zitejs 0.10.0-start.6 → 0.10.0-start.7

package/dist/esm/start/instance.d.ts

@@ -1,12 +1,11 @@
 import { type AnySerializationAdapter } from "@tanstack/react-router";
 import type { SSROption } from "@tanstack/router-core";
 import type { AnyFunctionMiddleware, AnyRequestMiddleware, StartInstance } from "@tanstack/start-client-core";
-import { ZiteError } from "./index.js";
 /**
  * The start instance every Start app builds with: the platform's middleware and
  * adapters first, then whatever the app's own `src/start.ts` sets.
  */
-export declare function createZiteStart<const TAdapters extends ReadonlyArray<AnySerializationAdapter> = [], TDefaultSsr extends SSROption = SSROption, const TRequest extends ReadonlyArray<AnyRequestMiddleware> = [], const TFunction extends ReadonlyArray<AnyFunctionMiddleware> = []>(app?: StartInstance<TAdapters, TDefaultSsr, TRequest, TFunction>): StartInstance<readonly [import("@tanstack/react-router").SerializationAdapter<ZiteError, {
+export declare function createZiteStart<const TAdapters extends ReadonlyArray<AnySerializationAdapter> = [], TDefaultSsr extends SSROption = SSROption, const TRequest extends ReadonlyArray<AnyRequestMiddleware> = [], const TFunction extends ReadonlyArray<AnyFunctionMiddleware> = []>(app?: StartInstance<TAdapters, TDefaultSsr, TRequest, TFunction>): StartInstance<readonly [import("@tanstack/react-router").SerializationAdapter<Error, {
     code: "BAD_REQUEST" | "UNAUTHORIZED" | "FORBIDDEN" | "NOT_FOUND" | "CONFLICT" | "RATE_LIMITED" | "INTERNAL_ERROR" | "INVALID_INPUT";
     message: string;
 }, never>, ...TAdapters], TDefaultSsr, readonly [import("@tanstack/react-start").RequestMiddlewareAfterServer<{}, undefined, undefined>, ...TRequest], readonly [import("@tanstack/react-start").FunctionMiddlewareAfterClient<{}, unknown, undefined, undefined, undefined>, import("@tanstack/react-start").FunctionMiddlewareAfterServer<{}, unknown, undefined, undefined, undefined, undefined, undefined>, ...TFunction]>;

package/dist/esm/start/instance.js

@@ -2,7 +2,8 @@
 // `src/start.ts`, which the generated instance composes after the platform's.
 import { createCsrfMiddleware, createMiddleware, createStart } from "@tanstack/react-start";
 import { createSerializationAdapter, redirect } from "@tanstack/react-router";
-import { isSignInRequired, loginHref, ZiteError } from "./index.js";
+import { toClientError, ZiteError } from "./errors.js";
+import { isSignInRequired, loginHref } from "./index.js";
 import { errorOf, preview } from "./runLog.js";
 import { getHost, inScope } from "./scope.js";
 // TanStack drops its default CSRF check once an app has a start instance.
@@ -47,11 +48,17 @@ const runCapture = createMiddleware({ type: "function" }).server(async ({ next,
         throw error;
     }
 });
-/** Carries a ZiteError to the browser as itself, so `instanceof ZiteError` and `.code` work there. */
+/**
+ * Every error a server function or a page's loader sends the browser arrives as a ZiteError, with its code and the
+ * message classic would show. Anything else on it, a stack or an SDK's request, stays on the server.
+ */
 const ziteErrorAdapter = createSerializationAdapter({
     key: "zite-error",
-    test: (value) => value instanceof ZiteError,
-    toSerializable: (error) => ({ code: error.code, message: error.message }),
+    test: (value) => value instanceof Error,
+    toSerializable: (error) => {
+        const { code, message } = toClientError(error);
+        return { code, message };
+    },
     fromSerializable: ({ code, message }) => new ZiteError(code, message),
 });
 /**

package/dist/esm/start/previewClaim.d.ts

@@ -0,0 +1,10 @@
+export declare const PREVIEW_CLAIM_PARAM = "zite_preview";
+export declare const PREVIEW_CLAIM_HEADER = "x-zite-preview";
+/**
+ * An editor preview's access, which the host keeps on the URL because the editor's frame may drop its cookie (WebKit
+ * drops even Partitioned ones). On the server the host hands it over; in the browser it's on the URL the host sent
+ * the page to, read once, before the router hides it.
+ */
+export declare const previewClaim: () => string | undefined;
+/** Every same-origin fetch from the page carries the claim: server functions and the app's own routes alike. */
+export declare const carryPreviewClaim: (claim: string) => void;

