@cfast/core 0.1.1 → 0.1.3

package/README.md

@@ -130,7 +130,7 @@ import { app } from '~/cfast';
 
 export async function loader({ request, context }: Route.LoaderArgs) {
   const ctx = await app.context(request, context);
-  return ctx.db.client.query(posts).findMany().run({});
+  return ctx.db.client.query(posts).findMany().run();
 }
 ```
 
@@ -165,7 +165,7 @@ Optional convenience wrappers that call `app.context()` and pass the result as t
 
 ```typescript
 export const loader = app.loader(async (ctx, { params }) => {
-  return ctx.db.client.query(posts).findMany().run({});
+  return ctx.db.client.query(posts).findMany().run();
 });
 ```
 
@@ -443,7 +443,7 @@ export async function loader({ request, context }: Route.LoaderArgs) {
   }
   await ctx['rate-limit'].consume();
 
-  return ctx.db.client.query(posts).findMany().run({});
+  return ctx.db.client.query(posts).findMany().run();
 }
 ```
 

package/dist/client/index.d.ts

@@ -1,6 +1,6 @@
 import * as react from 'react';
 import { ComponentType, ReactNode } from 'react';
-import { d as RuntimePlugin } from '../types-L3fwnDhg.js';
+import { f as RuntimePlugin } from '../types-CQyKq4D1.js';
 import '@cfast/env';
 import '@cfast/permissions';
 

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { Schema } from '@cfast/env';
 import { Permissions } from '@cfast/permissions';
-import { C as CreateAppConfig, A as App, P as PluginSetupContext, a as CfastPlugin } from './types-L3fwnDhg.js';
-export { b as AppContext, c as PluginProvides, R as RouteArgs } from './types-L3fwnDhg.js';
+import { C as CreateAppConfig, A as App, a as CfastPlugin, P as PluginSetupContext, R as RequiresFromPlugins } from './types-CQyKq4D1.js';
+export { b as AppContext, c as PluginContext, d as PluginProvides, e as RouteArgs } from './types-CQyKq4D1.js';
 import { ComponentType, ReactNode } from 'react';
 
