@softr/sdk 0.0.63-alpha.0 → 0.0.64-alpha.0

package/dist/core/use-file-upload.d.ts

@@ -1,4 +1,4 @@
-import { CommentsAction, DatasourceAction } from "../action.js";
+import { DatasourceAction } from "../action.js";
 import { FileAttachment } from "./file-upload.js";
 
 //#region src/core/use-file-upload.d.ts
@@ -16,7 +16,7 @@ type FileItem = {
   filename: string;
   error: Error;
 };
-declare function useFileUpload(action: DatasourceAction | CommentsAction, options?: {
+declare function useFileUpload(action: DatasourceAction, options?: {
   initialAttachments?: FileAttachment[];
 }): {
   files: FileItem[];

package/dist/datasource/record.js

@@ -5,7 +5,7 @@ import { readSessionToken } from "../auth/session.js";
 import { isDatasourceAction } from "../action.js";
 import { buildFilterCriteria, buildOrderBy, dealiasFilterCriteria, dealiasOrderBy } from "./filter.js";
 import { andAll, makeFieldSet, makeSortSet } from "./fields.js";
-import { getRequestHeader } from "@tanstack/react-start/server";
+import { getRequestHeader, getRequestUrl } from "@tanstack/react-start/server";
 
 //#region src/datasource/record.ts
 const MAX_RECORD_COUNT = 100;
@@ -17,13 +17,19 @@ const dsUrl = (actionId) => {
 	return `${withoutTrailingSlash(datasourceApiUrl)}/v1/datasource/vibe/applications/${applicationId}/actions/${actionId}`;
 };
 /**
-* The datasource API wants to know which page made the call.
-* The browser sends that page to the app server, so we pass it on.
-* Without an incoming Referer, we send none.
+* The datasource API wants to know which page made the call, and rejects a call without it.
+*
+* A call from the browser has a Referer on this app's origin, and that Referer names the page.
+* A page load has the previous page as its Referer: Studio, or none for a pasted link.
+* There the page is the request itself, so we send the request URL.
 */
 function refererHeader() {
+	const page = getRequestUrl({
+		xForwardedHost: true,
+		xForwardedProto: true
+	});
 	const referer = getRequestHeader("referer");
-	return referer ? { Referer: referer } : {};
+	return { Referer: referer !== void 0 && URL.parse(referer)?.origin === page.origin ? referer : page.href };
 }
 async function describeFailure(res) {
 	const body = await res.json().catch(() => null);

package/dist/default-error-overlay.d.ts

@@ -1,4 +1,4 @@
-import * as react5 from "react";
+import * as react6 from "react";
 
 //#region src/default-error-overlay.d.ts
 type Props = {
@@ -8,6 +8,6 @@ type Props = {
 declare function DefaultErrorOverlay({
   error,
   reset
-}: Props): react5.JSX.Element;
+}: Props): react6.JSX.Element;
 //#endregion
 export { DefaultErrorOverlay };

package/dist/formatting.d.ts

@@ -1,4 +1,4 @@
-import * as react1 from "react";
+import * as react0 from "react";
 import { ReactNode } from "react";
 import { z } from "zod";
 
@@ -94,7 +94,7 @@ declare function FormattingScope({
   /** A BCP 47 locale, such as `de-DE`. It drops the app's fixed date format inside the scope. */
   locale?: string;
   children?: ReactNode;
-}): react1.FunctionComponentElement<react1.ProviderProps<Scope>>;
+}): react0.FunctionComponentElement<react0.ProviderProps<Scope>>;
 /**
  * A date in the app's format, safe to render on the server. A timestamp whose
  * zone is not known yet renders `fallback` until the browser supplies it, so
@@ -115,6 +115,6 @@ declare function FormattedDate({
   time?: boolean;
   /** What renders while the visitor's zone is unknown. */
   fallback?: ReactNode;
-}): react1.FunctionComponentElement<react1.FragmentProps>;
+}): react0.FunctionComponentElement<react0.FragmentProps>;
 //#endregion
 export { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting };

package/dist/index.d.ts

@@ -1,16 +1,16 @@
 import { SoftrUserGroupId, SoftrUserGroups, User } from "./auth/user.js";
-import { ActionPermissions, SoftrDatasources, defineComments, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { ActionPermissions, SoftrDatasources, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { FileAttachment } from "./core/file-upload.js";
 import { FileItem, useFileUpload } from "./core/use-file-upload.js";
-import { CommentAttachmentInput, CommentMention, CommentThread, CommentView } from "./comments/comments.js";
 import { DateOptions, DateParts, DateSeparator, DateValue, FixedDateFormat, FormattedDate, Formatting, FormattingScope, WeekDay, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrContext } from "./auth/context.js";
+import { AuthSettings } from "./auth/platform.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
-import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
-import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
+import { AuthOptions, AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { PwaInstall, PwaPlatform, SoftrPwaHead, usePwaInstall } from "./pwa.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
-export { type ActionPermissions, Audience, type CommentAttachmentInput, type CommentMention, type CommentThread, type CommentView, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, checkAccess, defineComments, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { type ActionPermissions, Audience, type AuthOptions, type AuthSettings, AuthSettingsProvider, type DateOptions, type DateParts, type DateSeparator, type DateValue, DefaultErrorOverlay, type FileAttachment, type FileItem, type FixedDateFormat, FormattedDate, type Formatting, FormattingScope, type PwaInstall, type PwaPlatform, type SoftrContext, type SoftrDatasources, SoftrPwaHead, type SoftrUserGroupId, type SoftrUserGroups, type User, type WeekDay, assertRouteAccess, authRedirectTarget, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/index.js

@@ -1,13 +1,13 @@
 import { useFileUpload } from "./core/use-file-upload.js";
-import { defineComments, defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
+import { defineIntegration, defineMutation, defineQuery, defineWorkflow } from "./action.js";
 import { checkAccess, defineVisibility, isAuthorized } from "./visibility/visibility.js";
-import { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
+import { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError } from "./visibility/route.js";
 import { FormattedDate, FormattingScope, formatDate, formatDateTime, formatNumber, useFormatting } from "./formatting.js";
 import { SoftrPwaHead, usePwaInstall } from "./pwa.js";
-import { getSoftrContext, initialSoftrContext, softrAuthMiddleware, useCurrentUser } from "./auth/isomorphic.js";
+import { AuthSettingsProvider, getAuthSettings, getSoftrContext, initialSoftrContext, softrAuthMiddleware, useAuthSettings, useCurrentUser } from "./auth/isomorphic.js";
 import { softrMcpMiddleware } from "./mcp.js";
 import { useUserTimezone } from "./timezone.js";
 import { DefaultErrorOverlay } from "./default-error-overlay.js";
 import { Audience } from "./visibility/audience.js";
 
-export { Audience, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, checkAccess, defineComments, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };
+export { Audience, AuthSettingsProvider, DefaultErrorOverlay, FormattedDate, FormattingScope, SoftrPwaHead, assertRouteAccess, authRedirectTarget, checkAccess, defineIntegration, defineMutation, defineQuery, defineVisibility, defineWorkflow, formatDate, formatDateTime, formatNumber, getAuthSettings, getSoftrContext, guardRoute, initialSoftrContext, isAccessError, isAlreadyAuthenticatedError, isAuthorized, isForbiddenError, isUnauthenticatedError, softrAuthMiddleware, softrMcpMiddleware, useAuthSettings, useCurrentUser, useFileUpload, useFormatting, usePwaInstall, useUserTimezone };

package/dist/mcp.d.ts

@@ -1,5 +1,5 @@
 import { DatasourceAction } from "./action.js";
-import * as _tanstack_react_start3 from "@tanstack/react-start";
+import * as _tanstack_react_start4 from "@tanstack/react-start";
 
