zitejs 0.9.140 → 0.9.141

package/dist/esm/start/scope.d.ts

@@ -0,0 +1,15 @@
+import type { AccessKind, User, ZiteRequestContext } from "./types.js";
+export type { AccessKind } from "./types.js";
+export type AccessScope = {
+    kind: AccessKind;
+    user: User | null;
+};
+export declare const runInScope: <T>(scope: AccessScope, fn: () => T) => T;
+/** True inside another server function's scope, i.e. a nested server-side call. */
+export declare const inScope: () => boolean;
+export declare class NoAccessDecisionError extends Error {
+    constructor(what: string);
+}
+export declare const requireScope: (what: string) => AccessScope;
+export declare const runWithHost: <T>(host: ZiteRequestContext, fn: () => T) => T;
+export declare const getHost: () => ZiteRequestContext | undefined;

package/dist/esm/start/scope.js

@@ -0,0 +1,58 @@
+// Server-only. Only zitejs's access middleware opens an access scope, and the
+// platform transport refuses calls outside one, so code with no access decision
+// can't reach data, integrations or email however it was written.
+import { AsyncLocalStorage } from "node:async_hooks";
+import { HOST_STORE_KEY } from "./host.js";
+// Keyed on globalThis so two copies of zitejs in one bundle share the stores.
+const stores = globalThis;
+const scopeStorage = (stores[Symbol.for("zitejs:access-scope")] ??=
+    new AsyncLocalStorage());
+const hostStorage = (stores[HOST_STORE_KEY] ??=
+    new AsyncLocalStorage());
+const isAsyncIterable = (value) => typeof value === "object" &&
+    value !== null &&
+    Symbol.asyncIterator in value &&
+    !(value instanceof ReadableStream);
+// TanStack resumes a streamed async generator from its serializer, outside the
+// middleware's async context, so each step re-enters the scope it started in.
+const rescope = (scope, source) => (async function* () {
+    const iterator = source[Symbol.asyncIterator]();
+    try {
+        while (true) {
+            const step = await scopeStorage.run(scope, () => iterator.next());
+            if (step.done)
+                return step.value;
+            yield step.value;
+        }
+    }
+    finally {
+        await scopeStorage.run(scope, async () => iterator.return?.());
+    }
+})();
+const rescopeResult = (scope, out) => {
+    const result = out?.result;
+    return isAsyncIterable(result) ? { ...out, result: rescope(scope, result) } : out;
+};
+export const runInScope = (scope, fn) => {
+    const out = scopeStorage.run(scope, fn);
+    return (out instanceof Promise
+        ? out.then((value) => rescopeResult(scope, value))
+        : rescopeResult(scope, out));
+};
+/** True inside another server function's scope, i.e. a nested server-side call. */
+export const inScope = () => scopeStorage.getStore() !== undefined;
+export class NoAccessDecisionError extends Error {
+    constructor(what) {
+        super(`${what} ran outside an access decision. Define server functions with signedInFn or publicFn, ` +
+            "and give server routes signedIn, anyone or webhook middleware. Loaders get data by calling a server function.");
+        this.name = "NoAccessDecisionError";
+    }
+}
+export const requireScope = (what) => {
+    const scope = scopeStorage.getStore();
+    if (!scope)
+        throw new NoAccessDecisionError(what);
+    return scope;
+};
+export const runWithHost = (host, fn) => hostStorage.run(host, fn);
+export const getHost = () => hostStorage.getStore();