package/dist/esm/start/previewClaim.js

@@ -0,0 +1,32 @@
+import { currentHost } from "./host.js";
+// The host's names (apps/zite-host/src/previewClaim.ts).
+export const PREVIEW_CLAIM_PARAM = "zite_preview";
+export const PREVIEW_CLAIM_HEADER = "x-zite-preview";
+let captured;
+/**
+ * An editor preview's access, which the host keeps on the URL because the editor's frame may drop its cookie (WebKit
+ * drops even Partitioned ones). On the server the host hands it over; in the browser it's on the URL the host sent
+ * the page to, read once, before the router hides it.
+ */
+export const previewClaim = () => {
+    if (typeof window === "undefined")
+        return currentHost()?.previewClaim;
+    captured ??= new URL(window.location.href).searchParams.get(PREVIEW_CLAIM_PARAM);
+    return captured ?? undefined;
+};
+let carrying = false;
+/** Every same-origin fetch from the page carries the claim: server functions and the app's own routes alike. */
+export const carryPreviewClaim = (claim) => {
+    if (carrying || typeof window === "undefined")
+        return;
+    carrying = true;
+    const original = window.fetch.bind(window);
+    window.fetch = (input, init) => {
+        const target = new URL(input instanceof Request ? input.url : String(input), window.location.href);
+        if (target.origin !== window.location.origin)
+            return original(input, init);
+        const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));
+        headers.set(PREVIEW_CLAIM_HEADER, claim);
+        return original(input, { ...init, headers });
+    };
+};

package/dist/esm/start/redactSecrets.d.ts

@@ -0,0 +1,7 @@
+export declare const REDACTED = "REDACTED";
+/**
+ * Replace any credentials in `text` with a placeholder, leaving the rest
+ * intact. Returns the input unchanged when there is nothing to redact, so
+ * callers that pass clean text see byte-identical output.
+ */
+export declare function redactSecrets(text: string): string;

