fix(backend): remove dev auth bypass

Always register auth handlers and use requireSession
regardless of NODE_ENV.

Co-authored-by: Ona <no-reply@ona.com>

apps/aelis-backend/package.json

@@ -15,7 +15,6 @@
 		"@aelis/source-location": "workspace:*",
 		"@aelis/source-tfl": "workspace:*",
 		"@aelis/source-weatherkit": "workspace:*",
-		"@nym.sh/jrx": "^0.2.0",
 		"@openrouter/sdk": "^0.9.11",
 		"arktype": "^2.1.29",
 		"better-auth": "^1",

apps/aelis-backend/src/caldav/renderer-provider.ts

@@ -1,7 +0,0 @@
-import type { FeedItemRenderer } from "@aelis/core"
-
-import { renderCalDavFeedItem } from "@aelis/source-caldav"
-
-export const CALDAV_SOURCE_ID = "aelis.caldav"
-
-export const calDavRenderer: FeedItemRenderer = renderCalDavFeedItem as FeedItemRenderer

apps/aelis-backend/src/engine/http.test.ts

@@ -1,19 +1,10 @@
-import type {
+import type { ActionDefinition, ContextEntry, FeedItem, FeedSource } from "@aelis/core"
-	ActionDefinition,
-	ContextEntry,
-	FeedItem,
-	FeedItemRenderer,
-	FeedSource,
-} from "@aelis/core"
-import type { Spec } from "@json-render/core"
 
 import { contextKey } from "@aelis/core"
-import { JRX_NODE } from "@nym.sh/jrx"
+import { describe, expect, spyOn, test } from "bun:test"
-import { describe, expect, test } from "bun:test"
 import { Hono } from "hono"
 
 import { mockAuthSessionMiddleware } from "../auth/session-middleware.ts"
-import { FeedRenderer } from "../session/feed-renderer.ts"
 import { UserSessionManager } from "../session/index.ts"
 import { registerFeedHttpHandlers } from "./http.ts"
 
@@ -28,17 +19,6 @@ interface FeedResponse {
 	errors: Array<{ sourceId: string; error: string }>
 }
 
-interface RenderedFeedResponse {
-	items: Array<{
-		id: string
-		type: string
-		timestamp: string
-		data: Record<string, unknown>
-		ui: Spec
-	}>
-	errors: Array<{ sourceId: string; error: string }>
-}
-
 function createStubSource(
 	id: string,
 	items: FeedItem[] = [],
@@ -92,12 +72,12 @@ describe("GET /api/feed", () => {
 			},
 		]
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
+			providers: [async () => createStubSource("test", items)],
 		})
 		const app = buildTestApp(manager, "user-1")
 
 		// Prime the cache
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		await session.engine.refresh()
 		expect(session.engine.lastFeed()).not.toBeNull()
 
@@ -125,7 +105,7 @@ describe("GET /api/feed", () => {
 			},
 		]
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
+			providers: [async () => createStubSource("test", items)],
 		})
 		const app = buildTestApp(manager, "user-1")
 
@@ -156,7 +136,7 @@ describe("GET /api/feed", () => {
 				throw new Error("connection timeout")
 			},
 		}
-		const manager = new UserSessionManager({ providers: [() => failingSource] })
+		const manager = new UserSessionManager({ providers: [async () => failingSource] })
 		const app = buildTestApp(manager, "user-1")
 
 		const res = await app.request("/api/feed")
@@ -168,167 +148,26 @@ describe("GET /api/feed", () => {
 		expect(body.errors[0]!.sourceId).toBe("failing")
 		expect(body.errors[0]!.error).toBe("connection timeout")
 	})
-})
 
-describe("GET /api/feed?render=json-render", () => {
+	test("returns 503 when all providers fail", async () => {
-	const stubRenderer: FeedItemRenderer = (item) => ({
-		$$typeof: JRX_NODE,
-		type: "FeedCard",
-		props: {},
-		children: [
-			{
-				$$typeof: JRX_NODE,
-				type: "SansSerifText",
-				props: { content: `Rendered: ${item.data.value}` },
-				children: [],
-				key: undefined,
-				visible: undefined,
-				on: undefined,
-				repeat: undefined,
-				watch: undefined,
-			},
-		],
-		key: undefined,
-		visible: undefined,
-		on: undefined,
-		repeat: undefined,
-		watch: undefined,
-	})
-
-	const rendererProvider = {
-		feedRendererForUser: () => new FeedRenderer({ "test-source": stubRenderer }),
-	}
-
-	test("returns rendered items with ui field as Spec", async () => {
-		const items: FeedItem[] = [
-			{
-				id: "item-1",
-				sourceId: "test-source",
-				type: "renderable",
-				timestamp: new Date("2025-01-01T00:00:00.000Z"),
-				data: { value: "hello" },
-			},
-		]
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
+			providers: [
-			rendererProvider,
+				async () => {
+					throw new Error("provider down")
+				},
+			],
 		})
 		const app = buildTestApp(manager, "user-1")
 
