@softr/sdk 0.0.3 → 0.0.4

package/dist/index.d.ts

@@ -1,84 +1,37 @@
-import { a as ListResult, c as SoftrRecord, d as WorkflowAPI, i as ListOptions, l as SoftrSDK, n as DatasourceAPI, o as SoftrMe, r as DatasourcePermissions, s as SoftrPermissions, t as AuthAPI, u as SoftrUser } from "./types-BLLUI6MI.js";
+import { C as isAccessError, E as isUnauthenticatedError, S as defineVisibility, T as isForbiddenError, _ as SoftrContext, a as ListResult, b as User, c as SoftrRecord, d as WorkflowAPI, f as AccessBehaviour, g as RouteVisibility, h as AccessReason, i as ListOptions, l as SoftrSDK, m as AccessError, n as DatasourceAPI, o as SoftrMe, p as AccessCheck, r as DatasourcePermissions, s as SoftrPermissions, t as AuthAPI, u as SoftrUser, v as SoftrUserGroupId, w as isAlreadySignedInError, x as VisibilityHandle, y as SoftrUserGroups } from "./types-DCiIbAw_.js";
+import * as _tanstack_react_start0 from "@tanstack/react-start";
 
-//#region src/routes/visibility.d.ts
-type RouteVisibility = {
-  userGroup: "ALL_USERS";
-} | {
-  userGroup: "NON_LOGGED_IN_USERS";
-} | {
-  userGroup: "LOGGED_IN_USERS";
-  userGroupIds?: Array<SoftrUserGroupId>;
-};
-/** Shape of the TanStack route context after the root route's beforeLoad. */
-type SoftrContext = {
-  user: SoftrUser | null;
-};
-type RefusalReason = "unauthenticated" | "forbidden" | "alreadySignedIn";
-type RefusalBehaviour = string | {
-  strategy: "redirect";
-  to: string;
-} | {
-  strategy: "throw";
-};
-type GuardOverrides = Partial<Record<RefusalReason, RefusalBehaviour>>;
-type CheckResult = {
-  ok: true;
-} | {
-  ok: false;
-  reason: "unauthenticated" | "alreadySignedIn";
-} | {
-  ok: false;
-  reason: "forbidden";
-  requiredGroupIds: Array<SoftrUserGroupId>;
-};
-declare class VisibilityError extends Error {
-  readonly reason: RefusalReason;
-  readonly requiredGroupIds: Array<SoftrUserGroupId> | undefined;
-  constructor(reason: RefusalReason, requiredGroupIds?: Array<SoftrUserGroupId>);
-}
-interface VisibilityHandle {
-  /** Structured check — returns { ok: true } or { ok: false, reason }. */
-  check(context: SoftrContext): CheckResult;
-  /** Returns true if the visitor passes the rule. */
-  isAuthorized(context: SoftrContext): boolean;
-  /**
-   * Throws a VisibilityError if not authorized. Acts as a TypeScript assertion,
-   * narrowing context.user to non-null for code that follows.
-   *
-   * @example
-   * beforeLoad: ({ context }) => {
-   *   visibility.assert(context)
-   *   if (context.user.trialExpired) throw redirect({ to: '/renew' })
-   * }
-   */
-  assert(context: SoftrContext): asserts context is SoftrContext & {
-    user: SoftrUser;
-  };
-  /**
-   * Returns a TanStack beforeLoad handler. On refusal, throws a VisibilityError
-   * caught by the route's errorComponent.
-   *
-   * For redirect-on-refusal, use isAuthorized or check directly and throw
-   * TanStack's redirect() yourself.
-   *
-   * @example
-   * beforeLoad: visibility.guard()
-   * errorComponent: ({ error }) => isVisibilityError(error) ? <NoAccess /> : <AppError />
-   */
-  guard(overrides?: GuardOverrides): (params: {
-    context: SoftrContext;
-  }) => void;
-}
-declare function defineVisibility(rule: RouteVisibility): VisibilityHandle;
-declare function isVisibilityError(error: unknown): error is VisibilityError;
-declare function isUnauthenticatedError(error: unknown): error is VisibilityError & {
-  reason: "unauthenticated";
-};
-declare function isForbiddenError(error: unknown): error is VisibilityError & {
-  reason: "forbidden";
-};
-declare function isAlreadySignedInError(error: unknown): error is VisibilityError & {
-  reason: "alreadySignedIn";
-};
+//#region src/auth/session.d.ts
+
+/**
+ * Returns the signed-in visitor, or `null` when nobody is signed in.
+ *
+ * Await it in the root route's `beforeLoad` to publish the visitor as route
+ * context, which every `defineVisibility` guard then reads. It requires
+ * {@link softrAuthMiddleware} to be registered.
+ *
+ * @example
+ * export const Route = createRootRouteWithContext<SoftrContext>()({
+ *   beforeLoad: async () => ({ user: await getSoftrUser() }),
+ * })
+ */
+declare const getSoftrUser: _tanstack_react_start0.OptionalFetcher<undefined, undefined, Promise<User | null>>;
+//#endregion
+//#region src/auth/middleware.d.ts
+/**
+ * Resolves the Softr visitor for every request, so that `getSoftrUser` and the
+ * route guards have someone to check.
+ *
+ * Register it once, as a global request middleware in the app's `src/start.ts`.
+ * It touches nothing but the visitor.
+ *
+ * @example
+ * export const startInstance = createStart(() => ({
+ *   requestMiddleware: [softrAuthMiddleware()],
+ * }))
+ */
+declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, {
+  user: User | null;
+}>;
 //#endregion
-export { type AuthAPI, type CheckResult, type DatasourceAPI, type DatasourcePermissions, type GuardOverrides, type ListOptions, type ListResult, type RefusalBehaviour, type RefusalReason, type RouteVisibility, type SoftrContext, type SoftrMe, type SoftrPermissions, type SoftrRecord, type SoftrSDK, type SoftrUser, VisibilityError, type VisibilityHandle, type WorkflowAPI, defineVisibility, isAlreadySignedInError, isForbiddenError, isUnauthenticatedError, isVisibilityError };
+export { type AccessBehaviour, type AccessCheck, type AccessError, type AccessReason, type AuthAPI, type DatasourceAPI, type DatasourcePermissions, type ListOptions, type ListResult, type RouteVisibility, type SoftrContext, type SoftrMe, type SoftrPermissions, type SoftrRecord, type SoftrSDK, type SoftrUser, type SoftrUserGroupId, type SoftrUserGroups, type User, type VisibilityHandle, type WorkflowAPI, defineVisibility, getSoftrUser, isAccessError, isAlreadySignedInError, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware };

package/dist/index.js

@@ -1,73 +1,169 @@
+import { redirect } from "@tanstack/react-router";
+import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
+
 //#region src/routes/visibility.ts
-var VisibilityError = class extends Error {
-	reason;
-	requiredGroupIds;
-	constructor(reason, requiredGroupIds) {
-		super(`Access denied: ${reason}`);
-		this.name = "VisibilityError";
-		this.reason = reason;
-		this.requiredGroupIds = requiredGroupIds;
-	}
-};
-function runCheck(rule, context) {
+/**
+* Why a visitor was denied.
+*
+* - `unauthenticated` — the route needs a signed-in visitor and there is none.
+* - `forbidden` — signed in, but in none of the groups the route names.
+* - `alreadySignedIn` — the route is for signed-out visitors only.
+*/
+const ACCESS_REASONS = [
+	"unauthenticated",
+	"forbidden",
+	"alreadySignedIn"
+];
+/** Decides whether a visitor passes a visibility rule, without throwing. */
+function checkAccess(rule, context) {
 	const { user } = context;
-	if (rule.userGroup === "ALL_USERS") return { ok: true };
-	if (rule.userGroup === "NON_LOGGED_IN_USERS") return user ? {
-		ok: false,
-		reason: "alreadySignedIn"
-	} : { ok: true };
-	if (!user) return {
-		ok: false,
-		reason: "unauthenticated"
-	};
-	const { userGroupIds } = rule;
-	if (userGroupIds?.length) {
-		if (!userGroupIds.some((id) => user.userGroupIds.includes(id))) return {
+	switch (rule.userGroup) {
+		case "ALL_USERS": return { ok: true };
+		case "NON_LOGGED_IN_USERS": return user === null ? { ok: true } : {
 			ok: false,
-			reason: "forbidden",
-			requiredGroupIds: userGroupIds
+			reason: "alreadySignedIn"
 		};
+		case "LOGGED_IN_USERS": {
+			if (user === null) return {
+				ok: false,
+				reason: "unauthenticated"
+			};
+			const required = rule.userGroupIds ?? [];
+			if (required.length === 0) return { ok: true };
+			return required.some((id) => user.userGroupIds.includes(id)) ? { ok: true } : {
+				ok: false,
+				reason: "forbidden"
+			};
+		}
 	}
-	return { ok: true };
 }
-function throwIfDenied(result) {
-	if (result.ok) return;
-	throw new VisibilityError(result.reason, result.reason === "forbidden" ? result.requiredGroupIds : void 0);
+function isAccessReason(value) {
+	return ACCESS_REASONS.some((reason) => reason === value);
 }
-function defineVisibility(rule) {
-	function check(context) {
-		return runCheck(rule, context);
-	}
-	function isAuthorized(context) {
-		return runCheck(rule, context).ok;
-	}
-	function assert(context) {
-		throwIfDenied(runCheck(rule, context));
-	}
-	function guard(_overrides) {
-		return ({ context }) => {
-			throwIfDenied(runCheck(rule, context));
-		};
-	}
-	return {
-		check,
-		isAuthorized,
-		assert,
-		guard
-	};
+/**
+* True for any access error thrown by a guard, whatever its reason.
+*
+* An access error arrives as `unknown` — hydrated from the page, or thrown by
+* anything else at all — so every field is checked before it is narrowed.
+*/
+function isAccessError(error) {
+	if (typeof error !== "object" || error === null) return false;
+	const candidate = error;
+	if (candidate.type !== "access_error") return false;
+	return isAccessReason(candidate.reason);
 }
-function isVisibilityError(error) {
-	return error instanceof VisibilityError;
+function isReason(error, reason) {
+	return isAccessError(error) && error.reason === reason;
 }
+/** True for an access error thrown because nobody was signed in. */
 function isUnauthenticatedError(error) {
-	return error instanceof VisibilityError && error.reason === "unauthenticated";
+	return isReason(error, "unauthenticated");
 }
+/** True for an access error thrown because the visitor was in none of the groups. */