package/dist/esm/start/redactSecrets.js

@@ -0,0 +1,131 @@
+// Ported from restly's shared/src/redactSecrets.ts, so a live Start app redacts
+// exactly what a classic one does. Keep the two in step.
+export const REDACTED = "REDACTED";
+/**
+ * A run of characters that can plausibly be a secret's value. Stops at
+ * whitespace and at the punctuation that normally *ends* a value in a sentence
+ * or a serialized payload, so the redaction does not swallow the rest of the
+ * text after it.
+ */
+const VALUE_RUN = String.raw `[^\s,;)\]}"'<>]+`;
+const CREDENTIAL_KEY = String.raw `(?:password|passwd|secret|api[_-]?key|apikey|access[_-]?token|refresh[_-]?token|auth[_-]?token|client[_-]?secret|private[_-]?key)`;
+// The scheme is length-capped because, unbounded, every position in a long
+// alphanumeric run (hex, a base64 blob) rescans to the end of the run —
+// quadratic, and minutes of blocked event loop on a megabyte of output.
+const URL_USERINFO = String.raw `([a-z][a-z0-9+.-]{0,31}:\/\/[^\s:/@]+:)`;
+const JSON_MEMBER = String.raw `("${CREDENTIAL_KEY}"\s*:\s*")`;
+const JSON_VALUE = String.raw `(?:[^"\\]|\\.)*`;
+const ESCAPED_JSON_MEMBER = String.raw `(\\"${CREDENTIAL_KEY}\\"\s*:\s*\\")`;
+const ESCAPED_JSON_VALUE = String.raw `(?:[^"\\]|\\\\(?:\\["\\]|[^"\\]))*`;
+const PATTERNS = [
+    {
+        // URL userinfo: scheme://user:password@host. Keeps the scheme, the user,
+        // and the host — the parts that identify *which* connection failed.
+        pattern: new RegExp(URL_USERINFO + String.raw `[^\s@/]+(@)`, "gi"),
+        replace: `$1${REDACTED}$2`,
+    },
+    {
+        // Bearer tokens. RFC 6750 `token68` permits a single character, so a length
+        // floor lets short opaque tokens through. Same shape guard as Basic below:
+        // reject a value that is one alphabetic word, so "Bearer token required"
+        // survives while anything mixing case or digits is redacted. Case-sensitive
+        // for the same reason as Basic, so the scheme is spelled out.
+        //
+        // `Token` is deliberately not treated as a scheme: it is a GitHub-ism
+        // rather than a registered one, and "Token" is a common enough English word
+        // that it matched the next word in prose. The credentials it precedes are
+        // already covered by the `gh*_` prefixes below.
+        pattern: new RegExp(String.raw `\b([Bb]earer)\s+(?![A-Za-z][a-z]*(?![A-Za-z0-9._~+/=-]))([A-Za-z0-9._~+/=-]+)`, "g"),
+        replace: `$1 ${REDACTED}`,
+    },
+    {
+        // Basic credentials are base64 of "user:pass" and can be legitimately
+        // short — base64("u:pw") is four characters — so the 16-char floor used for
+        // Bearer would let real credentials through.
+        //
+        // Length alone therefore cannot separate a credential from prose, and
+        // "Basic plan" / "Basic tier" / "Basic Auth" are exactly the kind of copy a
+        // subscription app writes. The guard is shape instead: reject the value if
+        // it is a single alphabetic word (one letter followed by lowercase to the
+        // end of the token). Base64 of any realistic "user:pass" mixes case or
+        // digits and so survives the guard, while an English word does not.
+        //
+        // Case-sensitive by necessity — an `i` flag would make `[a-z]` match
+        // uppercase and collapse that distinction — so the scheme is spelled out
+        // to still accept the lowercase form.
+        pattern: new RegExp(String.raw `\b([Bb]asic)\s+(?![A-Za-z][a-z]*(?![A-Za-z0-9+/=]))([A-Za-z0-9+/=]{4,})`, "g"),
+        replace: `$1 ${REDACTED}`,
+    },
+    {
+        // JWTs, which carry claims and are frequently the credential itself. The
+        // header is capped for the same reason as the scheme above (a run of
+        // `-eyJ` fragments restarts at each one); a JWT has to fit in an HTTP
+        // header, so 8KB loses nothing real.
+        pattern: /\beyJ[A-Za-z0-9_-]{8,8192}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]+/g,
+        replace: REDACTED,
+    },
+    {
+        // Provider secret keys, matched on each vendor's published prefix.
+        // OpenAI/Anthropic `sk-`, Stripe `sk_live_`/`sk_test_`/`rk_live_`.
+        // Stripe's publishable `pk_` keys are deliberately absent: they are
+        // designed to ship to browsers, so redacting them only loses detail.
+        pattern: /\b(?:sk-(?:ant-)?|sk_live_|sk_test_|rk_live_)[A-Za-z0-9_-]{16,}/g,
+        replace: REDACTED,
+    },
+    {
+        // AWS access key ids (AKIA long-lived, ASIA temporary) and Google API keys.
+        // Google's are documented as AIza + 35 chars; the open-ended quantifier
+        // means an unexpectedly long variant is redacted whole rather than having
+        // its first 39 characters replaced and the remainder left exposed.
+        pattern: /\b(?:A[KS]IA[0-9A-Z]{16}\b|AIza[0-9A-Za-z_-]{35,})/g,
+        replace: REDACTED,
+    },
+    {
+        // GitHub (`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`) and Slack (`xoxb-` etc).
+        pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|xox[abprs]-[A-Za-z0-9-]{10,})\b/g,
+        replace: REDACTED,
+    },
+    {
+        // Credential-bearing key/value pairs, in query strings, connection strings
+        // and serialized config alike. Anchored on the key name plus its separator,
+        // and the key must be a whole token so an app's "reset_password_url=..."
+        // style key is not mistaken for the secret itself.
+        //
+        // The leading boundary is a captured alternation rather than a lookbehind:
+        // this module is exported from @fillout/shared and so can be bundled into
+        // the frontend, where an unsupported lookbehind would throw while building
+        // the RegExp at module load and take the whole bundle down with it.
+        pattern: new RegExp(String.raw `(^|[^\w-])(${CREDENTIAL_KEY})(\s*[:=]\s*)` + VALUE_RUN, "gi"),
+        replace: `$1$2$3${REDACTED}`,
+    },
+    {
+        // The same keys as JSON string members. The closing quote after the key
+        // sits between it and the colon, so the pattern above never sees them.
+        pattern: new RegExp(JSON_MEMBER + JSON_VALUE + '"', "gi"),
+        replace: `$1${REDACTED}"`,
+    },
+    {
+        // ...and as members of JSON serialized into another JSON string, where
+        // every quote arrives as \" and the value's own escapes are doubled, so a
+        // \\\" inside the value is an escaped quote rather than its end.
+        pattern: new RegExp(ESCAPED_JSON_MEMBER + ESCAPED_JSON_VALUE + String.raw `\\"`, "gi"),
+        replace: `$1${REDACTED}\\"`,
+    },
+];
+/**
+ * Replace any credentials in `text` with a placeholder, leaving the rest
+ * intact. Returns the input unchanged when there is nothing to redact, so
+ * callers that pass clean text see byte-identical output.
+ */
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let result = text;
+    for (const { pattern, replace } of PATTERNS) {
+        // The patterns are global, so reset lastIndex — these RegExp objects are
+        // module-level and reused across calls.
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, replace);
+    }
+    return result;
+}