 /**
@@ -29,12 +29,44 @@ declare function createApp<TSchema extends Schema, TPermissions extends Permissi
 /**
  * Defines a cfast plugin for use with `createApp().use()`.
  *
- * Has two call signatures:
- * - **Direct form** (no dependencies): `definePlugin({ name, setup, ... })` -- types are fully inferred.
- * - **Curried form** (with dependencies): `definePlugin<TRequires>()({ name, setup, ... })` --
- *   specify `TRequires` explicitly so `setup(ctx)` receives typed prior-plugin context.
+ * Two equivalent forms are supported:
  *
- * @param config - Plugin configuration with `name`, `setup`, and optional `Provider`/`client`.
+ * 1. **Inferred form (preferred)** — pass plugin references in `requires` and the
+ *    `setup(ctx)` parameter is automatically typed with their provides:
+ *
+ *    ```ts
+ *    const dbPlugin = definePlugin({
+ *      name: "db",
+ *      requires: [authPlugin],
+ *      setup(ctx) {
+ *        ctx.auth.user; // typed from authPlugin
+ *        return { client: createDb({}) };
+ *      },
+ *    });
+ *    ```
+ *
+ *    No need to import or declare a `TRequires` type token — the dependency type
+ *    flows directly from the registered plugin objects. Leaf plugins simply omit
+ *    `requires` and get `ctx: { request, env }`.
+ *
+ * 2. **Curried form (legacy)** — kept for backward compatibility with code that
+ *    only has access to a `PluginProvides<typeof authPlugin>` *type* (e.g. when
+ *    you cannot import the actual plugin value):
+ *
+ *    ```ts
+ *    definePlugin<AuthPluginProvides>()({
+ *      name: "db",
+ *      setup(ctx) { ctx.auth.user; return { ... }; },
+ *    });
+ *    ```
+ *
+ * Plugins declared via the inferred form also benefit from runtime validation:
+ * `app.use(plugin)` throws a `CfastConfigError` if any plugin listed in
+ * `requires` has not yet been registered, with a message that names the missing
+ * dependency.
+ *
+ * @param config - Plugin configuration with `name`, `setup`, and optional
+ *                 `requires`, `Provider`, `client`.
  * @returns A `CfastPlugin` instance ready to pass to `app.use()`.
  *
  * @example
@@ -47,25 +79,26 @@ declare function createApp<TSchema extends Schema, TPermissions extends Permissi
  *   },
  * });
  *
- * // Plugin with dependencies (curried)
- * import type { AuthPluginProvides } from '@cfast/auth';
- * const dbPlugin = definePlugin<AuthPluginProvides>()({
+ * // Dependent plugin — requires inferred from plugin references
+ * const dbPlugin = definePlugin({
  *   name: 'db',
+ *   requires: [authPlugin],
  *   setup(ctx) {
- *     ctx.auth.user; // typed from AuthPluginProvides
+ *     ctx.auth.user; // typed from authPlugin
  *     return { client: createDb({}) };
  *   },
  * });
  * ```
  */
-declare function definePlugin<TName extends string, TProvides, TClient = unknown>(config: {
+declare function definePlugin<TName extends string, TProvides, const TRequires extends readonly CfastPlugin<string, unknown, any, unknown, any>[] = [], TClient = unknown>(config: {
     name: TName;
-    setup: (ctx: PluginSetupContext<unknown>) => TProvides | Promise<TProvides>;
+    requires?: TRequires;
+    setup: (ctx: PluginSetupContext<RequiresFromPlugins<TRequires>>) => TProvides | Promise<TProvides>;
     Provider?: ComponentType<{
         children: ReactNode;
     }>;
     client?: TClient;
-}): CfastPlugin<TName, Awaited<TProvides>, unknown, TClient>;
+}): CfastPlugin<TName, Awaited<TProvides>, RequiresFromPlugins<TRequires>, TClient>;
 declare function definePlugin<TRequires>(): <TName extends string, TProvides, TClient = unknown>(config: {
     name: TName;
     setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
@@ -74,6 +107,53 @@ declare function definePlugin<TRequires>(): <TName extends string, TProvides, TC
     }>;
     client?: TClient;
 }) => CfastPlugin<TName, Awaited<TProvides>, TRequires, TClient>;
+/**
+ * Returns an env-typed `definePlugin` factory.
+ *
+ * The scaffolded `Cloudflare.Env` type from `worker-configuration.d.ts` is
+ * not known to `@cfast/core` at build time, so the generic `definePlugin`
+ * exposes `ctx.env` as the loose `Record<string, unknown>` shape and
+ * consumers have to cast bindings (e.g. `ctx.env.DB as D1Database`). Apps
+ * that want precise bindings call this factory once with their env type
+ * and re-export the typed `definePlugin` from a local module:
+ *
+ * ```ts
+ * // app/plugins/define-plugin.ts
+ * import { definePluginFor } from "@cfast/core";
+ *
+ * export const definePlugin = definePluginFor<Cloudflare.Env>();
+ * ```
+ *
+ * Plugin authors then import from their local module and get `ctx.env.DB`
+ * typed as `D1Database` without any casting:
+ *
+ * ```ts
+ * import { definePlugin } from "~/plugins/define-plugin";
+ *
+ * export const dbPlugin = definePlugin({
+ *   name: "db",
+ *   setup(ctx) {
+ *     const db = ctx.env.DB; // D1Database, no cast
+ *     return { client: createDb({ d1: db }) };
+ *   },
+ * });
+ * ```
+ *
+ * The returned factory has the same shape as {@link definePlugin} (with the
+ * curried legacy overload preserved) so existing code that switches from the
+ * generic form to the env-typed form only needs an import swap.
+ */
+declare function definePluginFor<TEnv>(): {
+    <TName extends string, TProvides, const TRequires extends readonly CfastPlugin<string, unknown, any, unknown, any>[] = [], TClient = unknown>(config: {
