@softr/sdk 0.0.6 → 0.0.10

package/dist/server.d.ts

@@ -0,0 +1,85 @@
+import { r as User } from "./user-D23hwTsf.js";
+import "@tanstack/react-start/server-only";
+
+//#region src/auth/methods/utils.d.ts
+type Result<T, E = Error> = {
+  success: false;
+  error: E;
+} | {
+  success: true;
+  data: T;
+};
+type AuthError = {
+  code: AuthErrorCode;
+  message: string;
+};
+type AuthErrorCode = "invalidCredentials" | "tooManyAttempts" | "emailTaken" | "invalidDetails" | "invalidCode";
+//#endregion
+//#region src/auth/methods/password.d.ts
+/**
+ * Signs a visitor in with an email and password.
+ *
+ * The cache is primed from the same `/me` the resolver would have called anyway,
+ * so the next request costs no round-trip.
+ */
+declare function signIn(credentials: {
+  email: string;
+  password: string;
+}): Promise<Result<User, AuthError>>;
+/**
+ * Signs the visitor out and clears the session cookies.
+ *
+ * This revokes **every** outstanding session for that user in this app, on every
+ * device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
+ * before it. There is no per-device sign-out.
+ *
+ * A platform that could not revoke leaves the caller signed out here and
+ * possibly still signed in elsewhere — loud outside production, logged in it,
+ * because the local half already succeeded.
+ */
+declare function signOut(): Promise<void>;
+//#endregion
+//#region src/auth/methods/signup.d.ts
+/**
+ * Starts a sign-up flow by emailing a verification code.
+ *
+ * User only exists once `confirmSignUp` returns the code.
+ */
+declare function signUp(details: {
+  email: string;
+  name?: string;
+}): Promise<Result<null, AuthError>>;
+/**
+ * Finishes sign-up flow with the emailed code and signs the visitor in.
+ *
+ * The platform splits on how the app is configured: a code-only app creates the
+ * user on the second `sign-up` request and answers with a token, while a
+ * password app answers it with an empty 200 and expects the password on
+ * `users/new`.
+ */
+declare function confirmSignUp(details: {
+  email: string;
+  /**
+   * What `users/new` creates the account with, and unused on a code-only app,
+   * which never reaches that request.
+   *
+   * TODO: temporary in one respect — it is spent a second time on the
+   * 400-after-create workaround below, which goes away with the platform fix.
+   */
+  password: string;
+  code: string;
+  name?: string;
+}): Promise<Result<User, AuthError>>;
+//#endregion
+//#region src/auth/server.d.ts
+/**
+ * Server-only auth methods, should be called from the app's own `createServerFn` handlers.
+ */
+declare const auth: {
+  signIn: typeof signIn;
+  signOut: typeof signOut;
+  signUp: typeof signUp;
+  confirmSignUp: typeof confirmSignUp;
+};
+//#endregion
+export { auth };

