@pylonsync/sdk 0.8.3 → 0.9.1

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-export type RouteMode = "static" | "server" | "live" | "ssr";
+export type { RouteMode } from "./route";
+import type { RouteDefinition } from "./route";
 export type FieldType = "string" | "int" | "float" | "bool" | "datetime" | "richtext" | "json" | `id(${string})` | `vector(${number})`;
 /**
  * CRDT container override for a field. Wire format is the kebab-case
@@ -376,38 +377,8 @@ export declare function entity(name: string, fields: Record<string, FieldBuilder
     sync?: boolean | SyncScope;
 }): EntityDefinition;
 export declare function relation(def: RelationDefinition): RelationDefinition;
-export type AuthMode = "public" | "user";
-export interface RouteDefinition {
-    path: string;
-    mode: RouteMode;
-    query?: string;
-    auth?: AuthMode;
-    /**
-     * Project-relative module path (e.g. `app/hello/page`) for SSR
-     * routes. Required when `mode === "ssr"`. Discovered automatically
-     * by `discoverAppRoutes()`; only specify manually for one-off
-     * SSR routes outside the `app/` tree.
-     */
-    component?: string;
-    /**
-     * Layout module path chain (root→leaf). Each layout wraps the next
-     * as `children`. Only relevant for `mode === "ssr"`.
-     */
-    layouts?: string[];
-    /**
-     * Route kind. Omitted (or `"page"`) is a normal navigable page.
-     * `"not-found"` / `"error"` are SSR boundary modules discovered from
-     * `app/.../not-found.tsx` and `app/.../error.tsx`. Boundary routes are
-     * NOT matched as navigable URLs — the host renders `not-found` for
-     * unmatched URLs (HTTP 404) and `error` on render failure (HTTP 500).
-     * `path` records the segment prefix the boundary covers (`/` for root).
-     * `"route"` is a form/method handler (`app/.../route.ts` exporting
-     * POST/PUT/PATCH/DELETE) — matched on its `path` for non-GET requests only,
-     * never rendered as a page.
-     */
-    kind?: "page" | "not-found" | "error" | "route" | "sitemap" | "robots" | "llms" | "og-image";
-}
-export declare function defineRoute(route: RouteDefinition): RouteDefinition;
+export { defineRoute } from "./route";
+export type { AuthMode, RouteDefinition } from "./route";
 export interface InputFieldDefinition {
     name: string;
     type: FieldType;
@@ -950,6 +921,17 @@ export type AuthConfig = {
      * any port) is always auto-trusted at every gate.
      */
     trustedOrigins?: string[];
+    /**
+     * Name of a function the runtime calls before it deletes a user through
+     * `DELETE /api/auth/account`. Pylon deletes the User row and its own
+     * auth-side rows (sessions, API keys, linked accounts, trusted devices).
+     * It does not know which app tables belong to the user, so the named
+     * function must remove them. It runs as the user with `{ userId }`; a
+     * failure aborts the deletion and the client gets
+     * `ACCOUNT_DELETE_HOOK_FAILED`. Required by the App Store's account
+     * deletion rule whenever an app stores user content.
+     */
+    onDeleteAccount?: string;
 };
 /**
  * Developer-facing camelCase config consumed by the `llm({...})`
@@ -1074,6 +1056,7 @@ export type ManifestAuthConfig = {
     };
     org_roles: string[];
     trusted_origins: string[];
+    on_delete_account?: string;
 };
 /**
  * Build the manifest's `auth` block from the user-facing camelCase