-		const res = await app.request("/api/feed?render=json-render")
+		const spy = spyOn(console, "error").mockImplementation(() => {})
-
-		expect(res.status).toBe(200)
-		const body = (await res.json()) as RenderedFeedResponse
-		expect(body.items).toHaveLength(1)
-		expect(body.items[0]!.id).toBe("item-1")
-		expect(body.items[0]!.ui).toBeDefined()
-		expect(body.items[0]!.ui.root).toBeDefined()
-		expect(body.items[0]!.ui.elements).toBeDefined()
-	})
-
-	test("drops items without a renderer", async () => {
-		const items: FeedItem[] = [
-			{
-				id: "renderable-1",
-				sourceId: "test-source",
-				type: "renderable",
-				timestamp: new Date("2025-01-01T00:00:00.000Z"),
-				data: { value: "yes" },
-			},
-			{
-				id: "unrenderable-1",
-				sourceId: "other-source",
-				type: "no-renderer",
-				timestamp: new Date("2025-01-01T00:00:00.000Z"),
-				data: { value: "no" },
-			},
-		]
-		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
-			rendererProvider,
-		})
-		const app = buildTestApp(manager, "user-1")
-
-		const res = await app.request("/api/feed?render=json-render")
-
-		expect(res.status).toBe(200)
-		const body = (await res.json()) as RenderedFeedResponse
-		expect(body.items).toHaveLength(1)
-		expect(body.items[0]!.id).toBe("renderable-1")
-	})
-
-	test("returns empty items when no renderers match", async () => {
-		const items: FeedItem[] = [
-			{
-				id: "item-1",
-				sourceId: "other-source",
-				type: "no-renderer",
-				timestamp: new Date("2025-01-01T00:00:00.000Z"),
-				data: { value: 42 },
-			},
-		]
-		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
-			rendererProvider,
-		})
-		const app = buildTestApp(manager, "user-1")
-
-		const res = await app.request("/api/feed?render=json-render")
-
-		expect(res.status).toBe(200)
-		const body = (await res.json()) as RenderedFeedResponse
-		expect(body.items).toHaveLength(0)
-	})
-
-	test("returns 400 for unknown render format", async () => {
-		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test")],
-			rendererProvider,
-		})
-		const app = buildTestApp(manager, "user-1")
-
-		const res = await app.request("/api/feed?render=unknown")
-
-		expect(res.status).toBe(400)
-		const body = (await res.json()) as { error: string }
-		expect(body.error).toContain("unknown")
-	})
-
-	test("returns 500 when renderer is not available", async () => {
-		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test")],
-		})
-		const app = buildTestApp(manager, "user-1")
-
-		const res = await app.request("/api/feed?render=json-render")
-
-		expect(res.status).toBe(500)
-		const body = (await res.json()) as { error: string }
-		expect(body.error).toContain("not available")
-	})
-
-	test("without render param returns raw items (no ui field)", async () => {
-		const items: FeedItem[] = [
-			{
-				id: "item-1",
-				sourceId: "test-source",
-				type: "renderable",
-				timestamp: new Date("2025-01-01T00:00:00.000Z"),
-				data: { value: 42 },
-			},
-		]
-		const manager = new UserSessionManager({
-			providers: [() => createStubSource("test", items)],
-			rendererProvider,
-		})
-		const app = buildTestApp(manager, "user-1")
 
 		const res = await app.request("/api/feed")
 
-		expect(res.status).toBe(200)
+		expect(res.status).toBe(503)
-		const body = (await res.json()) as FeedResponse
+		const body = (await res.json()) as { error: string }
-		expect(body.items).toHaveLength(1)
+		expect(body.error).toBe("Service unavailable")
-		expect(body.items[0]!).not.toHaveProperty("ui")
+
+		spy.mockRestore()
 	})
 })
 
@@ -340,12 +179,12 @@ describe("GET /api/context", () => {
 	// The mock auth middleware always injects this hardcoded user ID
 	const mockUserId = "k7Gx2mPqRvNwYs9TdLfA4bHcJeUo1iZn"
 
-	function buildContextApp(userId?: string) {
+	async function buildContextApp(userId?: string) {
 		const manager = new UserSessionManager({
-			providers: [() => createStubSource("weather", [], contextEntries)],
+			providers: [async () => createStubSource("weather", [], contextEntries)],
 		})
 		const app = buildTestApp(manager, userId)
-		const session = manager.getOrCreate(mockUserId)
+		const session = await manager.getOrCreate(mockUserId)
 		return { app, session }
 	}
 
@@ -359,7 +198,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key param is missing", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context")
 
@@ -369,7 +208,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is invalid JSON", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=notjson")
 
@@ -379,7 +218,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is not an array", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request('/api/context?key="string"')
 
@@ -389,7 +228,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key contains invalid element types", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=[true,null,[1,2]]")
 
@@ -399,7 +238,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when key is an empty array", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request("/api/context?key=[]")
 
@@ -409,7 +248,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 400 when match param is invalid", async () => {
-		const { app } = buildContextApp("user-1")
+		const { app } = await buildContextApp("user-1")
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=invalid')
 
@@ -419,7 +258,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns exact match with match=exact", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather","weather"]&match=exact')
@@ -431,7 +270,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 404 with match=exact when only prefix would match", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=exact')
@@ -440,7 +279,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns prefix match with match=prefix", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]&match=prefix')
@@ -457,7 +296,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("default mode returns exact match when available", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather","weather"]')
@@ -469,7 +308,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("default mode falls back to prefix when no exact match", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["aelis.weather"]')
@@ -485,7 +324,7 @@ describe("GET /api/context", () => {
 	})
 
 	test("returns 404 when neither exact nor prefix matches", async () => {
-		const { app, session } = buildContextApp("user-1")
+		const { app, session } = await buildContextApp("user-1")
 		await session.engine.refresh()
 
 		const res = await app.request('/api/context?key=["nonexistent"]')

apps/aelis-backend/src/engine/http.ts

@@ -1,7 +1,6 @@
 import type { Context, Hono } from "hono"
 
 import { contextKey } from "@aelis/core"
-import { render } from "@nym.sh/jrx"
 import { createMiddleware } from "hono/factory"
 
 import type { AuthSessionMiddleware } from "../auth/session-middleware.ts"
@@ -34,35 +33,17 @@ export function registerFeedHttpHandlers(
 async function handleGetFeed(c: Context<Env>) {
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleGetFeed] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
 
 	const feed = await session.feed()
 