package/dist/esm/start/server.d.ts

@@ -0,0 +1,51 @@
+import type { HostProps, PlatformBinding, RenderWatch, ZiteRequestContext } from "./types.js";
+export { runWithHost } from "./scope.js";
+export { describeApp } from "./describe.js";
+export type { HostProps, PlatformBinding, PlatformCallInput, PlatformCallResult, PlatformSession, RenderWatch, RunRecord } from "./types.js";
+/**
+ * Routes every zitejs data, integration and email call to this request's
+ * platform, on one session, and only inside an access scope. The access kind
+ * travels with the call so the platform can record what a page read and narrow
+ * anonymous reads.
+ */
+export declare function installPlatformTransport(): void;
+/** What the host dispatched this request with. Headers are ignored: props are the only thing it alone can set. */
+export declare function hostContextFromProps(request: Request, props: HostProps): ZiteRequestContext;
+/**
+ * A request the host didn't dispatch: `zitejs describe` under `vite preview`,
+ * and tests, which pass their own platform. Deployed builds have no public URL,
+ * so in production every request carries props.
+ */
+export declare function hostContextFromRequest(request: Request, platform?: PlatformBinding): ZiteRequestContext;
+/** Every server function TanStack compiled, written in by `zite()` at build. Empty in dev, where TanStack doesn't call its id hook. */
+export declare const builtFunctionIds: () => string[];
+/** Each server function's `description` option, written in by `zite()` at build. */
+export declare const builtFunctionDescriptions: () => Record<string, string>;
+type Fetch = (request: Request, ...rest: unknown[]) => Promise<Response> | Response;
+type WorkerContext = {
+    waitUntil(promise: Promise<unknown>): void;
+};
+export type ZiteServerOptions = {
+    handler: {
+        fetch: Fetch;
+    };
+    getRouter: () => unknown;
+    platform?: PlatformBinding;
+};
+type HostedContext = WorkerContext & {
+    props?: Partial<HostProps>;
+};
+export type ZiteHandlers = {
+    fetch: Fetch;
+    /** A page the host may cache: as `fetch`, with every read and outbound fetch reported to `watch`. */
+    render(request: Request, ctx: HostedContext, watch: RenderWatch): Promise<Response>;
+};
+/**
+ * The handlers of a Start app's server entry. A request the host dispatched
+ * carries its identity and platform in props; anything else (describe under
+ * `vite preview`, tests) reads `x-zite-*` headers and uses `platform` if one
+ * is given.
+ */
+export declare function createZiteHandlers(options: ZiteServerOptions): ZiteHandlers;
+/** The fetch handler alone, for entries that take no RPC. */
+export declare function createZiteFetch(options: ZiteServerOptions): Fetch;

