create-stitchkit 0.6.1 → 0.6.2

package/CHANGELOG.md

@@ -12,6 +12,31 @@ step is overwritten by the next release.
 
 ## [Unreleased]
 
+## [0.6.2] — 2026-09-21
+
+### Fixed
+
+- **A scaffold installs the framework the manifest promises.** 0.6.1 rode in the
+  same release train as stitchkit 0.90.6 and therefore shipped a lockfile
+  resolving 0.90.5: a lockfile is written by an install, so it could not name a
+  version that train had not published yet. Every scaffold from 0.6.1 got a
+  framework one release behind the one its own range allowed. The template now
+  targets `^0.90.7` over a lockfile resolving 0.90.7, and the framework's release
+  machinery refuses that shape of train outright.
+
+### Changed
+
+- **The generated frontend takes its QueryClient from the framework.**
+  `lib/query-client.ts` now calls `createQueryClientFactory` from
+  `stitchkit/react` instead of restating it locally. The local copy spelled the
+  query retry as a plain `1`, which retries an unauthorized, forbidden or invalid
+  request exactly as eagerly as a network blip; the framework predicate retries
+  server failures and network faults and leaves the rest alone. Request-local
+  server identity, the browser singleton, pending dehydration and the
+  no-retry-for-mutations rule are unchanged in behaviour. This is the cutover
+  `UPGRADING.md` recorded under *Released migration: 0.6.1* — adopting it in a
+  project you already own remains optional.
+
 ## [0.6.1] — 2026-09-20
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-stitchkit",
-  "version": "0.6.1",
+  "version": "0.6.2",
   "description": "Create a production-shaped Stitchkit application",
   "license": "MIT",
   "author": "Max Listov <maxlistov@gmail.com>",

package/template/bun.lock

@@ -145,7 +145,7 @@
     "zod": "4.6.5",
   },
   "catalog": {
-    "stitchkit": "^0.90.5",
+    "stitchkit": "^0.90.7",
   },
   "packages": {
     "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.87", "", { "dependencies": { "@ai-sdk/provider": "4.0.17", "@ai-sdk/provider-utils": "5.0.45", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-6wJmX/D5OO7tvDJbtFdXdBuRt8AkCnW+FLK+W35UHe/tHgolAa4hclXtJcMSYnlTDy/t5DNRgdesVaoMXtwzow=="],
@@ -906,7 +906,7 @@
 
     "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="],
 
-    "ky": ["ky@2.0.2", "", {}, "sha512-/GmXpo9F9W+f8n4Ivr2iH+7h7wL7jLbLKWkMlpflcCRb6kGjBfTlASEXaZ9qUgNTn4VgS0P2pwxxzQ4EM6Ulgg=="],
+    "ky": ["ky@2.1.0", "", {}, "sha512-nIKwelw+7qVqKOlX4Eht6GXfEXlDHcdIjyLWV3s119kYt5s+70ayTnYS+0fRNmtgGRRAfqdeWQbh8YizqkS0ng=="],
 
     "lightningcss": ["lightningcss@1.32.0", "", { "dependencies": { "detect-libc": "^2.0.3" }, "optionalDependencies": { "lightningcss-android-arm64": "1.32.0", "lightningcss-darwin-arm64": "1.32.0", "lightningcss-darwin-x64": "1.32.0", "lightningcss-freebsd-x64": "1.32.0", "lightningcss-linux-arm-gnueabihf": "1.32.0", "lightningcss-linux-arm64-gnu": "1.32.0", "lightningcss-linux-arm64-musl": "1.32.0", "lightningcss-linux-x64-gnu": "1.32.0", "lightningcss-linux-x64-musl": "1.32.0", "lightningcss-win32-arm64-msvc": "1.32.0", "lightningcss-win32-x64-msvc": "1.32.0" } }, "sha512-NXYBzinNrblfraPGyrbPoD19C1h9lfI/1mzgWYvXUTe414Gz/X1FD2XBZSZM7rRTrMA8JL3OtAaGifrIKhQ5yQ=="],
 
@@ -1128,7 +1128,7 @@
 
     "std-env": ["std-env@3.10.0", "", {}, "sha512-5GS12FdOZNliM5mAOxFRg7Ir0pWz8MdpYm6AY6VPkGpbA7ZzmbzNcBJQ0GPvvyWgcY7QAhCgf9Uy89I03faLkg=="],
 
-    "stitchkit": ["stitchkit@0.90.5", "", { "dependencies": { "ky": "^2.0.2" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.0.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.1", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.3.14", "ai": "^7.0.0", "grammy": "^1.45.1", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5", "zod": "^4.4.3" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/upgrade-cli.js" } }, "sha512-DCkHJYXbDB6VNUUgi0gnSsrB3ukrYBYKzyT072dkFLFrBUhg+lRmfgLFL+fAs+XKO7IB+xfCcpSw2lop/wxLBw=="],
+    "stitchkit": ["stitchkit@0.90.7", "", { "dependencies": { "ky": "^2.1.0" }, "peerDependencies": { "@modelcontextprotocol/ext-apps": "^1.7.2 || ^2.0.0", "@modelcontextprotocol/server": "^2.0.0", "@openrouter/ai-sdk-provider": "^3.1.0", "@opentelemetry/api": "^1.9.0", "@socket.io/bun-engine": "^0.1.2", "@socket.io/component-emitter": "^3.1.2", "@tanstack/react-query": ">=5", "@types/bun": "^1.4.2", "ai": "^7.0.107", "google-auth-library": "^11.1.0", "grammy": "^1.46.0", "maxmind": "^5.0.7", "react": ">=18", "react-query-kit": "^3.3.3", "socket.io": "^4.8.3", "socket.io-client": "^4.8.3", "srvx": "^0.12.5 || ^1.0.5", "zod": "^4.6.5" }, "optionalPeers": ["@modelcontextprotocol/ext-apps", "@modelcontextprotocol/server", "@openrouter/ai-sdk-provider", "@opentelemetry/api", "@socket.io/bun-engine", "@socket.io/component-emitter", "@tanstack/react-query", "@types/bun", "ai", "google-auth-library", "grammy", "maxmind", "react", "react-query-kit", "socket.io", "socket.io-client", "srvx"], "bin": { "stitchkit": "dist/upgrade-cli.js" } }, "sha512-My36iuzUc4FULJ26jIQK/czwY+uBy8MRh6AgbnvQNBIvo4fghuiINmN501uoJzeN7JM8v4J1C6fqjwA/XNxf/A=="],
 