+        name: TName;
+        requires?: TRequires;
+        setup: (ctx: PluginSetupContext<RequiresFromPlugins<TRequires>, TEnv>) => TProvides | Promise<TProvides>;
+        Provider?: ComponentType<{
+            children: ReactNode;
+        }>;
+        client?: TClient;
+    }): CfastPlugin<TName, Awaited<TProvides>, RequiresFromPlugins<TRequires>, TClient, TEnv>;
+};
 
 /**
  * Error thrown when a plugin's `setup()` function fails during `app.context()`.
@@ -101,4 +181,4 @@ declare class CfastConfigError extends Error {
     constructor(message: string);
 }
 
-export { App, CfastConfigError, CfastPlugin, CfastPluginError, CreateAppConfig, PluginSetupContext, createApp, definePlugin };
+export { App, CfastConfigError, CfastPlugin, CfastPluginError, CreateAppConfig, PluginSetupContext, createApp, definePlugin, definePluginFor };

package/dist/index.js

@@ -91,6 +91,15 @@ function buildApp(envInstance, permissions, plugins) {
           `Duplicate plugin name "${plugin.name}". Each plugin must have a unique name.`
         );
       }
+      if (plugin.requires) {
+        for (const dep of plugin.requires) {
+          if (!pluginNames.has(dep.name)) {
+            throw new CfastConfigError(
+              `Plugin "${plugin.name}" requires "${dep.name}" but it has not been registered. Did you call .use(${dep.name}Plugin) before .use(${plugin.name}Plugin)?`
+            );
+          }
+        }
+      }
       return buildApp(envInstance, permissions, [...plugins, plugin]);
     },
     Provider: createCoreProvider(plugins)
@@ -105,9 +114,13 @@ function definePlugin(config) {
   }
   return config;
 }
+function definePluginFor() {
+  return (config) => config;
+}
 export {
   CfastConfigError,
   CfastPluginError,
   createApp,
-  definePlugin
+  definePlugin,
+  definePluginFor
 };

package/dist/{types-L3fwnDhg.d.ts → types-CQyKq4D1.d.ts}

@@ -20,14 +20,43 @@ type CreateAppConfig<TSchema extends Schema, TPermissions extends Permissions> =
  * Contains the current request, validated env, and all values provided by prior plugins
  * (typed via `TRequires`).
  *
+ * By default `env` is typed as the loose `Record<string, unknown>` shape used
+ * by the framework's generic plugin layer. Consumer apps that want precise
+ * bindings (e.g. `Cloudflare.Env` from `worker-configuration.d.ts`) can
+ * specialise the type via {@link definePluginFor} or by importing the
+ * {@link PluginContext} helper directly.
+ *
  * @typeParam TRequires - Intersection of prior plugin provides (e.g., `AuthPluginProvides`).
+ * @typeParam TEnv - Env shape (defaults to the loose record shape).
  */
-type PluginSetupContext<TRequires> = {
+type PluginSetupContext<TRequires, TEnv = Record<string, unknown>> = {
     /** The incoming HTTP request for the current invocation. */
     request: Request;
     /** The validated environment bindings. */
-    env: Record<string, unknown>;
+    env: TEnv;
 } & TRequires;
+/**
+ * Convenience alias for consumers who want to annotate a plugin's `setup(ctx)`
+ * parameter without going through {@link definePluginFor}. Re-exported from
+ * the package entry as `PluginContext`.
+ *
+ * @example
+ * ```ts
+ * import type { PluginContext } from "@cfast/core";
+ * import type { PluginProvides } from "@cfast/core";
+ * import type { authPlugin } from "./plugins/auth";
+ *
+ * export const dbPlugin = definePlugin({
+ *   name: "db",
+ *   requires: [authPlugin],
+ *   setup(ctx: PluginContext<Cloudflare.Env, PluginProvides<typeof authPlugin>>) {
+ *     const db = ctx.env.DB; // typed as D1Database, no cast
+ *     return { client: createDb({ d1: db }) };
+ *   },
+ * });
+ * ```
+ */
+type PluginContext<TEnv = Record<string, unknown>, TRequires = unknown> = PluginSetupContext<TRequires, TEnv>;
 /**
  * A cfast plugin definition created by {@link definePlugin}.
  *
@@ -38,12 +67,22 @@ type PluginSetupContext<TRequires> = {
  * @typeParam TProvides - The type returned by `setup()`, accessible as `ctx[name]`.
  * @typeParam TRequires - The context shape this plugin depends on from prior plugins.
  * @typeParam TClient - Client-side values exposed via `useApp()`.
+ * @typeParam TEnv - Env shape seen by `setup()`. Defaults to the loose record
+ *   shape so non-specialised plugins do not need to parameterise this slot.
  */
-type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = unknown, TClient = unknown> = {
+type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires = unknown, TClient = unknown, TEnv = Record<string, unknown>> = {
     /** Unique identifier used as the namespace key in the app context. */
     name: TName;
+    /**
+     * Optional list of plugin references this plugin depends on.
+     *
+     * When supplied, `setup(ctx)` is automatically typed with the union of each
+     * required plugin's provides, and `app.use(this)` will throw at registration
+     * time if any of these plugins have not yet been registered.
+     */
+    requires?: readonly CfastPlugin<string, unknown, any, unknown, any>[];
     /** Called per-request to produce the values this plugin provides. */
-    setup: (ctx: PluginSetupContext<TRequires>) => TProvides | Promise<TProvides>;
+    setup: (ctx: PluginSetupContext<TRequires, TEnv>) => TProvides | Promise<TProvides>;
     /** Optional client-side React provider, composed into `app.Provider`. */