-	const renderParam = c.req.query("render")
-
-	if (renderParam !== undefined) {
-		if (renderParam !== "json-render") {
-			return c.json({ error: `Unknown render format: "${renderParam}"` }, 400)
-		}
-
-		if (!session.renderer) {
-			return c.json({ error: "Rendering is not available" }, 500)
-		}
-
-		const renderedItems = session.renderer.render(feed.items).map((item) => ({
-			...item,
-			ui: render(item.ui),
-		}))
-
-		return c.json({
-			items: renderedItems,
-			errors: feed.errors.map((e) => ({
-				sourceId: e.sourceId,
-				error: e.error.message,
-			})),
-		})
-	}
-
 	return c.json({
 		items: feed.items,
 		errors: feed.errors.map((e) => ({
@@ -72,7 +53,7 @@ async function handleGetFeed(c: Context<Env>) {
 	})
 }
 
-function handleGetContext(c: Context<Env>) {
+async function handleGetContext(c: Context<Env>) {
 	const keyParam = c.req.query("key")
 	if (!keyParam) {
 		return c.json({ error: 'Invalid or missing "key" parameter: must be a JSON array' }, 400)
@@ -96,7 +77,15 @@ function handleGetContext(c: Context<Env>) {
 
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleGetContext] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
+
 	const context = session.engine.currentContext()
 	const key = contextKey(...parsed)
 

apps/aelis-backend/src/location/http.ts

@@ -44,7 +44,15 @@ async function handleUpdateLocation(c: Context<Env>) {
 
 	const user = c.get("user")!
 	const sessionManager = c.get("sessionManager")
-	const session = sessionManager.getOrCreate(user.id)
+
+	let session
+	try {
+		session = await sessionManager.getOrCreate(user.id)
+	} catch (err) {
+		console.error("[handleUpdateLocation] Failed to create session:", err)
+		return c.json({ error: "Service unavailable" }, 503)
+	}
+
 	await session.engine.executeAction("aelis.location", "update-location", {
 		lat: result.lat,
 		lng: result.lng,

apps/aelis-backend/src/server.ts

@@ -2,14 +2,12 @@ import { LocationSource } from "@aelis/source-location"
 import { Hono } from "hono"
 
 import { registerAuthHandlers } from "./auth/http.ts"
-import { mockAuthSessionMiddleware, requireSession } from "./auth/session-middleware.ts"
+import { requireSession } from "./auth/session-middleware.ts"
-import { CALDAV_SOURCE_ID, calDavRenderer } from "./caldav/renderer-provider.ts"
 import { registerFeedHttpHandlers } from "./engine/http.ts"
 import { createFeedEnhancer } from "./enhancement/enhance-feed.ts"
 import { createLlmClient } from "./enhancement/llm-client.ts"
 import { registerLocationHttpHandlers } from "./location/http.ts"
-import { FeedRenderer, UserSessionManager } from "./session/index.ts"
+import { UserSessionManager } from "./session/index.ts"
-import { TFL_SOURCE_ID, tflRenderer } from "./tfl/renderer-provider.ts"
 import { WeatherSourceProvider } from "./weather/provider.ts"
 
 function main() {
@@ -26,14 +24,9 @@ function main() {
 		console.warn("[enhancement] OPENROUTER_API_KEY not set — feed enhancement disabled")
 	}
 
-	const allRenderers = {
-		[TFL_SOURCE_ID]: tflRenderer,
-		[CALDAV_SOURCE_ID]: calDavRenderer,
-	}
-
 	const sessionManager = new UserSessionManager({
 		providers: [
-			() => new LocationSource(),
+			async () => new LocationSource(),
 			new WeatherSourceProvider({
 				credentials: {
 					privateKey: process.env.WEATHERKIT_PRIVATE_KEY!,
@@ -43,9 +36,6 @@ function main() {
 				},
 			}),
 		],
-		rendererProvider: {
-			feedRendererForUser: (_userId) => new FeedRenderer(allRenderers),
-		},
 		feedEnhancer,
 	})
 
@@ -53,16 +43,11 @@ function main() {
 
 	app.get("/health", (c) => c.json({ status: "ok" }))
 
-	const isDev = process.env.NODE_ENV !== "production"
+	registerAuthHandlers(app)
-	const authSessionMiddleware = isDev ? mockAuthSessionMiddleware("dev-user") : requireSession
-
-	if (!isDev) {
-		registerAuthHandlers(app)
-	}
 
 	registerFeedHttpHandlers(app, {
 		sessionManager,
-		authSessionMiddleware,
+		authSessionMiddleware: requireSession,
 	})
 	registerLocationHttpHandlers(app, { sessionManager })
 

apps/aelis-backend/src/session/feed-renderer.ts

@@ -1,30 +0,0 @@
-import type { FeedItem, FeedItemRenderer, RenderedFeedItem } from "@aelis/core"
-
-/**
- * Renders feed items using registered renderers.
- *
- * Constructed with a map of source ID to renderer function.
- * Items whose source has no renderer are silently dropped.
- */
-export class FeedRenderer {
-	private readonly renderers: Map<string, FeedItemRenderer>
-
-	constructor(renderers: Record<string, FeedItemRenderer>) {
-		this.renderers = new Map(Object.entries(renderers))
-	}
-
-	/**
-	 * Renders an array of feed items. Items whose sourceId has no
-	 * registered renderer are silently dropped from the result.
-	 */
-	render(items: FeedItem[]): RenderedFeedItem[] {
-		const result: RenderedFeedItem[] = []
-		for (const item of items) {
-			const renderer = this.renderers.get(item.sourceId)
-			if (renderer) {
-				result.push({ ...item, ui: renderer(item) })
-			}
-		}
-		return result
-	}
-}

apps/aelis-backend/src/session/feed-source-provider.ts

@@ -1,9 +1,9 @@
 import type { FeedSource } from "@aelis/core"
 
 export interface FeedSourceProvider {
-	feedSourceForUser(userId: string): FeedSource
+	feedSourceForUser(userId: string): Promise<FeedSource>
 }
 
