeParam TClient - Client-side values exposed via `useApp()`.
+ */
+type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = unknown, TClient = unknown> = {
+    /** Unique identifier used as the namespace key in the app context. */
+    name: TName;
+    /** Called per-request to produce the values this plugin provides. */
+    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    /** Optional client-side React provider, composed into `app.Provider`. */
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    /** Optional client-side values exposed via `useApp()`. */
+    client?: TClient;
+};
+/**
+ * Utility type that extracts `{ [name]: ReturnType<setup> }` from a plugin definition.
+ *
+ * Use this to create a type token that dependent plugins can reference via `definePlugin<TRequires>()`.
+ *
+ * @typeParam T - A `CfastPlugin` type to extract provides from.
+ */
+type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown> ? {
+    [K in N]: P;
+} : never;
+/**
+ * The accumulated per-request context after all plugins have run.
+ *
+ * Contains the validated env plus each plugin's namespaced values.
+ *
+ * @typeParam TSchema - The env schema type.
+ * @typeParam TPluginContext - The intersection of all registered plugins' provides.
+ */
+type AppContext<TSchema extends Schema, TPluginContext> = {
+    /** The validated environment bindings. */
+    env: ParsedEnv<TSchema>;
+} & TPluginContext;
+/**
+ * Route handler arguments passed through from React Router loaders and actions.
+ */
+type RouteArgs = {
+    /** The incoming HTTP request. */
+    request: Request;
+    /** URL route parameters (e.g., `{ postId: "abc" }`). */
+    params: Record<string, string | undefined>;
+    /** The React Router context object (contains `cloudflare.env`, etc.). */
+    context: unknown;
+};
+/**
+ * The app object returned by `createApp()` and extended by `.use()` calls.
+ *
+ * Provides methods for environment initialization, per-request context creation,
+ * route handler wrappers, plugin registration, and a composed React provider.
+ *
+ * @typeParam TSchema - The env schema type.
+ * @typeParam TPermissions - The permissions definition type.
+ * @typeParam TPluginContext - The accumulated plugin context type.
+ * @typeParam TClientContext - The accumulated client-side context type.
+ */
+type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContext, TClientContext> = {
+    /** Validates and initializes environment bindings. Call once in the Workers entry point. */
+    init(rawEnv: Record<string, unknown>): void;
+    /** Returns the typed, validated environment. */
+    env(): ParsedEnv<TSchema>;
+    /** Builds the per-request context by running each plugin's `setup()` in order. */
+    context(request: Request, context?: unknown): Promise<AppContext<TSchema, TPluginContext>>;
+    /** Convenience wrapper for React Router loaders that auto-creates the app context. */
+    loader<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    /** Convenience wrapper for React Router actions that auto-creates the app context. */
+    action<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    /** Registers a plugin, extending the app's context type. Throws on duplicate names. */
+    use<TName extends string, TProvides, TClient>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient>): App<TSchema, TPermissions, TPluginContext & {
+        [K in TName]: TProvides;
+    }, TClientContext & (TClient extends object ? {
+        [K in TName]: TClient;
+    } : unknown)>;
+    /** Composed React provider tree from all registered plugins. */
+    Provider: ComponentType<{
+        children: ReactNode;
+    }>;
+    /** The permissions config passed to `createApp()`. */
+    permissions: TPermissions;
+};
+
+export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RouteArgs as R, CfastPlugin as a, AppContext as b, PluginProvides as c };

