zitejs 0.10.0-start.6 → 0.10.0-start.7

package/dist/esm/start/server.js

@@ -1,8 +1,10 @@
-import { ZiteError, ZITE_ERROR_STATUS } from "./index.js";
+import { asZiteError, isZiteErrorCode, ZiteError, ZITE_ERROR_STATUS } from "./errors.js";
 import { describeApp } from "./describe.js";
 import { runRegistration } from "./registration.js";
-import { preview } from "./runLog.js";
-import { getHost, requireScope, runWithHost } from "./scope.js";
+import { isAuthHookName, loadAuthHooks } from "./authHooks.js";
+import { errorOf, preview } from "./runLog.js";
+import { getHost, requireScope, runInScope, runWithHost } from "./scope.js";
+import { ZITEJS_VERSION } from "./version.js";
 import { loadWorkflows, loggedInput, runWorkflow } from "./workflowRun.js";
 export { runWithHost } from "./scope.js";
 export { describeApp } from "./describe.js";
@@ -23,8 +25,8 @@ export function installPlatformTransport() {
         const result = await (await host.session).call({ integrationId, className, methodName, params, access: scope.kind });
         if ("value" in result)
             return result.value;
-        const { code, message } = result.error;
-        throw new ZiteError(code in ZITE_ERROR_STATUS ? code : "INTERNAL_ERROR", message);
+        const { code, message, userFacingMessage } = result.error;
+        throw new ZiteError({ code: isZiteErrorCode(code) ? code : "INTERNAL_ERROR", message, userFacingMessage });
     };
     globalThis.__wrapSdkCall = sdkCall;
     watchOutboundFetches();
@@ -53,7 +55,9 @@ const watchOutboundFetches = () => {
     };
 };
 const decodeUser = (value) => JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(value.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
-const INVOKE_KINDS = new Set(["webhook", "describe", "workflow", "register", "warm"]);
+const INVOKE_KINDS = new Set(["webhook", "describe", "workflow", "register", "warm", "authHook"]);
+// What a request without props may ask for: neither runs app code on anyone's behalf.
+const UNHOSTED_INVOKE_KINDS = new Set(["warm", "describe"]);
 /** What the host dispatched this request with. Headers are ignored: props are the only thing it alone can set. */
 export function hostContextFromProps(request, props) {
     return {
@@ -62,32 +66,48 @@ export function hostContextFromProps(request, props) {
         user: props.user,
         mode: props.mode,
         invoke: props.invoke,
+        appUrl: props.appUrl,
+        baseId: props.baseId,
+        previewClaim: props.previewClaim,
         runs: [],
         platform: props.platform,
     };
 }
+// Classic sets these per run. Node and workerd both refuse getters on process.env, so each request writes what the
+// host sent, which is the same for every request a build serves: the live URL even on a demo.
+const setRequestEnv = ({ appUrl, baseId }) => {
+    const env = globalThis.process?.env;
+    if (!env)
+        return;
+    if (appUrl)
+        env.ZITE_APP_URL = appUrl;
+    if (baseId)
+        env.ZITE_BASE_ID = baseId;
+};
 /**
- * A request the host didn't dispatch: `zitejs describe` under `vite preview`,
- * and tests, which pass their own platform. Deployed builds have no public URL,
- * so in production every request carries props.
+ * A request the host didn't dispatch: the host's warm-up, `zitejs describe` under `vite preview`, and tests. Only the
+ * host can set props, so without them a build answers warm and describe and nobody is signed in. An entry that passes
+ * its own platform (tests, local dev) owns its requests and may say who is calling in `x-zite-*` headers.
  */
 export function hostContextFromRequest(request, platform) {
     const { headers } = request;
-    const user = headers.get("x-zite-user");
+    const trusted = platform !== undefined;
+    const user = trusted ? headers.get("x-zite-user") : null;
     const [kind, name = ""] = headers.get("x-zite-invoke")?.split(":") ?? [];
+    const kinds = trusted ? INVOKE_KINDS : UNHOSTED_INVOKE_KINDS;
     return {
-        requestId: headers.get("x-zite-request-id") ?? crypto.randomUUID(),
+        requestId: (trusted && headers.get("x-zite-request-id")) || crypto.randomUUID(),
         url: request.url,
         user: user ? decodeUser(user) : null,
         mode: "live",
-        invoke: INVOKE_KINDS.has(kind) ? { kind: kind, name } : null,
+        invoke: kinds.has(kind) ? { kind: kind, name } : null,
         runs: [],
         platform,
     };
 }
 /** Every server function TanStack compiled, written in by `zite()` at build. Empty in dev, where TanStack doesn't call its id hook. */
 export const builtFunctionIds = () => "__ZITE_FN_IDS__".split(",").filter((id) => id && !id.startsWith("__ZITE"));
-const parseDescriptions = (json) => {
+const parseBuiltJson = (json) => {
     try {
         return JSON.parse(json);
     }
@@ -96,7 +116,9 @@ const parseDescriptions = (json) => {
     }
 };
 /** Each server function's `description` option, written in by `zite()` at build. */
-export const builtFunctionDescriptions = () => parseDescriptions("__ZITE_FN_DESCRIPTIONS__");
+export const builtFunctionDescriptions = () => parseBuiltJson("__ZITE_FN_DESCRIPTIONS__");
+/** Each route's file, by route id, written in by `zite()` at build. */
+export const builtRouteFiles = () => parseBuiltJson("__ZITE_ROUTE_FILES__");
 // Server functions also run while a streamed page renders, so the run log is