package/dist/esm/start/redactSecrets.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/esm/start/redactSecrets.test.js

@@ -0,0 +1,151 @@
+// Classic's cases (restly shared/src/redactSecrets.test.ts), for the port beside it.
+import { describe, it, expect } from 'vitest';
+import { redactSecrets, REDACTED } from './redactSecrets.js';
+describe('redactSecrets', () => {
+    describe('keeps the surrounding message', () => {
+        it('redacts a connection string password but keeps scheme, user and host', () => {
+            expect(redactSecrets('Failed to sync roster: postgres://svc:hunter2@db.internal:5432/prod')).toBe(`Failed to sync roster: postgres://svc:${REDACTED}@db.internal:5432/prod`);
+        });
+        it('leaves the sentence readable around a redacted key', () => {
+            expect(redactSecrets('Stripe rejected the charge (key sk_live_abcdefghijklmnop1234) — retry later')).toBe(`Stripe rejected the charge (key ${REDACTED}) — retry later`);
+        });
+        it('does not swallow text following a key=value pair', () => {
+            expect(redactSecrets('config invalid: api_key=abc123def456, region=us-west-2')).toBe(`config invalid: api_key=${REDACTED}, region=us-west-2`);
+        });
+    });
+    describe('credential formats', () => {
+        it('redacts bearer tokens', () => {
+            expect(redactSecrets('Authorization: Bearer abcdef1234567890XYZ')).toBe(`Authorization: Bearer ${REDACTED}`);
+        });
+        it('redacts a short opaque bearer token', () => {
+            // RFC 6750 token68 permits values this short, so shape decides, not length.
+            expect(redactSecrets('Authorization: Bearer abc123')).toBe(`Authorization: Bearer ${REDACTED}`);
+        });
+        it('redacts short Basic credentials, which base64 makes legitimately tiny', () => {
+            // base64("u:pw") — four characters.
+            expect(redactSecrets('Authorization: Basic dTpw')).toBe(`Authorization: Basic ${REDACTED}`);
+            expect(redactSecrets('basic YWI6Y2Q=')).toBe(`basic ${REDACTED}`);
+        });
+        it('redacts a full-length Basic credential', () => {
+            expect(redactSecrets('Basic YWxhZGRpbjpvcGVuc2VzYW1l')).toBe(`Basic ${REDACTED}`);
+        });
+        it('redacts JWTs', () => {
+            const jwt = 'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dQw4w9WgXcQ';
+            expect(redactSecrets(`token rejected: ${jwt}`)).toBe(`token rejected: ${REDACTED}`);
+        });
+        it('redacts OpenAI and Anthropic style keys', () => {
+            expect(redactSecrets('sk-ant-api03-abcdefghijklmnopqrstuv')).toBe(REDACTED);
+            expect(redactSecrets('sk-abcdefghijklmnopqrstuvwxyz')).toBe(REDACTED);
+        });
+        it('redacts AWS access key ids and Google API keys', () => {
+            expect(redactSecrets('using AKIAIOSFODNN7EXAMPLE for s3')).toBe(`using ${REDACTED} for s3`);
+            expect(redactSecrets('key AIzaSyA1234567890abcdefghijklmnopqrstuvw rejected')).toBe(`key ${REDACTED} rejected`);
+        });
+        it('redacts GitHub and Slack tokens', () => {
+            expect(redactSecrets('ghp_abcdefghijklmnopqrstuvwxyz0123456789')).toBe(REDACTED);
+            expect(redactSecrets('xoxb-1234567890-abcdefghij')).toBe(REDACTED);
+        });
+        it('redacts credential key/value pairs in either separator style', () => {
+            expect(redactSecrets('password: hunter2')).toBe(`password: ${REDACTED}`);
+            expect(redactSecrets('client_secret=s3cr3tvalue')).toBe(`client_secret=${REDACTED}`);
+        });
+        it('redacts the secret in a URL-encoded token exchange body', () => {
+            expect(redactSecrets('grant_type=client_credentials&client_id=3MVG9abc&client_secret=8F2A1B9C')).toBe(`grant_type=client_credentials&client_id=3MVG9abc&client_secret=${REDACTED}`);
+        });
+        it('redacts credential members of a JSON body, keeping the rest', () => {
+            expect(redactSecrets('{"client_id":"3MVG9abc","client_secret":"8F2A1B9C","grant_type":"client_credentials"}')).toBe(`{"client_id":"3MVG9abc","client_secret":"${REDACTED}","grant_type":"client_credentials"}`);
+            expect(redactSecrets('{"refreshToken": "a\\"b", "page": 2}')).toBe(`{"refreshToken": "${REDACTED}", "page": 2}`);
+        });
+        it('redacts credential members of JSON serialized inside a JSON string', () => {
+            expect(redactSecrets(String.raw `{"body":"{\"client_secret\":\"8F2A1B9C\",\"grant_type\":\"client_credentials\"}"}`)).toBe(String.raw `{"body":"{\"client_secret\":\"${REDACTED}\",\"grant_type\":\"client_credentials\"}"}`);
+            expect(redactSecrets(String.raw `{\"password\":\"a\\\"b\\\\\",\"page\":2}`)).toBe(String.raw `{\"password\":\"${REDACTED}\",\"page\":2}`);