-export type FeedSourceProviderFn = (userId: string) => FeedSource
+export type FeedSourceProviderFn = (userId: string) => Promise<FeedSource>
 
 export type FeedSourceProviderInput = FeedSourceProvider | FeedSourceProviderFn

apps/aelis-backend/src/session/index.ts

@@ -3,7 +3,5 @@ export type {
 	FeedSourceProviderFn,
 	FeedSourceProviderInput,
 } from "./feed-source-provider.ts"
-export { FeedRenderer } from "./feed-renderer.ts"
-export type { FeedRendererProvider } from "./renderer-provider.ts"
 export { UserSession } from "./user-session.ts"
 export { UserSessionManager } from "./user-session-manager.ts"

apps/aelis-backend/src/session/renderer-provider.ts

@@ -1,5 +0,0 @@
-import type { FeedRenderer } from "./feed-renderer.ts"
-
-export interface FeedRendererProvider {
-	feedRendererForUser(userId: string): FeedRenderer
-}

apps/aelis-backend/src/session/user-session-manager.test.ts

@@ -1,7 +1,7 @@
 import type { WeatherKitClient, WeatherKitResponse } from "@aelis/source-weatherkit"
 
 import { LocationSource } from "@aelis/source-location"
-import { describe, expect, mock, test } from "bun:test"
+import { describe, expect, mock, spyOn, test } from "bun:test"
 
 import { WeatherSourceProvider } from "../weather/provider.ts"
 import { UserSessionManager } from "./user-session-manager.ts"
@@ -11,38 +11,38 @@ const mockWeatherClient: WeatherKitClient = {
 }
 
 describe("UserSessionManager", () => {
-	test("getOrCreate creates session on first call", () => {
+	test("getOrCreate creates session on first call", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session).toBeDefined()
 		expect(session.engine).toBeDefined()
 	})
 
-	test("getOrCreate returns same session for same user", () => {
+	test("getOrCreate returns same session for same user", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 
 		expect(session1).toBe(session2)
 	})
 
-	test("getOrCreate returns different sessions for different users", () => {
+	test("getOrCreate returns different sessions for different users", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-2")
+		const session2 = await manager.getOrCreate("user-2")
 
 		expect(session1).not.toBe(session2)
 	})
 
-	test("each user gets independent source instances", () => {
+	test("each user gets independent source instances", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
-		const session2 = manager.getOrCreate("user-2")
+		const session2 = await manager.getOrCreate("user-2")
 
 		const source1 = session1.getSource<LocationSource>("aelis.location")
 		const source2 = session2.getSource<LocationSource>("aelis.location")
@@ -50,58 +50,58 @@ describe("UserSessionManager", () => {
 		expect(source1).not.toBe(source2)
 	})
 
-	test("remove destroys session and allows re-creation", () => {
+	test("remove destroys session and allows re-creation", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session1 = manager.getOrCreate("user-1")
+		const session1 = await manager.getOrCreate("user-1")
 		manager.remove("user-1")
-		const session2 = manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 
 		expect(session1).not.toBe(session2)
 	})
 
 	test("remove is no-op for unknown user", () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
 		expect(() => manager.remove("unknown")).not.toThrow()
 	})
 
 	test("accepts function providers", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		const result = await session.engine.refresh()
 
 		expect(result.errors).toHaveLength(0)
 	})
 
-	test("accepts object providers", () => {
+	test("accepts object providers", async () => {
 		const provider = new WeatherSourceProvider({ client: mockWeatherClient })
 		const manager = new UserSessionManager({
-			providers: [() => new LocationSource(), provider],
+			providers: [async () => new LocationSource(), provider],
 		})
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session.getSource("aelis.weather")).toBeDefined()
 	})
 
-	test("accepts mixed providers", () => {
+	test("accepts mixed providers", async () => {
 		const provider = new WeatherSourceProvider({ client: mockWeatherClient })
 		const manager = new UserSessionManager({
-			providers: [() => new LocationSource(), provider],
+			providers: [async () => new LocationSource(), provider],
 		})
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 
 		expect(session.getSource("aelis.location")).toBeDefined()
 		expect(session.getSource("aelis.weather")).toBeDefined()
 	})
 
 	test("refresh returns feed result through session", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		const result = await session.engine.refresh()
 
 		expect(result).toHaveProperty("context")
@@ -111,9 +111,9 @@ describe("UserSessionManager", () => {
 	})
 
 	test("location update via executeAction works", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		await session.engine.executeAction("aelis.location", "update-location", {
 			lat: 51.5074,
 			lng: -0.1278,
@@ -126,10 +126,10 @@ describe("UserSessionManager", () => {
 	})
 
 	test("subscribe receives updates after location push", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 		const callback = mock()
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		session.engine.subscribe(callback)
 
 		await session.engine.executeAction("aelis.location", "update-location", {
@@ -146,16 +146,16 @@ describe("UserSessionManager", () => {
 	})
 
 	test("remove stops reactive updates", async () => {
-		const manager = new UserSessionManager({ providers: [() => new LocationSource()] })
+		const manager = new UserSessionManager({ providers: [async () => new LocationSource()] })
 		const callback = mock()
 
-		const session = manager.getOrCreate("user-1")
+		const session = await manager.getOrCreate("user-1")
 		session.engine.subscribe(callback)
 
 		manager.remove("user-1")
 