 function isForbiddenError(error) {
-	return error instanceof VisibilityError && error.reason === "forbidden";
+	return isReason(error, "forbidden");
 }
+/** True for an access error thrown because a signed-out-only route saw a user. */
 function isAlreadySignedInError(error) {
-	return error instanceof VisibilityError && error.reason === "alreadySignedIn";
+	return isReason(error, "alreadySignedIn");
+}
+const DEFAULT_ACCESS_BEHAVIOUR = {
+	unauthenticated: {
+		strategy: "redirect",
+		to: "/login"
+	},
+	forbidden: { strategy: "throw" },
+	alreadySignedIn: {
+		strategy: "redirect",
+		to: "/"
+	}
+};
+/** What a guard throws for a reason: a redirect, or an {@link AccessError}. */
+function thrownFor(reason, overrides) {
+	const behaviour = overrides?.[reason] ?? DEFAULT_ACCESS_BEHAVIOUR[reason];
+	const resolved = typeof behaviour === "string" ? {
+		strategy: "redirect",
+		to: behaviour
+	} : behaviour;
+	if (resolved.strategy === "redirect") return redirect({ to: resolved.to });
+	return {
+		type: "access_error",
+		reason
+	};
+}
+/**
+* Declares who may see a route, and returns the handle that enforces it.
+*
+* One call per route file, at module scope: the build reads these declarations
+* to publish the app's route visibility, so the rule must be a literal.
+*
+* @example
+* const visibility = defineVisibility({ userGroup: "LOGGED_IN_USERS" })
+*
+* export const Route = createFileRoute("/about")({
+*   beforeLoad: visibility.guard(),
+*   component: About,
+* })
+*/
+function defineVisibility(rule) {
+	return {
+		guard: (overrides) => ({ context }) => {
+			const result = checkAccess(rule, context);
+			if (result.ok) return;
+			throw thrownFor(result.reason, overrides);
+		},
+		assert: (context) => {
+			const result = checkAccess(rule, context);
+			if (result.ok) return;
+			throw thrownFor(result.reason, void 0);
+		},
+		isAuthorized: (context) => checkAccess(rule, context).ok,
+		check: (context) => checkAccess(rule, context)
+	};
+}
+
+//#endregion
+//#region src/auth/session.ts
+async function resolveVisitor(_request) {
+	return null;
+}
+function visitorFromContext(context) {
+	if (typeof context !== "object" || context === null || !("user" in context)) throw new Error("softrAuthMiddleware has not run: the Start global context carries no `user`. Register it as a global request middleware, e.g. createStart(() => ({ requestMiddleware: [softrAuthMiddleware()] })).");
+	return context.user ?? null;
+}
+/**
+* Returns the signed-in visitor, or `null` when nobody is signed in.
+*
+* Await it in the root route's `beforeLoad` to publish the visitor as route
+* context, which every `defineVisibility` guard then reads. It requires
+* {@link softrAuthMiddleware} to be registered.
+*
+* @example
+* export const Route = createRootRouteWithContext<SoftrContext>()({
+*   beforeLoad: async () => ({ user: await getSoftrUser() }),
+* })
+*/
+const getSoftrUser = createServerFn({ method: "GET" }).handler(async () => visitorFromContext(getGlobalStartContext()));
+
+//#endregion
+//#region src/auth/middleware.ts
+/**
+* Resolves the Softr visitor for every request, so that `getSoftrUser` and the
+* route guards have someone to check.
+*
+* Register it once, as a global request middleware in the app's `src/start.ts`.
+* It touches nothing but the visitor.
+*
+* @example
+* export const startInstance = createStart(() => ({
+*   requestMiddleware: [softrAuthMiddleware()],
+* }))
+*/
+function softrAuthMiddleware() {
+	return createMiddleware({ type: "request" }).server(async ({ request, next }) => {
+		return next({ context: { user: await resolveVisitor(request) } });
+	});
 }
 