     Provider?: ComponentType<{
         children: ReactNode;
@@ -51,6 +90,32 @@ type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires =
     /** Optional client-side values exposed via `useApp()`. */
     client?: TClient;
 };
+/**
+ * Converts a union type to an intersection type.
+ *
+ * Used by {@link RequiresFromPlugins} to merge each required plugin's provides
+ * into a single intersection that becomes the `setup(ctx)` parameter shape.
+ */
+type UnionToIntersection<U> = (U extends unknown ? (k: U) => void : never) extends (k: infer I) => void ? I : never;
+/**
+ * Derives the `TRequires` shape for a `setup(ctx)` parameter from an array of
+ * plugin references passed via `definePlugin({ requires: [...] })`.
+ *
+ * Each plugin in the tuple contributes `{ [name]: provides }` and the results
+ * are intersected so `ctx` exposes every required plugin's namespace at the
+ * right key. An empty `requires` tuple resolves to `unknown` (no extra fields).
+ *
+ * Implementation note: we walk the tuple positionally with a mapped type
+ * (`{ [K in keyof R]: ... }[number]`) instead of using `R[number]` directly.
+ * The mapped form preserves per-element inference of `N` and `P`, so multiple
+ * required plugins each contribute their own `{ name: provides }` shape rather
+ * than collapsing into a union of widened `provides` values.
+ */
+type RequiresFromPlugins<R extends readonly CfastPlugin<string, unknown, any, unknown, any>[]> = R extends readonly [] ? unknown : UnionToIntersection<{
+    [K in keyof R]: R[K] extends CfastPlugin<infer N, infer P, unknown, unknown, any> ? {
+        [Key in N]: P;
+    } : never;
+}[number]>;
 /**
  * Minimal plugin shape used internally for runtime iteration in `buildApp`.
  *
@@ -68,6 +133,13 @@ type CfastPlugin<TName extends string = string, TProvides = unknown, TRequires =
 type RuntimePlugin = {
     /** Plugin name used as the namespace key. */
     name: string;
+    /**
+     * Optional dependencies declared via `definePlugin({ requires: [...] })`.
+     *
+     * `app.use(plugin)` walks this list and verifies each entry is already
+     * registered, throwing `CfastConfigError` immediately if not.
+     */
+    requires?: readonly CfastPlugin<string, unknown, any, unknown, any>[];
     /**
      * Setup function called per-request.
      *
@@ -89,7 +161,7 @@ type RuntimePlugin = {
  *
  * @typeParam T - A `CfastPlugin` type to extract provides from.
  */
-type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown> ? {
+type PluginProvides<T> = T extends CfastPlugin<infer N, infer P, unknown, unknown, any> ? {
     [K in N]: P;
 } : never;
 /**
@@ -138,7 +210,7 @@ type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContex
     /** Convenience wrapper for React Router actions that auto-creates the app context. */
     action<T>(fn: (ctx: AppContext<TSchema, TPluginContext>, args: RouteArgs) => T | Promise<T>): (args: RouteArgs) => Promise<T>;
     /** Registers a plugin, extending the app's context type. Throws on duplicate names. */
-    use<TName extends string, TProvides, TClient>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient>): App<TSchema, TPermissions, TPluginContext & {
+    use<TName extends string, TProvides, TClient, TEnv = any>(plugin: CfastPlugin<TName, TProvides, TPluginContext, TClient, TEnv>): App<TSchema, TPermissions, TPluginContext & {
         [K in TName]: TProvides;
     }, TClientContext & (TClient extends object ? {
         [K in TName]: TClient;
@@ -151,4 +223,4 @@ type App<TSchema extends Schema, TPermissions extends Permissions, TPluginContex
     permissions: TPermissions;
 };
 
-export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RouteArgs as R, CfastPlugin as a, AppContext as b, PluginProvides as c, RuntimePlugin as d };
+export type { App as A, CreateAppConfig as C, PluginSetupContext as P, RequiresFromPlugins as R, CfastPlugin as a, AppContext as b, PluginContext as c, PluginProvides as d, RouteArgs as e, RuntimePlugin as f };

package/llms.txt

@@ -10,7 +10,7 @@ Use `@cfast/core` when you want multiple cfast packages (auth, db, storage, etc.
 
 - **Plugin chain**: Plugins run in registration order via `.use()`. Each plugin's `setup()` receives everything prior plugins provided, plus `request` and `env`.
 - **Namespaced context**: Each plugin's return value is nested under its `name` key (e.g., `ctx.auth.user`, `ctx.db.client`). No flat merging, no collisions.
-- **Compile-time dependencies**: Dependent plugins declare requirements via `definePlugin<TRequires>()` (curried form). TypeScript catches missing dependencies at the `.use()` call site.
+- **Inferred dependencies**: Dependent plugins list their requirements as plugin references in `requires: [authPlugin]`. TypeScript infers `setup(ctx)` from the listed plugins -- no manual `TRequires` type token needed. TypeScript also catches missing dependencies at the `.use()` call site, and `app.use(plugin)` throws a clear `CfastConfigError` at runtime if a required plugin has not yet been registered.
 - **Client provider composition**: `<app.Provider>` nests all plugin React providers in registration order. `useApp()` accesses client-side plugin exports.
 
 ## API Reference
@@ -37,7 +37,7 @@ app.permissions: TPermissions                           // permissions config
 ### Plugin definition
 