+        });
+        it('redacts a key at the start of a line in a multi-line message', () => {
+            expect(redactSecrets('connection failed\napi_key=abc123def456')).toBe(`connection failed\napi_key=${REDACTED}`);
+        });
+        it('redacts every occurrence, not just the first', () => {
+            expect(redactSecrets('api_key=aaa111 and api_key=bbb222')).toBe(`api_key=${REDACTED} and api_key=${REDACTED}`);
+        });
+    });
+    describe('leaves app-authored prose alone', () => {
+        it('does not touch an ordinary user-facing message', () => {
+            const message = 'CAPACITY EXCEEDED: The following week(s) are now full: Week #11. Please select different weeks or join the waitlist.';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not touch a parseable frontend signal', () => {
+            const message = 'CLOTHES_CHANGE_PENDING:recSHyUztFA6rF5UA';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not redact prose that merely mentions a password', () => {
+            const message = 'Your password must be at least 8 characters long.';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not redact the word "Bearer" without a token-shaped value', () => {
+            const message = 'Include a Bearer token in the Authorization header.';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not redact "Basic" followed by an ordinary word', () => {
+            // The reason the Basic matcher guards on shape rather than length: a
+            // subscription app's own copy reads exactly like a short credential.
+            for (const message of [
+                'Your Basic plan does not include this feature.',
+                'Basic tier limits reached.',
+                'Basic Auth is required for this endpoint.',
+                'Upgrade from Basic Plan to continue.',
+            ]) {
+                expect(redactSecrets(message)).toBe(message);
+            }
+        });
+        it('does not redact a Stripe publishable key, which is meant to be public', () => {
+            const message = 'pk_live_abcdefghijklmnop1234 is not a secret key';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not treat a URL with a port as userinfo', () => {
+            const message = 'GET https://api.example.com:8443/v1/records failed';
+            expect(redactSecrets(message)).toBe(message);
+        });
+        it('does not match a credential key embedded in a longer name', () => {
+            // "reset_password_url" ends in "password" but names a link, not a secret.
+            const message = 'reset_password_url=https://example.org/reset';
+            expect(redactSecrets(message)).toBe(message);
+            const json = '{"reset_password_url":"https://example.org/reset"}';
+            expect(redactSecrets(json)).toBe(json);
+        });
+        it('returns short or empty input untouched', () => {
+            expect(redactSecrets('')).toBe('');
+            expect(redactSecrets('nope')).toBe('nope');
+        });
+    });
+    describe('repeated use', () => {
+        it('is stable across calls despite module-level global regexes', () => {
+            const message = 'api_key=abc123def456';
+            const first = redactSecrets(message);
+            const second = redactSecrets(message);
+            expect(first).toBe(second);
+            expect(first).toBe(`api_key=${REDACTED}`);
+        });
+        it('is idempotent', () => {
+            const once = redactSecrets('postgres://svc:hunter2@db.internal/prod');
+            expect(redactSecrets(once)).toBe(once);
+        });
+    });
+    describe('large input', () => {
+        // It runs synchronously on raw sandbox output, so anything worse than
+        // linear blocks the event loop long enough to fail health checks. Both
+        // inputs took several seconds at this size before the patterns were capped.
+        it.each([
+            ['an unbroken alphanumeric run', 'aB3dE9fG1h'],
+            ['a run of -eyJ fragments', '-eyJabcdefgh'],
+        ])('stays fast on %s', (_, unit) => {
+            const text = unit.repeat(10_000);
+            const started = performance.now();
+            expect(redactSecrets(text)).toBe(text);
+            expect(performance.now() - started).toBeLessThan(2000);
+        });
+        it('still redacts a long scheme and a JWT after the caps', () => {
+            expect(redactSecrets('averyveryveryveryveryveryverylongscheme://svc:hunter2@db.internal')).toBe(`averyveryveryveryveryveryverylongscheme://svc:${REDACTED}@db.internal`);
+            const jwt = 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U';
+            expect(redactSecrets(`x-${jwt}`)).toBe(`x-${REDACTED}`);
+        });
+    });
+});