 //#endregion
-export { VisibilityError, defineVisibility, isAlreadySignedInError, isForbiddenError, isUnauthenticatedError, isVisibilityError };
+export { defineVisibility, getSoftrUser, isAccessError, isAlreadySignedInError, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware };

package/dist/tanstack.d.ts

@@ -1,4 +1,4 @@
-import { l as SoftrSDK } from "./types-BLLUI6MI.js";
+import { l as SoftrSDK } from "./types-DCiIbAw_.js";
 
 //#region src/tanstack.d.ts
 

package/dist/types-DCiIbAw_.d.ts

@@ -0,0 +1,237 @@
+//#region src/routes/visibility.d.ts
+/**
+ * Declare this interface in your app to narrow every group id the SDK takes and
+ * returns. Without a declaration, a group id is a plain `string`.
+ *
+ * @example
+ * declare module "@softr/sdk" {
+ *   interface SoftrUserGroups {
+ *     ids:
+ *       | "b1f2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
+ *       | "f9e8d7c6-5b4a-4938-8271-605f4e3d2c1b"
+ *   }
+ * }
+ */
+interface SoftrUserGroups {}
+/** A Softr user group id, narrowed to your own ids if you declare {@link SoftrUserGroups}. */
+type SoftrUserGroupId = SoftrUserGroups extends {
+  ids: infer Id extends string;
+} ? Id : string;
+/**
+ * Who may see a route.
+ *
+ * - `ALL_USERS` — everyone, signed in or not.
+ * - `NON_LOGGED_IN_USERS` — signed-out visitors only.
+ * - `LOGGED_IN_USERS` — signed-in visitors; with `userGroupIds`, only members of
+ *   at least one of those groups.
+ */
+type RouteVisibility = {
+  userGroup: "ALL_USERS";
+} | {
+  userGroup: "NON_LOGGED_IN_USERS";
+} | {
+  userGroup: "LOGGED_IN_USERS";
+  userGroupIds?: Array<SoftrUserGroupId>;
+};
+/** The signed-in visitor. */
+type User = {
+  id: string;
+  email: string;
+  name: string;
+  userGroupIds: Array<SoftrUserGroupId>;
+};
+/** The route context the root route publishes: the visitor, or `null` when signed out. */
+type SoftrContext = {
+  user: User | null;
+};
+/**
+ * Why a visitor was denied.
+ *
+ * - `unauthenticated` — the route needs a signed-in visitor and there is none.
+ * - `forbidden` — signed in, but in none of the groups the route names.
+ * - `alreadySignedIn` — the route is for signed-out visitors only.
+ */
+declare const ACCESS_REASONS: readonly ["unauthenticated", "forbidden", "alreadySignedIn"];
+type AccessReason = (typeof ACCESS_REASONS)[number];
+/**
+ * What a guard does when it refuses a visitor: redirect to a path, or throw an
+ * {@link AccessError} for the route's `errorComponent` to render. A bare string
+ * is shorthand for redirecting there.
+ */
+type AccessBehaviour = string | {
+  strategy: "redirect";
+  to: string;
+} | {
+  strategy: "throw";
+};
+/** Per-reason overrides of the default {@link AccessBehaviour}. */
+type GuardOverrides = Partial<Record<AccessReason, AccessBehaviour>>;
+/** The result of {@link VisibilityHandle.check}: passed, or denied with a reason. */
+type AccessCheck = {
+  ok: true;
+} | {
+  ok: false;
+  reason: AccessReason;
+};
+/**
+ * The access error a guard throws. It is plain data, not an `Error` subclass, so
+ * take it as `unknown` in an `errorComponent` and narrow it with
+ * {@link isAccessError}. It carries the reason and nothing else: the error is
+ * serialized into the page, so it never names the groups the route wanted.