package/dist/types-L3fwnDhg.d.ts

@@ -0,0 +1,154 @@
+import { Schema, ParsedEnv } from '@cfast/env';
+import { Permissions } from '@cfast/permissions';
+import { ComponentType, ReactNode } from 'react';
+
+/**
+ * Configuration object for {@link createApp}.
+ *
+ * @typeParam TSchema - The env schema type from `@cfast/env`.
+ * @typeParam TPermissions - The permissions definition from `@cfast/permissions`.
+ */
+type CreateAppConfig<TSchema extends Schema, TPermissions extends Permissions> = {
+    /** The environment variable schema. Validated at `app.init()` time via `@cfast/env`. */
+    env: TSchema;
+    /** The permissions config from `definePermissions()`. Made available to all plugins. */
+    permissions: TPermissions;
+};
+/**
+ * The context object passed to a plugin's `setup()` function.
+ *
+ * Contains the current request, validated env, and all values provided by prior plugins
+ * (typed via `TRequires`).
+ *
+ * @typeParam TRequires - Intersection of prior plugin provides (e.g., `AuthPluginProvides`).
+ */
+type PluginSetupContext<TRequires> = {
+    /** The incoming HTTP request for the current invocation. */
+    request: Request;
+    /** The validated environment bindings. */
+    env: Record<string, unknown>;
+} & TRequires;
+/**
+ * A cfast plugin definition created by {@link definePlugin}.
+ *
+ * Plugins provide server-side context values via `setup()`, optional client-side React providers,
+ * and optional client-side values accessible via `useApp()`.
+ *
+ * @typeParam TName - The unique plugin name, used as the namespace key in `AppContext`.
+ * @typeParam TProvides - The type returned by `setup()`, accessible as `ctx[name]`.
+ * @typeParam TRequires - The context shape this plugin depends on from prior plugins.
+ * @typeParam TClient - Client-side values exposed via `useApp()`.
+ */
+type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = unknown, TClient = unknown> = {
+    /** Unique identifier used as the namespace key in the app context. */
+    name: TName;
+    /** Called per-request to produce the values this plugin provides. */
+    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    /** Optional client-side React provider, composed into `app.Provider`. */
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    /** Optional client-side values exposed via `useApp()`. */
+    client?: TClient;
+};
+/**
+ * Minimal plugin shape used internally for runtime iteration in `buildApp`.
+ *
+ * The `setup` parameter uses `PluginSetupContext<never>` so that every concrete
+ * `CfastPlugin<TName, TProvides, TRequires, TClient>` is structurally assignable
+ * to this type without casting — `never` extends any `TRequires`, satisfying
+ * function parameter contravariance.
+ *
+ * At the call site in `context()`, we use a single documented cast to invoke
+ * `setup` with the actual runtime context, since TypeScript cannot prove that
+ * accumulated plugin results satisfy each plugin's `TRequires`.
+ *
+ * This type is internal and not part of the public API.
+ */
+type RuntimePlugin = {
+    /** Plugin name used as the namespace key. */
+    name: string;
+    /**
+     * Setup function called per-request.
+     *
+     * Typed with `never` parameter to make all `CfastPlugin` subtypes assignable.
+     * Called at runtime via a documented cast in `context()`.
+     */
+    setup: (ctx: PluginSetupContext<never>) => unknown | Promise<unknown>;
+    /** Optional client-side React provider. */
+    Provider?: ComponentType<{
+        children: ReactNode;
+    }>;
+    /** Optional client-side values. */
+    client?: unknown;
+};
+/**
+ * Utility type that extracts `{ [name]: ReturnType<setup> }` from a plugin definition.
+ *
+ * Use this to create a type token that dependent plugins can reference via `definePlugin<TRequires>()`.
+ *
+ * @typeParam T - A `CfastPlugin` type to extract provides from.
+ */
+type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown> ? {
+    [K in N]: P;
+} : never;
+/**
+ * The accumulated per-request context after all plugins have run.
+ *
+ * Contains the validated env plus each plugin's namespaced values.
+ *
+ * @typeParam TSchema - The env schema type.
+ * @typeParam TPluginContext - The intersection of all registered plugins' provides.
+ */
+type AppContext<TSchema extends Schema, TPluginContext> = {
+    /** The validated environment bindings. */
+    env: ParsedEnv<TSchema>;
+} & TPluginContext;
+/**
+ * Route handler arguments passed through from React Router loaders and actions.
+ */
+type RouteArgs = {
+    /** The incoming HTTP request. */
+    request: Request;
+    /** URL route parameters (e.g., `{ postId: "abc" }`). */
+    params: Record<string, string | undefined>;
+    /** The React Router context object (contains `cloudflare.env`, etc.). */
+    context: unknown;
+};
+/**
+ * The app object returned by `createApp()` and extended by `.use()` calls.
+ *
+ * Provides methods for environment initialization, per-request context creation,
+ * route handler wrappers, plugin registration, and a composed React provider.
+ *
+ * @typeParam TSchema - The env schema type.
+ * @typeParam TPermissions - The permissions definition type.
+ * @typeParam TPluginContext - The accumulated plugin context type.
+ * @typeParam TClientContext - The accumulated client-side context type.
+ */
+type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContext, TClientContext> = {
+    /** Validates and initializes environment bindings. Call once in the Workers entry point. */
+    init(rawEnv: Record<string, unknown>): void;
+    /** Returns the typed, validated environment. */
+    env(): ParsedEnv<TSchema>;
+    /** Builds the per-request context by running each plugin's `setup()` in order. */
+    context(request: Request, context?: unknown): Promise<AppContext<TSchema, TPluginContext>>;
+    /** Convenience wrapper for React Router loaders that auto-creates the app context. */
+    loader<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    /** Convenience wrapper for React Router actions that auto-creates the app context. */
+    action<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
+    /** Registers a plugin, extending the app's context type. Throws on duplicate names. */
+    use<TName extends string, TProvides, TClient>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient>): App<TSchema, TPermissions, TPluginContext & {
+        [K in TName]: TProvides;
+    }, TClientContext & (TClient extends object ? {
+        [K in TName]: TClient;
+    } : unknown)>;
+    /** Composed React provider tree from all registered plugins. */
+    Provider: ComponentType<{
+        children: ReactNode;
+    }>;
+    /** The permissions config passed to `createApp()`. */
+    permissions: TPermissions;
+};
+
+export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RouteArgs as R, CfastPlugin as a, AppContext as b, PluginProvides as c, RuntimePlugin as d };

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@cfast/core",
+  "version": "0.0.1",
+  "description": "App composition layer with plugin system for @cfast/* packages",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/DanielMSchmidt/cfast.git",
+    "directory": "packages/core"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    },
+    "./client": {
+      "import": "./dist/client/index.js",
+      "types": "./dist/client/index.d.ts"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@cfast/permissions": "0.0.1",
+    "@cfast/env": "0.0.1"
+  },
+  "peerDependencies": {
+    "react": ">=18"
+  },
+  "peerDependenciesMeta": {
+    "react": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/react": "^19.2.14",
+    "@types/react-dom": "^19.2.3",
+    "react": "^19.1.0",
+    "react-dom": "^19.2.4",
+    "tsup": "^8",
+    "typescript": "^5.7",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/client/index.ts --format esm --dts",
+    "dev": "tsup src/index.ts src/client/index.ts --format esm --dts --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/",
+    "test": "vitest run --passWithNoTests"
+  }
+}