package/dist/esm/start/server.js

@@ -0,0 +1,215 @@
+import { ZiteError, ZITE_ERROR_STATUS } from "./index.js";
+import { describeApp } from "./describe.js";
+import { runRegistration } from "./registration.js";
+import { preview } from "./runLog.js";
+import { getHost, requireScope, runWithHost } from "./scope.js";
+import { loadWorkflows, loggedInput, runWorkflow } from "./workflowRun.js";
+export { runWithHost } from "./scope.js";
+export { describeApp } from "./describe.js";
+/**
+ * Routes every zitejs data, integration and email call to this request's
+ * platform, on one session, and only inside an access scope. The access kind
+ * travels with the call so the platform can record what a page read and narrow
+ * anonymous reads.
+ */
+export function installPlatformTransport() {
+    const sdkCall = async (integrationId, className, methodName, params) => {
+        const scope = requireScope(`${className}.${methodName}`);
+        const host = getHost();
+        // Fails closed: no platform means no platform access, never a fallback.
+        if (!host?.platform)
+            throw new Error("The Zite platform binding is missing");
+        host.session ??= Promise.resolve(host.watch ? host.platform.session(host.watch) : host.platform.session());
+        const result = await (await host.session).call({ integrationId, className, methodName, params, access: scope.kind });
+        if ("value" in result)
+            return result.value;
+        const { code, message } = result.error;
+        throw new ZiteError(code in ZITE_ERROR_STATUS ? code : "INTERNAL_ERROR", message);
+    };
+    globalThis.__wrapSdkCall = sdkCall;
+    watchOutboundFetches();
+}
+let fetchesWatched = false;
+const fetchedHost = (input) => {
+    try {
+        return new URL(input instanceof Request ? input.url : input).host;
+    }
+    catch {
+        return "?";
+    }
+};
+// A page that fetched depends on more than the reads the host saw, so the host
+// must hear of it before the fetch goes out. Next patches fetch for the same reason.
+const watchOutboundFetches = () => {
+    if (fetchesWatched)
+        return;
+    fetchesWatched = true;
+    const nativeFetch = globalThis.fetch.bind(globalThis);
+    globalThis.fetch = async (input, init) => {
+        const watch = getHost()?.watch;
+        if (watch)
+            await watch.uncacheable(`fetch ${fetchedHost(input)}`);
+        return nativeFetch(input, init);
+    };
+};
+const decodeUser = (value) => JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(value.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0))));
+const INVOKE_KINDS = new Set(["webhook", "describe", "workflow", "register", "warm"]);
+/** What the host dispatched this request with. Headers are ignored: props are the only thing it alone can set. */
+export function hostContextFromProps(request, props) {
+    return {
+        requestId: props.requestId,
+        url: request.url,
+        user: props.user,
+        mode: props.mode,
+        invoke: props.invoke,
+        runs: [],
+        platform: props.platform,
+    };
+}
+/**
+ * A request the host didn't dispatch: `zitejs describe` under `vite preview`,
+ * and tests, which pass their own platform. Deployed builds have no public URL,
+ * so in production every request carries props.
+ */
+export function hostContextFromRequest(request, platform) {
+    const { headers } = request;
+    const user = headers.get("x-zite-user");
+    const [kind, name = ""] = headers.get("x-zite-invoke")?.split(":") ?? [];
+    return {
+        requestId: headers.get("x-zite-request-id") ?? crypto.randomUUID(),
+        url: request.url,
+        user: user ? decodeUser(user) : null,
+        mode: "live",
+        invoke: INVOKE_KINDS.has(kind) ? { kind: kind, name } : null,
+        runs: [],
+        platform,
+    };
+}
+/** Every server function TanStack compiled, written in by `zite()` at build. Empty in dev, where TanStack doesn't call its id hook. */
+export const builtFunctionIds = () => "__ZITE_FN_IDS__".split(",").filter((id) => id && !id.startsWith("__ZITE"));
+const parseDescriptions = (json) => {
+    try {
+        return JSON.parse(json);
+    }
+    catch {
+        return {};
+    }
+};
+/** Each server function's `description` option, written in by `zite()` at build. */
+export const builtFunctionDescriptions = () => parseDescriptions("__ZITE_FN_DESCRIPTIONS__");
+// Server functions also run while a streamed page renders, so the run log is
+// complete only once the body has been read to the end.
+const onBodyEnd = (response, done) => {
+    if (!response.body) {
+        done();
+        return response;
+    }
+    return new Response(response.body.pipeThrough(new TransformStream({ flush: done })), response);
+};
+const INVOKE_PATH = "/_zite/invoke";
+// The host sends `{ input }`; a platform-fired run's input carries the runner's
+// `__cron`, `__poll` or `__webhook` state, exactly as for classic endpoints.
+async function invokeWorkflow(request, host, workflows) {
+    if (request.method !== "POST" || new URL(request.url).pathname !== INVOKE_PATH)