 ```typescript
-// Leaf plugin (no dependencies) -- direct form, full inference
+// Leaf plugin (no dependencies) -- types are fully inferred
 definePlugin({
   name: "analytics",
   setup(ctx) { return { track: (event: string) => {} }; },
@@ -45,27 +45,99 @@ definePlugin({
   client?: { /* client-side values for useApp() */ },
 }): CfastPlugin
 
-// Dependent plugin -- curried form, specify TRequires explicitly
-definePlugin<AuthPluginProvides>()({
+// Dependent plugin -- list plugin references in `requires`. The setup ctx is
+// inferred from those plugins automatically; no manual generic, no type token.
+const authPlugin = definePlugin({
+  name: "auth",
+  setup() { return { user: getUser(), grants: getGrants() }; },
+});
+
+const dbPlugin = definePlugin({
   name: "db",
+  requires: [authPlugin],
   setup(ctx) {
-    ctx.auth.user;  // typed from AuthPluginProvides
-    return { client: createDb({}) };
+    ctx.auth.user;   // typed from authPlugin
+    ctx.auth.grants; // typed from authPlugin
+    return { client: createDb({ grants: ctx.auth.grants }) };
   },
 }): CfastPlugin
+
+// Multiple dependencies -- list each one
+const adminPlugin = definePlugin({
+  name: "admin",
+  requires: [authPlugin, dbPlugin],
+  setup(ctx) {
+    ctx.auth.user;   // typed
+    ctx.db.client;   // typed
+    return { /* ... */ };
+  },
+});
+```
+
+### Runtime dependency validation
+
+`app.use(plugin)` throws `CfastConfigError` immediately if a plugin listed in
+`requires` has not yet been registered:
+
+```
+CfastConfigError: Plugin "db" requires "auth" but it has not been registered.
+Did you call .use(authPlugin) before .use(dbPlugin)?
 ```
 
-### Plugin type token
+This catches misordering at composition time instead of letting it surface as
+an undefined access deep in the request lifecycle.
+
+### Plugin type token (legacy curried form)
+
+For situations where you only have access to a *type*, not the actual plugin
+value (e.g. you cannot import the plugin module), the legacy curried form is
+still available:
 