package/dist/server.js

@@ -0,0 +1,202 @@
+import { a as readSessionToken, c as writeCookies, d as softAssert, f as todo, n as makeSessionDataCookie, o as fetchVisitor, r as makeSessionTokenCookie, s as sessionConfig, t as clearSession, u as panic } from "./session-Blx62HHJ.js";
+import { z } from "zod";
+import "@tanstack/react-start/server-only";
+
+//#region src/auth/methods/utils.ts
+function authError(code, message) {
+	return {
+		success: false,
+		error: {
+			code,
+			message
+		}
+	};
+}
+const errorSchema = z.object({ message: z.string() });
+async function describe(response, action) {
+	const body = errorSchema.safeParse(await response.json().catch(() => null));
+	const said = body.success && body.data.message ? body.data.message : response.statusText;
+	return `Softr platform refused the ${action}: ${response.status} ${said}`.trim();
+}
+function endpoint(config, path) {
+	return `${config.platformApiUrl}/v1/applications/${config.applicationId}/users/${path}`;
+}
+
+//#endregion
+//#region src/auth/methods/password.ts
+const signInBody = z.object({
+	jwt: z.string().nullish(),
+	authenticatorAppAction: z.string().nullish()
+});
+/**
+* Signs a visitor in with an email and password.
+*
+* The cache is primed from the same `/me` the resolver would have called anyway,
+* so the next request costs no round-trip.
+*/
+async function signIn(credentials) {
+	const config = sessionConfig();
+	const response = await fetch(endpoint(config, "sign-in"), {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json"
+		},
+		body: JSON.stringify(credentials)
+	});
+	if (response.status === 401 || response.status === 429) return authError(response.status === 401 ? "invalidCredentials" : "tooManyAttempts", await describe(response, "sign-in"));
+	if (response.status >= 500) panic(await describe(response, "sign-in"));
+	if (response.status === 400) todo(await describe(response, "sign-in"));
+	if (!response.ok) throw new Error(`${await describe(response, "sign-in")}. Check SOFTR_APPLICATION_ID and that the app allows sign-in.`);
+	const raw = await response.text();
+	const body = signInBody.parse(raw.length === 0 ? {} : JSON.parse(raw));
+	if (body.authenticatorAppAction) todo(`Softr platform asked for an authenticator step (${body.authenticatorAppAction}) to finish the sign-in. This app requires an authenticator app, which the SDK cannot finish yet.`);
+	const token = body.jwt;
+	if (!token) todo("Softr platform answered the sign-in by emailing a one-time code. This app is configured for passwordless sign-in, which the SDK cannot finish yet.");
+	const user = await fetchVisitor(token);
+	if (!user) panic("Session token issued, but no user could be resolved for it.");
+	writeCookies([makeSessionTokenCookie(token), makeSessionDataCookie(user, token)]);
+	return {
+		success: true,
+		data: user
+	};
+}
+/**
+* Signs the visitor out and clears the session cookies.
+*
+* This revokes **every** outstanding session for that user in this app, on every
+* device: the platform stamps `tokensInvalidatedAt` and rejects anything issued
+* before it. There is no per-device sign-out.
+*
+* A platform that could not revoke leaves the caller signed out here and
+* possibly still signed in elsewhere — loud outside production, logged in it,
+* because the local half already succeeded.
+*/
+async function signOut() {
+	const config = sessionConfig();
+	const token = readSessionToken();
+	clearSession();
+	if (!token) return;
+	const response = await fetch(endpoint(config, "sign-out"), {
+		method: "POST",
+		headers: {
+			authorization: `Bearer ${token}`,
+			accept: "application/json"
+		}
+	});
+	softAssert(response.ok || response.status < 500, () => `Softr platform could not revoke the session: ${response.status}. This browser is signed out, but other devices may still be.`);
+}
+
+//#endregion
+//#region src/auth/methods/signup.ts
+/**
+* Starts a sign-up flow by emailing a verification code.
+*
+* User only exists once `confirmSignUp` returns the code.
+*/
+async function signUp(details) {
+	const response = await fetch(endpoint(sessionConfig(), "sign-up"), {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json"
+		},
+		body: JSON.stringify(signUpBody(details))
+	});
+	if (response.status >= 500) panic(await describe(response, "sign-up"));
+	if (response.status === 409) return authError("emailTaken", await describe(response, "sign-up"));
+	if (!response.ok) return authError("invalidDetails", await describe(response, "sign-up"));
+	return {
+		success: true,
+		data: null
+	};
+}
+/**
+* Finishes sign-up flow with the emailed code and signs the visitor in.
+*
+* The platform splits on how the app is configured: a code-only app creates the
+* user on the second `sign-up` request and answers with a token, while a
+* password app answers it with an empty 200 and expects the password on
+* `users/new`.
+*/
+async function confirmSignUp(details) {
+	const config = sessionConfig();
+	const verified = await fetch(endpoint(config, "sign-up"), {
+		method: "POST",
+		headers: {
+			"content-type": "application/json",
+			accept: "application/json"
+		},
+		body: JSON.stringify({
+			...signUpBody(details),
+			token: details.code
+		})
+	});
+	if (verified.status >= 500) panic(await describe(verified, "sign-up"));
+	if (verified.status === 409) return authError("emailTaken", await describe(verified, "sign-up"));
+	if (!verified.ok) return authError("invalidCode", await describe(verified, "sign-up"));
+	const verifiedBody = await verified.text();
+	let token = tokenBody.parse(verifiedBody.length === 0 ? {} : JSON.parse(verifiedBody)).jwt;
+	if (!token) {
+		const created = await fetch(endpoint(config, "new"), {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				accept: "application/json"
+			},
+			body: JSON.stringify({
+				...signUpBody(details),
+				password: details.password,
+				token: details.code
+			})
+		});
+		if (created.status >= 500) panic(await describe(created, "sign-up"));
+		if (created.status === 409) return authError("emailTaken", await describe(created, "sign-up"));
+		if (created.ok) {
+			const createdBody = await created.text();
+			token = tokenBody.parse(createdBody.length === 0 ? {} : JSON.parse(createdBody)).jwt;
+		} else {
+			const signedIn = await signIn({
+				email: details.email,
+				password: details.password
+			});
+			if (!signedIn.success) return authError("invalidCode", await describe(created, "sign-up"));
+			return signedIn;
+		}
+	}
+	if (!token) todo("Softr platform accepted the sign-up and returned no session token. This app is configured for a sign-up flow the SDK cannot finish yet.");
+	const user = await fetchVisitor(token);
+	if (!user) panic("Session token issued, but no user could be resolved for it.");
+	writeCookies([makeSessionTokenCookie(token), makeSessionDataCookie(user, token)]);
+	return {
+		success: true,
+		data: user
+	};
+}
+/**
+* `name` is dropped when absent rather than sent as `undefined`: the platform's
+* validator runs on whatever key is present, and an explicit null is not the
+* same request as no name at all.
+*/
+function signUpBody(details) {
+	return details.name === void 0 ? { email: details.email } : {
+		email: details.email,
+		name: details.name
+	};
+}
+const tokenBody = z.object({ jwt: z.string().nullish() });
+
+//#endregion
+//#region src/auth/server.ts
+/**
+* Server-only auth methods, should be called from the app's own `createServerFn` handlers.
+*/
+const auth = {
+	signIn,
+	signOut,
+	signUp,
+	confirmSignUp
+};
+
+//#endregion
+export { auth };