 //#region src/mcp.d.ts
 
@@ -12,12 +12,6 @@ type SoftrMcpOptions = {
    * decide who may run the ones that are listed.
    */
   actions?: Array<DatasourceAction>;
-  /**
-   * The app's sign-in page, as a path on this app. A signed-out visitor who
-   * opens the approval page is sent here with `?redirect=` pointing back at it.
-   * Defaults to `/login`.
-   */
-  loginPath?: string;
 };
 /**
  * Serves the MCP endpoint and its OAuth flow from the app's own origin.
@@ -37,6 +31,6 @@ type SoftrMcpOptions = {
  *   ],
  * }))
  */
-declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start3.RequestMiddlewareAfterServer<{}, undefined, undefined>;
+declare function softrMcpMiddleware(options?: SoftrMcpOptions): _tanstack_react_start4.RequestMiddlewareAfterServer<{}, undefined, undefined>;
 //#endregion
 export { softrMcpMiddleware };

package/dist/mcp.js

@@ -4,6 +4,7 @@ import { sessionConfig } from "./auth/config.js";
 import { readSessionToken, withSessionToken } from "./auth/session.js";
 import { makePlatform, platformApiUrl } from "./auth/platform.js";
 import { isDatasourceAction } from "./action.js";
+import { softrConfig } from "./visibility/route.js";
 import { ds } from "./datasource/datasource.js";
 import { createMiddleware } from "@tanstack/react-start";
 import { z } from "zod";
@@ -38,8 +39,7 @@ const SUPPORTED_PROTOCOL_VERSIONS = ["2025-06-18", "2025-03-26"];
 * }))
 */
 function softrMcpMiddleware(options = {}) {
-	const loginPath = options.loginPath ?? "/login";
-	assert(loginPath.startsWith("/") && new URL(loginPath, "https://app.invalid").origin === "https://app.invalid", `softrMcpMiddleware's loginPath must be a path on this app, got "${loginPath}"`);
+	const login = softrConfig().auth.routes.login;
 	const actions = /* @__PURE__ */ new Map();
 	for (const action of options.actions ?? []) {
 		assert(isDatasourceAction(action), "softrMcpMiddleware takes actions built by defineQuery or defineMutation");
@@ -68,7 +68,7 @@ function softrMcpMiddleware(options = {}) {
 				client_id_metadata_document_supported: true,
 				scopes_supported: SCOPES
 			});
-			case AUTHORIZE_PATH: return await authorize(request, loginPath);
+			case AUTHORIZE_PATH: return await authorize(request, login);
 			case TOKEN_PATH: return await issueToken(request);
 			case MCP_PATH: return await rpc(request, origin, actions);
 			default: return await next();
@@ -92,14 +92,14 @@ const authorizeQuerySchema = z.object({
 * because this runs on the app's origin. The client and the code are the
 * platform's, so we ask it for both.
 */
-async function authorize(request, loginPath) {
+async function authorize(request, login) {
 	const url = new URL(request.url);
 	const query = authorizeQuerySchema.safeParse(Object.fromEntries(url.searchParams));
 	if (!query.success) return html(400, page("This request is not valid", "The app that sent you here left something out. Close this window and try connecting again."));
 	if (request.method !== "GET" && request.method !== "POST") return methodNotAllowed("GET, POST");
 	const sessionToken = readSessionToken();
 	const user = sessionToken === null ? null : await resolveUser(sessionToken);
-	if (user === null || sessionToken === null) return html(200, signInPage(url, loginPath));
+	if (user === null || sessionToken === null) return html(200, signInPage(url, login));
 	const client = await platformConsent(query.data);
 	if (!client.ok) return html(400, page("We can't connect this right now", escapeHtml(client.message)));
 	if (request.method === "GET") return html(200, consentPage(user, url, client.name));
@@ -539,9 +539,9 @@ function consentPage(user, url, clientName) {
        <button type="submit" name="decision" value="deny">Cancel</button>
      </form>`);
 }
-function signInPage(url, loginPath) {
-	const back = encodeURIComponent(url.pathname + url.search);
-	return page("Sign in first", "You need to be signed in to this app before you can connect an assistant to it.", `<a class="primary" href="${escapeHtml(loginPath)}?redirect=${back}">Sign in</a>`);
+function signInPage(url, login) {
+	const back = new URLSearchParams({ [login.redirectParam]: url.pathname + url.search });
+	return page("Sign in first", "You need to be signed in to this app before you can connect an assistant to it.", `<a class="primary" href="${escapeHtml(`${login.path}?${back}`)}">Sign in</a>`);
 }
 function page(title, body, actions = "") {
 	return `<!doctype html>