+ *
+ * @example
+ * errorComponent: ({ error }: { error: unknown }) =>
+ *   isAccessError(error) ? <NoAccess /> : <AppError />
+ */
+type AccessError = {
+  type: "access_error";
+  reason: AccessReason;
+};
+/**
+ * True for any access error thrown by a guard, whatever its reason.
+ *
+ * An access error arrives as `unknown` — hydrated from the page, or thrown by
+ * anything else at all — so every field is checked before it is narrowed.
+ */
+declare function isAccessError(error: unknown): error is AccessError;
+/** True for an access error thrown because nobody was signed in. */
+declare function isUnauthenticatedError(error: unknown): error is AccessError;
+/** True for an access error thrown because the visitor was in none of the groups. */
+declare function isForbiddenError(error: unknown): error is AccessError;
+/** True for an access error thrown because a signed-out-only route saw a user. */
+declare function isAlreadySignedInError(error: unknown): error is AccessError;
+type Narrowed<R extends RouteVisibility> = R extends {
+  userGroup: "LOGGED_IN_USERS";
+} ? SoftrContext & {
+  user: User;
+} : R extends {
+  userGroup: "NON_LOGGED_IN_USERS";
+} ? SoftrContext & {
+  user: null;
+} : SoftrContext;
+/** The four ways to apply a rule, returned by {@link defineVisibility}. */
+type VisibilityHandle<R extends RouteVisibility = RouteVisibility> = {
+  /**
+   * A `beforeLoad` handler that denies a visitor who fails the rule.
+   *
+   * By default an unauthenticated visitor is redirected to `/login`, an already
+   * signed-in one to `/`, and a forbidden one gets an {@link AccessError} thrown
+   * in place, for the route's `errorComponent` to render. Pass `overrides` to
+   * change what any one reason does.
+   *
+   * @example
+   * beforeLoad: visibility.guard({ unauthenticated: "/sign-in" })
+   */
+  guard(overrides?: GuardOverrides): (opts: {
+    context: SoftrContext;
+  }) => void;
+  /**
+   * Throws the same access error or redirect `guard()` would, for code that
+   * needs to run its own checks after the rule.
+   *
+   * @example
+   * beforeLoad: ({ context }) => {
+   *   visibility.assert(context)
+   *   if (context.user.trialExpired) throw redirect({ to: "/renew" })
+   * }
+   */
+  assert(context: SoftrContext): void;
+  /**
+   * Whether the visitor passes the rule. Narrows `context.user` where the rule
+   * allows it.
+   */
+  isAuthorized(context: SoftrContext): context is Narrowed<R>;
+  /** The decision and, when a visitor is refused, the reason. Throws nothing. */
+  check(context: SoftrContext): AccessCheck;
+};
+/**
+ * Declares who may see a route, and returns the handle that enforces it.
+ *
+ * One call per route file, at module scope: the build reads these declarations
+ * to publish the app's route visibility, so the rule must be a literal.
+ *
+ * @example
+ * const visibility = defineVisibility({ userGroup: "LOGGED_IN_USERS" })
+ *
+ * export const Route = createFileRoute("/about")({
+ *   beforeLoad: visibility.guard(),
+ *   component: About,
+ * })
+ */
+declare function defineVisibility<const R extends RouteVisibility>(rule: R): VisibilityHandle<R>;
+//#endregion
+//#region src/types.d.ts