package/dist/route.d.ts

@@ -0,0 +1,33 @@
+export type RouteMode = "static" | "server" | "live" | "ssr";
+export type AuthMode = "public" | "user";
+export interface RouteDefinition {
+    path: string;
+    mode: RouteMode;
+    query?: string;
+    auth?: AuthMode;
+    /**
+     * Project-relative module path (e.g. `app/hello/page`) for SSR
+     * routes. Required when `mode === "ssr"`. Discovered automatically
+     * by `discoverAppRoutes()`; only specify manually for one-off
+     * SSR routes outside the `app/` tree.
+     */
+    component?: string;
+    /**
+     * Layout module path chain (root→leaf). Each layout wraps the next
+     * as `children`. Only relevant for `mode === "ssr"`.
+     */
+    layouts?: string[];
+    /**
+     * Route kind. Omitted (or `"page"`) is a normal navigable page.
+     * `"not-found"` / `"error"` are SSR boundary modules discovered from
+     * `app/.../not-found.tsx` and `app/.../error.tsx`. Boundary routes are
+     * NOT matched as navigable URLs — the host renders `not-found` for
+     * unmatched URLs (HTTP 404) and `error` on render failure (HTTP 500).
+     * `path` records the segment prefix the boundary covers (`/` for root).
+     * `"route"` is a form/method handler (`app/.../route.ts` exporting
+     * POST/PUT/PATCH/DELETE) — matched on its `path` for non-GET requests only,
+     * never rendered as a page.
+     */
+    kind?: "page" | "not-found" | "error" | "route" | "sitemap" | "robots" | "llms" | "og-image";
+}
+export declare function defineRoute(route: RouteDefinition): RouteDefinition;

package/package.json

@@ -3,10 +3,28 @@
   "publishConfig": {
     "access": "public"
   },
-  "version": "0.8.3",
+  "version": "0.9.1",
   "type": "module",
   "main": "./src/index.ts",
   "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./route": {
+      "types": "./dist/route.d.ts",
+      "default": "./src/route.ts"
+    },
+    "./package.json": "./package.json"
+  },
+  "typesVersions": {
+    "*": {
+      "route": [
+        "./dist/route.d.ts"
+      ]
+    }
+  },
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "check": "tsc -p tsconfig.json --noEmit",

package/src/index.ts

@@ -2,7 +2,8 @@
 // Route modes
 // ---------------------------------------------------------------------------
 
-export type RouteMode = "static" | "server" | "live" | "ssr";
+export type { RouteMode } from "./route";
+import type { RouteDefinition } from "./route";
 
 // ---------------------------------------------------------------------------
 // Field types
@@ -493,53 +494,12 @@ export function relation(def: RelationDefinition): RelationDefinition {
 }
 
 // ---------------------------------------------------------------------------
-// Route definition
+// Route definition — lives in ./route so client bundles can import it
+// without the Node-only discovery helpers below.
 // ---------------------------------------------------------------------------
 
-export type AuthMode = "public" | "user";
-
-export interface RouteDefinition {
-  path: string;
-  mode: RouteMode;
-  query?: string;
-  auth?: AuthMode;
-  /**
-   * Project-relative module path (e.g. `app/hello/page`) for SSR
-   * routes. Required when `mode === "ssr"`. Discovered automatically
-   * by `discoverAppRoutes()`; only specify manually for one-off
-   * SSR routes outside the `app/` tree.
-   */
-  component?: string;
-  /**
-   * Layout module path chain (root→leaf). Each layout wraps the next
-   * as `children`. Only relevant for `mode === "ssr"`.
-   */
-  layouts?: string[];
-  /**
-   * Route kind. Omitted (or `"page"`) is a normal navigable page.
-   * `"not-found"` / `"error"` are SSR boundary modules discovered from
-   * `app/.../not-found.tsx` and `app/.../error.tsx`. Boundary routes are
-   * NOT matched as navigable URLs — the host renders `not-found` for
-   * unmatched URLs (HTTP 404) and `error` on render failure (HTTP 500).
-   * `path` records the segment prefix the boundary covers (`/` for root).
-   * `"route"` is a form/method handler (`app/.../route.ts` exporting
-   * POST/PUT/PATCH/DELETE) — matched on its `path` for non-GET requests only,
-   * never rendered as a page.
-   */
-  kind?:
-    | "page"
-    | "not-found"
-    | "error"
-    | "route"
-    | "sitemap"
-    | "robots"
-    | "llms"
-    | "og-image";
-}
-
-export function defineRoute(route: RouteDefinition): RouteDefinition {
-  return route;
-}
+export { defineRoute } from "./route";
+export type { AuthMode, RouteDefinition } from "./route";
 