+        return new Response("Not found", { status: 404 });
+    const name = host.invoke?.name;
+    const found = workflows.find((w) => w.id === name);
+    if (!found)
+        return Response.json({ ok: false, error: { code: "NOT_FOUND", message: `No workflow named ${name}` } }, { status: 404 });
+    const input = (await request.json().catch(() => ({})))?.input;
+    const startedAt = Date.now();
+    const result = await runWorkflow(found.workflow, input);
+    host.runs.push({
+        fn: `workflow:${found.id}`,
+        name: found.id,
+        nested: false,
+        startedAt,
+        durationMs: Date.now() - startedAt,
+        input: preview(loggedInput(input)),
+        ...(result.ok ? { output: preview(result.output) } : { error: result.error }),
+    });
+    return Response.json(result, { status: result.ok ? 200 : 500 });
+}
+// The host sends `{ op, input }`: `subscribe` with the platform's notification
+// URL and secret, or `unsubscribe` with what `subscribe` returned.
+async function invokeRegistration(request, host, workflows) {
+    if (request.method !== "POST" || new URL(request.url).pathname !== INVOKE_PATH)
+        return new Response("Not found", { status: 404 });
+    const name = host.invoke?.name ?? "";
+    const body = (await request.json().catch(() => null));
+    const result = await runRegistration(workflows, name, body?.op, body?.input);
+    if (!result) {
+        return Response.json({ ok: false, error: { code: "NOT_FOUND", message: `${name} has no ${String(body?.op)}` } }, { status: 404 });
+    }
+    return Response.json(result, { status: result.ok ? 200 : 500 });
+}
+const isZiteError = (error) => error instanceof Error && error.name === "ZiteError" && error.code in ZITE_ERROR_STATUS;
+// TanStack renders any loader error as a 500. A page refused with a ZiteError
+// (a missing role, a record that isn't there) answers with that error's status.
+const pageStatus = (host) => {
+    const matches = host.router?.state?.matches;
+    const failed = matches?.find((match) => match.status === "error")?.error;
+    return isZiteError(failed) ? ZITE_ERROR_STATUS[failed.code] : undefined;
+};
+/**
+ * The handlers of a Start app's server entry. A request the host dispatched
+ * carries its identity and platform in props; anything else (describe under
+ * `vite preview`, tests) reads `x-zite-*` headers and uses `platform` if one
+ * is given.
+ */
+export function createZiteHandlers(options) {
+    installPlatformTransport();
+    // Loaded on first use, so a page request never pays for importing workflow modules.
+    let workflows;
+    const loadedWorkflows = () => (workflows ??= loadWorkflows());
+    const serve = async (request, ctx, watch) => {
+        const host = ctx?.props?.platform
+            ? hostContextFromProps(request, ctx.props)
+            : hostContextFromRequest(request, options.platform);
+        if (watch)
+            host.watch = watch;
+        // Starting this isolate was the point: the platform warms a build before its
+        // first visitors, and no app code runs.
+        if (host.invoke?.kind === "warm")
+            return new Response(null, { status: 204 });
+        if (host.invoke?.kind === "describe") {
+            return Response.json(await describeApp({
+                fnIds: builtFunctionIds(),
+                descriptions: builtFunctionDescriptions(),
+                getRouter: options.getRouter,
+                request,
+                workflows: await loadedWorkflows(),
+            }));
+        }
+        let response = await runWithHost(host, async () => host.invoke?.kind === "workflow"
+            ? invokeWorkflow(request, host, await loadedWorkflows())
+            : host.invoke?.kind === "register"
+                ? invokeRegistration(request, host, await loadedWorkflows())
+                : options.handler.fetch(request));
+        const status = response.status === 500 ? pageStatus(host) : undefined;
+        if (status)
+            response = new Response(response.body, { status, headers: response.headers });
+        return onBodyEnd(response, () => {
+            const { platform } = host;
+            if (!host.runs.length || !platform)
+                return;
+            const batch = { runs: host.runs };
+            // On the request's session when it has one: one call, not another binding round trip.
+            const flushed = (async () => {
+                const session = host.session ? await host.session : undefined;
+                await (session?.runs ? session.runs(batch) : platform.runs(batch));
+            })().catch((error) => {
+                console.error("[zite] couldn't record runs", error);
+            });
+            ctx?.waitUntil(flushed);
+        });
+    };
+    return {
+        fetch: (request, ...rest) => serve(request, rest[1]),
+        render: (request, ctx, watch) => serve(request, ctx, watch),
+    };
+}
+/** The fetch handler alone, for entries that take no RPC. */
+export function createZiteFetch(options) {
+    return createZiteHandlers(options).fetch;
+}