 // complete only once the body has been read to the end.
 const onBodyEnd = (response, done) => {
@@ -107,6 +129,8 @@ const onBodyEnd = (response, done) => {
     return new Response(response.body.pipeThrough(new TransformStream({ flush: done })), response);
 };
 const INVOKE_PATH = "/_zite/invoke";
+/** On describe's answer: the zitejs this build's server code was bundled from. */
+export const RUNTIME_VERSION_HEADER = "x-zitejs-version";
 // The host sends `{ input }`; a platform-fired run's input carries the runner's
 // `__cron`, `__poll` or `__webhook` state, exactly as for classic endpoints.
 async function invokeWorkflow(request, host, workflows) {
@@ -143,13 +167,35 @@ async function invokeRegistration(request, host, workflows) {
     }
     return Response.json(result, { status: result.ok ? 200 : 500 });
 }
-const isZiteError = (error) => error instanceof Error && error.name === "ZiteError" && error.code in ZITE_ERROR_STATUS;
+// The host sends `{ input }`, the same fields classic hooks get. A hook runs as
+// a workflow does: no user, and the app's data and integrations through its platform.
+async function invokeAuthHook(request, host) {
+    if (request.method !== "POST" || new URL(request.url).pathname !== INVOKE_PATH)
+        return new Response("Not found", { status: 404 });
+    const name = host.invoke?.name ?? "";
+    const hook = isAuthHookName(name) ? (await loadAuthHooks())[name] : undefined;
+    if (!hook) {
+        return Response.json({ ok: false, error: { code: "NOT_FOUND", message: `No auth hook named ${name}` } }, { status: 404 });
+    }
+    const input = (await request.json().catch(() => ({})))?.input ?? {};
+    const startedAt = Date.now();
+    try {
+        const output = await runInScope({ kind: "workflow", user: null }, () => hook(input));
+        host.runs.push({ fn: `authHook:${name}`, name, nested: false, startedAt, durationMs: Date.now() - startedAt, input: preview(input), output: preview(output) });
+        return Response.json({ ok: true, output: output ?? null });
+    }
+    catch (error) {
+        const failed = errorOf(error);
+        host.runs.push({ fn: `authHook:${name}`, name, nested: false, startedAt, durationMs: Date.now() - startedAt, input: preview(input), error: failed });
+        return Response.json({ ok: false, error: failed }, { status: 500 });
+    }
+}
 // TanStack renders any loader error as a 500. A page refused with a ZiteError
 // (a missing role, a record that isn't there) answers with that error's status.
 const pageStatus = (host) => {
     const matches = host.router?.state?.matches;
-    const failed = matches?.find((match) => match.status === "error")?.error;
-    return isZiteError(failed) ? ZITE_ERROR_STATUS[failed.code] : undefined;
+    const failed = asZiteError(matches?.find((match) => match.status === "error")?.error);
+    return failed ? ZITE_ERROR_STATUS[failed.code] : undefined;
 };
 /**
  * The handlers of a Start app's server entry. A request the host dispatched
@@ -168,6 +214,7 @@ export function createZiteHandlers(options) {
             : hostContextFromRequest(request, options.platform);
         if (watch)
             host.watch = watch;
+        setRequestEnv(host);
         // Starting this isolate was the point: the platform warms a build before its
         // first visitors, and no app code runs.
         if (host.invoke?.kind === "warm")
@@ -176,26 +223,32 @@ export function createZiteHandlers(options) {
             return Response.json(await describeApp({
                 fnIds: builtFunctionIds(),
                 descriptions: builtFunctionDescriptions(),
+                routeFiles: builtRouteFiles(),
                 getRouter: options.getRouter,
                 request,
                 workflows: await loadedWorkflows(),
-            }));
+            }), { headers: { [RUNTIME_VERSION_HEADER]: ZITEJS_VERSION } });
         }
         let response = await runWithHost(host, async () => host.invoke?.kind === "workflow"
             ? invokeWorkflow(request, host, await loadedWorkflows())
             : host.invoke?.kind === "register"
                 ? invokeRegistration(request, host, await loadedWorkflows())
-                : options.handler.fetch(request));
+                : host.invoke?.kind === "authHook"
+                    ? invokeAuthHook(request, host)
+                    : options.handler.fetch(request));
         const status = response.status === 500 ? pageStatus(host) : undefined;
         if (status)
             response = new Response(response.body, { status, headers: response.headers });
         return onBodyEnd(response, () => {
             const { platform } = host;
-            if (!host.runs.length || !platform)
+            if ((!host.runs.length && !host.pending?.length) || !platform)
                 return;
-            const batch = { runs: host.runs };
             // On the request's session when it has one: one call, not another binding round trip.
             const flushed = (async () => {
+                await Promise.all(host.pending ?? []);
+                if (!host.runs.length)
+                    return;
+                const batch = { runs: host.runs };
                 const session = host.session ? await host.session : undefined;
                 await (session?.runs ? session.runs(batch) : platform.runs(batch));
             })().catch((error) => {