package/dist/esm/start/router.d.ts

@@ -1,17 +1,20 @@
+import { QueryClient } from "@tanstack/react-query";
 import { type AnyRoute, type RouterConstructorOptions, type RouterHistory } from "@tanstack/react-router";
 import type { User } from "./types.js";
 /** The router context every Zite app's root route declares: `createRootRouteWithContext<ZiteRouterContext>()`. */
 export type ZiteRouterContext = {
     user: User | null;
+    queryClient: QueryClient;
 };
 type Dehydrated = {
     user: User | null;
 };
 type ZiteRouterOptions<TRouteTree extends AnyRoute> = Omit<RouterConstructorOptions<TRouteTree, "never", false, RouterHistory, Dehydrated>, "context" | "dehydrate" | "hydrate">;
 /**
- * The router for `src/router.tsx`. The signed-in user is in `context.user`: on
- * the server from the platform, in the browser from the page it rendered, so
- * no request asks for it again.
+ * The router for `src/router.tsx`. The signed-in user is in `context.user`: on the server from the platform, in the
+ * browser from the page it rendered, so no request asks for it again. `context.queryClient` is new for each request
+ * on the server, so a page never renders with another visitor's cached queries, and its queries reach the browser
+ * with the page.
  */
 export declare function createZiteRouter<TRouteTree extends AnyRoute>(options: ZiteRouterOptions<TRouteTree>): import("@tanstack/router-core").RouterCore<TRouteTree, "never", false, RouterHistory, Dehydrated>;
 export {};