 ```typescript
-// Each package exports a type token for dependents:
 export type AuthPluginProvides = PluginProvides<typeof authPlugin>;
 // Resolves to: { auth: { user: AuthUser | null; grants: Grant[]; instance: AuthInstance } }
 
-// Multiple dependencies -- intersect type tokens:
-definePlugin<AuthPluginProvides & DbPluginProvides>()({ ... })
+definePlugin<AuthPluginProvides>()({
+  name: "db",
+  setup(ctx) { ctx.auth.user; return { /* ... */ }; },
+});
+```
+
+Prefer the inferred form (`requires: [authPlugin]`) when you can — it removes
+the need to declare and import a `PluginProvides` type token.
+
+### Typed env (`definePluginFor<Env>`)
+
+The generic `definePlugin` exposes `ctx.env` as `Record<string, unknown>`
+because `@cfast/core` cannot know your scaffolded `Cloudflare.Env` shape. To
+avoid `ctx.env.DB as D1Database` casts in every plugin, call `definePluginFor`
+once with your env type and re-export the typed factory from a local module:
+
+```typescript
+// app/plugins/define-plugin.ts
+import { definePluginFor } from "@cfast/core";
+export const definePlugin = definePluginFor<Cloudflare.Env>();
+```
+
+```typescript
+// app/plugins/db.ts
+import { definePlugin } from "~/plugins/define-plugin";
+
+export const dbPlugin = definePlugin({
+  name: "db",
+  requires: [authPlugin],
+  setup(ctx) {
+    const db = ctx.env.DB; // typed as D1Database — no cast
+    return { client: createDb({ d1: db, /* ... */ }) };
+  },
+});
 ```
 
+The returned factory has the same shape as `definePlugin`, so plugins built
+with it slot into existing `app.use()` calls without further changes. If you
+prefer to type a single plugin in-place without a factory, import the
+`PluginContext<Env, TRequires>` helper and annotate the parameter directly.
+
 ### Client (`@cfast/core/client`)
 
 ```typescript
@@ -118,12 +190,12 @@ export default {
 // Using app.context() directly:
 export async function loader({ request, context }: Route.LoaderArgs) {
   const ctx = await app.context(request, context);
-  return ctx.db.client.query(posts).findMany().run({});
+  return ctx.db.client.query(posts).findMany().run();
 }
 
 // Using convenience wrapper:
 export const loader = app.loader(async (ctx, { params }) => {
-  return ctx.db.client.query(posts).findMany().run({});
+  return ctx.db.client.query(posts).findMany().run();
 });
 ```
 
@@ -160,7 +232,7 @@ export const { createAction, composeActions } = createActions({
 
 ## Common Mistakes
 
-- Registering plugins in the wrong order -- `dbPlugin` depends on `authPlugin`, so auth must be `.use()`'d first. TypeScript catches this at compile time.
+- Registering plugins in the wrong order -- `dbPlugin` depends on `authPlugin`, so auth must be `.use()`'d first. TypeScript catches this at compile time, and `.use()` also throws `CfastConfigError` immediately at runtime if a plugin's `requires` are unsatisfied.
 - Calling `app.context()` before `app.init()` -- env is not validated yet, will throw.
 - Calling `useApp()` outside `<app.Provider>` -- throws a context error.
 - Registering two plugins with the same `name` -- throws `CfastConfigError` at import time.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cfast/core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "App composition layer with plugin system for @cfast/* packages",
   "keywords": [
     "cfast",
@@ -36,14 +36,18 @@
   "publishConfig": {
     "access": "public"
   },
-  "dependencies": {
-    "@cfast/env": "0.1.0",
-    "@cfast/permissions": "0.1.0"
-  },
   "peerDependencies": {
+    "@cfast/env": ">=0.1.0 <0.3.0",
+    "@cfast/permissions": ">=0.3.0 <0.5.0",
     "react": ">=18"
   },
   "peerDependenciesMeta": {
+    "@cfast/env": {
+      "optional": false
+    },
+    "@cfast/permissions": {
+      "optional": false
+    },
     "react": {
       "optional": true
     }
@@ -55,7 +59,9 @@
     "react-dom": "^19.2.4",
     "tsup": "^8",
     "typescript": "^5.7",
-    "vitest": "^4.1.0"
+    "vitest": "^4.1.0",
+    "@cfast/env": "0.1.1",
+    "@cfast/permissions": "0.4.0"
   },
   "scripts": {
     "build": "tsup src/index.ts src/client/index.ts --format esm --dts",