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.0.63-alpha.0";
+var version = "0.0.64-alpha.0";
 
 //#endregion
 export { version };

package/dist/pwa.d.ts

@@ -1,4 +1,4 @@
-import * as react0 from "react";
+import * as react4 from "react";
 import "@tanstack/react-start";
 
 //#region src/pwa.d.ts
@@ -23,7 +23,7 @@ import "@tanstack/react-start";
  *   )
  * }
  */
-declare function SoftrPwaHead(): react0.FunctionComponentElement<react0.FragmentProps>;
+declare function SoftrPwaHead(): react4.FunctionComponentElement<react4.FragmentProps>;
 type PwaPlatform = "ios" | "android" | "desktop";
 type PwaInstall = {
   available: false;

package/dist/server.d.ts

@@ -1,8 +1,7 @@
 import { upload } from "./core/file-upload.js";
-import { comments } from "./comments/comments.js";
 import { auth } from "./auth/server.js";
 import { ds } from "./datasource/datasource.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
 import "@tanstack/react-start/server-only";
-export { auth, comments, ds, integration, upload, workflow };
+export { auth, ds, integration, upload, workflow };

package/dist/server.js

@@ -3,7 +3,6 @@ import { ds } from "./datasource/datasource.js";
 import { auth } from "./auth/server.js";
 import { workflow } from "./core/workflow.js";
 import { integration } from "./core/integration.js";
-import { comments } from "./comments/comments.js";
 import "@tanstack/react-start/server-only";
 
-export { auth, comments, ds, integration, upload, workflow };
+export { auth, ds, integration, upload, workflow };

package/dist/softr-config.d.ts

@@ -0,0 +1 @@
+import { z } from "zod";

package/dist/softr-config.js

@@ -9,11 +9,32 @@ const AccessBehaviour = z.union([
 	}),
 	z.object({ strategy: z.literal("throw") })
 ], { error: "must be a path like \"/login\", { \"strategy\": \"redirect\", \"to\": \"/login\" } or { \"strategy\": \"throw\" }" });
-const SoftrConfigSchema = z.object({ auth: z.strictObject({ guard: z.strictObject({
-	unauthenticated: AccessBehaviour,
-	forbidden: AccessBehaviour,
-	alreadyAuthenticated: AccessBehaviour
-}) }) });
+const AppPath = z.string().refine((path) => path.startsWith("/") && !path.includes("?") && !path.includes("#") && new URL(path, "https://app.invalid").origin === "https://app.invalid", { error: "must be a path on this app like \"/login\", with no \"?\" or \"#\"" });
+const SoftrConfigSchema = z.object({ auth: z.strictObject({
+	routes: z.strictObject({
+		login: z.strictObject({
+			path: AppPath,
+			redirectParam: z.string()
+		}),
+		resetPassword: z.strictObject({
+			path: AppPath,
+			tokenParam: z.string()
+		}),
+		acceptInvitation: z.strictObject({
+			path: AppPath,
+			tokenParam: z.string()
+		}),
+		magicLink: z.strictObject({
+			path: AppPath,
+			tokenParam: z.string()
+		})
+	}),
+	guard: z.strictObject({
+		unauthenticated: AccessBehaviour,
+		forbidden: AccessBehaviour,
+		alreadyAuthenticated: AccessBehaviour
+	})
+}) });
 
 //#endregion
 export { SoftrConfigSchema };

package/dist/visibility/route.d.ts

@@ -1,4 +1,5 @@
 import { AccessContext, AccessReason, Narrowed, Visibility, VisibilityRule } from "./visibility.js";
+import "../softr-config.js";
 