 		// Create new session and push location — old callback should not fire
-		const session2 = manager.getOrCreate("user-1")
+		const session2 = await manager.getOrCreate("user-1")
 		await session2.engine.executeAction("aelis.location", "update-location", {
 			lat: 51.5074,
 			lng: -0.1278,
@@ -167,4 +167,93 @@ describe("UserSessionManager", () => {
 
 		expect(callback).not.toHaveBeenCalled()
 	})
+
+	test("creates session with successful providers when some fail", async () => {
+		const manager = new UserSessionManager({
+			providers: [
+				async () => new LocationSource(),
+				async () => {
+					throw new Error("provider failed")
+				},
+			],
+		})
+
+		const spy = spyOn(console, "error").mockImplementation(() => {})
+
+		const session = await manager.getOrCreate("user-1")
+
+		expect(session).toBeDefined()
+		expect(session.getSource("aelis.location")).toBeDefined()
+		expect(spy).toHaveBeenCalled()
+
+		spy.mockRestore()
+	})
+
+	test("throws AggregateError when all providers fail", async () => {
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					throw new Error("first failed")
+				},
+				async () => {
+					throw new Error("second failed")
+				},
+			],
+		})
+
+		await expect(manager.getOrCreate("user-1")).rejects.toBeInstanceOf(AggregateError)
+	})
+
+	test("concurrent getOrCreate for same user returns same session", async () => {
+		let callCount = 0
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					callCount++
+					// Simulate async work to widen the race window
+					await new Promise((resolve) => setTimeout(resolve, 10))
+					return new LocationSource()
+				},
+			],
+		})
+
+		const [session1, session2] = await Promise.all([
+			manager.getOrCreate("user-1"),
+			manager.getOrCreate("user-1"),
+		])
+
+		expect(session1).toBe(session2)
+		expect(callCount).toBe(1)
+	})
+
+	test("remove during in-flight getOrCreate prevents session from being stored", async () => {
+		let resolveProvider: () => void
+		const providerGate = new Promise<void>((r) => {
+			resolveProvider = r
+		})
+
+		const manager = new UserSessionManager({
+			providers: [
+				async () => {
+					await providerGate
+					return new LocationSource()
+				},
+			],
+		})
+
+		const sessionPromise = manager.getOrCreate("user-1")
+
+		// remove() while provider is still resolving
+		manager.remove("user-1")
+
+		// Let the provider finish
+		resolveProvider!()
+
+		await expect(sessionPromise).rejects.toThrow("removed during creation")
+
+		// A fresh getOrCreate should produce a new session, not the cancelled one
+		const freshSession = await manager.getOrCreate("user-1")
+		expect(freshSession).toBeDefined()
+		expect(freshSession.engine).toBeDefined()
+	})
 })

apps/aelis-backend/src/session/user-session-manager.ts

@@ -1,41 +1,48 @@
+import type { FeedSource } from "@aelis/core"
+
 import type { FeedEnhancer } from "../enhancement/enhance-feed.ts"
 import type { FeedSourceProviderInput } from "./feed-source-provider.ts"
-import type { FeedRendererProvider } from "./renderer-provider.ts"
 
 import { UserSession } from "./user-session.ts"
 
 export interface UserSessionManagerConfig {
 	providers: FeedSourceProviderInput[]
-	rendererProvider?: FeedRendererProvider | null
 	feedEnhancer?: FeedEnhancer | null
 }
 
 export class UserSessionManager {
 	private sessions = new Map<string, UserSession>()
+	private pending = new Map<string, Promise<UserSession>>()
 	private readonly providers: FeedSourceProviderInput[]
-	private readonly rendererProvider: FeedRendererProvider | null
 	private readonly feedEnhancer: FeedEnhancer | null
 
 	constructor(config: UserSessionManagerConfig) {
 		this.providers = config.providers
-		this.rendererProvider = config.rendererProvider ?? null
 		this.feedEnhancer = config.feedEnhancer ?? null
 	}
 
-	getOrCreate(userId: string): UserSession {
+	async getOrCreate(userId: string): Promise<UserSession> {
-		let session = this.sessions.get(userId)
+		const existing = this.sessions.get(userId)
-		if (!session) {
+		if (existing) return existing
-			const sources = this.providers.map((p) =>
+
-				typeof p === "function" ? p(userId) : p.feedSourceForUser(userId),
+		const inflight = this.pending.get(userId)
-			)
+		if (inflight) return inflight
-			session = new UserSession({
+
-				sources,
+		const promise = this.createSession(userId)
-				enhancer: this.feedEnhancer,
+		this.pending.set(userId, promise)
-				renderer: this.rendererProvider?.feedRendererForUser(userId) ?? null,
+		try {
-			})
+			const session = await promise
+			// If remove() was called while we were awaiting, it clears the
+			// pending entry. Detect that and destroy the session immediately.
+			if (!this.pending.has(userId)) {
+				session.destroy()
+				throw new Error(`Session for user ${userId} was removed during creation`)
+			}
 			this.sessions.set(userId, session)
+			return session
+		} finally {
+			this.pending.delete(userId)
 		}
-		return session
 	}
 