+interface SoftrUser {
+  id: string;
+  email: string;
+  name: string;
+  userGroupIds: Array<SoftrUserGroupId>;
+}
+interface DatasourcePermissions {
+  read: boolean;
+  create: boolean;
+  update: boolean;
+  delete: boolean;
+}
+interface SoftrPermissions {
+  datasources: Record<string, DatasourcePermissions>;
+  workflows: Record<string, boolean>;
+}
+interface SoftrMe {
+  user: SoftrUser | null;
+  permissions: SoftrPermissions;
+}
+interface ListOptions {
+  page?: number;
+  limit?: number;
+  filters?: Array<{
+    field: string;
+    operator: string;
+    value: unknown;
+  }>;
+  sort?: Array<{
+    field: string;
+    direction: 'asc' | 'desc';
+  }>;
+}
+interface ListResult<T = SoftrRecord> {
+  records: T[];
+  total: number;
+  page: number;
+  limit: number;
+}
+interface SoftrRecord {
+  id: string;
+  [field: string]: unknown;
+}
+interface DatasourceAPI {
+  list(options?: ListOptions): Promise<ListResult>;
+  get(recordId: string): Promise<SoftrRecord>;
+  create(data: Record<string, unknown>): Promise<SoftrRecord>;
+  update(recordId: string, data: Record<string, unknown>): Promise<SoftrRecord>;
+  delete(recordId: string): Promise<void>;
+}
+interface WorkflowAPI {
+  trigger(payload?: Record<string, unknown>): Promise<void>;
+}
+interface AuthAPI {
+  /** Sign in with email and password. Clears the cached me() result. */
+  login(credentials: {
+    email: string;
+    password: string;
+  }): Promise<void>;
+  /** Sign out the current user. Clears the cached me() result. */
+  logout(): Promise<void>;
+}
+interface SoftrSDK {
+  /**
+   * Fetch the current user and their permissions from /me.
+   * Cached for the lifetime of the instance — create a new instance per request on the server.
+   */
+  me(): Promise<SoftrMe>;
+  auth: AuthAPI;
+  datasource(id: string): DatasourceAPI;
+  workflow(id: string): WorkflowAPI;
+}
+//#endregion
+export { isAccessError as C, isUnauthenticatedError as E, defineVisibility as S, isForbiddenError as T, SoftrContext as _, ListResult as a, User as b, SoftrRecord as c, WorkflowAPI as d, AccessBehaviour as f, RouteVisibility as g, AccessReason as h, ListOptions as i, SoftrSDK as l, AccessError as m, DatasourceAPI as n, SoftrMe as o, AccessCheck as p, DatasourcePermissions as r, SoftrPermissions as s, AuthAPI as t, SoftrUser as u, SoftrUserGroupId as v, isAlreadySignedInError as w, VisibilityHandle as x, SoftrUserGroups as y };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.3",
+  "version": "0.0.4",
   "type": "module",
   "exports": {
     ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
@@ -21,6 +21,8 @@
     "@tanstack/router-generator": "1.167.23"
   },
   "devDependencies": {
+    "@tanstack/react-router": "^1.168.0",
+    "@tanstack/react-start": "^1.168.0",
     "@types/babel__traverse": "^7.28.0",
     "@types/node": "^24.3.0",
     "tsdown": "^0.15.0",
@@ -28,11 +30,11 @@
     "vite": "^8.0.0"
   },
   "peerDependencies": {
-    "@tanstack/start": ">=1",
-    "vite": "^8.0.0"
+    "vite": "^8.0.0",
+    "@tanstack/react-router": "^1.168.0",
+    "@tanstack/react-start": "^1.168.0"
   },
   "peerDependenciesMeta": {
-    "@tanstack/start": { "optional": true },
     "vite": { "optional": true }
   }
 }