 //#region src/visibility/route.d.ts
 
@@ -46,7 +47,8 @@ declare function isAlreadyAuthenticatedError(error: unknown): error is AccessErr
  * A `beforeLoad` handler that denies a visitor who fails the rule.
  *
  * Each reason falls back to the app's configured behaviour. Pass `overrides` to
- * change what any one reason does.
+ * change what any one reason does. A redirected signed-out visitor carries the
+ * page they wanted, for {@link authRedirectTarget} to read back.
  *
  * Throws a router redirect, so it belongs in `beforeLoad` and nowhere else.
  *
@@ -55,17 +57,35 @@ declare function isAlreadyAuthenticatedError(error: unknown): error is AccessErr
  */
 declare function guardRoute(visibility: Visibility, overrides?: GuardOverrides): (opts: {
   context: AccessContext;
+  location: {
+    href: string;
+  };
 }) => void;
 /**
  * Throws what {@link guardRoute} would, for a `beforeLoad` that runs its own
  * checks after the rule. It takes no overrides.
  *
  * @example
- * beforeLoad: ({ context, params }) => {
- *   assertRouteAccess(visibility, context)
- *   if (params.projectId === "demo") throw redirect({ to: "/projects" })
+ * beforeLoad: (opts) => {
+ *   assertRouteAccess(visibility, opts)
+ *   if (opts.params.projectId === "demo") throw redirect({ to: "/projects" })
  * }
  */
-declare function assertRouteAccess<R extends VisibilityRule>(visibility: Visibility<R>, context: AccessContext): asserts context is Narrowed<R>;
+declare function assertRouteAccess<R extends VisibilityRule, O extends {
+  context: AccessContext;
+  location: {
+    href: string;
+  };
+}>(visibility: Visibility<R>, opts: O): asserts opts is O & {
+  context: Narrowed<R>;
+};
+/**
+ * Where to send a visitor who just signed in: the path a guard sent them away
+ * from, or `home`. Anything but a path on this app is `home`.
+ *
+ * @example
+ * const target = authRedirectTarget(useLocation({ select: (l) => l.search }), "/")
+ */
+declare function authRedirectTarget(search: Record<string, unknown>, home: string): string;
 //#endregion
-export { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError };
+export { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError };

package/dist/visibility/route.js

@@ -32,14 +32,24 @@ function isForbiddenError(error) {
 function isAlreadyAuthenticatedError(error) {
 	return isReason(error, "alreadyAuthenticated");
 }
+function softrConfig() {
+	return typeof __SOFTR_CONFIG__ === "undefined" ? panic("softr.json is missing") : __SOFTR_CONFIG__;
+}
 /** What a guard throws for a reason: a redirect, or an {@link AccessError}. */
-function thrownFor(reason, overrides) {
-	const behaviour = overrides?.[reason] ?? (typeof __SOFTR_CONFIG__ === "undefined" ? panic("softr.json is missing, so no guard behaviour is configured") : __SOFTR_CONFIG__.auth.guard[reason]);
+function thrownFor(reason, overrides, location) {
+	const behaviour = overrides?.[reason] ?? softrConfig().auth.guard[reason];
 	const resolved = typeof behaviour === "string" ? {
 		strategy: "redirect",
 		to: behaviour
 	} : behaviour;
-	if (resolved.strategy === "redirect") return redirect({ to: resolved.to });
+	if (resolved.strategy === "redirect") {
+		if (reason !== "unauthenticated") return redirect({ to: resolved.to });
+		const { redirectParam } = softrConfig().auth.routes.login;
+		return redirect({
+			to: resolved.to,
+			search: { [redirectParam]: location.href }
+		});
+	}
 	return {
 		type: "access_error",
 		reason
@@ -49,7 +59,8 @@ function thrownFor(reason, overrides) {
 * A `beforeLoad` handler that denies a visitor who fails the rule.
 *
 * Each reason falls back to the app's configured behaviour. Pass `overrides` to
-* change what any one reason does.
+* change what any one reason does. A redirected signed-out visitor carries the
+* page they wanted, for {@link authRedirectTarget} to read back.
 *
 * Throws a router redirect, so it belongs in `beforeLoad` and nowhere else.
 *
@@ -57,10 +68,10 @@ function thrownFor(reason, overrides) {
 * beforeLoad: guardRoute(visibility, { unauthenticated: "/sign-in" })
 */
 function guardRoute(visibility, overrides) {
-	return ({ context }) => {
+	return ({ context, location }) => {
 		const result = checkAccess(visibility, context);
 		if (result.ok) return;
-		throw thrownFor(result.reason, overrides);
+		throw thrownFor(result.reason, overrides, location);
 	};
 }
 /**
@@ -68,16 +79,28 @@ function guardRoute(visibility, overrides) {
 * checks after the rule. It takes no overrides.
 *
 * @example
-* beforeLoad: ({ context, params }) => {
-*   assertRouteAccess(visibility, context)
-*   if (params.projectId === "demo") throw redirect({ to: "/projects" })
+* beforeLoad: (opts) => {
+*   assertRouteAccess(visibility, opts)
+*   if (opts.params.projectId === "demo") throw redirect({ to: "/projects" })
 * }
 */
-function assertRouteAccess(visibility, context) {
-	const result = checkAccess(visibility, context);
+function assertRouteAccess(visibility, opts) {
+	const result = checkAccess(visibility, opts.context);
 	if (result.ok) return;
-	throw thrownFor(result.reason, void 0);
+	throw thrownFor(result.reason, void 0, opts.location);
+}
+/**
+* Where to send a visitor who just signed in: the path a guard sent them away
+* from, or `home`. Anything but a path on this app is `home`.
+*
+* @example
+* const target = authRedirectTarget(useLocation({ select: (l) => l.search }), "/")
+*/
+function authRedirectTarget(search, home) {
+	const target = search[softrConfig().auth.routes.login.redirectParam];
+	if (typeof target !== "string" || !target.startsWith("/")) return home;
+	return new URL(target, "https://app.invalid").origin === "https://app.invalid" ? target : home;
 }
 