package/dist/esm/start/types.d.ts

@@ -0,0 +1,94 @@
+export type User = {
+    id: string;
+    email: string;
+    name: string;
+    roles: ReadonlyArray<string>;
+};
+/** One server function call, as the platform's run log shows it. Input and output are truncated JSON. */
+export type RunRecord = {
+    fn: string;
+    name?: string;
+    nested: boolean;
+    startedAt: number;
+    durationMs: number;
+    input?: string;
+    output?: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+};
+export type AccessKind = "signedIn" | "anyone" | "webhook" | "workflow";
+/** One data, integration or email call. Who is calling is the platform's to know, never the app's to say. */
+export type PlatformCallInput = {
+    integrationId: string;
+    className: string;
+    methodName: string;
+    params: unknown;
+    /** The access decision the call ran under; the platform may narrow on it but never widens. */
+    access: AccessKind;
+};
+/**
+ * A call's answer. Errors come back as values: Workers RPC keeps a thrown
+ * error's message but drops its code.
+ */
+export type PlatformCallResult = {
+    value: unknown;
+} | {
+    error: {
+        code: string;
+        message: string;
+    };
+};
+export type PlatformSession = {
+    call(call: PlatformCallInput): Promise<PlatformCallResult>;
+    /** As `PlatformBinding.runs`, on a session the request already holds. Hosts before 0.10.0-start.4 lack it. */
+    runs?(batch: {
+        runs: RunRecord[];
+    }): Promise<void>;
+};
+/**
+ * The host's ear on a page render it may cache, from `render()`. Reports can
+ * only make the page less cacheable, so an app gains nothing by sending them.
+ */
+export type RenderWatch = {
+    uncacheable(reason: string): Promise<void>;
+};
+/** What the host hands each request: its platform, already scoped to the app, build, request and user. */
+export type PlatformBinding = {
+    /** Every platform call of one request goes through one session. A render's session reports what it read to `watch`. */
+    session(watch?: RenderWatch): PlatformSession | Promise<PlatformSession>;
+    /** One batch per request, after its response has ended. */
+    runs(batch: {
+        runs: RunRecord[];
+    }): Promise<void>;
+};
+export type HostMode = "live" | "preview" | "validate";
+export type HostInvoke = {
+    kind: "webhook" | "describe" | "workflow" | "register" | "warm";
+    name: string;
+};
+/** The per-request props the host dispatches with. Only the host can set them. */
+export type HostProps = {
+    platform: PlatformBinding;
+    requestId: string;
+    user: User | null;
+    mode: HostMode;
+    invoke: HostInvoke | null;
+};
+/** What the host resolved for this request. Set by the generated server entry, never by the browser. */
+export type ZiteRequestContext = {
+    requestId: string;
+    url: string;
+    user: User | null;
+    mode: HostMode;
+    invoke: HostInvoke | null;
+    /** Filled by run capture, flushed to the platform once the response ends. */
+    runs: RunRecord[];
+    platform?: PlatformBinding;
+    session?: Promise<PlatformSession>;
+    /** Set when the host renders a page it may cache. */
+    watch?: RenderWatch;
+    /** This request's router, so a page's status can follow the error it rendered. */
+    router?: unknown;
+};

package/dist/esm/start/types.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/start/vite.d.ts

@@ -0,0 +1,9 @@
+import type { PluginOption } from "vite";
+export type ZiteOptions = {
+    /** A server entry the caller owns, relative to the app root. By default zite() writes the platform's. */
+    serverEntry?: string;
+    /** Build for Cloudflare Workers, the target the platform deploys. Defaults to true; false builds for Node. */
+    cloudflare?: boolean;
+};
+/** The one plugin a Zite app's `vite.config.ts` uses. */
+export declare function zite(options?: ZiteOptions): PluginOption[];