package/dist/session-Blx62HHJ.js

@@ -0,0 +1,334 @@
+import { getRequestHeader, getRequestProtocol, getResponseHeaders, setResponseHeader } from "@tanstack/react-start/server";
+import { z } from "zod";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+
+//#region src/assertions.ts
+function assert(condition, message) {
+	if (!condition) throwAtCaller(assert, new AssertionError(unwrapErrorMessage(message)));
+}
+/**
+* Shorthand for throw new AssertionError("Error message")
+* Useful because it is an expression instead of a statement.
+* Can be assigned to any value, because it never returns.
+*/
+function panic(message) {
+	throwAtCaller(panic, new AssertionError(unwrapErrorMessage(message)));
+}
+function todo(message) {
+	throwAtCaller(todo, new UnimplementedError(unwrapErrorMessage(message)));
+}
+/**
+* A soft assertion that throws an error in non prod environments, including
+* staging, but logs an error in production mode.
+* This is useful for cases where something unexpected happens, but you can still
+* continue in a slightly broken state.
+* For example, if a block has defined a style control with a hardcoded id and
+* that style control is not found, this is definitely a bug, but it's still
+* possible to go on rendering with a fallback value for this style.
+* It is recommended to liberally use soft assertions so that we fail loudly in
+* staging and local environments.
+*
+* A hard assertion would be more appropriate if we wanted to display some data
+* from an object but that object is null. It's better to throw an assertion
+* error at the place we detect this, instead of continuing and potentially
+* causing an exception in an unrelated part of the code.
+*/
+function softAssert(condition, message) {
+	if (!condition) if (process.env.NODE_ENV !== "production") throwAtCaller(softAssert, new SoftAssertionError(unwrapErrorMessage(message)));
+	else console.error(`Assertion failed: ${unwrapErrorMessage(message)}`);
+}
+var AssertionError = class extends Error {
+	name = "AssertionError";
+};
+var SoftAssertionError = class extends Error {
+	name = "SoftAssertionError";
+};
+var UnimplementedError = class extends Error {
+	name = "UnimplementedError";
+};
+function unwrapErrorMessage(message) {
+	return typeof message === "function" ? message() : message ?? "";
+}
+/**
+* Uses chrome's non-standard Error.captureStackTrace to set the top of the stack
+* trace to start from the caller of the supplied function {@param f}.
+* Useful in assertion functions to make sure that the stack trace shows the spot
+* where the assertion failed, not the place where the assertion was thrown.
+*/
+function throwAtCaller(f, ex) {
+	if (Error.captureStackTrace) Error.captureStackTrace(ex, f);
+	throw ex;
+}
+
+//#endregion
+//#region src/cookies.ts
+function parseCookieHeader(header) {
+	const cookies = {};
+	if (!header) return cookies;
+	for (const pair of header.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator === -1) continue;
+		const name = pair.slice(0, separator).trim();
+		if (name.length === 0) continue;
+		cookies[name] = decode(pair.slice(separator + 1).trim());
+	}
+	return cookies;
+}
+function decode(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+function readRequestCookies() {
+	return parseCookieHeader(getRequestHeader("cookie"));
+}
+function serializeCookie(name, value, { maxAge, secure }) {
+	if (name.startsWith("__Host-") && !secure) throw new Error(`Refusing to write ${name} without Secure: a __Host- cookie is only valid when Secure, Path=/ and free of Domain, and a browser silently discards one that is not.`);
+	const parts = [
+		`${name}=${encodeURIComponent(value)}`,
+		"Path=/",
+		"HttpOnly"
+	];
+	if (secure) parts.push("Secure");
+	parts.push("SameSite=Lax", `Max-Age=${maxAge}`);
+	return parts.join("; ");
+}
+function writeCookies(cookies) {
+	if (cookies.length === 0) return;
+	setResponseHeader("Set-Cookie", [...getResponseHeaders().getSetCookie(), ...cookies]);
+}
+
+//#endregion
+//#region src/auth/config.ts
+const DEFAULT_SESSION_MAX_AGE = 2160 * 60 * 60;
+/** 32 bytes, hex encoded. */
+const SESSION_SECRET = /^[0-9a-f]{64}$/i;
+function loadSessionConfig() {