 // ---------------------------------------------------------------------------
 // Query definition
@@ -1778,6 +1738,17 @@ export type AuthConfig = {
    * any port) is always auto-trusted at every gate.
    */
   trustedOrigins?: string[];
+  /**
+   * Name of a function the runtime calls before it deletes a user through
+   * `DELETE /api/auth/account`. Pylon deletes the User row and its own
+   * auth-side rows (sessions, API keys, linked accounts, trusted devices).
+   * It does not know which app tables belong to the user, so the named
+   * function must remove them. It runs as the user with `{ userId }`; a
+   * failure aborts the deletion and the client gets
+   * `ACCOUNT_DELETE_HOOK_FAILED`. Required by the App Store's account
+   * deletion rule whenever an app stores user content.
+   */
+  onDeleteAccount?: string;
 };
 
 // ---------------------------------------------------------------------------
@@ -1931,6 +1902,7 @@ export type ManifestAuthConfig = {
   };
   org_roles: string[];
   trusted_origins: string[];
+  on_delete_account?: string;
 };
 
 const BUILTIN_ORG_ROLES = new Set(["owner", "admin", "member"]);
@@ -2001,6 +1973,7 @@ export function auth(cfg: AuthConfig = {}): ManifestAuthConfig {
     },
     org_roles: validateOrgRoles(cfg.orgRoles ?? []),
     trusted_origins: cfg.trustedOrigins ?? [],
+    ...(cfg.onDeleteAccount ? { on_delete_account: cfg.onDeleteAccount } : {}),
   };
 }
 

package/src/route.ts

@@ -0,0 +1,52 @@
+// Route definitions. This module has no runtime dependency on Node
+// builtins, so client bundlers (Metro for React Native, Vite, Next.js)
+// can import `defineRoute` through `@pylonsync/sdk/route` without
+// pulling in the filesystem-backed discovery helpers from the package
+// root. `@pylonsync/react` re-exports from here for that reason.
+
+export type RouteMode = "static" | "server" | "live" | "ssr";
+
+export type AuthMode = "public" | "user";
+
+export interface RouteDefinition {
+  path: string;
+  mode: RouteMode;
+  query?: string;
+  auth?: AuthMode;
+  /**
+   * Project-relative module path (e.g. `app/hello/page`) for SSR
+   * routes. Required when `mode === "ssr"`. Discovered automatically
+   * by `discoverAppRoutes()`; only specify manually for one-off
+   * SSR routes outside the `app/` tree.
+   */
+  component?: string;
+  /**
+   * Layout module path chain (root→leaf). Each layout wraps the next
+   * as `children`. Only relevant for `mode === "ssr"`.
+   */
+  layouts?: string[];
+  /**
+   * Route kind. Omitted (or `"page"`) is a normal navigable page.
+   * `"not-found"` / `"error"` are SSR boundary modules discovered from
+   * `app/.../not-found.tsx` and `app/.../error.tsx`. Boundary routes are
+   * NOT matched as navigable URLs — the host renders `not-found` for
+   * unmatched URLs (HTTP 404) and `error` on render failure (HTTP 500).
+   * `path` records the segment prefix the boundary covers (`/` for root).
+   * `"route"` is a form/method handler (`app/.../route.ts` exporting
+   * POST/PUT/PATCH/DELETE) — matched on its `path` for non-GET requests only,
+   * never rendered as a page.
+   */
+  kind?:
+    | "page"
+    | "not-found"
+    | "error"
+    | "route"
+    | "sitemap"
+    | "robots"
+    | "llms"
+    | "og-image";
+}
+
+export function defineRoute(route: RouteDefinition): RouteDefinition {
+  return route;
+}

package/src/sdk.types.test.ts

@@ -102,3 +102,10 @@ describe("custom organization roles", () => {
     expect(() => auth({ orgRoles: ["member"] })).toThrow("is built in");
   });
 });
+
+describe("auth() account deletion hook", () => {
+  test("names the function in the manifest only when configured", () => {
+    expect(auth({ onDeleteAccount: "purgeMyData" }).on_delete_account).toBe("purgeMyData");
+    expect("on_delete_account" in auth({})).toBe(false);
+  });
+});