package/dist/esm/start/vite.js

@@ -0,0 +1,144 @@
+import path from "node:path";
+import { tanstackStart } from "@tanstack/react-start/plugin/vite";
+import viteReact from "@vitejs/plugin-react";
+import { ziteId } from "../vite/index.js";
+import { factoryDescriptions } from "./descriptions.js";
+import { hasAppStart, renderStartInstance, renderStartServerEntry, renderWorkflowModules, START_INSTANCE_ENTRY, START_SERVER_ENTRY, workflowFiles, writeIfChanged, } from "./entries.js";
+// Must match the literals in ./server.ts, which the build rewrites.
+const FN_IDS_TOKEN = "__ZITE_FN_IDS__";
+const FN_DESCRIPTIONS_LITERAL = /(["'`])__ZITE_FN_DESCRIPTIONS__\1/;
+// zitejs's empty registry, which the build replaces with the app's.
+const WORKFLOW_REGISTRY = /[\\/]zitejs[\\/]dist[\\/]esm[\\/]start[\\/]workflowModules\.js$/;
+// Platform-pinned Worker settings. The deploy uses its own fixed template, so
+// these only have to match it; apps don't carry a wrangler config.
+const WORKER_COMPATIBILITY_DATE = "2026-09-25";
+const WORKER_COMPATIBILITY_FLAGS = ["nodejs_compat"];
+// Resolved from the app at build time; zitejs doesn't depend on it.
+const loadCloudflare = async (main) => {
+    const { cloudflare } = (await import("@cloudflare/vite-plugin"));
+    return cloudflare({
+        viteEnvironment: { name: "ssr" },
+        config: {
+            name: "zite-app",
+            main,
+            compatibility_date: WORKER_COMPATIBILITY_DATE,
+            compatibility_flags: WORKER_COMPATIBILITY_FLAGS,
+        },
+    });
+};
+/** The one plugin a Zite app's `vite.config.ts` uses. */
+export function zite(options = {}) {
+    const serverEntry = options.serverEntry ?? START_SERVER_ENTRY;
+    // Platform-owned, so they're rewritten whenever they differ. Sandboxes run the
+    // image's zitejs for `generate`, which may predate Start; the plugin can't.
+    const appDir = process.cwd();
+    if (!options.serverEntry) {
+        writeIfChanged(appDir, START_SERVER_ENTRY, renderStartServerEntry(options.cloudflare === false ? "node" : "cloudflare"));
+    }
+    writeIfChanged(appDir, START_INSTANCE_ENTRY, renderStartInstance(hasAppStart(appDir)));
+    // Every server function TanStack's compiler found, from its own hook, by id.
+    const ids = new Map();
+    const compileZitejs = {
+        name: "zite:compile-zitejs",
+        // The factories must go through TanStack's compiler in both environments.
+        // The peer dependency gets zitejs crawled already; this keeps it true if an
+        // install drops that. A Node build bundles everything, so externalized
+        // libraries can't load the root's React 18 renderer.
+        config: (config) => {
+            const root = path.resolve(config.root ?? ".");
+            const src = `${path.join(root, "src")}/`;
+            return {
+                ssr: { noExternal: options.cloudflare === false ? true : ["zitejs"] },
+                optimizeDeps: { exclude: ["zitejs"] },
+                resolve: {
+                    // `@/` as in classic apps and shadcn, `~/` as in TanStack's templates.
+                    alias: [
+                        { find: /^@\//, replacement: src },
+                        { find: /^~\//, replacement: src },
+                        // The workspace SDKs `zitejs generate` writes, as classic apps map them.
+                        { find: /^zitejs\/db$/, replacement: path.join(root, "../../.zite/db.ts") },
+                        { find: /^zitejs\/integrations$/, replacement: path.join(root, ".zite/integrations/index.ts") },
+                        { find: /^zitejs\/email$/, replacement: path.join(root, ".zite/integrations/email.ts") },
+                        { find: /^zitejs\/meta$/, replacement: path.join(root, ".zite/meta.ts") },
+                    ],
+                    // Shared workspace libraries resolve from the root, where classic apps
+                    // keep React 18; recharts 2 needs the app's react-is 19 or drops series.
+                    dedupe: ["react-is"],
+                },
+            };
+        },
+        // Each new isolate loads the whole server bundle, so its size is cold-start
+        // time; Vite leaves SSR output unminified.
+        configEnvironment: (name, config) => name === "ssr" && options.cloudflare !== false && config.build?.minify === undefined ? { build: { minify: true } } : undefined,
+    };
+    // Each server function's `description` option, by name, for the editor.
+    const descriptions = new Map();
+    const srcDir = `${path.join(appDir, "src")}${path.sep}`;
+    const functionIds = {
+        name: "zite:function-ids",
+        apply: "build",
+        transform(code, id) {
+            if (this.environment?.config.consumer !== "server" || !id.startsWith(srcDir) || !code.includes("description"))
+                return;
+            try {
+                for (const [name, text] of factoryDescriptions(this.parse(code)))
+                    descriptions.set(name, text);
+            }
+            catch {
+                // Display-only: an unreadable module just shows no descriptions.
+            }
+        },
+        generateBundle(_, bundle) {
+            const described = Object.fromEntries([...descriptions].filter(([name]) => ids.has(name)));
+            for (const chunk of Object.values(bundle)) {
+                if (chunk.type !== "chunk")
+                    continue;
+                if (chunk.code.includes(FN_IDS_TOKEN))
+                    chunk.code = chunk.code.replace(FN_IDS_TOKEN, [...ids.keys()].join(","));
+                chunk.code = chunk.code.replace(FN_DESCRIPTIONS_LITERAL, () => JSON.stringify(JSON.stringify(described)));
+            }
+        },
+    };
+    const workflowRegistry = {
+        name: "zite:workflow-registry",
+        load: (id) => (WORKFLOW_REGISTRY.test(id.split("?")[0]) ? renderWorkflowModules(appDir, workflowFiles(appDir)) : undefined),
+    };
+    return [
+        tanstackStart({
+            // TanStack resolves these from `src/`.
+            server: { entry: `../${serverEntry.replace(/\.ts$/, "")}` },
+            start: { entry: `../${START_INSTANCE_ENTRY.replace(/\.ts$/, "")}` },
+            serverFns: {
+                generateFunctionId: ({ filename, functionName }) => {
+                    const id = functionName.replace(/_createServerFn_handler$/, "");
+                    if (/(^|\/)node_modules\//.test(filename)) {
+                        throw new Error(`[zite] ${filename} defines server function ${id}; dependencies can't ship server functions`);
+                    }
+                    const existing = ids.get(id);
+                    if (existing && existing !== filename) {
+                        throw new Error(`[zite] server function name ${id} is used in both ${existing} and ${filename}`);
+                    }
+                    ids.set(id, filename);
+                    return id;
+                },
+            },
+            importProtection: {
+                behavior: "error",
+                client: {
+                    // Appended to TanStack's own.
+                    specifiers: ["zitejs/start/server", "zitejs/start/worker", "zitejs/start/describe", "zitejs/runtime"],
+                    // Replaces TanStack's list, so its `**/*.server.*` is restated. File
+                    // patterns also catch `zitejs/db` and `zitejs/integrations`, which the
+                    // aliases above rewrite before specifiers are matched.
+                    files: ["**/*.server.*", "**/.zite/db.ts", "**/.zite/integrations/**"],
+                },
+            },
+        }),
+        options.cloudflare !== false ? loadCloudflare(serverEntry) : null,
+        viteReact(),
+        ziteId(),
+        compileZitejs,
+        functionIds,
+        workflowRegistry,
+    ];
+}