+	const missing = [];
+	const applicationId = process.env.SOFTR_APPLICATION_ID;
+	if (!applicationId) missing.push("SOFTR_APPLICATION_ID");
+	const sessionSecret = process.env.SOFTR_SESSION_SECRET;
+	if (!sessionSecret) missing.push("SOFTR_SESSION_SECRET");
+	const platformApiUrl = process.env.SOFTR_PLATFORM_API_URL;
+	if (!platformApiUrl) missing.push("SOFTR_PLATFORM_API_URL");
+	if (missing.length > 0) throw new Error(`Softr auth is not configured: missing ${missing.join(", ")}.`);
+	assert(applicationId && sessionSecret && platformApiUrl);
+	if (!SESSION_SECRET.test(sessionSecret)) throw new Error("SOFTR_SESSION_SECRET must be 32 random bytes encoded as hex.\nGenerate one with:  openssl rand -hex 32");
+	const rawMaxAge = process.env.SOFTR_SESSION_MAX_AGE;
+	let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
+	if (rawMaxAge) {
+		sessionMaxAge = Number(rawMaxAge);
+		if (!Number.isInteger(sessionMaxAge) || sessionMaxAge <= 0) throw new Error(`SOFTR_SESSION_MAX_AGE must be a positive whole number of seconds, got "${rawMaxAge}".`);
+	}
+	return {
+		applicationId,
+		sessionSecret,
+		platformApiUrl,
+		sessionMaxAge
+	};
+}
+let cached;
+function sessionConfig() {
+	cached ??= loadSessionConfig();
+	return cached;
+}
+
+//#endregion
+//#region src/auth/me.ts
+/**
+* `null` means the platform refused the token — any 4xx, because `/me` answers
+* 400 rather than 401 for an expired one, so only the class of the status is
+* informative. Anything else that is not a 200 throws.
+*/
+async function fetchVisitor(token) {
+	const config = sessionConfig();
+	const response = await fetch(`${config.platformApiUrl}/v1/applications/${config.applicationId}/users/me`, {
+		method: "GET",
+		headers: {
+			authorization: `Bearer ${token}`,
+			accept: "application/json"
+		}
+	});
+	if (response.status >= 400 && response.status < 500) return null;
+	if (!response.ok) throw new Error(`Softr platform did not answer /me: ${response.status} ${response.statusText}`.trim());
+	return toUser(await response.json());
+}
+const meSchema = z.object({
+	id: z.string(),
+	full_name: z.string().nullish(),
+	credentials: z.object({ email: z.string().nullish() }).nullish()
+});
+function toUser(body) {
+	const me = meSchema.safeParse(body);
+	if (!me.success) throw new Error(`Softr platform answered /me with something that is not a user: ${z.prettifyError(me.error)}`);
+	return {
+		id: me.data.id,
+		email: me.data.credentials?.email ?? "",
+		name: me.data.full_name ?? "",
+		userGroupIds: []
+	};
+}
+
+//#endregion
+//#region src/auth/session.ts
+const SESSION_TOKEN = "session_token";
+const SESSION_DATA = "session_data";
+const SESSION_DATA_TTL_SECONDS = 300;
+/**
+* A browser refuses a `__Host-` cookie unless it is `Secure`, `Path=/` and free
+* of `Domain` — that last clause is the one worth having, since it stops a
+* sibling host planting a cookie of this name for us to honour.
+*/
+const HOST_PREFIX = "__Host-";
+function requestIsSecure() {
+	return getRequestProtocol() === "https";
+}
+function sessionCookie(base) {
+	const secure = requestIsSecure();
+	return {
+		name: secure ? HOST_PREFIX + base : base,
+		secure
+	};
+}
+/** The platform token this request carries, or `null`. */
+function readSessionToken() {
+	const { name } = sessionCookie(SESSION_TOKEN);
+	return openEnvelope(readRequestCookies()[name], SESSION_TOKEN);
+}
+/** The cached visitor for `sessionToken`, or `null` on any kind of miss. */
+function readSessionData(sessionToken) {
+	const { name } = sessionCookie(SESSION_DATA);
+	const payload = parseSessionData(openEnvelope(readRequestCookies()[name], SESSION_DATA));
+	if (payload === null) return null;
+	if (payload.exp <= Math.floor(Date.now() / 1e3)) return null;
+	if (payload.tb !== tokenBinding(sessionToken)) return null;
+	return {
+		id: payload.id,
+		email: payload.email,
+		name: payload.name,
+		userGroupIds: payload.userGroupIds
+	};
+}
+function makeSessionTokenCookie(token) {
+	const { name, secure } = sessionCookie(SESSION_TOKEN);
+	return serializeCookie(name, sealEnvelope(token, SESSION_TOKEN), {
+		maxAge: sessionConfig().sessionMaxAge,
+		secure
+	});
+}
+function makeSessionDataCookie(user, sessionToken) {