package/dist/esm/start/router.js

@@ -1,35 +1,75 @@
-import { createElement as h } from "react";
+import { createElement as h, useEffect, useState } from "react";
+import { QueryClient } from "@tanstack/react-query";
 import { createRouter, Link, useRouter, } from "@tanstack/react-router";
+import { setupRouterSsrQueryIntegration } from "@tanstack/react-router-ssr-query";
+import { toClientError } from "./errors.js";
+import { carryPreviewClaim, PREVIEW_CLAIM_PARAM, previewClaim } from "./previewClaim.js";
 import { currentHost } from "./host.js";
+const ziteWindow = () => (typeof window === "undefined" ? undefined : window);
 const box = { maxWidth: 480, margin: "15vh auto", padding: 24, fontFamily: "system-ui, sans-serif", textAlign: "center" };
+// As classic's crash screen: the message, "Fix it for me" in the editor, and a reload. The server renders from the
+// app's own error and the browser from the one that crossed, already mapped, so both show the same text.
 function ZiteErrorComponent({ error }) {
     const router = useRouter();
-    const message = error instanceof Error && error.name === "ZiteError" ? error.message : "Something went wrong.";
-    return h("div", { role: "alert", style: box }, h("p", { style: { fontWeight: 600 } }, message), h("button", { type: "button", onClick: () => router.invalidate() }, "Try again"));
+    const [allowAiFix, setAllowAiFix] = useState(false);
+    useEffect(() => setAllowAiFix(ziteWindow()?.__ziteAllowAiFix === true), []);
+    const message = typeof window === "undefined" ? toClientError(error).message : error instanceof Error ? error.message : String(error);
+    const reload = () => {
+        const onReload = ziteWindow()?._ziteOnReload;
+        if (onReload)
+            onReload();
+        else
+            router.invalidate();
+    };
+    return h("div", { role: "alert", style: box }, h("p", { style: { fontWeight: 600 } }, "Something went wrong"), h("pre", { style: { whiteSpace: "pre-wrap", textAlign: "left" } }, message), allowAiFix && h("button", { type: "button", onClick: () => ziteWindow()?._ziteOnFixError?.(error) }, "Fix it for me"), h("button", { type: "button", onClick: reload }, "Try again"));
 }
 function ZiteNotFound() {
     return h("div", { style: box }, h("p", { style: { fontWeight: 600 } }, "Page not found"), h(Link, { to: "/" }, "Go home"));
 }
+function ZitePending() {
+    return h("div", { "aria-busy": true, style: { ...box, color: "#888" } }, "Loading…");
+}
+// The claim stays on every URL the router writes, and the app's own routes never see it.
+const keepPreviewClaim = (claim, own) => ({
+    input: ({ url }) => {
+        url.searchParams.delete(PREVIEW_CLAIM_PARAM);
+        return own?.input?.({ url }) ?? url;
+    },
+    output: ({ url }) => {
+        const rewritten = own?.output?.({ url }) ?? url;
+        const out = new URL(rewritten.toString(), url);
+        out.searchParams.set(PREVIEW_CLAIM_PARAM, claim);
+        return out;
+    },
+});
 /**
- * The router for `src/router.tsx`. The signed-in user is in `context.user`: on
- * the server from the platform, in the browser from the page it rendered, so
- * no request asks for it again.
+ * The router for `src/router.tsx`. The signed-in user is in `context.user`: on the server from the platform, in the
+ * browser from the page it rendered, so no request asks for it again. `context.queryClient` is new for each request
+ * on the server, so a page never renders with another visitor's cached queries, and its queries reach the browser
+ * with the page.
  */
 export function createZiteRouter(options) {
-    const context = { user: currentHost()?.user ?? null };
+    const queryClient = new QueryClient();
+    const claim = previewClaim();
+    if (claim)
+        carryPreviewClaim(claim);
+    const context = { user: currentHost()?.user ?? null, queryClient };
     const router = createRouter({
         defaultPreload: "intent",
         defaultPreloadStaleTime: 0,
         scrollRestoration: true,
         defaultErrorComponent: ZiteErrorComponent,
         defaultNotFoundComponent: ZiteNotFound,
+        defaultPendingComponent: ZitePending,
         ...options,
+        ...(claim && { rewrite: keepPreviewClaim(claim, options.rewrite) }),
         context,
         dehydrate: () => ({ user: context.user }),
         hydrate: (dehydrated) => {
             context.user = dehydrated.user;
         },
     });
+    setupRouterSsrQueryIntegration({ router, queryClient });
     const host = currentHost();
     if (host)
         host.router = router;

package/dist/esm/start/runLog.d.ts

@@ -1,5 +1,8 @@
+import type { RunRecord, ZiteRequestContext } from "./types.js";
 export declare const preview: (value: unknown) => string | undefined;
-export declare const errorOf: (error: unknown) => {
-    code: string;
-    message: string;
-};
+export declare const errorOf: (error: unknown) => NonNullable<RunRecord["error"]>;
+/**
+ * A server route's run, which run capture doesn't see: its body in, and its status and body out. The bodies are
+ * read from copies after the fact, so the response never waits; the run log waits for them before it flushes.
+ */
+export declare function recordRoute<T>(host: ZiteRequestContext | undefined, request: Request, run: () => Promise<T>): Promise<T>;