package/dist/types-BLLUI6MI.d.ts

@@ -1,75 +0,0 @@
-//#region src/types.d.ts
-interface SoftrUser {
-  id: string;
-  email: string;
-  name: string;
-  userGroupIds: Array<SoftrUserGroupId>;
-}
-interface DatasourcePermissions {
-  read: boolean;
-  create: boolean;
-  update: boolean;
-  delete: boolean;
-}
-interface SoftrPermissions {
-  datasources: Record<string, DatasourcePermissions>;
-  workflows: Record<string, boolean>;
-}
-interface SoftrMe {
-  user: SoftrUser | null;
-  permissions: SoftrPermissions;
-}
-interface ListOptions {
-  page?: number;
-  limit?: number;
-  filters?: Array<{
-    field: string;
-    operator: string;
-    value: unknown;
-  }>;
-  sort?: Array<{
-    field: string;
-    direction: 'asc' | 'desc';
-  }>;
-}
-interface ListResult<T = SoftrRecord> {
-  records: T[];
-  total: number;
-  page: number;
-  limit: number;
-}
-interface SoftrRecord {
-  id: string;
-  [field: string]: unknown;
-}
-interface DatasourceAPI {
-  list(options?: ListOptions): Promise<ListResult>;
-  get(recordId: string): Promise<SoftrRecord>;
-  create(data: Record<string, unknown>): Promise<SoftrRecord>;
-  update(recordId: string, data: Record<string, unknown>): Promise<SoftrRecord>;
-  delete(recordId: string): Promise<void>;
-}
-interface WorkflowAPI {
-  trigger(payload?: Record<string, unknown>): Promise<void>;
-}
-interface AuthAPI {
-  /** Sign in with email and password. Clears the cached me() result. */
-  login(credentials: {
-    email: string;
-    password: string;
-  }): Promise<void>;
-  /** Sign out the current user. Clears the cached me() result. */
-  logout(): Promise<void>;
-}
-interface SoftrSDK {
-  /**
-   * Fetch the current user and their permissions from /me.
-   * Cached for the lifetime of the instance — create a new instance per request on the server.
-   */
-  me(): Promise<SoftrMe>;
-  auth: AuthAPI;
-  datasource(id: string): DatasourceAPI;
-  workflow(id: string): WorkflowAPI;
-}
-//#endregion
-export { ListResult as a, SoftrRecord as c, WorkflowAPI as d, ListOptions as i, SoftrSDK as l, DatasourceAPI as n, SoftrMe as o, DatasourcePermissions as r, SoftrPermissions as s, AuthAPI as t, SoftrUser as u };