 	remove(userId: string): void {
@@ -44,5 +51,36 @@ export class UserSessionManager {
 			session.destroy()
 			this.sessions.delete(userId)
 		}
+		// Cancel any in-flight creation so getOrCreate won't store the session
+		this.pending.delete(userId)
+	}
+
+	private async createSession(userId: string): Promise<UserSession> {
+		const results = await Promise.allSettled(
+			this.providers.map((p) =>
+				typeof p === "function" ? p(userId) : p.feedSourceForUser(userId),
+			),
+		)
+
+		const sources: FeedSource[] = []
+		const errors: unknown[] = []
+
+		for (const result of results) {
+			if (result.status === "fulfilled") {
+				sources.push(result.value)
+			} else {
+				errors.push(result.reason)
+			}
+		}
+
+		if (sources.length === 0 && errors.length > 0) {
+			throw new AggregateError(errors, "All feed source providers failed")
+		}
+
+		for (const error of errors) {
+			console.error("[UserSessionManager] Feed source provider failed:", error)
+		}
+
+		return new UserSession(sources, this.feedEnhancer)
 	}
 }

apps/aelis-backend/src/session/user-session.test.ts

@@ -1,16 +1,8 @@
-import type {
+import type { ActionDefinition, ContextEntry, FeedItem, FeedSource } from "@aelis/core"
-	ActionDefinition,
-	ContextEntry,
-	FeedItem,
-	FeedItemRenderer,
-	FeedSource,
-} from "@aelis/core"
 
 import { LocationSource } from "@aelis/source-location"
-import { JRX_NODE } from "@nym.sh/jrx"
 import { describe, expect, test } from "bun:test"
 
-import { FeedRenderer } from "./feed-renderer.ts"
 import { UserSession } from "./user-session.ts"
 
 function createStubSource(id: string, items: FeedItem[] = []): FeedSource {
@@ -33,9 +25,7 @@ function createStubSource(id: string, items: FeedItem[] = []): FeedSource {
 
 describe("UserSession", () => {
 	test("registers sources and starts engine", async () => {
-		const session = new UserSession({
+		const session = new UserSession([createStubSource("test-a"), createStubSource("test-b")])
-			sources: [createStubSource("test-a"), createStubSource("test-b")],
-		})
 
 		const result = await session.engine.refresh()
 
@@ -44,7 +34,7 @@ describe("UserSession", () => {
 
 	test("getSource returns registered source", () => {
 		const location = new LocationSource()
-		const session = new UserSession({ sources: [location] })
+		const session = new UserSession([location])
 
 		const result = session.getSource<LocationSource>("aelis.location")
 
@@ -52,13 +42,13 @@ describe("UserSession", () => {
 	})
 
 	test("getSource returns undefined for unknown source", () => {
-		const session = new UserSession({ sources: [createStubSource("test")] })
+		const session = new UserSession([createStubSource("test")])
 
 		expect(session.getSource("unknown")).toBeUndefined()
 	})
 
 	test("destroy stops engine and clears sources", () => {
-		const session = new UserSession({ sources: [createStubSource("test")] })
+		const session = new UserSession([createStubSource("test")])
 
 		session.destroy()
 
@@ -67,7 +57,7 @@ describe("UserSession", () => {
 
 	test("engine.executeAction routes to correct source", async () => {
 		const location = new LocationSource()
-		const session = new UserSession({ sources: [location] })
+		const session = new UserSession([location])
 
 		await session.engine.executeAction("aelis.location", "update-location", {
 			lat: 51.5,
@@ -92,7 +82,7 @@ describe("UserSession.feed", () => {
 				data: { value: 42 },
 			},
 		]
-		const session = new UserSession({ sources: [createStubSource("test", items)] })
+		const session = new UserSession([createStubSource("test", items)])
 
 		const result = await session.feed()
 
@@ -113,7 +103,7 @@ describe("UserSession.feed", () => {
 		const enhancer = async (feedItems: FeedItem[]) =>
 			feedItems.map((item) => ({ ...item, data: { ...item.data, enhanced: true } }))
 
-		const session = new UserSession({ sources: [createStubSource("test", items)], enhancer })
+		const session = new UserSession([createStubSource("test", items)], enhancer)
 
 		const result = await session.feed()
 
@@ -137,7 +127,7 @@ describe("UserSession.feed", () => {
 			return feedItems.map((item) => ({ ...item, data: { ...item.data, enhanced: true } }))
 		}
 
-		const session = new UserSession({ sources: [createStubSource("test", items)], enhancer })
+		const session = new UserSession([createStubSource("test", items)], enhancer)
 
 		const result1 = await session.feed()
 		expect(result1.items[0]!.data.enhanced).toBe(true)
@@ -172,7 +162,7 @@ describe("UserSession.feed", () => {
 			}))
 		}
 
-		const session = new UserSession({ sources: [source], enhancer })
+		const session = new UserSession([source], enhancer)
 
 		// First feed triggers refresh + enhancement
 		const result1 = await session.feed()
@@ -215,7 +205,7 @@ describe("UserSession.feed", () => {
 			throw new Error("enhancement exploded")
 		}
 
-		const session = new UserSession({ sources: [createStubSource("test", items)], enhancer })
+		const session = new UserSession([createStubSource("test", items)], enhancer)
 
 		const result = await session.feed()
 