package/dist/esm/start/types.d.ts

@@ -1,8 +1,19 @@
+export type Role = {
+    id: string;
+    name: string;
+};
+/** As classic's `context.user`, plus `name`. */
 export type User = {
     id: string;
     email: string;
+    /** First and last name, or the email when neither is set. */
     name: string;
-    roles: ReadonlyArray<string>;
+    firstName?: string;
+    lastName?: string;
+    /** The built-in roles, then the ones assigned on the Members tab. */
+    roles: ReadonlyArray<Role>;
+    /** A member of the workspace's team, not an external user. */
+    isInternal: boolean;
 };
 /** One server function call, as the platform's run log shows it. Input and output are truncated JSON. */
 export type RunRecord = {
@@ -16,6 +27,7 @@ export type RunRecord = {
     error?: {
         code: string;
         message: string;
+        stack?: string;
     };
 };
 export type AccessKind = "signedIn" | "anyone" | "webhook" | "workflow";
@@ -38,6 +50,7 @@ export type PlatformCallResult = {
     error: {
         code: string;
         message: string;
+        userFacingMessage?: string;
     };
 };
 export type PlatformSession = {
@@ -63,9 +76,10 @@ export type PlatformBinding = {
         runs: RunRecord[];
     }): Promise<void>;
 };
-export type HostMode = "live" | "preview" | "validate";
+/** A demo is the published build serving a read-only visitor: as live, but every write is refused. */
+export type HostMode = "live" | "preview" | "demo" | "validate";
 export type HostInvoke = {
-    kind: "webhook" | "describe" | "workflow" | "register" | "warm";
+    kind: "webhook" | "describe" | "workflow" | "register" | "warm" | "authHook";
     name: string;
 };
 /** The per-request props the host dispatches with. Only the host can set them. */
@@ -75,6 +89,12 @@ export type HostProps = {
     user: User | null;
     mode: HostMode;
     invoke: HostInvoke | null;
+    /** The app's live URL, demo included: `process.env.ZITE_APP_URL`. Hosts before 0.10.0-start.7 don't send it. */
+    appUrl?: string;
+    /** The app's database: `process.env.ZITE_BASE_ID`. */
+    baseId?: string;
+    /** An editor preview's access, which zitejs keeps on the app's links and calls. */
+    previewClaim?: string;
 };
 /** What the host resolved for this request. Set by the generated server entry, never by the browser. */
 export type ZiteRequestContext = {
@@ -83,8 +103,13 @@ export type ZiteRequestContext = {
     user: User | null;
     mode: HostMode;
     invoke: HostInvoke | null;
+    appUrl?: string;
+    baseId?: string;
+    previewClaim?: string;
     /** Filled by run capture, flushed to the platform once the response ends. */
     runs: RunRecord[];
+    /** Records still reading a copy of a body; the flush waits for them. */
+    pending?: Promise<void>[];
     platform?: PlatformBinding;
     session?: Promise<PlatformSession>;
     /** Set when the host renders a page it may cache. */