package/dist/esm/start/runLog.js

@@ -1,5 +1,7 @@
-import { ZiteError } from "./index.js";
-const PREVIEW_LIMIT = 8_000;
+import { asZiteError } from "./errors.js";
+// Classic's per-field cap. The host caps again; this keeps a large value from crossing at all.
+const RUN_FIELD_LIMIT = 50 * 1024;
+const capped = (text) => (text.length > RUN_FIELD_LIMIT ? `${text.slice(0, RUN_FIELD_LIMIT)}…` : text);
 export const preview = (value) => {
     if (value === undefined)
         return undefined;
@@ -7,12 +9,68 @@ export const preview = (value) => {
         return "[stream]";
     try {
         const json = JSON.stringify(value);
-        return json && json.length > PREVIEW_LIMIT ? `${json.slice(0, PREVIEW_LIMIT)}…` : json;
+        return json === undefined ? undefined : capped(json);
     }
     catch {
         return "[unserializable]";
     }
 };
-export const errorOf = (error) => error instanceof ZiteError
-    ? { code: error.code, message: error.message }
-    : { code: "INTERNAL_ERROR", message: error instanceof Error ? error.message : String(error) };
+export const errorOf = (error) => ({
+    code: asZiteError(error)?.code ?? "INTERNAL_ERROR",
+    message: error instanceof Error ? error.message : String(error),
+    ...(error instanceof Error && error.stack ? { stack: capped(error.stack) } : {}),
+});
+const TEXT_BODY = /^(application\/(json|x-www-form-urlencoded)|text\/(?!event-stream))/i;
+// Up to the cap of a copy of the body, so the app still reads the original. Uploads and streams aren't read.
+const bodyText = async (message) => {
+    if (!message.body || !TEXT_BODY.test(message.headers.get("content-type") ?? ""))
+        return undefined;
+    const reader = message.clone().body.pipeThrough(new TextDecoderStream()).getReader();
+    let text = "";
+    try {
+        while (text.length <= RUN_FIELD_LIMIT) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            text += value;
+        }
+    }
+    finally {
+        reader.cancel().catch(() => { });
+    }
+    return capped(text);
+};
+/**
+ * A server route's run, which run capture doesn't see: its body in, and its status and body out. The bodies are
+ * read from copies after the fact, so the response never waits; the run log waits for them before it flushes.
+ */
+export async function recordRoute(host, request, run) {
+    if (!host)
+        return run();
+    const startedAt = Date.now();
+    const path = new URL(request.url).pathname;
+    const input = bodyText(request).catch(() => undefined);
+    const record = (outcome) => {
+        const durationMs = Date.now() - startedAt;
+        const recorded = (async () => {
+            const fields = { input: await input, ...(await outcome) };
+            host.runs.push({ fn: `route:${request.method} ${path}`, name: path, nested: false, startedAt, durationMs, ...fields });
+        })();
+        (host.pending ??= []).push(recorded.catch(() => { }));
+    };
+    try {
+        const out = await run();
+        const response = out instanceof Response ? out : out?.response;
+        if (response instanceof Response) {
+            record(bodyText(response).then((body) => ({ output: preview({ status: response.status, body }) }), () => ({})));
+        }
+        else {
+            record(Promise.resolve({}));
+        }
+        return out;
+    }
+    catch (error) {
+        record(Promise.resolve({ error: errorOf(error) }));
+        throw error;
+    }
+}

package/dist/esm/start/server.d.ts

@@ -12,19 +12,23 @@ export declare function installPlatformTransport(): void;
 /** What the host dispatched this request with. Headers are ignored: props are the only thing it alone can set. */
 export declare function hostContextFromProps(request: Request, props: HostProps): ZiteRequestContext;
 /**
- * A request the host didn't dispatch: `zitejs describe` under `vite preview`,
- * and tests, which pass their own platform. Deployed builds have no public URL,
- * so in production every request carries props.
+ * A request the host didn't dispatch: the host's warm-up, `zitejs describe` under `vite preview`, and tests. Only the
+ * host can set props, so without them a build answers warm and describe and nobody is signed in. An entry that passes
+ * its own platform (tests, local dev) owns its requests and may say who is calling in `x-zite-*` headers.
  */
 export declare function hostContextFromRequest(request: Request, platform?: PlatformBinding): ZiteRequestContext;
 /** Every server function TanStack compiled, written in by `zite()` at build. Empty in dev, where TanStack doesn't call its id hook. */
 export declare const builtFunctionIds: () => string[];
 /** Each server function's `description` option, written in by `zite()` at build. */
 export declare const builtFunctionDescriptions: () => Record<string, string>;
+/** Each route's file, by route id, written in by `zite()` at build. */
+export declare const builtRouteFiles: () => Record<string, string>;
 type Fetch = (request: Request, ...rest: unknown[]) => Promise<Response> | Response;
 type WorkerContext = {
     waitUntil(promise: Promise<unknown>): void;
 };
+/** On describe's answer: the zitejs this build's server code was bundled from. */
+export declare const RUNTIME_VERSION_HEADER = "x-zitejs-version";
 export type ZiteServerOptions = {
     handler: {
         fetch: Fetch;