     "stringify-entities": ["stringify-entities@4.0.4", "", { "dependencies": { "character-entities-html4": "^2.0.0", "character-entities-legacy": "^3.0.0" } }, "sha512-IwfBptatlO+QCJUo19AqvrPNqlVMpW9YEL2LIVY+Rpv2qsjCGxaDLNRgeGsQWJhfItebuJhsGSLjaBbNSQ+ieg=="],
 

package/template/package.json

@@ -7,7 +7,7 @@
     "packages/*"
   ],
   "catalog": {
-    "stitchkit": "^0.90.5"
+    "stitchkit": "^0.90.7"
   },
   "overrides": {
     "@playwright/test": "1.63.0",

package/template/packages/frontend/src/lib/query-client.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from 'bun:test';
+import { ApiError } from 'stitchkit';
 import { getQueryClient } from './query-client';
 
 describe('query dehydration policy', () => {
@@ -20,9 +21,25 @@ describe('query dehydration policy', () => {
     expect(shouldDehydrate(pending)).toBe(true);
   });
 
-  test('retries a query once and never retries a mutation', () => {
+  test('retries a server failure once and never retries a mutation', () => {
+    // Asserted through the decision, not through the literal: the policy is a
+    // predicate now, and `retry === 1` would pass for a client that retries an
+    // unauthorized request too.
     const defaults = getQueryClient().getDefaultOptions();
-    expect(defaults.queries?.retry).toBe(1);
+    const retry = defaults.queries?.retry;
+    if (typeof retry !== 'function') throw new Error('query retry policy is required');
+    const serverFailure = new ApiError('INTERNAL_SERVER_ERROR', 500);
+    expect(retry(0, serverFailure)).toBe(true);
+    expect(retry(1, serverFailure)).toBe(false);
     expect(defaults.mutations?.retry).toBe(false);
   });
+
+  test('a request the user cannot repeat into success is not retried', () => {
+    const defaults = getQueryClient().getDefaultOptions();
+    const retry = defaults.queries?.retry;
+    if (typeof retry !== 'function') throw new Error('query retry policy is required');
+    for (const code of ['UNAUTHORIZED', 'FORBIDDEN', 'VALIDATION_ERROR']) {
+      expect(retry(0, new ApiError(code, 401))).toBe(false);
+    }
+  });
 });

package/template/packages/frontend/src/lib/query-client.ts

@@ -1,36 +1,17 @@
-import {
-  defaultShouldDehydrateQuery,
-  environmentManager,
-  QueryClient,
-  type QueryClientConfig,
-} from '@tanstack/react-query';
 import { cache } from 'react';
+import { createQueryClientFactory } from 'stitchkit/react';
 
-// The template targets the published catalog release, so it cannot import
-// `createQueryClientFactory` yet; the retry policy below is the part of that
-// factory a released core already lets it state. UPGRADING names the cutover.
-const config = {
-  defaultOptions: {
-    // One retry for queries, none for mutations — a mutation retried on a
-    // timeout may run twice; a query only reads.
-    queries: { staleTime: 30_000, retry: 1 },
-    mutations: { retry: false },
-    dehydrate: {
-      shouldDehydrateQuery: (query) =>
-        defaultShouldDehydrateQuery(query) || query.state.status === 'pending',
-    },
+// One request-local server client and one browser singleton, both from the
+// framework. The local construction this replaced was a second implementation
+// of the same thing: it restated the dehydration policy and the mutation rule,
+// and it spelled the query retry as a plain `1`, which retries an unauthorized
+// or invalid request exactly as eagerly as a network blip. `apiErrorRetry` —
+// the factory's default — retries what is worth retrying and nothing else.
+// Project-specific cache configuration and mutation toasts belong in these
+// options, never in a copy of the framework's retry predicate.
+export const getQueryClient = createQueryClientFactory({
+  serverCache: cache,
+  queryClient: {
+    defaultOptions: { queries: { staleTime: 30_000 } },
   },
-} satisfies QueryClientConfig;
-
-function createQueryClient(): QueryClient {
-  return new QueryClient(config);
-}
-
-const getServerQueryClient = cache(createQueryClient);
-let browserQueryClient: QueryClient | undefined;
-
-export function getQueryClient(): QueryClient {
-  if (environmentManager.isServer()) return getServerQueryClient();
-  browserQueryClient ??= createQueryClient();
-  return browserQueryClient;
-}
+});