package/dist/esm/start/version.d.ts

@@ -0,0 +1 @@
+export declare const ZITEJS_VERSION = "0.10.0-start.7";

package/dist/esm/start/version.js

@@ -0,0 +1,2 @@
+// Written by scripts/write-version.mjs from package.json.
+export const ZITEJS_VERSION = "0.10.0-start.7";

package/dist/esm/start/vite.js

@@ -1,3 +1,4 @@
+import { existsSync } from "node:fs";
 import path from "node:path";
 import { tanstackStart } from "@tanstack/react-start/plugin/vite";
 import viteReact from "@vitejs/plugin-react";
@@ -7,8 +8,14 @@ import { hasAppStart, renderStartInstance, renderStartServerEntry, renderWorkflo
 // Must match the literals in ./server.ts, which the build rewrites.
 const FN_IDS_TOKEN = "__ZITE_FN_IDS__";
 const FN_DESCRIPTIONS_LITERAL = /(["'`])__ZITE_FN_DESCRIPTIONS__\1/;
+const ROUTE_FILES_LITERAL = /(["'`])__ZITE_ROUTE_FILES__\1/;
+// TanStack's generator writes each route file's id into its createFileRoute call and keeps it in step.
+const FILE_ROUTE_ID = /\bcreateFileRoute\(\s*(["'`])([^"'`]+)\1\s*\)/;
 // zitejs's empty registry, which the build replaces with the app's.
 const WORKFLOW_REGISTRY = /[\\/]zitejs[\\/]dist[\\/]esm[\\/]start[\\/]workflowModules\.js$/;
+// zitejs's null auth-hooks module, which the build points at the app's `zite.auth.ts`.
+const AUTH_HOOKS_REGISTRY = /[\\/]zitejs[\\/]dist[\\/]esm[\\/]start[\\/]authHooksModule\.js$/;
+const AUTH_HOOKS_FILE = "zite.auth.ts";
 // Platform-pinned Worker settings. The deploy uses its own fixed template, so
 // these only have to match it; apps don't carry a wrangler config.
 const WORKER_COMPATIBILITY_DATE = "2026-09-25";
@@ -71,14 +78,21 @@ export function zite(options = {}) {
         // time; Vite leaves SSR output unminified.
         configEnvironment: (name, config) => name === "ssr" && options.cloudflare !== false && config.build?.minify === undefined ? { build: { minify: true } } : undefined,
     };
-    // Each server function's `description` option, by name, for the editor.
+    // Each server function's `description` option, by name, and each route's file, by route id: for the editor.
     const descriptions = new Map();
+    const routeFiles = new Map();
     const srcDir = `${path.join(appDir, "src")}${path.sep}`;
     const functionIds = {
         name: "zite:function-ids",
         apply: "build",
         transform(code, id) {
-            if (this.environment?.config.consumer !== "server" || !id.startsWith(srcDir) || !code.includes("description"))
+            if (this.environment?.config.consumer !== "server" || !id.startsWith(srcDir))
+                return;
+            const file = id.split("?")[0];
+            const routeId = FILE_ROUTE_ID.exec(code)?.[2];
+            if (routeId && !id.includes("?"))
+                routeFiles.set(routeId, path.relative(appDir, file).split(path.sep).join("/"));
+            if (!code.includes("description"))
                 return;
             try {
                 for (const [name, text] of factoryDescriptions(this.parse(code)))
@@ -95,7 +109,9 @@ export function zite(options = {}) {
                     continue;
                 if (chunk.code.includes(FN_IDS_TOKEN))
                     chunk.code = chunk.code.replace(FN_IDS_TOKEN, [...ids.keys()].join(","));
-                chunk.code = chunk.code.replace(FN_DESCRIPTIONS_LITERAL, () => JSON.stringify(JSON.stringify(described)));
+                chunk.code = chunk.code
+                    .replace(FN_DESCRIPTIONS_LITERAL, () => JSON.stringify(JSON.stringify(described)))
+                    .replace(ROUTE_FILES_LITERAL, () => JSON.stringify(JSON.stringify(Object.fromEntries(routeFiles))));
             }
         },
     };
@@ -103,6 +119,17 @@ export function zite(options = {}) {
         name: "zite:workflow-registry",
         load: (id) => (WORKFLOW_REGISTRY.test(id.split("?")[0]) ? renderWorkflowModules(appDir, workflowFiles(appDir)) : undefined),
     };
+    const authHooksRegistry = {
+        name: "zite:auth-hooks",
+        load: (id) => {
+            if (!AUTH_HOOKS_REGISTRY.test(id.split("?")[0]))
+                return undefined;
+            const file = path.join(appDir, AUTH_HOOKS_FILE);
+            return existsSync(file)
+                ? `export const authHooksModule = () => import(${JSON.stringify(file)});\n`
+                : "export const authHooksModule = null;\n";
+        },
+    };
     return [
         tanstackStart({
             // TanStack resolves these from `src/`.
@@ -140,5 +167,6 @@ export function zite(options = {}) {
         compileZitejs,
         functionIds,
         workflowRegistry,
+        authHooksRegistry,
     ];
 }