+	const { name, secure } = sessionCookie(SESSION_DATA);
+	const payload = {
+		id: user.id,
+		email: user.email,
+		name: user.name,
+		userGroupIds: user.userGroupIds,
+		exp: Math.floor(Date.now() / 1e3) + SESSION_DATA_TTL_SECONDS,
+		tb: tokenBinding(sessionToken)
+	};
+	return serializeCookie(name, sealEnvelope(JSON.stringify(payload), SESSION_DATA), {
+		maxAge: SESSION_DATA_TTL_SECONDS,
+		secure
+	});
+}
+/**
+* Writes rather than returns: a forgotten list would leave the session live.
+*/
+function clearSession() {
+	clearCookies([SESSION_TOKEN, SESSION_DATA]);
+}
+const sessionDataSchema = z.object({
+	id: z.string(),
+	email: z.string(),
+	name: z.string(),
+	userGroupIds: z.array(z.string()),
+	exp: z.number(),
+	tb: z.string()
+});
+/**
+* Both spellings on https: a jar can hold both pairs across a move between
+* schemes, and the one left behind would revive if the scheme changed back.
+*/
+function clearCookies(bases) {
+	const secure = requestIsSecure();
+	writeCookies(bases.flatMap((base) => secure ? [HOST_PREFIX + base, base] : [base]).map((name) => serializeCookie(name, "", {
+		maxAge: 0,
+		secure
+	})));
+}
+/**
+* Over the plaintext token, never the cookie value: that is resealed with a
+* fresh iv on every write, so a binding over its bytes would be a permanent
+* cache miss.
+*/
+function tokenBinding(sessionToken) {
+	return createHash("sha256").update(sessionToken).digest("base64url");
+}
+function parseSessionData(json) {
+	if (json === null) return null;
+	let payload;
+	try {
+		payload = JSON.parse(json);
+	} catch {
+		return null;
+	}
+	const data = sessionDataSchema.safeParse(payload);
+	return data.success ? data.data : null;
+}
+const IV_BYTES = 12;
+const TAG_BYTES = 16;
+/** Iv + one byte of ciphertext + tag. Anything shorter is not ours. */
+const MIN_ENVELOPE_BYTES = IV_BYTES + TAG_BYTES + 1;
+/**
+* `Buffer.from(…, "base64url")` skips stray characters rather than throwing.
+*/
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/**
+* One key for both cookies. The application id goes in with the secret so a
+* cookie from staging is inert in production even when the two share a secret.
+*/
+function sessionKey() {
+	const { applicationId, sessionSecret } = sessionConfig();
+	return createHash("sha256").update(Buffer.from(sessionSecret, "hex")).update(applicationId).digest();
+}
+/**
+* `base64url(iv ‖ ct ‖ tag)`, sealed with AES-256-GCM — an AEAD, so opening
+* throws on a single flipped bit and needs no separate signature. The iv must
+* be fresh per seal: nonce reuse under one key leaks the payloads and the
+* authentication subkey.
+*
+* The purpose is bound in as additional authenticated data rather than by
+* giving each cookie a key of its own: one key, and a `session_data` value
+* moved into the token slot then fails to open at all instead of opening into
+* a later field check.
+*/
+function sealEnvelope(payload, purpose) {
+	const iv = randomBytes(IV_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", sessionKey(), iv);
+	cipher.setAAD(Buffer.from(purpose));
+	const sealed = Buffer.concat([cipher.update(payload, "utf8"), cipher.final()]);
+	return Buffer.concat([
+		iv,
+		sealed,
+		cipher.getAuthTag()
+	]).toString("base64url");
+}
+/** `null` for anything that is not one of ours, with no reason attached. */
+function openEnvelope(raw, purpose) {
+	if (!raw || !BASE64URL.test(raw)) return null;
+	try {
+		const bytes = Buffer.from(raw, "base64url");
+		if (bytes.length < MIN_ENVELOPE_BYTES) return null;
+		const decipher = createDecipheriv("aes-256-gcm", sessionKey(), bytes.subarray(0, IV_BYTES));
+		decipher.setAAD(Buffer.from(purpose));
+		decipher.setAuthTag(bytes.subarray(bytes.length - TAG_BYTES));
+		return Buffer.concat([decipher.update(bytes.subarray(IV_BYTES, bytes.length - TAG_BYTES)), decipher.final()]).toString("utf8");
+	} catch {
+		return null;
+	}
+}
+
+//#endregion
+export { readSessionToken as a, writeCookies as c, softAssert as d, todo as f, readSessionData as i, assert as l, makeSessionDataCookie as n, fetchVisitor as o, makeSessionTokenCookie as r, sessionConfig as s, clearSession as t, panic as u };