@@ -224,81 +214,3 @@ describe("UserSession.feed", () => {
 		expect(result.items[0]!.data.value).toBe(42)
 	})
 })
-
-describe("FeedRenderer", () => {
-	const stubRenderer: FeedItemRenderer = (item) => ({
-		$$typeof: JRX_NODE,
-		type: "FeedCard",
-		props: { content: item.data.value },
-		children: [],
-		key: undefined,
-		visible: undefined,
-		on: undefined,
-		repeat: undefined,
-		watch: undefined,
-	})
-
-	function makeItem(sourceId: string): FeedItem {
-		return {
-			id: `item-${sourceId}`,
-			sourceId,
-			type: "some-type",
-			timestamp: new Date("2025-01-01T00:00:00.000Z"),
-			data: { value: 42 },
-		}
-	}
-
-	test("renders items with matching sourceId", () => {
-		const renderer = new FeedRenderer({ "test-source": stubRenderer })
-
-		const result = renderer.render([makeItem("test-source")])
-
-		expect(result).toHaveLength(1)
-		expect(result[0]!.ui).toBeDefined()
-		expect(result[0]!.id).toBe("item-test-source")
-	})
-
-	test("drops items without a matching renderer", () => {
-		const renderer = new FeedRenderer({ "test-source": stubRenderer })
-
-		const result = renderer.render([makeItem("unknown-source")])
-
-		expect(result).toHaveLength(0)
-	})
-
-	test("filters mixed items", () => {
-		const renderer = new FeedRenderer({ "test-source": stubRenderer })
-
-		const result = renderer.render([makeItem("test-source"), makeItem("unknown-source")])
-
-		expect(result).toHaveLength(1)
-		expect(result[0]!.id).toBe("item-test-source")
-	})
-
-	test("renders empty array for empty input", () => {
-		const renderer = new FeedRenderer({ "test-source": stubRenderer })
-
-		expect(renderer.render([])).toHaveLength(0)
-	})
-
-	test("renders with no renderers registered", () => {
-		const renderer = new FeedRenderer({})
-
-		expect(renderer.render([makeItem("test-source")])).toHaveLength(0)
-	})
-})
-
-describe("UserSession.renderer", () => {
-	test("exposes renderer when provided", () => {
-		const renderer = new FeedRenderer({})
-		const session = new UserSession({ sources: [createStubSource("test")], renderer })
-
-		expect(session.renderer).toBe(renderer)
-	})
-
-	test("renderer is null when not provided", () => {
-		const session = new UserSession({ sources: [createStubSource("test")] })
-
-		expect(session.renderer).toBeNull()
-	})
-})

apps/aelis-backend/src/session/user-session.ts

@@ -1,17 +1,9 @@
 import { FeedEngine, type FeedItem, type FeedResult, type FeedSource } from "@aelis/core"
 
 import type { FeedEnhancer } from "../enhancement/enhance-feed.ts"
-import type { FeedRenderer } from "./feed-renderer.ts"
-
-export interface UserSessionOptions {
-	sources: FeedSource[]
-	enhancer?: FeedEnhancer | null
-	renderer?: FeedRenderer | null
-}
 
 export class UserSession {
 	readonly engine: FeedEngine
-	readonly renderer: FeedRenderer | null
 	private sources = new Map<string, FeedSource>()
 	private readonly enhancer: FeedEnhancer | null
 	private enhancedItems: FeedItem[] | null = null
@@ -20,11 +12,10 @@ export class UserSession {
 	private enhancingPromise: Promise<void> | null = null
 	private unsubscribe: (() => void) | null = null
 
-	constructor(options: UserSessionOptions) {
+	constructor(sources: FeedSource[], enhancer?: FeedEnhancer | null) {
 		this.engine = new FeedEngine()
-		this.enhancer = options.enhancer ?? null
+		this.enhancer = enhancer ?? null
-		this.renderer = options.renderer ?? null
+		for (const source of sources) {
-		for (const source of options.sources) {
 			this.sources.set(source.id, source)
 			this.engine.register(source)
 		}

apps/aelis-backend/src/tfl/provider.ts

@@ -13,7 +13,7 @@ export class TflSourceProvider implements FeedSourceProvider {
 		this.options = options
 	}
 
-	feedSourceForUser(_userId: string): TflSource {
+	async feedSourceForUser(_userId: string): Promise<TflSource> {
 		return new TflSource(this.options)
 	}
 }

apps/aelis-backend/src/tfl/renderer-provider.ts

@@ -1,7 +0,0 @@
-import type { FeedItemRenderer } from "@aelis/core"
-
-import { renderTflAlert } from "@aelis/source-tfl"
-
-export const TFL_SOURCE_ID = "aelis.tfl"
-
-export const tflRenderer: FeedItemRenderer = renderTflAlert as FeedItemRenderer

apps/aelis-backend/src/weather/provider.ts

@@ -9,7 +9,7 @@ export class WeatherSourceProvider implements FeedSourceProvider {
 		this.options = options
 	}
 
-	feedSourceForUser(_userId: string): WeatherSource {
+	async feedSourceForUser(_userId: string): Promise<WeatherSource> {
 		return new WeatherSource(this.options)
 	}
 }

apps/aelis-client/package.json

@@ -22,6 +22,7 @@
 		"@react-navigation/bottom-tabs": "^7.4.0",
 		"@react-navigation/elements": "^2.6.3",
 		"@react-navigation/native": "^7.1.8",
+		"@tanstack/react-query": "^5.90.21",
 		"expo": "~54.0.33",
 		"expo-constants": "~18.0.13",
 		"expo-dev-client": "~6.0.20",

apps/aelis-client/src/api/auth-middleware.ts

@@ -0,0 +1,6 @@
+import { ApiRequestMiddleware } from "./client"
+
+export const authMiddleware: ApiRequestMiddleware = (_url, init) => {
+	// TODO: placeholder auth middleware
+	return init
+}

apps/aelis-client/src/api/client.ts

@@ -0,0 +1,39 @@
+import { createContext, useContext } from "react"
+
+export type ApiRequestMiddleware = (
+	url: Parameters<typeof fetch>[0],
+	init: RequestInit,
+) => RequestInit
+
+export class ApiClient {
+	private readonly baseUrl: string
+	private readonly middlewares: readonly ApiRequestMiddleware[]
+
+	static noop = new ApiClient({ baseUrl: "" })
+
+	constructor({
+		baseUrl,
+		middlewares = [],
+	}: {
+		baseUrl: string
+		middlewares?: ApiRequestMiddleware[]
+	}) {
+		this.baseUrl = baseUrl
+		this.middlewares = middlewares
+	}
+
+	async request<T>(...[url, init = {}]: Parameters<typeof fetch>): Promise<[Response, T]> {
+		const finalInit = this.middlewares.reduce(
+			(prevInit, middleware) => middleware(url, prevInit),
+			init,
+		)
+		return fetch(this.baseUrl ? new URL(url.toString(), this.baseUrl) : url, finalInit).then((res) =>
+			Promise.all([Promise.resolve(res), res.json()]),
+		)
+	}
+}
+
+export const ApiClientContext = createContext(ApiClient.noop)
+export function useApiClient() {
+	return useContext(ApiClientContext)
+}