 //#endregion
-export { assertRouteAccess, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError };
+export { assertRouteAccess, authRedirectTarget, guardRoute, isAccessError, isAlreadyAuthenticatedError, isForbiddenError, isUnauthenticatedError, softrConfig };

package/package.json

@@ -1,24 +1,43 @@
 {
   "name": "@softr/sdk",
-  "version": "0.0.63-alpha.0",
+  "version": "0.0.64-alpha.0",
   "type": "module",
   "exports": {
-    ".": { "types": "./dist/index.d.ts", "import": "./dist/index.js" },
-    "./client": { "types": "./dist/client.d.ts", "import": "./dist/client.js" },
-    "./server": { "types": "./dist/server.d.ts", "import": "./dist/server.js" },
-    "./vite": { "types": "./dist/vite.d.ts", "import": "./dist/vite.js" }
-  },
-  "bin": { "softr-sdk": "./dist/cli.js" },
-  "files": ["dist", "schema", "skills", "!skills/_artifacts"],
-  "publishConfig": { "access": "public" },
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./client": {
+      "types": "./dist/client.d.ts",
+      "import": "./dist/client.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./vite": {
+      "types": "./dist/vite.d.ts",
+      "import": "./dist/vite.js"
+    }
+  },
+  "bin": {
+    "softr-sdk": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "skills",
+    "!skills/_artifacts"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
   "scripts": {
     "build": "tsdown",
     "test": "node --import ./src/test-utils/setup.ts --test",
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "marked": "^18.0.14",
-    "xss": "^1.0.15",
     "zod": "^4.4.3"
   },
   "devDependencies": {
@@ -44,7 +63,9 @@
       "optional": true
     }
   },
-  "keywords": ["tanstack-intent"],
+  "keywords": [
+    "tanstack-intent"
+  ],
   "intent": {
     "version": 1,
     "repo": "@softr/sdk",