package/dist/esm/start/workflowRun.js

@@ -23,7 +23,8 @@ const idOf = (id) => {
  */
 export function triggerContext(workflow, rawInput) {
     const raw = asRecord(rawInput);
-    const { __cron, __poll, __webhook, ...input } = raw ?? {};
+    // `__cron` stays in the input, as on classic: scheduled code reads its scheduleId and scheduledAt there.
+    const { __poll, __webhook, ...input } = raw ?? {};
     const declared = workflow.config.trigger;
     if (!declared)
         return { input: raw ? input : rawInput };

package/dist/esm/sync/lib.js

@@ -509,7 +509,7 @@ export function generateDbTs(inputSchema) {
     lines.push('//       `not: null` means "is set". An empty `in: []` matches nothing; an', "//       empty `notIn: []` applies no filter.");
     lines.push("//     sort is currently IGNORED here — it is stripped before the request.", "//       (it does work on zite.auth.findAllUsers). Order in SQL instead.");
     lines.push("//     limit defaults to 500, max 2000; offset is a row count (a number)");
-    lines.push('//     a filter value of `undefined` is REJECTED (it would query unfiltered', '//       and match an arbitrary record). Check the value first.');
+    lines.push("//     a filter value of `undefined` is REJECTED (it would query unfiltered", "//       and match an arbitrary record). Check the value first.");
     lines.push("//   .findOne({ id?, filters?, fields? }) → T | undefined");
     lines.push("//   .create({ record }) → T");
     lines.push("//   .update({ id, record }) → { id: string, fields: Partial<T> }");
@@ -1217,13 +1217,13 @@ export function generateBackendWrapperTs(envVarNames = []) {
         "// Auto-generated type-narrowing wrapper. Do not edit manually.",
         "// Re-exports createEndpoint with context.user typed to the app User.",
         "",
-        "import type { ZiteRequestContext as _ZiteRequestContext, ZiteScheduledContext, ZiteErrorCode, ZiteSchedule, ZiteStep, ZiteStreamInterface, ZiteTrigger, ZiteTriggerContext, ZiteWebhook } from 'zitejs/backend/base';",
+        "import type { ZiteRequestContext as _ZiteRequestContext, ZiteScheduledContext, ZiteErrorCode, ZiteSchedule, ZiteStep, ZiteStreamInterface, ZiteTrigger, ZiteTriggerContext, ZiteEndpointInput, ZiteWebhook } from 'zitejs/backend/base';",
         "import type { User } from 'zitejs/auth';",
         "",
         "export type { ZiteErrorCode, ZiteSchedule, ZiteScheduledContext, ZiteStep, ZiteStreamInterface, ZiteTrigger, ZiteWebhook };",
         // A trigger's registration exports are typed against these, and they
         // only reach app code through this file.
-        "export type { ZiteTriggerContext, ZiteTriggerDeliveryInfo, ZiteTriggerDeliveryRun, ZiteTriggerRun, ZiteTriggerSubscribe, ZiteTriggerSubscribeInput, ZiteTriggerSubscribeResult, ZiteTriggerUnsubscribe, ZiteTriggerUnsubscribeInput } from 'zitejs/backend/base';",
+        "export type { ZiteDatabaseTriggerEvent, ZiteDatabaseTriggerInput, ZiteFormTriggerInput, ZiteTriggerContext, ZiteTriggerDeliveryInfo, ZiteTriggerDeliveryRun, ZiteTriggerRun, ZiteTriggerSubscribe, ZiteTriggerSubscribeInput, ZiteTriggerSubscribeResult, ZiteTriggerUnsubscribe, ZiteTriggerUnsubscribeInput } from 'zitejs/backend/base';",
         // The pre-monorepo SDK put this in scope for every endpoint, so migrated
         // code can name it. `createEndpoint` infers the same thing without it.
         "export type InferSchemaType<T> = T extends { _output: infer U } ? U : T;",
@@ -1311,12 +1311,12 @@ export function generateBackendWrapperTs(envVarNames = []) {
         "  schedule?: TSchedule;",
         "  /** When set, an inbound webhook can also trigger this endpoint. Like `schedule`, it widens `context` — a webhook fire has no session. */",
         "  webhook?: TWebhook;",