package/dist/esm/start/worker.d.ts

@@ -0,0 +1,11 @@
+import { type ZiteServerOptions } from "./server.js";
+import type { RenderWatch } from "./types.js";
+export type ZiteWorker = new (ctx: unknown, env: unknown) => {
+    fetch(request: Request): Promise<Response>;
+    render(request: Request, watch: RenderWatch): Promise<Response>;
+};
+/**
+ * A Start app's Worker. The host sends most requests to `fetch`, and a page it
+ * may cache to `render` over RPC, with a watch for what the page depends on.
+ */
+export declare function createZiteWorker(options: ZiteServerOptions): ZiteWorker;

package/dist/esm/start/worker.js

@@ -0,0 +1,20 @@
+// For the generated server entry of a Workers build only. Apps never import this.
+import { WorkerEntrypoint } from "cloudflare:workers";
+import { createZiteHandlers } from "./server.js";
+/**
+ * A Start app's Worker. The host sends most requests to `fetch`, and a page it
+ * may cache to `render` over RPC, with a watch for what the page depends on.
+ */
+export function createZiteWorker(options) {
+    const handlers = createZiteHandlers(options);
+    return class extends WorkerEntrypoint {
+        async fetch(request) {
+            return handlers.fetch(request, this.env, this.ctx);
+        }
+        // An argument's stubs are disposed when the call returns, and a streamed
+        // page can still read after that.
+        async render(request, watch) {
+            return handlers.render(request, this.ctx, watch.dup?.() ?? watch);
+        }
+    };
+}