apps/aelis-client/src/app/_layout.tsx

@@ -1,17 +1,29 @@
 import "react-native-reanimated"
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query"
 import { Stack } from "expo-router"
 import { StatusBar } from "expo-status-bar"
+import React from "react"
 import { useColorScheme } from "react-native"
 import tw, { useDeviceContext } from "twrnc"
 
+import { authMiddleware } from "@/api/auth-middleware"
+import { ApiClient, ApiClientContext } from "@/api/client"
+
+const queryClient = new QueryClient()
+const apiClient = new ApiClient({
+	baseUrl: process.env.EXPO_PUBLIC_API_BASE_URL ?? "",
+	middlewares: [authMiddleware],
+})
+
 export default function RootLayout() {
 	useDeviceContext(tw)
+
 	const colorScheme = useColorScheme()
 	const headerBg = colorScheme === "dark" ? "#1c1917" : "#f5f5f4"
 	const headerTint = colorScheme === "dark" ? "#e7e5e4" : "#1c1917"
 
 	return (
-		<>
+		<ContextProvider>
 			<Stack
 				screenOptions={{
 					headerShown: false,
@@ -40,6 +52,14 @@ export default function RootLayout() {
 				/>
 			</Stack>
 			<StatusBar style="auto" />
-		</>
+		</ContextProvider>
+	)
+}
+
+function ContextProvider({ children }: React.PropsWithChildren) {
+	return (
+		<QueryClientProvider client={queryClient}>
+			<ApiClientContext value={apiClient}>{children}</ApiClientContext>
+		</QueryClientProvider>
 	)
 }

apps/aelis-client/src/feed/queries.ts

@@ -0,0 +1,13 @@
+import { queryOptions } from "@tanstack/react-query"
+
+import { useApiClient } from "@/api/client"
+
+import { FeedItem } from "./types"
+
+export function useFeedQuery() {
+	const api = useApiClient()
+	return queryOptions({
+		queryKey: ["feed"],
+		queryFn: async () => api.request<{ items: FeedItem[] }>("/feed?render=json-render"),
+	})
+}

apps/aelis-client/src/feed/types.ts

@@ -0,0 +1,5 @@
+import { Spec } from "@json-render/core"
+
+export interface FeedItem {
+	ui: Spec
+}

bun.lock

@@ -25,7 +25,6 @@
         "@aelis/source-location": "workspace:*",
         "@aelis/source-tfl": "workspace:*",
         "@aelis/source-weatherkit": "workspace:*",
-        "@nym.sh/jrx": "^0.2.0",
         "@openrouter/sdk": "^0.9.11",
         "arktype": "^2.1.29",
         "better-auth": "^1",
@@ -47,6 +46,7 @@
         "@react-navigation/bottom-tabs": "^7.4.0",
         "@react-navigation/elements": "^2.6.3",
         "@react-navigation/native": "^7.1.8",
+        "@tanstack/react-query": "^5.90.21",
         "expo": "~54.0.33",
         "expo-constants": "~18.0.13",
         "expo-dev-client": "~6.0.20",
@@ -1190,6 +1190,10 @@
 
     "@tailwindcss/vite": ["@tailwindcss/vite@4.2.1", "", { "dependencies": { "@tailwindcss/node": "4.2.1", "@tailwindcss/oxide": "4.2.1", "tailwindcss": "4.2.1" }, "peerDependencies": { "vite": "^5.2.0 || ^6 || ^7" } }, "sha512-TBf2sJjYeb28jD2U/OhwdW0bbOsxkWPwQ7SrqGf9sVcoYwZj7rkXljroBO9wKBut9XnmQLXanuDUeqQK0lGg/w=="],
 
+    "@tanstack/query-core": ["@tanstack/query-core@5.90.20", "", {}, "sha512-OMD2HLpNouXEfZJWcKeVKUgQ5n+n3A2JFmBaScpNDUqSrQSjiveC7dKMe53uJUg1nDG16ttFPz2xfilz6i2uVg=="],
+
+    "@tanstack/react-query": ["@tanstack/react-query@5.90.21", "", { "dependencies": { "@tanstack/query-core": "5.90.20" }, "peerDependencies": { "react": "^18 || ^19" } }, "sha512-0Lu6y5t+tvlTJMTO7oh5NSpJfpg/5D41LlThfepTixPYkJ0sE2Jj0m0f6yYqujBwIXlId87e234+MxG3D3g7kg=="],
+
     "@tsconfig/node10": ["@tsconfig/node10@1.0.12", "", {}, "sha512-UCYBaeFvM11aU2y3YPZ//O5Rhj+xKyzy7mvcIoAjASbigy8mHMryP5cK7dgjlz2hWxh1g5pLw084E0a/wlUSFQ=="],
 
     "@tsconfig/node12": ["@tsconfig/node12@1.0.11", "", {}, "sha512-cqefuRsh12pWyGsIoBKJA9luFu3mRxCA+ORZvA4ktLSzIuCUtWVxGIuXigEwO5/ywWFMZ2QEGKWvkZG1zDMTag=="],