-        "  /** When set, a connection's events (registered by this file's own `subscribe` export) or a poll (`every`) also fire this endpoint. Like `webhook`, it widens `context` — a trigger fire has no session. */",
+        "  /** When set, a connection's events (registered by this file's own `subscribe` export), a poll (`every`), a change to one of the project's tables (`table`) or a submission to one of its forms (`form`) also fire this endpoint. Like `webhook`, it widens `context` — a trigger fire has no session. */",
         "  trigger?: TTrigger;",
         "  execute: (",
         "    params: {",
-        "      input: TInput;",
-        "      /** Durable steps: step.run(name, fn) runs fn once per logical run — its result is saved before anything after it executes, and a resumed run replays completed steps from their saved results. Provided by the platform; never define a local stand-in. */",
+        "      input: ZiteEndpointInput<TInput, TTrigger>;",
+        "      /** Durable steps: step.run(name, fn) runs fn once per logical run — its result is saved before anything after it executes, and a resumed run replays completed steps from their saved results. In a run fired by a schedule, webhook or trigger, step.sleep(name, \"2d\") pauses the run and a failed step is tried again. Provided by the platform; never define a local stand-in. */",
         "      step: ZiteStep;",
         "      context: TSchedule extends ZiteSchedule ? ZiteRequestContext | ZiteScheduledContext : TWebhook extends ZiteWebhook ? ZiteRequestContext | ZiteScheduledContext : TTrigger extends ZiteTrigger ? ZiteRequestContext | ZiteScheduledContext : ZiteRequestContext;",
         // Mirrors the base module: a trigger's run gets `trigger`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "zitejs",
-  "version": "0.10.0-start.6",
+  "version": "0.10.0-start.7",
   "description": "The Zite framework — build apps on Zite Database",
   "type": "module",
   "sideEffects": false,
@@ -123,11 +123,13 @@
     }
   },
   "scripts": {
-    "build": "tsc && tsc -p tsconfig.cjs.json && echo '{\"type\":\"commonjs\"}' > dist/cjs/package.json",
+    "build": "node scripts/write-version.mjs && tsc && tsc -p tsconfig.cjs.json && echo '{\"type\":\"commonjs\"}' > dist/cjs/package.json",
     "test": "vitest run",
     "test:start": "node tests/start/run-contract.mjs",
     "test:watch": "vitest",
     "typecheck": "tsc --noEmit",
+    "version": "node scripts/write-version.mjs && git add src/start/version.ts",
+    "release": "node ./scripts/release.mjs",
     "prepublishOnly": "npm run build"
   },
   "files": [
@@ -177,14 +179,15 @@
     }
   },
   "peerDependencies": {
-    "@tanstack/react-query": ">=5",
-    "react": ">=18",
-    "vite": ">=5",
+    "@cloudflare/vite-plugin": ">=1",
+    "@tanstack/react-query": ">=5.102.0",
+    "@tanstack/react-router": "1.170.41",
+    "@tanstack/react-router-ssr-query": "1.167.3",
     "@tanstack/react-start": "1.168.60",
     "@tanstack/start-storage-context": "1.167.36",
     "@vitejs/plugin-react": ">=5",
-    "@cloudflare/vite-plugin": ">=1",
-    "@tanstack/react-router": "1.170.41"
+    "react": ">=18",
+    "vite": ">=5"
   },
   "peerDependenciesMeta": {
     "react": {
@@ -210,11 +213,16 @@
     },
     "@tanstack/react-router": {
       "optional": true
+    },
+    "@tanstack/react-router-ssr-query": {
+      "optional": true
     }
   },
   "devDependencies": {
-    "@tanstack/react-query": "^5.100.14",
+    "@tanstack/query-core": "5.104.0",
+    "@tanstack/react-query": "5.104.0",
     "@tanstack/react-router": "1.170.41",
+    "@tanstack/react-router-ssr-query": "1.167.3",
     "@tanstack/react-start": "1.168.60",
     "@tanstack/start-storage-context": "1.167.36",
     "@types/node": "^25.9.1",