@softr/sdk 0.0.47-alpha.0 → 0.0.47

package/dist/auth/isomorphic.d.ts

@@ -17,7 +17,7 @@ import * as _tanstack_react_start0 from "@tanstack/react-start";
  *   requestMiddleware: [softrAuthMiddleware()],
  * }))
  */
-declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>, _tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
+declare function softrAuthMiddleware(): _tanstack_react_start0.RequestMiddlewareAfterServer<{}, readonly [_tanstack_react_start0.RequestMiddlewareAfterServer<{}, undefined, undefined>], {
   user: User | null;
   permissions: Permissions;
 }>;

package/dist/auth/isomorphic.js

@@ -4,7 +4,6 @@ import { sessionConfig } from "./config.js";
 import { clearSession, makeSessionDataCookie, readSessionData, readSessionToken } from "./session.js";
 import { makePlatform } from "./platform.js";
 import { bootErrorMiddleware } from "../boot-error.js";
-import { pwaMiddleware } from "../pwa.js";
 import { createMiddleware, createServerFn, getGlobalStartContext } from "@tanstack/react-start";
 import { rootRouteId, useRouteContext } from "@tanstack/react-router";
 
@@ -22,7 +21,7 @@ import { rootRouteId, useRouteContext } from "@tanstack/react-router";
 * }))
 */
 function softrAuthMiddleware() {
-	return createMiddleware({ type: "request" }).middleware([bootErrorMiddleware(), pwaMiddleware()]).server(async ({ next }) => {
+	return createMiddleware({ type: "request" }).middleware([bootErrorMiddleware()]).server(async ({ next }) => {
 		async function getSession() {
 			const token = readSessionToken();
 			const cached = readSessionData(token);

package/dist/auth/session.js

@@ -3,6 +3,7 @@ import { permissionsSchema } from "./permissions.js";
 import { sessionConfig } from "./config.js";
 import { userSchema } from "./user.js";
 import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { getRequestProtocol } from "@tanstack/react-start/server";
 import { z } from "zod";
 
@@ -35,8 +36,20 @@ function sessionCookie(base) {
 		secure
 	};
 }
+/**
+* Runs `fn` with `token` standing in for the request's session cookie, so that
+* every datasource call inside it acts as that visitor.
+*
+* For requests that carry who they are somewhere other than the cookie: an MCP
+* call authenticates with a bearer token and has no cookie at all.
+*/
+function withSessionToken(token, fn) {
+	return standInToken.run(token, fn);
+}
 /** The platform token this request carries, or `null`. */
 function readSessionToken() {
+	const standIn = standInToken.getStore();
+	if (standIn !== void 0) return standIn;
 	const { name } = sessionCookie(SESSION_TOKEN);
 	return openEnvelope(readRequestCookies()[name], SESSION_TOKEN);
 }
@@ -105,6 +118,7 @@ function clearSession() {
 		PENDING_AUTH
 	]);
 }
+const standInToken = new AsyncLocalStorage();
 const sessionDataSchema = z.object({
 	user: userSchema.nullable(),
 	permissions: permissionsSchema,
@@ -196,4 +210,4 @@ function openEnvelope(raw, purpose) {
 }
 
 //#endregion
-export { clearPendingAuth, clearSession, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken, readSessionData, readSessionToken };
+export { clearPendingAuth, clearSession, makePendingAuthCookie, makeSessionDataCookie, makeSessionTokenCookie, readPendingAuthToken, readSessionData, readSessionToken, withSessionToken };

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react1 from "react";
+import * as react0 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react1.JSX.Element;
+}: Props): react0.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/index.d.ts

@@ -6,8 +6,8 @@ import { SoftrContext } from "./auth/context.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
 import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
-import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, DefaultErrorOverlay, type FileAttachment, type FileItem, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, useCurrentUser, useFileUpload, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, DefaultErrorOverlay, type FileAttachment, type FileItem, type SoftrContext, type SoftrDatasources, type SoftrUserGroupId, type SoftrUserGroups, type User, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useUserTimezone };

package/dist/index.js

@@ -2,10 +2,10 @@ import { useFileUpload } from "./core/use-file-upload.js";
 import { defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
 import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
-import { SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
 
-export { Audience, DefaultErrorOverlay, SoftrPwaHead, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, useCurrentUser, useFileUpload, usePwaInstall, useUserTimezone };
+export { Audience, DefaultErrorOverlay, assertRouteAccess, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useUserTimezone };

package/dist/mcp.d.ts

@@ -0,0 +1,42 @@
+import { DatasourceAction } from "./action.js";
+import * as _tanstack_react_start2 from "@tanstack/react-start";
+
+//#region src/mcp.d.ts
+
+type SoftrMcpOptions = {
+  /**
+   * The actions to expose as tools, from `defineQuery` and `defineMutation`.
+   *
+   * Listing them is deliberate: an action left out is invisible over MCP, even
+   * though the app's own pages may use it. The action's own `permissions` still
+   * decide who may run the ones that are listed.
+   */
+  actions?: Array<DatasourceAction>;
+  /**
+   * The app's sign-in page, as a path on this app. A signed-out visitor who
+   * opens the approval page is sent here with `?redirect=` pointing back at it.
+   * Defaults to `/login`.
+   */
+  loginPath?: string;
+};
+/**
+ * Serves the MCP endpoint and its OAuth flow from the app's own origin.
+ *
+ * Register it in the app's `src/start.ts`, ahead of `softrAuthMiddleware`: it
+ * answers its own paths and resolves the caller from the bearer token, so it
+ * must not sit behind the session lookup that middleware does on every
+ * request. Everything else passes straight through.
+ *
+ * @example
+ * import { publishedPosts, addCafe } from './actions'
+ *
+ * export const startInstance = createStart(() => ({
+ *   requestMiddleware: [
+ *     softrMcpMiddleware({ actions: [publishedPosts, addCafe] }),
+ *     softrAuthMiddleware(),
+ *   ],
+ * }))
+ */
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start2.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+//#endregion
+export { softrMcpMiddleware };