package/dist/user-D23hwTsf.d.ts

@@ -0,0 +1,28 @@
+//#region src/auth/user.d.ts
+/**
+ * Declare this interface in your app to narrow every group id the SDK takes and
+ * returns. Without a declaration, a group id is a plain `string`.
+ *
+ * @example
+ * declare module "@softr/sdk" {
+ *   interface SoftrUserGroups {
+ *     ids:
+ *       | "b1f2c3d4-5e6f-4a7b-8c9d-0e1f2a3b4c5d"
+ *       | "f9e8d7c6-5b4a-4938-8271-605f4e3d2c1b"
+ *   }
+ * }
+ */
+interface SoftrUserGroups {}
+/** A Softr user group id, narrowed to your own ids if you declare {@link SoftrUserGroups}. */
+type SoftrUserGroupId = SoftrUserGroups extends {
+  ids: infer Id extends string;
+} ? Id : string;
+/** The signed-in visitor. */
+type User = {
+  id: string;
+  email: string;
+  name: string;
+  userGroupIds: Array<SoftrUserGroupId>;
+};
+//#endregion
+export { SoftrUserGroups as n, User as r, SoftrUserGroupId as t };

package/dist/vite.d.ts

@@ -1,5 +1,5 @@
 import "@tanstack/router-generator";
-import { Plugin } from "vite";
+import { PluginOption } from "vite";
 
 //#region src/routes/discover.d.ts
 
@@ -25,7 +25,10 @@ type Manifest = {
 declare const MANIFEST_RELATIVE_PATH: string;
 /** Writes `<root>/dist/routes.json` and returns its path. Throws on a rule it cannot read. */
 declare function generateManifest(root: string): Promise<string>;
-/** Plugin order does not matter: this puts nothing into the module graph. */
-declare function softr(): Plugin;
+/**
+ * Everything Softr adds to an app's Vite config: the build-time routes manifest, plus the studio
+ * edit engine when the pod supplies one.
+ */
+declare function softr(): PluginOption[];
 //#endregion
 export { MANIFEST_RELATIVE_PATH, type Manifest, type ManifestNode, generateManifest, softr };