package/schema/softr.schema.json

@@ -7,6 +7,30 @@
       "type": "object",
       "description": "Authentication. Written in this repo and read by the app's build.",
       "properties": {
+        "routes": {
+          "type": "object",
+          "description": "Where the app's sign-in pages live.",
+          "properties": {
+            "login": {
+              "type": "object",
+              "description": "The sign-in page.",
+              "properties": {
+                "path": { "$ref": "#/$defs/appPath" },
+                "redirectParam": {
+                  "type": "string",
+                  "description": "The search param that carries where to go after signing in. Every unauthenticated redirect sets it."
+                }
+              },
+              "required": ["path", "redirectParam"],
+              "additionalProperties": false
+            },
+            "resetPassword": { "$ref": "#/$defs/tokenRoute", "description": "The page a password reset email links to." },
+            "acceptInvitation": { "$ref": "#/$defs/tokenRoute", "description": "The page an invitation email links to." },
+            "magicLink": { "$ref": "#/$defs/tokenRoute", "description": "The page a magic link email links to." }
+          },
+          "required": ["login", "resetPassword", "acceptInvitation", "magicLink"],
+          "additionalProperties": false
+        },
         "guard": {
           "type": "object",
           "description": "What a route guard does when it denies a visitor. A route's own overrides win over these.",
@@ -28,12 +52,29 @@
           "additionalProperties": false
         }
       },
-      "required": ["guard"],
+      "required": ["routes", "guard"],
       "additionalProperties": false
     }
   },
   "required": ["auth"],
   "$defs": {
+    "appPath": {
+      "type": "string",
+      "pattern": "^/[^?#]*$",
+      "description": "A path on this app, with no search or hash."
+    },
+    "tokenRoute": {
+      "type": "object",
+      "properties": {
+        "path": { "$ref": "#/$defs/appPath" },
+        "tokenParam": {
+          "type": "string",
+          "description": "The search param that carries the link's token."
+        }
+      },
+      "required": ["path", "tokenParam"],
+      "additionalProperties": false
+    },
     "accessBehaviour": {
       "oneOf": [
         { "type": "string", "description": "A path to redirect to." },

package/skills/softr-sdk/SKILL.md

@@ -6,12 +6,13 @@ description: >-
   boundary between them, softrAuthMiddleware, getSoftrContext,
   initialSoftrContext, SoftrContext, and which sub-skill to load for route
   visibility, the current user, reading records, charts and metrics, writing
-  records, auth, or showing dates and numbers. Load this when unsure which sub-skill applies, or when
-  touching the wiring; each sub-skill stands alone for its own task.
+  records, auth, or showing dates and numbers. Load this when unsure which
+  sub-skill applies, or when touching the wiring; each sub-skill stands alone
+  for its own task.
 metadata:
   type: core
   library: softr-sdk
-  library_version: 0.0.63-alpha.0
+  library_version: 0.0.64-alpha.0
 ---
 
 # Softr SDK core
@@ -29,9 +30,9 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 
 | Import | Runs | Holds |
 | --- | --- | --- |
-| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineComments`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
-| `@softr/sdk/server` | Server only | `ds`, `auth`, `workflow`, `integration`, `comments` |
-| `@softr/sdk/client` | Browser only | `useCommentComposer` |
+| `@softr/sdk` | Both | `defineQuery`, `defineMutation`, `defineVisibility`, `guardRoute`, `assertRouteAccess`, `isAuthorized`, `checkAccess`, `Audience`, `useCurrentUser`, `useUserTimezone`, `FormattedDate`, `FormattingScope`, `useFormatting`, `formatDate`, `formatDateTime`, `formatNumber`, `SoftrPwaHead`, `usePwaInstall`, `getSoftrContext`, `initialSoftrContext`, `softrAuthMiddleware`, the error predicates, and every type |
+| `@softr/sdk/server` | Server only | `ds`, `auth`, `workflow`, `integration` |
+| `@softr/sdk/client` | Browser only | Nothing yet, reserved for browser-only utilities |
 | `@softr/sdk/vite` | Build | `softr()`, already in `vite.config.ts` |
 
 ## Sub-Skills
@@ -50,7 +51,6 @@ Each sub-skill stands alone for its task and repeats the boundary above, so most
 | Open the app to AI assistants over MCP | [mcp/SKILL.md](./mcp/SKILL.md) |
 | Let visitors install the app on their home screen | [pwa/SKILL.md](./pwa/SKILL.md) |
 | Show a date, a time or a number | [formatting/SKILL.md](./formatting/SKILL.md) |
-| Add comments to a record | [comments/SKILL.md](./comments/SKILL.md) |
 
 ## Quick Decision Tree
 
@@ -91,9 +91,6 @@ Adding an install button, or making the app installable?
 Showing a date, a time or a number on a page?
   load softr-sdk/formatting
 
-Letting visitors comment on a record?
-  load softr-sdk/comments
-
 Writing a server function, loader, or middleware in general?
   not a Softr concern. Use the TanStack Start skills.
 ```